netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2mg9-hv69-897x
GHSA-c7jj-vfmr-j9mj
GHSA-g5m5-j48g-fr24
GHSA-gqrp-qhv8-phrv
GHSA-m34m-fgh4-v7cx
GHSA-2mg9-hv69-897x
GHSA-c7jj-vfmr-j9mj
GHSA-m34m-fgh4-v7cx
This commit is contained in:
advisory-database[bot]
2024-04-24 17:30:35 +00:00
parent 854713cc17
commit 901beed90e
8 changed files with 385 additions and 132 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-2mg9-hv69-897x/GHSA-2mg9-hv69-897x.json
+108
View File
@@ -0,0 +1,108 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2mg9-hv69-897x",
"modified": "2024-04-24T17:29:07Z",
"published": "2022-05-24T16:52:01Z",
"aliases": [
"CVE-2019-10187"
],
"summary": "Moodle Ability to delete glossary entries that belong to another glossary",
"details": "A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.7"
},
{
"fixed": "3.7.1"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.6"
},
{
"fixed": "3.6.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.5"
},
{
"fixed": "3.5.7"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10187"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10187"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=388568#p1566330"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/109174"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T17:29:07Z",
"nvd_published_at": "2019-07-31T22:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-c7jj-vfmr-j9mj/GHSA-c7jj-vfmr-j9mj.json
+73
View File
@@ -0,0 +1,73 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c7jj-vfmr-j9mj",
"modified": "2024-04-24T17:29:50Z",
"published": "2022-05-24T19:06:04Z",
"aliases": [
"CVE-2021-21809"
],
"summary": "Moodle command execution vulnerability exists in the default legacy spellchecker plugin",
"details": "A command execution vulnerability exists in the default legacy spellchecker plugin in a few Moodle multiple specific versions. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"versions": [
"3.10.0"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"versions": [
"3.11.2"
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"versions": [
"3.8.0"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21809"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1277"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/164481/Moodle-SpellChecker-Path-Authenticated-Remote-Command-Execution.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-732"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T17:29:50Z",
"nvd_published_at": "2021-06-23T22:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-g5m5-j48g-fr24/GHSA-g5m5-j48g-fr24.json → advisories/github-reviewed/2022/05/GHSA-g5m5-j48g-fr24/GHSA-g5m5-j48g-fr24.json
+21 -5
View File
@@ -1,17 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g5m5-j48g-fr24",
"modified": "2022-05-24T19:05:25Z",
"modified": "2024-04-24T17:29:14Z",
"published": "2022-05-24T19:05:25Z",
"aliases": [
"CVE-2021-32244"
],
"summary": "Moodle Cross Site Scripting (XSS)",
"details": "Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the \"Description\" field.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"versions": [
"3.10.3"
]
}
],
"references": [
{
@@ -21,6 +33,10 @@
{
"type": "WEB",
"url": "https://github.com/langkexiansheng/Images/blob/master/moodle_xss.gif"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
}
],
"database_specific": {
@@ -28,8 +44,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T17:29:14Z",
"nvd_published_at": "2021-06-16T21:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-gqrp-qhv8-phrv/GHSA-gqrp-qhv8-phrv.json → advisories/github-reviewed/2022/05/GHSA-gqrp-qhv8-phrv/GHSA-gqrp-qhv8-phrv.json
+65 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gqrp-qhv8-phrv",
"modified": "2022-05-13T01:34:31Z",
"modified": "2024-04-24T17:29:57Z",
"published": "2022-05-13T01:34:31Z",
"aliases": [
"CVE-2018-14631"
],
"summary": "Moodle Cross-site Scripting",
"details": "moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter.",
"severity": [
{
@@ -14,7 +15,63 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.3"
},
{
"fixed": "3.3.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.4"
},
{
"fixed": "3.4.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.5"
},
{
"fixed": "3.5.2"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +82,10 @@
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14631"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=376025"
@@ -43,8 +104,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T17:29:57Z",
"nvd_published_at": "2018-09-17T20:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-m34m-fgh4-v7cx/GHSA-m34m-fgh4-v7cx.json
+118
View File
@@ -0,0 +1,118 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m34m-fgh4-v7cx",
"modified": "2024-04-24T17:30:08Z",
"published": "2022-05-13T01:46:59Z",
"aliases": [
"CVE-2017-7489"
],
"summary": "Moodle External blog editing takeover",
"details": "In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2"
},
{
"fixed": "3.2.3"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0"
},
{
"fixed": "3.0.10"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.7"
},
{
"fixed": "2.7.20"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7489"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=352353"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T17:30:08Z",
"nvd_published_at": "2017-05-15T14:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-2mg9-hv69-897x/GHSA-2mg9-hv69-897x.json
-43
View File
@@ -1,43 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2mg9-hv69-897x",
"modified": "2022-05-24T16:52:01Z",
"published": "2022-05-24T16:52:01Z",
"aliases": [
"CVE-2019-10187"
],
"details": "A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10187"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10187"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=388568#p1566330"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/109174"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-31T22:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-c7jj-vfmr-j9mj/GHSA-c7jj-vfmr-j9mj.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c7jj-vfmr-j9mj",
"modified": "2022-05-24T19:06:04Z",
"published": "2022-05-24T19:06:04Z",
"aliases": [
"CVE-2021-21809"
],
"details": "A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21809"
},
{
"type": "WEB",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1277"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/164481/Moodle-SpellChecker-Path-Authenticated-Remote-Command-Execution.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-732"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-23T22:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-m34m-fgh4-v7cx/GHSA-m34m-fgh4-v7cx.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m34m-fgh4-v7cx",
"modified": "2022-05-13T01:46:59Z",
"published": "2022-05-13T01:46:59Z",
"aliases": [
"CVE-2017-7489"
],
"details": "In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7489"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=352353"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-05-15T14:29:00Z"
}
}