netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3mm5-rh7g-ph5j
GHSA-qqqv-wfvc-wrgw
GHSA-v495-fr6m-f3x9
GHSA-2hjm-r8h9-f78j
GHSA-23g5-cwwr-8xhw
GHSA-jw59-9v6j-fpwh
GHSA-wvhv-cj6c-94gv
GHSA-cqgm-m7h3-xgwm
GHSA-xcf7-g637-p7f5
GHSA-3q5m-9r3g-pqfj
GHSA-52rm-ch56-6jhr
GHSA-cf4r-5p5m-jqq2
GHSA-f8f7-69v5-w4vx
GHSA-g45c-4xf2-8f43
GHSA-gwrc-vqcf-v9v4
GHSA-mg79-3wxp-f4x4
GHSA-p5fh-fh5q-gpgf
This commit is contained in:
advisory-database[bot]
2023-07-11 21:32:10 +00:00
parent 91d091ba18
commit 602bdf91e8
17 changed files with 271 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/01/GHSA-3mm5-rh7g-ph5j/GHSA-3mm5-rh7g-ph5j.json
+6 -2
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3mm5-rh7g-ph5j",
"modified": "2022-02-05T00:01:09Z",
"modified": "2023-07-11T21:30:56Z",
"published": "2022-01-29T00:00:40Z",
"aliases": [
"CVE-2022-22992"
],
"details": "A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,6 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-116",
"CWE-77"
],
"severity": "CRITICAL",
advisories/unreviewed/2022/01/GHSA-qqqv-wfvc-wrgw/GHSA-qqqv-wfvc-wrgw.json
+2 -1
View File
@@ -36,7 +36,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-287"
"CWE-287",
"CWE-697"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2022/02/GHSA-v495-fr6m-f3x9/GHSA-v495-fr6m-f3x9.json
+7 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v495-fr6m-f3x9",
"modified": "2022-02-19T00:01:46Z",
"modified": "2023-07-11T21:30:57Z",
"published": "2022-02-12T00:00:40Z",
"aliases": [
"CVE-2022-23432"
],
"details": "An improper input validation in SMC_SRPMB_WSM handler of RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,7 +28,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-20"
"CWE-20",
"CWE-787"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2022/07/GHSA-2hjm-r8h9-f78j/GHSA-2hjm-r8h9-f78j.json
+2 -1
View File
@@ -28,7 +28,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-20"
"CWE-20",
"CWE-22"
],
"severity": "CRITICAL",
"github_reviewed": false,
advisories/unreviewed/2022/08/GHSA-23g5-cwwr-8xhw/GHSA-23g5-cwwr-8xhw.json
+1
View File
@@ -60,6 +60,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-327"
],
"severity": "MODERATE",
advisories/unreviewed/2022/11/GHSA-jw59-9v6j-fpwh/GHSA-jw59-9v6j-fpwh.json
+1
View File
@@ -28,6 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"severity": "CRITICAL",
advisories/unreviewed/2022/11/GHSA-wvhv-cj6c-94gv/GHSA-wvhv-cj6c-94gv.json
+2 -1
View File
@@ -36,7 +36,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-119"
"CWE-119",
"CWE-787"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2023/06/GHSA-cqgm-m7h3-xgwm/GHSA-cqgm-m7h3-xgwm.json
+4
View File
@@ -28,6 +28,10 @@
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00000.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00013.html"
}
],
"database_specific": {
advisories/unreviewed/2023/06/GHSA-xcf7-g637-p7f5/GHSA-xcf7-g637-p7f5.json
+5 -2
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xcf7-g637-p7f5",
"modified": "2023-06-29T18:30:57Z",
"modified": "2023-07-11T21:30:57Z",
"published": "2023-06-29T18:30:57Z",
"aliases": [
"CVE-2023-35830"
],
"details": "STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage_v3.03r0-Impala and DeploymentPackage_v3.04r2-Jellyfish and TCG-4lite Connectivity Module DeploymentPackage_v3.04r2-Jellyfish allow an attacker to gain full remote access with root privileges without the need for authentication, giving an attacker arbitrary remote code execution over LTE / 4G network via SMS.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
advisories/unreviewed/2023/07/GHSA-3q5m-9r3g-pqfj/GHSA-3q5m-9r3g-pqfj.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3q5m-9r3g-pqfj",
"modified": "2023-07-11T21:30:58Z",
"published": "2023-07-11T21:30:58Z",
"aliases": [
"CVE-2022-48521"
],
"details": "An issue was discovered in OpenDKIM through 2.10.3, and 2.11.x through 2.11.0-Beta2. It fails to keep track of ordinal numbers when removing fake Authentication-Results header fields, which allows a remote attacker to craft an e-mail message with a fake sender address such that programs that rely on Authentication-Results from OpenDKIM will treat the message as having a valid DKIM signature when in fact it has none.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48521"
},
{
"type": "WEB",
"url": "https://github.com/trusteddomainproject/OpenDKIM/issues/148"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
}
}
advisories/unreviewed/2023/07/GHSA-52rm-ch56-6jhr/GHSA-52rm-ch56-6jhr.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-52rm-ch56-6jhr",
"modified": "2023-07-05T21:30:17Z",
"modified": "2023-07-11T21:30:58Z",
"published": "2023-07-05T21:30:17Z",
"aliases": [
"CVE-2023-36622"
],
