netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-01-23 18:32:00 +00:00
parent 8211540eeb
commit 96c297bfe7
39 changed files with 516 additions and 154 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-r62w-x9pp-jrqp/GHSA-r62w-x9pp-jrqp.json
+78
View File
@@ -0,0 +1,78 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r62w-x9pp-jrqp",
"modified": "2024-01-23T18:30:44Z",
"published": "2022-05-02T03:26:40Z",
"aliases": [
"CVE-2009-1595"
],
"summary": "Ignite Realtime Openfire Allows Users to Change Passwords of Arbitrary Accounts",
"details": "The `jabber:iq:auth` implementation in `IQAuthHandler.java` in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a `passwd_change` action.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.igniterealtime.openfire:parent"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1595"
},
{
"type": "WEB",
"url": "https://github.com/igniterealtime/Openfire/commit/97e1f08cf72e430f5cca5ba94cd20703dadb5ce5"
},
{
"type": "WEB",
"url": "https://download.igniterealtime.org/openfire/docs/latest/changelog.html#3.6.4"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50292"
},
{
"type": "PACKAGE",
"url": "https://github.com/igniterealtime/Openfire"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20090518061336/http://www.igniterealtime.org/issues/browse/JM-1531"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20140901211944/http://www.securityfocus.com/bid/34804"
},
{
"type": "WEB",
"url": "http://www.igniterealtime.org/community/message/190280"
}
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-23T18:30:44Z",
"nvd_published_at": "2009-05-11T14:30:00Z"
}
}
advisories/unreviewed/2021/12/GHSA-8jvf-jqg4-r6h2/GHSA-8jvf-jqg4-r6h2.json
+5 -2
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8jvf-jqg4-r6h2",
"modified": "2021-12-21T00:01:25Z",
"modified": "2024-01-23T18:31:10Z",
"published": "2021-12-16T00:02:12Z",
"aliases": [
"CVE-2021-20330"
],
"details": "An attacker with basic CRUD permissions on a replicated collection can run the applyOps command with specially malformed oplog entries, resulting in a potential denial of service on secondaries. This issue affects MongoDB Server v4.0 versions prior to 4.0.25; MongoDB Server v4.2 versions prior to 4.2.14; MongoDB Server v4.4 versions prior to 4.4.6.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
advisories/unreviewed/2022/01/GHSA-6fjw-fw76-494w/GHSA-6fjw-fw76-494w.json
+5 -2
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6fjw-fw76-494w",
"modified": "2022-01-27T00:03:02Z",
"modified": "2024-01-23T18:31:10Z",
"published": "2022-01-21T00:00:47Z",
"aliases": [
"CVE-2021-32039"
],
"details": "Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary file. These credentials may be used by malicious attackers to perform unauthorized actions. This vulnerability affects all MongoDB Extension for VS Code including and prior to version 0.7.0",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
advisories/unreviewed/2022/02/GHSA-4wcp-phx2-2w2x/GHSA-4wcp-phx2-2w2x.json
+5 -2
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4wcp-phx2-2w2x",
"modified": "2022-02-10T00:00:42Z",
"modified": "2024-01-23T18:31:10Z",
"published": "2022-02-10T00:00:42Z",
"aliases": [
"CVE-2021-32036"
],
"details": "An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may lead to resource depletion or generate high lock contention. This may result in denial of service and in rare cases could result in id field collisions.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H"
}
],
"affected": [
advisories/unreviewed/2022/05/GHSA-4hh4-3rxm-gq3h/GHSA-4hh4-3rxm-gq3h.json
+5 -2
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4hh4-3rxm-gq3h",
"modified": "2022-05-24T17:41:54Z",
"modified": "2024-01-23T18:31:09Z",
"published": "2022-05-24T17:41:54Z",
"aliases": [
"CVE-2021-20335"
],
"details": "For MongoDB Ops Manager 4.2.X with multiple OM application servers, that have SSL turned on for their MongoDB processes, the upgrade to MongoDB Ops Manager 4.4.X triggers a bug where Automation thinks SSL is being turned off, and can disable SSL temporarily for members of the cluster. This issue is temporary and eventually corrects itself after MongoDB Ops Manager instances have finished upgrading to MongoDB Ops Manager 4.4. In addition, customers must be running with clientCertificateMode=OPTIONAL / allowConnectionsWithoutCertificates=true to be impacted.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
advisories/unreviewed/2022/05/GHSA-4jpm-qv63-23qh/GHSA-4jpm-qv63-23qh.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4jpm-qv63-23qh",
"modified": "2022-05-24T22:01:28Z",
"modified": "2024-01-23T18:31:09Z",
