netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2g23-qmmp-fvmr
GHSA-3g6c-88pf-m46f
GHSA-5r9j-698h-2h5m
GHSA-fp8m-xw3f-6h7x
GHSA-gjx6-58xh-p7pw
GHSA-gmg5-f2gm-p3h7
GHSA-ph84-vg7q-fqq8
GHSA-wr23-m9m2-jjf4
GHSA-ph84-vg7q-fqq8
This commit is contained in:
advisory-database[bot]
2024-04-23 23:17:09 +00:00
parent 5d3eb9b01e
commit 87af437ec8
9 changed files with 250 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-2g23-qmmp-fvmr/GHSA-2g23-qmmp-fvmr.json → advisories/github-reviewed/2022/05/GHSA-2g23-qmmp-fvmr/GHSA-2g23-qmmp-fvmr.json
+23 -7
View File
@@ -1,23 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2g23-qmmp-fvmr",
"modified": "2022-05-24T17:05:27Z",
"modified": "2024-04-23T23:16:11Z",
"published": "2022-05-24T17:05:27Z",
"aliases": [
"CVE-2019-9553"
],
"details": "Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933.",
"summary": "Bolt Cross-site Scripting via the slug, teaser or title parameters",
"details": "Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to `editcontent/pages`, a related issue to CVE-2017-11128 and CVE-2018-19933.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "bolt/bolt"
},
"versions": [
"3.6.4"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9553"
},
{
"type": "PACKAGE",
"url": "https://github.com/bolt/bolt"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/151943/Bold-CMS-3.6.4-Cross-Site-Scripting.html"
@@ -29,11 +45,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:16:11Z",
"nvd_published_at": "2019-12-31T17:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-3g6c-88pf-m46f/GHSA-3g6c-88pf-m46f.json → advisories/github-reviewed/2022/05/GHSA-3g6c-88pf-m46f/GHSA-3g6c-88pf-m46f.json
+31 -5
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3g6c-88pf-m46f",
"modified": "2022-05-13T01:12:16Z",
"modified": "2024-04-23T23:15:59Z",
"published": "2022-05-13T01:12:16Z",
"aliases": [
"CVE-2019-10874"
],
"details": "Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file.",
"summary": "Bolt Cross Site Request Forgery (CSRF)",
"details": "Cross Site Request Forgery (CSRF) in the `bolt/upload` File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the `file/edit/config/config.yml` configuration file.",
"severity": [
{
"type": "CVSS_V3",
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "bolt/bolt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.6.6"
},
{
"fixed": "3.6.7"
}
]
}
],
"versions": [
"3.6.6"
]
}
],
"references": [
{
@@ -29,6 +51,10 @@
"type": "WEB",
"url": "https://fgsec.net/from-csrf-to-rce-bolt-cms"
},
{
"type": "PACKAGE",
"url": "https://github.com/bolt/bolt"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/46664"
@@ -43,8 +69,8 @@
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:15:59Z",
"nvd_published_at": "2019-04-05T05:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-5r9j-698h-2h5m/GHSA-5r9j-698h-2h5m.json → advisories/github-reviewed/2022/05/GHSA-5r9j-698h-2h5m/GHSA-5r9j-698h-2h5m.json
+17 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5r9j-698h-2h5m",
"modified": "2022-05-17T02:27:47Z",
"modified": "2024-04-23T23:15:45Z",
"published": "2022-05-17T02:27:47Z",
"aliases": [
"CVE-2017-11128"
],
"summary": "Bolt stored Cross-site Scripting (XSS)",
"details": "Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry.",
"severity": [
{
@@ -14,13 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "bolt/bolt"
},
"versions": [
"3.2.14"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11128"
},
{
"type": "PACKAGE",
"url": "https://github.com/bolt/bolt"
},
{
"type": "WEB",
"url": "https://websecnerd.blogspot.in/2017/07/bolt-cms-3.html"
@@ -31,8 +44,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:15:45Z",
"nvd_published_at": "2017-07-17T19:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-fp8m-xw3f-6h7x/GHSA-fp8m-xw3f-6h7x.json → advisories/github-reviewed/2022/05/GHSA-fp8m-xw3f-6h7x/GHSA-fp8m-xw3f-6h7x.json
+31 -5
View File
@@ -1,17 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fp8m-xw3f-6h7x",
"modified": "2022-05-24T22:00:24Z",
"modified": "2024-04-23T23:16:18Z",
"published": "2022-05-24T22:00:24Z",
"aliases": [
"CVE-2019-15484"
],
"summary": "Bolt Cross-site Scripting (XSS) via an image's alt or title field",
"details": "Bolt before 3.6.10 has XSS via an image's alt or title field.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "bolt/bolt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.10"
}
]
}
]
}
],
"references": [
{
@@ -22,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/bolt/bolt/pull/7801"
},
{
"type": "PACKAGE",
"url": "https://github.com/bolt/bolt"
},
{
"type": "WEB",
"url": "https://github.com/bolt/bolt/releases/tag/v3.6.10"
@@ -32,8 +58,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:16:18Z",
"nvd_published_at": "2019-08-23T13:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-gjx6-58xh-p7pw/GHSA-gjx6-58xh-p7pw.json → advisories/github-reviewed/2022/05/GHSA-gjx6-58xh-p7pw/GHSA-gjx6-58xh-p7pw.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gjx6-58xh-p7pw",
