From 72c40aa952dd3a7c732f528de759b2e50dbafe6e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 27 Jun 2023 22:29:10 +0000 Subject: [PATCH] Publish Advisories GHSA-273r-mgr4-v34f GHSA-8xjp-rp29-v5j8 GHSA-g4c2-ghfg-g5rh GHSA-gmh3-x5w7-jg5m GHSA-2g5c-228j-p52x GHSA-ggf6-638m-vqmg GHSA-rfj2-q3h3-hm5j GHSA-xr6m-2p4m-jvqf GHSA-cjp8-vv38-p3g2 GHSA-6643-h7h5-x9wh GHSA-7xqx-xwg9-jx34 --- .../01/GHSA-273r-mgr4-v34f/GHSA-273r-mgr4-v34f.json | 3 ++- .../01/GHSA-8xjp-rp29-v5j8/GHSA-8xjp-rp29-v5j8.json | 13 +++++++++---- .../01/GHSA-g4c2-ghfg-g5rh/GHSA-g4c2-ghfg-g5rh.json | 1 + .../07/GHSA-gmh3-x5w7-jg5m/GHSA-gmh3-x5w7-jg5m.json | 1 + .../09/GHSA-2g5c-228j-p52x/GHSA-2g5c-228j-p52x.json | 1 + .../09/GHSA-ggf6-638m-vqmg/GHSA-ggf6-638m-vqmg.json | 7 +++---- .../09/GHSA-rfj2-q3h3-hm5j/GHSA-rfj2-q3h3-hm5j.json | 3 ++- .../09/GHSA-xr6m-2p4m-jvqf/GHSA-xr6m-2p4m-jvqf.json | 1 + .../11/GHSA-cjp8-vv38-p3g2/GHSA-cjp8-vv38-p3g2.json | 6 +++++- .../06/GHSA-6643-h7h5-x9wh/GHSA-6643-h7h5-x9wh.json | 13 ++++++++++--- .../06/GHSA-7xqx-xwg9-jx34/GHSA-7xqx-xwg9-jx34.json | 7 +++++-- 11 files changed, 40 insertions(+), 16 deletions(-) diff --git a/advisories/github-reviewed/2022/01/GHSA-273r-mgr4-v34f/GHSA-273r-mgr4-v34f.json b/advisories/github-reviewed/2022/01/GHSA-273r-mgr4-v34f/GHSA-273r-mgr4-v34f.json index c64922bc879..407e72759ce 100644 --- a/advisories/github-reviewed/2022/01/GHSA-273r-mgr4-v34f/GHSA-273r-mgr4-v34f.json +++ b/advisories/github-reviewed/2022/01/GHSA-273r-mgr4-v34f/GHSA-273r-mgr4-v34f.json @@ -117,7 +117,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-754" + "CWE-754", + "CWE-755" ], "severity": "HIGH", "github_reviewed": true, diff --git a/advisories/github-reviewed/2022/01/GHSA-8xjp-rp29-v5j8/GHSA-8xjp-rp29-v5j8.json b/advisories/github-reviewed/2022/01/GHSA-8xjp-rp29-v5j8/GHSA-8xjp-rp29-v5j8.json index 0286c514861..a4cb2728d3a 100644 --- a/advisories/github-reviewed/2022/01/GHSA-8xjp-rp29-v5j8/GHSA-8xjp-rp29-v5j8.json +++ b/advisories/github-reviewed/2022/01/GHSA-8xjp-rp29-v5j8/GHSA-8xjp-rp29-v5j8.json @@ -1,15 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-8xjp-rp29-v5j8", - "modified": "2022-06-01T20:10:51Z", + "modified": "2023-06-27T22:18:19Z", "published": "2022-01-13T00:00:52Z", "aliases": [ "CVE-2022-23118" ], "summary": "Agent-to-controller security bypass in Jenkins Debian Package Builder Plugin", - "details": "Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line `git` at an attacker-specified path on the controller, allowing attackers able to control agent processes to invoke arbitrary OS commands on the controller.", + "details": "Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agent processes to invoke command-line git at an attacker-specified path on the controller.\n\nThis allows attackers able to control agent processes to invoke arbitrary OS commands on the controller.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ { @@ -52,7 +55,9 @@ ], "database_specific": { "cwe_ids": [ - "CWE-269" + "CWE-269", + "CWE-668", + "CWE-693" ], "severity": "HIGH", "github_reviewed": true, diff --git a/advisories/github-reviewed/2022/01/GHSA-g4c2-ghfg-g5rh/GHSA-g4c2-ghfg-g5rh.json b/advisories/github-reviewed/2022/01/GHSA-g4c2-ghfg-g5rh/GHSA-g4c2-ghfg-g5rh.json index 8055bbcf68d..8853db6f595 100644 --- a/advisories/github-reviewed/2022/01/GHSA-g4c2-ghfg-g5rh/GHSA-g4c2-ghfg-g5rh.json +++ b/advisories/github-reviewed/2022/01/GHSA-g4c2-ghfg-g5rh/GHSA-g4c2-ghfg-g5rh.json @@ -55,6 +55,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-601", "CWE-79" ], "severity": "MODERATE", diff --git a/advisories/github-reviewed/2022/07/GHSA-gmh3-x5w7-jg5m/GHSA-gmh3-x5w7-jg5m.json b/advisories/github-reviewed/2022/07/GHSA-gmh3-x5w7-jg5m/GHSA-gmh3-x5w7-jg5m.json index d67ebff1c57..9bd12a347d3 100644 --- a/advisories/github-reviewed/2022/07/GHSA-gmh3-x5w7-jg5m/GHSA-gmh3-x5w7-jg5m.json +++ b/advisories/github-reviewed/2022/07/GHSA-gmh3-x5w7-jg5m/GHSA-gmh3-x5w7-jg5m.json @@ -55,6 +55,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-352", "CWE-79" ], "severity": "MODERATE", diff --git a/advisories/github-reviewed/2022/09/GHSA-2g5c-228j-p52x/GHSA-2g5c-228j-p52x.json b/advisories/github-reviewed/2022/09/GHSA-2g5c-228j-p52x/GHSA-2g5c-228j-p52x.json index d143327669f..4bd4ebaaccb 100644 --- a/advisories/github-reviewed/2022/09/GHSA-2g5c-228j-p52x/GHSA-2g5c-228j-p52x.json +++ b/advisories/github-reviewed/2022/09/GHSA-2g5c-228j-p52x/GHSA-2g5c-228j-p52x.json @@ -94,6 +94,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-116", "CWE-94", "CWE-95" ], diff --git a/advisories/github-reviewed/2022/09/GHSA-ggf6-638m-vqmg/GHSA-ggf6-638m-vqmg.json b/advisories/github-reviewed/2022/09/GHSA-ggf6-638m-vqmg/GHSA-ggf6-638m-vqmg.json index 09e99f06e28..b98c9e7f232 100644 --- a/advisories/github-reviewed/2022/09/GHSA-ggf6-638m-vqmg/GHSA-ggf6-638m-vqmg.json +++ b/advisories/github-reviewed/2022/09/GHSA-ggf6-638m-vqmg/GHSA-ggf6-638m-vqmg.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-ggf6-638m-vqmg", - "modified": "2022-09-15T03:34:21Z", + "modified": "2023-06-27T22:21:05Z", "published": "2022-09-15T03:34:21Z", "aliases": [ "CVE-2022-36110" ], - "summary": "Netmaker before 0.15.1 vulnerable to Insufficient Granularity of Access Control", + "summary": "Netmaker vulnerable to Insufficient Granularity of Access Control", "details": "### Impact\nImproper Authorization functions leads to non-privileged users running privileged API calls. If you have added users to your Netmaker platform who whould not have admin privileges, they could use their auth token to run admin-level functions via the API.\n\nIn addition, differing response codes based on function calls allowed non-users to potentially brute force the determination of names of networks on the system.\n\n### Patches\nThis problem has been patched in v0.15.1. To apply:\n\n1. docker-compose down\n2. docker pull gravitl/netmaker:v0.15.1\n3. docker-compose up -d\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nEmail us at [info@netmaker.io](mailto:info@netmaker.io)\nThis vulnerability was brought to our attention by @tweidinger", "severity": [ { @@ -56,8 +56,7 @@ "database_specific": { "cwe_ids": [ "CWE-1220", - "CWE-285", - "CWE-863" + "CWE-285" ], "severity": "HIGH", "github_reviewed": true, diff --git a/advisories/github-reviewed/2022/09/GHSA-rfj2-q3h3-hm5j/GHSA-rfj2-q3h3-hm5j.json b/advisories/github-reviewed/2022/09/GHSA-rfj2-q3h3-hm5j/GHSA-rfj2-q3h3-hm5j.json index 542e9a071ad..10dd13ceeef 100644 --- a/advisories/github-reviewed/2022/09/GHSA-rfj2-q3h3-hm5j/GHSA-rfj2-q3h3-hm5j.json +++ b/advisories/github-reviewed/2022/09/GHSA-rfj2-q3h3-hm5j/GHSA-rfj2-q3h3-hm5j.json @@ -63,7 +63,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-22" + "CWE-22", + "CWE-59" ], "severity": "LOW", "github_reviewed": true, diff --git a/advisories/github-reviewed/2022/09/GHSA-xr6m-2p4m-jvqf/GHSA-xr6m-2p4m-jvqf.json b/advisories/github-reviewed/2022/09/GHSA-xr6m-2p4m-jvqf/GHSA-xr6m-2p4m-jvqf.json index 3b8aa29edfa..a0becadbde1 100644 --- a/advisories/github-reviewed/2022/09/GHSA-xr6m-2p4m-jvqf/GHSA-xr6m-2p4m-jvqf.json +++ b/advisories/github-reviewed/2022/09/GHSA-xr6m-2p4m-jvqf/GHSA-xr6m-2p4m-jvqf.json @@ -78,6 +78,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-116", "CWE-94", "CWE-95" ], diff --git a/advisories/github-reviewed/2022/11/GHSA-cjp8-vv38-p3g2/GHSA-cjp8-vv38-p3g2.json b/advisories/github-reviewed/2022/11/GHSA-cjp8-vv38-p3g2/GHSA-cjp8-vv38-p3g2.json index 38b43e7f384..f730d4e8eb9 100644 --- a/advisories/github-reviewed/2022/11/GHSA-cjp8-vv38-p3g2/GHSA-cjp8-vv38-p3g2.json +++ b/advisories/github-reviewed/2022/11/GHSA-cjp8-vv38-p3g2/GHSA-cjp8-vv38-p3g2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-cjp8-vv38-p3g2", - "modified": "2022-11-21T23:52:50Z", + "modified": "2023-06-27T22:20:22Z", "published": "2022-11-16T12:00:18Z", "aliases": [ "CVE-2022-4014" @@ -40,6 +40,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4014" }, + { + "type": "PACKAGE", + "url": "https://github.com/liufee/feehicms" + }, { "type": "WEB", "url": "https://vuldb.com/?id.213788" diff --git a/advisories/github-reviewed/2023/06/GHSA-6643-h7h5-x9wh/GHSA-6643-h7h5-x9wh.json b/advisories/github-reviewed/2023/06/GHSA-6643-h7h5-x9wh/GHSA-6643-h7h5-x9wh.json index d3595b220e4..5384c31629f 100644 --- a/advisories/github-reviewed/2023/06/GHSA-6643-h7h5-x9wh/GHSA-6643-h7h5-x9wh.json +++ b/advisories/github-reviewed/2023/06/GHSA-6643-h7h5-x9wh/GHSA-6643-h7h5-x9wh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6643-h7h5-x9wh", - "modified": "2023-06-21T22:09:21Z", + "modified": "2023-06-27T22:19:47Z", "published": "2023-06-20T15:31:09Z", "aliases": [ "CVE-2023-34541" @@ -9,7 +9,10 @@ "summary": "Langchain vulnerable to arbitrary code execution", "details": "Langchain 0.0.171 is vulnerable to Arbitrary code execution in `load_prompt`.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ { @@ -44,13 +47,17 @@ { "type": "PACKAGE", "url": "https://github.com/hwchase17/langchain" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/langchain/PYSEC-2023-92.yaml" } ], "database_specific": { "cwe_ids": [ ], - "severity": "MODERATE", + "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2023-06-21T22:09:21Z", "nvd_published_at": null diff --git a/advisories/github-reviewed/2023/06/GHSA-7xqx-xwg9-jx34/GHSA-7xqx-xwg9-jx34.json b/advisories/github-reviewed/2023/06/GHSA-7xqx-xwg9-jx34/GHSA-7xqx-xwg9-jx34.json index 9bab4ae6914..14d6c35a6b3 100644 --- a/advisories/github-reviewed/2023/06/GHSA-7xqx-xwg9-jx34/GHSA-7xqx-xwg9-jx34.json +++ b/advisories/github-reviewed/2023/06/GHSA-7xqx-xwg9-jx34/GHSA-7xqx-xwg9-jx34.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7xqx-xwg9-jx34", - "modified": "2023-06-21T22:10:00Z", + "modified": "2023-06-27T22:22:11Z", "published": "2023-06-20T15:31:08Z", "aliases": [ "CVE-2020-20697" @@ -9,7 +9,10 @@ "summary": "NodCMS Cross Site Scripting vulnerability", "details": "Cross Site Scripting vulnerability in khodakhah NodCMS v.3.0 allows an attacker with administrative privileges to execute arbitrary code and gain access to sensitive information via a crafted script to the address parameter.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ {