Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-01 05:05:20 +00:00
parent 3efb791e2e
commit a78c9a04fa
976 changed files with 1368 additions and 4104 deletions
@@ -3,9 +3,7 @@
  "id": "GHSA-3hwm-922r-47hw",
  "modified": "2023-04-25T23:06:52Z",
  "published": "2023-03-31T19:33:44Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Stud42 vulnerable to denial of service",
  "details": "A security vulnerability has been identified in the GraphQL parser used by the API of s42.app. An attacker can overload the parser and cause the API pod to crash. With a bit of threading, the attacker can bring down the entire API, resulting in an unhealthy stream. This vulnerability can be exploited by sending a specially crafted request to the API with a large payload.\n\nAn attacker can exploit this vulnerability to cause a denial of service (DoS) attack on the s42.app API, resulting in unavailability of the API for legitimate users.",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-3jxq-5xhh-9jr3",
  "modified": "2024-06-04T14:45:20Z",
  "published": "2024-06-04T14:45:20Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Cross-Site Scripting (XSS) in TYPO3 component Backend",
  "details": "Failing to properly encode incoming data, the bookmark toolbar is susceptible to Cross-Site Scripting.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -47,9 +43,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-04T14:45:20Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-pmxp-7224-h794",
  "modified": "2024-06-04T15:13:20Z",
  "published": "2024-06-04T15:13:20Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Denial of Service (DoS) attack possibility in TYPO3 component Indexed Search",
  "details": "Due to an oversized maximum result limit, TYPO3 component Indexed Search is susceptible to a Denial of Service attack.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-qffc-gwpp-m2xr",
  "modified": "2024-06-04T14:47:00Z",
  "published": "2024-06-04T14:47:00Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "XML External Entity (XXE) Processing in TYPO3 Core",
  "details": "All XML processing within the TYPO3 CMS are vulnerable to XEE processing. This can lead to load internal and/or external (file) content within an XML structure. Furthermore it is possible to inject arbitrary files for an XML Denial of Service attack. For more information on that topic see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -62,9 +58,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-04T14:47:00Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-wrpf-2x8h-82gr",
  "modified": "2024-06-04T15:01:36Z",
  "published": "2024-06-04T15:01:36Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Typo3 Arbitrary File Disclosure in Form Component",
  "details": "Failing to properly validate user input, the form component is susceptible to Arbitrary File Disclosure. A valid backend user account is needed to exploit this vulnerability. Only forms are vulnerable, which contain upload fields.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-52cw-pvq9-9m5v",
  "modified": "2024-07-22T16:54:34Z",
  "published": "2024-07-17T16:00:48Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Silverstripe uses TinyMCE which allows svg files linked in object tags",
  "details": "### Impact\nTinyMCE v6 has a configuration value `convert_unsafe_embeds` set to `false` which allows svg files containing javascript to be used in `<object>` or `<embed>` tags, which can be used as a vector for XSS attacks.\n\nNote that `<embed>` tags are not allowed by default.\n\nAfter patching the default value of `convert_unsafe_embeds` will be set to `true`. This means that `<object>` tags will be converted to iframes instead the next time the page is saved, which may break any pages that rely upon previously saved `<object>` tags. Developers can override this configuration if desired to revert to the original behaviour.\n\nWe reviewed the potential impact of this vulnerability within the context of Silverstripe CMS. We concluded this is a medium impact vulnerability given how TinyMCE is used by Silverstripe CMS.\n\n### References:\n- https://www.silverstripe.org/download/security-releases/ss-2024-001\n- https://github.com/advisories/GHSA-5359-pvf2-pw78\n\n",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-q445-7m23-qrmw",
  "modified": "2024-07-22T17:34:53Z",
  "published": "2024-07-22T17:34:53Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "openssl's `MemBio::get_buf` has undefined behavior with empty buffers",
  "details": "Previously, `MemBio::get_buf` called `slice::from_raw_parts` with a null-pointer, which violates the functions invariants, leading to undefined behavior. In debug builds this would produce an assertion failure. This is now fixed.\n",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-2r6g-7r83-jg72",
  "modified": "2024-08-30T23:37:36Z",
  "published": "2024-08-30T23:37:36Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "`spam` project on PyPI compromised, malicious releases made",
  "details": "The `spam` project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -42,9 +38,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-30T23:37:36Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-cxjf-x6jp-p7mc",
  "modified": "2024-08-30T23:37:19Z",
  "published": "2024-08-30T23:37:19Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "opencv-contrib-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863",
  "details": "opencv-contrib-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-contrib-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-f3q4-ggfp-jv34",
  "modified": "2024-08-30T18:51:58Z",
  "published": "2024-08-30T18:51:58Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Adyen APIs Library for Python timing attack vulnerability",
  "details": "Adyen has utility methods for validating notification HMAC signatures. The `is_valid_hmac` and `is_valid_hmac_notification` methods are vulnerable to a timing attack, you should compare the hash of the HMACs instead.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-jh2j-j4j9-crg3",
  "modified": "2024-08-30T23:37:17Z",
  "published": "2024-08-30T23:37:17Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "opencv-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863",
  "details": "opencv-python-headless versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python-headless v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-qr4w-53vh-m672",
  "modified": "2024-08-30T23:37:21Z",
  "published": "2024-08-30T23:37:20Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "opencv-python bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863",
  "details": "opencv-python versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-python v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-w2pj-9cgh-mq2c",
  "modified": "2024-08-30T23:37:14Z",
  "published": "2024-08-30T23:37:14Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "opencv-contrib-python-headless bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863",
  "details": "opencv-contrib-python-headless versions before v4.8.1.78 bundled libwebp binaries in wheels that are vulnerable to CVE-2023-4863. opencv-contrib-python-headless v4.8.1.78 upgrades the bundled libwebp binary to v1.3.2.",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-x6xg-3fj2-4pq3",
  "modified": "2024-08-30T23:36:58Z",
  "published": "2024-08-30T23:36:58Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "`exotel` project on PyPI compromised, malicious release made",
  "details": "The exotel project on PyPI was taken over via user account compromise via a phishing attack and a new malicious release made which contained code which some environment variables and downloaded and ran malware at install time",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -33,9 +29,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-30T23:36:58Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-xm4r-5rj9-2pg3",
  "modified": "2024-08-30T23:37:05Z",
  "published": "2024-08-30T23:37:05Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "gratient 0.5 contains credential harvesting code",
  "details": "gratient is a user-facing library for generating color gradients of text.\nVersion 0.5 contained obfuscated, malicious code targeting\nWindows platforms, harvesting information and credentials from the\nuser's system and sending them to a remote server.\nServices may include Mullvad VPN and Telegram.\n",
  "severity": [
@@ -44,9 +42,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-30T23:37:05Z",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
--- a/Show More
+++ b/Show More