mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-2xv7-fwh6-x7fc GHSA-4f4h-jgjp-3vfg GHSA-4j79-4m6q-77vf GHSA-6wc4-v4v5-3m82 GHSA-9738-c49q-4rgc GHSA-c4wx-3x5q-hf4w GHSA-fmqq-hw9m-448q GHSA-jj94-j4r3-5gr4 GHSA-xhc3-5pgf-p576 GHSA-2xv7-fwh6-x7fc GHSA-4j79-4m6q-77vf GHSA-6wc4-v4v5-3m82 GHSA-fmqq-hw9m-448q GHSA-jj94-j4r3-5gr4
This commit is contained in:
@@ -0,0 +1,68 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2xv7-fwh6-x7fc",
|
||||
"modified": "2024-04-25T21:53:56Z",
|
||||
"published": "2022-05-14T02:01:19Z",
|
||||
"aliases": [
|
||||
"CVE-2017-10795"
|
||||
],
|
||||
"summary": "Subrion Cross-site scripting (XSS) vulnerability",
|
||||
"details": "Cross-site scripting (XSS) vulnerability in Subrion CMS allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "intelliants/subrion"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"fixed": "4.1.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"last_known_affected_version_range": "<= 4.1.5"
|
||||
}
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10795"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/intelliants/subrion/issues/467"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/intelliants/subrion"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.securityfocus.com/bid/99378"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-25T21:53:56Z",
|
||||
"nvd_published_at": "2017-07-02T13:29:00Z"
|
||||
}
|
||||
}
|
||||
+26
-6
@@ -1,35 +1,55 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4f4h-jgjp-3vfg",
|
||||
"modified": "2022-05-24T17:16:53Z",
|
||||
"modified": "2024-04-25T21:54:41Z",
|
||||
"published": "2022-05-24T17:16:53Z",
|
||||
"aliases": [
|
||||
"CVE-2020-12468"
|
||||
],
|
||||
"summary": "Subrion CMS CSV injection via Export Language",
|
||||
"details": "Subrion CMS 4.2.1 allows CSV injection via a phrase value within a language. This is related to phrases/add/ and languages/download/.",
|
||||
"severity": [
|
||||
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "intelliants/subrion"
|
||||
},
|
||||
"versions": [
|
||||
"4.2.1"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12468"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://belong2yourself.github.io/vulnerabilities/docs/Subrion%20CMS/CSV%20Injection/readme"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/belong2yourself/vulnerabilities/tree/master/Subrion%20CMS/CSV%20Injection"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/intelliants/subrion"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-25T21:54:41Z",
|
||||
"nvd_published_at": "2020-04-29T21:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4j79-4m6q-77vf",
|
||||
"modified": "2024-04-25T21:54:12Z",
|
||||
"published": "2022-05-14T02:00:54Z",
|
||||
"aliases": [
|
||||
"CVE-2017-5543"
|
||||
],
|
||||
"summary": "Subrion CMS PHP Object Injection",
|
||||
"details": "`includes/classes/ia.core.users.php` in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "intelliants/subrion"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "4.0.5"
|
||||
},
|
||||
{
|
||||
"fixed": "4.1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"versions": [
|
||||
"4.0.5"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5543"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/intelliants/subrion/issues/297"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/intelliants/subrion/commit/019dee20a38f39a5827aae2eb92f09b1f6afb7bb"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/intelliants/subrion"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.securityfocus.com/bid/95688"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-94"
|
||||
],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-25T21:54:12Z",
|
||||
"nvd_published_at": "2017-01-20T08:59:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,61 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-6wc4-v4v5-3m82",
|
||||
"modified": "2024-04-25T21:54:23Z",
|
||||
"published": "2022-05-14T02:00:53Z",
|
||||
"aliases": [
|
||||
"CVE-2018-15563"
|
||||
],
|
||||
"summary": "Subrion CMS Stored Cross-site Scripting (XSS)",
|
||||
"details": "`_core/admin/pages/add/` in Subrion CMS 4.2.1 has XSS via the titles[en] parameter.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "intelliants/subrion"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"last_affected": "4.2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15563"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://cxsecurity.com/issue/WLB-2018090261"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/intelliants/subrion"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-25T21:54:23Z",
|
||||
"nvd_published_at": "2018-10-02T18:29:00Z"
|
||||
}
|
||||
}
|
||||
+21
-4
