netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-7wxf-r2qv-9xwr
GHSA-jq57-3w7p-vwvv
GHSA-pcfx-g2j2-f6f6
GHSA-2wqw-hr4f-xrhh
GHSA-3p3p-cgj7-vgw3
GHSA-5frw-4rwq-xhcr
GHSA-86fc-f9gr-v533
This commit is contained in:
advisory-database[bot]
2024-03-21 18:26:48 +00:00
parent 2e0c33aa82
commit b246224104
7 changed files with 83 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/02/GHSA-7wxf-r2qv-9xwr/GHSA-7wxf-r2qv-9xwr.json
+10 -3
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7wxf-r2qv-9xwr",
"modified": "2024-02-29T22:14:47Z",
"modified": "2024-03-21T18:25:19Z",
"published": "2024-02-29T22:14:47Z",
"aliases": [
"CVE-2024-27291"
@@ -9,7 +9,10 @@
"summary": "Docassemble open redirect",
"details": "### Impact\nIt is possible to create a URL that acts as an open redirect.\n\n### Patches\nThe vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched.\n\n### Workarounds\nIf upgrading is not possible, manually apply the changes of [4801ac7](https://github.com/jhpyle/docassemble/commit/4801ac7ff7c90df00ac09523077930cdb6dea2aa) and restart the server (e.g., by pressing Save on the Configuration screen).\n\n### Credit\n\nThe vulnerability was discovered by Riyush Ghimire (@richighimi).\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [docassemble](https://github.com/jhpyle/docassemble/issues)\n* Join the [Slack channel](https://join.slack.com/t/docassemble/shared_invite/zt-2cspzjo9j-YyE7SrLmi5muAvnPv~Bz~A)\n* Email us at jhpyle@gmail.com",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
@@ -37,6 +40,10 @@
"type": "WEB",
"url": "https://github.com/jhpyle/docassemble/security/advisories/GHSA-7wxf-r2qv-9xwr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27291"
},
{
"type": "WEB",
"url": "https://github.com/jhpyle/docassemble/commit/4801ac7ff7c90df00ac09523077930cdb6dea2aa"
@@ -53,6 +60,6 @@
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-02-29T22:14:47Z",
"nvd_published_at": null
"nvd_published_at": "2024-03-21T02:52:19Z"
}
}
advisories/github-reviewed/2024/02/GHSA-jq57-3w7p-vwvv/GHSA-jq57-3w7p-vwvv.json
+11 -4
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jq57-3w7p-vwvv",
"modified": "2024-02-29T22:14:46Z",
"modified": "2024-03-21T18:25:22Z",
"published": "2024-02-29T22:14:46Z",
"aliases": [
"CVE-2024-27292"
@@ -9,7 +9,10 @@
"summary": "Docassemble unauthorized access through URL manipulation",
"details": "### Impact\nThe vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96.\n\n### Patches\nThe vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched.\n\n### Workarounds\nIf upgrading is not possible, manually apply the changes of [97f77dc](https://github.com/jhpyle/docassemble/commit/97f77dc486a26a22ba804765bfd7058aabd600c9) and restart the server.\n\n### Credit\n\nThe vulnerability was discovered by Riyush Ghimire (@richighimi).\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [docassemble](https://github.com/jhpyle/docassemble/issues)\n* Join the [Slack channel](https://join.slack.com/t/docassemble/shared_invite/zt-2cspzjo9j-YyE7SrLmi5muAvnPv~Bz~A)\n* Email us at jhpyle@gmail.com",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
@@ -56,6 +59,10 @@
"type": "WEB",
"url": "https://github.com/jhpyle/docassemble/security/advisories/GHSA-jq57-3w7p-vwvv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27292"
},
{
"type": "WEB",
"url": "https://github.com/jhpyle/docassemble/commit/97f77dc486a26a22ba804765bfd7058aabd600c9"
@@ -67,11 +74,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-706"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-02-29T22:14:46Z",
"nvd_published_at": null
"nvd_published_at": "2024-03-21T02:52:19Z"
}
}
advisories/github-reviewed/2024/02/GHSA-pcfx-g2j2-f6f6/GHSA-pcfx-g2j2-f6f6.json
+10 -3
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pcfx-g2j2-f6f6",
"modified": "2024-02-29T22:14:49Z",
"modified": "2024-03-21T18:25:16Z",
"published": "2024-02-29T22:14:49Z",
"aliases": [
"CVE-2024-27290"
@@ -9,7 +9,10 @@
"summary": "Docassemble HTML and javascript injection",
"details": "### Impact\nA user could type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The HTML can also contain `<script>` tags allowing JavaScript to execute on the page.\n\n### Patches\nThe vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched.\n\n### Workarounds\nIf upgrading is not possible, manually apply the changes of [4801ac7](https://github.com/jhpyle/docassemble/commit/4801ac7ff7c90df00ac09523077930cdb6dea2aa) and restart the server (e.g., by pressing Save on the Configuration screen).\n\n### Credit\n\nThe vulnerability was discovered by Riyush Ghimire (@richighimi).\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [docassemble](https://github.com/jhpyle/docassemble/issues)\n* Join the [Slack channel](https://join.slack.com/t/docassemble/shared_invite/zt-2cspzjo9j-YyE7SrLmi5muAvnPv~Bz~A)\n* Email us at jhpyle@gmail.com",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
