netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2hx4-gpwf-5qv2
GHSA-4ggp-9p27-vq7h
GHSA-7m3v-93h9-w27h
GHSA-jm5g-jhgq-9vwh
GHSA-px7f-qj7m-m4v6
GHSA-q9c4-rq7w-7q8x
GHSA-qr26-2mpm-7j4x
GHSA-329h-fcrp-rfh4
GHSA-42m4-gw8j-vjvg
GHSA-cfq4-896j-74qc
This commit is contained in:
advisory-database[bot]
2024-08-27 00:32:54 +00:00
parent e6f3ef738c
commit a46ab08dab
10 changed files with 69 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/03/GHSA-2hx4-gpwf-5qv2/GHSA-2hx4-gpwf-5qv2.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2hx4-gpwf-5qv2",
"modified": "2024-03-14T03:31:14Z",
"modified": "2024-08-27T00:31:32Z",
"published": "2024-03-14T03:31:14Z",
"aliases": [
"CVE-2024-25228"
],
"details": "Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-14T02:15:50Z"
advisories/unreviewed/2024/03/GHSA-4ggp-9p27-vq7h/GHSA-4ggp-9p27-vq7h.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4ggp-9p27-vq7h",
"modified": "2024-03-04T03:30:26Z",
"modified": "2024-08-27T00:31:32Z",
"published": "2024-03-04T03:30:26Z",
"aliases": [
"CVE-2024-20036"
],
"details": "In vdec, there is a possible permission bypass due to a permissions bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08509508; Issue ID: ALPS08509508.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-04T03:15:07Z"
advisories/unreviewed/2024/03/GHSA-7m3v-93h9-w27h/GHSA-7m3v-93h9-w27h.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7m3v-93h9-w27h",
"modified": "2024-03-09T06:30:41Z",
"modified": "2024-08-27T00:31:32Z",
"published": "2024-03-09T06:30:41Z",
"aliases": [
"CVE-2023-49341"
],
"details": "An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to obtain sensitive information via cleartext credential storage in backup.htm component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-09T05:15:08Z"
advisories/unreviewed/2024/03/GHSA-jm5g-jhgq-9vwh/GHSA-jm5g-jhgq-9vwh.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jm5g-jhgq-9vwh",
"modified": "2024-03-07T18:30:28Z",
"modified": "2024-08-27T00:31:32Z",
"published": "2024-03-07T18:30:28Z",
"aliases": [
"CVE-2024-27733"
],
"details": "File Upload vulnerability in Byzro Network Smart s42 Management Platform v.S42 allows a local attacker to execute arbitrary code via the useratte/userattestation.php component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-07T17:15:13Z"
advisories/unreviewed/2024/03/GHSA-px7f-qj7m-m4v6/GHSA-px7f-qj7m-m4v6.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-px7f-qj7m-m4v6",
"modified": "2024-06-10T18:30:53Z",
"modified": "2024-08-27T00:31:32Z",
"published": "2024-03-27T21:30:47Z",
"aliases": [
"CVE-2024-28085"
],
"details": "wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
@@ -81,9 +84,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"severity": null,
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T19:15:48Z"
advisories/unreviewed/2024/03/GHSA-q9c4-rq7w-7q8x/GHSA-q9c4-rq7w-7q8x.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q9c4-rq7w-7q8x",
"modified": "2024-03-04T03:30:26Z",
"modified": "2024-08-27T00:31:32Z",
"published": "2024-03-04T03:30:26Z",
"aliases": [
"CVE-2024-20025"
],
"details": "In da, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08541686; Issue ID: ALPS08541686.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-04T03:15:07Z"
advisories/unreviewed/2024/03/GHSA-qr26-2mpm-7j4x/GHSA-qr26-2mpm-7j4x.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qr26-2mpm-7j4x",
"modified": "2024-03-04T03:30:25Z",
"modified": "2024-08-27T00:31:32Z",
"published": "2024-03-04T03:30:25Z",
"aliases": [
"CVE-2024-20017"
],
"details": "In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation Patch ID: WCNCR00350938; Issue ID: MSV-1132.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-04T03:15:06Z"
advisories/unreviewed/2024/08/GHSA-329h-fcrp-rfh4/GHSA-329h-fcrp-rfh4.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-329h-fcrp-rfh4",
"modified": "2024-08-26T21:30:33Z",
"modified": "2024-08-27T00:31:33Z",
"published": "2024-08-26T21:30:33Z",
"aliases": [
"CVE-2024-42906"
],
"details": "TestLink before v.1.9.20 is vulnerable to Cross Site Scripting (XSS) via the pop-up on upload file. When uploading a file, the XSS payload can be entered into the file name.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-26T20:15:07Z"
advisories/unreviewed/2024/08/GHSA-42m4-gw8j-vjvg/GHSA-42m4-gw8j-vjvg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-42m4-gw8j-vjvg",
"modified": "2024-08-26T21:30:34Z",
"modified": "2024-08-27T00:31:33Z",
"published": "2024-08-26T21:30:34Z",
"aliases": [
"CVE-2024-44793"
],
"details": "A cross-site scripting (XSS) vulnerability in the component /managers/multiple_freeleech.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the torrents parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-26T20:15:08Z"
advisories/unreviewed/2024/08/GHSA-cfq4-896j-74qc/GHSA-cfq4-896j-74qc.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cfq4-896j-74qc",
"modified": "2024-08-26T21:30:34Z",
"modified": "2024-08-27T00:31:33Z",
"published": "2024-08-26T21:30:34Z",
"aliases": [
"CVE-2024-44795"
],
"details": "A cross-site scripting (XSS) vulnerability in the component /login/disabled.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-26T20:15:08Z"