mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Advisory Database Sync
This commit is contained in:
advisory-database[bot]
@@ -8,9 +8,7 @@
|
||||
],
|
||||
"summary": "Content Injection in remarkable",
|
||||
"details": "Versions 1.4.0 and earlier of `remarkable` are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of `remarkable` did not properly whitelist link protocols, and consequently allowed `javascript:` to be used. \n\n\n### Proof of Concept\n\nMarkdown Source:\n```\n[link](<javascript:alert(1)>)\n```\n\nRendered HTML:\n```\n<a href=\"javascript:alert(1)\">link</a>\n```\n\n\n## Recommendation\n\nUpdate to version 1.4.1 or later",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-c7pp-x73h-4m2v",
|
||||
"modified": "2021-09-27T15:43:19Z",
|
||||
"published": "2020-09-02T15:53:46Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Cross-Site Scripting in bootstrap-vue",
|
||||
"details": "Versions of `bootstrap-vue` prior to 2.0.0-rc.12 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization, components may be vulnerable to Cross-Site Scripting through the `options` variable. This may lead to the execution of malicious JavaScript on the user's browser.\n\n\n## Recommendation\n\nUpgrade to version 2.0.0-rc.12 or later.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-cr56-66mx-293v",
|
||||
"modified": "2021-10-04T21:12:14Z",
|
||||
"published": "2020-09-03T15:53:50Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Cross-Site Scripting in @toast-ui/editor",
|
||||
"details": "Versions of `@toast-ui/editor` prior to 2.2.0 are vulnerable to Cross-Site Scripting (XSS). There are multiple bypasses to the package's built-in XSS sanitization. This may allow attackers to execute arbitrary JavaScript on a victim's browser.\n\n## Recommendation\n\nUpgrade to version 2.2.0 or later.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-g336-c7wv-8hp3",
|
||||
"modified": "2021-09-23T21:35:43Z",
|
||||
"published": "2020-09-01T15:58:06Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Cross-Site Scripting in swagger-ui",
|
||||
"details": "Affected versions of `swagger-ui` are vulnerable to cross-site scripting via the `url` query string parameter.\n\n\n## Recommendation\n\nUpdate to 2.2.1 or later.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-26hp-cgjj-m2j3",
|
||||
"modified": "2024-05-15T21:44:46Z",
|
||||
"published": "2024-05-15T21:44:46Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "fuel/core ImageMagick driver does not escape all shell arguments.",
|
||||
"details": "This vulnerability may cause OS commands to be executed when you pass unvalidated image filenames containing specially crafted strings to the ImageMagick driver.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-26hq-7286-mg8f",
|
||||
"modified": "2024-05-15T22:33:44Z",
|
||||
"published": "2024-05-15T22:33:44Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability",
|
||||
"details": "Zend Framework 1 vulnerability can be remotely exploited to execute code in Magento 1. While the issue is not reproducible in Magento 2, the library code is the same so it was fixed as well.\n\nNote: while the vulnerability is scored as critical, few systems are affected. To be affected by the vulnerability the installation has to:\n\n- use sendmail as the mail transport agent\n\n- have specific, non-default configuration settings as described [here](https://magento.com/security/patches/supee-9652#:~:text=settings%20as%20described-,here,-.).",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -47,9 +43,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-05-15T22:33:44Z",
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-2867-6rrm-38gr",
|
||||
"modified": "2024-05-15T21:56:10Z",
|
||||
"published": "2024-05-15T21:56:10Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Laravel Cookie serialization vulnerability",
|
||||
"details": "Laravel 5.6.30 is a security release of Laravel and is recommended as an immediate upgrade for all users. Laravel 5.6.30 also contains a breaking change to cookie encryption and serialization logic. Refer to [laravel advisory](https://laravel.com/docs/5.6/upgrade#upgrade-5.6.30) for more details and read the notes carefully when upgrading your application.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-297g-xg4h-7w4c",
|
||||
"modified": "2024-05-15T21:54:05Z",
|
||||
"published": "2024-05-15T21:54:05Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Laravel Cross-site Scripting vulnerability in blade templating",
|
||||
"details": "Laravel is prone to a Cross-site Scripting vulnerability in blade templating.",
|
||||
"severity": [
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-2ffv-r4r9-r8xr",
|
||||
"modified": "2024-05-15T21:52:29Z",
|
||||
"published": "2024-05-15T21:52:29Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Laravel RCE vulnerability in \"cookie\" session driver",
|
||||
"details": "Application's using the \"cookie\" session driver were the primary applications affected by this vulnerability. Since we have not yet released a security release for the Laravel 5.5 version of the framework, we recommend that all applications running Laravel 5.5 and earlier do not use the \"cookie\" session driver in their production deployments.\n\nRegarding the vulnerability, applications using the \"cookie\" session driver that were also exposing an encryption oracle via their application were vulnerable to remote code execution. An encryption oracle is a mechanism where arbitrary user input is encrypted and the encrypted string is later displayed or exposed to the user. This combination of scenarios lets the user generate valid Laravel signed encryption strings for any plain-text string, thus allowing them to craft Laravel session payloads when an application is using the \"cookie\" driver.\n\nThis fix prefixes cookie values with an HMAC hash of the cookie's name before encryption and then verifies a matching hash on decryption, making it impossible to craft a valid cookie payload even if an encryption oracle is exposed via the application.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-2gq2-m628-33xp",
