netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2q9c-qj72-94fh
GHSA-597f-j5wg-h28f
GHSA-7crh-9v7x-2x2r
GHSA-f3f9-274w-r3m6
GHSA-g5c3-6p2q-wc3j
GHSA-j23x-w7m9-8c47
GHSA-r9vr-4rjx-2pxv
GHSA-3626-w2c4-wvvc
GHSA-3gmf-fq2f-gwph
GHSA-47fw-q27j-gr9f
GHSA-7h23-57pg-3hwc
GHSA-8hpx-q4cx-gfxw
GHSA-c476-j253-5rgq
GHSA-cf7w-246v-3mp8
GHSA-h5jh-rp76-q242
GHSA-qq5h-rjj9-q9qg
GHSA-v664-qgx9-wf79
GHSA-wq97-58c8-w5g5
GHSA-x26x-c8x5-v2rm
GHSA-xf79-8g8m-ch82
This commit is contained in:
advisory-database[bot]
2025-01-29 15:33:11 +00:00
parent da59c2b5dd
commit a9b7127ef3
20 changed files with 252 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2023/05/GHSA-2q9c-qj72-94fh/GHSA-2q9c-qj72-94fh.json
+3 -1
View File
@@ -57,7 +57,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-863"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2023/05/GHSA-597f-j5wg-h28f/GHSA-597f-j5wg-h28f.json
+3 -1
View File
@@ -45,7 +45,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-120"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2023/05/GHSA-7crh-9v7x-2x2r/GHSA-7crh-9v7x-2x2r.json
+3 -1
View File
@@ -45,7 +45,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-120"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2023/05/GHSA-f3f9-274w-r3m6/GHSA-f3f9-274w-r3m6.json
+2 -1
View File
@@ -26,7 +26,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-269"
"CWE-269",
"CWE-863"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2023/05/GHSA-g5c3-6p2q-wc3j/GHSA-g5c3-6p2q-wc3j.json
+3 -1
View File
@@ -29,7 +29,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2023/05/GHSA-j23x-w7m9-8c47/GHSA-j23x-w7m9-8c47.json
+3 -1
View File
@@ -37,7 +37,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-770"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2023/05/GHSA-r9vr-4rjx-2pxv/GHSA-r9vr-4rjx-2pxv.json
+3 -1
View File
@@ -33,7 +33,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-863"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2025/01/GHSA-3626-w2c4-wvvc/GHSA-3626-w2c4-wvvc.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3626-w2c4-wvvc",
"modified": "2025-01-29T00:31:54Z",
"modified": "2025-01-29T15:31:34Z",
"published": "2025-01-29T00:31:54Z",
"aliases": [
"CVE-2024-55968"
],
"details": "An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. The com.dtexsystems.helper service, responsible for handling privileged operations within the macOS DTEX Event Forwarder agent, fails to implement critical client validation during XPC interprocess communication (IPC). Specifically, the service does not verify the code requirements, entitlements, security flags, or version of any client attempting to establish a connection. This lack of proper logic validation allows malicious actors to exploit the service's methods via unauthorized client connections, and escalate privileges to root by abusing the DTConnectionHelperProtocol protocol's submitQuery method over an unauthorized XPC connection.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-798"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-28T22:15:15Z"
advisories/unreviewed/2025/01/GHSA-3gmf-fq2f-gwph/GHSA-3gmf-fq2f-gwph.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3gmf-fq2f-gwph",
"modified": "2025-01-29T00:31:54Z",
"modified": "2025-01-29T15:31:34Z",
"published": "2025-01-29T00:31:54Z",
"aliases": [
"CVE-2024-56529"
],
"details": "Mailcow through 2024-11b has a session fixation vulnerability in the web panel. It allows remote attackers to set a session identifier when HSTS is disabled on a victim's browser. After a user logs in, they are authenticated and the session identifier is valid. Then, a remote attacker can access the victim's web panel with the same session identifier.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-384"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-28T23:15:07Z"
advisories/unreviewed/2025/01/GHSA-47fw-q27j-gr9f/GHSA-47fw-q27j-gr9f.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-47fw-q27j-gr9f",
"modified": "2025-01-29T06:31:50Z",
"modified": "2025-01-29T15:31:34Z",
"published": "2025-01-29T06:31:50Z",
"aliases": [
"CVE-2024-12749"
],
"details": "The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-29T06:15:30Z"
advisories/unreviewed/2025/01/GHSA-7h23-57pg-3hwc/GHSA-7h23-57pg-3hwc.json
+2 -1
View File
@@ -42,7 +42,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-276"
"CWE-276",
"CWE-416"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2025/01/GHSA-8hpx-q4cx-gfxw/GHSA-8hpx-q4cx-gfxw.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8hpx-q4cx-gfxw",
"modified": "2025-01-29T00:31:55Z",
"modified": "2025-01-29T15:31:34Z",
"published": "2025-01-29T00:31:55Z",
"aliases": [
"CVE-2024-57519"
],
