netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-jc55-crg7-pr35
GHSA-pw97-6v74-9w3p
GHSA-fcgg-qgxg-2g2x
GHSA-m9hv-qmqh-33qh
GHSA-pggw-rqfm-72rh
GHSA-wjpv-frf2-3r58
GHSA-pw97-6v74-9w3p
GHSA-4cxm-8hh5-jj33
This commit is contained in:
advisory-database[bot]
2024-04-25 20:42:49 +00:00
parent 2d85d40747
commit 6ac4301589
8 changed files with 254 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2021/11/GHSA-jc55-crg7-pr35/GHSA-jc55-crg7-pr35.json → advisories/github-reviewed/2021/11/GHSA-jc55-crg7-pr35/GHSA-jc55-crg7-pr35.json
+30 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jc55-crg7-pr35",
"modified": "2022-07-13T00:01:06Z",
"modified": "2024-04-25T20:40:45Z",
"published": "2021-11-25T00:00:38Z",
"aliases": [
"CVE-2021-20841"
],
"summary": "EC-CUBE Improper access control in Management screen",
"details": "Improper access control in Management screen of EC-CUBE 2 series 2.11.2 to 2.17.1 allows a remote authenticated attacker to bypass access restriction and to alter System settings via unspecified vectors.",
"severity": [
{
@@ -14,13 +15,38 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.11.2"
},
{
"fixed": "2.17.2"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.17.1"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20841"
},
{
"type": "PACKAGE",
"url": "https://github.com/EC-CUBE/ec-cube"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN75444925/index.html"
@@ -35,8 +61,8 @@
"CWE-863"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T20:40:45Z",
"nvd_published_at": "2021-11-24T16:15:00Z"
}
}
advisories/github-reviewed/2022/02/GHSA-pw97-6v74-9w3p/GHSA-pw97-6v74-9w3p.json
+87
View File
@@ -0,0 +1,87 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pw97-6v74-9w3p",
"modified": "2024-04-25T20:40:50Z",
"published": "2022-02-25T00:01:02Z",
"aliases": [
"CVE-2022-25355"
],
"summary": "EC-CUBE improperly handles HTTP Host header values",
"details": "EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"last_affected": "3.0.18-p3"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.2"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 4.1.1"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25355"
},
{
"type": "PACKAGE",
"url": "https://github.com/EC-CUBE/ec-cube"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN53871926/index.html"
},
{
"type": "WEB",
"url": "https://www.ec-cube.net/info/weakness/20220221"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T20:40:50Z",
"nvd_published_at": "2022-02-24T15:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-fcgg-qgxg-2g2x/GHSA-fcgg-qgxg-2g2x.json → advisories/github-reviewed/2022/05/GHSA-fcgg-qgxg-2g2x/GHSA-fcgg-qgxg-2g2x.json
+30 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fcgg-qgxg-2g2x",
"modified": "2022-05-14T01:36:14Z",
"modified": "2024-04-25T20:40:54Z",
"published": "2022-05-14T01:36:14Z",
"aliases": [
"CVE-2018-16191"
],
"summary": "EC-CUBE Open redirect vulnerability",
"details": "Open redirect vulnerability in EC-CUBE (EC-CUBE 3.0.0, EC-CUBE 3.0.1, EC-CUBE 3.0.2, EC-CUBE 3.0.3, EC-CUBE 3.0.4, EC-CUBE 3.0.5, EC-CUBE 3.0.6, EC-CUBE 3.0.7, EC-CUBE 3.0.8, EC-CUBE 3.0.9, EC-CUBE 3.0.10, EC-CUBE 3.0.11, EC-CUBE 3.0.12, EC-CUBE 3.0.12-p1, EC-CUBE 3.0.13, EC-CUBE 3.0.14, EC-CUBE 3.0.15, EC-CUBE 3.0.16) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.",
"severity": [
{
@@ -14,13 +15,38 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.17"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "< 3.0.16"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16191"
},
{
"type": "PACKAGE",
"url": "https://github.com/EC-CUBE/ec-cube"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN25359688/index.html"
@@ -39,8 +65,8 @@
"CWE-601"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T20:40:54Z",
"nvd_published_at": "2019-01-09T23:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-m9hv-qmqh-33qh/GHSA-m9hv-qmqh-33qh.json → advisories/github-reviewed/2022/05/GHSA-m9hv-qmqh-33qh/GHSA-m9hv-qmqh-33qh.json
+34 -5
View File
@@ -1,23 +1,52 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m9hv-qmqh-33qh",
"modified": "2022-05-24T19:21:18Z",
"modified": "2024-04-25T20:40:40Z",
"published": "2022-05-24T19:21:18Z",
"aliases": [
"CVE-2021-20842"
