netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-fx4w-v43j-vc45
GHSA-q7pp-wcgr-pffx
GHSA-xgmm-3vvr-6c8j
GHSA-4h5h-p23f-hjqf
GHSA-xgj4-2hrf-j4xg
GHSA-q7pp-wcgr-pffx
GHSA-xgmm-3vvr-6c8j
This commit is contained in:
advisory-database[bot]
2024-03-21 18:58:57 +00:00
parent cfc7e09076
commit 5cf8855bec
7 changed files with 204 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/07/GHSA-fx4w-v43j-vc45/GHSA-fx4w-v43j-vc45.json → advisories/github-reviewed/2022/07/GHSA-fx4w-v43j-vc45/GHSA-fx4w-v43j-vc45.json
+24 -5
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fx4w-v43j-vc45",
"modified": "2022-07-14T00:00:19Z",
"modified": "2024-03-21T18:57:32Z",
"published": "2022-07-05T00:00:54Z",
"aliases": [
"CVE-2022-33171"
],
"details": "** DISPUTED ** The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation.",
"summary": "SQL injection in typeORM",
"details": "The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection. NOTE: the vendor's position is that the user's application is responsible for input validation.",
"severity": [
{
"type": "CVSS_V3",
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "typeorm"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.0"
}
]
}
]
}
],
"references": [
{
@@ -43,8 +62,8 @@
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-03-21T18:57:32Z",
"nvd_published_at": "2022-07-04T16:15:00Z"
}
}
advisories/github-reviewed/2023/09/GHSA-q7pp-wcgr-pffx/GHSA-q7pp-wcgr-pffx.json
+62
View File
@@ -0,0 +1,62 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q7pp-wcgr-pffx",
"modified": "2024-03-21T18:57:46Z",
"published": "2023-09-05T06:30:14Z",
"aliases": [
"CVE-2023-36308"
],
"summary": "Crash when processing crafted TIFF files",
"details": "Disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a crafted TIFF file to the scan function of scanner.go. NOTE: it is unclear whether there are common use cases in which this panic could have any security consequence",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/disintegration/imaging"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.6.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36308"
},
{
"type": "WEB",
"url": "https://github.com/disintegration/imaging/issues/165"
},
{
"type": "WEB",
"url": "https://github.com/disintegration/imaging/releases/tag/v1.6.2"
},
{
"type": "PACKAGE",
"url": "github.com/disintegration/imaging"
}
],
"database_specific": {
"cwe_ids": [
"CWE-129"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2024-03-21T18:57:46Z",
"nvd_published_at": "2023-09-05T04:15:08Z"
}
}
advisories/github-reviewed/2023/09/GHSA-xgmm-3vvr-6c8j/GHSA-xgmm-3vvr-6c8j.json
+65
View File
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xgmm-3vvr-6c8j",
"modified": "2024-03-21T18:58:11Z",
"published": "2023-09-05T06:30:14Z",
"aliases": [
"CVE-2023-36307"
],
"summary": "Index out of bounds leading to crash",
"details": "ZPLGFA 1.1.1 allows attackers to cause a panic (because of an integer index out of range during a ConvertToGraphicField call) via an image of zero width. NOTE: it is unclear whether there are common use cases in which this panic could have any security consequence",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "simonwaldherr.de/go/zplgfa"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36307"
},
{
"type": "WEB",
"url": "https://github.com/SimonWaldherr/zplgfa/pull/6"
},
{
"type": "WEB",
"url": "https://github.com/SimonWaldherr/zplgfa/commit/c0d018ffa921cd2460b80f766b7969fbe63678fc"
},
{
"type": "PACKAGE",
"url": "https://github.com/SimonWaldherr/zplgfa"
}
],
"database_specific": {
"cwe_ids": [
"CWE-129"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-03-21T18:58:11Z",
"nvd_published_at": "2023-09-05T05:15:07Z"
}
}
advisories/unreviewed/2024/03/GHSA-4h5h-p23f-hjqf/GHSA-4h5h-p23f-hjqf.json → advisories/github-reviewed/2024/03/GHSA-4h5h-p23f-hjqf/GHSA-4h5h-p23f-hjqf.json
+24 -5
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4h5h-p23f-hjqf",
"modified": "2024-03-21T03:36:44Z",
"modified": "2024-03-21T18:58:23Z",
"published": "2024-03-21T03:36:44Z",
