Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-06 05:02:55 +00:00
parent c3027c3f1c
commit 9455ccb910
978 changed files with 1912 additions and 5736 deletions
@@ -3,9 +3,7 @@
  "id": "GHSA-cf4g-fcf8-3cr9",
  "modified": "2023-02-09T19:27:57Z",
  "published": "2023-02-09T19:27:57Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "`pnet_packet` buffer overrun in `set_payload` setters",
  "details": "As indicated by this [issue](https://github.com/libpnet/libpnet/issues/449#issuecomment-663355987), a buffer overrun is possible in the `set_payload` setter of the various mutable \"Packet\" struct setters. The offending `set_payload` functions were defined within the struct `impl` blocks in earlier versions of the package, and later by the `packet` macro.\n\nFixed in the `packet` macro by [this](https://github.com/libpnet/libpnet/pull/455) PR.\n",
  "severity": [
@@ -50,9 +48,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-09T19:27:57Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-qqhq-8r2c-c3f5",
  "modified": "2023-12-16T00:51:51Z",
  "published": "2023-12-15T23:43:30Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "nvdApiKey is logged in debug mode",
  "details": "### Summary\nThe value of `nvdApiKey` configuration parameter is logged in clear text in debug mode.\n\n### Details\nThe NVD API key is a kind of secret and should be treated like other secrets when logging in debug mode.\nExpecting the same behavior as for several password configurations: just print `******`\n\nNote that while the NVD API Key is an access token for the NVD API - they are not that sensitive. The only thing an NVD API Token grants is a higher rate limit when making calls to publicly available data. The data available from the NVD API is the same whether you have an API Key or not.\n\n### PoC\nThe nvdApiKey is configured to use an environment variable; when running `mvn -X dependency-check:check` the clear value is logged twice.\n\n### Impact\nThe NVD API key is a kind of secret and should not be exposed. If stolen, an attacker can use this key to obtain already public information.\n\n",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-45xg-4w5x-j429",
  "modified": "2024-05-30T18:59:33Z",
  "published": "2024-05-30T18:59:33Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "TYPO3 Arbitrary Shell Execution in Swiftmailer library",
  "details": "The swiftmailer library in use allows to execute arbitrary shell commands if the \"From\" header comes from a non-trusted source and no \"Return-Path\" is configured. Affected are only TYPO3 installation the configuration option\n```\n$GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport'] \n```\nis set to \"sendmail\". Installations with the default configuration are not affected.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-5h5v-m596-r6rf",
  "modified": "2024-05-30T18:37:39Z",
  "published": "2024-05-30T18:37:39Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "TYPO3 Possible Insecure Deserialization in Extbase Request Handling",
  "details": "It has been discovered that request handling in Extbase can be vulnerable to insecure deserialization. User submitted payload has to be signed with a corresponding HMAC-SHA1 using the sensitive TYPO3 encryptionKey as secret - invalid or unsigned payload is not deserialized.\n\nHowever, since sensitive information could have been leaked by accident (e.g. in repositories or in commonly known and unprotected backup files), there is the possibility that attackers know the private encryptionKey and are able to calculate the required HMAC-SHA1 to allow a malicious payload to be deserialized.\n\nRequirements for successfully exploiting this vulnerability (all of the following):\n\n- rendering at least one Extbase plugin in the frontend\n- encryptionKey has been leaked (from LocalConfiguration.php or corresponding .env file)",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-95qm-3xp7-vfj5",
  "modified": "2024-05-30T18:31:36Z",
  "published": "2024-05-30T18:31:36Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "TYPO3 Cross-Site Scripting in Form Framework validation handling",
  "details": "It has been discovered that the output of field validation errors in the Form Framework is vulnerable to cross-site scripting.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-mxjf-hc9v-xgv2",
  "modified": "2024-05-30T20:01:17Z",
  "published": "2024-05-30T20:00:38Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting",
  "details": "Failing to properly validate the HTTP host-header TYPO3 CMS is susceptible to host spoofing. TYPO3 uses the HTTP host-header to generate absolute URLs in several places like 404 handling, http(s) enforcement, password reset links and many more. Since the host header itself is provided by the client it can be forged to any value, even in a name based virtual hosts environment. A blog post describes this problem in great detail.",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-p84g-j2gh-83g3",
  "modified": "2024-05-30T20:35:41Z",
  "published": "2024-05-30T20:35:41Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "TYPO3 possible cache poisoning on the homepage when anchors are used",
