diff --git a/advisories/github-reviewed/2021/05/GHSA-2v6x-frw8-7r7f/GHSA-2v6x-frw8-7r7f.json b/advisories/github-reviewed/2021/05/GHSA-2v6x-frw8-7r7f/GHSA-2v6x-frw8-7r7f.json index 484d3f89f40..a1463a8316a 100644 --- a/advisories/github-reviewed/2021/05/GHSA-2v6x-frw8-7r7f/GHSA-2v6x-frw8-7r7f.json +++ b/advisories/github-reviewed/2021/05/GHSA-2v6x-frw8-7r7f/GHSA-2v6x-frw8-7r7f.json @@ -1,13 +1,14 @@ { "schema_version": "1.4.0", "id": "GHSA-2v6x-frw8-7r7f", - "modified": "2021-05-17T21:04:15Z", + "modified": "2024-01-23T17:50:31Z", "published": "2021-05-18T15:38:54Z", + "withdrawn": "2024-01-23T17:50:31Z", "aliases": [ "CVE-2019-17110" ], - "summary": "Exposure of Sensitive Information to an Unauthorized Actor in kube-state-metrics", - "details": "A security issue was discovered in kube-state-metrics 1.7.x before 1.7.2. An experimental feature was added to v1.7.0 and v1.7.1 that enabled annotations to be exposed as metrics. By default, kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default kubectl behavior and this new feature can cause the entire secret content to end up in metric labels, thus inadvertently exposing the secret content in metrics.", + "summary": "Duplicate Advisory: k8s.io/kube-state-metrics Exposure of Sensitive Information", + "details": "# Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-c92w-72c5-9x59. This link is maintained to preserve external references.\n\n# Original Description\n\nA security issue was discovered in kube-state-metrics 1.7.x before 1.7.2. An experimental feature was added to v1.7.0 and v1.7.1 that enabled annotations to be exposed as metrics. By default, kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default kubectl behavior and this new feature can cause the entire secret content to end up in metric labels, thus inadvertently exposing the secret content in metrics.", "severity": [ { "type": "CVSS_V3", @@ -33,6 +34,25 @@ ] } ] + }, + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/kube-state-metrics" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.7.0" + }, + { + "fixed": "1.7.2" + } + ] + } + ] } ], "references": [ @@ -48,6 +68,10 @@ "type": "WEB", "url": "https://github.com/kubernetes/kube-state-metrics/commit/2a9ab3a9a0f1c4dbecb6a5577185b33bfac86a96" }, + { + "type": "PACKAGE", + "url": "https://github.com/kubernetes/kube-state-metrics" + }, { "type": "WEB", "url": "https://github.com/kubernetes/kube-state-metrics/releases/tag/v1.7.2" diff --git a/advisories/github-reviewed/2022/05/GHSA-j6c3-3c4w-qv8p/GHSA-j6c3-3c4w-qv8p.json b/advisories/github-reviewed/2022/05/GHSA-j6c3-3c4w-qv8p/GHSA-j6c3-3c4w-qv8p.json new file mode 100644 index 00000000000..454f677933d --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-j6c3-3c4w-qv8p/GHSA-j6c3-3c4w-qv8p.json @@ -0,0 +1,128 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j6c3-3c4w-qv8p", + "modified": "2024-01-23T17:51:27Z", + "published": "2022-05-13T01:12:49Z", + "aliases": [ + "CVE-2013-7341" + ], + "summary": "Moodle cross-site scripting (XSS) vulnerabilities", + "details": "Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.4.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.5.0" + }, + { + "fixed": "2.5.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.6.0" + }, + { + "fixed": "2.6.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7341" + }, + { + "type": "WEB", + "url": "https://github.com/flowplayer/flash/issues/121" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/98d135fea3006334093efa822205d4b2c3fd8ff9" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/9f2967e301d123d11625f3b6948e1ee538086791" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/c3cd5e1db9de4f1a634492d99990534e30518066" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/d65634044ebaa738f55bdec521beb42844d6916a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=256420" + }, + { + "type": "WEB", + "url": "http://flash.flowplayer.org/documentation/version-history.html" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43344" + }, + { + "type": "WEB", + "url": "http://openwall.com/lists/oss-security/2014/03/17/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T17:51:27Z", + "nvd_published_at": "2014-03-24T14:20:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-wp3g-pr4h-q6vv/GHSA-wp3g-pr4h-q6vv.json b/advisories/github-reviewed/2022/05/GHSA-wp3g-pr4h-q6vv/GHSA-wp3g-pr4h-q6vv.json new file mode 100644 index 00000000000..f5610f0ab06 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-wp3g-pr4h-q6vv/GHSA-wp3g-pr4h-q6vv.json @@ -0,0 +1,140 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wp3g-pr4h-q6vv", + "modified": "2024-01-23T17:51:12Z", + "published": "2022-05-13T01:12:59Z", + "aliases": [ + "CVE-2013-2082" + ], + "summary": "Moodle does not enforce capability requirements for reading blog comments", + "details": "Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.2.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.3.0" + }, + { + "fixed": "2.3.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.0" + }, + { + "fixed": "2.4.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2082" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/28772fb9e7e6be01b765fb721af16901bb47e417" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/5fde58a59335bc3109a9eaac4a15d1e9217541c3" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/8aa12adcf26ff2f0b61cd6f0288f2886c8c55bf7" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/9a909b1a359f72b8d384e18da8e05474604279e1" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/cb538f0e539e833edb7cf6fa3d705e8abc5003fd" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/f9e27e8323f31186820d25252ec0d4c6cd65dafc" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=228934" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37245" + }, + { + "type": "WEB", + "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html" + }, + { + "type": "WEB", + "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html" + }, + { + "type": "WEB", + "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.html" + }, + { + "type": "WEB", + "url": "http://openwall.com/lists/oss-security/2013/05/21/1" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T17:51:12Z", + "nvd_published_at": "2013-05-25T03:18:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-x3x8-fjw6-hccx/GHSA-x3x8-fjw6-hccx.json b/advisories/github-reviewed/2022/05/GHSA-x3x8-fjw6-hccx/GHSA-x3x8-fjw6-hccx.json new file mode 100644 index 00000000000..1391fd8bb5a --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-x3x8-fjw6-hccx/GHSA-x3x8-fjw6-hccx.json @@ -0,0 +1,156 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x3x8-fjw6-hccx", + "modified": "2024-01-23T17:50:52Z", + "published": "2022-05-13T01:12:59Z", + "aliases": [ + "CVE-2013-2081" + ], + "summary": "Moodle does not consider \"don't send\" attributes during hub registration", + "details": "Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider \"don't send\" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.2.