"aliases": [
"CVE-2022-4963"
],
"details": "A vulnerability was found in Folio Spring Module Core up to 1.1.5. It has been rated as critical. Affected by this issue is the function dropSchema of the file tenant/src/main/java/org/folio/spring/tenant/hibernate/HibernateSchemaService.java of the component Schema Name Handler. The manipulation leads to sql injection. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is d374a5f77e6b58e36f0e0e4419be18b95edcd7ff. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-257516.",
"summary": "SQL injection in Folio Spring Module Core",
"details": "A vulnerability was found in Folio Spring Module Core before 2.0.0. Affected by this issue is the function dropSchema of the file tenant/src/main/java/org/folio/spring/tenant/hibernate/HibernateSchemaService.java of the component Schema Name Handler. The manipulation leads to sql injection. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is d374a5f77e6b58e36f0e0e4419be18b95edcd7ff. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-257516.",
"severity": [
{
"type": "CVSS_V3",
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.folio:spring-module-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0"
}
]
}
]
}
],
"references": [
{
@@ -47,8 +66,8 @@
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-03-21T18:58:23Z",
"nvd_published_at": "2024-03-21T02:44:57Z"
}
}
advisories/unreviewed/2024/03/GHSA-xgj4-2hrf-j4xg/GHSA-xgj4-2hrf-j4xg.json → advisories/github-reviewed/2024/03/GHSA-xgj4-2hrf-j4xg/GHSA-xgj4-2hrf-j4xg.json
+29 -6
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xgj4-2hrf-j4xg",
"modified": "2024-03-21T06:33:04Z",
"modified": "2024-03-21T18:58:33Z",
"published": "2024-03-21T06:33:04Z",
"aliases": [
"CVE-2024-28635"
],
"summary": "Cross-site scripting in Survey Creator",
"details": "Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "survey-creator"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.133"
}
]
}
]
}
],
"references": [
{
@@ -22,6 +41,10 @@
"type": "WEB",
"url": "https://github.com/surveyjs/survey-creator/issues/5285"
},
{
"type": "PACKAGE",
"url": "https://github.com/surveyjs/survey-creator"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/2403-exploits/surveyjssurveycreator19132-xss.txt"
@@ -29,11 +52,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-03-21T18:58:33Z",
"nvd_published_at": "2024-03-21T04:15:09Z"
}
}
advisories/unreviewed/2023/09/GHSA-q7pp-wcgr-pffx/GHSA-q7pp-wcgr-pffx.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q7pp-wcgr-pffx",
"modified": "2024-03-21T03:35:41Z",
"published": "2023-09-05T06:30:14Z",
"aliases": [
"CVE-2023-36308"
],
"details": "** DISPUTED ** disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a crafted TIFF file to the scan function of scanner.go. NOTE: it is unclear whether there are common use cases in which this panic could have any security consequence",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36308"
},
{
"type": "WEB",
"url": "https://github.com/disintegration/imaging/issues/165"
},
{
"type": "WEB",
"url": "https://github.com/disintegration/imaging/releases/tag/v1.6.2"
}
],
"database_specific": {
"cwe_ids": [
"CWE-129"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-05T04:15:08Z"
}
}
advisories/unreviewed/2023/09/GHSA-xgmm-3vvr-6c8j/GHSA-xgmm-3vvr-6c8j.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xgmm-3vvr-6c8j",
"modified": "2024-03-21T03:35:41Z",
"published": "2023-09-05T06:30:14Z",
"aliases": [
"CVE-2023-36307"
],
"details": "** DISPUTED ** ZPLGFA 1.1.1 allows attackers to cause a panic (because of an integer index out of range during a ConvertToGraphicField call) via an image of zero width. NOTE: it is unclear whether there are common use cases in which this panic could have any security consequence",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36307"
},
{
"type": "WEB",
"url": "https://github.com/SimonWaldherr/zplgfa/pull/6"
}
],
"database_specific": {
"cwe_ids": [
"CWE-129"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-05T05:15:07Z"
}
}