netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-08-26 21:31:54 +00:00
parent 9b2b688c62
commit bb10df1d42
83 changed files with 1750 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/02/GHSA-226m-fqfj-v6xp/GHSA-226m-fqfj-v6xp.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-226m-fqfj-v6xp",
"modified": "2024-02-29T03:33:11Z",
"modified": "2024-08-26T21:30:31Z",
"published": "2024-02-29T03:33:11Z",
"aliases": [
"CVE-2022-36677"
],
"details": "Obsidian Mind Map v1.1.0 allows attackers to execute arbitrary code via a crafted payload injected into an uploaded document.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-29T01:35:29Z"
advisories/unreviewed/2024/02/GHSA-283x-r7vm-882q/GHSA-283x-r7vm-882q.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-283x-r7vm-882q",
"modified": "2024-02-29T03:33:17Z",
"modified": "2024-08-26T21:30:31Z",
"published": "2024-02-29T03:33:17Z",
"aliases": [
"CVE-2024-22936"
],
"details": "Cross-site scripting (XSS) vulnerability in Parents & Student Portal in Genesis School Management Systems in Genesis AIMS Student Information Systems v.3053 allows remote attackers to inject arbitrary web script or HTML via the message parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-29T01:44:07Z"
advisories/unreviewed/2024/02/GHSA-3q8j-579q-jx44/GHSA-3q8j-579q-jx44.json
+6 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3q8j-579q-jx44",
"modified": "2024-02-15T06:31:36Z",
"modified": "2024-08-26T21:30:31Z",
"published": "2024-02-15T06:31:36Z",
"aliases": [
"CVE-2022-23090"
@@ -21,11 +21,15 @@
{
"type": "WEB",
"url": "https://security.freebsd.org/advisories/FreeBSD-SA-22:10.aio.asc"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20240415-0007"
}
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": null,
"github_reviewed": false,
advisories/unreviewed/2024/02/GHSA-3rhh-97v9-2g42/GHSA-3rhh-97v9-2g42.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3rhh-97v9-2g42",
"modified": "2024-02-16T00:30:28Z",
"modified": "2024-08-26T21:30:31Z",
"published": "2024-02-16T00:30:28Z",
"aliases": [
"CVE-2023-40111"
],
"details": "In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system_server due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -31,7 +34,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-15T23:15:08Z"
advisories/unreviewed/2024/02/GHSA-3vf3-8x3v-cfhr/GHSA-3vf3-8x3v-cfhr.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3vf3-8x3v-cfhr",
"modified": "2024-02-16T21:31:31Z",
"modified": "2024-08-26T21:30:31Z",
"published": "2024-02-16T21:31:31Z",
"aliases": [
"CVE-2023-21165"
],
"details": "In DevmemIntUnmapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-16T19:15:08Z"
advisories/unreviewed/2024/02/GHSA-3wcf-84jq-4rxx/GHSA-3wcf-84jq-4rxx.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3wcf-84jq-4rxx",
"modified": "2024-05-02T00:30:47Z",
"modified": "2024-08-26T21:30:32Z",
"published": "2024-02-29T18:30:59Z",
"aliases": [
"CVE-2024-25180"
],
"details": "An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the path '/pdf'.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-29T18:15:16Z"
advisories/unreviewed/2024/02/GHSA-4mwq-x2m3-qxc6/GHSA-4mwq-x2m3-qxc6.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4mwq-x2m3-qxc6",
"modified": "2024-02-16T03:30:50Z",
"modified": "2024-08-26T21:30:31Z",
"published": "2024-02-16T03:30:50Z",
"aliases": [
"CVE-2024-0014"
],
"details": "In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-16T02:15:50Z"
advisories/unreviewed/2024/02/GHSA-6hvh-59wp-qgpm/GHSA-6hvh-59wp-qgpm.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6hvh-59wp-qgpm",
"modified": "2024-02-29T00:30:22Z",
"modified": "2024-08-26T21:30:31Z",
"published": "2024-02-29T00:30:22Z",
"aliases": [
"CVE-2024-25351"
],
"details": "SQL Injection vulnerability in /zms/admin/changeimage.php in PHPGurukul Zoo Management System 1.0 allows attackers to run arbitrary SQL commands via the editid parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-28T22:15:26Z"
advisories/unreviewed/2024/02/GHSA-74rv-fq96-j6vr/GHSA-74rv-fq96-j6vr.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-74rv-fq96-j6vr",
"modified": "2024-02-13T00:30:27Z",
"modified": "2024-08-26T21:30:31Z",
"published": "2024-02-13T00:30:27Z",
"aliases": [
"CVE-2024-24337"
],
"details": "CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' components.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-1236"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-12T22:15:08Z"
advisories/unreviewed/2024/02/GHSA-754f-f3pv-5vpq/GHSA-754f-f3pv-5vpq.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-754f-f3pv-5vpq",
