netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-864w-r5qj-h6fj
GHSA-gvgf-fp4m-2hw6
GHSA-hqwh-8xv9-42hw
GHSA-q4hw-62mx-q37w
GHSA-rvmg-xc29-rvxf
GHSA-hqwh-8xv9-42hw
GHSA-rvmg-xc29-rvxf
This commit is contained in:
advisory-database[bot]
2025-04-23 02:24:36 +00:00
parent f0f1b692f1
commit 91fff5c89d
7 changed files with 247 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-864w-r5qj-h6fj/GHSA-864w-r5qj-h6fj.json → advisories/github-reviewed/2022/05/GHSA-864w-r5qj-h6fj/GHSA-864w-r5qj-h6fj.json
+31 -9
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-864w-r5qj-h6fj",
"modified": "2025-04-20T03:46:51Z",
"modified": "2025-04-23T02:23:16Z",
"published": "2022-05-14T01:05:57Z",
"aliases": [
"CVE-2016-4461"
],
"summary": "Apache Struts forced double OGNL evaluation",
"details": "Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a \"%{}\" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785.",
"severity": [
{
@@ -13,12 +14,36 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.struts:struts2-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.3.29"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4461"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/struts"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20180629-0004"
@@ -26,19 +51,16 @@
{
"type": "WEB",
"url": "https://struts.apache.org/docs/s2-036.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/91277"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
"CWE-20",
"CWE-74"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-04-23T02:23:16Z",
"nvd_published_at": "2017-10-16T16:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-gvgf-fp4m-2hw6/GHSA-gvgf-fp4m-2hw6.json → advisories/github-reviewed/2022/05/GHSA-gvgf-fp4m-2hw6/GHSA-gvgf-fp4m-2hw6.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gvgf-fp4m-2hw6",
"modified": "2025-04-20T03:46:39Z",
"modified": "2025-04-23T02:22:39Z",
"published": "2022-05-13T01:24:45Z",
"aliases": [
"CVE-2017-15284"
],
"summary": "OctoberCMS Cross-Site Scripting",
"details": "Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "october/rain"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.426"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -23,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/octobercms/library/commit/3bbbbf3da469f457881b5af902eb0b89b95189a2"
},
{
"type": "PACKAGE",
"url": "https://github.com/octobercms/october"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/144587/OctoberCMS-1.0.425-Cross-Site-Scripting.html"
@@ -37,8 +62,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-04-23T02:22:39Z",
"nvd_published_at": "2017-10-12T08:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-hqwh-8xv9-42hw/GHSA-hqwh-8xv9-42hw.json
+74
View File
@@ -0,0 +1,74 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hqwh-8xv9-42hw",
"modified": "2025-04-23T02:23:37Z",
"published": "2022-05-17T00:22:00Z",
"aliases": [
"CVE-2017-14992"
],
"summary": "tar-split memory exhaustion",
"details": "Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/vbatts/tar-split"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14992"
},
{
"type": "WEB",
"url": "https://github.com/moby/moby/issues/35075"
},
{
"type": "WEB",
"url": "https://github.com/vbatts/tar-split/pull/42"
},
{
"type": "PACKAGE",
"url": "https://github.com/vbatts/tar-split"
},
{
"type": "WEB",
"url": "https://github.com/vbatts/tar-split/releases/tag/v0.10.2"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20171119174639/https://blog.cloudpassage.com/2017/10/13/discovering-docker-cve-2017-14992"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-770"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-04-23T02:23:36Z",
"nvd_published_at": "2017-11-01T17:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-q4hw-62mx-q37w/GHSA-q4hw-62mx-q37w.json → advisories/github-reviewed/2022/05/GHSA-q4hw-62mx-q37w/GHSA-q4hw-62mx-q37w.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q4hw-62mx-q37w",
"modified": "2025-04-20T03:48:10Z",
"modified": "2025-04-23T02:24:09Z",
"published": "2022-05-17T00:20:54Z",
"aliases": [
"CVE-2015-3933"
],
"summary": "MetalGenix GeniXCMS vulnerable to SQL Injection",
"details": "Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the (1) email parameter or (2) userid parameter to register.php.",
"severity": [
{
@@ -13,12 +14,36 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "genix/cms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3933"
},
{
"type": "PACKAGE",
"url": "https://github.com/GeniXCMS/GeniXCMS"
},
{
"type": "WEB",
"url": "https://github.com/semplon/GeniXCMS/releases/tag/v0.0.3-patch"
@@ -33,8 +58,8 @@
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-04-23T02:24:09Z",
"nvd_published_at": "2017-11-08T16:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-rvmg-xc29-rvxf/GHSA-rvmg-xc29-rvxf.json
+84
View File
@@ -0,0 +1,84 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rvmg-xc29-rvxf",
"modified": "2025-04-23T02:22:52Z",
"published": "2022-05-13T01:10:42Z",
"aliases": [
"CVE-2017-15363"
],
"summary": "Luracast Restler directory traversal vulnerability",
"details": "Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension before 1.7.1 for TYPO3, allows remote attackers to read arbitrary files via the file parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "aoe/restler"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.1"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "luracast/restler"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15363"
},
{
"type": "WEB",
"url": "https://extensions.typo3.org/extension/restler"
},
{
"type": "PACKAGE",
"url": "https://github.com/AOEpeople/TYPO3_Restler"
},
{
"type": "WEB",
"url": "https://github.com/AOEpeople/TYPO3_Restler/releases/tag/1.7.1"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-04-23T02:22:51Z",
"nvd_published_at": "2017-10-15T19:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-hqwh-8xv9-42hw/GHSA-hqwh-8xv9-42hw.json
-40
View File
@@ -1,40 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hqwh-8xv9-42hw",
"modified": "2025-04-20T03:47:56Z",
"published": "2022-05-17T00:22:00Z",
"aliases": [
"CVE-2017-14992"
],
"details": "Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06.2, 17.09.0, and earlier allows a remote attacker to cause a Denial of Service via a crafted image layer payload, aka gzip bombing.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14992"
},
{
"type": "WEB",
"url": "https://github.com/moby/moby/issues/35075"
},
{
"type": "WEB",
"url": "https://blog.cloudpassage.com/2017/10/13/discovering-docker-cve-2017-14992"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-01T17:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-rvmg-xc29-rvxf/GHSA-rvmg-xc29-rvxf.json
-40
View File
@@ -1,40 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rvmg-xc29-rvxf",
"modified": "2025-04-20T03:46:50Z",
"published": "2022-05-13T01:10:42Z",
"aliases": [
"CVE-2017-15363"
],
"details": "Directory traversal vulnerability in public/examples/resources/getsource.php in Luracast Restler through 3.0.0, as used in the restler extension before 1.7.1 for TYPO3, allows remote attackers to read arbitrary files via the file parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15363"
},
{
"type": "WEB",
"url": "https://extensions.typo3.org/extension/download/restler/1.7.1/zip"
},
{
"type": "WEB",
"url": "https://extensions.typo3.org/extension/restler"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-10-15T19:29:00Z"
}
}