From c01a102c483ba39c0e8010485ad7ad10e0190164 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 22 Apr 2025 17:33:50 +0000 Subject: [PATCH] Publish Advisories GHSA-48q3-m4hf-56c9 GHSA-49wf-927p-jpvj GHSA-f2x4-547g-rp95 GHSA-r64j-5w3w-fp49 GHSA-49wf-927p-jpvj --- .../GHSA-48q3-m4hf-56c9.json | 33 ++++++++- .../GHSA-49wf-927p-jpvj.json | 73 +++++++++++++++++++ .../GHSA-f2x4-547g-rp95.json | 41 ++++++++--- .../GHSA-r64j-5w3w-fp49.json | 33 ++++++++- .../GHSA-49wf-927p-jpvj.json | 56 -------------- 5 files changed, 160 insertions(+), 76 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-48q3-m4hf-56c9/GHSA-48q3-m4hf-56c9.json (59%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-49wf-927p-jpvj/GHSA-49wf-927p-jpvj.json rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-f2x4-547g-rp95/GHSA-f2x4-547g-rp95.json (50%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-r64j-5w3w-fp49/GHSA-r64j-5w3w-fp49.json (62%) delete mode 100644 advisories/unreviewed/2022/05/GHSA-49wf-927p-jpvj/GHSA-49wf-927p-jpvj.json diff --git a/advisories/unreviewed/2022/05/GHSA-48q3-m4hf-56c9/GHSA-48q3-m4hf-56c9.json b/advisories/github-reviewed/2022/05/GHSA-48q3-m4hf-56c9/GHSA-48q3-m4hf-56c9.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-48q3-m4hf-56c9/GHSA-48q3-m4hf-56c9.json rename to advisories/github-reviewed/2022/05/GHSA-48q3-m4hf-56c9/GHSA-48q3-m4hf-56c9.json index feb73797141..009d1315242 100644 --- a/advisories/unreviewed/2022/05/GHSA-48q3-m4hf-56c9/GHSA-48q3-m4hf-56c9.json +++ b/advisories/github-reviewed/2022/05/GHSA-48q3-m4hf-56c9/GHSA-48q3-m4hf-56c9.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-48q3-m4hf-56c9", - "modified": "2025-04-20T03:35:57Z", + "modified": "2025-04-22T17:33:02Z", "published": "2022-05-17T02:49:21Z", "aliases": [ "CVE-2015-7562" ], + "summary": "TeamPass vulnerable to Cross-site Scripting", "details": "Multiple cross-site scripting (XSS) vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) label value of an item or (2) name of a role.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "nilsteampassnet/teampass" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.25" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -23,6 +44,10 @@ "type": "WEB", "url": "https://github.com/nilsteampassnet/TeamPass/pull/1140" }, + { + "type": "PACKAGE", + "url": "https://github.com/nilsteampassnet/TeamPass" + }, { "type": "WEB", "url": "https://www.exploit-db.com/exploits/39559" @@ -33,8 +58,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-22T17:33:02Z", "nvd_published_at": "2017-04-12T22:59:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-49wf-927p-jpvj/GHSA-49wf-927p-jpvj.json b/advisories/github-reviewed/2022/05/GHSA-49wf-927p-jpvj/GHSA-49wf-927p-jpvj.json new file mode 100644 index 00000000000..1bb084f4132 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-49wf-927p-jpvj/GHSA-49wf-927p-jpvj.json @@ -0,0 +1,73 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-49wf-927p-jpvj", + "modified": "2025-04-22T17:32:27Z", + "published": "2022-05-17T02:50:39Z", + "aliases": [ + "CVE-2015-1611" + ], + "summary": "OpenFlow plugin for OpenDaylight allows spoofing the SDN topology", + "details": "OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to \"fake LLDP injection.\"", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.opendaylight.openflowplugin:openflowplugin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.6-Helium-SR3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1611" + }, + { + "type": "WEB", + "url": "https://git.opendaylight.org/gerrit/#/c/16193" + }, + { + "type": "WEB", + "url": "https://git.opendaylight.org/gerrit/#/c/16208" + }, + { + "type": "PACKAGE", + "url": "https://github.com/opendaylight/openflowplugin" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20150510044305/https://wiki.opendaylight.org/view/Security_Advisories#.5BModerate.5D_CVE-2015-1611_CVE-2015-1612_openflowplugin:_topology_spoofing_via_LLDP" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20150701104709/https://www.internetsociety.org/sites/default/files/10_4_2.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-04-22T17:32:26Z", + "nvd_published_at": "2017-04-04T17:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-f2x4-547g-rp95/GHSA-f2x4-547g-rp95.json b/advisories/github-reviewed/2022/05/GHSA-f2x4-547g-rp95/GHSA-f2x4-547g-rp95.json similarity index 50% rename from advisories/unreviewed/2022/05/GHSA-f2x4-547g-rp95/GHSA-f2x4-547g-rp95.json rename to advisories/github-reviewed/2022/05/GHSA-f2x4-547g-rp95/GHSA-f2x4-547g-rp95.json index 0c7240cb0f5..a6e451eadfd 100644 --- a/advisories/unreviewed/2022/05/GHSA-f2x4-547g-rp95/GHSA-f2x4-547g-rp95.json +++ b/advisories/github-reviewed/2022/05/GHSA-f2x4-547g-rp95/GHSA-f2x4-547g-rp95.