netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-4qhc-v8r6-8vwm
GHSA-5cvx-cwpx-9rjh
GHSA-cwh2-q44x-5w3c
GHSA-fm5h-58g2-4m3f
GHSA-jr83-8x65-xcr5
GHSA-4qhc-v8r6-8vwm
GHSA-jr83-8x65-xcr5
This commit is contained in:
advisory-database[bot]
2023-11-10 00:43:51 +00:00
parent 35a70140d0
commit b3cbce5141
7 changed files with 273 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2023/11/GHSA-4qhc-v8r6-8vwm/GHSA-4qhc-v8r6-8vwm.json
+99
View File
@@ -0,0 +1,99 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4qhc-v8r6-8vwm",
"modified": "2023-11-10T00:43:02Z",
"published": "2023-11-09T21:30:39Z",
"aliases": [
"CVE-2023-5954"
],
"summary": "HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability",
"details": "HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/vault"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13.10"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/vault"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.14.0"
},
{
"fixed": "1.14.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/vault"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.15.0"
},
{
"fixed": "1.15.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5954"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926"
},
{
"type": "PACKAGE",
"url": "https://github.com/hashicorp/vault"
}
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2023-11-10T00:43:02Z",
"nvd_published_at": "2023-11-09T21:15:25Z"
}
}
advisories/unreviewed/2023/11/GHSA-5cvx-cwpx-9rjh/GHSA-5cvx-cwpx-9rjh.json → advisories/github-reviewed/2023/11/GHSA-5cvx-cwpx-9rjh/GHSA-5cvx-cwpx-9rjh.json
+31 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5cvx-cwpx-9rjh",
"modified": "2023-11-09T21:30:39Z",
"modified": "2023-11-10T00:42:36Z",
"published": "2023-11-09T21:30:39Z",
"aliases": [
"CVE-2023-5550"
],
"summary": "Moodle Code Injection vulnerability",
"details": "In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.",
"severity": [
{
@@ -14,17 +15,43 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0-rc2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5550"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/77766f9c8af8fc8d861d7ac09ce4e1f6e72faca7"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243452"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=451591"
@@ -39,8 +66,8 @@
"CWE-94"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2023-11-10T00:42:36Z",
"nvd_published_at": "2023-11-09T20:15:10Z"
}
}
advisories/unreviewed/2023/11/GHSA-cwh2-q44x-5w3c/GHSA-cwh2-q44x-5w3c.json → advisories/github-reviewed/2023/11/GHSA-cwh2-q44x-5w3c/GHSA-cwh2-q44x-5w3c.json
+31 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cwh2-q44x-5w3c",
"modified": "2023-11-09T21:30:39Z",
"modified": "2023-11-10T00:42:08Z",
"published": "2023-11-09T21:30:39Z",
"aliases": [
"CVE-2023-5548"
],
"summary": "Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability",
"details": "Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.",
"severity": [
{
@@ -14,17 +15,43 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0-rc2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5548"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/7679452caff6faa33f00d3f0589c5190bc01a933"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243449"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=451589"
@@ -39,8 +66,8 @@
"CWE-349"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2023-11-10T00:42:08Z",
"nvd_published_at": "2023-11-09T20:15:10Z"
}
}
advisories/unreviewed/2023/11/GHSA-fm5h-58g2-4m3f/GHSA-fm5h-58g2-4m3f.json → advisories/github-reviewed/2023/11/GHSA-fm5h-58g2-4m3f/GHSA-fm5h-58g2-4m3f.json
+31 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fm5h-58g2-4m3f",
"modified": "2023-11-09T21:30:39Z",
"modified": "2023-11-10T00:42:19Z",
"published": "2023-11-09T21:30:39Z",
"aliases": [
"CVE-2023-5549"
],
"summary": "Moodle Improper Access Control vulnerability",
"details": "Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.",
"severity": [
{
@@ -14,17 +15,43 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0-rc2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5549"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/5a765e124c950b1e4313c9bf96ea2dd194f65c75"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243451"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=451590"
@@ -39,8 +66,8 @@
"CWE-284"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2023-11-10T00:42:19Z",
"nvd_published_at": "2023-11-09T20:15:10Z"
}
}
advisories/github-reviewed/2023/11/GHSA-jr83-8x65-xcr5/GHSA-jr83-8x65-xcr5.json
+81
View File
@@ -0,0 +1,81 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jr83-8x65-xcr5",
"modified": "2023-11-10T00:42:49Z",
"published": "2023-11-09T21:30:39Z",
"aliases": [
"CVE-2023-5551"
],
"summary": "Moodle Exposure of Sensitive Information to an Unauthorized Actor vulnerability",
"details": "Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.3.0-rc2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5551"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/2bb6c551cf2e7be29857db35388911b8179394b0"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/6de45d2c9f7dd7b24210ab0310c296366a82986a"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/b91feb0b2328cdda2561d68b8dfe2a129190bc85"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243453"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=451592"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79310"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "LOW",
"github_reviewed": true,
"github_reviewed_at": "2023-11-10T00:42:49Z",
"nvd_published_at": "2023-11-09T20:15:11Z"
}
}
advisories/unreviewed/2023/11/GHSA-4qhc-v8r6-8vwm/GHSA-4qhc-v8r6-8vwm.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4qhc-v8r6-8vwm",
"modified": "2023-11-09T21:30:39Z",
"published": "2023-11-09T21:30:39Z",
"aliases": [
"CVE-2023-5954"
],
"details": "HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5954"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2023-33-vault-requests-triggering-policy-checks-may-lead-to-unbounded-memory-consumption/59926"
}
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-09T21:15:25Z"
}
}
advisories/unreviewed/2023/11/GHSA-jr83-8x65-xcr5/GHSA-jr83-8x65-xcr5.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jr83-8x65-xcr5",
"modified": "2023-11-09T21:30:39Z",
"published": "2023-11-09T21:30:39Z",
"aliases": [
"CVE-2023-5551"
],
"details": "Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5551"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243453"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=451592"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-79310"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-09T20:15:11Z"
}
}