netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-qqc8-rv37-79q5
GHSA-g2r4-phv7-5fgv
GHSA-v49p-m6gh-747c
GHSA-xx83-cxmq-x89m
This commit is contained in:
advisory-database[bot]
2024-12-13 20:39:17 +00:00
parent e1baf0f274
commit 975674b454
4 changed files with 119 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/03/GHSA-qqc8-rv37-79q5/GHSA-qqc8-rv37-79q5.json → advisories/github-reviewed/2024/03/GHSA-qqc8-rv37-79q5/GHSA-qqc8-rv37-79q5.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qqc8-rv37-79q5",
"modified": "2024-12-13T18:31:55Z",
"modified": "2024-12-13T20:37:40Z",
"published": "2024-03-15T09:30:37Z",
"aliases": [
"CVE-2024-28053"
],
"summary": "Mattermost Server Resource Exhaustion",
"details": "Resource Exhaustion in Mattermost Server versions 8.1.x before 8.1.10 fails to limit the size of the payload that can be read and parsed allowing an attacker to send a very large email payload and crash the server.\n\n",
"severity": [
{
@@ -13,12 +14,36 @@
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20240209181221-674f549daf0e"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28053"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
@@ -30,8 +55,8 @@
"CWE-770"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-12-13T20:37:40Z",
"nvd_published_at": "2024-03-15T09:15:07Z"
}
}
advisories/unreviewed/2024/12/GHSA-g2r4-phv7-5fgv/GHSA-g2r4-phv7-5fgv.json → advisories/github-reviewed/2024/12/GHSA-g2r4-phv7-5fgv/GHSA-g2r4-phv7-5fgv.json
+30 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g2r4-phv7-5fgv",
"modified": "2024-12-13T06:30:58Z",
"modified": "2024-12-13T20:37:35Z",
"published": "2024-12-13T06:30:58Z",
"aliases": [
"CVE-2024-21544"
],
"summary": "Browsershot Local File Inclusion",
"details": "Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method.\nAn attacker can exploit this vulnerability by using leading whitespace (%20) before the file:// protocol, resulting in Local File Inclusion, which allows the attacker to read sensitive files on the server.",
"severity": [
{
@@ -14,10 +15,30 @@
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "spatie/browsershot"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.1"
}
]
}
]
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -27,6 +48,10 @@
"type": "WEB",
"url": "https://github.com/spatie/browsershot/commit/fae8396641b961f62bd756920b14f01a4391296e"
},
{
"type": "PACKAGE",
"url": "https://github.com/spatie/browsershot"
},
{
"type": "WEB",
"url": "https://github.com/spatie/browsershot/blob/1e212b596c104138550ed4ef1b9977d8df570c67/src/Browsershot.php%23L258-L269"
@@ -41,8 +66,8 @@
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-12-13T20:37:35Z",
"nvd_published_at": "2024-12-13T05:15:07Z"
}
}
advisories/unreviewed/2024/12/GHSA-v49p-m6gh-747c/GHSA-v49p-m6gh-747c.json → advisories/github-reviewed/2024/12/GHSA-v49p-m6gh-747c/GHSA-v49p-m6gh-747c.json
+31 -6
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v49p-m6gh-747c",
"modified": "2024-12-13T06:30:58Z",
"modified": "2024-12-13T20:37:27Z",
"published": "2024-12-13T06:30:58Z",
"aliases": [
"CVE-2024-21543"
],
"summary": "djoser Authentication Bypass",
"details": "Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails. This is because the system falls back to querying the database directly, granting access to users with valid credentials, and eventually bypassing custom authentication checks such as two-factor authentication, LDAP validations, or requirements from configured AUTHENTICATION_BACKENDS.",
"severity": [
{
@@ -14,10 +15,30 @@
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "djoser"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.0"
}
]
}
]
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -35,6 +56,10 @@
"type": "WEB",
"url": "https://github.com/sunscrapers/djoser/commit/d33c3993c0c735f23cbedc60fa59fce69354f19d"
},
{
"type": "PACKAGE",
"url": "https://github.com/sunscrapers/djoser"
},
{
"type": "WEB",
"url": "https://github.com/sunscrapers/djoser/releases/tag/2.3.0"
@@ -48,9 +73,9 @@
"cwe_ids": [
"CWE-287"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-12-13T20:37:27Z",
"nvd_published_at": "2024-12-13T05:15:07Z"
}
}
advisories/unreviewed/2024/12/GHSA-xx83-cxmq-x89m/GHSA-xx83-cxmq-x89m.json → advisories/github-reviewed/2024/12/GHSA-xx83-cxmq-x89m/GHSA-xx83-cxmq-x89m.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xx83-cxmq-x89m",
"modified": "2024-12-13T00:30:50Z",
"modified": "2024-12-13T20:37:17Z",
"published": "2024-12-13T00:30:50Z",
"aliases": [
"CVE-2024-12289"
],
"summary": "Boundary Community Edition Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service",
"details": "Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on average is measured in milliseconds during the Boundary startup process.\n\nThis vulnerability, CVE-2024-12289, is fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.17.3, 0.18.2.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/boundary"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.18.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -22,6 +43,10 @@
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2024-28-boundary-controller-incorrectly-handles-http-requests-on-initialization-which-may-lead-to-a-denial-of-service"
},
{
"type": "PACKAGE",
"url": "https://github.com/hashicorp/boundary"
}
],
"database_specific": {
@@ -29,8 +54,8 @@
"CWE-460"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-12-13T20:37:17Z",
"nvd_published_at": "2024-12-12T23:15:10Z"
}
}