netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-j6vx-r77h-44wc
GHSA-qff2-8qw7-hcvw
GHSA-v352-rg37-5q5m
GHSA-j6vx-r77h-44wc
GHSA-qff2-8qw7-hcvw
GHSA-v352-rg37-5q5m
This commit is contained in:
advisory-database[bot]
2024-08-02 15:17:41 +00:00
parent f281ed5128
commit 9b1e69e6e2
6 changed files with 199 additions and 105 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/08/GHSA-j6vx-r77h-44wc/GHSA-j6vx-r77h-44wc.json
+65
View File
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j6vx-r77h-44wc",
"modified": "2024-08-02T15:16:08Z",
"published": "2024-08-02T12:31:43Z",
"aliases": [
"CVE-2024-27182"
],
"summary": "Apache Linkis arbitrary file deletion vulnerability",
"details": "In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on a user with an administrator account could delete any file accessible by the Linkis system user. Users are recommended to upgrade to version 1.6.0, which fixes this issue.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.linkis:linkis"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27182"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/linkis"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/2of1p433h8rbq2bx525rtftnk19oz38h"
}
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-08-02T15:16:07Z",
"nvd_published_at": "2024-08-02T10:16:00Z"
}
}
advisories/github-reviewed/2024/08/GHSA-qff2-8qw7-hcvw/GHSA-qff2-8qw7-hcvw.json
+69
View File
@@ -0,0 +1,69 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qff2-8qw7-hcvw",
"modified": "2024-08-02T15:16:26Z",
"published": "2024-08-02T12:31:43Z",
"aliases": [
"CVE-2024-36268"
],
"summary": "Apache Inlong Code Injection vulnerability",
"details": "Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.\n\nThis issue affects Apache InLong: from 1.10.0 through 1.12.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.13.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/10251",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.inlong:tubemq-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.10.0"
},
{
"fixed": "1.13.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36268"
},
{
"type": "WEB",
"url": "https://github.com/apache/inlong/pull/10251"
},
{
"type": "WEB",
"url": "https://github.com/apache/inlong/commit/85fc8b02e69badc5103fadb77559a921c788537a"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/1w1yp1bg5sjvn46dszkf00tz1vfs0frc"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-08-02T15:16:26Z",
"nvd_published_at": "2024-08-02T10:16:00Z"
}
}
advisories/github-reviewed/2024/08/GHSA-v352-rg37-5q5m/GHSA-v352-rg37-5q5m.json
+65
View File
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v352-rg37-5q5m",
"modified": "2024-08-02T15:16:43Z",
"published": "2024-08-02T12:31:43Z",
"aliases": [
"CVE-2024-27181"
],
"summary": "Apache Linkis vulnerable to privilege escalation",
"details": "In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.linkis:linkis"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27181"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/linkis"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/hosd73l7hxb3rpt5rb0yg0ld11zph4c6"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-08-02T15:16:43Z",
"nvd_published_at": "2024-08-02T10:15:59Z"
}
}
advisories/unreviewed/2024/08/GHSA-j6vx-r77h-44wc/GHSA-j6vx-r77h-44wc.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j6vx-r77h-44wc",
"modified": "2024-08-02T12:31:43Z",
"published": "2024-08-02T12:31:43Z",
"aliases": [
"CVE-2024-27182"
],
"details": "In Apache Linkis <= 1.5.0,\n\nArbitrary file deletion in Basic management services on \n\nA user with an administrator account could delete any file accessible by the Linkis system user\n\n.\nUsers are recommended to upgrade to version 1.6.0, which fixes this issue.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27182"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/2of1p433h8rbq2bx525rtftnk19oz38h"
}
],
"database_specific": {
"cwe_ids": [
"CWE-552"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-02T10:16:00Z"
}
}
advisories/unreviewed/2024/08/GHSA-qff2-8qw7-hcvw/GHSA-qff2-8qw7-hcvw.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qff2-8qw7-hcvw",
"modified": "2024-08-02T12:31:43Z",
"published": "2024-08-02T12:31:43Z",
"aliases": [
"CVE-2024-36268"
],
"details": "Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.\n\nThis issue affects Apache InLong: from 1.10.0 through 1.12.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.13.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/10251",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36268"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/1w1yp1bg5sjvn46dszkf00tz1vfs0frc"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-02T10:16:00Z"
}
}
advisories/unreviewed/2024/08/GHSA-v352-rg37-5q5m/GHSA-v352-rg37-5q5m.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v352-rg37-5q5m",
"modified": "2024-08-02T12:31:43Z",
"published": "2024-08-02T12:31:43Z",
"aliases": [
"CVE-2024-27181"
],
"details": "In Apache Linkis <= 1.5.0,\n\nPrivilege Escalation in Basic management services where the attacking user is \n\na trusted account\n\n allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27181"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/hosd73l7hxb3rpt5rb0yg0ld11zph4c6"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-02T10:15:59Z"
}
}