Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-02 05:08:22 +00:00
parent ee48ec5861
commit 824ce281ea
920 changed files with 1951 additions and 5853 deletions
@@ -4,14 +4,10 @@
  "modified": "2020-06-17T16:30:41Z",
  "published": "2017-10-24T18:33:36Z",
  "withdrawn": "2020-06-17T16:30:41Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Moderate severity vulnerability that affects validator",
  "details": "**Withdrawn:** Duplicate of GHSA-79mx-88w7-8f7q",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -44,9 +40,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-17T16:30:41Z",
@@ -4,14 +4,10 @@
  "modified": "2020-06-17T16:30:43Z",
  "published": "2017-10-24T18:33:36Z",
  "withdrawn": "2020-06-17T16:30:43Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Moderate severity vulnerability that affects handlebars",
  "details": "**Withdrawn:** Duplicate of GHSA-9prh-257w-9277",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -44,9 +40,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-17T16:30:43Z",
@@ -4,14 +4,10 @@
  "modified": "2020-06-17T15:15:14Z",
  "published": "2017-10-24T18:33:36Z",
  "withdrawn": "2020-06-17T15:15:14Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Moderate severity vulnerability that affects ember",
  "details": "Withdrawn, accidental duplicate publish.\n\nCross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -139,9 +135,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-17T15:15:14Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "SQL Injection in sequelize",
  "details": "Versions 2.0.0-rc-7 and earlier of `sequelize` are affected by a SQL injection vulnerability when user input is passed into the order parameter.\n\n\n\n## Proof of Concept\n\n```javascript\nTest.findAndCountAll({\nwhere: { id :1 },\norder : [['id', 'UNTRUSTED USER INPUT']]\n})\n```\n\n\n## Recommendation\n\nUpdate to version 2.0.0-rc8 or later",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Directory Traversal in send",
  "details": "Versions 0.8.3 and earlier of `send` are affected by a directory traversal vulnerability. When relying on the root option to restrict file access it may be possible for an application consumer to escape out of the restricted directory and access files in a similarly named directory. \n\nFor example, `static(_dirname + '/public')` would allow access to `_dirname + '/public-restricted'`.\n\n\n## Recommendation\n\nUpdate to version 0.8.4 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Deserialization Code Execution in js-yaml",
  "details": "Versions 2.0.4 and earlier of `js-yaml` are affected by a code execution vulnerability in the YAML deserializer.\n\n## Proof of Concept\n```\nconst yaml = require('js-yaml');\n\nconst x = `test: !!js/function >\nfunction f() { \nconsole.log(1); \n}();`\n\nyaml.load(x);\n```\n\n\n## Recommendation\n\nUpdate js-yaml to version 2.0.5 or later, and ensure that all instances where the `.load()` method is called are updated to use `.safeLoad()` instead.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Denial of Service in hapi",
  "details": "Versions of `hapi` prior to 11.1.3 are affected by a denial of service vulnerability.\n\nThe vulnerability is triggered when certain input is passed into the If-Modified-Since or Last-Modified headers.\n\nThis causes an 'illegal access' exception to be raised, and instead of sending a HTTP 500 error back to the sender, hapi will continue to hold the socket open until timed out (default node timeout is 2 minutes).\n\n\n\n\n\n## Recommendation\n\nUpdate to v11.1.3 or later",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Incorrect handling of CORS preflight request headers in hapi",
  "details": "Versions of `hapi` prior to 11.0.0 implement CORS incorrectly, allowing for configurations that at best return inconsistent headers, and at worst allow cross-origin activities that are expected to be forbidden. \n\nIf the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.\n\n\n## Recommendation\n\nUpdate to version 11.0.0 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -4,14 +4,10 @@
  "modified": "2020-06-17T15:14:53Z",
  "published": "2018-07-31T23:03:17Z",
  "withdrawn": "2020-06-17T15:14:53Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Moderate severity vulnerability that affects moment",
  "details": "Withdrawn, accidental duplicate publish.\n\nThe duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a \"regular expression Denial of Service (ReDoS).\"",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -44,9 +40,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-17T15:14:53Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Moderate severity vulnerability that affects Zope2",
