netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-08-23 21:32:06 +00:00
parent 7ab0f35bb3
commit 88e86a0096
31 changed files with 455 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/01/GHSA-8c2v-657f-h9r7/GHSA-8c2v-657f-h9r7.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8c2v-657f-h9r7",
"modified": "2024-02-03T00:31:33Z",
"modified": "2024-08-23T21:30:41Z",
"published": "2024-01-29T21:30:27Z",
"aliases": [
"CVE-2024-24139"
advisories/unreviewed/2024/02/GHSA-62vc-2f72-vcj3/GHSA-62vc-2f72-vcj3.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-62vc-2f72-vcj3",
"modified": "2024-03-04T09:30:29Z",
"modified": "2024-08-23T21:30:41Z",
"published": "2024-02-20T15:31:05Z",
"aliases": [
"CVE-2024-1553"
],
"details": "Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 123 and Firefox ESR < 115.8.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -47,7 +50,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-20T14:15:08Z"
advisories/unreviewed/2024/02/GHSA-9jmq-68m9-2x2j/GHSA-9jmq-68m9-2x2j.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9jmq-68m9-2x2j",
"modified": "2024-02-27T18:31:02Z",
"modified": "2024-08-23T21:30:41Z",
"published": "2024-02-27T18:31:02Z",
"aliases": [
"CVE-2024-25840"
],
"details": "In the module \"Account Manager | Sales Representative & Dealers | CRM\" (prestasalesmanager) up to 9.0 from Presta World for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-31"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-27T17:15:12Z"
advisories/unreviewed/2024/02/GHSA-f8vf-5cvf-jr22/GHSA-f8vf-5cvf-jr22.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f8vf-5cvf-jr22",
"modified": "2024-02-29T03:33:12Z",
"modified": "2024-08-23T21:30:41Z",
"published": "2024-02-29T03:33:12Z",
"aliases": [
"CVE-2023-27151"
],
"details": "openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number (in the Saved Search Activity) via the Name, Description, or Activity Number field.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-29T01:38:30Z"
advisories/unreviewed/2024/03/GHSA-9xr6-qf7m-2jv5/GHSA-9xr6-qf7m-2jv5.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9xr6-qf7m-2jv5",
"modified": "2024-07-30T03:30:51Z",
"modified": "2024-08-23T21:30:41Z",
"published": "2024-03-27T09:30:41Z",
"aliases": [
"CVE-2024-2466"
],
"details": "libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
@@ -65,9 +68,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T08:15:41Z"
advisories/unreviewed/2024/03/GHSA-r7wm-jrf5-83qv/GHSA-r7wm-jrf5-83qv.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r7wm-jrf5-83qv",
"modified": "2024-03-04T03:30:26Z",
"modified": "2024-08-23T21:30:41Z",
"published": "2024-03-04T03:30:26Z",
"aliases": [
"CVE-2024-20032"
],
"details": "In aee, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08487630; Issue ID: MSV-1020.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-04T03:15:07Z"
advisories/unreviewed/2024/03/GHSA-v2vx-hcgc-qcvc/GHSA-v2vx-hcgc-qcvc.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v2vx-hcgc-qcvc",
"modified": "2024-03-22T12:30:46Z",
"modified": "2024-08-23T21:30:41Z",
"published": "2024-03-22T12:30:46Z",
"aliases": [
"CVE-2024-28560"
],
"details": "SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the deleteArea() function of the Address.php component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-22T12:15:07Z"
advisories/unreviewed/2024/03/GHSA-v6qj-65jf-4qvc/GHSA-v6qj-65jf-4qvc.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v6qj-65jf-4qvc",
"modified": "2024-03-28T03:30:59Z",
"modified": "2024-08-23T21:30:41Z",
"published": "2024-03-28T03:30:59Z",
"aliases": [
"CVE-2024-28014"
],
