netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-364c-vvqx-446c
GHSA-ppjh-xp5v-46wc
GHSA-h6mp-mc7g-mg49
This commit is contained in:
advisory-database[bot]
2024-05-21 18:16:47 +00:00
parent 5ba8a48f0c
commit 9a70c7787b
3 changed files with 86 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2023/09/GHSA-364c-vvqx-446c/GHSA-364c-vvqx-446c.json
+11 -3
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-364c-vvqx-446c",
"modified": "2023-09-22T19:43:27Z",
"modified": "2024-05-21T18:15:12Z",
"published": "2023-09-20T06:30:50Z",
"aliases": [
"CVE-2023-43620"
],
"summary": "Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device",
"details": "An issue was discovered in Croc through 9.6.5. A sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver. ",
"details": "An issue was discovered in Croc before 9.6.16. A sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver. ",
"severity": [
{
"type": "CVSS_V3",
@@ -28,7 +28,7 @@
"introduced": "0"
},
{
"last_affected": "9.6.5"
"fixed": "9.6.16"
}
]
}
@@ -44,6 +44,14 @@
"type": "WEB",
"url": "https://github.com/schollz/croc/issues/595"
},
{
"type": "WEB",
"url": "https://github.com/schollz/croc/pull/697"
},
{
"type": "WEB",
"url": "https://github.com/schollz/croc/commit/3f12f75fae2e844c555ec01eeba0b8474938e93a"
},
{
"type": "PACKAGE",
"url": "https://github.com/schollz/croc"
advisories/github-reviewed/2023/09/GHSA-ppjh-xp5v-46wc/GHSA-ppjh-xp5v-46wc.json
+10 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-ppjh-xp5v-46wc",
"modified": "2023-09-22T19:40:39Z",
"modified": "2024-05-21T18:16:24Z",
"published": "2023-09-20T06:30:50Z",
"aliases": [
"CVE-2023-43619"
@@ -28,7 +28,7 @@
"introduced": "0"
},
{
"last_affected": "9.6.5"
"fixed": "9.6.16"
}
]
}
@@ -44,6 +44,14 @@
"type": "WEB",
"url": "https://github.com/schollz/croc/issues/593"
},
{
"type": "WEB",
"url": "https://github.com/schollz/croc/pull/697"
},
{
"type": "WEB",
"url": "https://github.com/schollz/croc/commit/3f12f75fae2e844c555ec01eeba0b8474938e93a"
},
{
"type": "PACKAGE",
"url": "https://github.com/schollz/croc"
advisories/github-reviewed/2024/05/GHSA-h6mp-mc7g-mg49/GHSA-h6mp-mc7g-mg49.json
+65
View File
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h6mp-mc7g-mg49",
"modified": "2024-05-21T18:16:24Z",
"published": "2024-05-21T18:16:24Z",
"aliases": [
],
"summary": "scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token",
"details": "Before version 3.7 the bundle is vulnerable to a [security issue in JWT](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/), which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "scheb/two-factor-bundle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.7.0"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/scheb/two-factor-bundle/issues/143"
},
{
"type": "WEB",
"url": "https://github.com/scheb/two-factor-bundle/commit/8890c1e47ae89e0ac6f8a40fd4bb4b91c2081aa7"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/scheb/two-factor-bundle/2018-07-08.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/scheb/two-factor-bundle"
}
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-05-21T18:16:24Z",
"nvd_published_at": null
}
}