netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-7hqr-j26m-gmwp
GHSA-m4x3-xmjv-r778
GHSA-pr4f-4pcx-2r3h
GHSA-m4x3-xmjv-r778
This commit is contained in:
advisory-database[bot]
2024-04-24 17:24:06 +00:00
parent 7c7800a9fb
commit bd1381f33a
4 changed files with 125 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-7hqr-j26m-gmwp/GHSA-7hqr-j26m-gmwp.json → advisories/github-reviewed/2022/05/GHSA-7hqr-j26m-gmwp/GHSA-7hqr-j26m-gmwp.json
+28 -5
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7hqr-j26m-gmwp",
"modified": "2022-05-13T01:27:53Z",
"modified": "2024-04-24T17:23:05Z",
"published": "2022-05-13T01:27:53Z",
"aliases": [
"CVE-2019-10867"
],
"details": "An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php.",
"summary": "Pimcore Unserialize Remote Code Execution",
"details": "An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to `/admin/class/bulk-commit`, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to `bundles/AdminBundle/Controller/Admin/DataObject/ClassController.php`.",
"severity": [
{
"type": "CVSS_V3",
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "pimcore/pimcore"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.7.1"
}
]
}
]
}
],
"references": [
{
@@ -29,6 +48,10 @@
"type": "WEB",
"url": "https://blog.certimetergroup.com/it/articolo/security/polyglot_phar_deserialization_to_rce"
},
{
"type": "PACKAGE",
"url": "https://github.com/pimcore/pimcore"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-173998"
@@ -51,8 +74,8 @@
"CWE-502"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T17:23:05Z",
"nvd_published_at": "2019-04-04T18:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-m4x3-xmjv-r778/GHSA-m4x3-xmjv-r778.json
+65
View File
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m4x3-xmjv-r778",
"modified": "2024-04-24T17:23:36Z",
"published": "2022-05-24T17:01:23Z",
"aliases": [
"CVE-2019-18982"
],
"summary": "Pimcore Cross-site Scripting (XSS) vulnerability",
"details": "`bundles/AdminBundle/Controller/Admin/EmailController.php` in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "pimcore/pimcore"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.3.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18982"
},
{
"type": "WEB",
"url": "https://github.com/pimcore/pimcore/commit/e0b48faf7d29ce43a98825a0b230e88350ebcf78"
},
{
"type": "PACKAGE",
"url": "https://github.com/pimcore/pimcore"
},
{
"type": "WEB",
"url": "https://github.com/pimcore/pimcore/compare/v6.2.3...v6.3.0"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T17:23:36Z",
"nvd_published_at": "2019-11-15T05:15:00Z"
}
}
advisories/unreviewed/2022/08/GHSA-pr4f-4pcx-2r3h/GHSA-pr4f-4pcx-2r3h.json → advisories/github-reviewed/2022/08/GHSA-pr4f-4pcx-2r3h/GHSA-pr4f-4pcx-2r3h.json
+32 -6
View File
@@ -1,17 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pr4f-4pcx-2r3h",
"modified": "2022-08-24T00:00:31Z",
"modified": "2024-04-24T17:22:40Z",
"published": "2022-08-24T00:00:31Z",
"aliases": [
"CVE-2022-2796"
],
"summary": "Pimcore Cross-site Scripting (XSS)",
"details": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.4.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "pimcore/pimcore"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "10.5.4"
}
]
}
]
}
],
"references": [
{
@@ -22,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/pimcore/pimcore/commit/2fd46859c1def6b5ab79ae2b9cb88c309769443d"
},
{
"type": "PACKAGE",
"url": "https://github.com/pimcore/pimcore"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/69d56ec3-8370-44cf-9732-4065e3076097"
@@ -31,9 +57,9 @@
"cwe_ids": [
"CWE-79"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T17:22:39Z",
"nvd_published_at": "2022-08-23T08:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-m4x3-xmjv-r778/GHSA-m4x3-xmjv-r778.json
-39
View File
@@ -1,39 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m4x3-xmjv-r778",
"modified": "2022-05-24T17:01:23Z",
"published": "2022-05-24T17:01:23Z",
"aliases": [
"CVE-2019-18982"
],
"details": "bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18982"
},
{
"type": "WEB",
"url": "https://github.com/pimcore/pimcore/commit/e0b48faf7d29ce43a98825a0b230e88350ebcf78"
},
{
"type": "WEB",
"url": "https://github.com/pimcore/pimcore/compare/v6.2.3...v6.3.0"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-11-15T05:15:00Z"
}
}