netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-qp8q-gwf5-hqh2
GHSA-2p28-5mvp-2j2r
GHSA-585j-5449-mf5m
GHSA-6g9h-6v79-w4pc
GHSA-7fh9-933g-885p
GHSA-297x-j9pm-xjgg
GHSA-2p28-5mvp-2j2r
GHSA-585j-5449-mf5m
GHSA-6g9h-6v79-w4pc
GHSA-7fh9-933g-885p
This commit is contained in:
advisory-database[bot]
2024-04-23 22:38:11 +00:00
parent f028c0bd6b
commit 9511c8cf06
10 changed files with 849 additions and 255 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/04/GHSA-qp8q-gwf5-hqh2/GHSA-qp8q-gwf5-hqh2.json → advisories/github-reviewed/2022/04/GHSA-qp8q-gwf5-hqh2/GHSA-qp8q-gwf5-hqh2.json
+23 -7
View File
@@ -1,23 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qp8q-gwf5-hqh2",
"modified": "2022-04-22T00:24:21Z",
"modified": "2024-04-23T22:35:50Z",
"published": "2022-04-22T00:24:21Z",
"aliases": [
"CVE-2011-2714"
],
"summary": "Drupal Cross-Site Scripting vulnerability",
"details": "A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before display.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"versions": [
"6.20"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2714"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2011/Feb/219"
@@ -33,11 +49,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T22:35:50Z",
"nvd_published_at": "2020-01-14T22:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-2p28-5mvp-2j2r/GHSA-2p28-5mvp-2j2r.json
+126
View File
@@ -0,0 +1,126 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2p28-5mvp-2j2r",
"modified": "2024-04-23T22:36:48Z",
"published": "2022-05-14T03:35:57Z",
"aliases": [
"CVE-2017-6926"
],
"summary": "Drupal Comment reply form allows access to restricted content",
"details": "In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the attacker must have permission to post comments.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.4.0"
},
{
"fixed": "8.4.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0"
},
{
"fixed": "7.57"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.4.0"
},
{
"fixed": "8.4.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0"
},
{
"fixed": "7.57"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6926"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6926.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6926.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2018-001"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T22:36:48Z",
"nvd_published_at": "2018-03-01T23:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-585j-5449-mf5m/GHSA-585j-5449-mf5m.json
+138
View File
@@ -0,0 +1,138 @@
{
"schema_version": "1.4.0",
"id": "GHSA-585j-5449-mf5m",
"modified": "2024-04-23T22:36:53Z",
"published": "2022-05-14T03:35:58Z",
"aliases": [
"CVE-2017-6927"
],
"summary": "Drupal cross-site scripting vulnerability",
"details": "Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.4.0"
},
{
"fixed": "8.4.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0"
},
{
"fixed": "7.57"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.4.0"
},
{
"fixed": "8.4.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0"
},
{
"fixed": "7.57"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6927"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2017-6927.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2017-6927.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4123"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2018-001"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103138"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T22:36:53Z",
"nvd_published_at": "2018-03-01T23:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-6g9h-6v79-w4pc/GHSA-6g9h-6v79-w4pc.json
+96
View File
@@ -0,0 +1,96 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6g9h-6v79-w4pc",
"modified": "2024-04-23T22:37:18Z",
"published": "2022-05-17T03:47:58Z",
"aliases": [
"CVE-2016-7570"
],
"summary": "Drupal Users without \"Administer comments\" can set comment visibility on nodes they can edit",
"details": "Drupal 8.x before 8.1.10 does not properly check for \"Administer comments\" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.1.10"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.1.10"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7570"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-7570.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-7570.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://www.drupal.org/SA-CORE-2016-004"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93101"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1036886"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T22:37:18Z",
"nvd_published_at": "2016-10-03T18:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-7fh9-933g-885p/GHSA-7fh9-933g-885p.json
+278
View File
@@ -0,0 +1,278 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7fh9-933g-885p",
"modified": "2024-04-23T22:36:48Z",
"published": "2022-05-14T01:29:45Z",
"aliases": [
"CVE-2018-7600"
],
"summary": "Drupal Core Remote Code Execution Vulnerability",
"details": "Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0"
},
{
"fixed": "7.58"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0"
},
{
"fixed": "8.3.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.4.0"
},
{
"fixed": "8.4.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.5.0"
},
{
"fixed": "8.5.1"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0"
},
{
"fixed": "7.58"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0"
},
{
"fixed": "8.3.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.4"
},
{
"fixed": "8.4.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.5"
},
{
"fixed": "8.5.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7600"
},
{
"type": "WEB",
"url": "https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know"
},
{
"type": "WEB",
"url": "https://www.synology.com/support/security/Synology_SA_18_17"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44482"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44449"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44448"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2018-002"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4156"
},
{
"type": "WEB",
"url": "https://twitter.com/arancaytar/status/979090719003627521"
},
{
"type": "WEB",
"url": "https://twitter.com/RicterZ/status/984495201354854401"
},
{
"type": "WEB",
"url": "https://twitter.com/RicterZ/status/979567469726613504"
},
{
"type": "WEB",
"url": "https://research.checkpoint.com/uncovering-drupalgeddon-2"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html"
},
{
"type": "WEB",
"url": "https://groups.drupal.org/security/faq-2018-002"
},
{
"type": "WEB",
"url": "https://greysec.net/showthread.php?tid=2912&pid=10561"
},
{
"type": "WEB",
