netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-64r3-582j-frqm
GHSA-x5hj-47vv-53p8
GHSA-64r3-582j-frqm
GHSA-x5hj-47vv-53p8
This commit is contained in:
advisory-database[bot]
2025-04-12 03:26:18 +00:00
parent 20f4957b37
commit 6d07427c03
4 changed files with 307 additions and 78 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-64r3-582j-frqm/GHSA-64r3-582j-frqm.json
+141
View File
@@ -0,0 +1,141 @@
{
"schema_version": "1.4.0",
"id": "GHSA-64r3-582j-frqm",
"modified": "2025-04-12T03:25:18Z",
"published": "2022-05-13T01:12:54Z",
"aliases": [
"CVE-2013-4941"
],
"summary": "YUI Cross-site Scripting (XSS) vulnerability",
"details": "Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "yui"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2.0"
},
{
"last_affected": "3.9.1"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.4.0-rc1"
},
{
"fixed": "2.4.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0-beta"
},
{
"fixed": "2.5.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4941"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=232496"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20130909203912/http://yuilibrary.com/support/20130515-vulnerability"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-04-12T03:25:17Z",
"nvd_published_at": "2013-07-29T13:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-x5hj-47vv-53p8/GHSA-x5hj-47vv-53p8.json
+166
View File
@@ -0,0 +1,166 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x5hj-47vv-53p8",
"modified": "2025-04-12T03:24:28Z",
"published": "2022-05-13T01:12:54Z",
"aliases": [
"CVE-2013-4940"
],
"summary": "YUI Cross-site Scripting (XSS) vulnerability",
"details": "Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. NOTE: this vulnerability exists because of a CVE-2013-4939 regression.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "yui"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.10.11"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 3.10.0"
}
},
{
"package": {
"ecosystem": "npm",
"name": "yui"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.10.12"
},
{
"fixed": "3.10.13"
}
]
}
],
"versions": [
"3.10.12"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.4.0-rc1"
},
{
"fixed": "2.4.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.5.0-beta"
},
{
"fixed": "2.5.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4940"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=232496"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20130909203912/http://yuilibrary.com/support/20130515-vulnerability"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-04-12T03:24:28Z",
"nvd_published_at": "2013-07-29T13:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-64r3-582j-frqm/GHSA-64r3-582j-frqm.json
-39
View File
@@ -1,39 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-64r3-582j-frqm",
"modified": "2025-04-11T04:12:20Z",
"published": "2022-05-13T01:12:54Z",
"aliases": [
"CVE-2013-4941"
],
"details": "Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4941"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=232496"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678"
},
{
"type": "WEB",
"url": "http://yuilibrary.com/support/20130515-vulnerability"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-07-29T13:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-x5hj-47vv-53p8/GHSA-x5hj-47vv-53p8.json
-39
View File
@@ -1,39 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x5hj-47vv-53p8",
"modified": "2025-04-11T04:12:20Z",
"published": "2022-05-13T01:12:54Z",
"aliases": [
"CVE-2013-4940"
],
"details": "Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. NOTE: this vulnerability exists because of a CVE-2013-4939 regression.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4940"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=232496"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678"
},
{
"type": "WEB",
"url": "http://yuilibrary.com/support/20130515-vulnerability"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-07-29T13:59:00Z"
}
}