Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-04 05:20:11 +00:00
parent dccc8820b0
commit a1ef4a1f84
927 changed files with 1328 additions and 3984 deletions
@@ -8,9 +8,7 @@
  ],
  "summary": "Cross-site Scripting in Apache Pluto",
  "details": "The \"first name\" and \"last name\" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-c6fg-99pr-25m9",
  "modified": "2022-01-06T19:47:00Z",
  "published": "2022-01-06T23:53:58Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Uncapped length of skin data fields submitted by players",
  "details": "### Impact\nSome skin data fields (e.g. skinID, geometryName) are not capped in length. These fields are typically saved in the NBT data of a player when the player quits the server, or during an autosave.\n\nThis is problematic due to the 32767 byte limit on `TAG_String`s. If any of these fields exceeds 32767 bytes, an exception will be thrown during data saving, which will cause the server to crash.\n\nOther fields (such as skinGeometryData) are also uncapped, but those have a much larger 2 GB length limit, so this is not a concern for those, particularly considering the decompressed packet size limit of 2 MB.\n\n### Patches\nPM3: 958a9dbf0fe3131ab60319c5a939f5dfbfe5dfbb\nPM4: 6492cac5c10f9fa8443ceddd2191a7b65b73f601\n\n### Workarounds\nA plugin may check player skins during `PlayerLoginEvent` and `PlayerSkinChangeEvent` and ensure that the offending fields are not larger than 32767 bytes.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [team@pmmp.io](mailto:team@pmmp.io)\n",
  "severity": [
@@ -73,9 +71,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-06T19:47:00Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Command Injection in Apache Kylin",
  "details": "Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-p62j-hrxm-xcxf",
  "modified": "2022-01-06T19:44:35Z",
  "published": "2022-01-06T23:53:35Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Book page text, count, and author/title length is not limited in PocketMine-MP",
  "details": "### Impact\nPlayers can fill book pages with as many characters as they like; the server does not check this.\nIn addition, the maximum of 50 pages is also not enforced, meaning that players can create \"book bombs\".\n\nThis causes a variety of problems:\n- Oversized NBT on the wire costing excess bandwidth for server and client\n- Server crashes when saving region-based worlds due to exceeding maximum chunk size of 1 MB (PM3-specific)\n- Server crashes if any book page exceeds 32 KiB (due to TAG_String size limit) (PM4-specific)\n\nThis does, however, require that an attacker obtain a writable book in the first place in order to exploit the problem.\n\n### Patches\nThe bug has been fixed in 3.26.5 and 4.0.5.\n\n### Workarounds\nBan writable books, or use a plugin to cancel `PlayerEditBookEvent` to cancel the event if `strlen(text) > 1024 || mb_strlen(text) > 256`.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [team@pmmp.io](mailto:team@pmmp.io)\n",
  "severity": [
@@ -65,9 +63,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-06T19:44:35Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Kylin can receive user input and load any class through Class.forName(...).",
  "details": "Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Server-Side Request Forgery in Apache Kylin",
  "details": "All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator. For endpoints accepting node details in HTTP message body, unauthenticated (but limited) server-side request forgery (SSRF) can be achieved. This issue affects Apache Kylin Apache Kylin 3 versions prior to 3.1.2.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Cross-site Scripting in Apache Struts",
  "details": "When the Struts2 debug mode is turned on, under certain conditions an arbitrary script may be executed in the 'Problem Report' screen. Also if JSP files are exposed to be accessed directly it's possible to execute an arbitrary script. \n\nIt is generally not advisable to have debug mode switched on outside of the development environment. Debug mode should always be turned off in production setup. Also never expose JSPs files directly and hide them inside WEB-INF folder or define dedicated security constraints to block access to raw JSP files.\n\nStruts >= 2.3.20 is not vulnerable to this attack. We recommend upgrading to Struts 2.3.20 or higher if turning off debug mode is not possible.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-xpp3-xrff-w6rh",
  "modified": "2022-08-12T15:31:10Z",
  "published": "2022-08-12T15:31:10Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "rocksdb vulnerable to out-of-bounds read",
  "details": "Affected versions of this crate called the RocksDB C API\n`rocksdb_open_column_families_with_ttl()` with a pointer to a single integer\nTTL value, but one TTL value for each column family is expected.\n\nThis is only relevant when using\n`rocksdb::DBWithThreadMode::open_cf_descriptors_with_ttl()` with multiple\ncolumn families.\n\nThis bug has been fixed in v0.19.0.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -56,9 +52,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-08-12T15:31:10Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-3w9w-9833-gcpv",
  "modified": "2023-02-08T22:38:31Z",
  "published": "2023-01-26T19:52:50Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Security bug in ConvertToSinglePlane when used with untrusted content from the DDS loader",
  "details": "### Impact\nA memory overwrite bug was reported by a security researcher in the **ConvertToSinglePlane** method via the *texconv* command-line tool when given an invalid height for planar video textures such as NV12. This can be a potential security bug for any clients of the library who follow the same pattern.\n\nThis issue *does not* impact use of the DDS texture loader itself, only when combined with `ConvertToSinglePlane` for converting multi-planar video formats. All other functions in the library fail immediately if given images in planar formats.\n\n### Patches\nThe fix to the specific area as well as general hardening can be found in [this PR](https://github.com/microsoft/DirectXTex/pull/307) and will be included in the This bug has been fixed in the January 31, 2023 or later release of DirectXTex.\n\n### Workarounds\nIf your code makes use of **ConvertToSinglePlane**, you can validate that the width & height alignment requirements are met for the input image before calling the function.\n",
