netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-6rrr-cv38-85fp
GHSA-c8mq-83h4-gm57
GHSA-ff4v-crmx-qh7v
GHSA-fmf6-j3g7-995j
GHSA-gjfq-92fx-g45f
GHSA-hm98-m8vw-mjg2
GHSA-pmj2-vwxv-3w98
GHSA-pvrf-2wf8-jrqv
GHSA-q8cm-r6w4-28gm
GHSA-r8x7-gmq5-6256
GHSA-vxr5-ghr8-4787
GHSA-w28x-jp4q-gc53
GHSA-w32h-m3r8-mq4c
GHSA-x4rq-x9vx-hmx3
GHSA-xxg6-wvf8-73xv
This commit is contained in:
advisory-database[bot]
2022-12-22 15:31:29 +00:00
parent 84332f397e
commit 809391d247
15 changed files with 229 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/12/GHSA-6rrr-cv38-85fp/GHSA-6rrr-cv38-85fp.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.3.0",
"id": "GHSA-6rrr-cv38-85fp",
"modified": "2022-12-17T15:30:24Z",
"modified": "2022-12-22T15:30:21Z",
"published": "2022-12-17T15:30:24Z",
"aliases": [
"CVE-2022-4585"
],
"details": "A vulnerability classified as problematic has been found in Opencaching Deutschland oc-server3. This affects an unknown part of the file htdocs/templates2/ocstyle/start.tpl of the component Cookie Handler. The manipulation of the argument usercountryCode leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is c720f2777a452186c67ef30db3679dd409556544. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216171.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -35,7 +38,7 @@
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false
}
}
advisories/unreviewed/2022/12/GHSA-c8mq-83h4-gm57/GHSA-c8mq-83h4-gm57.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.3.0",
"id": "GHSA-c8mq-83h4-gm57",
"modified": "2022-12-18T06:31:09Z",
"modified": "2022-12-22T15:30:21Z",
"published": "2022-12-18T06:31:09Z",
"aliases": [
"CVE-2022-47517"
],
"details": "An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a url_canonize2 heap-based buffer over-read because of an off-by-one error.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false
}
}
advisories/unreviewed/2022/12/GHSA-ff4v-crmx-qh7v/GHSA-ff4v-crmx-qh7v.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.3.0",
"id": "GHSA-ff4v-crmx-qh7v",
"modified": "2022-12-18T06:31:09Z",
"modified": "2022-12-22T15:30:20Z",
"published": "2022-12-18T06:31:09Z",
"aliases": [
"CVE-2022-47518"
],
"details": "An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false
}
}
advisories/unreviewed/2022/12/GHSA-fmf6-j3g7-995j/GHSA-fmf6-j3g7-995j.json
+33
View File
@@ -0,0 +1,33 @@
{
"schema_version": "1.3.0",
"id": "GHSA-fmf6-j3g7-995j",
"modified": "2022-12-22T15:30:21Z",
"published": "2022-12-22T15:30:21Z",
"aliases": [
"CVE-2022-45966"
],
"details": "here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45966"
},
{
"type": "WEB",
"url": "https://github.com/yinfei6/classcms"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false
}
}
advisories/unreviewed/2022/12/GHSA-gjfq-92fx-g45f/GHSA-gjfq-92fx-g45f.json
+36
View File
@@ -0,0 +1,36 @@
{
"schema_version": "1.3.0",
"id": "GHSA-gjfq-92fx-g45f",
"modified": "2022-12-22T15:30:22Z",
"published": "2022-12-22T15:30:22Z",
"aliases": [
"CVE-2022-41992"
],
"details": "A memory corruption vulnerability exists in the VHD File Format parsing CXSPARSE record functionality of PowerISO PowerISO 8.3. A specially-crafted file can lead to an out-of-bounds write. A victim needs to open a malicious file to trigger this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41992"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2022-1644"
}
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": "HIGH",
"github_reviewed": false
}
}
advisories/unreviewed/2022/12/GHSA-hm98-m8vw-mjg2/GHSA-hm98-m8vw-mjg2.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.3.0",
"id": "GHSA-hm98-m8vw-mjg2",
"modified": "2022-12-17T15:30:24Z",
"modified": "2022-12-22T15:30:21Z",
"published": "2022-12-17T15:30:24Z",
"aliases": [
"CVE-2022-4581"
],
"details": "A vulnerability was found in 1j01 mind-map and classified as problematic. This issue affects some unknown processing of the file app.coffee. The manipulation of the argument html leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 9617e6084dfeccd92079ab4d7f439300a4b24394. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216167.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -31,7 +34,7 @@
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false
}
}
advisories/unreviewed/2022/12/GHSA-pmj2-vwxv-3w98/GHSA-pmj2-vwxv-3w98.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.3.0",
"id": "GHSA-pmj2-vwxv-3w98",
"modified": "2022-12-18T06:31:09Z",
"modified": "2022-12-22T15:30:21Z",
"published": "2022-12-18T06:31:09Z",
"aliases": [
"CVE-2022-47520"
],
"details": "An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false
}
}
advisories/unreviewed/2022/12/GHSA-pvrf-2wf8-jrqv/GHSA-pvrf-2wf8-jrqv.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.3.0",
"id": "GHSA-pvrf-2wf8-jrqv",
"modified": "2022-12-18T06:31:09Z",
"modified": "2022-12-22T15:30:21Z",
"published": "2022-12-18T06:31:09Z",
"aliases": [
"CVE-2022-47519"
],
"details": "An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false
}
}
advisories/unreviewed/2022/12/GHSA-q8cm-r6w4-28gm/GHSA-q8cm-r6w4-28gm.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.3.0",
