netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-08-06 18:32:14 +00:00
parent 1a5b686fab
commit 9046cbbaa8
74 changed files with 1536 additions and 128 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/02/GHSA-4452-v8jv-h496/GHSA-4452-v8jv-h496.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4452-v8jv-h496",
"modified": "2024-02-16T03:30:51Z",
"modified": "2024-08-06T18:30:48Z",
"published": "2024-02-16T03:30:51Z",
"aliases": [
"CVE-2024-25413"
],
"details": "A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to execute arbitrary commands via a crafted XSLT file.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
@@ -31,7 +34,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-16T02:15:51Z"
advisories/unreviewed/2024/02/GHSA-vgjv-qpvm-qjx7/GHSA-vgjv-qpvm-qjx7.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vgjv-qpvm-qjx7",
"modified": "2024-02-20T21:30:25Z",
"modified": "2024-08-06T18:30:48Z",
"published": "2024-02-20T21:30:25Z",
"aliases": [
"CVE-2023-46967"
],
"details": "Cross Site Scripting vulnerability in the sanitize function in Enhancesoft osTicket 1.18.0 allows a remote attacker to escalate privileges via a crafted support ticket.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-20T21:15:07Z"
advisories/unreviewed/2024/02/GHSA-whq9-vwxq-6f23/GHSA-whq9-vwxq-6f23.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-whq9-vwxq-6f23",
"modified": "2024-02-09T18:31:07Z",
"modified": "2024-08-06T18:30:48Z",
"published": "2024-02-05T18:31:37Z",
"aliases": [
"CVE-2024-0953"
@@ -24,6 +24,10 @@
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1837916"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-36"
}
],
"database_specific": {
advisories/unreviewed/2024/03/GHSA-29pw-vrcf-rqvp/GHSA-29pw-vrcf-rqvp.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-29pw-vrcf-rqvp",
"modified": "2024-03-20T15:32:23Z",
"modified": "2024-08-06T18:30:49Z",
"published": "2024-03-20T15:32:23Z",
"aliases": [
"CVE-2024-28283"
],
"details": "There is stack-based buffer overflow vulnerability in pc_change_act function in Linksys E1000 router firmware version v.2.1.03 and before, leading to remote code execution.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-19T21:15:07Z"
advisories/unreviewed/2024/03/GHSA-2c59-j8fr-6828/GHSA-2c59-j8fr-6828.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2c59-j8fr-6828",
"modified": "2024-03-21T03:36:45Z",
"modified": "2024-08-06T18:30:49Z",
"published": "2024-03-21T03:36:45Z",
"aliases": [
"CVE-2023-49979"
],
"details": "A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application without requiring authorization.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-548"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-21T02:49:38Z"
advisories/unreviewed/2024/03/GHSA-36f2-v56q-6v2j/GHSA-36f2-v56q-6v2j.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-36f2-v56q-6v2j",
"modified": "2024-03-27T06:30:31Z",
"modified": "2024-08-06T18:30:49Z",
"published": "2024-03-27T06:30:31Z",
"aliases": [
"CVE-2023-40290"
],
"details": "An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue that affects Internet Explorer 11 on Windows.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-80"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T04:15:10Z"
advisories/unreviewed/2024/03/GHSA-7444-32c7-cjv4/GHSA-7444-32c7-cjv4.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7444-32c7-cjv4",
"modified": "2024-03-21T06:33:01Z",
"modified": "2024-08-06T18:30:49Z",
"published": "2024-03-21T06:33:01Z",
"aliases": [
"CVE-2023-48901"
],
"details": "A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers to execute arbitrary SQL commands via the parameter \"id\" within the getPhotosByCarId function call in details.php.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-21T04:15:08Z"
advisories/unreviewed/2024/03/GHSA-76jh-m3c4-gxgj/GHSA-76jh-m3c4-gxgj.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-76jh-m3c4-gxgj",
"modified": "2024-03-26T18:32:05Z",
"modified": "2024-08-06T18:30:49Z",
"published": "2024-03-26T18:32:05Z",
"aliases": [
"CVE-2024-2915"
],
"details": "Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to elevate themselves to unauthorized groups via a specially crafted request.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-26T16:15:14Z"
advisories/unreviewed/2024/03/GHSA-8w7r-5fhv-vwj9/GHSA-8w7r-5fhv-vwj9.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8w7r-5fhv-vwj9",
"modified": "2024-03-01T06:33:06Z",
"modified": "2024-08-06T18:30:48Z",
"published": "2024-03-01T06:33:06Z",
"aliases": [
"CVE-2024-25293"
],
"details": "mjml-app versions 3.0.4 and 3.1.0-beta were discovered to contain a remote code execution (RCE) via the href attribute.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-01T06:15:48Z"
advisories/unreviewed/2024/03/GHSA-92jp-q2g9-wmq7/GHSA-92jp-q2g9-wmq7.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-92jp-q2g9-wmq7",
"modified": "2024-03-21T03:36:47Z",
"modified": "2024-08-06T18:30:49Z",
"published": "2024-03-21T03:36:47Z",
"aliases": [
"CVE-2024-2053"
],
