netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-08-22 18:32:54 +00:00
parent 5ce458d277
commit b530504411
90 changed files with 1363 additions and 238 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/04/GHSA-4f3f-7mf9-qrhc/GHSA-4f3f-7mf9-qrhc.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4f3f-7mf9-qrhc",
"modified": "2024-06-15T12:30:26Z",
"modified": "2024-08-22T18:31:18Z",
"published": "2022-04-29T01:25:46Z",
"aliases": [
"CVE-2003-0063"
],
"details": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
@@ -61,7 +64,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/03/GHSA-fpf2-cr84-mrv9/GHSA-fpf2-cr84-mrv9.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fpf2-cr84-mrv9",
"modified": "2024-03-22T15:31:07Z",
"modified": "2024-08-22T18:31:18Z",
"published": "2024-03-22T15:31:07Z",
"aliases": [
"CVE-2023-41099"
],
"details": "In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.(from a regular user to SYSTEM).",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-22T15:15:15Z"
advisories/unreviewed/2024/04/GHSA-8vjg-37gr-gvx7/GHSA-8vjg-37gr-gvx7.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8vjg-37gr-gvx7",
"modified": "2024-04-08T06:31:30Z",
"modified": "2024-08-22T18:31:18Z",
"published": "2024-04-08T06:31:30Z",
"aliases": [
"CVE-2024-27488"
],
"details": "Incorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain sensitive information. The application system enables the http API interface by default and uses the secret parameter method to authenticate the http restful api interface, but the secret is hardcoded by default.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-259"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-08T06:15:07Z"
advisories/unreviewed/2024/04/GHSA-hf5c-hjgx-rmrw/GHSA-hf5c-hjgx-rmrw.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hf5c-hjgx-rmrw",
"modified": "2024-04-16T18:31:35Z",
"modified": "2024-08-22T18:31:19Z",
"published": "2024-04-16T18:31:35Z",
"aliases": [
"CVE-2024-3858"
],
"details": "It was possible to mutate a JavaScript object so that the JIT could crash while tracing it. This vulnerability affects Firefox < 125.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-16T16:15:08Z"
advisories/unreviewed/2024/04/GHSA-rq49-j5jp-7mr4/GHSA-rq49-j5jp-7mr4.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rq49-j5jp-7mr4",
"modified": "2024-04-07T09:30:29Z",
"modified": "2024-08-22T18:31:18Z",
"published": "2024-04-07T09:30:29Z",
"aliases": [
"CVE-2024-30418"
],
"details": "Vulnerability of insufficient permission verification in the app management module.\nImpact: Successful exploitation of this vulnerability will affect availability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-280"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-07T09:15:08Z"
advisories/unreviewed/2024/05/GHSA-cv9w-4mcm-4cc2/GHSA-cv9w-4mcm-4cc2.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cv9w-4mcm-4cc2",
"modified": "2024-05-14T18:30:52Z",
"modified": "2024-08-22T18:31:19Z",
"published": "2024-05-14T18:30:52Z",
"aliases": [
"CVE-2024-3016"
],
"details": "NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5.4.0.0 – v5.6.0.20 allows an attacker to access a non-documented the system settings to change settings via local network with unauthenticated user.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
"CWE-912"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T15:39:46Z"
advisories/unreviewed/2024/05/GHSA-fmvf-fm6q-vpjg/GHSA-fmvf-fm6q-vpjg.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fmvf-fm6q-vpjg",
"modified": "2024-05-21T15:31:38Z",
"modified": "2024-08-22T18:31:19Z",
"published": "2024-05-21T15:31:38Z",
"aliases": [
"CVE-2024-35386"
],
"details": "An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_do_gc function in the mjs.c file.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T14:15:12Z"
advisories/unreviewed/2024/05/GHSA-vq2q-wrwm-2ggf/GHSA-vq2q-wrwm-2ggf.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vq2q-wrwm-2ggf",
"modified": "2024-05-14T18:30:49Z",
"modified": "2024-08-22T18:31:19Z",
"published": "2024-05-14T18:30:49Z",
"aliases": [
"CVE-2024-34226"
],
"details": "SQL injection vulnerability in /php-sqlite-vms/?page=manage_visitor&id=1 in SourceCodester Visitor Management System 1.0 allow attackers to execute arbitrary SQL commands via the id parameters.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T15:38:36Z"
advisories/unreviewed/2024/06/GHSA-gfx2-f362-7f24/GHSA-gfx2-f362-7f24.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gfx2-f362-7f24",
"modified": "2024-06-29T06:31:39Z",
"modified": "2024-08-22T18:31:19Z",
"published": "2024-06-29T06:31:39Z",
"aliases": [
"CVE-2022-27540"
],
"details": "A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-367"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-28T19:15:03Z"
advisories/unreviewed/2024/06/GHSA-qpvg-vp7c-mg9m/GHSA-qpvg-vp7c-mg9m.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qpvg-vp7c-mg9m",
"modified": "2024-06-06T21:30:38Z",
"modified": "2024-08-22T18:31:19Z",
"published": "2024-06-06T21:30:38Z",
"aliases": [
"CVE-2024-36795"
],
