netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3j6m-m5v5-9785
GHSA-825g-f3g2-6vxf
GHSA-jwqr-jcwp-445w
GHSA-qgrf-34hp-ghm9
GHSA-wx3q-f5f2-4q8v
GHSA-jwqr-jcwp-445w
GHSA-qgrf-34hp-ghm9
This commit is contained in:
advisory-database[bot]
2024-04-23 17:29:36 +00:00
parent b542c79717
commit 6ced742c5c
7 changed files with 208 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-3j6m-m5v5-9785/GHSA-3j6m-m5v5-9785.json → advisories/github-reviewed/2022/05/GHSA-3j6m-m5v5-9785/GHSA-3j6m-m5v5-9785.json
+21 -5
View File
@@ -1,23 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3j6m-m5v5-9785",
"modified": "2022-05-24T17:36:05Z",
"modified": "2024-04-23T17:28:28Z",
"published": "2022-05-24T17:36:05Z",
"aliases": [
"CVE-2020-28838"
],
"summary": "OpenCart Cross-Site Request Forgery (CSRF)",
"details": "Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "opencart/opencart"
},
"versions": [
"3.0.3.6"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28838"
},
{
"type": "PACKAGE",
"url": "https://github.com/opencart/opencart"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/49228"
@@ -32,8 +48,8 @@
"CWE-352"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T17:28:28Z",
"nvd_published_at": "2020-12-11T15:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-825g-f3g2-6vxf/GHSA-825g-f3g2-6vxf.json → advisories/github-reviewed/2022/05/GHSA-825g-f3g2-6vxf/GHSA-825g-f3g2-6vxf.json
+34 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-825g-f3g2-6vxf",
"modified": "2022-05-14T03:49:57Z",
"modified": "2024-04-23T17:27:29Z",
"published": "2022-05-14T03:49:57Z",
"aliases": [
"CVE-2017-1000495"
],
"summary": "QuickApps CMS Cross-site Scripting",
"details": "QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site Scripting in the user's real name field resulting in denial of service and performing unauthorised actions with an administrator user's account",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "quickapps/cms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.0.0-beta1"
}
}
],
"references": [
{
@@ -24,6 +46,14 @@
{
"type": "WEB",
"url": "https://github.com/quickapps/cms/issues/183"
},
{
"type": "WEB",
"url": "https://github.com/quickapps/cms/commit/7d648f21bd87af8263dcd6449f0946a2dd31348a"
},
{
"type": "PACKAGE",
"url": "https://github.com/quickapps/cms"
}
],
"database_specific": {
@@ -31,8 +61,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T17:27:29Z",
"nvd_published_at": "2018-01-03T14:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-jwqr-jcwp-445w/GHSA-jwqr-jcwp-445w.json
+65
View File
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jwqr-jcwp-445w",
"modified": "2024-04-23T17:28:23Z",
"published": "2022-05-14T03:01:48Z",
"aliases": [
"CVE-2018-13067"
],
"summary": "OpenCart Cross-Site Request Forgery (CSRF)",
"details": "`/upload/catalog/controller/account/password.php` in OpenCart through 3.0.2.0 has CSRF via the `index.php?route=account/password` URI to change a user's password.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "opencart/opencart"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.0.2.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13067"
},
{
"type": "WEB",
"url": "https://github.com/opencart/opencart/issues/6912"
},
{
"type": "PACKAGE",
"url": "https://github.com/opencart/opencart"
},
{
"type": "WEB",
"url": "https://whitehatck01.blogspot.com/2018/06/opencart-v3-0-3-0-user-changes-password.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T17:28:23Z",
"nvd_published_at": "2018-07-02T17:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-qgrf-34hp-ghm9/GHSA-qgrf-34hp-ghm9.json
+61
View File
@@ -0,0 +1,61 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qgrf-34hp-ghm9",
"modified": "2024-04-23T17:28:15Z",
"published": "2022-05-14T03:15:28Z",
"aliases": [
"CVE-2018-11495"
],
"summary": "OpenCart Path Traversal",
"details": "OpenCart through 3.0.2.0 allows directory traversal in the `editDownload` function in `admin\\model\\catalog\\download.php` via `admin/index.php?route=catalog/download/edit`, related to the `download_id`. For example, an attacker can download `../../config.php`.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "opencart/opencart"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.0.2.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11495"
},
{
"type": "PACKAGE",
"url": "https://github.com/opencart/opencart"
},
{
"type": "WEB",
"url": "http://www.bigdiao.cc/2018/05/24/Opencart-v3-0-2-0"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T17:28:15Z",
"nvd_published_at": "2018-05-26T20:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-wx3q-f5f2-4q8v/GHSA-wx3q-f5f2-4q8v.json → advisories/github-reviewed/2022/05/GHSA-wx3q-f5f2-4q8v/GHSA-wx3q-f5f2-4q8v.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wx3q-f5f2-4q8v",
"modified": "2022-05-14T03:15:27Z",
"modified": "2024-04-23T17:28:19Z",
"published": "2022-05-14T03:15:27Z",
"aliases": [
"CVE-2018-11494"
],
"summary": "OpenCart Path Traversal",
"details": "The \"program extension upload\" feature in OpenCart through 3.0.2.0 has a six-step process (upload, install, unzip, move, xml, remove) that allows attackers to execute arbitrary code if the remove step is skipped, because the attacker can discover a secret temporary directory name (containing 10 random digits) via a directory traversal attack involving language_info['code'].",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "opencart/opencart"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.0.2.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11494"
},
{
"type": "PACKAGE",
"url": "https://github.com/opencart/opencart"
},
{
"type": "WEB",
"url": "http://www.bigdiao.cc/2018/05/24/Opencart-v3-0-2-0"
@@ -31,8 +54,8 @@
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T17:28:19Z",
"nvd_published_at": "2018-05-26T20:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-jwqr-jcwp-445w/GHSA-jwqr-jcwp-445w.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jwqr-jcwp-445w",
"modified": "2022-05-14T03:01:48Z",
"published": "2022-05-14T03:01:48Z",
"aliases": [
"CVE-2018-13067"
],
"details": "/upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change a user's password.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13067"
},
{
"type": "WEB",
"url": "https://whitehatck01.blogspot.com/2018/06/opencart-v3-0-3-0-user-changes-password.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-02T17:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-qgrf-34hp-ghm9/GHSA-qgrf-34hp-ghm9.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qgrf-34hp-ghm9",
"modified": "2022-05-14T03:15:28Z",
"published": "2022-05-14T03:15:28Z",
"aliases": [
"CVE-2018-11495"
],
"details": "OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\\model\\catalog\\download.php via admin/index.php?route=catalog/download/edit, related to the download_id. For example, an attacker can download ../../config.php.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11495"
},
{
"type": "WEB",
"url": "http://www.bigdiao.cc/2018/05/24/Opencart-v3-0-2-0"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-26T20:29:00Z"
}
}