"details": "Stack-based Buffer Overflow vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W300P, WF800HP, WR8165N, WG2200HP, WF1200HP2, WG1800HP2, WF1200HP, WG600HP, WG300HP, WF300HP, WG1800HP, WG1400HP, WR8175N, WR9300N, WR8750N, WR8160N, WR9500N, WR8600N, WR8370N, WR8170N, WR8700N, WR8300N, WR8150N, WR4100N, WR4500N, WR8100N, WR8500N, CR2500P, WR8400N, WR8200N, WR1200H, WR7870S, WR6670S, WR7850S, WR6650S, WR6600H, WR7800H, WM3400RN, WM3450RN, WM3500R, WM3600R, WM3800R, WR8166N, MR01LN and MR02LN all versions allows a attacker to execute an arbitrary command via the internet.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
"CWE-121"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-28T01:15:47Z"
advisories/unreviewed/2024/03/GHSA-w4j4-p425-4fwc/GHSA-w4j4-p425-4fwc.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w4j4-p425-4fwc",
"modified": "2024-03-22T18:30:31Z",
"modified": "2024-08-23T21:30:41Z",
"published": "2024-03-22T18:30:31Z",
"aliases": [
"CVE-2024-29385"
],
"details": "DIR-845L router <= v1.01KRb03 has an Unauthenticated remote code execution vulnerability in the cgibin binary via soapcgi_main function.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-22T17:15:08Z"
advisories/unreviewed/2024/05/GHSA-q2xc-6c48-r5px/GHSA-q2xc-6c48-r5px.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q2xc-6c48-r5px",
"modified": "2024-05-14T21:34:44Z",
"modified": "2024-08-23T21:30:41Z",
"published": "2024-05-14T21:34:44Z",
"aliases": [
"CVE-2022-28132"
],
"details": "The T-Soft E-Commerce 4 web application is susceptible to SQL injection (SQLi) attacks when authenticated as an admin or privileged user. This vulnerability allows attackers to access and manipulate the database through crafted requests. By exploiting this flaw, attackers can bypass authentication mechanisms, view sensitive information stored in the database, and potentially exfiltrate data.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T21:15:11Z"
advisories/unreviewed/2024/06/GHSA-6qmp-435x-jm84/GHSA-6qmp-435x-jm84.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6qmp-435x-jm84",
"modified": "2024-06-07T00:30:37Z",
"modified": "2024-08-23T21:30:41Z",
"published": "2024-06-07T00:30:37Z",
"aliases": [
"CVE-2024-24194"
],
"details": "robdns commit d76d2e6 was discovered to contain a NULL pointer dereference via the item->tokens component at /src/conf-parse.c.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-06T22:15:10Z"
advisories/unreviewed/2024/08/GHSA-27rm-pvpp-228f/GHSA-27rm-pvpp-228f.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-27rm-pvpp-228f",
"modified": "2024-08-23T21:30:42Z",
"published": "2024-08-23T21:30:42Z",
"aliases": [
"CVE-2024-37392"
],
"details": "A stored Cross-Site Scripting (XSS) vulnerability has been identified in SMSEagle software version < 6.0. The vulnerability arises because the application did not properly sanitize user input in the SMS messages in the inbox. This could allow an attacker to inject malicious JavaScript code into an SMS message, which gets executed when the SMS is viewed and specially interacted in web-GUI.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37392"
},
{
"type": "WEB",
"url": "https://www.smseagle.eu/2024/08/21/resolved-xss-in-smseagle-software-cve-2024-37392"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-23T21:15:07Z"
}
}
advisories/unreviewed/2024/08/GHSA-44mp-qrwc-xm4x/GHSA-44mp-qrwc-xm4x.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-44mp-qrwc-xm4x",
"modified": "2024-08-23T18:33:03Z",
"modified": "2024-08-23T21:30:42Z",
"published": "2024-08-23T18:33:03Z",
"aliases": [
"CVE-2024-42852"
],
"details": "Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary code via the index.php component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-23T18:15:07Z"
advisories/unreviewed/2024/08/GHSA-4mrc-w7jh-hx4j/GHSA-4mrc-w7jh-hx4j.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4mrc-w7jh-hx4j",