|
||||
"modified": "2024-05-15T21:49:20Z",
|
||||
"published": "2024-05-15T21:49:20Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "gregwar/rst Local File Inclusion Vulnerability",
|
||||
"details": "A Local File Inclusion (LFI) vulnerability has been discovered in the gregwar/rst library, potentially exposing sensitive files on the server to unauthorized users. The issue arises from inadequate input validation, allowing an attacker to manipulate file paths and include arbitrary files.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -55,9 +51,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-05-15T21:49:20Z",
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-2vh3-cj9j-mcj5",
|
||||
"modified": "2024-05-15T21:29:15Z",
|
||||
"published": "2024-05-15T21:29:15Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "eZ Publish Legacy Cross-site Scripting (XSS) in 'disabled module' error template",
|
||||
"details": "This security advisory fixes a vulnerability in eZ Publish Legacy, and we recommend that you install it as soon as possible if you are using Legacy via the LegacyBridge.\n\nInstallations where all modules are disabled may be vulnerable to XSS injection in the module name. This is a rare configuration, but we still recommend installing the update, which adds the necessary input washing.\n\nTo install, use Composer to update to one of the \"Resolving versions\" mentioned above, or apply this patch manually:\nhttps://github.com/ezsystems/ezpublish-legacy/commit/4697bff700e8cf95d5847ea19dad3479a77b02d9",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-337w-fxpq-5m34",
|
||||
"modified": "2024-05-15T21:02:01Z",
|
||||
"published": "2024-05-15T21:02:01Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Drupal core uses a vulnerable Third-party library CKEditor",
|
||||
"details": "The Drupal project uses the third-party library [CKEditor](https://github.com/ckeditor/ckeditor4), which has released a [security improvement](https://ckeditor.com/blog/CKEditor-4.14-with-Paste-from-LibreOffice-released/#security-issues-fixed) that is needed to protect some Drupal configurations.\n\nVulnerabilities are possible if Drupal is configured to use the WYSIWYG CKEditor for your site's users. An attacker that can create or edit content may be able to exploit this Cross Site Scripting (XSS) vulnerability to target users with access to the WYSIWYG CKEditor, and this may include site admins with privileged access.\n\nThe latest versions of Drupal update CKEditor to 4.14 to mitigate the vulnerabilities.",
|
||||
"severity": [
|
||||
@@ -69,9 +67,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-05-15T21:02:01Z",
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-39j2-4p9j-5w4j",
|
||||
"modified": "2024-05-15T21:32:29Z",
|
||||
"published": "2024-05-15T21:32:29Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Ez Platform Object Injection in legacy shop module",
|
||||
"details": "This Security Advisory is about a vulnerability in the Legacy shop module. A backend editor could perform object injection in discount rules. This would require backend access and permission to edit discount rules. While object injection in itself is a serious vulnerability, the permission requirement means that normally only administrators would be able to exploit it, that's why it was classified as Medium severity.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-3g43-xfrw-pv5m",
|
||||
"modified": "2024-05-15T21:34:59Z",
|
||||
"published": "2024-05-15T21:34:59Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "eZ Platform User data disclosure",
|
||||
"details": "In eZ Platform v2.3.x it is possible to bypass permission checks in a particular case. This means user data such as name and email (but not passwords or password hashes) can be read by unauthenticated users. This affects only v2.3.x. If you use v2.2.x or older you are not affected.\n\nTo install, use Composer to update \"ezsystems/repository-forms\" to the \"Resolving versions\" mentioned above, or apply this patch manually:\nhttps://github.com/ezsystems/repository-forms/commit/ea82e136ec1ea40aca714abb79cc8e5bfece01e8\n\nHave you found a security bug in eZ Publish or eZ Platform? See how to report it responsibly here: https://doc.ez.no/Security",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-3vwr-jj4f-h98x",
|
||||
"modified": "2024-05-15T21:19:07Z",
|
||||
"published": "2024-05-15T21:19:07Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "eZ Publish Remote code execution in file uploads",
|
||||