"details": "The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject arbitrary OS commands via the timezone parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,7 +32,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": null,
"github_reviewed": false,
advisories/unreviewed/2023/07/GHSA-cf4r-5p5m-jqq2/GHSA-cf4r-5p5m-jqq2.json
+43
View File
@@ -0,0 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cf4r-5p5m-jqq2",
"modified": "2023-07-11T21:30:58Z",
"published": "2023-07-11T21:30:58Z",
"aliases": [
"CVE-2023-29984"
],
"details": "Null pointer dereference vulnerability exists in multiple vendors MFPs and printers which implement Debut web server 1.2 or 1.3. Processing a specially crafted request may lead an affected product to a denial-of-service (DoS) condition. As for the affected products/models/versions, see the detailed information provided by each vendor.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29984"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU93767756/index.html"
},
{
"type": "WEB",
"url": "https://www.fujifilm.com/fbglobal/eng/company/news/notice/2023/browser_announce.html"
},
{
"type": "WEB",
"url": "http://brother.com"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
}
}
advisories/unreviewed/2023/07/GHSA-f8f7-69v5-w4vx/GHSA-f8f7-69v5-w4vx.json
+47
View File
@@ -0,0 +1,47 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f8f7-69v5-w4vx",
"modified": "2023-07-11T21:30:58Z",
"published": "2023-07-11T21:30:58Z",
"aliases": [
"CVE-2023-29406"
],
"details": "The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29406"
},
{
"type": "WEB",
"url": "https://go.dev/cl/506996"
},
{
"type": "WEB",
"url": "https://go.dev/issue/60374"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/2q13H6LEEx0"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2023-1878"
}
],
"database_specific": {
"cwe_ids": [
"CWE-113"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
}
}
advisories/unreviewed/2023/07/GHSA-g45c-4xf2-8f43/GHSA-g45c-4xf2-8f43.json
+2 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g45c-4xf2-8f43",
"modified": "2023-07-05T15:30:25Z",
"modified": "2023-07-11T21:30:57Z",
"published": "2023-07-05T15:30:25Z",
"aliases": [
"CVE-2023-35975"
@@ -28,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": null,
"github_reviewed": false,
advisories/unreviewed/2023/07/GHSA-gwrc-vqcf-v9v4/GHSA-gwrc-vqcf-v9v4.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gwrc-vqcf-v9v4",
"modified": "2023-07-11T21:30:58Z",
"published": "2023-07-11T21:30:58Z",
"aliases": [
"CVE-2023-36884"
],
"details": "Microsoft is investigating reports of a series of remote code execution vulnerabilities impacting Windows and Office products. Microsoft is aware of targeted attacks that attempt to exploit these vulnerabilities by using specially-crafted Microsoft Office documents.\n\nAn attacker could create a specially crafted Microsoft Office document that enables them to perform remote code execution in the context of the victim. However, an attacker would have to convince the victim to open the malicious file.\n\nUpon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This might include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.\n\nPlease see the Microsoft Threat Intelligence Blog https://aka.ms/Storm-0978  Entry for important information about steps you can take to protect your system from this vulnerability.\n\nThis CVE will be updated with new information and links to security updates when they become available.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36884"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
}
}
advisories/unreviewed/2023/07/GHSA-mg79-3wxp-f4x4/GHSA-mg79-3wxp-f4x4.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mg79-3wxp-f4x4",
"modified": "2023-07-11T21:30:58Z",
"published": "2023-07-11T21:30:58Z",
"aliases": [
"CVE-2023-20575"
],
"details": "\nA potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a program’s execution inside an AMD SEV VM potentially resulting in a leak of sensitive information.\n\n\n\n\n\n\n\n\n\n",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20575"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3004"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
}
}
advisories/unreviewed/2023/07/GHSA-p5fh-fh5q-gpgf/GHSA-p5fh-fh5q-gpgf.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p5fh-fh5q-gpgf",
"modified": "2023-07-11T21:30:58Z",
"published": "2023-07-11T21:30:58Z",
"aliases": [
"CVE-2023-23756"
],
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script Elements.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23756"
},
{
"type": "WEB",
"url": "https://extensions.joomla.org/vulnerable-extensions/vulnerable/one-vote-1-7-xss-cross-site-scripting/"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
}
}