"modified": "2022-05-14T01:42:52Z",
"modified": "2024-04-23T23:15:49Z",
"published": "2022-05-14T01:42:52Z",
"aliases": [
"CVE-2018-19933"
],
"summary": "Bolt Cross-site Scripting (XSS) via text input click preview button",
"details": "Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "bolt/bolt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19933"
},
{
"type": "PACKAGE",
"url": "https://github.com/bolt/bolt"
},
{
"type": "WEB",
"url": "https://github.com/rdincel1/Bolt-CMS-3.6.2---Cross-Site-Scripting"
@@ -39,8 +62,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:15:49Z",
"nvd_published_at": "2018-12-17T19:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-gmg5-f2gm-p3h7/GHSA-gmg5-f2gm-p3h7.json → advisories/github-reviewed/2022/05/GHSA-gmg5-f2gm-p3h7/GHSA-gmg5-f2gm-p3h7.json
+28 -5
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gmg5-f2gm-p3h7",
"modified": "2022-05-13T01:12:17Z",
"modified": "2024-04-23T23:15:54Z",
"published": "2022-05-13T01:12:17Z",
"aliases": [
"CVE-2019-9185"
],
"details": "Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension.",
"summary": "Bolt Unrestricted Upload of File with Dangerous Type",
"details": "`Controller/Async/FilesystemManager.php` in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a `.php` extension.",
"severity": [
{
"type": "CVSS_V3",
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "bolt/bolt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.5"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/bolt/bolt/pull/7745"
},
{
"type": "PACKAGE",
"url": "https://github.com/bolt/bolt"
},
{
"type": "WEB",
"url": "https://github.com/bolt/bolt/blob/v3.6.5/changelog.md"
@@ -43,8 +66,8 @@
"CWE-434"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:15:54Z",
"nvd_published_at": "2019-03-07T23:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-ph84-vg7q-fqq8/GHSA-ph84-vg7q-fqq8.json
+65
View File
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-ph84-vg7q-fqq8",
"modified": "2024-04-23T23:16:23Z",
"published": "2022-05-24T16:54:38Z",
"aliases": [
"CVE-2019-15483"
],
"summary": "Bolt Cross-site Scripting (XSS) via a title that is mishandled in the system log",
"details": "Bolt before 3.6.10 has XSS via a title that is mishandled in the system log.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "bolt/bolt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.10"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15483"
},
{
"type": "WEB",
"url": "https://github.com/bolt/bolt/pull/7802"
},
{
"type": "PACKAGE",
"url": "https://github.com/bolt/bolt"
},
{
"type": "WEB",
"url": "https://github.com/bolt/bolt/releases/tag/v3.6.10"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:16:23Z",
"nvd_published_at": "2019-08-23T13:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-wr23-m9m2-jjf4/GHSA-wr23-m9m2-jjf4.json → advisories/github-reviewed/2022/05/GHSA-wr23-m9m2-jjf4/GHSA-wr23-m9m2-jjf4.json
+28 -5
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wr23-m9m2-jjf4",
"modified": "2022-05-13T01:12:16Z",
"modified": "2024-04-23T23:16:04Z",
"published": "2022-05-13T01:12:16Z",
"aliases": [
"CVE-2017-16754"
],
"details": "Bolt before 3.3.6 does not properly restrict access to _profiler routes, related to EventListener/ProfilerListener.php and Provider/EventListenerServiceProvider.php.",
"summary": "Bolt Improper Access Control",
"details": "Bolt before 3.3.6 does not properly restrict access to `_profiler` routes, related to `EventListener/ProfilerListener.php` and `Provider/EventListenerServiceProvider.php`.",
"severity": [
{
"type": "CVSS_V3",
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "bolt/bolt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.6"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/bolt/bolt/commit/aa21787241945457a2e4abc8b079672935fe0840"
},
{
"type": "PACKAGE",
"url": "https://github.com/bolt/bolt"
},
{
"type": "WEB",
"url": "https://github.com/bolt/bolt/releases/tag/v3.3.6"
@@ -39,8 +62,8 @@
"CWE-732"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:16:04Z",
"nvd_published_at": "2017-11-10T02:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-ph84-vg7q-fqq8/GHSA-ph84-vg7q-fqq8.json
-39
View File
@@ -1,39 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-ph84-vg7q-fqq8",
"modified": "2022-05-24T16:54:38Z",
"published": "2022-05-24T16:54:38Z",
"aliases": [
"CVE-2019-15483"
],
"details": "Bolt before 3.6.10 has XSS via a title that is mishandled in the system log.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15483"
},
{
"type": "WEB",
"url": "https://github.com/bolt/bolt/pull/7802"
},
{
"type": "WEB",
"url": "https://github.com/bolt/bolt/releases/tag/v3.6.10"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-23T13:15:00Z"
}
}