"url": "https://github.com/g0rx/CVE-2018-7600-Drupal-RCE"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://github.com/a2u/CVE-2018-7600"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7600.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7600.yaml"
},
{
"type": "WEB",
"url": "https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714"
},
{
"type": "WEB",
"url": "https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103534"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040598"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T22:36:48Z",
"nvd_published_at": "2018-03-29T07:29:00Z"
}
}
advisories/github-reviewed/2024/04/GHSA-297x-j9pm-xjgg/GHSA-297x-j9pm-xjgg.json
+188
View File
@@ -0,0 +1,188 @@
{
"schema_version": "1.4.0",
"id": "GHSA-297x-j9pm-xjgg",
"modified": "2024-04-23T22:36:09Z",
"published": "2024-04-23T22:36:09Z",
"aliases": [
"CVE-2018-7602"
],
"summary": "Drupal Core Remote Code Execution Vulnerability",
"details": "A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0"
},
{
"fixed": "7.59"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0"
},
{
"fixed": "8.4.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.5"
},
{
"fixed": "8.5.3"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0"
},
{
"fixed": "7.59"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.0"
},
{
"fixed": "8.4.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "drupal/drupal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.5"
},
{
"fixed": "8.5.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7602"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2018-7602.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2018-7602.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/drupal/core"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00030.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4180"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2018-004"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44542"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44557"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103985"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040754"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T22:36:09Z",
"nvd_published_at": "2018-07-19T17:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-2p28-5mvp-2j2r/GHSA-2p28-5mvp-2j2r.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2p28-5mvp-2j2r",
"modified": "2022-05-14T03:35:57Z",
"published": "2022-05-14T03:35:57Z",
"aliases": [
"CVE-2017-6926"
],
"details": "In Drupal versions 8.4.x versions before 8.4.5 users with permission to post comments are able to view content and comments they do not have access to, and are also able to add comments to this content. This vulnerability is mitigated by the fact that the comment system must be enabled and the attacker must have permission to post comments.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6926"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2018-001"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-01T23:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-585j-5449-mf5m/GHSA-585j-5449-mf5m.json
-50
View File
@@ -1,50 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-585j-5449-mf5m",
"modified": "2022-05-14T03:35:58Z",
"published": "2022-05-14T03:35:58Z",
"aliases": [
"CVE-2017-6927"
],
"details": "Drupal 8.4.x versions before 8.4.5 and Drupal 7.x versions before 7.57 has a Drupal.checkPlain() JavaScript function which is used to escape potentially dangerous text before outputting it to HTML (as JavaScript output does not typically go through Twig autoescaping). This function does not correctly handle all methods of injecting malicious HTML, leading to a cross-site scripting vulnerability under certain circumstances. The PHP functions which Drupal provides for HTML escaping are not affected.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6927"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00030.html"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4123"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2018-001"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103138"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-01T23:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-6g9h-6v79-w4pc/GHSA-6g9h-6v79-w4pc.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6g9h-6v79-w4pc",
"modified": "2022-05-17T03:47:58Z",
"published": "2022-05-17T03:47:58Z",
"aliases": [
"CVE-2016-7570"
],
"details": "Drupal 8.x before 8.1.10 does not properly check for \"Administer comments\" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7570"
},
{
"type": "WEB",
"url": "https://www.drupal.org/SA-CORE-2016-004"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93101"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1036886"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-10-03T18:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-7fh9-933g-885p/GHSA-7fh9-933g-885p.json
-114
View File
@@ -1,114 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7fh9-933g-885p",
"modified": "2022-05-14T01:29:45Z",
"published": "2022-05-14T01:29:45Z",
"aliases": [
"CVE-2018-7600"
],
"details": "Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7600"
},
{
"type": "WEB",
"url": "https://www.tenable.com/blog/critical-drupal-core-vulnerability-what-you-need-to-know"
},
{
"type": "WEB",
"url": "https://www.synology.com/support/security/Synology_SA_18_17"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44482"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44449"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44448"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-core-2018-002"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4156"
},
{
"type": "WEB",
"url": "https://twitter.com/arancaytar/status/979090719003627521"
},
{
"type": "WEB",
"url": "https://twitter.com/RicterZ/status/984495201354854401"
},
{
"type": "WEB",
"url": "https://twitter.com/RicterZ/status/979567469726613504"
},
{
"type": "WEB",
"url": "https://research.checkpoint.com/uncovering-drupalgeddon-2"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/03/msg00028.html"
},
{
"type": "WEB",
"url": "https://groups.drupal.org/security/faq-2018-002"
},
{
"type": "WEB",
"url": "https://greysec.net/showthread.php?tid=2912&pid=10561"
},
{
"type": "WEB",
"url": "https://github.com/g0rx/CVE-2018-7600-Drupal-RCE"
},
{
"type": "WEB",
"url": "https://github.com/a2u/CVE-2018-7600"
},
{
"type": "WEB",
"url": "https://blog.appsecco.com/remote-code-execution-with-drupal-core-sa-core-2018-002-95e6ecc0c714"
},
{
"type": "WEB",
"url": "https://badpackets.net/over-100000-drupal-websites-vulnerable-to-drupalgeddon-2-cve-2018-7600"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103534"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040598"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-29T07:29:00Z"
}
}