"published": "2022-05-24T22:01:28Z",
"aliases": [
"CVE-2020-7929"
],
"details": "A user authorized to perform database queries may trigger denial of service by issuing specially crafted query contain a type of regex. This issue affects: MongoDB Inc. MongoDB Server v3.6 versions prior to 3.6.21 and MongoDB Server v4.0 versions prior to 4.0.20.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -25,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-185"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2022/05/GHSA-5mwc-rp6j-mw6r/GHSA-5mwc-rp6j-mw6r.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5mwc-rp6j-mw6r",
"modified": "2022-05-24T17:34:50Z",
"modified": "2024-01-23T18:31:08Z",
"published": "2022-05-24T17:34:50Z",
"aliases": [
"CVE-2020-7928"
],
"details": "A user authorized to perform database queries may trigger a read overrun and access arbitrary memory by issuing specially crafted queries. This issue affects: MongoDB Inc. MongoDB Server v4.5 versions prior to 4.5.1; v4.4 versions prior to 4.4.1; v4.2 versions prior to 4.2.9; v4.0 versions prior to 4.0.20; v3.6 versions prior to 3.6.20.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -25,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-158"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2022/05/GHSA-8v5c-chfg-fcjx/GHSA-8v5c-chfg-fcjx.json
+5 -2
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8v5c-chfg-fcjx",
"modified": "2022-05-24T19:21:17Z",
"modified": "2024-01-23T18:31:10Z",
"published": "2022-05-24T19:21:17Z",
"aliases": [
"CVE-2021-32037"
],
"details": "An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent to a shard. Usually, the requests are sent via mongos and special privileges are required in order to know the address of the shards and to log in to the shards of an auth enabled environment.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
advisories/unreviewed/2022/05/GHSA-8v6g-rf54-42cg/GHSA-8v6g-rf54-42cg.json
+10 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8v6g-rf54-42cg",
"modified": "2022-05-24T17:34:50Z",
"modified": "2024-01-23T18:31:09Z",
"published": "2022-05-24T17:34:50Z",
"aliases": [
"CVE-2020-7927"
],
"details": "Specially crafted API calls may allow an authenticated user who holds Organization Owner privilege to obtain an API key with Global Role privilege. This issue affects MongoDB Ops Manager v4.2 versions 4.2.0-4.2.17, v4.3 versions 4.3.0-4.3.9 and v4.4 versions 4.4.0-4.4.2.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -21,11 +24,15 @@
{
"type": "WEB",
"url": "https://docs.opsmanager.mongodb.com/current/release-notes/application/#onprem-server-4-4-3"
},
{
"type": "WEB",
"url": "https://www.mongodb.com/docs/ops-manager/current/release-notes/application/#onprem-server-4.4.3"
}
],
"database_specific": {
"cwe_ids": [
"CWE-648"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2022/05/GHSA-g7vh-w82q-6c7j/GHSA-g7vh-w82q-6c7j.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g7vh-w82q-6c7j",
"modified": "2022-05-24T16:53:23Z",
"modified": "2024-01-23T18:31:08Z",
"published": "2022-05-24T16:53:23Z",
"aliases": [
"CVE-2016-10885"
],
"details": "The wp-editor plugin before 1.2.6 for WordPress has CSRF.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-14T16:15:00Z"
advisories/unreviewed/2022/05/GHSA-ghvr-mww9-3hrg/GHSA-ghvr-mww9-3hrg.json
+7 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-ghvr-mww9-3hrg",
"modified": "2022-05-24T19:09:06Z",
"modified": "2024-01-23T18:31:10Z",
"published": "2022-05-24T19:09:06Z",
"aliases": [
"CVE-2021-20333"
],
"details": "Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects MongoDB Server v3.6 versions prior to 3.6.20; MongoDB Server v4.0 versions prior to 4.0.21; MongoDB Server v4.2 versions prior to 4.2.10;",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
@@ -25,7 +28,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-116"
"CWE-116",
"CWE-117"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2022/05/GHSA-hf4m-wpq9-6c3x/GHSA-hf4m-wpq9-6c3x.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hf4m-wpq9-6c3x",
"modified": "2022-05-24T16:53:23Z",
"modified": "2024-01-23T18:31:08Z",
"published": "2022-05-24T16:53:23Z",
"aliases": [
"CVE-2016-10886"
],
"details": "The wp-editor plugin before 1.2.6 for WordPress has incorrect permissions.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-14T16:15:00Z"
advisories/unreviewed/2022/05/GHSA-p75r-f57h-pg5w/GHSA-p75r-f57h-pg5w.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p75r-f57h-pg5w",
"modified": "2022-05-24T17:13:58Z",
"modified": "2024-01-23T18:31:08Z",
"published": "2022-05-24T17:13:58Z",
"aliases": [
"CVE-2020-7922"
