netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-08-16 18:32:04 +00:00
parent af920db8c8
commit 90dd1ea827
62 changed files with 630 additions and 146 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/02/GHSA-34mq-x3p9-rvrm/GHSA-34mq-x3p9-rvrm.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-34mq-x3p9-rvrm",
"modified": "2024-02-16T00:30:28Z",
"modified": "2024-08-16T18:30:55Z",
"published": "2024-02-16T00:30:28Z",
"aliases": [
"CVE-2023-40109"
],
"details": "In createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-15T23:15:08Z"
advisories/unreviewed/2024/02/GHSA-fpg4-3688-q56c/GHSA-fpg4-3688-q56c.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fpg4-3688-q56c",
"modified": "2024-02-27T03:31:01Z",
"modified": "2024-08-16T18:30:55Z",
"published": "2024-02-27T03:31:01Z",
"aliases": [
"CVE-2024-22543"
],
"details": "An issue was discovered in Linksys Router E1700 1.0.04 (build 3), allows authenticated attackers to escalate privileges via a crafted GET request to the /goform/* URI or via the ExportSettings function.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-613"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-27T01:15:06Z"
advisories/unreviewed/2024/02/GHSA-g22p-98cv-w94f/GHSA-g22p-98cv-w94f.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g22p-98cv-w94f",
"modified": "2024-02-29T03:33:18Z",
"modified": "2024-08-16T18:30:55Z",
"published": "2024-02-29T03:33:18Z",
"aliases": [
"CVE-2023-51800"
],
"details": "Cross Site Scripting (XSS) vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the main_settings component in the phone, address, bank, acc_name, acc_number parameters, new_class and cname parameter, add_new_parent function in the name email parameters, new_term function in the tname parameter, and the edit_student function in the name parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-29T02:15:09Z"
advisories/unreviewed/2024/02/GHSA-hj8r-465g-5vm4/GHSA-hj8r-465g-5vm4.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hj8r-465g-5vm4",
"modified": "2024-04-03T21:31:41Z",
"modified": "2024-08-16T18:30:55Z",
"published": "2024-02-26T18:30:31Z",
"aliases": [
"CVE-2024-25410"
],
"details": "flusity-CMS 2.33 is vulnerable to Unrestricted Upload of File with Dangerous Type in update_setting.php.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-26T16:27:58Z"
advisories/unreviewed/2024/02/GHSA-mv62-4r83-58qq/GHSA-mv62-4r83-58qq.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mv62-4r83-58qq",
"modified": "2024-02-21T18:31:02Z",
"modified": "2024-08-16T18:30:55Z",
"published": "2024-02-21T18:31:02Z",
"aliases": [
"CVE-2024-25288"
],
"details": "SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-21T17:15:09Z"
advisories/unreviewed/2024/03/GHSA-8f8j-wj6q-42wj/GHSA-8f8j-wj6q-42wj.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8f8j-wj6q-42wj",
"modified": "2024-03-04T15:31:07Z",
"modified": "2024-08-16T18:30:56Z",
"published": "2024-03-04T15:31:07Z",
"aliases": [
"CVE-2024-27684"
],
"details": "A Cross-site scripting (XSS) vulnerability in dlapn.cgi, dldongle.cgi, dlcfg.cgi, fwup.cgi and seama.cgi in D-Link GORTAC750_A1_FW_v101b03 allows remote attackers to inject arbitrary web script or HTML via the url parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-04T14:15:41Z"
advisories/unreviewed/2024/03/GHSA-9667-g4xx-wm5w/GHSA-9667-g4xx-wm5w.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9667-g4xx-wm5w",
"modified": "2024-03-07T03:30:41Z",
"modified": "2024-08-16T18:30:56Z",
"published": "2024-03-07T03:30:41Z",
"aliases": [
"CVE-2022-46089"
],
"details": "Cross Site Scripting (XSS) vulnerability in the add-airline form of Online Flight Booking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the airline parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-07T02:15:51Z"
advisories/unreviewed/2024/03/GHSA-gvvj-6354-3j8f/GHSA-gvvj-6354-3j8f.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gvvj-6354-3j8f",
"modified": "2024-03-14T15:34:06Z",
"modified": "2024-08-16T18:30:56Z",
"published": "2024-03-14T15:34:06Z",
"aliases": [
"CVE-2024-28418"
],
"details": "Webedition CMS 9.2.2.0 has a File upload vulnerability via /webEdition/we_cmd.php",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-14T13:15:53Z"
advisories/unreviewed/2024/03/GHSA-hjh7-5257-gpj4/GHSA-hjh7-5257-gpj4.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hjh7-5257-gpj4",
"modified": "2024-03-12T21:30:59Z",
"modified": "2024-08-16T18:30:56Z",
"published": "2024-03-12T21:30:59Z",
"aliases": [
"CVE-2023-43292"
],
"details": "Cross Site Scripting vulnerability in My Food Recipe Using PHP with Source Code v.1.0 allows a local attacker to execute arbitrary code via a crafted payload to the Recipe Name, Procedure, and ingredients parameters.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-12T21:15:55Z"
advisories/unreviewed/2024/03/GHSA-jqhq-7m2m-3xjx/GHSA-jqhq-7m2m-3xjx.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jqhq-7m2m-3xjx",
