netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-846m-99qv-67mg
GHSA-9jqr-5x45-pgw8
GHSA-mg8j-w93w-xjgc
GHSA-846m-99qv-67mg
GHSA-9jqr-5x45-pgw8
GHSA-mg8j-w93w-xjgc
This commit is contained in:
advisory-database[bot]
2024-08-29 18:07:07 +00:00
parent 522427ccd1
commit 6ff7bae70d
6 changed files with 273 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/08/GHSA-846m-99qv-67mg/GHSA-846m-99qv-67mg.json
+73
View File
@@ -0,0 +1,73 @@
{
"schema_version": "1.4.0",
"id": "GHSA-846m-99qv-67mg",
"modified": "2024-08-29T18:05:18Z",
"published": "2024-08-29T03:30:49Z",
"aliases": [
"CVE-2024-45436"
],
"summary": "Ollama can extract members of a ZIP archive outside of the parent directory",
"details": "`extractFromZipFile` in `model.go` in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/ollama/ollama"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.47"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45436"
},
{
"type": "WEB",
"url": "https://github.com/ollama/ollama/pull/5314"
},
{
"type": "WEB",
"url": "https://github.com/ollama/ollama/commit/123a722a6f541e300bc8e34297ac378ebe23f527"
},
{
"type": "PACKAGE",
"url": "https://github.com/ollama/ollama"
},
{
"type": "WEB",
"url": "https://github.com/ollama/ollama/compare/v0.1.46...v0.1.47"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-08-29T18:05:18Z",
"nvd_published_at": "2024-08-29T03:15:05Z"
}
}
advisories/github-reviewed/2024/08/GHSA-9jqr-5x45-pgw8/GHSA-9jqr-5x45-pgw8.json
+138
View File
@@ -0,0 +1,138 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9jqr-5x45-pgw8",
"modified": "2024-08-29T18:04:55Z",
"published": "2024-08-29T00:31:35Z",
"aliases": [
"CVE-2024-45233"
],
"summary": "Powermail TYPO3 extension Broken Access Control in the OutputController",
"details": "An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemented access checks, resulting in Broken Access Control. Depending on the configuration of the Powermail Frontend plugins, an unauthenticated attacker can exploit this to edit, update, delete, or export data of persisted forms. This can only be exploited when the Powermail Frontend plugins are used. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "in2code/powermail"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.5.0"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "in2code/powermail"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.5.0"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "in2code/powermail"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "10.9.0"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "in2code/powermail"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "12.4.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45233"
},
{
"type": "WEB",
"url": "https://github.com/in2code-de/powermail/commit/04a010c4009202e8e1b4c72accd4d7b2771b80b3"
},
{
"type": "WEB",
"url": "https://github.com/in2code-de/powermail/commit/2c8a1bf7669eb0661e8a93164f57e4b653ac3408"
},
{
"type": "WEB",
"url": "https://github.com/in2code-de/powermail/commit/6e94ec5e0c7b553c467b826df1b922db6c2ad08e"
},
{
"type": "WEB",
"url": "https://github.com/in2code-de/powermail/commit/f56f8eefe151ad67cbd32c21f1106953b8e4f19f"
},
{
"type": "PACKAGE",
"url": "https://github.com/in2code-de/powermail"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2024-006"
}
],
"database_specific": {
"cwe_ids": [
"CWE-285"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-08-29T18:04:54Z",
"nvd_published_at": "2024-08-29T00:15:09Z"
}
}
advisories/github-reviewed/2024/08/GHSA-mg8j-w93w-xjgc/GHSA-mg8j-w93w-xjgc.json
+62
View File
@@ -0,0 +1,62 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mg8j-w93w-xjgc",
"modified": "2024-08-29T18:05:46Z",
"published": "2024-08-29T12:31:05Z",
"aliases": [
"CVE-2024-45440"
],
"summary": "Drupal Full Path Disclosure",
"details": "`core/authorize.php` in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of `hash_salt` is `file_get_contents` of a file that does not exist.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"versions": [
"11.x-dev"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core-recommended"
},
"versions": [
"11.x-dev"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"versions": [
"11.x-dev"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45440"
},
{
"type": "WEB",
"url": "https://www.drupal.org/project/drupal/issues/3457781"
}
],
"database_specific": {
"cwe_ids": [
"CWE-497"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2024-08-29T18:05:46Z",
"nvd_published_at": "2024-08-29T11:15:27Z"
}
}
advisories/unreviewed/2024/08/GHSA-846m-99qv-67mg/GHSA-846m-99qv-67mg.json
-39
View File
@@ -1,39 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-846m-99qv-67mg",
"modified": "2024-08-29T03:30:49Z",
"published": "2024-08-29T03:30:49Z",
"aliases": [
"CVE-2024-45436"
],
"details": "extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45436"
},
{
"type": "WEB",
"url": "https://github.com/ollama/ollama/pull/5314"
},
{
"type": "WEB",
"url": "https://github.com/ollama/ollama/compare/v0.1.46...v0.1.47"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-29T03:15:05Z"
}
}
advisories/unreviewed/2024/08/GHSA-9jqr-5x45-pgw8/GHSA-9jqr-5x45-pgw8.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9jqr-5x45-pgw8",
"modified": "2024-08-29T00:31:35Z",
"published": "2024-08-29T00:31:35Z",
"aliases": [
"CVE-2024-45233"
],
"details": "An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemented access checks, resulting in Broken Access Control. Depending on the configuration of the Powermail Frontend plugins, an unauthenticated attacker can exploit this to edit, update, delete, or export data of persisted forms. This can only be exploited when the Powermail Frontend plugins are used. The fixed versions are 7.5.0, 8.5.0, 10.9.0, and 12.4.0.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45233"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-ext-sa-2024-006"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-29T00:15:09Z"
}
}
advisories/unreviewed/2024/08/GHSA-mg8j-w93w-xjgc/GHSA-mg8j-w93w-xjgc.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mg8j-w93w-xjgc",
"modified": "2024-08-29T12:31:05Z",
"published": "2024-08-29T12:31:05Z",
"aliases": [
"CVE-2024-45440"
],
"details": "core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45440"
},
{
"type": "WEB",
"url": "https://www.drupal.org/project/drupal/issues/3457781"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-29T11:15:27Z"
}
}