Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-11-29 05:20:14 +00:00
parent 7afda2a832
commit 8ae9f87cdc
945 changed files with 1959 additions and 5877 deletions
@@ -8,9 +8,7 @@
  ],
  "summary": "actionpack Improper Input Validation vulnerability",
  "details": "The `to_s` method in `actionpack/lib/action_dispatch/middleware/remote_ip.rb` in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "actionpack allows remote attackers to bypass intended access restrictions",
  "details": "`actionpack/lib/action_view/template/resolver.rb` in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -67,9 +65,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:59:33Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Puppet Improper Input Validation vulnerability",
  "details": "Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to \"serialized attributes.\"",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "sqlite3-ruby uses weak permissions for unspecified files, which allows local users to gain privileges",
  "details": "The sqlite3-ruby gem in the rubygem-sqlite3 package before 1.2.4-0.5.1 in SUSE Linux Enterprise (SLE) 11 SP1 uses weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -67,9 +65,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:20:29Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "activerecord vulnerable to SQL Injection",
  "details": "The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Puppet allows local users to obtain sensitive configuration information",
  "details": "`lib/puppet/defaults.rb` in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for `last_run_report.yaml`, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -75,9 +73,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:25:49Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "activesupport Cross-site Scripting vulnerability",
  "details": "Cross-site scripting (XSS) vulnerability in `activesupport/lib/active_support/core_ext/string/output_safety.r`b in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a \"UTF-8 escaping vulnerability.\"",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Puppet allows local users to overwrite arbitrary files via a symlink attack",
  "details": "`telnet.rb` in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (`/tmp/out.log`).",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -83,9 +81,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:30:16Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service",
  "details": "Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service.  NOTE: this vulnerability can only be exploited utilizing unspecified \"local file system access\" to the Puppet Master.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -90,9 +88,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:31:52Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Puppet Improper Input Validation vulnerability",
  "details": "Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-j3rq-4xjw-xg63",
  "modified": "2023-12-04T23:13:42Z",
  "published": "2023-12-04T23:13:42Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks",
  "details": "### Impact\nAny CLI command issued to a Coordinator after the Manifest has been set, is susceptible to be redirected to another MarbleRun Coordinator instance, which runs the same binary, but potentially a different manifest.\n\n### Patches\n The issue has been patched in [`v1.4.0`](https://github.com/edgelesssys/marblerun/releases/tag/v1.4.0)\n\n### Workarounds\n\nDirectly using the REST API of the Coordinator and manually verifying and pinning the certificate to a set Manifest avoids the issue.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-h6j3-j35f-v2x7",
  "modified": "2024-05-15T14:30:10Z",
  "published": "2024-03-06T17:02:06Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "PocketMine-MP server crash with certain invalid JSON payloads in `LoginPacket` due to dependency vulnerability (3rd time)",
  "details": "### Impact\nAn attacker could crash PocketMine-MP by sending malformed JSON in LoginPacket.\n\n[netresearch/jsonmapper](https://github.com/cweiske/JsonMapper) allows objects to be hydrated from scalar types in JSON. However, due to the lack of validation in the code for this feature, it may output improperly initialized objects if applied to objects whose constructors don't handle the input values.\n\nCode handling these objects in PocketMine-MP could then crash due to `@required` properties not being set within the objects.\n\nIn addition, because JsonMapper does not respect `bStrictObjectTypes` when processing arrays, it's not possible to avoid the issue by disabling the feature.\n\nDue to the relatively high number of security issues arising from unexpected behaviour in JsonMapper, the team is exploring options to replace it.\n\n### Patches\nIn the meantime, the issue was fixed by pmmp/netresearch-jsonmapper@b96a209f9e8b76b899a0d0918493cd87eb3c02a7 and 6872661fd03649cc7a8762c41c16e9ee5a4de1c9.\n\n### Workarounds\nDetecting the malicious data that triggers this issue is of rather high difficulty, so it's not likely that a plugin would be able to easily remediate this.\n\n### References\nhttps://github.com/cweiske/jsonmapper/pull/225\nhttps://github.com/cweiske/jsonmapper/issues/226\n",
  "severity": [
@@ -62,9 +60,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-06T17:02:06Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-27qr-636m-wxg2",
  "modified": "2024-05-15T18:09:41Z",
  "published": "2024-05-15T18:09:41Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "codeigniter/framework SQL injection in ODBC database driver",