@@ -1,11 +1,12 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-9738-c49q-4rgc",
|
||||
"modified": "2022-05-14T02:00:32Z",
|
||||
"modified": "2024-04-25T21:54:26Z",
|
||||
"published": "2022-05-14T02:00:32Z",
|
||||
"aliases": [
|
||||
"CVE-2018-16327"
|
||||
],
|
||||
"summary": "Subrion Cross-site Scripting (XSS)",
|
||||
"details": "There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.",
|
||||
"severity": [
|
||||
{
|
||||
@@ -14,7 +15,15 @@
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "intelliants/subrion"
|
||||
},
|
||||
"versions": [
|
||||
"4.2.1"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
@@ -24,6 +33,14 @@
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/intelliants/subrion/issues/771"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/intelliants/subrion/commit/ec8e6e8984eeebfaf0d8022f4c07aa508624ee18"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/intelliants/subrion"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
@@ -31,8 +48,8 @@
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-25T21:54:26Z",
|
||||
"nvd_published_at": "2018-09-01T22:29:00Z"
|
||||
}
|
||||
}
|
||||
+23
-7
@@ -1,23 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-c4wx-3x5q-hf4w",
|
||||
"modified": "2022-05-24T17:17:57Z",
|
||||
"modified": "2024-04-25T21:54:34Z",
|
||||
"published": "2022-05-24T17:17:57Z",
|
||||
"aliases": [
|
||||
"CVE-2019-20390"
|
||||
],
|
||||
"summary": "Subrion CMS Cross-Site Request Forgery (CSRF) vulnerability",
|
||||
"details": "A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Subrion CMS 4.2.1 that allows a remote attacker to remove files on the server without a victim's knowledge, by enticing an authenticated user to visit an attacker's web page. The application fails to validate the CSRF token for a GET request. An attacker can craft a panel/uploads/read.json?cmd=rm URL (removing this token) and send it to the victim.",
|
||||
"severity": [
|
||||
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "intelliants/subrion"
|
||||
},
|
||||
"versions": [
|
||||
"4.2.1"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20390"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/intelliants/subrion"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://packetstormsecurity.com/files/157700/Subrion-CMS-4.2.1-Cross-Site-Request-Forgery.html"
|
||||
@@ -25,11 +41,11 @@
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
"CWE-352"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-25T21:54:34Z",
|
||||
"nvd_published_at": "2020-05-15T18:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-fmqq-hw9m-448q",
|
||||
"modified": "2024-04-25T21:54:38Z",
|
||||
"published": "2022-05-24T17:16:53Z",
|
||||
"aliases": [
|
||||
"CVE-2020-12469"
|
||||
],
|
||||
"summary": "Subrion CMS PHP Object Injection",
|
||||
"details": "admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a block to blocks/edit.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "intelliants/subrion"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"last_affected": "4.2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12469"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://belong2yourself.github.io/vulnerabilities/docs/Subrion%20CMS/Insecure%20Deserialization/Subpages%20-%20Authenticated%20PHP%20Object%20Injection/readme"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/belong2yourself/vulnerabilities/tree/master/Subrion%20CMS/Insecure%20Deserialization/Subpages%20-%20Authenticated%20PHP%20Object%20Injection"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/intelliants/subrion"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-502"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-25T21:54:38Z",
|
||||
"nvd_published_at": "2020-04-29T21:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,72 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-jj94-j4r3-5gr4",
|
||||
"modified": "2024-04-25T21:54:28Z",
|
||||
"published": "2022-05-24T19:10:19Z",
|
||||
"aliases": [
|
||||
"CVE-2020-22330"
|
||||
],
|
||||
"summary": "Subrion Cross-Site Scripting (XSS) vulnerability",
|
||||
"details": "Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "intelliants/subrion"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "4.2.1"
|
||||
},
|
||||
{
|
||||
"fixed": "4.2.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"versions": [
|
||||
"4.2.1"
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-22330"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/intelliants/subrion/issues/850"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/intelliants/subrion/commit/06950c2f9c4aa69e323cbdd141beabb6a9273ca4"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/intelliants/subrion/commit/0e9180d2330a00b1ce8e7ec2e92e0a4e0612f1a9"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/intelliants/subrion"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-25T21:54:28Z",
