netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-57fh-76pf-jqr3
GHSA-5m36-96vc-4fp6
GHSA-6whc-mw54-c55c
GHSA-cr2c-p6wc-8hfh
GHSA-f49h-4f4j-3rjc
GHSA-grv7-fg5c-xmjg
GHSA-q4r9-2gmr-g75g
GHSA-w3wv-rqfw-m3r7
This commit is contained in:
advisory-database[bot]
2024-05-22 12:33:51 +00:00
parent aef823dfc8
commit 98d7146f28
8 changed files with 328 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/05/GHSA-57fh-76pf-jqr3/GHSA-57fh-76pf-jqr3.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-57fh-76pf-jqr3",
"modified": "2024-05-22T12:32:28Z",
"published": "2024-05-22T12:32:28Z",
"aliases": [
"CVE-2024-5195"
],
"details": "A vulnerability was found in Arris VAP2500 08.50. It has been rated as critical. Affected by this issue is some unknown functionality of the file /diag_s.php. The manipulation of the argument customer_info leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-265832.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5195"
},
{
"type": "WEB",
"url": "https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/a%2B%26%5BE4%3Flp5%3Fk9_%3D%5D/ARRIS_VAP2500-RCE-diag_s.php.pdf"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.265832"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.265832"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.335253"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T11:15:54Z"
}
}
advisories/unreviewed/2024/05/GHSA-5m36-96vc-4fp6/GHSA-5m36-96vc-4fp6.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5m36-96vc-4fp6",
"modified": "2024-05-22T12:32:28Z",
"published": "2024-05-22T12:32:28Z",
"aliases": [
"CVE-2024-5194"
],
"details": "A vulnerability was found in Arris VAP2500 08.50. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /assoc_table.php. The manipulation of the argument id leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-265831.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5194"
},
{
"type": "WEB",
"url": "https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/a%2B%26%5BE4%3Flp5%3Fk9_%3D%5D/ARRIS_VAP2500-RCE-assoc_table.php.pdf"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.265831"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.265831"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.335252"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T11:15:53Z"
}
}
advisories/unreviewed/2024/05/GHSA-6whc-mw54-c55c/GHSA-6whc-mw54-c55c.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6whc-mw54-c55c",
"modified": "2024-05-22T12:32:26Z",
"published": "2024-05-22T12:32:26Z",
"aliases": [
"CVE-2024-4262"
],
"details": "The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.4.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4262"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3088562%40piotnet-addons-for-elementor&old=3048934%40piotnet-addons-for-elementor&sfp_email=&sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/812cc8f1-f89e-47c4-b029-f6a3dbc55d70?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T10:15:09Z"
}
}
advisories/unreviewed/2024/05/GHSA-cr2c-p6wc-8hfh/GHSA-cr2c-p6wc-8hfh.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cr2c-p6wc-8hfh",
"modified": "2024-05-22T12:32:28Z",
"published": "2024-05-22T12:32:28Z",
"aliases": [
"CVE-2024-36010"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nigb: Fix string truncation warnings in igb_set_fw_version\n\nCommit 1978d3ead82c (\"intel: fix string truncation warnings\")\nfixes '-Wformat-truncation=' warnings in igb_main.c by using kasprintf.\n\ndrivers/net/ethernet/intel/igb/igb_main.c:3092:53: warning：‘%d’ directive output may be truncated writing between 1 and 5 bytes into a region of size between 1 and 13 [-Wformat-truncation=]\n 3092 | \"%d.%d, 0x%08x, %d.%d.%d\",\n | ^~\ndrivers/net/ethernet/intel/igb/igb_main.c:3092:34: note：directive argument in the range [0, 65535]\n 3092 | \"%d.%d, 0x%08x, %d.%d.%d\",\n | ^~~~~~~~~~~~~~~~~~~~~~~~~\ndrivers/net/ethernet/intel/igb/igb_main.c:3092:34: note：directive argument in the range [0, 65535]\ndrivers/net/ethernet/intel/igb/igb_main.c:3090:25: note：‘snprintf’ output between 23 and 43 bytes into a destination of size 32\n\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure.\n\nFix this warning by using a larger space for adapter->fw_version,\nand then fall back and continue to use snprintf.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36010"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c56d055893cbe97848611855d1c97d0ab171eccc"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T12:15:10Z"
}
}
advisories/unreviewed/2024/05/GHSA-f49h-4f4j-3rjc/GHSA-f49h-4f4j-3rjc.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f49h-4f4j-3rjc",
"modified": "2024-05-22T12:32:27Z",
"published": "2024-05-22T12:32:27Z",
"aliases": [
"CVE-2024-5193"
],
"details": "A vulnerability was found in Ritlabs TinyWeb Server 1.94. It has been classified as problematic. Affected is an unknown function of the component Request Handler. The manipulation with the input %0D%0A leads to crlf injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-265830 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5193"
},
{
"type": "WEB",
"url": "https://github.com/DMCERTCE/CRLF_Tiny"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.265830"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.265830"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.333059"
}
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T11:15:53Z"
}
}
advisories/unreviewed/2024/05/GHSA-grv7-fg5c-xmjg/GHSA-grv7-fg5c-xmjg.json
+13 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-grv7-fg5c-xmjg",
"modified": "2024-05-14T18:30:54Z",
"modified": "2024-05-22T12:32:25Z",
"published": "2024-05-14T18:30:54Z",
"aliases": [
"CVE-2024-4068"
@@ -25,6 +25,18 @@
"type": "WEB",
"url": "https://github.com/micromatch/braces/issues/35"
},
{
"type": "WEB",
"url": "https://github.com/micromatch/braces/pull/37"
},
{
"type": "WEB",
"url": "https://github.com/micromatch/braces/pull/40"
},
{
"type": "WEB",
"url": "https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff"
},
{
"type": "WEB",
"url": "https://devhub.checkmarx.com/cve-details/CVE-2024-4068"
advisories/unreviewed/2024/05/GHSA-q4r9-2gmr-g75g/GHSA-q4r9-2gmr-g75g.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q4r9-2gmr-g75g",
"modified": "2024-05-22T12:32:26Z",
"published": "2024-05-22T12:32:26Z",
"aliases": [
"CVE-2024-4153"
],
"details": "A vulnerability in lunary-ai/lunary version 1.2.2 allows attackers to bypass user creation limits and potentially evade payment requirements. The issue arises from an undefined behavior when handling input to the API, specifically through a POST request to the /v1/users endpoint. By crafting a request with a new user's email and assigning them an 'admin' role, attackers can invite additional users beyond the set limit. This vulnerability could be exploited to add an unlimited number of users without adhering to the intended restrictions.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4153"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/336db0ae-fe33-44b9-ba9d-bf117e0d90c4"
}
],
"database_specific": {
"cwe_ids": [
"CWE-475"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T10:15:08Z"
}
}
advisories/unreviewed/2024/05/GHSA-w3wv-rqfw-m3r7/GHSA-w3wv-rqfw-m3r7.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w3wv-rqfw-m3r7",
"modified": "2024-05-22T12:32:28Z",
"published": "2024-05-22T12:32:28Z",
"aliases": [
"CVE-2024-5196"
],
"details": "A vulnerability classified as critical has been found in Arris VAP2500 08.50. This affects an unknown part of the file /tools_command.php. The manipulation of the argument cmb_header/txt_command leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265833 was assigned to this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5196"
},
{
"type": "WEB",
"url": "https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/a%2B%26%5BE4%3Flp5%3Fk9_%3D%5D/ARRIS_VAP2500-RCE-tools_command.php.pdf"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.265833"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.265833"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.335254"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T12:15:11Z"
}
}