"modified": "2024-08-23T21:30:42Z",
"published": "2024-08-23T21:30:42Z",
"aliases": [
"CVE-2024-45190"
],
"details": "Mage AI allows remote users with the \"Viewer\" role to leak arbitrary files from the Mage server due to a path traversal in the \"Pipeline Interaction\" request",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45190"
},
{
"type": "WEB",
"url": "https://research.jfrog.com/vulnerabilities/mage-ai-pipeline-interaction-request-remote-arbitrary-file-leak-jfsa-2024-001039605"
}
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-23T20:15:08Z"
}
}
advisories/unreviewed/2024/08/GHSA-58cw-gjp7-8mm7/GHSA-58cw-gjp7-8mm7.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-58cw-gjp7-8mm7",
"modified": "2024-08-23T18:33:02Z",
"modified": "2024-08-23T21:30:42Z",
"published": "2024-08-23T18:33:02Z",
"aliases": [
"CVE-2024-39841"
],
"details": "A SQL Injection vulnerability exists in the service configuration functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.04.19, and 22.10.x before 22.10.23.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-23T17:15:06Z"
advisories/unreviewed/2024/08/GHSA-6v83-ppjw-wp84/GHSA-6v83-ppjw-wp84.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6v83-ppjw-wp84",
"modified": "2024-08-23T18:33:01Z",
"modified": "2024-08-23T21:30:42Z",
"published": "2024-08-23T18:33:01Z",
"aliases": [
"CVE-2024-42636"
],
"details": "DedeCMS V5.7.115 has a command execution vulnerability via file_manage_view.php?fmdo=newfile&activepath.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-23T16:15:06Z"
advisories/unreviewed/2024/08/GHSA-723q-4x66-vrf2/GHSA-723q-4x66-vrf2.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-723q-4x66-vrf2",
"modified": "2024-08-23T18:33:02Z",
"modified": "2024-08-23T21:30:42Z",
"published": "2024-08-23T18:33:02Z",
"aliases": [
"CVE-2024-44381"
],
"details": "D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in jhttpd msp_info_htm function.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-23T16:15:07Z"
advisories/unreviewed/2024/08/GHSA-c9r7-wpw8-xc67/GHSA-c9r7-wpw8-xc67.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c9r7-wpw8-xc67",
"modified": "2024-08-23T15:30:34Z",
"modified": "2024-08-23T21:30:42Z",
"published": "2024-08-23T15:30:34Z",
"aliases": [
"CVE-2024-42915"
],
"details": "A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This will allow attackers to arbitrarily reset other users' passwords and compromise their accounts.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-23T15:15:16Z"
advisories/unreviewed/2024/08/GHSA-cgxv-795x-3vqr/GHSA-cgxv-795x-3vqr.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cgxv-795x-3vqr",
"modified": "2024-08-23T21:30:42Z",
"published": "2024-08-23T21:30:42Z",
"aliases": [
"CVE-2024-45189"
],
"details": "Mage AI allows remote users with the \"Viewer\" role to leak arbitrary files from the Mage server due to a path traversal in the \"Git Content\" request",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45189"
},
{
"type": "WEB",
"url": "https://research.jfrog.com/vulnerabilities/mage-ai-git-content-request-remote-arbitrary-file-leak-jfsa-2024-001039604"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-23T20:15:08Z"
}
}
advisories/unreviewed/2024/08/GHSA-g3jm-x33w-9q5w/GHSA-g3jm-x33w-9q5w.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g3jm-x33w-9q5w",
"modified": "2024-08-23T18:33:02Z",
"modified": "2024-08-23T21:30:42Z",
"published": "2024-08-23T18:33:02Z",
"aliases": [
"CVE-2024-44386"
],
"details": "Tenda FH1206 V1.2.0.8(8155)_EN contains a Buffer Overflow vulnerability via the function fromSetIpBind.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-23T16:15:07Z"

Some files were not shown because too many files have changed in this diff Show More