"modified": "2024-03-05T00:31:14Z",
"modified": "2024-08-16T18:30:56Z",
"published": "2024-03-05T00:31:14Z",
"aliases": [
"CVE-2024-25164"
],
"details": "iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download functionality.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-05T00:15:52Z"
advisories/unreviewed/2024/03/GHSA-mhv9-5hxr-j9mw/GHSA-mhv9-5hxr-j9mw.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mhv9-5hxr-j9mw",
"modified": "2024-03-02T00:31:31Z",
"modified": "2024-08-16T18:30:56Z",
"published": "2024-03-02T00:31:31Z",
"aliases": [
"CVE-2024-27744"
],
"details": "Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the image parameter in the profile.php component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -41,9 +44,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-01T22:15:47Z"
advisories/unreviewed/2024/03/GHSA-rr8j-4qpf-75m2/GHSA-rr8j-4qpf-75m2.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rr8j-4qpf-75m2",
"modified": "2024-03-07T09:30:30Z",
"modified": "2024-08-16T18:30:56Z",
"published": "2024-03-07T09:30:30Z",
"aliases": [
"CVE-2023-33676"
],
"details": "Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at \"?page=items/view&id=*\" which can be escalated to the remote command execution.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-07T09:15:38Z"
advisories/unreviewed/2024/03/GHSA-vqw3-3gm8-35vm/GHSA-vqw3-3gm8-35vm.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vqw3-3gm8-35vm",
"modified": "2024-03-01T15:31:39Z",
"modified": "2024-08-16T18:30:56Z",
"published": "2024-03-01T15:31:39Z",
"aliases": [
"CVE-2024-27497"
],
"details": "Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-01T15:15:08Z"
advisories/unreviewed/2024/03/GHSA-w7qj-9r4p-2jh6/GHSA-w7qj-9r4p-2jh6.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w7qj-9r4p-2jh6",
"modified": "2024-03-24T00:30:32Z",
"modified": "2024-08-16T18:30:56Z",
"published": "2024-03-24T00:30:32Z",
"aliases": [
"CVE-2024-23755"
],
"details": "ClickUp Desktop before 3.3.77 on macOS and Windows allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-23T22:15:07Z"
advisories/unreviewed/2024/03/GHSA-xf53-c458-r6pv/GHSA-xf53-c458-r6pv.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xf53-c458-r6pv",
"modified": "2024-03-13T06:30:51Z",
"modified": "2024-08-16T18:30:56Z",
"published": "2024-03-01T06:33:06Z",
"aliases": [
"CVE-2024-25386"
],
"details": "Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote attacker to execute arbitrary code via the format_logfile.pl file.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-01T06:15:48Z"
advisories/unreviewed/2024/04/GHSA-872f-jfmv-qjp2/GHSA-872f-jfmv-qjp2.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-872f-jfmv-qjp2",
"modified": "2024-04-10T21:30:32Z",
"modified": "2024-08-16T18:30:56Z",
"published": "2024-04-10T21:30:32Z",
"aliases": [
"CVE-2023-52070"
],
"details": "JFreeChart v1.5.4 was discovered to be vulnerable to ArrayIndexOutOfBounds via the 'setSeriesNeedle(int index, int type)' method.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-10T19:15:48Z"
advisories/unreviewed/2024/04/GHSA-8qpg-h99j-c4j3/GHSA-8qpg-h99j-c4j3.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8qpg-h99j-c4j3",
"modified": "2024-04-03T03:30:30Z",
"modified": "2024-08-16T18:30:56Z",
"published": "2024-04-03T03:30:30Z",
"aliases": [
"CVE-2024-24724"
],
"details": "Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-1336"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-03T03:15:09Z"
advisories/unreviewed/2024/04/GHSA-9jm5-85j2-p9f4/GHSA-9jm5-85j2-p9f4.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9jm5-85j2-p9f4",
"modified": "2024-04-11T03:34:59Z",
"modified": "2024-08-16T18:30:56Z",
"published": "2024-04-11T03:34:59Z",
"aliases": [
"CVE-2023-51141"
],
"details": "An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information via the Authentication & Authorization component",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-11T01:22:43Z"
advisories/unreviewed/2024/04/GHSA-fm24-99vc-2vfh/GHSA-fm24-99vc-2vfh.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fm24-99vc-2vfh",
"modified": "2024-04-17T18:31:33Z",
"modified": "2024-08-16T18:30:56Z",
"published": "2024-04-17T18:31:33Z",
"aliases": [
"CVE-2024-32316"
],
"details": "Tenda AC500 V2.0.1.9(1307) firmware has a stack overflow vulnerability in the fromDhcpListClient function.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-17T16:15:09Z"
advisories/unreviewed/2024/04/GHSA-j2v6-5mgp-w77v/GHSA-j2v6-5mgp-w77v.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j2v6-5mgp-w77v",
"modified": "2024-04-23T15:30:35Z",
"modified": "2024-08-16T18:30:56Z",
"published": "2024-04-23T15:30:35Z",
"aliases": [
"CVE-2024-33212"
],
"details": "Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the funcpara1 parameter in ip/goform/setcfm.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-23T15:15:50Z"

Some files were not shown because too many files have changed in this diff Show More