netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-g85v-wf27-67xc
GHSA-hw9x-8m75-4vjq
GHSA-xcpr-7mr4-h4xq
GHSA-xcpr-7mr4-h4xq
This commit is contained in:
advisory-database[bot]
2024-11-18 23:49:13 +00:00
parent db41310983
commit b75f168733
4 changed files with 199 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/11/GHSA-g85v-wf27-67xc/GHSA-g85v-wf27-67xc.json
+58
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2024/11/GHSA-hw9x-8m75-4vjq/GHSA-hw9x-8m75-4vjq.json → advisories/github-reviewed/2024/11/GHSA-hw9x-8m75-4vjq/GHSA-hw9x-8m75-4vjq.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hw9x-8m75-4vjq",
"modified": "2024-11-18T18:30:48Z",
"modified": "2024-11-18T23:48:11Z",
"published": "2024-11-12T21:30:55Z",
"aliases": [
"CVE-2024-51093"
],
"summary": "Cross Site Scripting vulnerability in Snipe-IT",
"details": "Cross Site Scripting vulnerability in Snipe-IT v.7.0.13 allows a remote attacker to escalate privileges via an unknown part of the file /users/{{user-id}}/#files.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "snipe/snipe-it"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.0.13"
}
]
}
]
}
],
"references": [
{
@@ -24,6 +43,10 @@
{
"type": "WEB",
"url": "https://gist.githubusercontent.com/Tommywarren/ca70f1c43f4ec34dc19cd13459535780/raw/d13192ae50bc7c024b922412dfa3f530faa8d5db/CVE-2024-51093"
},
{
"type": "PACKAGE",
"url": "https://github.com/snipe/snipe-it"
}
],
"database_specific": {
@@ -31,8 +54,8 @@
"CWE-79"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-11-18T23:48:11Z",
"nvd_published_at": "2024-11-12T21:15:14Z"
}
}
advisories/github-reviewed/2024/11/GHSA-xcpr-7mr4-h4xq/GHSA-xcpr-7mr4-h4xq.json
+114
View File
@@ -0,0 +1,114 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xcpr-7mr4-h4xq",
"modified": "2024-11-18T23:48:03Z",
"published": "2024-11-18T12:30:43Z",
"aliases": [
"CVE-2024-52316"
],
"summary": "Apache Tomcat - Authentication Bypass",
"details": "Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95.\n\nUsers are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.96"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.1.0-M1"
},
{
"fixed": "10.1.30"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.tomcat:tomcat-catalina"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "11.0.0-M1"
},
{
"fixed": "11.0.1"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 11.0.0-M26"
}
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52316"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/6d097a66746635df6880fe7662a792156b0eca14"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/7532f9dc4a8c37ec958f79dc82c4924a6c539223"
},
{
"type": "WEB",
"url": "https://github.com/apache/tomcat/commit/acc2f01395f895980f5d8a64573fcc1bade13369"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/tomcat"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928"
}
],
"database_specific": {
"cwe_ids": [
"CWE-391"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-11-18T23:48:03Z",
"nvd_published_at": "2024-11-18T12:15:18Z"
}
}
advisories/unreviewed/2024/11/GHSA-xcpr-7mr4-h4xq/GHSA-xcpr-7mr4-h4xq.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xcpr-7mr4-h4xq",
"modified": "2024-11-18T18:30:55Z",
"published": "2024-11-18T12:30:43Z",
"aliases": [
"CVE-2024-52316"
],
"details": "Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95.\n\nUsers are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52316"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928"
}
],
"database_specific": {
"cwe_ids": [
"CWE-391"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-18T12:15:18Z"
}
}