Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-01 05:06:05 +00:00
parent a78c9a04fa
commit 8f2283168e
900 changed files with 1230 additions and 3690 deletions
@@ -458,9 +458,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-14T21:57:52Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Uncontrolled Resource Consumption in OPCFoundation.NetStandard.Opc.Ua.Core",
  "details": "A vulnerability was discovered in the OPC UA .NET Standard Stack that allows a malicious client to trigger a stack overflow exception in a server that exposes an HTTPS endpoint.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-9q5j-jm53-v7vr",
  "modified": "2022-09-01T22:24:55Z",
  "published": "2022-09-01T22:24:55Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "lz4-sys vulnerable to memory corruption via issue in liblz4",
  "details": "lz4-sys up to v1.9.3 bundles a version of liblz4 that is vulnerable to\n[CVE-2021-3520](https://nvd.nist.gov/vuln/detail/CVE-2021-3520).\n\nAttackers could craft a payload that triggers an integer overflow upon\ndecompression, causing an out-of-bounds write.\n\nThe flaw has been corrected in version v1.9.4 of liblz4, which is included\nin lz4-sys 1.9.4.\n",
  "severity": [
@@ -470,9 +470,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-11T20:48:52Z",
@@ -9,9 +9,7 @@
  ],
  "summary": "Duplicate Advisory: Arbitrary code execution in jfinal CMS",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-8qhm-ch8h-xgjr. This link is maintained to preserve external references.\n\n## Original Description\nCommand execution vulnerability in the ActionEnter Class ins jfinal CMS version 5.1.0 allows attackers to execute arbitrary code via a created json file to the ueditor route.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -44,9 +42,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-01T14:01:21Z",
@@ -4,14 +4,10 @@
  "modified": "2024-05-07T21:32:36Z",
  "published": "2023-06-22T20:01:48Z",
  "withdrawn": "2024-05-07T21:32:36Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: Cosmos \"Barberry\" vulnerability in github.com/cosmos/cosmos-sdk",
  "details": "## Withdrawn\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-j2cr-jc39-wpx5. This link is maintained to preserve external references.\n\n## Original Description\n\nThe cosmos-sdk module is affected by the vulnerability codenamed \"Barberry\".",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -67,9 +63,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-22T20:01:48Z",
@@ -4,9 +4,7 @@
  "modified": "2023-06-09T22:54:42Z",
  "published": "2023-06-06T21:30:18Z",
  "withdrawn": "2023-06-09T22:54:42Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: Grafana Improper Access Control vulnerability",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-cvm3-pp2j-chr3. This link is maintained to preserve external references.\n\n## Original Description\nGrafana is an open-source platform for monitoring and observability. \n\nThe option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.\n\nThis might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.\n\nUsers may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.\n\n",
  "severity": [
@@ -88,9 +88,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-06T21:18:06Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-gm68-572p-q28r",
  "modified": "2023-07-06T15:30:51Z",
  "published": "2023-07-06T15:30:51Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "@vendure/admin-ui-plugin authenticated Cross-site Scripting vulnerability",
  "details": "### Impact\nVendure provides an authorization system with different levels of privileges. For example, an administrator cannot create another administrator.\n\nIn the admin UI, there are a couple of places with description inputs, such as inventory/collection catalog, shipping methods, promotions, and more.\n\nWhile the WYSIWYG editor allows limited customization, altering the request data (not in the ui) saves and returns arbitrary HTML with no sanitization. Causing an XSS when viewing the page.\n\nThe impact of this XSS is privilege escalation. A user that can write any type of description can trigger the attack. Then any other user that visits the vulnerable page is prone to arbitrary Javascript code execution, giving the attacker ability to execute actions on behalf of this user.\n\n### Patches\nin progress\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\n### References\n_Are there any links users can visit to find out more?_\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -4,14 +4,10 @@
  "modified": "2023-07-06T20:39:13Z",
  "published": "2023-07-04T18:30:58Z",
  "withdrawn": "2023-07-06T20:38:21Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: @fastify/oauth2 Oauth2 state parameter reuse",
  "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-g8x5-p9qc-cf95. This link is maintained to preserve external references.\n\n## Original Description\nAll versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user's session in some way that will allow the server to validate it.\n\nv7.2.0 changes the default behavior to store the state in a cookie with the http-only and same-site=lax attributes set. The state is now by default generated for every user. Note that this contains a breaking change in the checkStateFunction function, which now accepts the full Request object.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -56,9 +52,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-06T20:38:21Z",
@@ -72,9 +72,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-06T21:54:20Z",
@@ -88,9 +88,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-06T21:51:17Z",
@@ -58,9 +58,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-12T23:03:15Z",
@@ -7,12 +7,8 @@
    "CVE-2021-42784"
  ],
  "details": "OS Command Injection vulnerability in debug_fcgi of D-Link DWR-932C E1 firmware allows a remote attacker to perform command injection via a crafted HTTP request.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2021-33087"
  ],
  "details": "Improper authentication in the installer for the Intel(R) NUC M15 Laptop Kit Management Engine driver pack before version 15.0.10.1508 may allow an authenticated user to potentially enable denial of service via local access.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2021-24891"
  ],
  "details": "The Elementor Website Builder WordPress plugin before 3.1.4 does not sanitise or escape user input appended to the DOM via a malicious hash, resulting in a DOM Cross-Site Scripting issue",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2021-0623"
  ],
  "details": "In asf extractor, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05489178; Issue ID: ALPS05585817.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
--- a/Show More
+++ b/Show More