"details": "The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the \"www-data\" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to prevent local file inclusion. These protections can be bypassed and arbitrary file requests supplied by unauthenticated users will be returned according to the privileges of the \"www-data\" user.\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -31,7 +34,7 @@
"cwe_ids": [
"CWE-23"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-21T02:52:27Z"
advisories/unreviewed/2024/03/GHSA-92q8-mrj6-9v42/GHSA-92q8-mrj6-9v42.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-92q8-mrj6-9v42",
"modified": "2024-03-27T06:30:31Z",
"modified": "2024-08-06T18:30:49Z",
"published": "2024-03-27T06:30:31Z",
"aliases": [
"CVE-2023-40289"
],
"details": "A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a user with BMC administrative privileges.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T04:15:10Z"
advisories/unreviewed/2024/03/GHSA-cv7f-2fw2-8wrg/GHSA-cv7f-2fw2-8wrg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cv7f-2fw2-8wrg",
"modified": "2024-03-27T06:30:31Z",
"modified": "2024-08-06T18:30:49Z",
"published": "2024-03-27T06:30:31Z",
"aliases": [
"CVE-2023-45927"
],
"details": "S-Lang 2.3.2 was discovered to contain an arithmetic exception via the function tt_sprintf().",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-703"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T04:15:10Z"
advisories/unreviewed/2024/03/GHSA-ghf9-8669-q7h4/GHSA-ghf9-8669-q7h4.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-ghf9-8669-q7h4",
"modified": "2024-03-02T00:31:32Z",
"modified": "2024-08-06T18:30:48Z",
"published": "2024-03-02T00:31:32Z",
"aliases": [
"CVE-2024-24511"
],
"details": "Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-01T23:15:08Z"
advisories/unreviewed/2024/03/GHSA-gwqv-mxv2-3769/GHSA-gwqv-mxv2-3769.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gwqv-mxv2-3769",
"modified": "2024-03-26T15:30:50Z",
"modified": "2024-08-06T18:30:49Z",
"published": "2024-03-26T15:30:50Z",
"aliases": [
"CVE-2024-29684"
],
"details": "DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/makehtml_homepage.php allowing a remote attacker to execute arbitrary code.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-26T14:15:09Z"
advisories/unreviewed/2024/03/GHSA-h2ph-x33p-jmpm/GHSA-h2ph-x33p-jmpm.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h2ph-x33p-jmpm",
"modified": "2024-03-21T06:33:03Z",
"modified": "2024-08-06T18:30:49Z",
"published": "2024-03-21T06:33:03Z",
"aliases": [
"CVE-2024-22724"
],
"details": "An issue was discovered in osCommerce v4, allows local attackers to bypass file upload restrictions and execute arbitrary code via administrator profile photo upload feature.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-21T04:15:09Z"
advisories/unreviewed/2024/03/GHSA-hmmj-whc7-2qjg/GHSA-hmmj-whc7-2qjg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hmmj-whc7-2qjg",
"modified": "2024-03-13T15:31:05Z",
"modified": "2024-08-06T18:30:49Z",
"published": "2024-03-13T15:31:05Z",
"aliases": [
"CVE-2024-28675"
],
"details": "DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_edit.php",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-13T14:15:07Z"
advisories/unreviewed/2024/03/GHSA-j8r5-8r3h-439x/GHSA-j8r5-8r3h-439x.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j8r5-8r3h-439x",
"modified": "2024-03-26T15:30:50Z",
"modified": "2024-08-06T18:30:49Z",
"published": "2024-03-26T15:30:50Z",
"aliases": [
"CVE-2023-50895"
],
"details": "In Janitza GridVis through 9.0.66, exposed dangerous methods in the de.janitza.pasw.project.server.ServerDatabaseProject project load functionality allow remote authenticated administrative users to execute arbitrary Groovy code.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -31,7 +34,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-26T15:15:48Z"
advisories/unreviewed/2024/03/GHSA-qfrj-3cjf-95fh/GHSA-qfrj-3cjf-95fh.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qfrj-3cjf-95fh",
"modified": "2024-03-04T03:30:26Z",
"modified": "2024-08-06T18:30:49Z",
"published": "2024-03-04T03:30:26Z",
"aliases": [
"CVE-2024-20027"
],
"details": "In da, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541632; Issue ID: ALPS08541633.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-04T03:15:07Z"
advisories/unreviewed/2024/03/GHSA-r2f8-jcm8-g23c/GHSA-r2f8-jcm8-g23c.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r2f8-jcm8-g23c",
"modified": "2024-03-27T03:31:17Z",
"modified": "2024-08-06T18:30:49Z",
"published": "2024-03-27T03:31:17Z",
"aliases": [
"CVE-2024-25735"
],
"details": "An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /device/config GET request.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T03:15:12Z"
advisories/unreviewed/2024/03/GHSA-rmwv-r5xx-8jvp/GHSA-rmwv-r5xx-8jvp.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rmwv-r5xx-8jvp",
"modified": "2024-03-02T00:31:31Z",
"modified": "2024-08-06T18:30:48Z",
"published": "2024-03-02T00:31:31Z",
"aliases": [
"CVE-2023-49540"
],
"details": "Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/history. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the history parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-01T22:15:47Z"

Some files were not shown because too many files have changed in this diff Show More