"details": "This Security Advisory is about a vulnerability in the way eZ Platform and eZ Publish Legacy handles file uploads, which can in the worst case lead to remote code execution (RCE), a very serious threat. An attacker would need access to uploading files to be able to exploit the vulnerability, so if you have strict controls on this and trust all who have this permission, you're not affected. On the basis of the tests we have made, we also believe the vulnerability cannot be exploited as long as our recommended vhost configuration is used. Here is the v2.5 recommendation for Nginx, as an example:\n\nhttps://github.com/ezsystems/ezplatform/blob/2.5/doc/nginx/vhost.template#L31\n\nThis vhost template specifies that only the file app.php in the web root is executed, while vulnerable configurations allow execution of any php file. Apache is affected in the same way as Nginx, and is also protected by using the recommended configuration. The build-in webserver in PHP stays vulnerable, as it doesn't use this type of configuration (this webserver should only be used for development, never for production). We cannot be 100% certain our configuration is not vulnerable. We also do not know if all our users use the recommended configuration, so we send out this fix to be on the safe side.\n\nThe fix includes a blacklist feature for uploaded filenames, such as \".php\". The file types on the blacklist cannot be uploaded. The blacklist is configurable. In eZ Platform you will find it as ezsettings.default.io.file_storage.file_type_blacklist in eZ/Bundle/EzPublishCoreBundle/Resources/config/default_settings.yml in vendors/ezsystems/ezpublish-kernel. In eZ Publish Legacy you will find it as FileExtensionBlackList in settings/file.ini. By default it blocks these file types: php, php3, phar, phpt, pht, phtml, pgif. The fix also inclues a new block against path traversal attacks, though this kind of attack was not reproducible in our tests.\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-44pg-c29v-hp6r",
|
||||
"modified": "2024-05-15T22:18:33Z",
|
||||
"published": "2024-05-15T22:18:33Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Laravel Guard bypass in Eloquent models",
|
||||
"details": "In laravel releases before 6.18.34 and 7.23.2. It was possible to mass assign Eloquent attributes that included the model's table name:\n```\n$model->fill(['users.name' => 'Taylor']);\n```\nWhen doing so, Eloquent would remove the table name from the attribute for you. This was a \"convenience\" feature of Eloquent and was not documented.\n\nHowever, when paired with validation, this can lead to unexpected and unvalidated values being saved to the database. For this reason, we have removed the automatic stripping of table names from mass-asignment operations so that the attributes go through the typical \"fillable\" / \"guarded\" logic. Any attributes containing table names that are not explicitly declared as fillable will be discarded.\n\nThis security release will be a breaking change for applications that were relying on the undocumented table name stripping during mass assignment. Since this feature was relatively unknown and undocumented, we expect the vast majority of Laravel applications to be able to upgrade without issues.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-58xv-7h9r-mx3c",
|
||||
"modified": "2024-05-15T20:55:22Z",
|
||||
"published": "2024-05-15T20:55:22Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Drupal Malicious file upload with filenames stating with dot",
|
||||
"details": "Drupal 8 core's file_save_upload() function does not strip the leading and trailing dot ('.') from filenames, like Drupal 7 did.\n\nUsers with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system files such as .htaccess in order to bypass protections afforded by Drupal's default .htaccess file.\n\nAfter this fix, file_save_upload() now trims leading and trailing dots from filenames.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-5gmh-85x8-5cx7",
|
||||
"modified": "2024-05-15T22:34:08Z",
|
||||
"published": "2024-05-15T22:34:08Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities",
|
||||
"details": "Magento Commerce and Open Source 2.2.5 and 2.1.14 contain multiple security enhancements that help close authenticated Admin user remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -66,9 +62,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-05-15T22:34:08Z",
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-5x28-3f32-x523",
|
||||
"modified": "2024-05-15T21:00:34Z",
|
||||
"published": "2024-05-15T21:00:34Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Drupal core Access control bypass ",
|
||||
"details": "The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations.\n\n### Solution: \nIf you are using Drupal 8.7.x, you should upgrade to Drupal 8.7.11.\nIf you are using Drupal 8.8.x, you should upgrade to Drupal 8.8.1.\nVersions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage.\n\nAlternatively, you may mitigate this vulnerability by unchecking the \"Enable advanced UI\" checkbox on `/admin/config/media/media-library`. (This mitigation is not available in 8.7.x.)",
|
||||
"severity": [
|
||||
@@ -69,9 +67,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-05-15T21:00:34Z",
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-64vj-933f-6pm3",
|
||||
"modified": "2024-05-15T21:28:27Z",
|
||||
"published": "2024-05-15T21:28:27Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "eZ Platform Object Injection in SiteAccessMatchListener",
|
||||
"details": "This Security Advisory is about an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE), a very serious threat. All sites may be affected.\n\nUpdate: There are bugs introduced by this fix, particularly but not limited to compound siteaccess matchers. These have been fixed in ezsystems/ezplatform-kernel v1.0.3, and in ezsystems/ezpublish-kernel v7.5.8, v6.13.6.4, and v5.4.15.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user