netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-23gj-x27g-r34f
GHSA-7hhg-xj2h-5vq9
GHSA-cgrv-6h2h-6f7v
GHSA-vrw6-7vgj-vj7x
This commit is contained in:
advisory-database[bot]
2025-04-22 18:44:16 +00:00
parent 27e550303d
commit 8bb55bbfae
4 changed files with 116 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-23gj-x27g-r34f/GHSA-23gj-x27g-r34f.json → advisories/github-reviewed/2022/05/GHSA-23gj-x27g-r34f/GHSA-23gj-x27g-r34f.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-23gj-x27g-r34f",
"modified": "2025-04-20T03:37:51Z",
"modified": "2025-04-22T18:43:38Z",
"published": "2022-05-17T02:43:14Z",
"aliases": [
"CVE-2017-9069"
],
"summary": "MODX Revolution allows overwriting .htaccess",
"details": "In MODX Revolution before 2.5.7, a user with file upload permissions is able to execute arbitrary code by uploading a file with the name .htaccess.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "modx/revolution"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.7"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -26,6 +47,10 @@
{
"type": "WEB",
"url": "https://citadelo.com/en/2017/04/modx-revolution-cms"
},
{
"type": "PACKAGE",
"url": "https://github.com/modxcms/revolution"
}
],
"database_specific": {
@@ -33,8 +58,8 @@
"CWE-434"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-04-22T18:43:38Z",
"nvd_published_at": "2017-05-18T16:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-7hhg-xj2h-5vq9/GHSA-7hhg-xj2h-5vq9.json → advisories/github-reviewed/2022/05/GHSA-7hhg-xj2h-5vq9/GHSA-7hhg-xj2h-5vq9.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7hhg-xj2h-5vq9",
"modified": "2025-04-20T03:37:51Z",
"modified": "2025-04-22T18:43:50Z",
"published": "2022-05-17T02:43:14Z",
"aliases": [
"CVE-2017-9070"
],
"summary": "MODX Revolution cross-site scripting vulnerability",
"details": "In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "modx/revolution"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.7"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -26,6 +47,10 @@
{
"type": "WEB",
"url": "https://citadelo.com/en/2017/04/modx-revolution-cms"
},
{
"type": "PACKAGE",
"url": "https://github.com/modxcms/revolution"
}
],
"database_specific": {
@@ -33,8 +58,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-04-22T18:43:50Z",
"nvd_published_at": "2017-05-18T16:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-cgrv-6h2h-6f7v/GHSA-cgrv-6h2h-6f7v.json → advisories/github-reviewed/2022/05/GHSA-cgrv-6h2h-6f7v/GHSA-cgrv-6h2h-6f7v.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cgrv-6h2h-6f7v",
"modified": "2025-04-20T03:37:51Z",
"modified": "2025-04-22T18:42:58Z",
"published": "2022-05-17T02:43:12Z",
"aliases": [
"CVE-2017-9067"
],
"summary": "MODX Revolution Directory Traversal Vulnerability",
"details": "In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "modx/revolution"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.7"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -30,6 +51,10 @@
{
"type": "WEB",
"url": "https://citadelo.com/en/2017/04/modx-revolution-cms"
},
{
"type": "PACKAGE",
"url": "https://github.com/modxcms/revolution"
}
],
"database_specific": {
@@ -37,8 +62,8 @@
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-04-22T18:42:58Z",
"nvd_published_at": "2017-05-18T16:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-vrw6-7vgj-vj7x/GHSA-vrw6-7vgj-vj7x.json → advisories/github-reviewed/2022/05/GHSA-vrw6-7vgj-vj7x/GHSA-vrw6-7vgj-vj7x.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vrw6-7vgj-vj7x",
"modified": "2025-04-20T03:37:51Z",
"modified": "2025-04-22T18:43:09Z",
"published": "2022-05-17T02:43:14Z",
"aliases": [
"CVE-2017-9068"
],
"summary": "MODX Revolution Reflected XSS",
"details": "In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the database_type parameter.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "modx/revolution"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.5.7"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -26,6 +47,10 @@
{
"type": "WEB",
"url": "https://citadelo.com/en/2017/04/modx-revolution-cms"
},
{
"type": "PACKAGE",
"url": "https://github.com/modxcms/revolution"
}
],
"database_specific": {
@@ -33,8 +58,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-04-22T18:43:09Z",
"nvd_published_at": "2017-05-18T16:29:00Z"
}
}