netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3rwj-v7jp-w542
GHSA-jh2j-7248-9p3c
GHSA-rp89-32rp-qpq2
GHSA-v47j-rw9h-6m47
This commit is contained in:
advisory-database[bot]
2024-04-24 20:20:29 +00:00
parent ed88ab7efa
commit b65989b07f
4 changed files with 95 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-3rwj-v7jp-w542/GHSA-3rwj-v7jp-w542.json → advisories/github-reviewed/2022/05/GHSA-3rwj-v7jp-w542/GHSA-3rwj-v7jp-w542.json
+17 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3rwj-v7jp-w542",
"modified": "2022-05-14T03:14:51Z",
"modified": "2024-04-24T20:18:26Z",
"published": "2022-05-14T03:14:51Z",
"aliases": [
"CVE-2018-11564"
],
"summary": "Pagekit Stored Cross-site Scripting",
"details": "Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to \"/storage/poc.svg\" that will point to http://localhost/pagekit/storage/poc.svg. When a user comes along to click that link, it will trigger a XSS attack.",
"severity": [
{
@@ -14,13 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "pagekit/pagekit"
},
"versions": [
"1.0.13"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11564"
},
{
"type": "PACKAGE",
"url": "https://github.com/pagekit/pagekit"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/148001/PageKit-CMS-1.0.13-Cross-Site-Scripting.html"
@@ -39,8 +52,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:18:26Z",
"nvd_published_at": "2018-06-02T01:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-jh2j-7248-9p3c/GHSA-jh2j-7248-9p3c.json → advisories/github-reviewed/2022/05/GHSA-jh2j-7248-9p3c/GHSA-jh2j-7248-9p3c.json
+23 -7
View File
@@ -1,17 +1,29 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jh2j-7248-9p3c",
"modified": "2022-05-24T16:56:38Z",
"modified": "2024-04-24T20:18:24Z",
"published": "2022-05-24T16:56:38Z",
"aliases": [
"CVE-2019-16669"
],
"summary": "Pagekit User enumeration",
"details": "The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "pagekit/pagekit"
},
"versions": [
"1.0.17"
]
}
],
"references": [
{
@@ -21,15 +33,19 @@
{
"type": "WEB",
"url": "https://github.com/pagekit/pagekit/issues/935"
},
{
"type": "PACKAGE",
"url": "https://github.com/pagekit/pagekit"
}
],
"database_specific": {
"cwe_ids": [
"CWE-203"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:18:24Z",
"nvd_published_at": "2019-09-21T19:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-rp89-32rp-qpq2/GHSA-rp89-32rp-qpq2.json → advisories/github-reviewed/2022/05/GHSA-rp89-32rp-qpq2/GHSA-rp89-32rp-qpq2.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rp89-32rp-qpq2",
"modified": "2022-05-13T01:12:12Z",
"modified": "2024-04-24T20:18:58Z",
"published": "2022-05-13T01:12:12Z",
"aliases": [
"CVE-2017-5594"
],
"summary": "Pagekit Weak Password Recovery Mechanism for Forgotten Password",
"details": "An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7_PGKT_01.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "pagekit/pagekit"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.11"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/pagekit/pagekit/commit/e0454f9c037c427a5ff76a57e78dbf8cc00c268b"
},
{
"type": "PACKAGE",
"url": "https://github.com/pagekit/pagekit"
},
{
"type": "WEB",
"url": "https://securelayer7.net/download/pdf/SecureLayer7-Pentest-report-Pagekit-CMS.pdf"
@@ -47,8 +70,8 @@
"CWE-640"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:18:58Z",
"nvd_published_at": "2017-01-25T18:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-v47j-rw9h-6m47/GHSA-v47j-rw9h-6m47.json → advisories/github-reviewed/2022/05/GHSA-v47j-rw9h-6m47/GHSA-v47j-rw9h-6m47.json
+28 -5
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v47j-rw9h-6m47",
"modified": "2022-05-14T02:59:33Z",
"modified": "2024-04-24T20:18:57Z",
"published": "2022-05-14T02:59:33Z",
"aliases": [
"CVE-2018-14381"
],
"details": "Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability.",
"summary": "Pagekit open redirect vulnerability",
"details": "Pagekit before 1.0.14 has a `/user/login?redirect=` open redirect vulnerability.",
"severity": [
{
"type": "CVSS_V3",
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "pagekit/pagekit"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.14"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/pagekit/pagekit/issues/905"
},
{
"type": "PACKAGE",
"url": "https://github.com/pagekit/pagekit"
},
{
"type": "WEB",
"url": "https://github.com/pagekit/pagekit/releases/tag/1.0.14"
@@ -35,8 +58,8 @@
"CWE-601"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:18:57Z",
"nvd_published_at": "2018-07-18T15:29:00Z"
}
}