  "details": "A request URL with arbitrary arguments, but still pointing to the home page of  a TYPO3 installation can be cached if the configuration option config.prefixLocalAnchors is used with the values \"all\" or \"cached\". The impact of this vulnerability is that unfamiliar looking links to the home page can end up in the cache, which leads to a reload of the page in the browser when section links are followed by web page visitors, instead of just directly jumping to the requested section of the page. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -66,9 +62,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-30T20:35:41Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-x428-565f-8xj2",
  "modified": "2024-05-30T18:27:24Z",
  "published": "2024-05-30T18:27:24Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "TYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend API",
  "details": "Backend API configuration using Page TSconfig is vulnerable to arbitrary code execution and cross-site scripting. TSconfig fields of page properties in backend forms can be used to inject malicious sequences. Field tsconfig_includes is vulnerable to directory traversal leading to same scenarios as having direct access to TSconfig settings.\n\nA valid backend user account having access to modify values for fields `pages.TSconfig` and `pages.tsconfig_includes` is needed in order to exploit this vulnerability.\n\n",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-x4gp-pqpj-f43q",
  "modified": "2024-06-18T21:56:24Z",
  "published": "2024-06-18T21:56:24Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "curve25519-dalek has timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`",
  "details": "Timing variability of any kind is problematic when working with  potentially secret values such as\nelliptic curve scalars, and such issues can potentially leak private keys and other secrets. Such a\nproblem was recently discovered in `curve25519-dalek`.\n\nThe `Scalar29::sub` (32-bit) and `Scalar52::sub` (64-bit) functions contained usage of a mask value\ninside a loop where LLVM saw an opportunity to insert a branch instruction (`jns` on x86) to\nconditionally bypass this code section when the mask value is set to zero as can be seen in godbolt:\n\n- 32-bit (see L106): https://godbolt.org/z/zvaWxzvqv\n- 64-bit (see L48): https://godbolt.org/z/PczYj7Pda\n\nA similar problem was recently discovered in the Kyber reference implementation:\n\nhttps://groups.google.com/a/list.nist.gov/g/pqc-forum/c/hqbtIGFKIpU/m/cnE3pbueBgAJ\n\nAs discussed on that thread, one portable solution, which is also used in this PR, is to introduce a\nvolatile read as an optimization barrier, which prevents the compiler from optimizing it away.\n\nThe fix can be validated in godbolt here:\n\n- 32-bit: https://godbolt.org/z/jc9j7eb8E\n- 64-bit: https://godbolt.org/z/x8d46Yfah\n\nThe problem was discovered and the solution independently verified by \nAlexander Wagner <alexander.wagner@aisec.fraunhofer.de> and Lea Themint <lea.thiemt@tum.de> using\ntheir DATA tool:\n\nhttps://github.com/Fraunhofer-AISEC/DATA\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-8327-84cj-8xjm",
  "modified": "2024-08-15T22:10:07Z",
  "published": "2024-08-15T22:10:06Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Stack overflow when parsing specially crafted JSON ABI strings",
  "details": "Affected versions of the `alloy-json-abi` crate did not properly handle parsing of malformatted JSON ABI strings. The `JsonAbi::parse` method can be tricked into a stack overflow when processing specially crafted input. \n\nThis stack overflow can lead to a crash of the application using this crate, potentially causing a denial of service.\n\nThe flaw was corrected in commit [4790c47](https://github.com/alloy-rs/core/commit/4790c47518024bd391bbd6815b00f501bad76a15).\n",
  "severity": [
@@ -13,9 +13,7 @@
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2013-3035"
  ],
  "details": "The IPv6 implementation in the inet subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allows remote attackers to cause a denial of service (system hang) via a crafted packet to an IPv6 interface.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2012-5237"
  ],
  "details": "The dissect_hsrp function in epan/dissectors/packet-hsrp.c in the HSRP dissector in Wireshark 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -56,9 +52,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -13,9 +13,7 @@
      "score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2015-3828"
  ],
  "details": "The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3826.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2013-1489"
  ],
  "details": "Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 10 and Update 11, when running on Windows using Internet Explorer, Firefox, Opera, and Google Chrome, allows remote attackers to bypass the \"Very High\" security level of the Java Control Panel and execute unsigned Java code without prompting the user via unknown vectors, aka \"Issue 53\" and the \"Java Security Slider\" vulnerability.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -76,9 +72,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -13,9 +13,7 @@
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -7,12 +7,8 @@
    "CVE-2013-1847"
  ],
  "details": "The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -60,9 +56,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
--- a/Show More
+++ b/Show More