"details": "An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs_dbi_auth_info function in lib/dbi/subscription.c file.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -28,8 +33,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-770"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-28T23:15:08Z"
advisories/unreviewed/2025/01/GHSA-c476-j253-5rgq/GHSA-c476-j253-5rgq.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c476-j253-5rgq",
"modified": "2025-01-29T00:31:54Z",
"modified": "2025-01-29T15:31:34Z",
"published": "2025-01-29T00:31:54Z",
"aliases": [
"CVE-2024-29869"
],
"details": "Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"references": [
{
@@ -39,7 +44,7 @@
"cwe_ids": [
"CWE-732"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-28T22:15:15Z"
advisories/unreviewed/2025/01/GHSA-cf7w-246v-3mp8/GHSA-cf7w-246v-3mp8.json
+2 -1
View File
@@ -26,7 +26,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-120"
"CWE-120",
"CWE-787"
],
"severity": "CRITICAL",
"github_reviewed": false,
advisories/unreviewed/2025/01/GHSA-h5jh-rp76-q242/GHSA-h5jh-rp76-q242.json
+41
View File
@@ -0,0 +1,41 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h5jh-rp76-q242",
"modified": "2025-01-29T15:31:35Z",
"published": "2025-01-29T15:31:35Z",
"aliases": [
"CVE-2024-57438"
],
"details": "Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57438"
},
{
"type": "WEB",
"url": "https://gitee.com/y_project/RuoYi"
},
{
"type": "WEB",
"url": "https://github.com/peccc/restful_vul/blob/main/ruoyi_insecure_role_assignments/ruoyi_insecure_role_assignments.md"
},
{
"type": "WEB",
"url": "https://github.com/yangzongzhuan/RuoYi"
},
{
"type": "WEB",
"url": "https://ruoyi.vip"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-29T15:15:17Z"
}
}
advisories/unreviewed/2025/01/GHSA-qq5h-rjj9-q9qg/GHSA-qq5h-rjj9-q9qg.json
+41
View File
@@ -0,0 +1,41 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qq5h-rjj9-q9qg",
"modified": "2025-01-29T15:31:35Z",
"published": "2025-01-29T15:31:35Z",
"aliases": [
"CVE-2024-57439"
],
"details": "An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicating the login name of the account.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57439"
},
{
"type": "WEB",
"url": "https://gitee.com/y_project/RuoYi"
},
{
"type": "WEB",
"url": "https://github.com/peccc/restful_vul/blob/main/ruoyi_dos/ruoyi_dos.md"
},
{
"type": "WEB",
"url": "https://github.com/yangzongzhuan/RuoYi"
},
{
"type": "WEB",
"url": "https://ruoyi.vip"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-29T15:15:17Z"
}
}
advisories/unreviewed/2025/01/GHSA-v664-qgx9-wf79/GHSA-v664-qgx9-wf79.json
+37
View File
@@ -0,0 +1,37 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v664-qgx9-wf79",
"modified": "2025-01-29T15:31:35Z",
"published": "2025-01-29T15:31:35Z",
"aliases": [
"CVE-2024-57436"
],
"details": "RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57436"
},
{
"type": "WEB",
"url": "https://github.com/peccc/restful_vul/blob/main/ruoyi_elevation_of_privileges/ruoyi_elevation_of_privileges.md"
},
{
"type": "WEB",
"url": "https://github.com/yangzongzhuan/RuoYi"
},
{
"type": "WEB",
"url": "https://ruoyi.vip"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-29T15:15:17Z"
}
}
advisories/unreviewed/2025/01/GHSA-wq97-58c8-w5g5/GHSA-wq97-58c8-w5g5.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wq97-58c8-w5g5",
"modified": "2025-01-29T00:31:54Z",
"modified": "2025-01-29T15:31:34Z",
"published": "2025-01-29T00:31:54Z",
"aliases": [
"CVE-2024-48310"
],
"details": "AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys to access the backend API or other sensitive information.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-798"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-28T23:15:07Z"
advisories/unreviewed/2025/01/GHSA-x26x-c8x5-v2rm/GHSA-x26x-c8x5-v2rm.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x26x-c8x5-v2rm",
"modified": "2025-01-29T12:31:45Z",
"modified": "2025-01-29T15:31:34Z",
"published": "2025-01-29T12:31:45Z",
"aliases": [
"CVE-2025-0762"
],
"details": "Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
@@ -27,7 +32,7 @@
"cwe_ids": [
"CWE-416"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-29T11:15:09Z"
advisories/unreviewed/2025/01/GHSA-xf79-8g8m-ch82/GHSA-xf79-8g8m-ch82.json
+41
View File
@@ -0,0 +1,41 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xf79-8g8m-ch82",
"modified": "2025-01-29T15:31:35Z",
"published": "2025-01-29T15:31:35Z",
"aliases": [
"CVE-2024-57437"
],
"details": "RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57437"
},
{
"type": "WEB",
"url": "https://gitee.com/y_project/RuoYi"
},
{
"type": "WEB",
"url": "https://github.com/peccc/restful_vul/blob/main/ruoyi_sqli_orderby/ruoyi_sqli_orderby.md"
},
{
"type": "WEB",
"url": "https://github.com/yangzongzhuan/RuoYi"
},
{
"type": "WEB",
"url": "https://ruoyi.vip"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-29T15:15:17Z"
}
}