netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3c6v-c67v-hx4q
GHSA-chfh-m75v-856c
GHSA-rj8p-c8g2-ppv6
GHSA-5w6g-chqx-w668
GHSA-8hfj-v3g5-5mpj
GHSA-c6h3-4727-9w7w
GHSA-hwpw-xpj3-c397
GHSA-j5x9-c5fm-gqwf
GHSA-m6xf-rg25-42wc
GHSA-m854-6wh4-fmg2
GHSA-q4h3-rm8f-c8qr
This commit is contained in:
advisory-database[bot]
2024-05-06 12:31:58 +00:00
parent 6d729e6902
commit 812325e0bd
11 changed files with 234 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-3c6v-c67v-hx4q/GHSA-3c6v-c67v-hx4q.json
+7 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3c6v-c67v-hx4q",
"modified": "2022-05-24T17:12:54Z",
"modified": "2024-05-06T12:30:25Z",
"published": "2022-05-24T17:12:54Z",
"aliases": [
"CVE-2020-3920"
],
"details": "UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
@@ -25,7 +28,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-287"
"CWE-287",
"CWE-306"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2022/05/GHSA-chfh-m75v-856c/GHSA-chfh-m75v-856c.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-chfh-m75v-856c",
"modified": "2022-05-24T17:12:55Z",
"modified": "2024-05-06T12:30:25Z",
"published": "2022-05-24T17:12:55Z",
"aliases": [
"CVE-2020-3936"
],
"details": "UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2022/05/GHSA-rj8p-c8g2-ppv6/GHSA-rj8p-c8g2-ppv6.json
+7 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rj8p-c8g2-ppv6",
"modified": "2022-05-24T22:28:57Z",
"modified": "2024-05-06T12:30:25Z",
"published": "2022-05-24T22:28:57Z",
"aliases": [
"CVE-2020-3921"
],
"details": "UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -25,7 +28,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-200"
"CWE-200",
"CWE-312"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2024/05/GHSA-5w6g-chqx-w668/GHSA-5w6g-chqx-w668.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5w6g-chqx-w668",
"modified": "2024-05-06T12:30:26Z",
"published": "2024-05-06T12:30:25Z",
"aliases": [
"CVE-2023-6854"
],
"details": "The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom postmeta output in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping on user supplied post meta fields. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6854"
},
{
"type": "WEB",
"url": "https://breakdance.com/breakdance-1-7-1-now-available-security-update"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e92a0387-bd09-46d3-9f6c-09f701b9e550?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-06T11:15:46Z"
}
}
advisories/unreviewed/2024/05/GHSA-8hfj-v3g5-5mpj/GHSA-8hfj-v3g5-5mpj.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8hfj-v3g5-5mpj",
"modified": "2024-05-06T12:30:26Z",
"published": "2024-05-06T12:30:26Z",
"aliases": [
"CVE-2024-3576"
],
"details": "The NPort 5100A Series prior to version 1.6 is affected by web server XSS vulnerability. The vulnerability is caused by not correctly neutralizing user-controllable input before placing it in output. Malicious users may use the vulnerability to get sensitive information and escalate privileges. ",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3576"
},
{
"type": "WEB",
"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-246328-nport-5100a-series-store-xss-vulnerability"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-06T12:15:08Z"
}
}
advisories/unreviewed/2024/05/GHSA-c6h3-4727-9w7w/GHSA-c6h3-4727-9w7w.json
+9 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c6h3-4727-9w7w",
"modified": "2024-05-03T03:30:47Z",
"modified": "2024-05-06T12:30:25Z",
"published": "2024-05-03T03:30:47Z",
"aliases": [
"CVE-2024-34403"
@@ -25,6 +25,14 @@
{
"type": "WEB",
"url": "https://github.com/uriparser/uriparser/pull/186"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/05/06/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/05/06/3"
}
],
"database_specific": {
advisories/unreviewed/2024/05/GHSA-hwpw-xpj3-c397/GHSA-hwpw-xpj3-c397.json
+9 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hwpw-xpj3-c397",
"modified": "2024-05-03T03:30:47Z",
"modified": "2024-05-06T12:30:25Z",
"published": "2024-05-03T03:30:47Z",
"aliases": [
"CVE-2024-34402"
@@ -25,6 +25,14 @@
{
"type": "WEB",
"url": "https://github.com/uriparser/uriparser/pull/185"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/05/06/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/05/06/3"
}
],
"database_specific": {
advisories/unreviewed/2024/05/GHSA-j5x9-c5fm-gqwf/GHSA-j5x9-c5fm-gqwf.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j5x9-c5fm-gqwf",
"modified": "2024-05-06T12:30:26Z",
"published": "2024-05-06T12:30:26Z",
"aliases": [
"CVE-2023-49675"
],
"details": "An unauthenticated local attacker may trick a user to open corrupted project files to execute arbitrary code or crash the system due to an out-of-bounds write vulnerability.\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49675"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2024-024"
}
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-06T12:15:07Z"
}
}
advisories/unreviewed/2024/05/GHSA-m6xf-rg25-42wc/GHSA-m6xf-rg25-42wc.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m6xf-rg25-42wc",
"modified": "2024-05-03T21:30:30Z",
"modified": "2024-05-06T12:30:25Z",
"published": "2024-05-03T21:30:30Z",
"aliases": [
"CVE-2024-34455"
@@ -25,6 +25,10 @@
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2024/04/11/13"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/05/06/2"
}
],
"database_specific": {
advisories/unreviewed/2024/05/GHSA-m854-6wh4-fmg2/GHSA-m854-6wh4-fmg2.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m854-6wh4-fmg2",
"modified": "2024-05-06T12:30:26Z",
"published": "2024-05-06T12:30:26Z",
"aliases": [
"CVE-2024-33753"
],
"details": "Section Camera V2.5.5.3116-S50-SMA-B20160811 and earlier versions allow the accounts and passwords of administrators and users to be changed without authorization.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33753"
},
{
"type": "WEB",
"url": "https://github.com/kklzzcun/Camera/blob/main/Camera/%E8%B6%8A%E6%9D%83%E4%BF%AE%E6%94%B9%E7%AE%A1%E7%90%86%E5%91%98%E6%88%96%E7%94%A8%E6%88%B7%E4%BF%A1%E6%81%AF.md"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-06T12:15:08Z"
}
}
advisories/unreviewed/2024/05/GHSA-q4h3-rm8f-c8qr/GHSA-q4h3-rm8f-c8qr.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q4h3-rm8f-c8qr",
"modified": "2024-05-06T12:30:26Z",
"published": "2024-05-06T12:30:26Z",
"aliases": [
"CVE-2023-49676"
],
"details": "An unauthenticated local attacker may trick a user to open corrupted project files to crash the system due to use after free vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49676"
},
{
"type": "WEB",
"url": "https://cert.vde.com/en/advisories/VDE-2024-024"
}
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-06T12:15:08Z"
}
}