Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-11-28 05:10:33 +00:00
parent 79c74fa91e
commit b6463d445e
969 changed files with 1876 additions and 5628 deletions
@@ -8,9 +8,7 @@
  ],
  "summary": "Mailman Cross-site scripting (XSS) vulnerability ",
  "details": "Cross-site scripting (XSS) vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the (1) email or (2) language parameters.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-f6p5-76fp-m248",
  "modified": "2022-04-28T21:09:54Z",
  "published": "2022-04-28T21:09:54Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "URL Rewrite vulnerability in multiple zendframework components",
  "details": "zend-diactoros (and, by extension, Expressive), zend-http (and, by extension, Zend Framework MVC projects), and zend-feed (specifically, its PubSubHubbub sub-component) each contain a potential URL rewrite exploit. In each case, marshaling a request URI includes logic that introspects HTTP request headers that are specific to a given server-side URL rewrite mechanism.\n\nWhen these headers are present on systems not running the specific URL rewriting mechanism, the logic would still trigger, allowing a malicious client or proxy to emulate the headers to request arbitrary content.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -85,9 +81,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-28T21:09:54Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-m98g-63qj-fp8j",
  "modified": "2022-04-28T21:01:28Z",
  "published": "2022-04-28T21:01:28Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Reflected XSS on clients-registrations endpoint",
  "details": "A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. When a malicious request is sent to the client registration endpoint, the error message is not properly escaped, allowing an attacker to execute malicious scripts into the user's browser.\n\n### Acknowledgement\n\nKeycloak would like to thank Quentin TEXIER (Pentester at Opencyber) for reporting this issue.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-mwm4-5qwr-g9pf",
  "modified": "2022-04-28T21:00:31Z",
  "published": "2022-04-28T21:00:31Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Keycloak is vulnerable to IDN homograph attack",
  "details": "A flaw was found in keycloak, where IDN homograph attacks are possible. This flaw allows a malicious user to register a name that already exists and then tricking an admin to grant extra privileges. The highest threat from this vulnerability is to integrity.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Jakarta Tomcat Directory Listing vulnerability",
  "details": "Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Jakarta Tomcat Denial of Service vulnerability",
  "details": "Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Integer Overflow or Wraparound in Apache Tomcat",
  "details": "Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat",
  "details": "Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain \"Tomcat internals\" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Missing XML Validation in Apache Tomcat",
  "details": "Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Improper Input Validation in Apache Tomcat",
  "details": "java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Denial of service in Apache Tomcat",
  "details": "java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a \"Content-Length: 0\" AJP request to trigger a hang in request processing.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Apache Tomcat Denial of Service vulnerability",
  "details": "Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-87pf-7x99-5xc4",
  "modified": "2024-05-23T19:28:06Z",
  "published": "2024-05-23T19:27:33Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Silverstripe Hostname, IP and Protocol Spoofing through HTTP Headers",
  "details": "In it's default configuration, SilverStripe trusts all originating IPs to include HTTP headers for Hostname, IP and Protocol. This enables reverse proxies to forward requests while still retaining the original request information. Trusted IPs can be limited via the SS_TRUSTED_PROXY_IPS constant. Even with this restriction in place, SilverStripe trusts a variety of HTTP headers due to different proxy notations (e.g. X-Forwarded-For vs. Client-IP). Unless a proxy explicitly unsets invalid HTTP headers from connecting clients, this can lead to spoofing requests being passed through trusted proxies.\n\nThe impact of spoofed headers can include Director::forceSSL() not being enforced, SS_HTTPRequest->getIP() returning a wrong IP (disabling any IP restrictions), and spoofed hostnames circumventing any hostname-specific restrictions enforced in SilverStripe Controllers.\n\nRegardless on running a reverse proxy in your hosting infrastructure, please follow the instructions on Secure Coding: Request hostname forgery in order to opt-in to these protections. If your website is not behind a reverse proxy, you might already be protected if using Apache with mod_env enabled, and you have the following line in your .htaccess file: SetEnv BlockUntrustedIPs true.",
