netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-6fvw-x6gw-4wv8
GHSA-cv24-vh45-4hjm
GHSA-g77v-m226-3f7g
GHSA-qj6h-m7xc-r2v3
GHSA-r6g8-mq9v-cgp4
GHSA-q4qm-fv7m-8rf7
GHSA-q4qm-fv7m-8rf7
This commit is contained in:
advisory-database[bot]
2024-04-25 21:25:57 +00:00
parent 2c1988578f
commit 7e2514d96f
7 changed files with 207 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-6fvw-x6gw-4wv8/GHSA-6fvw-x6gw-4wv8.json → advisories/github-reviewed/2022/05/GHSA-6fvw-x6gw-4wv8/GHSA-6fvw-x6gw-4wv8.json
+35 -6
View File
@@ -1,17 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6fvw-x6gw-4wv8",
"modified": "2022-05-24T19:17:16Z",
"modified": "2024-04-25T21:22:44Z",
"published": "2022-05-24T19:17:16Z",
"aliases": [
"CVE-2021-42325"
],
"details": "Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.",
"summary": "Froxlor SQL injection vulnerability",
"details": "Froxlor through 0.10.29.1 allows SQL injection in `Database/Manager/DbManagerMySQL.php` via a custom DB name.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "froxlor/froxlor"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.30"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 0.10.29.1"
}
}
],
"references": [
{
@@ -22,6 +47,10 @@
"type": "WEB",
"url": "https://github.com/Froxlor/Froxlor/commit/eb592340b022298f62a0a3e8450dbfbe29585782"
},
{
"type": "PACKAGE",
"url": "https://github.com/Froxlor/Froxlor"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/50502"
@@ -36,8 +65,8 @@
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:22:44Z",
"nvd_published_at": "2021-10-12T20:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-cv24-vh45-4hjm/GHSA-cv24-vh45-4hjm.json → advisories/github-reviewed/2022/05/GHSA-cv24-vh45-4hjm/GHSA-cv24-vh45-4hjm.json
+21 -5
View File
@@ -1,23 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cv24-vh45-4hjm",
"modified": "2022-05-24T19:18:34Z",
"modified": "2024-04-25T21:22:13Z",
"published": "2022-05-24T19:18:34Z",
"aliases": [
"CVE-2020-28957"
],
"summary": "Foxlor cross-site scripting (XSS) vulnerability",
"details": "Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the name, firstname, or username input fields.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "froxlor/froxlor"
},
"versions": [
"0.10.16"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28957"
},
{
"type": "PACKAGE",
"url": "https://github.com/Froxlor/Froxlor"
},
{
"type": "WEB",
"url": "https://www.vulnerability-lab.com/get_content.php?id=2241"
@@ -28,8 +44,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:22:13Z",
"nvd_published_at": "2021-10-22T20:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-g77v-m226-3f7g/GHSA-g77v-m226-3f7g.json → advisories/github-reviewed/2022/05/GHSA-g77v-m226-3f7g/GHSA-g77v-m226-3f7g.json
+31 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g77v-m226-3f7g",
"modified": "2022-05-13T01:18:46Z",
"modified": "2024-04-25T21:22:31Z",
"published": "2022-05-13T01:18:46Z",
"aliases": [
"CVE-2018-1000527"
],
"summary": "Froxlor PHP Object Injection vulnerability",
"details": "Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $_POST['ssl_ipandport']. This vulnerability appears to have been fixed in after commit c1e62e6.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "froxlor/froxlor"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.40"
}
]
}
]
}
],
"references": [
{
@@ -25,9 +44,17 @@
"type": "WEB",
"url": "https://github.com/Froxlor/Froxlor/issues/555"
},
{
"type": "WEB",
"url": "https://github.com/Froxlor/Froxlor/commit/c1e62e6be719affc003774a639de5c952ffd8ffc"
},
{
"type": "WEB",
"url": "https://0dd.zone/2018/05/31/Froxlor-Object-Injection"
},
{
"type": "PACKAGE",
"url": "https://github.com/Froxlor/Froxlor"
}
],
"database_specific": {
@@ -35,8 +62,8 @@
"CWE-502"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:22:30Z",
"nvd_published_at": "2018-06-26T16:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-qj6h-m7xc-r2v3/GHSA-qj6h-m7xc-r2v3.json → advisories/github-reviewed/2022/05/GHSA-qj6h-m7xc-r2v3/GHSA-qj6h-m7xc-r2v3.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qj6h-m7xc-r2v3",