],
"summary": "EC-CUBE Cross-site request forgery (CSRF) vulnerability",
"details": "Cross-site request forgery (CSRF) vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.11.0"
},
{
"fixed": "2.17.2"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.17.1"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20842"
},
{
"type": "PACKAGE",
"url": "https://github.com/EC-CUBE/ec-cube"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN75444925/index.html"
@@ -32,8 +61,8 @@
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T20:40:40Z",
"nvd_published_at": "2021-11-24T16:15:00Z"
}
}
advisories/unreviewed/2022/09/GHSA-pggw-rqfm-72rh/GHSA-pggw-rqfm-72rh.json → advisories/github-reviewed/2022/09/GHSA-pggw-rqfm-72rh/GHSA-pggw-rqfm-72rh.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pggw-rqfm-72rh",
"modified": "2022-09-30T00:00:43Z",
"modified": "2024-04-25T20:41:07Z",
"published": "2022-09-28T00:00:17Z",
"aliases": [
"CVE-2022-38975"
],
"summary": "EC-CUBE DOM-based cross-site scripting vulnerability",
"details": "DOM-based cross-site scripting vulnerability in EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page.",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"last_affected": "4.1.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38975"
},
{
"type": "PACKAGE",
"url": "https://github.com/EC-CUBE/ec-cube"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN21213852/index.html"
@@ -35,8 +58,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T20:41:07Z",
"nvd_published_at": "2022-09-27T23:15:00Z"
}
}
advisories/unreviewed/2022/09/GHSA-wjpv-frf2-3r58/GHSA-wjpv-frf2-3r58.json → advisories/github-reviewed/2022/09/GHSA-wjpv-frf2-3r58/GHSA-wjpv-frf2-3r58.json
+46 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wjpv-frf2-3r58",
"modified": "2022-09-30T00:00:43Z",
"modified": "2024-04-25T20:40:58Z",
"published": "2022-09-28T00:00:16Z",
"aliases": [
"CVE-2022-40199"
],
"summary": "EC-CUBE Directory traversal vulnerability",
"details": "Directory traversal vulnerability in EC-CUBE 3 series (EC-CUBE 3.0.0 to 3.0.18-p4 ) and EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.1.2) allows a remote authenticated attacker with an administrative privilege to obtain the product's directory structure information.",
"severity": [
{
@@ -14,13 +15,54 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"last_affected": "3.0.18-p4"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "ec-cube/ec-cube"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"last_affected": "4.1.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40199"
},
{
"type": "PACKAGE",
"url": "https://github.com/EC-CUBE/ec-cube"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN21213852/index.html"
@@ -35,8 +77,8 @@
"CWE-22"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T20:40:58Z",
"nvd_published_at": "2022-09-27T23:15:00Z"
}
}
advisories/unreviewed/2022/02/GHSA-pw97-6v74-9w3p/GHSA-pw97-6v74-9w3p.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pw97-6v74-9w3p",
"modified": "2023-08-08T15:31:44Z",
"published": "2022-02-25T00:01:02Z",
"aliases": [
"CVE-2022-25355"
],
"details": "EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25355"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN53871926/index.html"
},
{
"type": "WEB",
"url": "https://www.ec-cube.net/info/weakness/20220221"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-24T15:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-4cxm-8hh5-jj33/GHSA-4cxm-8hh5-jj33.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4cxm-8hh5-jj33",
"modified": "2022-06-29T00:00:41Z",
"published": "2022-05-24T19:06:43Z",
"aliases": [
"CVE-2021-20778"
],
"details": "Improper access control vulnerability in EC-CUBE 4.0.6 (EC-CUBE 4 series) allows a remote attacker to bypass access restriction and obtain sensitive information via unspecified vectors.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20778"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN57942445/index.html"
},
{
"type": "WEB",
"url": "https://www.ec-cube.net/info/weakness/weakness.php?id=80"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN57942445/index.html"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-01T06:15:00Z"
}
}