netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2gcp-xwxg-hqg3
GHSA-7x8g-h246-gvx3
GHSA-97fp-5m87-r9mf
GHSA-hwmc-v6j6-gc2p
This commit is contained in:
advisory-database[bot]
2024-04-24 20:32:44 +00:00
parent 02b6c3e0be
commit 59d4c23bff
4 changed files with 96 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-2gcp-xwxg-hqg3/GHSA-2gcp-xwxg-hqg3.json → advisories/github-reviewed/2022/05/GHSA-2gcp-xwxg-hqg3/GHSA-2gcp-xwxg-hqg3.json
+32 -6
View File
@@ -1,23 +1,49 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2gcp-xwxg-hqg3",
"modified": "2022-05-24T17:27:13Z",
"modified": "2024-04-24T20:31:34Z",
"published": "2022-05-24T17:27:13Z",
"aliases": [
"CVE-2020-14209"
],
"summary": "Dolibarr Unrestricted Upload of File with Dangerous Type",
"details": "Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control (e.g., to let .noexe files be executed as PHP code to defeat the .noexe protection mechanism).",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "11.0.5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14209"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/releases/tag/11.0.5"
@@ -35,9 +61,9 @@
"cwe_ids": [
"CWE-434"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:31:34Z",
"nvd_published_at": "2020-09-02T17:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-7x8g-h246-gvx3/GHSA-7x8g-h246-gvx3.json → advisories/github-reviewed/2022/05/GHSA-7x8g-h246-gvx3/GHSA-7x8g-h246-gvx3.json
+30 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7x8g-h246-gvx3",
"modified": "2022-11-17T18:30:30Z",
"modified": "2024-04-24T20:31:29Z",
"published": "2022-05-24T17:37:06Z",
"aliases": [
"CVE-2020-35136"
],
"summary": "Dolibarr authenticated Remote Code Execution",
"details": "Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr_export.php.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "12.0.4"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 12.0.3"
}
}
],
"references": [
{
@@ -25,6 +47,10 @@
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/4fcd3fe49332baab0e424225ad10b76b47ebcbac"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/releases"
@@ -44,8 +70,8 @@
"CWE-88"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:31:29Z",
"nvd_published_at": "2020-12-23T15:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-97fp-5m87-r9mf/GHSA-97fp-5m87-r9mf.json → advisories/github-reviewed/2022/05/GHSA-97fp-5m87-r9mf/GHSA-97fp-5m87-r9mf.json
+17 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-97fp-5m87-r9mf",
"modified": "2022-11-17T18:30:28Z",
"modified": "2024-04-24T20:31:24Z",
"published": "2022-05-24T16:50:15Z",
"aliases": [
"CVE-2019-1010016"
],
"summary": "Dolibarr Cross Site Scripting (XSS)",
"details": "Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker.",
"severity": [
{
@@ -14,7 +15,15 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"versions": [
"6.0.4"
]
}
],
"references": [
{
@@ -24,6 +33,10 @@
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/issues/7962"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
}
],
"database_specific": {
@@ -31,8 +44,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:31:24Z",
"nvd_published_at": "2019-07-15T03:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-hwmc-v6j6-gc2p/GHSA-hwmc-v6j6-gc2p.json → advisories/github-reviewed/2022/05/GHSA-hwmc-v6j6-gc2p/GHSA-hwmc-v6j6-gc2p.json
+17 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hwmc-v6j6-gc2p",
"modified": "2022-11-17T18:30:28Z",
"modified": "2024-04-24T20:31:20Z",
"published": "2022-05-24T16:50:37Z",
"aliases": [
"CVE-2019-1010054"
],
"summary": "Dolibarr Cross Site Request Forgery (CSRF)",
"details": "Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin access malitious urls.",
"severity": [
{
@@ -14,13 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"versions": [
"7.0.0"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010054"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://github.com/lucasgcilento/CVE/blob/master/Dolibarr_CSRF"
@@ -31,8 +44,8 @@
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:31:20Z",
"nvd_published_at": "2019-07-18T13:15:00Z"
}
}