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.3.0" + }, + { + "fixed": "2.3.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.0" + }, + { + "fixed": "2.4.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2081" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/1d79b726d762bcc629c1a2a74cfa3eca5a7c5da7" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/1fc34e37fdc57b4ec303cb942dc5d5535b953ed7" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/4d65904bc132548a2ef4c2a40bf5ba2cffb5f68f" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/54a3ce69e9ca751fffd0b3e0eb5be4add50de113" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/60c468bcb3b6f867a70f2f30427b52e0362e93d1" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/667eaec4d2679a8bc1fcd9f0ff17a1be2babccb0" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/669dee58048b18d9034a7b2367b97a50b498b0e0" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/a811e8ac56e49a174b68ceade81197c80be4b325" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/be6281e2cbc2fb40b96a48c07c80883fa80cd1b7" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/fd469033fa2c860647e48f3d543346503a37faa0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=228933" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37822" + }, + { + "type": "WEB", + "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html" + }, + { + "type": "WEB", + "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html" + }, + { + "type": "WEB", + "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.html" + }, + { + "type": "WEB", + "url": "http://openwall.com/lists/oss-security/2013/05/21/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T17:50:52Z", + "nvd_published_at": "2013-05-25T03:18:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-j6c3-3c4w-qv8p/GHSA-j6c3-3c4w-qv8p.json b/advisories/unreviewed/2022/05/GHSA-j6c3-3c4w-qv8p/GHSA-j6c3-3c4w-qv8p.json deleted file mode 100644 index 7d970c74a62..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-j6c3-3c4w-qv8p/GHSA-j6c3-3c4w-qv8p.json +++ /dev/null @@ -1,51 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-j6c3-3c4w-qv8p", - "modified": "2022-05-13T01:12:49Z", - "published": "2022-05-13T01:12:49Z", - "aliases": [ - "CVE-2013-7341" - ], - "details": "Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7341" - }, - { - "type": "WEB", - "url": "https://github.com/flowplayer/flash/issues/121" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=256420" - }, - { - "type": "WEB", - "url": "http://flash.flowplayer.org/documentation/version-history.html" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-43344" - }, - { - "type": "WEB", - "url": "http://openwall.com/lists/oss-security/2014/03/17/1" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2014-03-24T14:20:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-wp3g-pr4h-q6vv/GHSA-wp3g-pr4h-q6vv.json b/advisories/unreviewed/2022/05/GHSA-wp3g-pr4h-q6vv/GHSA-wp3g-pr4h-q6vv.json deleted file mode 100644 index a1d6cc81bd4..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-wp3g-pr4h-q6vv/GHSA-wp3g-pr4h-q6vv.json +++ /dev/null @@ -1,55 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-wp3g-pr4h-q6vv", - "modified": "2022-05-13T01:12:59Z", - "published": "2022-05-13T01:12:59Z", - "aliases": [ - "CVE-2013-2082" - ], - "details": "Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2082" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=228934" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37245" - }, - { - "type": "WEB", - "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html" - }, - { - "type": "WEB", - "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html" - }, - { - "type": "WEB", - "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.html" - }, - { - "type": "WEB", - "url": "http://openwall.com/lists/oss-security/2013/05/21/1" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2013-05-25T03:18:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-x3x8-fjw6-hccx/GHSA-x3x8-fjw6-hccx.json b/advisories/unreviewed/2022/05/GHSA-x3x8-fjw6-hccx/GHSA-x3x8-fjw6-hccx.json deleted file mode 100644 index eed31746b60..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-x3x8-fjw6-hccx/GHSA-x3x8-fjw6-hccx.json +++ /dev/null @@ -1,55 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-x3x8-fjw6-hccx", - "modified": "2022-05-13T01:12:59Z", - "published": "2022-05-13T01:12:59Z", - "aliases": [ - "CVE-2013-2081" - ], - "details": "Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider \"don't send\" attributes during hub registration, which allows remote hubs to obtain sensitive site information by reading form data.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2081" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=228933" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37822" - }, - { - "type": "WEB", - "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106965.html" - }, - { - "type": "WEB", - "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106988.html" - }, - { - "type": "WEB", - "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107026.html" - }, - { - "type": "WEB", - "url": "http://openwall.com/lists/oss-security/2013/05/21/1" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2013-05-25T03:18:00Z" - } -} \ No newline at end of file