"id": "GHSA-q8cm-r6w4-28gm",
"modified": "2022-12-18T06:31:08Z",
"modified": "2022-12-22T15:30:21Z",
"published": "2022-12-18T06:31:08Z",
"aliases": [
"CVE-2022-47521"
],
"details": "An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false
}
}
advisories/unreviewed/2022/12/GHSA-r8x7-gmq5-6256/GHSA-r8x7-gmq5-6256.json
+44
View File
@@ -0,0 +1,44 @@
{
"schema_version": "1.3.0",
"id": "GHSA-r8x7-gmq5-6256",
"modified": "2022-12-22T15:30:21Z",
"published": "2022-12-22T15:30:21Z",
"aliases": [
"CVE-2022-4558"
],
"details": "A vulnerability was found in Alinto SOGo up to 5.7.1. It has been classified as problematic. This affects an unknown part of the file SoObjects/SOGo/NSString+Utilities.m of the component Folder/Mail Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is 1e0f5f00890f751e84d67be4f139dd7f00faa5f3. It is recommended to upgrade the affected component. The identifier VDB-215961 was assigned to this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4558"
},
{
"type": "WEB",
"url": "https://github.com/Alinto/sogo/commit/1e0f5f00890f751e84d67be4f139dd7f00faa5f3"
},
{
"type": "WEB",
"url": "https://github.com/Alinto/sogo/releases/tag/SOGo-5.8.0"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.215961"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false
}
}
advisories/unreviewed/2022/12/GHSA-vxr5-ghr8-4787/GHSA-vxr5-ghr8-4787.json
+44
View File
@@ -0,0 +1,44 @@
{
"schema_version": "1.3.0",
"id": "GHSA-vxr5-ghr8-4787",
"modified": "2022-12-22T15:30:22Z",
"published": "2022-12-22T15:30:22Z",
"aliases": [
"CVE-2022-4556"
],
"details": "A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument fullName leads to cross site scripting. The attack may be launched remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is efac49ae91a4a325df9931e78e543f707a0f8e5e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215960.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4556"
},
{
"type": "WEB",
"url": "https://github.com/Alinto/sogo/commit/efac49ae91a4a325df9931e78e543f707a0f8e5e"
},
{
"type": "WEB",
"url": "https://github.com/Alinto/sogo/releases/tag/SOGo-5.8.0"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.215960"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false
}
}
advisories/unreviewed/2022/12/GHSA-w28x-jp4q-gc53/GHSA-w28x-jp4q-gc53.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.3.0",
"id": "GHSA-w28x-jp4q-gc53",
"modified": "2022-12-17T15:30:24Z",
"modified": "2022-12-22T15:30:21Z",
"published": "2022-12-17T15:30:24Z",
"aliases": [
"CVE-2022-4584"
],
"details": "A vulnerability was found in Axiomatic Bento4. It has been rated as critical. Affected by this issue is some unknown functionality of the component mp42aac. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-216170 is the identifier assigned to this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -35,7 +38,7 @@
"cwe_ids": [
"CWE-119"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false
}
}
advisories/unreviewed/2022/12/GHSA-w32h-m3r8-mq4c/GHSA-w32h-m3r8-mq4c.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.3.0",
"id": "GHSA-w32h-m3r8-mq4c",
"modified": "2022-12-18T06:31:09Z",
"modified": "2022-12-22T15:30:21Z",
"published": "2022-12-18T06:31:09Z",
"aliases": [
"CVE-2022-47516"
],
"details": "An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that leads to a failure of the libsofia-sip-ua/tport/tport.c self assertion.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-617"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false
}
}
advisories/unreviewed/2022/12/GHSA-x4rq-x9vx-hmx3/GHSA-x4rq-x9vx-hmx3.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.3.0",
"id": "GHSA-x4rq-x9vx-hmx3",
"modified": "2022-12-17T15:30:24Z",
"modified": "2022-12-22T15:30:21Z",
"published": "2022-12-17T15:30:24Z",
"aliases": [
"CVE-2022-4586"
],
"details": "A vulnerability classified as problematic was found in Opencaching Deutschland oc-server3. This vulnerability affects unknown code of the file htdocs/templates2/ocstyle/cachelists.tpl of the component Cachelist Handler. The manipulation of the argument name_filter/by_filter leads to cross site scripting. The attack can be initiated remotely. The name of the patch is a9f79c7da78cd24a7ef1d298e6bc86006972ea73. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216172.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -35,7 +38,7 @@
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false
}
}
advisories/unreviewed/2022/12/GHSA-xxg6-wvf8-73xv/GHSA-xxg6-wvf8-73xv.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.3.0",
"id": "GHSA-xxg6-wvf8-73xv",
"modified": "2022-12-17T15:30:24Z",
"modified": "2022-12-22T15:30:21Z",
"published": "2022-12-17T15:30:24Z",
"aliases": [
"CVE-2022-4582"
],
"details": "A vulnerability was found in starter-public-edition-4 up to 4.6.10. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 4.6.11 is able to address this issue. The name of the patch is 2606983c20f6ea3430ac4b36b3d2e88aafef45da. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216168.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -35,7 +38,7 @@
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false
}
}