netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-55g3-fjwm-w2c8
GHSA-m76j-69c2-c3m8
GHSA-55g3-fjwm-w2c8
GHSA-m76j-69c2-c3m8
This commit is contained in:
advisory-database[bot]
2025-04-14 16:02:11 +00:00
parent c6e8585bd6
commit c1125ad45e
4 changed files with 210 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json
+130
View File
@@ -0,0 +1,130 @@
{
"schema_version": "1.4.0",
"id": "GHSA-55g3-fjwm-w2c8",
"modified": "2025-04-14T16:01:20Z",
"published": "2022-05-14T04:01:57Z",
"aliases": [
"CVE-2014-3942"
],
"summary": "TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code",
"details": "The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.5.0"
},
{
"fixed": "4.5.34"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.7.0"
},
{
"fixed": "4.7.19"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.14"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.1.0"
},
{
"fixed": "6.1.9"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3942"
},
{
"type": "PACKAGE",
"url": "https://github.com/TYPO3/typo3"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-core-sa-2014-001"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2014/dsa-2942"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/06/03/2"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-04-14T16:01:20Z",
"nvd_published_at": "2014-06-03T14:55:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json
+80
View File
@@ -0,0 +1,80 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m76j-69c2-c3m8",
"modified": "2025-04-14T16:00:18Z",
"published": "2022-05-17T04:43:27Z",
"aliases": [
"CVE-2013-4321"
],
"summary": "TYPO3 vulnerable to remote authenticated arbitrary code execution",
"details": "The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.1.0"
},
{
"fixed": "6.1.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4321"
},
{
"type": "PACKAGE",
"url": "https://github.com/TYPO3/typo3"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-core-sa-2013-003"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-04-14T16:00:18Z",
"nvd_published_at": "2014-05-20T14:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-55g3-fjwm-w2c8/GHSA-55g3-fjwm-w2c8.json
-43
View File
@@ -1,43 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-55g3-fjwm-w2c8",
"modified": "2025-04-12T12:34:25Z",
"published": "2022-05-14T04:01:57Z",
"aliases": [
"CVE-2014-3942"
],
"details": "The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3942"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2014-06/msg00037.html"
},
{
"type": "WEB",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2014/dsa-2942"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/06/03/2"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-06-03T14:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-m76j-69c2-c3m8/GHSA-m76j-69c2-c3m8.json
-31
View File
@@ -1,31 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m76j-69c2-c3m8",
"modified": "2025-04-12T12:33:54Z",
"published": "2022-05-17T04:43:27Z",
"aliases": [
"CVE-2013-4321"
],
"details": "The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4321"
},
{
"type": "WEB",
"url": "https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-05-20T14:55:00Z"
}
}