"details": "Insecure permissions in Netgear WNR614 JNR1010V2/N300-V1.1.0.54_1.0.1 allows attackers to access URLs and directories embedded within the firmware via unspecified vectors.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-06T21:15:48Z"
advisories/unreviewed/2024/07/GHSA-2x53-jv7f-c2x5/GHSA-2x53-jv7f-c2x5.json
+1
View File
@@ -28,6 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-287"
],
"severity": "HIGH",
advisories/unreviewed/2024/07/GHSA-99jj-f2xq-29qh/GHSA-99jj-f2xq-29qh.json
+2 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-99jj-f2xq-29qh",
"modified": "2024-07-18T09:30:51Z",
"modified": "2024-08-22T18:31:19Z",
"published": "2024-07-18T09:30:51Z",
"aliases": [
"CVE-2024-5554"
@@ -36,7 +36,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2024/07/GHSA-9f75-gjv3-f63r/GHSA-9f75-gjv3-f63r.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9f75-gjv3-f63r",
"modified": "2024-07-19T21:31:11Z",
"modified": "2024-08-22T18:31:19Z",
"published": "2024-07-19T21:31:11Z",
"aliases": [
"CVE-2024-41599"
],
"details": "Cross Site Scripting vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the file upload method",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-19T20:15:09Z"
advisories/unreviewed/2024/07/GHSA-9g8f-2366-pj88/GHSA-9g8f-2366-pj88.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9g8f-2366-pj88",
"modified": "2024-07-19T18:31:21Z",
"modified": "2024-08-22T18:31:20Z",
"published": "2024-07-19T18:31:21Z",
"aliases": [
"CVE-2024-41600"
],
"details": "Insecure Permissions vulnerability in lin-CMS Springboot v.0.2.1 and before allows a remote attacker to obtain sensitive information via the login method in the UserController.java component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-19T18:15:05Z"
advisories/unreviewed/2024/07/GHSA-g8mv-cj5h-rwjh/GHSA-g8mv-cj5h-rwjh.json
+2 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g8mv-cj5h-rwjh",
"modified": "2024-07-18T09:30:51Z",
"modified": "2024-08-22T18:31:19Z",
"published": "2024-07-18T09:30:51Z",
"aliases": [
"CVE-2024-5555"
@@ -36,7 +36,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2024/07/GHSA-v8wj-qf3f-5p7v/GHSA-v8wj-qf3f-5p7v.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v8wj-qf3f-5p7v",
"modified": "2024-07-19T09:32:06Z",
"modified": "2024-08-22T18:31:19Z",
"published": "2024-07-19T09:32:06Z",
"aliases": [
"CVE-2024-39457"
],
"details": "Cybozu Garoon 6.0.0 to 6.0.1 contains a cross-site scripting vulnerability in PDF preview. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user’s web browser.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-19T09:15:05Z"
advisories/unreviewed/2024/07/GHSA-vwv2-7pwm-39x4/GHSA-vwv2-7pwm-39x4.json
+1 -1
View File
@@ -28,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "CRITICAL",
"github_reviewed": false,
advisories/unreviewed/2024/07/GHSA-wx53-7r2h-f7w6/GHSA-wx53-7r2h-f7w6.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wx53-7r2h-f7w6",
"modified": "2024-07-18T00:31:19Z",
"modified": "2024-08-22T18:31:19Z",
"published": "2024-07-18T00:31:19Z",
"aliases": [
"CVE-2023-43971"
],
"details": "Cross Site Scripting vulnerability in ACG-faka v1.1.7 allows a remote attacker to execute arbitrary code via the encode parameter in Index.php.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-17T22:15:03Z"
advisories/unreviewed/2024/07/GHSA-x749-289q-pg9q/GHSA-x749-289q-pg9q.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x749-289q-pg9q",
"modified": "2024-07-18T12:30:52Z",
"modified": "2024-08-22T18:31:19Z",
"published": "2024-07-18T12:30:52Z",
"aliases": [
"CVE-2024-40725"
],
"details": "A partial fix for  CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. \"AddType\" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.\n\nUsers are recommended to upgrade to version 2.4.62, which fixes this issue.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
"CWE-668"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-18T10:15:02Z"
advisories/unreviewed/2024/08/GHSA-269x-4f35-gf3h/GHSA-269x-4f35-gf3h.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-269x-4f35-gf3h",
"modified": "2024-08-17T09:30:25Z",
"modified": "2024-08-22T18:31:20Z",
"published": "2024-08-17T09:30:25Z",
"aliases": [
"CVE-2024-42315"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix potential deadlock on __exfat_get_dentry_set\n\nWhen accessing a file with more entries than ES_MAX_ENTRY_NUM, the bh-array\nis allocated in __exfat_get_entry_set. The problem is that the bh-array is\nallocated with GFP_KERNEL. It does not make sense. In the following cases,\na deadlock for sbi->s_lock between the two processes may occur.\n\n CPU0 CPU1\n ---- ----\n kswapd\n balance_pgdat\n lock(fs_reclaim)\n exfat_iterate\n lock(&sbi->s_lock)\n exfat_readdir\n exfat_get_uniname_from_ext_entry\n exfat_get_dentry_set\n __exfat_get_dentry_set\n kmalloc_array\n ...\n lock(fs_reclaim)\n ...\n evict\n exfat_evict_inode\n lock(&sbi->s_lock)\n\nTo fix this, let's allocate bh-array with GFP_NOFS.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-667"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-17T09:15:11Z"

Some files were not shown because too many files have changed in this diff Show More