  "severity": [
@@ -88,9 +86,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-01-26T19:52:50Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-fjj4-2q73-jvgc",
  "modified": "2023-02-08T18:15:28Z",
  "published": "2023-02-08T18:15:28Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Nervos CKB calculation of program load cycles may be missed when executing in resume mode",
  "details": "### Impact\nThe calculation of program load cycles may be missed when executing in resume mode. Since the script execution order is now determined, this issue does not cause network splitting.\n\n\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -40,9 +36,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-08T18:15:28Z",
@@ -4,9 +4,7 @@
  "modified": "2023-02-08T20:54:38Z",
  "published": "2023-02-01T12:32:41Z",
  "withdrawn": "2023-02-02T19:26:25Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Withdrawn: wallabag subject to Improper Authorization",
  "details": "## Duplicate advisory\nThis advisory has been withdrawn because it is a duplicate of [GHSA-qwx8-mxxx-mg96](https://github.com/advisories/GHSA-qwx8-mxxx-mg96). This link is maintained to preserve external references.\n\n## Original Description\n\nImproper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-p2gm-ffr3-w2xw",
  "modified": "2023-02-08T18:17:06Z",
  "published": "2023-02-08T18:17:06Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Nervos CKB vulnerable to low-resource flood DDoS attacks through network message",
  "details": "### Workarounds\n* forbid request genesis through network request\n* forbid requesting duplicate data  through network request\n\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -43,9 +39,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-08T18:17:06Z",
@@ -4,9 +4,7 @@
  "modified": "2023-02-08T16:14:16Z",
  "published": "2023-02-01T12:32:41Z",
  "withdrawn": "2023-02-02T19:26:27Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Withdrawn: wallabag subject to Improper Authorization via annotations",
  "details": "## Duplicate advisory\nThis advisory has been withdrawn because it is a duplicate of [GHSA-mrqx-mjc4-vfh3](https://github.com/advisories/GHSA-mrqx-mjc4-vfh3). This link is maintained to preserve external references.\n\n## Original Description\n\nImproper Authorization in GitHub repository wallabag/wallabag prior to 2.5.3.",
  "severity": [
@@ -4,14 +4,10 @@
  "modified": "2024-01-03T22:27:29Z",
  "published": "2024-01-03T18:30:51Z",
  "withdrawn": "2024-01-03T21:21:37Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE",
  "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-5h9g-x5rv-25wg. This link is maintained to preserve external references.\n\n### Original Description\nTinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.\n\n\n\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -4,14 +4,10 @@
  "modified": "2024-01-03T22:28:05Z",
  "published": "2024-01-03T18:30:51Z",
  "withdrawn": "2024-01-03T21:06:15Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: Denial of service in CBOR library",
  "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-6r92-cgxc-r5fg. This link is maintained to preserve external references.\n\n### Original Description\nPeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of \nservice vulnerability. An attacker may trigger the denial of service \ncondition by providing crafted data to the DecodeFromBytes or other \ndecoding mechanisms in PeterO.Cbor. Depending on the usage of the \nlibrary, an unauthenticated and remote attacker may be able to cause the\n denial of service condition.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-p4v8-jgcv-9g75",
  "modified": "2024-01-03T21:40:45Z",
  "published": "2024-01-03T21:40:45Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "safe_pqc_kyber leaks parts of secret keys",
  "details": "### Impact\nOn some platforms, when an attacker can time decapsulation, and in particular when the attacker can forge cipher texts, they can learn (parts of) the secret key.\n\nDoes not apply to ephemeral usage, such as when used in the regular way in TLS.\n\n### Patches\nPatched in 0.6.2.\n\n\n### References\n- [kyberslash.cr.yp.to](https://kyberslash.cr.yp.to)",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -51,9 +47,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-03T21:40:45Z",
@@ -4,14 +4,10 @@
  "modified": "2024-01-03T22:27:37Z",
  "published": "2024-01-03T18:30:51Z",
  "withdrawn": "2024-01-03T21:25:16Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE",
  "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-5h9g-x5rv-25wg. This link is maintained to preserve external references.\n\n### Original Description\nTinyMCE versions before 5.6.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -4,14 +4,10 @@
  "modified": "2024-01-03T22:26:03Z",
  "published": "2024-01-03T18:30:51Z",
  "withdrawn": "2024-01-03T21:22:02Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE plugins",
  "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-5h9g-x5rv-25wg. This link is maintained to preserve external references.\n\n### Original Description\nTinyMCE versions before 5.10.0 are affected by a cross-site scripting vulnerability. A remote and unauthenticated attacker could introduce crafted image or link URLs that would result in the execution of arbitrary JavaScript in an editing user's browser.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -7,12 +7,8 @@
    "CVE-2021-37128"
  ],
  "details": "HwPCAssistant has a Path Traversal vulnerability .Successful exploitation of this vulnerability may write any file.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
+  "severity": [],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
--- a/Show More
+++ b/Show More