@@ -37,6 +40,10 @@
"type": "WEB",
"url": "https://github.com/jhpyle/docassemble/security/advisories/GHSA-pcfx-g2j2-f6f6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27290"
},
{
"type": "WEB",
"url": "https://github.com/jhpyle/docassemble/commit/4801ac7ff7c90df00ac09523077930cdb6dea2aa"
@@ -53,6 +60,6 @@
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-02-29T22:14:49Z",
"nvd_published_at": null
"nvd_published_at": "2024-03-21T02:52:19Z"
}
}
advisories/github-reviewed/2024/03/GHSA-2wqw-hr4f-xrhh/GHSA-2wqw-hr4f-xrhh.json
+11 -4
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2wqw-hr4f-xrhh",
"modified": "2024-03-06T17:02:34Z",
"modified": "2024-03-21T18:25:32Z",
"published": "2024-03-06T17:02:34Z",
"aliases": [
"CVE-2024-27926"
@@ -9,7 +9,10 @@
"summary": "RSSHub Cross-site Scripting vulnerability caused by internal media proxy",
"details": "## Impact\nWhen the specially crafted image is supplied to the internal media proxy, it proxies the image without handling XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code.\n\nUsers who access the deliberately constructed URL are affected.\n\n## Patches\n\nThis vulnerability was fixed in version https://github.com/DIYgod/RSSHub/commit/4d3e5d79c1c17837e931b4cd253d2013b487aa87. Please upgrade to this or a later version.\n\n## Workarounds\n\nNo.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
@@ -37,6 +40,10 @@
"type": "WEB",
"url": "https://github.com/DIYgod/RSSHub/security/advisories/GHSA-2wqw-hr4f-xrhh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27926"
},
{
"type": "WEB",
"url": "https://github.com/DIYgod/RSSHub/commit/4d3e5d79c1c17837e931b4cd253d2013b487aa87"
@@ -48,11 +55,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-03-06T17:02:34Z",
"nvd_published_at": null
"nvd_published_at": "2024-03-21T02:52:21Z"
}
}
advisories/github-reviewed/2024/03/GHSA-3p3p-cgj7-vgw3/GHSA-3p3p-cgj7-vgw3.json
+23 -3
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3p3p-cgj7-vgw3",
"modified": "2024-03-06T17:03:11Z",
"modified": "2024-03-21T18:25:36Z",
"published": "2024-03-06T17:03:11Z",
"aliases": [
"CVE-2024-27927"
@@ -40,6 +40,10 @@
"type": "WEB",
"url": "https://github.com/DIYgod/RSSHub/security/advisories/GHSA-3p3p-cgj7-vgw3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27927"
},
{
"type": "WEB",
"url": "https://github.com/DIYgod/RSSHub/commit/a42947231104a9ec3436fc52cedb31740c9a7069"
@@ -47,15 +51,31 @@
{
"type": "PACKAGE",
"url": "https://github.com/DIYgod/RSSHub"
},
{
"type": "WEB",
"url": "https://github.com/DIYgod/RSSHub/blob/172f6cfd2b69ea6affdbdedf61e6dde1671f3796/lib/routes/m4/index.js#L10-L14"
},
{
"type": "WEB",
"url": "https://github.com/DIYgod/RSSHub/blob/172f6cfd2b69ea6affdbdedf61e6dde1671f3796/lib/routes/zjol/paper.js#L7-L13"
},
{
"type": "WEB",
"url": "https://github.com/DIYgod/RSSHub/blob/5928c5db2472e101c2f5c3bafed77a2f72edd40a/lib/routes/mastodon/acct.js#L4-L7"
},
{
"type": "WEB",
"url": "https://github.com/DIYgod/RSSHub/blob/5928c5db2472e101c2f5c3bafed77a2f72edd40a/lib/routes/mastodon/utils.js#L85-L105"
}
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-03-06T17:03:11Z",
"nvd_published_at": null
"nvd_published_at": "2024-03-21T02:52:21Z"
}
}
advisories/github-reviewed/2024/03/GHSA-5frw-4rwq-xhcr/GHSA-5frw-4rwq-xhcr.json
+11 -3
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5frw-4rwq-xhcr",
"modified": "2024-03-06T17:03:36Z",
"modified": "2024-03-21T18:25:42Z",
"published": "2024-03-06T17:03:36Z",
"aliases": [
"CVE-2024-27932"
@@ -40,6 +40,10 @@
"type": "WEB",
"url": "https://github.com/denoland/deno/security/advisories/GHSA-5frw-4rwq-xhcr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27932"
},
{
"type": "WEB",
"url": "https://github.com/denoland/deno/commit/de23e3b60b066481cc390f459497d5bef42a899b"
@@ -47,15 +51,19 @@
{
"type": "PACKAGE",
"url": "https://github.com/denoland/deno"
},
{
"type": "WEB",
"url": "https://github.com/denoland/deno/blob/3f4639c330a31741b0efda2f93ebbb833f4f95bc/cli/auth_tokens.rs#L89"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-03-06T17:03:36Z",
"nvd_published_at": null
"nvd_published_at": "2024-03-21T02:52:21Z"
}
}
advisories/github-reviewed/2024/03/GHSA-86fc-f9gr-v533/GHSA-86fc-f9gr-v533.json
+7 -3
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-86fc-f9gr-v533",
"modified": "2024-03-05T16:24:31Z",
"modified": "2024-03-21T18:25:29Z",
"published": "2024-03-05T16:24:31Z",
"aliases": [
"CVE-2024-27922"
@@ -40,6 +40,10 @@
"type": "WEB",
"url": "https://github.com/tomphttp/bare-server-node/security/advisories/GHSA-86fc-f9gr-v533"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27922"
},
{
"type": "PACKAGE",
"url": "https://github.com/tomphttp/bare-server-node"
@@ -47,11 +51,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-03-05T16:24:31Z",
"nvd_published_at": null
"nvd_published_at": "2024-03-21T02:52:21Z"
}
}