netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3p68-m5qw-9g9w
GHSA-6rm6-mjmh-86jq
GHSA-q6v4-xjp2-8ggv
GHSA-q6v4-xjp2-8ggv
This commit is contained in:
advisory-database[bot]
2024-04-23 17:15:06 +00:00
parent 5f5137b60e
commit bcbffa1284
4 changed files with 131 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-3p68-m5qw-9g9w/GHSA-3p68-m5qw-9g9w.json → advisories/github-reviewed/2022/05/GHSA-3p68-m5qw-9g9w/GHSA-3p68-m5qw-9g9w.json
+31 -4
View File
@@ -1,23 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3p68-m5qw-9g9w",
"modified": "2022-05-13T01:07:48Z",
"modified": "2024-04-23T17:13:38Z",
"published": "2022-05-13T01:07:48Z",
"aliases": [
"CVE-2010-4183"
],
"summary": "HTML Purifier cross-site scripting (XSS) vulnerability",
"details": "Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ezyang/htmlpurifier"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4183"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezyang/htmlpurifier/CVE-2010-4183.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/ezyang/htmlpurifier"
},
{
"type": "WEB",
"url": "http://htmlpurifier.org/news/2010/0915-4.2.0-released"
@@ -32,8 +59,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T17:13:38Z",
"nvd_published_at": "2010-11-05T17:00:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-6rm6-mjmh-86jq/GHSA-6rm6-mjmh-86jq.json → advisories/github-reviewed/2022/05/GHSA-6rm6-mjmh-86jq/GHSA-6rm6-mjmh-86jq.json
+31 -4
View File
@@ -1,23 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6rm6-mjmh-86jq",
"modified": "2022-05-17T05:49:44Z",
"modified": "2024-04-23T17:13:36Z",
"published": "2022-05-17T05:49:44Z",
"aliases": [
"CVE-2010-2479"
],
"summary": "HTML Purifier Cross-site Scripting (XSS) vulnerability",
"details": "Cross-site scripting (XSS) vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ezyang/htmlpurifier"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2479"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/ezyang/htmlpurifier/CVE-2010-2479.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/ezyang/htmlpurifier"
},
{
"type": "WEB",
"url": "http://htmlpurifier.org/news/2010/0531-4.1.1-released"
@@ -56,8 +83,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T17:13:36Z",
"nvd_published_at": "2010-07-06T17:17:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-q6v4-xjp2-8ggv/GHSA-q6v4-xjp2-8ggv.json
+69
View File
@@ -0,0 +1,69 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q6v4-xjp2-8ggv",
"modified": "2024-04-23T17:14:29Z",
"published": "2022-05-13T01:11:18Z",
"aliases": [
"CVE-2017-14077"
],
"summary": "Securimage HTML Injection ",
"details": "HTML Injection in Securimage prior to 3.6.6 allows remote attackers to inject arbitrary HTML into an e-mail message body via the `$_SERVER['HTTP_USER_AGENT']` parameter to `example_form.ajax.php` or `example_form.php`.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dapphp/securimage"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.6"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14077"
},
{
"type": "WEB",
"url": "https://github.com/dapphp/securimage/commit/2c7ce3f6fa5ab86fd0ac8e3b4d5d72a21329d8ea"
},
{
"type": "WEB",
"url": "https://advisory.checkmarx.net/advisory/CX-2017-4223"
},
{
"type": "PACKAGE",
"url": "https://github.com/dapphp/securimage"
},
{
"type": "WEB",
"url": "https://www.checkmarx.com/advisories/html-injection-securimage"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T17:14:29Z",
"nvd_published_at": "2017-11-18T01:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-q6v4-xjp2-8ggv/GHSA-q6v4-xjp2-8ggv.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q6v4-xjp2-8ggv",
"modified": "2022-05-13T01:11:18Z",
"published": "2022-05-13T01:11:18Z",
"aliases": [
"CVE-2017-14077"
],
"details": "HTML Injection in Securimage 3.6.4 and earlier allows remote attackers to inject arbitrary HTML into an e-mail message body via the $_SERVER['HTTP_USER_AGENT'] parameter to example_form.ajax.php or example_form.php.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-14077"
},
{
"type": "WEB",
"url": "https://advisory.checkmarx.net/advisory/CX-2017-4223"
},
{
"type": "WEB",
"url": "https://www.checkmarx.com/advisories/html-injection-securimage"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-18T01:29:00Z"
}
}