Publish Advisories

GHSA-273r-mgr4-v34f GHSA-8xjp-rp29-v5j8 GHSA-g4c2-ghfg-g5rh GHSA-gmh3-x5w7-jg5m GHSA-2g5c-228j-p52x GHSA-ggf6-638m-vqmg GHSA-rfj2-q3h3-hm5j GHSA-xr6m-2p4m-jvqf GHSA-cjp8-vv38-p3g2 GHSA-6643-h7h5-x9wh GHSA-7xqx-xwg9-jx34
2026-05-22 18:04:22 -07:00 · 2023-06-27 22:29:10 +00:00
parent fc6ae15a6d
commit 72c40aa952
11 changed files with 40 additions and 16 deletions
@@ -117,7 +117,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-754"
+      "CWE-754",
+      "CWE-755"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
@@ -1,15 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8xjp-rp29-v5j8",
-  "modified": "2022-06-01T20:10:51Z",
+  "modified": "2023-06-27T22:18:19Z",
  "published": "2022-01-13T00:00:52Z",
  "aliases": [
    "CVE-2022-23118"
  ],
  "summary": "Agent-to-controller security bypass in Jenkins Debian Package Builder Plugin",
-  "details": "Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path on the controller, allowing attackers able to control agent processes to invoke arbitrary OS commands on the controller.",
+  "details": "Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agent processes to invoke command-line git at an attacker-specified path on the controller.\n\nThis allows attackers able to control agent processes to invoke arbitrary OS commands on the controller.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [
    {
@@ -52,7 +55,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-269"
+      "CWE-269",
+      "CWE-668",
+      "CWE-693"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
@@ -55,6 +55,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-601",
      "CWE-79"
    ],
    "severity": "MODERATE",
@@ -55,6 +55,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-352",
      "CWE-79"
    ],
    "severity": "MODERATE",
@@ -94,6 +94,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-116",
      "CWE-94",
      "CWE-95"
    ],
@@ -1,12 +1,12 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-ggf6-638m-vqmg",
-  "modified": "2022-09-15T03:34:21Z",
+  "modified": "2023-06-27T22:21:05Z",
  "published": "2022-09-15T03:34:21Z",
  "aliases": [
    "CVE-2022-36110"
  ],
-  "summary": "Netmaker before 0.15.1 vulnerable to Insufficient Granularity of Access Control",
+  "summary": "Netmaker vulnerable to Insufficient Granularity of Access Control",
  "details": "### Impact\nImproper Authorization functions leads to non-privileged users running privileged API calls. If you have added users to your Netmaker platform who whould not have admin privileges, they could use their auth token to run admin-level functions via the API.\n\nIn addition, differing response codes based on function calls allowed non-users to potentially brute force the determination of names of networks on the system.\n\n### Patches\nThis problem has been patched in v0.15.1. To apply:\n\n1. docker-compose down\n2. docker pull gravitl/netmaker:v0.15.1\n3. docker-compose up -d\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nEmail us at [info@netmaker.io](mailto:info@netmaker.io)\nThis vulnerability was brought to our attention by @tweidinger",
  "severity": [
    {
@@ -56,8 +56,7 @@
  "database_specific": {
    "cwe_ids": [
      "CWE-1220",
-      "CWE-285",
-      "CWE-863"
+      "CWE-285"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
@@ -63,7 +63,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-22"
+      "CWE-22",
+      "CWE-59"
    ],
    "severity": "LOW",
    "github_reviewed": true,
@@ -78,6 +78,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-116",
      "CWE-94",
      "CWE-95"
    ],
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-cjp8-vv38-p3g2",
-  "modified": "2022-11-21T23:52:50Z",
+  "modified": "2023-06-27T22:20:22Z",
  "published": "2022-11-16T12:00:18Z",
  "aliases": [
    "CVE-2022-4014"
@@ -40,6 +40,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4014"
    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/liufee/feehicms"
+    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.213788"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-6643-h7h5-x9wh",
-  "modified": "2023-06-21T22:09:21Z",
+  "modified": "2023-06-27T22:19:47Z",
  "published": "2023-06-20T15:31:09Z",
  "aliases": [
    "CVE-2023-34541"
@@ -9,7 +9,10 @@
  "summary": "Langchain vulnerable to arbitrary code execution",
  "details": "Langchain 0.0.171 is vulnerable to Arbitrary code execution in `load_prompt`.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [
    {
@@ -44,13 +47,17 @@
    {
      "type": "PACKAGE",
      "url": "https://github.com/hwchase17/langchain"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-92.yaml"
    }
  ],
  "database_specific": {
    "cwe_ids": [

    ],
-    "severity": "MODERATE",
+    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-21T22:09:21Z",
    "nvd_published_at": null
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7xqx-xwg9-jx34",
-  "modified": "2023-06-21T22:10:00Z",
+  "modified": "2023-06-27T22:22:11Z",
  "published": "2023-06-20T15:31:08Z",
  "aliases": [
    "CVE-2020-20697"
@@ -9,7 +9,10 @@
  "summary": "NodCMS Cross Site Scripting vulnerability",
  "details": "Cross Site Scripting vulnerability in khodakhah NodCMS v.3.0 allows an attacker with administrative privileges to execute arbitrary code and gain access to sensitive information via a crafted script to the address parameter.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [
    {