From 776eb3bfa204140e420adcdc10027a403b4fa16f Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 23 Apr 2024 22:40:27 +0000 Subject: [PATCH] Publish Advisories GHSA-9r2j-rg24-fvpj GHSA-qh9w-r7g5-q939 --- .../GHSA-9r2j-rg24-fvpj.json | 31 ++- .../GHSA-qh9w-r7g5-q939.json | 237 ++++++++++++++++++ 2 files changed, 262 insertions(+), 6 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-9r2j-rg24-fvpj/GHSA-9r2j-rg24-fvpj.json (55%) create mode 100644 advisories/github-reviewed/2024/04/GHSA-qh9w-r7g5-q939/GHSA-qh9w-r7g5-q939.json diff --git a/advisories/unreviewed/2022/05/GHSA-9r2j-rg24-fvpj/GHSA-9r2j-rg24-fvpj.json b/advisories/github-reviewed/2022/05/GHSA-9r2j-rg24-fvpj/GHSA-9r2j-rg24-fvpj.json similarity index 55% rename from advisories/unreviewed/2022/05/GHSA-9r2j-rg24-fvpj/GHSA-9r2j-rg24-fvpj.json rename to advisories/github-reviewed/2022/05/GHSA-9r2j-rg24-fvpj/GHSA-9r2j-rg24-fvpj.json index d1b89c873e2..278ef9529e8 100644 --- a/advisories/unreviewed/2022/05/GHSA-9r2j-rg24-fvpj/GHSA-9r2j-rg24-fvpj.json +++ b/advisories/github-reviewed/2022/05/GHSA-9r2j-rg24-fvpj/GHSA-9r2j-rg24-fvpj.json @@ -1,12 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-9r2j-rg24-fvpj", - "modified": "2023-02-03T21:30:25Z", + "modified": "2024-04-23T22:39:50Z", "published": "2022-05-24T17:12:48Z", "aliases": [ "CVE-2020-10963" ], - "details": "FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.", + "summary": "FrozenNode Laravel-Administrator unrestricted file upload", + "details": "FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via `admin/tips_image/image/file_upload` image upload with PHP content within a GIF image that has the `.php` extension. NOTE: this product is discontinued.", "severity": [ { "type": "CVSS_V3", @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "frozennode/administrator" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "5.0.12" + } + ] + } + ] + } ], "references": [ { @@ -34,9 +53,9 @@ "cwe_ids": [ "CWE-434" ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:39:50Z", "nvd_published_at": "2020-03-25T22:15:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/04/GHSA-qh9w-r7g5-q939/GHSA-qh9w-r7g5-q939.json b/advisories/github-reviewed/2024/04/GHSA-qh9w-r7g5-q939/GHSA-qh9w-r7g5-q939.json new file mode 100644 index 00000000000..de92f4cef96 --- /dev/null +++ b/advisories/github-reviewed/2024/04/GHSA-qh9w-r7g5-q939/GHSA-qh9w-r7g5-q939.json @@ -0,0 +1,237 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qh9w-r7g5-q939", + "modified": "2024-04-23T22:39:03Z", + "published": "2024-04-23T22:39:03Z", + "aliases": [ + "CVE-2014-8089" + ], + "summary": "Zend Framework SQL injection vulnerability", + "details": "SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zendframework1" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.12.0" + }, + { + "fixed": "1.12.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zend-db" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.99" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zend-db" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.1.0" + }, + { + "fixed": "2.1.99" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zend-db" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.2.0" + }, + { + "fixed": "2.2.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zend-db" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.3.0" + }, + { + "fixed": "2.3.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zendframework" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.99" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zendframework" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.1.0" + }, + { + "fixed": "2.1.99" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zendframework" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.2.0" + }, + { + "fixed": "2.2.8" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "zendframework/zendframework" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.3.0" + }, + { + "fixed": "2.3.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8089" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1151277" + }, + { + "type": "WEB", + "url": "https://framework.zend.com/security/advisory/ZF2014-06" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zend-db/CVE-2014-8089.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework/CVE-2014-8089.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/CVE-2014-8089.yaml" + }, + { + "type": "WEB", + "url": "http://framework.zend.com/security/advisory/ZF2014-06" + }, + { + "type": "WEB", + "url": "http://seclists.org/oss-sec/2014/q4/276" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/70011" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:39:03Z", + "nvd_published_at": "2020-02-17T22:15:00Z" + } +} \ No newline at end of file