|
||||
"nvd_published_at": "2021-08-06T14:15:00Z"
|
||||
}
|
||||
}
|
||||
+31
-5
@@ -1,23 +1,49 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-xhc3-5pgf-p576",
|
||||
"modified": "2022-05-24T17:46:56Z",
|
||||
"modified": "2024-04-25T21:54:32Z",
|
||||
"published": "2022-05-24T17:46:56Z",
|
||||
"aliases": [
|
||||
"CVE-2020-23761"
|
||||
],
|
||||
"summary": "subrion CMS Cross Site Scripting (XSS) vulnerability",
|
||||
"details": "Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the \"payment gateway\" column on transactions tab.",
|
||||
"severity": [
|
||||
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "Packagist",
|
||||
"name": "intelliants/subrion"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"last_affected": "4.2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-23761"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/intelliants/subrion"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://subrion.org"
|
||||
@@ -32,8 +58,8 @@
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-25T21:54:32Z",
|
||||
"nvd_published_at": "2021-04-09T18:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -1,42 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2xv7-fwh6-x7fc",
|
||||
"modified": "2022-05-14T02:01:19Z",
|
||||
"published": "2022-05-14T02:01:19Z",
|
||||
"aliases": [
|
||||
"CVE-2017-10795"
|
||||
],
|
||||
"details": "Cross-site scripting (XSS) vulnerability in Subrion CMS 4.1.4 allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10795"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/intelliants/subrion/issues/467"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.securityfocus.com/bid/99378"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2017-07-02T13:29:00Z"
|
||||
}
|
||||
}
|
||||
@@ -1,42 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4j79-4m6q-77vf",
|
||||
"modified": "2022-05-14T02:00:54Z",
|
||||
"published": "2022-05-14T02:00:54Z",
|
||||
"aliases": [
|
||||
"CVE-2017-5543"
|
||||
],
|
||||
"details": "includes/classes/ia.core.users.php in Subrion CMS 4.0.5 allows remote attackers to conduct PHP Object Injection attacks via crafted serialized data in a salt cookie in a login request.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5543"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/intelliants/subrion/issues/297"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.securityfocus.com/bid/95688"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-94"
|
||||
],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2017-01-20T08:59:00Z"
|
||||
}
|
||||
}
|
||||
@@ -1,38 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-6wc4-v4v5-3m82",
|
||||
"modified": "2022-05-14T02:00:53Z",
|
||||
"published": "2022-05-14T02:00:53Z",
|
||||
"aliases": [
|
||||
"CVE-2018-15563"
|
||||
],
|
||||
"details": "_core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titles[en] parameter.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-15563"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://cxsecurity.com/issue/WLB-2018090261"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2018-10-02T18:29:00Z"
|
||||
}
|
||||
}
|
||||
@@ -1,35 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-fmqq-hw9m-448q",
|
||||
"modified": "2022-05-24T17:16:53Z",
|
||||
"published": "2022-05-24T17:16:53Z",
|
||||
"aliases": [
|
||||
"CVE-2020-12469"
|
||||
],
|
||||
"details": "admin/blocks.php in Subrion CMS through 4.2.1 allows PHP Object Injection (with resultant file deletion) via serialized data in the subpages value within a block to blocks/edit.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12469"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/belong2yourself/vulnerabilities/tree/master/Subrion%20CMS/Insecure%20Deserialization/Subpages%20-%20Authenticated%20PHP%20Object%20Injection"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2020-04-29T21:15:00Z"
|
||||
}
|
||||
}
|
||||
@@ -1,35 +0,0 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-jj94-j4r3-5gr4",
|
||||
"modified": "2022-05-24T19:10:19Z",
|
||||
"published": "2022-05-24T19:10:19Z",
|
||||
"aliases": [
|
||||
"CVE-2020-22330"
|
||||
],
|
||||
"details": "Cross-Site Scripting (XSS) vulnerability in Subrion 4.2.1 via the title when adding a page.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-22330"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/intelliants/subrion/issues/850"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2021-08-06T14:15:00Z"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user