netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-jr64-pggr-j8xj
GHSA-pcv5-m2wh-66j3
GHSA-qgmm-f2qw-r95f
GHSA-qgmm-f2qw-r95f
This commit is contained in:
advisory-database[bot]
2024-04-22 23:12:59 +00:00
parent 6fb6d308ad
commit 5ee70be046
4 changed files with 124 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-jr64-pggr-j8xj/GHSA-jr64-pggr-j8xj.json → advisories/github-reviewed/2022/05/GHSA-jr64-pggr-j8xj/GHSA-jr64-pggr-j8xj.json
+23 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jr64-pggr-j8xj",
"modified": "2022-05-14T03:49:58Z",
"modified": "2024-04-22T23:11:42Z",
"published": "2022-05-14T03:49:58Z",
"aliases": [
"CVE-2017-1000491"
],
"summary": "Shiba vulnerable to XSS leading to code execution",
"details": "Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "shiba"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.1"
}
]
}
]
}
],
"references": [
{
@@ -35,8 +54,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T23:11:42Z",
"nvd_published_at": "2018-01-03T01:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-pcv5-m2wh-66j3/GHSA-pcv5-m2wh-66j3.json → advisories/github-reviewed/2022/05/GHSA-pcv5-m2wh-66j3/GHSA-pcv5-m2wh-66j3.json
+35 -5
View File
@@ -1,23 +1,53 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pcv5-m2wh-66j3",
"modified": "2022-05-24T17:43:50Z",
"modified": "2024-04-22T23:11:37Z",
"published": "2022-05-24T17:43:50Z",
"aliases": [
"CVE-2020-27838"
],
"summary": "Keycloak discloses information without authentication",
"details": "A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.0.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27838"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/pull/7790"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/9356843c6c3d7097d010b3bb6f91e25fcaba378c"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1906797"
@@ -28,8 +58,8 @@
"CWE-287"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T23:11:37Z",
"nvd_published_at": "2021-03-08T22:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-qgmm-f2qw-r95f/GHSA-qgmm-f2qw-r95f.json
+66
View File
@@ -0,0 +1,66 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qgmm-f2qw-r95f",
"modified": "2024-04-22T23:11:33Z",
"published": "2022-05-24T17:17:37Z",
"aliases": [
"CVE-2020-1698"
],
"summary": "Keycloak leaks sensitive information in logged exceptions",
"details": "A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat from this vulnerability is to data confidentiality.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1698"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/pull/6751"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/62c9e1577618470832ede22dcedd46cba15b1836"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1698"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-532"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T23:11:33Z",
"nvd_published_at": "2020-05-11T14:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-qgmm-f2qw-r95f/GHSA-qgmm-f2qw-r95f.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qgmm-f2qw-r95f",
"modified": "2022-05-24T17:17:37Z",
"published": "2022-05-24T17:17:37Z",
"aliases": [
"CVE-2020-1698"
],
"details": "A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat from this vulnerability is to data confidentiality.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1698"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1698"
}
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-05-11T14:15:00Z"
}
}