Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-02 05:13:30 +00:00
parent f5d4b02cfa
commit 9e5e489126
818 changed files with 1702 additions and 5106 deletions
@@ -3,14 +3,10 @@
  "id": "GHSA-mrvj-7q4f-5p42",
  "modified": "2021-03-19T19:56:16Z",
  "published": "2021-03-19T19:56:42Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Cross-site scripting in eZ Platform Kernel",
  "details": "### Impact\nIn file upload it is possible by certain means to upload files like .html and .js. These may contain XSS exploits which will be run when links to them are accessed by victims.\n\n### Patches\nThe fix consists simply of adding common types of scriptable file types to the configuration of the already existing filetype blacklist feature. See \"Patched versions\". As such, this can also be done manually, without installing the patched versions. This may be relevant if you are currently running a considerably older version of the kernel package and don't want to upgrade it at this time. Please see the settting \"ezsettings.default.io.file_storage.file_type_blacklist\" at:\nhttps://github.com/ezsystems/ezplatform-kernel/blob/master/eZ/Bundle/EzPublishCoreBundle/Resources/config/default_settings.yml#L109\n\n### Important note\nYou should adapt this setting to your needs. Do not add file types to the blacklist that you actually need to be able to upload. For instance, if you need your editors to be able to upload SVG files, then don't blacklist that. Instead, you could e.g. use an approval workflow for such content.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macro",
  "details": "### Impact\n\nThe `{{wikimacrocontent}}` executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inject scripts through it and they will be executed with the rights of the wiki macro (very often a user which has Programming rights).\n\nFortunately, no such macro exists by default in XWiki Standard but one could have been created or installed with an extension.\n\n### Patches\n\nIt has been patched in versions XWiki 12.6.3, 11.10.11 and 12.8-rc-1.\n\n### Workarounds\n\nThere is no easy workaround other than disabling the affected macros.\nInserting content in a safe way or knowing what is the user who called the wiki macro is not easy.\n\n### References\n\nhttps://jira.xwiki.org/browse/XWIKI-17759\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki](https://jira.xwiki.org)\n* Email us at [our security mailing list](mailto:security@xwiki.org)",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Path Traversal within joomla/archive zip class",
  "details": "An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "XSS in CreateQueuedJobTask",
  "details": "A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerability allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-fxq4-r6mr-9x64",
  "modified": "2021-04-08T16:45:47Z",
  "published": "2021-04-08T16:46:00Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "CSRF Vuln can expose user's QRcode",
  "details": "### Impact\nWhen a user is setting up two-factor authentication using an authenticator app, a QRcode is generated and made available via a GET request to /tf-qrcode. Since GETs do not have any CSRF protection, it is possible a malicious 3rd party could access the QRcode and therefore gain access to two-factor authentication codes. Note that the /tf-qrcode endpoint is ONLY accessible while the user is initially setting up their device. Once setup is complete, there is no vulnerability.\n\n### Patches\nThis is fixed in the upcoming 4.0.0 release.\n\n### Workarounds\nYou can provide your own URL for fetching the QRcode by defining SECURITY_TWO_FACTOR_QRCODE_URL and providing your own implementation (that presumably required a POST with CSRF protection). This would require changing the two-factor setup template as well.\n\n### References\nNone.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Read this pull request: #423",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-w3hj-wr2q-x83g",
  "modified": "2021-03-30T17:04:34Z",
  "published": "2021-04-06T17:22:17Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Discovery uses the same AES/GCM Nonce throughout the session",
  "details": "Discovery uses the same AES/GCM Nonce throughout the session though it should be generated on per message basis which can lead to the leaking of the session key.  As the actual ENR record is signed with a different key it is not possible for an attacker to alter the ENR record. Note that the node private key is not compromised, only the session key generated to communicate with an individual peer.\n\nFrom [discovery spec](https://github.com/ethereum/devp2p/blob/f97b8a5b8e9589d3355ebbd9d4a58d5d1644bdf7/discv5/discv5-theory.md#session-cache):\n> The number of messages which can be encrypted with a certain session key is limited because encryption of each message requires a unique nonce for AES-GCM. In addition to the keys, the session cache must also keep track of the count of outgoing messages to ensure the uniqueness of nonce values. Since the wire protocol uses 96 bit AES-GCM nonces, it is strongly recommended to generate them by encoding the current outgoing message count into the first 32 bits of the nonce and filling the remaining 64 bits with random data generated by a cryptographically secure random number generator.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Regular Expression Denial of Service (ReDoS) in braces",
  "details": "A vulnerability was found in Braces versions prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -4,9 +4,7 @@
  "modified": "2021-05-04T20:42:24Z",
  "published": "2022-01-06T20:31:01Z",
  "withdrawn": "2021-03-19T20:58:21Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Out-of-Bounds read in stringstream",
  "details": "Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).\n\n# WITHDRAWN\n\nThis is a duplicate of GHSA-mf6x-7mm4-x2g7",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-h87q-g2wp-47pj",
  "modified": "2022-02-15T01:51:57Z",
  "published": "2022-02-09T22:41:19Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Signatures are mistakenly recognized to be valid in jsrsasign",
  "details": "In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "RubyGems does not verify SSL certificate",
  "details": "RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -79,9 +77,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-04T21:15:08Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Puppet arbitrary file overwrite",
  "details": "Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Moodle does not enforce the forceloginforprofiles setting",
  "details": "`user/view.php` in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not enforce the `forceloginforprofiles` setting, which allows remote attackers to obtain sensitive course-profile information by leveraging the guest role, as demonstrated by a Google search.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Apache Tomcat Cross-site scripting (XSS) vulnerability",
  "details": "Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to `host-manager/html/add`.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Mono ASP.NET View State Cross-Site Scripting (XSS) vulnerability",
  "details": "The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Puppet uses predictable filenames, allowing arbitrary file overwrite",
  "details": "Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in `--edit` mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "QooxDoo XSS in Callback Parameter",
  "details": "Cross-site scripting (XSS) vulnerability in `framework/source/resource/qx/test/jsonp_primitive.php` in QooxDoo 1.3 and possibly other versions, as used in eyeOS 2.2 and 2.3, and possibly other products allows remote attackers to inject arbitrary web script or HTML via the callback parameter.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Puppet allows local users to modify the permissions of arbitrary files",
  "details": "Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Apache Tomcat Exposes IP Addresses and HTTP Headers of Requests",
  "details": "Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Ignite Realtime Openfire allows remote authenticated users to cause a denial of service",
  "details": "ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5 allows remote authenticated users to cause a denial of service (daemon outage) by triggering large outgoing queues without reading messages.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -102,9 +100,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-16T17:36:27Z",
--- a/Show More
+++ b/Show More