netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-q7jc-v6f2-q9jr
GHSA-4h72-34j6-j8x7
GHSA-5968-qw33-h47j
GHSA-9hmq-fm33-x4xx
GHSA-cvg2-7c3j-g36j
GHSA-q7jc-v6f2-q9jr
This commit is contained in:
advisory-database[bot]
2023-12-18 19:31:47 +00:00
parent 13889088f4
commit a0b339094d
6 changed files with 312 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/12/GHSA-q7jc-v6f2-q9jr/GHSA-q7jc-v6f2-q9jr.json
+59
View File
@@ -0,0 +1,59 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q7jc-v6f2-q9jr",
"modified": "2023-12-18T19:30:26Z",
"published": "2022-12-13T15:30:26Z",
"withdrawn": "2023-12-18T19:30:26Z",
"aliases": [
],
"summary": "Duplicate Advisory: Resque Scheduler Reflected XSS In Delayed Jobs View",
"details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-9hmq-fm33-x4xx. This link is maintained to preserve external references.\n\n## Original Description\nResque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the \"{schedule_job}\" or \"args\" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "resque-scheduler"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.27.4"
},
{
"fixed": "4.10.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44303"
},
{
"type": "WEB",
"url": "https://trungvm.gitbook.io/cves/resque/resque-1.27.4-multiple-reflected-xss-in-resque-schedule-job"
},
{
"type": "WEB",
"url": "http://resque.com"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2023-12-18T19:30:26Z",
"nvd_published_at": "2022-12-13T15:15:00Z"
}
}
advisories/github-reviewed/2023/12/GHSA-4h72-34j6-j8x7/GHSA-4h72-34j6-j8x7.json
+61
View File
@@ -0,0 +1,61 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4h72-34j6-j8x7",
"modified": "2023-12-18T19:31:12Z",
"published": "2023-12-18T19:31:12Z",
"aliases": [
],
"summary": "Maloja error page XSS vulnerability",
"details": "### Impact\nThe error page for a missing path echoes the path back to the user. If this contains HTML, an attacker could execute a script on the user's machine inside the Maloja context and perform authorized actions like scrobbling or deleting scrobbles.\nThis does not affect the security of your server. The exploit is purely client-side.\nSince there is very little incentive to mess with your scrobble data and it requires very specific targeting (an attacker would have to send a user a link to their own server), the severity rating might be misleading.\n\n### Patches\nThe Vulnerability is patched in 3.2.2\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "malojaserver"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.2.2"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/krateng/maloja/security/advisories/GHSA-4h72-34j6-j8x7"
},
{
"type": "WEB",
"url": "https://github.com/krateng/maloja/commit/febaff97228b37a192f2630aa331cac5e5c3e98e"
},
{
"type": "PACKAGE",
"url": "https://github.com/krateng/maloja"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2023-12-18T19:31:12Z",
"nvd_published_at": null
}
}
advisories/unreviewed/2023/12/GHSA-5968-qw33-h47j/GHSA-5968-qw33-h47j.json → advisories/github-reviewed/2023/12/GHSA-5968-qw33-h47j/GHSA-5968-qw33-h47j.json
+26 -6
View File
@@ -1,12 +1,14 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5968-qw33-h47j",
"modified": "2023-12-15T00:31:03Z",
"modified": "2023-12-18T19:30:55Z",
"published": "2023-12-15T00:31:03Z",
"withdrawn": "2023-12-18T19:30:55Z",
"aliases": [
"CVE-2023-6134"
],
"details": "A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.",
"summary": "Duplicate Advisory: Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri",
"details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-cvg2-7c3j-g36j. This link is maintained to preserve external references.\n\n## Original Description\nA flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.",
"severity": [
{
"type": "CVSS_V3",
@@ -14,7 +16,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "23.0.3"
}
]
}
]
}
],
"references": [
{
@@ -63,8 +83,8 @@
"CWE-75"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2023-12-18T19:30:55Z",
"nvd_published_at": "2023-12-14T22:15:44Z"
}
}
advisories/github-reviewed/2023/12/GHSA-9hmq-fm33-x4xx/GHSA-9hmq-fm33-x4xx.json
+65
View File
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9hmq-fm33-x4xx",
"modified": "2023-12-18T19:30:32Z",
"published": "2023-12-18T19:30:32Z",
"aliases": [
"CVE-2022-44303"
],
"summary": "Resque Scheduler Reflected XSS In Delayed Jobs View",
"details": "### Impact\n\nResque Scheduler version 1.27.4 and above are affected by a cross-site scripting vulnerability. A remote attacker can inject javascript code to the \"{schedule_job}\" or \"args\" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.\n\n### Patches\n\nFixed in v4.10.2\n\n### Workarounds\n\nNo known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.\n\n### References\n* https://nvd.nist.gov/vuln/detail/CVE-2022-44303\n* https://github.com/resque/resque-scheduler/issues/761\n* https://github.com/resque/resque/issues/1885\n* https://github.com/resque/resque-scheduler/pull/780\n* https://github.com/resque/resque-scheduler/pull/783\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "resque-scheduler"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.27.4"
},
{
"fixed": "4.10.2"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/resque/resque-scheduler/security/advisories/GHSA-9hmq-fm33-x4xx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44303"
},
{
"type": "PACKAGE",
"url": "https://github.com/resque/resque-scheduler"
},
{
"type": "WEB",
"url": "https://trungvm.gitbook.io/cves/resque/resque-1.27.4-multiple-reflected-xss-in-resque-schedule-job"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2023-12-18T19:30:32Z",
"nvd_published_at": null
}
}
advisories/github-reviewed/2023/12/GHSA-cvg2-7c3j-g36j/GHSA-cvg2-7c3j-g36j.json
+101
View File
@@ -0,0 +1,101 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cvg2-7c3j-g36j",
"modified": "2023-12-18T19:31:02Z",
"published": "2023-12-18T19:31:02Z",
"aliases": [
"CVE-2023-6134"
],
"summary": "Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri",
"details": "Keycloak prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This could permit an attacker to submit a specially crafted request leading to XSS or possibly further attacks.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "23.0.3"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-cvg2-7c3j-g36j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6134"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/15a21bf8e4fb71f006ba9caf25b9c9d1d152cd20"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7854"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7855"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7856"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7857"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7858"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7860"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2023:7861"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-6134"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2249673"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"database_specific": {
"cwe_ids": [
"CWE-75"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2023-12-18T19:31:02Z",
"nvd_published_at": null
}
}
advisories/unreviewed/2022/12/GHSA-q7jc-v6f2-q9jr/GHSA-q7jc-v6f2-q9jr.json
-39
View File
@@ -1,39 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q7jc-v6f2-q9jr",
"modified": "2022-12-13T15:30:26Z",
"published": "2022-12-13T15:30:26Z",
"aliases": [
"CVE-2022-44303"
],
"details": "Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the \"{schedule_job}\" or \"args\" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44303"
},
{
"type": "WEB",
"url": "https://trungvm.gitbook.io/cves/resque/resque-1.27.4-multiple-reflected-xss-in-resque-schedule-job"
},
{
"type": "WEB",
"url": "http://resque.com"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-13T15:15:00Z"
}
}