netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-8987-93fh-rcwq
GHSA-99xj-xqc9-98hr
GHSA-mwm8-36c5-j5cf
GHSA-v6fp-h79x-9rqc
GHSA-wm9c-vcv2-vpqc
GHSA-x394-g9j8-x7mf
GHSA-99xj-xqc9-98hr
GHSA-mwm8-36c5-j5cf
This commit is contained in:
advisory-database[bot]
2024-04-24 17:17:25 +00:00
parent 814bf78ceb
commit 74c15b7a61
8 changed files with 392 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-8987-93fh-rcwq/GHSA-8987-93fh-rcwq.json → advisories/github-reviewed/2022/05/GHSA-8987-93fh-rcwq/GHSA-8987-93fh-rcwq.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8987-93fh-rcwq",
"modified": "2022-05-14T01:09:10Z",
"modified": "2024-04-24T17:16:03Z",
"published": "2022-05-14T01:09:10Z",
"aliases": [
"CVE-2018-19970"
],
"summary": "phpMyAdmin Cross-site Scripting (XSS) vulnerability",
"details": "In phpMyAdmin before 4.8.4, an XSS vulnerability was found in the navigation tree, where an attacker can deliver a payload to a user through a crafted database/table name.",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyadmin/phpmyadmin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0"
},
{
"fixed": "4.8.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19970"
},
{
"type": "PACKAGE",
"url": "https://github.com/phpmyadmin/composer"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00003.html"
@@ -43,8 +66,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T17:16:03Z",
"nvd_published_at": "2018-12-11T17:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-99xj-xqc9-98hr/GHSA-99xj-xqc9-98hr.json
+103
View File
@@ -0,0 +1,103 @@
{
"schema_version": "1.4.0",
"id": "GHSA-99xj-xqc9-98hr",
"modified": "2024-04-24T17:16:11Z",
"published": "2022-05-14T01:15:48Z",
"aliases": [
"CVE-2017-1000017"
],
"summary": "phpMyAdmin SSRF in replication",
"details": "phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyadmin/phpmyadmin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.6"
},
{
"fixed": "4.6.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyadmin/phpmyadmin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.4"
},
{
"fixed": "4.4.15.10"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyadmin/phpmyadmin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0"
},
{
"fixed": "4.0.10.19"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000017"
},
{
"type": "PACKAGE",
"url": "https://github.com/phpmyadmin/composer"
},
{
"type": "WEB",
"url": "https://www.phpmyadmin.net/security/PMASA-2017-6"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/95732"
}
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T17:16:11Z",
"nvd_published_at": "2017-07-17T13:18:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-mwm8-36c5-j5cf/GHSA-mwm8-36c5-j5cf.json
+139
View File
@@ -0,0 +1,139 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mwm8-36c5-j5cf",
"modified": "2024-04-24T17:16:28Z",
"published": "2022-05-14T02:08:58Z",
"aliases": [
"CVE-2016-5731"
],
"summary": "phpMyAdmin Cross-site scripting (XSS) vulnerability",
"details": "Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyadmin/phpmyadmin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0"
},
{
"fixed": "4.0.10.16"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyadmin/phpmyadmin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.4"
},
{
"fixed": "4.4.15.7"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyadmin/phpmyadmin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.6"
},
{
"fixed": "4.6.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5731"
},
{
"type": "WEB",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/418aeea3d83b0b6021bac311d849570acfc6e48c"
},
{
"type": "WEB",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/52e7898"
},
{
"type": "WEB",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/5fefa51"
},
{
"type": "WEB",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/78f6c54"
},
{
"type": "WEB",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/94cf3864254ffaf3a69e97d8fc454888368b94ab"
},
{
"type": "WEB",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/d005ba6"
},
{
"type": "PACKAGE",
"url": "https://github.com/phpmyadmin/composer"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"type": "WEB",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-24"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3627"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T17:16:28Z",
"nvd_published_at": "2016-07-03T01:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-v6fp-h79x-9rqc/GHSA-v6fp-h79x-9rqc.json → advisories/github-reviewed/2022/05/GHSA-v6fp-h79x-9rqc/GHSA-v6fp-h79x-9rqc.json
+31 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v6fp-h79x-9rqc",
"modified": "2022-05-14T03:22:27Z",
"modified": "2024-04-24T17:16:59Z",
"published": "2022-05-14T03:22:27Z",
"aliases": [
"CVE-2018-10188"
],
"summary": "phpMyAdmin CSRF vulnerability allowing arbitrary SQL execution",
"details": "phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php.",
"severity": [
{
@@ -14,13 +15,39 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyadmin/phpmyadmin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.8"
},
{
