netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-h8xp-h3jf-wv4v
GHSA-p4xh-4869-8vrg
GHSA-x38j-4rr5-hqrj
GHSA-h8xp-h3jf-wv4v
GHSA-p4xh-4869-8vrg
GHSA-x38j-4rr5-hqrj
This commit is contained in:
advisory-database[bot]
2024-04-22 22:34:35 +00:00
parent 9947920422
commit 8f9d39b407
6 changed files with 203 additions and 121 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-h8xp-h3jf-wv4v/GHSA-h8xp-h3jf-wv4v.json
+69
View File
@@ -0,0 +1,69 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h8xp-h3jf-wv4v",
"modified": "2024-04-22T22:33:06Z",
"published": "2022-05-24T16:50:39Z",
"aliases": [
"CVE-2019-1010259"
],
"summary": "SaltStack Salt SQL Injection vulnerability in mysql.user_chpass function",
"details": "SaltStack Salt 2018.3 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The `mysql.user_chpass` function from the MySQL module for Salt (https://github.com/saltstack/salt/blob/develop/salt/modules/mysql.py#L1462). The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "salt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2018.3.0"
},
{
"fixed": "2018.3.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010259"
},
{
"type": "WEB",
"url": "https://github.com/saltstack/salt/pull/51462"
},
{
"type": "WEB",
"url": "https://github.com/ShantonRU/salt/commit/a46c86a987c78e74e87969d8d3b27094e6544b7a"
},
{
"type": "PACKAGE",
"url": "https://github.com/saltstack/salt"
},
{
"type": "WEB",
"url": "https://github.com/saltstack/salt/blob/f22de0887cd7167887f113bf394244b74fb36b6b/salt/modules/mysql.py#L1534"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:33:06Z",
"nvd_published_at": "2019-07-18T17:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-p4xh-4869-8vrg/GHSA-p4xh-4869-8vrg.json
+65
View File
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p4xh-4869-8vrg",
"modified": "2024-04-22T22:34:01Z",
"published": "2022-05-24T19:13:00Z",
"aliases": [
"CVE-2021-40494"
],
"summary": "AdaptiveScale LXDUI Hardcoded JWT Secret Key",
"details": "A Hardcoded JWT Secret Key in `__metadata__.py` metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "lxdui"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40494"
},
{
"type": "WEB",
"url": "https://github.com/AdaptiveScale/lxdui/pull/353"
},
{
"type": "WEB",
"url": "https://github.com/AdaptiveScale/lxdui/commit/e4bffeb9d69a5700a642cb6424453d1894e50d84"
},
{
"type": "PACKAGE",
"url": "https://github.com/AdaptiveScale/lxdui"
}
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:34:01Z",
"nvd_published_at": "2021-09-03T02:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-x38j-4rr5-hqrj/GHSA-x38j-4rr5-hqrj.json
+69
View File
@@ -0,0 +1,69 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x38j-4rr5-hqrj",
"modified": "2024-04-22T22:33:47Z",
"published": "2022-05-24T17:39:13Z",
"aliases": [
"CVE-2021-3028"
],
"summary": "git-big-picture Code Execution",
"details": "git-big-picture before 1.0.0 mishandles `'` characters in a branch name, leading to code execution.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "git-big-picture"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3028"
},
{
"type": "WEB",
"url": "https://github.com/git-big-picture/git-big-picture/pull/27"
},
{
"type": "WEB",
"url": "https://github.com/git-big-picture/git-big-picture/pull/62"
},
{
"type": "PACKAGE",
"url": "https://github.com/git-big-picture/git-big-picture"
},
{
"type": "WEB",
"url": "https://github.com/git-big-picture/git-big-picture/releases/tag/v1.0.0"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:33:47Z",
"nvd_published_at": "2021-01-13T17:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-h8xp-h3jf-wv4v/GHSA-h8xp-h3jf-wv4v.json
-43
View File
@@ -1,43 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h8xp-h3jf-wv4v",
"modified": "2022-05-24T16:50:39Z",
"published": "2022-05-24T16:50:39Z",
"aliases": [
"CVE-2019-1010259"
],
"details": "SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt (https://github.com/saltstack/salt/blob/develop/salt/modules/mysql.py#L1462). The attack vector is: specially crafted password string. The fixed version is: 2018.3.4.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010259"
},
{
"type": "WEB",
"url": "https://github.com/saltstack/salt/pull/51462"
},
{
"type": "WEB",
"url": "https://github.com/ShantonRU/salt/commit/a46c86a987c78e74e87969d8d3b27094e6544b7a"
},
{
"type": "WEB",
"url": "https://github.com/saltstack/salt/blob/f22de0887cd7167887f113bf394244b74fb36b6b/salt/modules/mysql.py#L1534"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-18T17:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-p4xh-4869-8vrg/GHSA-p4xh-4869-8vrg.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p4xh-4869-8vrg",
"modified": "2022-05-24T19:13:00Z",
"published": "2022-05-24T19:13:00Z",
"aliases": [
"CVE-2021-40494"
],
"details": "A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40494"
},
{
"type": "WEB",
"url": "https://github.com/AdaptiveScale/lxdui/pull/353"
}
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-03T02:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-x38j-4rr5-hqrj/GHSA-x38j-4rr5-hqrj.json
-43
View File
@@ -1,43 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x38j-4rr5-hqrj",
"modified": "2022-05-24T17:39:13Z",
"published": "2022-05-24T17:39:13Z",
"aliases": [
"CVE-2021-3028"
],
"details": "git-big-picture before 1.0.0 mishandles ' characters in a branch name, leading to code execution.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3028"
},
{
"type": "WEB",
"url": "https://github.com/git-big-picture/git-big-picture/pull/27"
},
{
"type": "WEB",
"url": "https://github.com/git-big-picture/git-big-picture/pull/62"
},
{
"type": "WEB",
"url": "https://github.com/git-big-picture/git-big-picture/releases/tag/v1.0.0"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-13T17:15:00Z"
}
}