"modified": "2024-02-27T09:31:15Z",
"modified": "2024-08-26T21:30:31Z",
"published": "2024-02-22T06:30:33Z",
"aliases": [
"CVE-2024-26484"
],
"details": "A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Link field.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-22T05:15:10Z"
advisories/unreviewed/2024/02/GHSA-77c4-m4jj-64q2/GHSA-77c4-m4jj-64q2.json
+1 -1
View File
@@ -32,7 +32,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "CRITICAL",
"github_reviewed": false,
advisories/unreviewed/2024/02/GHSA-824x-hcr6-cqgr/GHSA-824x-hcr6-cqgr.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-824x-hcr6-cqgr",
"modified": "2024-02-14T21:30:33Z",
"modified": "2024-08-26T21:30:31Z",
"published": "2024-02-14T21:30:33Z",
"aliases": [
"CVE-2024-25165"
],
"details": "A global-buffer-overflow vulnerability was found in SWFTools v0.9.2, in the function LineText at lib/swf5compiler.flex.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-120"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-14T20:15:46Z"
advisories/unreviewed/2024/02/GHSA-89x3-jgxj-39cx/GHSA-89x3-jgxj-39cx.json
+2 -1
View File
@@ -28,7 +28,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-22"
"CWE-22",
"CWE-94"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/02/GHSA-mmc3-qp8j-6fpj/GHSA-mmc3-qp8j-6fpj.json
+1 -1
View File
@@ -32,7 +32,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/02/GHSA-mmrc-cc78-9f9w/GHSA-mmrc-cc78-9f9w.json
+2 -1
View File
@@ -28,7 +28,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-352"
"CWE-352",
"CWE-94"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/02/GHSA-v57p-q7g2-4g2r/GHSA-v57p-q7g2-4g2r.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v57p-q7g2-4g2r",
"modified": "2024-02-22T15:30:38Z",
"modified": "2024-08-26T21:30:31Z",
"published": "2024-02-22T15:30:38Z",
"aliases": [
"CVE-2024-25873"
],
"details": "Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerability allows attackers to execute arbitrary code via a crafted payload.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-80"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-22T14:15:46Z"
advisories/unreviewed/2024/03/GHSA-6vrh-rgrg-f5x4/GHSA-6vrh-rgrg-f5x4.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6vrh-rgrg-f5x4",
"modified": "2024-03-03T09:30:38Z",
"modified": "2024-08-26T21:30:32Z",
"published": "2024-03-03T09:30:38Z",
"aliases": [
"CVE-2024-25839"
],
"details": "An issue was discovered in Webbax \"Super Newsletter\" (supernewsletter) module for PrestaShop versions 1.4.21 and before, allows local attackers to escalate privileges and obtain sensitive information.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-03T09:15:06Z"
advisories/unreviewed/2024/03/GHSA-6xfp-g425-7cw6/GHSA-6xfp-g425-7cw6.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6xfp-g425-7cw6",
"modified": "2024-03-14T03:31:15Z",
"modified": "2024-08-26T21:30:32Z",
"published": "2024-03-14T03:31:15Z",
"aliases": [
"CVE-2024-28388"
],
"details": "SQL injection vulnerability in SunnyToo stproductcomments module for PrestaShop v.1.0.5 and before, allows a remote attacker to escalate privileges and obtain sensitive information via the StProductCommentClass::getListcomments method.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-14T03:15:09Z"
advisories/unreviewed/2024/03/GHSA-726f-22p9-pqrr/GHSA-726f-22p9-pqrr.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-726f-22p9-pqrr",
"modified": "2024-03-06T00:31:27Z",
"modified": "2024-08-26T21:30:32Z",
"published": "2024-03-06T00:31:27Z",
"aliases": [
"CVE-2023-38946"
],
"details": "An issue in Multilaser RE160 firmware v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01 allows attackers to bypass the access control and gain complete access to the application via supplying a crafted cookie.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-06T00:15:52Z"
advisories/unreviewed/2024/03/GHSA-89cw-fq2g-5v94/GHSA-89cw-fq2g-5v94.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-89cw-fq2g-5v94",
"modified": "2024-04-24T03:30:45Z",
"modified": "2024-08-26T21:30:32Z",
"published": "2024-03-14T15:34:06Z",
"aliases": [
"CVE-2024-28323"
],
"details": "The bwdates-report-result.php file in Phpgurukul User Registration & Login and User Management System 3.1 contains a potential security vulnerability related to user input validation. The script retrieves user-provided date inputs without proper validation, making it susceptible to SQL injection attacks.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-14T14:15:08Z"

Some files were not shown because too many files have changed in this diff Show More