"fixed": "4.8.0.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10188"
},
{
"type": "WEB",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/c6dd6b56e236a3aff953cee4135ecaa67130e641"
},
{
"type": "PACKAGE",
"url": "https://github.com/phpmyadmin/composer"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44496"
@@ -43,8 +70,8 @@
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T17:16:59Z",
"nvd_published_at": "2018-04-19T14:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-wm9c-vcv2-vpqc/GHSA-wm9c-vcv2-vpqc.json → advisories/github-reviewed/2022/05/GHSA-wm9c-vcv2-vpqc/GHSA-wm9c-vcv2-vpqc.json
+65 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wm9c-vcv2-vpqc",
"modified": "2022-05-14T02:08:58Z",
"modified": "2024-04-24T17:16:37Z",
"published": "2022-05-14T02:08:58Z",
"aliases": [
"CVE-2016-5730"
],
"summary": "phpMyAdmin full path disclosure vulnerability",
"details": "phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to obtain sensitive information via vectors involving (1) an array value to FormDisplay.php, (2) incorrect data to validate.php, (3) unexpected data to Validator.php, (4) a missing config directory during setup, or (5) an incorrect OpenID identifier data type, which reveals the full path in an error message.",
"severity": [
{
@@ -14,7 +15,63 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyadmin/phpmyadmin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0"
},
{
"fixed": "4.0.10.16"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyadmin/phpmyadmin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.4"
},
{
"fixed": "4.4.15.7"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyadmin/phpmyadmin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.6"
},
{
"fixed": "4.6.3"
}
]
}
]
}
],
"references": [
{
@@ -41,6 +98,10 @@
"type": "WEB",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/cd229d718e8cb4bc8ba32446beaa82d27727b6f0"
},
{
"type": "PACKAGE",
"url": "https://github.com/phpmyadmin/composer"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201701-32"
@@ -67,8 +128,8 @@
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T17:16:37Z",
"nvd_published_at": "2016-07-03T01:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-x394-g9j8-x7mf/GHSA-x394-g9j8-x7mf.json → advisories/github-reviewed/2022/05/GHSA-x394-g9j8-x7mf/GHSA-x394-g9j8-x7mf.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x394-g9j8-x7mf",
"modified": "2022-05-13T01:05:22Z",
"modified": "2024-04-24T17:15:57Z",
"published": "2022-05-13T01:05:22Z",
"aliases": [
"CVE-2018-12613"
],
"summary": "phpMyAdmin Improper Authentication",
"details": "An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the \"$cfg['AllowArbitraryServer'] = true\" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the \"$cfg['ServerDefault'] = 0\" case (which bypasses the login requirement and runs the vulnerable code without any authentication).",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "phpmyadmin/phpmyadmin"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.8"
},
{
"fixed": "4.8.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12613"
},
{
"type": "PACKAGE",
"url": "https://github.com/phpmyadmin/composer"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201904-16"
@@ -55,8 +78,8 @@
"CWE-287"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T17:15:56Z",
"nvd_published_at": "2018-06-21T20:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-99xj-xqc9-98hr/GHSA-99xj-xqc9-98hr.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-99xj-xqc9-98hr",
"modified": "2022-05-14T01:15:48Z",
"published": "2022-05-14T01:15:48Z",
"aliases": [
"CVE-2017-1000017"
],
"details": "phpMyAdmin 4.0, 4.4 and 4.6 are vulnerable to a weakness where a user with appropriate permissions is able to connect to an arbitrary MySQL server",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000017"
},
{
"type": "WEB",
"url": "https://www.phpmyadmin.net/security/PMASA-2017-6"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/95732"
}
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-17T13:18:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-mwm8-36c5-j5cf/GHSA-mwm8-36c5-j5cf.json
-62
View File
@@ -1,62 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mwm8-36c5-j5cf",
"modified": "2022-05-14T02:08:58Z",
"published": "2022-05-14T02:08:58Z",
"aliases": [
"CVE-2016-5731"
],
"details": "Cross-site scripting (XSS) vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving an OpenID error message.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5731"
},
{
"type": "WEB",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/418aeea3d83b0b6021bac311d849570acfc6e48c"
},
{
"type": "WEB",
"url": "https://github.com/phpmyadmin/phpmyadmin/commit/94cf3864254ffaf3a69e97d8fc454888368b94ab"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201701-32"
},
{
"type": "WEB",
"url": "https://www.phpmyadmin.net/security/PMASA-2016-24"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00113.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2016-06/msg00114.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3627"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-07-03T01:59:00Z"
}
}