  "severity": [
@@ -106,9 +104,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-23T19:27:33Z",
@@ -3,9 +3,7 @@
  "id": "GHSA-8v6m-7f5v-hhx6",
  "modified": "2024-05-23T19:37:11Z",
  "published": "2024-05-23T19:37:11Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Silverstripe Brute force bypass on default admin",
  "details": "Default Administrator accounts were not subject to the same brute force protection afforded to other Member accounts. Failed login counts were not logged for default admins resulting in unlimited attempts on the default admin username and password.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-97jm-g33h-f46g",
  "modified": "2024-05-23T19:50:27Z",
  "published": "2024-05-23T19:50:27Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "silverstripe/framework ReadOnly transformation for formfields exploitable",
  "details": "Form fields returning isReadonly() as true are vulnerable to reflected XSS injections. This includes ReadonlyField, LookupField, HTMLReadonlyField, as well as special purpose fields like TimeField_Readonly. Values submitted to through these form fields are not filtered out from the form session data, and might be shown to the user depending on the form behaviour. For example, form validation errors cause the form to re-render with previously submitted values by default.\n\nSilverStripe forms automatically load values from request data (GET and POST), which enables malicious use of URLs if your form uses these fields and doesn't overwrite data on form construction.\n\nReadonly and disabled form fields are already filtered out in Form->saveInto(), so maliciously submitted data on these fields doesn't make it into the database unless you are accessing form values directly in your saving logic.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-g4hp-pfvf-vm5w",
  "modified": "2024-05-23T17:23:55Z",
  "published": "2024-05-23T17:23:55Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "SilverStripe Vulnerability on 'isDev', 'isTest' and 'flush' $_GET validation",
  "details": "When a secure token parameter is provided to a SilverStripe site (such as isDev or flush) an empty token parameter can be provided in order to bypass normal authentication parameters.\n\nFor instance, http://www.mysite.com/?isDev=1&isDevtoken will force a site to dev mode. Alternatively, \"flush\" could also be used in succession to cause excessive load on a victim site and risk denial of service.\n\nThe fix in this case is to ensure that empty tokens fail the validation check.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-j982-5jv7-v43r",
  "modified": "2024-05-23T18:07:48Z",
  "published": "2024-05-23T18:07:48Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Silverstripe Form field validation message XSS vulnerability",
  "details": "A high level XSS risk has been identified in the encoding of validation messages in certain FormField classes.\n\nCertain fields such as the NumericField and DropdownField have been identified, but any form field which presents any invalid content as a part of its validation response will be at risk.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-m8v7-x398-pxrf",
  "modified": "2024-05-23T19:33:34Z",
  "published": "2024-05-23T19:33:34Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Silverstripe XSS in CMS Edit Page",
  "details": "Due to a lack of parameter sanitisation a carefully crafted URL could be used to inject arbitrary HTML into the CMS Edit page.\n\nAn attacker could create a URL and share it with a site administrator to perform an attack.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-mpqj-f4v3-334h",
  "modified": "2024-05-23T19:46:36Z",
  "published": "2024-05-23T19:46:36Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter",
  "details": "A cross-site scripting vulnerability in VersionedRequestFilter has been found.\n\nIf an incoming user request should not be able to access the requested stage, an error message is created for display on the CMS login page that they are redirected to. In this error message, the URL of the requested page is interpolated into the error message without being escaped; hence, arbitrary HTML can be injected into the CMS login page.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-qp29-wcc2-vmpc",
  "modified": "2024-05-23T18:14:45Z",
  "published": "2024-05-23T18:14:45Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Silverstripe HtmlEditor embed url sanitisation",
  "details": "\"Add from URL\" doesn't clearly sanitise URL server side\n\nHtmlEditorField_Toolbar has an action HtmlEditorField_Toolbar#viewfile, which gets called by the CMS when adding a media \"from a URL\" (i.e. via oembed).\n\nThis action gets the URL to add in the GET parameter FileURL. However it doesn't do any URL sanitising server side. The current logic will pass this through to Oembed, which will probably reject most dangerous URLs, but it's possible future changes would break this.",
  "severity": [
@@ -50,9 +48,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-23T18:14:45Z",
--- a/Show More
+++ b/Show More