netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3p9v-xp6w-wcmc
GHSA-489x-ccjw-q7c4
GHSA-62g2-8p9f-ghjp
GHSA-vg4f-8v9q-5c3x
This commit is contained in:
advisory-database[bot]
2024-04-23 17:27:32 +00:00
parent b6a0f4a316
commit b542c79717
4 changed files with 119 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-3p9v-xp6w-wcmc/GHSA-3p9v-xp6w-wcmc.json → advisories/github-reviewed/2022/05/GHSA-3p9v-xp6w-wcmc/GHSA-3p9v-xp6w-wcmc.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3p9v-xp6w-wcmc",
"modified": "2022-05-14T01:57:27Z",
"modified": "2024-04-23T17:26:49Z",
"published": "2022-05-14T01:57:27Z",
"aliases": [
"CVE-2018-17102"
],
"summary": "QuickAppsCMS Cross-Site Request Forgery (CSRF) ",
"details": "An issue was discovered in QuickAppsCMS (aka QACMS) through 2.0.0-beta2. A CSRF vulnerability can change the administrator password via the user/me URI.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "quickapps/cms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.0.0-beta2"
}
]
}
]
}
],
"references": [
{
@@ -28,6 +47,10 @@
{
"type": "WEB",
"url": "https://github.com/quickapps/cms/issues/199"
},
{
"type": "PACKAGE",
"url": "https://github.com/quickapps/cms"
}
],
"database_specific": {
@@ -35,8 +58,8 @@
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T17:26:49Z",
"nvd_published_at": "2018-09-16T21:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-489x-ccjw-q7c4/GHSA-489x-ccjw-q7c4.json → advisories/github-reviewed/2022/05/GHSA-489x-ccjw-q7c4/GHSA-489x-ccjw-q7c4.json
+46 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-489x-ccjw-q7c4",
"modified": "2022-05-13T01:49:53Z",
"modified": "2024-04-23T17:25:44Z",
"published": "2022-05-13T01:49:53Z",
"aliases": [
"CVE-2018-14020"
],
"summary": "Paymorrow Improper Input Validation vulnerability",
"details": "An issue was discovered in the Paymorrow module 1.0.0 before 1.0.2 and 2.0.0 before 2.0.1 for OXID eShop. An attacker can bypass delivery-address change detection if the payment module doesn't use eShop's checkout procedure properly. To do so, the attacker must change the delivery address to one that is not verified by the Paymorrow module.",
"severity": [
{
@@ -14,7 +15,44 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "oxid-esales/paymorrow-module"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.0.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "oxid-esales/paymorrow-module"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.1"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +63,10 @@
"type": "WEB",
"url": "https://bugs.oxid-esales.com/view.php?id=6801"
},
{
"type": "PACKAGE",
"url": "https://github.com/OXID-eSales/paymorrow-module"
},
{
"type": "WEB",
"url": "https://oxidforge.org/en/security-bulletin-2018-003.html"
@@ -35,8 +77,8 @@
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T17:25:44Z",
"nvd_published_at": "2018-08-20T22:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-62g2-8p9f-ghjp/GHSA-62g2-8p9f-ghjp.json → advisories/github-reviewed/2022/05/GHSA-62g2-8p9f-ghjp/GHSA-62g2-8p9f-ghjp.json
+18 -5
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-62g2-8p9f-ghjp",
"modified": "2022-05-14T03:29:59Z",
"modified": "2024-04-23T17:26:55Z",
"published": "2022-05-14T03:29:59Z",
"aliases": [
"CVE-2018-9108"
],
"details": "CSRF in /admin/user/manage/add in QuickAppsCMS 2.0.0-beta2 allows an unauthorized remote attacker to create an account with admin privileges.",
"summary": "QuickAppsCMS Cross-Site Request Forgery (CSRF) ",
"details": "CSRF in `/admin/user/manage/add` in QuickAppsCMS 2.0.0-beta2 allows an unauthorized remote attacker to create an account with admin privileges.",
"severity": [
{
"type": "CVSS_V3",
@@ -14,7 +15,15 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "quickapps/cms"
},
"versions": [
"2.0.0-beta2"
]
}
],
"references": [
{
@@ -24,6 +33,10 @@
{
"type": "WEB",
"url": "https://github.com/quickapps/cms/issues/187"
},
{
"type": "PACKAGE",
"url": "https://github.com/quickapps/cms"
}
],
"database_specific": {
@@ -31,8 +44,8 @@
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T17:26:55Z",
"nvd_published_at": "2018-03-28T04:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-vg4f-8v9q-5c3x/GHSA-vg4f-8v9q-5c3x.json → advisories/github-reviewed/2022/05/GHSA-vg4f-8v9q-5c3x/GHSA-vg4f-8v9q-5c3x.json
+28 -5
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vg4f-8v9q-5c3x",
"modified": "2022-05-13T01:48:34Z",
"modified": "2024-04-23T17:25:35Z",
"published": "2022-05-13T01:48:33Z",
"aliases": [
"CVE-2018-1000165"
],
"details": "LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later.",
"summary": "LightSAML Incorrect Access Control vulnerability",
"details": "LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in `src/LightSaml/Model/XmlDSig/` that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later.",
"severity": [
{
"type": "CVSS_V3",
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "lightsaml/lightsaml"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.5"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/lightSAML/lightSAML/commit/47cef07bb09779df15620799f3763d1b8d32307a"
},
{
"type": "PACKAGE",
"url": "https://github.com/lightSAML/lightSAML"
},
{
"type": "WEB",
"url": "https://github.com/lightSAML/lightSAML/releases/tag/1.3.5"
@@ -35,8 +58,8 @@
"CWE-732"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T17:25:35Z",
"nvd_published_at": "2018-04-18T19:29:00Z"
}
}