Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-11-29 05:19:30 +00:00
parent aa4812df6a
commit 7afda2a832
904 changed files with 1852 additions and 5556 deletions
@@ -8,9 +8,7 @@
  ],
  "summary": "Sandbox Breakout / Arbitrary Code Execution in static-eval",
  "details": "Affected versions of `static-eval` pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package.\n\n## Proof of concept\n```js\nvar evaluate = require('static-eval');\nvar parse = require('esprima').parse;\nvar src = '(function(){console.log(process.pid)})()';\nvar ast = parse(src).body[0].expression;\nvar res = evaluate(ast, {});\n// Will print the process id\n```\n\n\n## Recommendation\n\nUpdate to version 2.0.0 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Private Data Disclosure in express-restify-mongoose",
  "details": "Affected versions of `express-restify-mongoose` are susceptible to an information leakage vulnerability which may allow an attacker to access fields on a model even if those fields are marked as private.\n\n\n## Proof of Concept\n\nIf you have a user model that you want to protect, such as the following User model:\n```\nconst User = mongoose.model('User', new mongoose.Schema({\n    name: String,\n    password: String,\n}));\n```\n\nYou would normally do something such as:\n```\nrestify.serve(router, User, {\n    private: ['password'], // Set the password part of User as private, so outside people can't read it\n})\n```\n\nThis would hide the password field from people that send your application a `GET /User` and `GET /User/some-user-id` request. \n\nA malicious user can go to your application and send a request for `GET /User?distinct=password` and get all the passwords for all the users in the database, despite the field being set to private. This could be used for other private data, if the malicious user knew what was set as private for specific routes.\n\n\n## Recommendation\n\nVersion 2.x: Update to version 2.5.0 or later.\nVersion 3.x: Update to version 3.1.0 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Regular Expression Denial of Service in jadedown",
  "details": "The `jadedown` package is affected by a regular expression denial of service vulnerability when certain types of user input are passed in.\n\n\n### Proof of concept\n```js\nvar jadedown = require('jadedown');\n\nvar genstr = function (len, chr) {\n    var result = \"\";\n    for (i=0; i<=len; i++) {\n        result = result + chr;\n    }\n\n    return result;\n}\n\n\nfor (i=1;i<=10000000;i=i+1) {\n    console.log(\"COUNT: \" + i);\n    var str = genstr(i, 'f') + genstr(i, '#') + '{';\n    console.log(\"LENGTH: \" + str.length);\n    var start = process.hrtime();\n    jadedown(str)\n\n    var end = process.hrtime(start);\n    console.log(end);\n}\n\n```\n\nResults demonstrating blocking for 5 seconds using only 48 characters.\n\n```\n$ node jadedown.js\nCOUNT: 1\nLENGTH: 6\n[ 0, 4014065 ]\nCOUNT: 4\nLENGTH: 12\n[ 0, 503507 ]\nCOUNT: 7\nLENGTH: 18\n[ 0, 325225 ]\nCOUNT: 10\nLENGTH: 24\n[ 0, 1632684 ]\nCOUNT: 13\nLENGTH: 30\n[ 0, 7541230 ]\nCOUNT: 16\nLENGTH: 36\n[ 0, 80889495 ]\nCOUNT: 19\nLENGTH: 42\n[ 0, 636009936 ]\nCOUNT: 22\nLENGTH: 48\n[ 5, 820586760 ]\n```\n\n# Timeline\n- October 24, 2015 - Vulnerability Identified\n- October 24, 2015 - Maintainers Notified\n- October 25, 2015 - Response from Maintainers with intent to fix\n- January 5, 2016 - Advisory Published\n- January 11, 2016 - CVE Requested\n\n\n## Recommendation\n\nThis package is not actively maintained, and has not seen an update since 2011. \n\nThe package also provides unique functionality in the form of a templating language that is not available elsewhere. If this package is used to process user input, the best available mitigation is to refactor the dependent application to not make use of this module.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -58,9 +58,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-06T14:22:40Z",
@@ -62,9 +62,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-06T14:29:54Z",
@@ -63,9 +63,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-05T23:20:00Z",
@@ -58,9 +58,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-06T18:18:40Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-wjfc-pgfp-pv9c",
  "modified": "2023-04-21T20:27:30Z",
  "published": "2023-04-21T20:27:30Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Improper Input Validation in nyholm/psr7",
  "details": "### Impact\n\nImproper header parsing. An attacker could sneak in a newline (`\\n`) into both the header names and values. While the specification states that `\\r\\n\\r\\n` is used to terminate the header list, many servers in the wild will also accept `\\n\\n`.\n\n### Patches\n\nThe issue is patched in 1.6.1.\n\n### Workarounds\n\nThere are no known workarounds.\n\n### References\n\n* https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4",
  "severity": [
@@ -4,9 +4,7 @@
  "modified": "2023-05-10T21:18:54Z",
  "published": "2023-05-10T06:30:29Z",
  "withdrawn": "2023-05-10T21:18:54Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: Cross-site Scripting (XSS) in name field of Custom Reports",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-m6m9-gr85-79vm. This link is maintained to preserve external references.\n\n## Original Description\nCross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.",
  "severity": [
@@ -4,9 +4,7 @@
  "modified": "2023-05-10T21:18:29Z",
  "published": "2023-05-10T06:30:27Z",
  "withdrawn": "2023-05-10T21:18:29Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: Pimcore Cross-site Scripting (XSS) in Static Routes name field",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-mhpj-7m7h-8p6x. This link is maintained to preserve external references.\n\n## Original Description\nCross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.",
  "severity": [
@@ -4,9 +4,7 @@
  "modified": "2023-05-10T21:19:09Z",
  "published": "2023-05-10T06:30:29Z",
  "withdrawn": "2023-05-10T21:19:09Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: Cross-site Scripting (XSS) in Predefined Properties delete",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-q7cc-m6jw-m262. This link is maintained to preserve external references.\n\n## Original DescriptionCross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.",
  "severity": [
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2001-1448"
  ],
  "details": "Magic eDeveloper Enterprise Edition 8.30-5 and earlier allows local users to overwrite arbitrary files and possibly execute code via a symlink attack on temporary files created by the (1) mkuserproc, (2) mgrnt, and (3) mgdatasrvr.sc scripts.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -32,9 +28,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -7,12 +7,8 @@
    "CVE-2001-1299"
  ],
  "details": "Zorbat Zorbstats PHP script before 0.9 allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -44,9 +40,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -7,12 +7,8 @@
    "CVE-2001-1292"
  ],
  "details": "Sambar Telnet Proxy/Server allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long password.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -28,9 +24,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -7,12 +7,8 @@
    "CVE-2001-1463"
  ],
  "details": "The remote administration client for RhinoSoft Serv-U 3.0 sends the user password in plaintext even when S/KEY One-Time Password (OTP) authentication is enabled, which allows remote attackers to sniff passwords.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -32,9 +28,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -7,12 +7,8 @@
    "CVE-2001-1504"
  ],
  "details": "Lotus Notes R5 Client 4.6 allows remote attackers to execute arbitrary commands via a Lotus Notes object with code in an event, which is automatically executed when the user processes the e-mail message.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -36,9 +32,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
--- a/Show More
+++ b/Show More