  "details": "CodeIgniter 3.1.0 addressed a critical security issue within the ODBC database driver. This update includes crucial fixes to mitigate a SQL injection vulnerability, preventing potential exploitation by attackers. It is noteworthy that these fixes render the query builder and escape() functions incompatible with the ODBC driver. However, the update introduces actual query binding as a more secure alternative.",
  "severity": [
@@ -54,9 +52,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-15T18:09:41Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-2m5g-8xpw-42vp",
  "modified": "2024-05-15T18:07:44Z",
  "published": "2024-05-15T18:07:44Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "OpenCFP Framework (Sentry) Account takeover via null password reset codes",
  "details": "OpenCFP, an open-source conference talk submission system written in PHP, contains a security vulnerability in its third-party authentication framework, Sentry, developed by Cartalyst. The vulnerability stems from how Sentry handles password reset checks. Users lacking a password reset token stored in the database default to having NULL in the reset_password_code column. Exploiting this flaw could allow unauthorized manipulation of any OpenCFP user's password, particularly those without an unused password reset token. Although successful login still requires correlating the numeric user ID with an email address, the identification of likely organizers (users 1-5) may facilitate this process.",
  "severity": [
@@ -50,9 +48,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-15T18:07:44Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-2w9p-xxqr-h253",
  "modified": "2024-05-15T21:14:18Z",
  "published": "2024-05-15T21:14:18Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "eZ Platform Object Injection in SiteAccessMatchListener",
  "details": "This Security Advisory is about an object injection vulnerability in the SiteAccessMatchListener of eZ Platform, which could lead to remote code execution (RCE), a very serious threat. All sites may be affected.\n\nUpdate: There are bugs introduced by this fix, particularly but not limited to compound siteaccess matchers. These have been fixed in ezsystems/ezplatform-kernel v1.0.3, and in ezsystems/ezpublish-kernel v7.5.8, v6.13.6.4, and v5.4.15.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-32rx-xvvr-4xv9",
  "modified": "2024-05-15T17:45:51Z",
  "published": "2024-05-15T17:45:51Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "easyadmin-extension-bundle action case insensitivity",
  "details": "In alterphp/easyadmin-extension-bundle, role based access rules do not handle action name case sensitivity which may lead to unauthorized access.",
  "severity": [
@@ -69,9 +67,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-15T17:45:51Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-45qm-j4m9-whv9",
  "modified": "2024-05-15T21:15:21Z",
  "published": "2024-05-15T21:15:21Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "eZ Platform CSRF token in login form is disabled by default",
  "details": "his security advisory fixes a potential vulnerability in the eZ Platform log in form. That form has a Cross-Site Request Forgery (CSRF) token, but the CSRF functionality is not enabled by default, meaning the token is inactive. The fix is distributed via Composer as ezsystems/ezplatform v2.5.4, and in v3.0.0 when that will be released.\n\nIf you'd like to manually enable it in your configuration, this is done by editing your app/config/security.yml and setting the \"csrf_token_generator\" key to \"security.csrf.token_manager\", like this:\n```\nsecurity:\n    firewalls:\n        ezpublish_front:\n            form_login:\n                csrf_token_generator: security.csrf.token_manager\n```\nNB: In eZ Platform 3.0 this file has been moved to config/packages/security.yaml\n\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-4c2w-v5rq-5mx7",
  "modified": "2024-05-15T21:10:29Z",
  "published": "2024-05-15T21:10:29Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "eZ Platform Editor Cross-site Scripting (XSS)",
  "details": "This Security Advisory is about two issues of low to medium severity. We recommend that you install the update as soon as possible.\n\n\nThere is an XSS vulnerability in CKEditor, which is used by AlloyEditor, which is used in eZ Platform Admin UI. Scripts can be injected through specially crafted \"protected\" comments. We are not sure it is exploitable in eZ Platform, but recommend installing it to be on the safe side. It is fixed in CKEditor v4.14, AlloyEditor v2.11.9. It is distributed via Composer, for:\n\neZ Platform v1.13.x: ezsystems/PlatformUIAssetsBundle v4.2.3 (included from ezsystems/PlatformUIBundle v1.13.x)\neZ Platform v2.5.13: ezsystems/ezplatform-admin-ui-assets v4.2.1\neZ Platform v3.0.*: ezsystems/ezplatform-admin-ui-assets v5.0.1\neZ Platform v3.1.2: ezsystems/ezplatform-admin-ui-assets v5.1.1\n\n\nDrafts that are sent to trash become visible in the Review Queue, even for users that were not able to see them before this action. It's not possible to preview them, but their title and review history is displayed. This affects Enterprise Edition only, of which ezplatform-workflow is a part. This security update is distributed via Composer, for\n\neZ Platform EE v2.5.13: ezsystems/ezplatform-workflow v1.1.9\neZ Platform EE v3.1.2: ezsystems/ezplatform-workflow v2.1.1",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-4cv2-xc5f-px8h",
  "modified": "2024-05-15T18:03:38Z",
  "published": "2024-05-15T18:03:37Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Denial of Service in extension \"Code Highlight\" (codehighlight)",
  "details": "The codehighlight extension bundles a vulnerable version of the 3rd party JavaScript component “prism” which is known to be vulnerable against Regular expression Denial of Service (ReDoS).",
  "severity": [
@@ -54,9 +52,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-15T18:03:37Z",
--- a/Show More
+++ b/Show More