netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-pm9m-w23q-5967
GHSA-r9mw-gwx9-v3h5
GHSA-pm9m-w23q-5967
This commit is contained in:
advisory-database[bot]
2024-04-23 23:15:07 +00:00
parent 81bed03146
commit 5d3eb9b01e
3 changed files with 214 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json
+130
View File
@@ -0,0 +1,130 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pm9m-w23q-5967",
"modified": "2024-04-23T23:12:50Z",
"published": "2022-05-17T00:26:26Z",
"aliases": [
"CVE-2015-7503"
],
"summary": "Zend Framework Information Disclosure",
"details": "Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendframework"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zend-crypt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.4.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zend-crypt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendframework"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.4.9"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7503"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283137"
},
{
"type": "WEB",
"url": "https://framework.zend.com/security/advisory/ZF2015-10"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-crypt/CVE-2015-7503.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2015-7503.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/zendframework/zendframework"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:12:49Z",
"nvd_published_at": "2017-10-10T16:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-r9mw-gwx9-v3h5/GHSA-r9mw-gwx9-v3h5.json → advisories/github-reviewed/2022/05/GHSA-r9mw-gwx9-v3h5/GHSA-r9mw-gwx9-v3h5.json
+84 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r9mw-gwx9-v3h5",
"modified": "2022-05-14T02:19:49Z",
"modified": "2024-04-23T23:13:14Z",
"published": "2022-05-14T02:19:49Z",
"aliases": [
"CVE-2016-10034"
],
"summary": "zend-mail remote code execution via Sendmail adapter",
"details": "The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11, 2.5.x, 2.6.x, and 2.7.x before 2.7.2, and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\" (backslash double quote) in a crafted e-mail address.",
"severity": [
{
@@ -14,7 +15,82 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zend-mail"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zend-mail"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5"
},
{
"last_affected": "2.5.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zend-mail"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.6"
},
{
"last_affected": "2.6.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zend-mail"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.7"
},
{
"fixed": "2.7.2"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +101,10 @@
"type": "WEB",
"url": "https://framework.zend.com/security/advisory/ZF2016-04"
},
{
"type": "PACKAGE",
"url": "https://github.com/zendframework/zend-mail"
},
{
"type": "WEB",
"url": "https://legalhackers.com/advisories/ZendFramework-Exploit-ZendMail-Remote-Code-Exec-CVE-2016-10034-Vuln.html"
@@ -59,8 +139,8 @@
"CWE-77"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:13:13Z",
"nvd_published_at": "2016-12-30T19:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-pm9m-w23q-5967/GHSA-pm9m-w23q-5967.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pm9m-w23q-5967",
"modified": "2022-05-17T00:26:26Z",
"published": "2022-05-17T00:26:26Z",
"aliases": [
"CVE-2015-7503"
],
"details": "Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7503"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1283137"
},
{
"type": "WEB",
"url": "https://framework.zend.com/security/advisory/ZF2015-10"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-10-10T16:29:00Z"
}
}