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-f2x4-547g-rp95", - "modified": "2025-04-20T03:35:26Z", + "modified": "2025-04-22T17:32:35Z", "published": "2022-05-17T02:50:39Z", "aliases": [ "CVE-2015-1612" ], + "summary": "OpenFlow plugin for OpenDaylight LLDP Relay", "details": "OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to the reuse of LLDP packets, aka \"LLDP Relay.\"", "severity": [ { @@ -13,16 +14,32 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.opendaylight.openflowplugin:openflowplugin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.0.6-Helium-SR3" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1612" }, - { - "type": "WEB", - "url": "https://cloudrouter.org/security" - }, { "type": "WEB", "url": "https://git.opendaylight.org/gerrit/#/c/16193" @@ -32,16 +49,16 @@ "url": "https://git.opendaylight.org/gerrit/#/c/16208" }, { - "type": "WEB", - "url": "https://wiki.opendaylight.org/view/Security_Advisories#.5BModerate.5D_CVE-2015-1611_CVE-2015-1612_openflowplugin:_topology_spoofing_via_LLDP" + "type": "PACKAGE", + "url": "https://github.com/opendaylight/openflowplugin" }, { "type": "WEB", - "url": "http://www.internetsociety.org/sites/default/files/10_4_2.pdf" + "url": "https://web.archive.org/web/20150510044305/https://wiki.opendaylight.org/view/Security_Advisories#.5BModerate.5D_CVE-2015-1611_CVE-2015-1612_openflowplugin:_topology_spoofing_via_LLDP" }, { "type": "WEB", - "url": "http://www.securityfocus.com/bid/73254" + "url": "https://web.archive.org/web/20150701104709/https://www.internetsociety.org/sites/default/files/10_4_2.pdf" } ], "database_specific": { @@ -49,8 +66,8 @@ "CWE-20" ], "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-22T17:32:34Z", "nvd_published_at": "2017-04-04T17:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-r64j-5w3w-fp49/GHSA-r64j-5w3w-fp49.json b/advisories/github-reviewed/2022/05/GHSA-r64j-5w3w-fp49/GHSA-r64j-5w3w-fp49.json similarity index 62% rename from advisories/unreviewed/2022/05/GHSA-r64j-5w3w-fp49/GHSA-r64j-5w3w-fp49.json rename to advisories/github-reviewed/2022/05/GHSA-r64j-5w3w-fp49/GHSA-r64j-5w3w-fp49.json index 89b62c2efeb..a8f1af1b41c 100644 --- a/advisories/unreviewed/2022/05/GHSA-r64j-5w3w-fp49/GHSA-r64j-5w3w-fp49.json +++ b/advisories/github-reviewed/2022/05/GHSA-r64j-5w3w-fp49/GHSA-r64j-5w3w-fp49.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-r64j-5w3w-fp49", - "modified": "2025-04-20T03:35:57Z", + "modified": "2025-04-22T17:33:24Z", "published": "2022-05-17T02:49:24Z", "aliases": [ "CVE-2015-7564" ], + "summary": "TeamPass vulnerable to SQL Injection", "details": "Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an action_on_quick_icon action to item.query.php or the (2) order or (3) direction parameter in an (a) connections_logs, (b) errors_logs or (c) access_logs action to view.query.php.", "severity": [ { @@ -13,7 +14,27 @@ "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "nilsteampassnet/teampass" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.25" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -23,6 +44,10 @@ "type": "WEB", "url": "https://github.com/nilsteampassnet/TeamPass/pull/1140" }, + { + "type": "PACKAGE", + "url": "https://github.com/nilsteampassnet/TeamPass" + }, { "type": "WEB", "url": "https://www.exploit-db.com/exploits/39559" @@ -33,8 +58,8 @@ "CWE-89" ], "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-22T17:33:24Z", "nvd_published_at": "2017-04-12T22:59:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-49wf-927p-jpvj/GHSA-49wf-927p-jpvj.json b/advisories/unreviewed/2022/05/GHSA-49wf-927p-jpvj/GHSA-49wf-927p-jpvj.json deleted file mode 100644 index bb88afd237b..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-49wf-927p-jpvj/GHSA-49wf-927p-jpvj.json +++ /dev/null @@ -1,56 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-49wf-927p-jpvj", - "modified": "2025-04-20T03:35:26Z", - "published": "2022-05-17T02:50:39Z", - "aliases": [ - "CVE-2015-1611" - ], - "details": "OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to \"fake LLDP injection.\"", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1611" - }, - { - "type": "WEB", - "url": "https://cloudrouter.org/security" - }, - { - "type": "WEB", - "url": "https://git.opendaylight.org/gerrit/#/c/16193" - }, - { - "type": "WEB", - "url": "https://git.opendaylight.org/gerrit/#/c/16208" - }, - { - "type": "WEB", - "url": "https://wiki.opendaylight.org/view/Security_Advisories#.5BModerate.5D_CVE-2015-1611_CVE-2015-1612_openflowplugin:_topology_spoofing_via_LLDP" - }, - { - "type": "WEB", - "url": "http://www.internetsociety.org/sites/default/files/10_4_2.pdf" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/73254" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-04-04T17:59:00Z" - } -} \ No newline at end of file