],
"details": "X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates are unaffected.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-09T18:15:00Z"
advisories/unreviewed/2022/05/GHSA-r62w-x9pp-jrqp/GHSA-r62w-x9pp-jrqp.json
-63
View File
@@ -1,63 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r62w-x9pp-jrqp",
"modified": "2022-05-02T03:26:40Z",
"published": "2022-05-02T03:26:40Z",
"aliases": [
"CVE-2009-1595"
],
"details": "The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1595"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50292"
},
{
"type": "WEB",
"url": "http://osvdb.org/54189"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/34976"
},
{
"type": "WEB",
"url": "http://www.igniterealtime.org/builds/openfire/docs/latest/changelog.html"
},
{
"type": "WEB",
"url": "http://www.igniterealtime.org/community/message/190280"
},
{
"type": "WEB",
"url": "http://www.igniterealtime.org/issues/browse/JM-1531"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/34804"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/1237"
}
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-05-11T14:30:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-rqw4-wgg4-99m9/GHSA-rqw4-wgg4-99m9.json
+5 -2
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rqw4-wgg4-99m9",
"modified": "2022-05-24T17:34:50Z",
"modified": "2024-01-23T18:31:08Z",
"published": "2022-05-24T17:34:50Z",
"aliases": [
"CVE-2020-7926"
],
"details": "A user authorized to perform database queries may cause denial of service by issuing a specially crafted query which violates an invariant in the server selection subsystem. This issue affects: MongoDB Server version 4.4 prior to 4.4.1. Versions before 4.4 are not affected.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
advisories/unreviewed/2022/05/GHSA-v8v4-4v92-48h2/GHSA-v8v4-4v92-48h2.json
+7 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v8v4-4v92-48h2",
"modified": "2022-05-24T17:34:50Z",
"modified": "2024-01-23T18:31:08Z",
"published": "2022-05-24T17:34:50Z",
"aliases": [
"CVE-2020-7925"
],
"details": "Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.0-rc12; v4.2 versions prior to 4.2.9.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -25,7 +28,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-20"
"CWE-20",
"CWE-475"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2022/05/GHSA-vqmx-64jh-5r2h/GHSA-vqmx-64jh-5r2h.json
+6 -2
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vqmx-64jh-5r2h",
"modified": "2022-05-24T17:49:18Z",
"modified": "2024-01-23T18:31:10Z",
"published": "2022-05-24T17:49:18Z",
"aliases": [
"CVE-2021-20326"
],
"details": "A user authorized to performing a specific type of find query may trigger a denial of service. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.4.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -25,6 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-732"
],
"severity": "MODERATE",
advisories/unreviewed/2023/08/GHSA-6hrq-pjj8-qgcg/GHSA-6hrq-pjj8-qgcg.json
+6 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6hrq-pjj8-qgcg",
"modified": "2023-08-11T18:31:48Z",
"modified": "2024-01-23T18:31:10Z",
"published": "2023-08-09T12:30:26Z",
"aliases": [
"CVE-2023-32781"
@@ -28,13 +28,17 @@
{
"type": "WEB",
"url": "https://www.paessler.com/prtg/history/stable"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/176677/PRTG-Authenticated-Remote-Code-Execution.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-09T12:15:10Z"
advisories/unreviewed/2024/01/GHSA-37m7-jq3g-46vx/GHSA-37m7-jq3g-46vx.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-37m7-jq3g-46vx",
"modified": "2024-01-16T18:31:10Z",
"modified": "2024-01-23T18:31:11Z",
"published": "2024-01-16T18:31:10Z",
"aliases": [
"CVE-2023-7125"
],
"details": "The Community by PeepSo WordPress plugin before 6.3.1.2 does not have CSRF check when creating a user post (visible on their wall in their profile page), which could allow attackers to make logged in users perform such action via a CSRF attack",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-16T16:15:14Z"
advisories/unreviewed/2024/01/GHSA-7pxw-wr4x-29hm/GHSA-7pxw-wr4x-29hm.json
+31
View File
@@ -0,0 +1,31 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7pxw-wr4x-29hm",
"modified": "2024-01-23T18:31:11Z",
"published": "2024-01-23T18:31:11Z",
"aliases": [
"CVE-2024-23854"
],
"details": "Rejected reason: This CVE ID was unused by the CNA.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23854"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-23T16:15:49Z"
}
}

Some files were not shown because too many files have changed in this diff Show More