netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-38g6-x6jv-jwff
GHSA-84jm-cpc5-c7g7
GHSA-hprr-4vfq-fcxw
GHSA-qfhw-fv3g-v836
GHSA-v83x-78q3-gr2j
GHSA-x9rq-fjp5-qgm9
GHSA-84jm-cpc5-c7g7
This commit is contained in:
advisory-database[bot]
2024-04-22 22:52:19 +00:00
parent a55c7b2f43
commit b614862042
7 changed files with 227 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-38g6-x6jv-jwff/GHSA-38g6-x6jv-jwff.json → advisories/github-reviewed/2022/05/GHSA-38g6-x6jv-jwff/GHSA-38g6-x6jv-jwff.json
+24 -5
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-38g6-x6jv-jwff",
"modified": "2022-05-24T22:01:29Z",
"modified": "2024-04-22T22:50:56Z",
"published": "2022-05-24T22:01:29Z",
"aliases": [
"CVE-2021-29002"
],
"details": "A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the \"form.widgets.site_title\" parameter.",
"summary": "Plone XSS Vulnerability",
"details": "A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the `form.widgets.site_title` parameter.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "plone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.2.3"
}
]
}
]
}
],
"references": [
{
@@ -32,8 +51,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:50:56Z",
"nvd_published_at": "2021-03-24T15:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-84jm-cpc5-c7g7/GHSA-84jm-cpc5-c7g7.json
+90
View File
@@ -0,0 +1,90 @@
{
"schema_version": "1.4.0",
"id": "GHSA-84jm-cpc5-c7g7",
"modified": "2024-04-22T22:51:31Z",
"published": "2022-05-17T03:00:45Z",
"aliases": [
"CVE-2016-7147"
],
"summary": "Plone XSS in Zope ZMI",
"details": "Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the `obj_ids:tokens` parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7140.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "plone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0"
},
{
"fixed": "4.3.12"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 4.3.11"
}
},
{
"package": {
"ecosystem": "PyPI",
"name": "plone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.0"
},
{
"fixed": "5.0.7"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 5.0.6"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7147"
},
{
"type": "WEB",
"url": "https://plone.org/security/hotfix/20170117"
},
{
"type": "WEB",
"url": "https://plone.org/security/hotfix/20170117/non-persistent-xss-in-zope2"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20170214002551/http://www.securityfocus.com/bid/96117"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:51:31Z",
"nvd_published_at": "2017-02-04T05:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-hprr-4vfq-fcxw/GHSA-hprr-4vfq-fcxw.json → advisories/github-reviewed/2022/05/GHSA-hprr-4vfq-fcxw/GHSA-hprr-4vfq-fcxw.json
+28 -5
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hprr-4vfq-fcxw",
"modified": "2022-05-24T19:02:50Z",
"modified": "2024-04-22T22:51:01Z",
"published": "2022-05-24T19:02:50Z",
"aliases": [
"CVE-2021-3313"
],
"summary": "Plone XSS in User Fullname Property and File Upload",
"details": "Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "plone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "< 5.2.4"
}
}
],
"references": [
{
@@ -24,7 +43,11 @@
},
{
"type": "WEB",
"url": "https://plone.org/security/hotfix/20210518"
"url": "https://plone.org/security/hotfix/20210518/stored-xss-from-file-upload-svg-html"
},
{
"type": "WEB",
"url": "https://plone.org/security/hotfix/20210518/stored-xss-from-user-fullname"
},
{
"type": "WEB",
@@ -40,8 +63,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:51:01Z",
"nvd_published_at": "2021-05-20T16:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-qfhw-fv3g-v836/GHSA-qfhw-fv3g-v836.json → advisories/github-reviewed/2022/05/GHSA-qfhw-fv3g-v836/GHSA-qfhw-fv3g-v836.json
+23 -4
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qfhw-fv3g-v836",
"modified": "2022-05-24T19:06:41Z",
"modified": "2024-04-22T22:51:04Z",
"published": "2022-05-24T19:06:41Z",
"aliases": [
"CVE-2021-35959"
],
"summary": "Plone has stored XSS in folder contents",
"details": "In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "plone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.0"
},
{
"last_affected": "5.2.4"
}
]
}
]
}
],
"references": [
{
@@ -32,8 +51,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:51:04Z",
"nvd_published_at": "2021-06-30T01:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-v83x-78q3-gr2j/GHSA-v83x-78q3-gr2j.json → advisories/github-reviewed/2022/05/GHSA-v83x-78q3-gr2j/GHSA-v83x-78q3-gr2j.json
+33 -7
View File
@@ -1,17 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v83x-78q3-gr2j",
"modified": "2022-05-24T19:14:08Z",
"modified": "2024-04-22T22:50:22Z",
"published": "2022-05-24T19:14:08Z",
"aliases": [
"CVE-2021-40347"
],
"details": "An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.",
"summary": "GNU Mailman Postorius Access Control Issues",
"details": "An issue was discovered in `views/list.py` in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "postorius"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.5"
}
]
}
]
}
],
"references": [
{
@@ -22,6 +44,10 @@
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993746"
},
{
"type": "PACKAGE",
"url": "https://gitlab.com/mailman/postorius"
},
{
"type": "WEB",
"url": "https://gitlab.com/mailman/postorius/-/commit/3d880c56b58bc26b32eac0799407d74b64b7474b"
@@ -45,11 +71,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:50:22Z",
"nvd_published_at": "2021-09-10T19:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-x9rq-fjp5-qgm9/GHSA-x9rq-fjp5-qgm9.json → advisories/github-reviewed/2022/05/GHSA-x9rq-fjp5-qgm9/GHSA-x9rq-fjp5-qgm9.json
+29 -11
View File
@@ -1,17 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x9rq-fjp5-qgm9",
"modified": "2022-05-24T19:02:06Z",
"modified": "2024-04-22T22:50:31Z",
"published": "2022-05-24T19:02:06Z",
"aliases": [
"CVE-2021-32560"
],
"details": "The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not *.log files.",
"summary": "OctoPrint Incorrect Access Control",
"details": "The Logging subsystem in OctoPrint before 1.6.0 has incorrect access control because it attempts to manage files that are not `*.log` files.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "octoprint"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.0"
}
]
}
]
}
],
"references": [
{
@@ -26,10 +48,6 @@
"type": "WEB",
"url": "https://octoprint.org/blog/2021/04/27/new-release-1.6.0"
},
{
"type": "WEB",
"url": "https://www.brzozowski.io"
},
{
"type": "WEB",
"url": "https://www.brzozowski.io/web-applications/2021/05/11/the-insecure-story-of-octoprint.html"
@@ -37,11 +55,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-22T22:50:31Z",
"nvd_published_at": "2021-05-11T14:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-84jm-cpc5-c7g7/GHSA-84jm-cpc5-c7g7.json
-50
View File
@@ -1,50 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-84jm-cpc5-c7g7",
"modified": "2022-05-17T03:00:45Z",
"published": "2022-05-17T03:00:45Z",
"aliases": [
"CVE-2016-7147"
],
"details": "Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the obj_ids:tokens parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7140.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7147"
},
{
"type": "WEB",
"url": "https://plone.org/security/hotfix/20170117"
},
{
"type": "WEB",
"url": "https://plone.org/security/hotfix/20170117/non-persistent-xss-in-zope2"
},
{
"type": "WEB",
"url": "https://www.curesec.com/blog/article/blog/Plone-XSS-186.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96117"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-04T05:59:00Z"
}
}