netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-f3h9-8phc-6gvh
GHSA-h24r-m9qc-pvpg
GHSA-h24r-m9qc-pvpg
This commit is contained in:
advisory-database[bot]
2024-02-06 20:27:01 +00:00
parent 808d6a943d
commit 9affb155bb
3 changed files with 150 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/02/GHSA-f3h9-8phc-6gvh/GHSA-f3h9-8phc-6gvh.json → advisories/github-reviewed/2024/02/GHSA-f3h9-8phc-6gvh/GHSA-f3h9-8phc-6gvh.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f3h9-8phc-6gvh",
"modified": "2024-02-06T00:30:28Z",
"modified": "2024-02-06T20:25:41Z",
"published": "2024-02-06T00:30:28Z",
"aliases": [
"CVE-2024-0964"
],
"summary": "Gradio Path Traversal vulnerability",
"details": "A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "gradio"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.9.0"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/gradio-app/gradio/commit/d76bcaaaf0734aaf49a680f94ea9d4d22a602e70"
},
{
"type": "PACKAGE",
"url": "https://github.com/gradio-app/gradio"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/25e25501-5918-429c-8541-88832dfd3741"
@@ -35,8 +58,8 @@
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-02-06T20:25:41Z",
"nvd_published_at": "2024-02-05T23:15:08Z"
}
}
advisories/github-reviewed/2024/02/GHSA-h24r-m9qc-pvpg/GHSA-h24r-m9qc-pvpg.json
+123
View File
@@ -0,0 +1,123 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h24r-m9qc-pvpg",
"modified": "2024-02-06T20:26:17Z",
"published": "2024-02-06T12:30:31Z",
"aliases": [
"CVE-2024-0690"
],
"summary": "Ansible-core information disclosure flaw",
"details": "An information disclosure flaw was found in ansible-core due to a failure to respect the `ANSIBLE_NO_LOG` configuration in some scenarios. It was discovered that information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.16.0b1"
},
{
"fixed": "2.16.3"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ansible-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.15.0b1"
},
{
"fixed": "2.15.9"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ansible-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.14.14"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0690"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/pull/82565"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/6935c8e303440addd3871ecf8e04bde61080b032"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/78db3a3de6b40fb52d216685ae7cb903c609c3e1"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/b9a03bbf5a63459468baf8895ff74a62e9be4532"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/beb04bc2642c208447c5a936f94310528a1946b1"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-0690"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259013"
},
{
"type": "PACKAGE",
"url": "https://github.com/ansible/ansible"
}
],
"database_specific": {
"cwe_ids": [
"CWE-117"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-02-06T20:26:17Z",
"nvd_published_at": "2024-02-06T12:15:55Z"
}
}
advisories/unreviewed/2024/02/GHSA-h24r-m9qc-pvpg/GHSA-h24r-m9qc-pvpg.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h24r-m9qc-pvpg",
"modified": "2024-02-06T12:30:31Z",
"published": "2024-02-06T12:30:31Z",
"aliases": [
"CVE-2024-0690"
],
"details": "An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. It was discovered that information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0690"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/pull/82565"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-0690"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259013"
}
],
"database_specific": {
"cwe_ids": [
"CWE-117"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-06T12:15:55Z"
}
}