netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-43x9-7hfv-mxrf
GHSA-hr3v-8cp3-68rf
GHSA-hr3v-8cp3-68rf
This commit is contained in:
advisory-database[bot]
2024-04-02 20:31:32 +00:00
parent f254f4fdcc
commit 60e7c59ac6
3 changed files with 138 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/02/GHSA-43x9-7hfv-mxrf/GHSA-43x9-7hfv-mxrf.json → advisories/github-reviewed/2022/02/GHSA-43x9-7hfv-mxrf/GHSA-43x9-7hfv-mxrf.json
+27 -28
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-43x9-7hfv-mxrf",
"modified": "2022-03-17T00:05:11Z",
"modified": "2024-04-02T20:31:01Z",
"published": "2022-02-26T00:00:39Z",
"aliases": [
"CVE-2021-37504"
],
"summary": "jQuery-Upload-File XSS in fileNameStr",
"details": "A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name.",
"severity": [
{
@@ -14,40 +15,38 @@
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "jquery-file-upload"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.0.11"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37504"
},
{
"type": "PACKAGE",
"url": "https://github.com/hayageek/jquery-upload-file"
},
{
"type": "WEB",
"url": "https://github.com/hayageek/jquery-upload-file/blob/master/js/jquery.uploadfile.js#L469"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/hayageek/jquery-upload-file/master/js/jquery.uploadfile.js"
},
{
"type": "WEB",
"url": "http://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js"
},
{
"type": "WEB",
"url": "http://hayageek.github.io/jQuery-Upload-File/4.0.11/jquery.uploadfile.min.js"
},
{
"type": "WEB",
"url": "http://hayageek.github.io/jQuery-Upload-File/4.0.11/uploadfile.css"
},
{
"type": "WEB",
"url": "http://haygeek.com"
},
{
"type": "WEB",
"url": "http://jquery-upload-file.com"
}
],
"database_specific": {
@@ -55,8 +54,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-02T20:31:01Z",
"nvd_published_at": "2022-02-25T19:15:00Z"
}
}
advisories/github-reviewed/2022/09/GHSA-hr3v-8cp3-68rf/GHSA-hr3v-8cp3-68rf.json
+111
View File
@@ -0,0 +1,111 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hr3v-8cp3-68rf",
"modified": "2024-04-02T20:30:12Z",
"published": "2022-09-25T00:00:15Z",
"aliases": [
"CVE-2021-41803"
],
"summary": "HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertions",
"details": "HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 did not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/consul"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.8.1"
},
{
"fixed": "1.11.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/consul"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.12.0"
},
{
"fixed": "1.12.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/consul"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.13.0"
},
{
"fixed": "1.13.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41803"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627"
},
{
"type": "PACKAGE",
"url": "https://github.com/hashicorp/consul"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-02T20:30:12Z",
"nvd_published_at": "2022-09-23T01:15:00Z"
}
}
advisories/unreviewed/2022/09/GHSA-hr3v-8cp3-68rf/GHSA-hr3v-8cp3-68rf.json
-50
View File
@@ -1,50 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hr3v-8cp3-68rf",
"modified": "2022-09-25T00:00:15Z",
"published": "2022-09-25T00:00:15Z",
"aliases": [
"CVE-2021-41803"
],
"details": "HashiCorp Consul 1.8.1 up to 1.11.8, 1.12.4, and 1.13.1 do not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC. Fixed in 1.11.9, 1.12.5, and 1.13.2.\"",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41803"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2022-19-consul-auto-config-jwt-authorization-missing-input-validation/44627"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI"
},
{
"type": "WEB",
"url": "https://www.hashicorp.com/blog/category/consul"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-23T01:15:00Z"
}
}