  "details": "Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-wm77-q74p-5763",
  "modified": "2021-08-09T22:21:02Z",
  "published": "2018-07-27T17:06:03Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Path Traversal in superstatic",
  "details": "Affected of `superstatic` are vulnerable to path traversal when used on Windows. \n\nAdditionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize `\\\\` to `/` in paths on all platforms (a known example being Node.js v9.9.0).\n\n\n## Recommendation\n\nUpdate to version 5.0.2 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -4,14 +4,10 @@
  "modified": "2020-06-17T15:15:19Z",
  "published": "2018-07-26T16:24:34Z",
  "withdrawn": "2020-06-17T15:15:19Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Critical severity vulnerability that affects dns-sync",
  "details": "Withdrawn, accidental duplicate publish.\n\nThe dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -44,9 +40,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-17T15:15:19Z",
@@ -4,14 +4,10 @@
  "modified": "2020-06-17T15:14:35Z",
  "published": "2018-08-13T20:49:10Z",
  "withdrawn": "2020-06-17T15:14:35Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Moderate severity vulnerability that affects doorkeeper",
  "details": "Withdrawn, accidental duplicate publish.\n\nThe Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -44,9 +40,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-17T15:14:35Z",
@@ -4,14 +4,10 @@
  "modified": "2020-06-17T15:14:38Z",
  "published": "2018-08-13T20:48:09Z",
  "withdrawn": "2020-06-17T15:14:38Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Moderate severity vulnerability that affects web-console",
  "details": "Withdrawn, accidental duplicate publish.\n\nrequest.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -44,9 +40,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-17T15:14:38Z",
@@ -4,14 +4,10 @@
  "modified": "2020-06-17T15:14:40Z",
  "published": "2018-08-08T22:29:10Z",
  "withdrawn": "2020-06-17T15:14:40Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "High severity vulnerability that affects safemode",
  "details": "Withdrawn, accidental duplicate publish.\n\nThe safemode rubygem, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -44,9 +40,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-17T15:14:40Z",
@@ -4,14 +4,10 @@
  "modified": "2020-06-17T15:14:43Z",
  "published": "2018-08-15T20:03:53Z",
  "withdrawn": "2020-06-17T15:14:43Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "High severity vulnerability that affects colorscore",
  "details": "Withdrawn, accidental duplicate publish.\n\nThe initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth variable.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -44,9 +40,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-17T15:14:43Z",
@@ -4,14 +4,10 @@
  "modified": "2020-06-17T15:14:48Z",
  "published": "2018-08-21T19:03:17Z",
  "withdrawn": "2020-06-17T15:14:48Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "High severity vulnerability that affects activerecord",
  "details": "Withdrawn, accidental duplicate publish.\n\nactiverecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -63,9 +59,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-17T15:14:48Z",
@@ -4,14 +4,10 @@
  "modified": "2021-12-02T23:14:01Z",
  "published": "2018-08-13T20:48:25Z",
  "withdrawn": "2020-06-17T15:14:51Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "High severity vulnerability that affects actionpack",
  "details": "Withdrawn, accidental duplicate publish.\n\nAction Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -91,9 +87,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-17T15:14:51Z",
@@ -4,14 +4,10 @@
  "modified": "2021-12-02T23:09:12Z",
  "published": "2018-08-13T20:47:44Z",
  "withdrawn": "2020-06-17T15:14:58Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Moderate severity vulnerability that affects paperclip",
  "details": "Withdrawn, accidental duplicate publish.\n\nThe thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -48,9 +44,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-17T15:14:58Z",
@@ -4,14 +4,10 @@
  "modified": "2020-06-17T15:15:17Z",
  "published": "2018-08-21T17:09:08Z",
  "withdrawn": "2020-06-17T15:15:17Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "High severity vulnerability that affects espeak-ruby",
  "details": "Withdrawn, accidental duplicate publish.\n\nThe espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or bytes_wav method in lib/espeak/speech.rb.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -44,9 +40,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-17T15:15:17Z",
--- a/Show More
+++ b/Show More