"modified": "2022-05-17T02:57:53Z",
"modified": "2024-04-25T21:22:15Z",
"published": "2022-05-17T02:57:53Z",
"aliases": [
"CVE-2016-5100"
],
"summary": "Froxlor guessable password reset token",
"details": "Froxlor before 0.9.35 uses the PHP rand function for random number generation, which makes it easier for remote attackers to guess the password reset token by predicting a value.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "froxlor/froxlor"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.35"
}
]
}
]
}
],
"references": [
{
@@ -24,6 +43,10 @@
{
"type": "WEB",
"url": "https://github.com/Froxlor/Froxlor/commit/da4ec3e1b591de96675817a009e26e05e848a6ba"
},
{
"type": "PACKAGE",
"url": "https://github.com/Froxlor/Froxlor"
}
],
"database_specific": {
@@ -31,8 +54,8 @@
"CWE-330"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:22:15Z",
"nvd_published_at": "2017-02-13T18:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-r6g8-mq9v-cgp4/GHSA-r6g8-mq9v-cgp4.json → advisories/github-reviewed/2022/05/GHSA-r6g8-mq9v-cgp4/GHSA-r6g8-mq9v-cgp4.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r6g8-mq9v-cgp4",
"modified": "2022-05-13T01:49:37Z",
"modified": "2024-04-25T21:22:32Z",
"published": "2022-05-13T01:49:37Z",
"aliases": [
"CVE-2018-12642"
],
"summary": "Froxlor Incorrect Access Control",
"details": "Froxlor through 0.9.39.5 has Incorrect Access Control for tickets not owned by the current user.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "froxlor/froxlor"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.40"
}
]
}
]
}
],
"references": [
{
@@ -24,6 +43,10 @@
{
"type": "WEB",
"url": "https://github.com/Froxlor/Froxlor/commit/aa881560cc996c38cbf8c20ee62854e27f72c73c"
},
{
"type": "PACKAGE",
"url": "https://github.com/Froxlor/Froxlor"
}
],
"database_specific": {
@@ -31,8 +54,8 @@
"CWE-732"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:22:32Z",
"nvd_published_at": "2018-06-22T12:29:00Z"
}
}
advisories/github-reviewed/2022/10/GHSA-q4qm-fv7m-8rf7/GHSA-q4qm-fv7m-8rf7.json
+66
View File
@@ -0,0 +1,66 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q4qm-fv7m-8rf7",
"modified": "2024-04-25T21:23:17Z",
"published": "2022-10-31T19:00:35Z",
"withdrawn": "2024-04-25T21:23:17Z",
"aliases": [
"CVE-2022-3772"
],
"summary": "Duplicate Advisory: Cross-Site Request Forgery in easyii CMS",
"details": "# Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-3x3w-vcjx-7796. This link is maintained to preserve external references.\n\n# Original Description\n\nA vulnerability, which was classified as problematic, was found in easyii CMS. Affected is an unknown function of the file /admin/sign/out. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. VDB-212502 is the identifier assigned to this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "noumo/easyii"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.9"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3772"
},
{
"type": "WEB",
"url": "https://github.com/noumo/easyii/issues/222"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-3x3w-vcjx-7796"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.212502"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:23:17Z",
"nvd_published_at": "2022-10-31T14:15:00Z"
}
}
advisories/unreviewed/2022/10/GHSA-q4qm-fv7m-8rf7/GHSA-q4qm-fv7m-8rf7.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q4qm-fv7m-8rf7",
"modified": "2022-11-01T19:00:31Z",
"published": "2022-10-31T19:00:35Z",
"aliases": [
"CVE-2022-3772"
],
"details": "A vulnerability, which was classified as problematic, was found in easyii CMS. Affected is an unknown function of the file /admin/sign/out. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. VDB-212502 is the identifier assigned to this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3772"
},
{
"type": "WEB",
"url": "https://github.com/noumo/easyii/issues/222"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.212502"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-31T14:15:00Z"
}
}