netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-08-20 18:32:57 +00:00
parent 4a996d545e
commit c3eba60ec9
62 changed files with 751 additions and 178 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/08/GHSA-hrww-x3fq-xcvh/GHSA-hrww-x3fq-xcvh.json
+69
View File
@@ -0,0 +1,69 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hrww-x3fq-xcvh",
"modified": "2024-08-20T18:32:26Z",
"published": "2024-08-20T18:32:26Z",
"aliases": [
"CVE-2024-43377"
],
"summary": "Umbraco CMS Improper Access Control vulnerability",
"details": "### Impact\nAs an authenticated user one can access a few unintended endpoints\n\n\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "Umbraco.Cms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "14.0.0"
},
{
"fixed": "14.1.2"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-hrww-x3fq-xcvh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43377"
},
{
"type": "WEB",
"url": "https://github.com/umbraco/Umbraco-CMS/commit/72bef8861d94a39d5cc9530a04c4797b91fcbecf"
},
{
"type": "PACKAGE",
"url": "https://github.com/umbraco/Umbraco-CMS"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-08-20T18:32:26Z",
"nvd_published_at": "2024-08-20T15:15:23Z"
}
}
advisories/unreviewed/2024/03/GHSA-2734-8vv8-c662/GHSA-2734-8vv8-c662.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2734-8vv8-c662",
"modified": "2024-03-27T00:30:54Z",
"modified": "2024-08-20T18:31:14Z",
"published": "2024-03-27T00:30:54Z",
"aliases": [
"CVE-2023-51146"
],
"details": "Buffer Overflow vulnerability in TRENDnet AC1200 TEW-821DAP with firmware version 3.00b06 allows an attacker to execute arbitrary code via the adm_add_user action.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-26T22:15:07Z"
advisories/unreviewed/2024/04/GHSA-6xrw-49j6-7f3m/GHSA-6xrw-49j6-7f3m.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6xrw-49j6-7f3m",
"modified": "2024-04-03T06:30:48Z",
"modified": "2024-08-20T18:31:14Z",
"published": "2024-04-03T06:30:48Z",
"aliases": [
"CVE-2024-31011"
],
"details": "Arbitrary file write vulnerability in beescms v.4.0, allows a remote attacker to execute arbitrary code via a file path that was not isolated and the suffix was not verified in admin_template.php.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-03T05:15:48Z"
advisories/unreviewed/2024/04/GHSA-772r-9j2c-4jvf/GHSA-772r-9j2c-4jvf.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-772r-9j2c-4jvf",
"modified": "2024-04-05T21:32:44Z",
"modified": "2024-08-20T18:31:14Z",
"published": "2024-04-05T21:32:44Z",
"aliases": [
"CVE-2024-29749"
],
"details": "In tmu_set_tr_thresholds of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-05T20:15:08Z"
advisories/unreviewed/2024/04/GHSA-9w56-p5q4-69pw/GHSA-9w56-p5q4-69pw.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9w56-p5q4-69pw",
"modified": "2024-04-16T00:30:32Z",
"modified": "2024-08-20T18:31:14Z",
"published": "2024-04-16T00:30:32Z",
"aliases": [
"CVE-2024-31651"
],
"details": "A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-15T22:15:09Z"
advisories/unreviewed/2024/04/GHSA-f6rh-8x43-h7fg/GHSA-f6rh-8x43-h7fg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f6rh-8x43-h7fg",
"modified": "2024-04-09T00:30:41Z",
"modified": "2024-08-20T18:31:14Z",
"published": "2024-04-09T00:30:41Z",
"aliases": [
"CVE-2024-23084"
],
"details": "Apfloat v1.10.1 was discovered to contain an ArrayIndexOutOfBoundsException via the component org.apfloat.internal.DoubleCRTMath::add(double[], double[]).",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-129"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-08T23:15:07Z"
advisories/unreviewed/2024/04/GHSA-g7gr-43mm-gr6q/GHSA-g7gr-43mm-gr6q.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g7gr-43mm-gr6q",
"modified": "2024-04-29T18:30:46Z",
"modified": "2024-08-20T18:31:14Z",
"published": "2024-04-29T18:30:46Z",
"aliases": [
"CVE-2024-31705"
],
"details": "An issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of user-supplied input.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-29T18:15:07Z"
advisories/unreviewed/2024/04/GHSA-rj56-c2jf-78qg/GHSA-rj56-c2jf-78qg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rj56-c2jf-78qg",
"modified": "2024-04-02T09:30:42Z",
"modified": "2024-08-20T18:31:14Z",
"published": "2024-04-02T09:30:42Z",
"aliases": [
"CVE-2024-29276"
],
"details": "An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDesignerController.class component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-02T07:15:45Z"
advisories/unreviewed/2024/05/GHSA-42g6-fx4g-4pxv/GHSA-42g6-fx4g-4pxv.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-42g6-fx4g-4pxv",
"modified": "2024-05-22T15:31:01Z",
"modified": "2024-08-20T18:31:15Z",
"published": "2024-05-22T15:31:01Z",
"aliases": [
"CVE-2024-33219"
],
"details": "An issue in the component AsIO64.sys of ASUSTeK Computer Inc ASUS SABERTOOTH X99 Driver v1.0.1.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-782"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T15:15:28Z"
advisories/unreviewed/2024/05/GHSA-9qhr-489p-hcrq/GHSA-9qhr-489p-hcrq.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9qhr-489p-hcrq",
"modified": "2024-05-23T18:30:55Z",
"modified": "2024-08-20T18:31:15Z",
"published": "2024-05-23T18:30:55Z",
"aliases": [
"CVE-2024-34934"
],
"details": "A SQL injection vulnerability in /view/emarks_range_grade_update_form.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the conversation_id parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-23T17:15:30Z"
advisories/unreviewed/2024/05/GHSA-gp37-m2c5-j775/GHSA-gp37-m2c5-j775.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gp37-m2c5-j775",
"modified": "2024-05-21T18:31:24Z",
"modified": "2024-08-20T18:31:14Z",
"published": "2024-05-21T18:31:23Z",
"aliases": [
"CVE-2024-36052"
],
"details": "RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T17:15:09Z"
advisories/unreviewed/2024/05/GHSA-h4rc-3vfw-rw96/GHSA-h4rc-3vfw-rw96.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h4rc-3vfw-rw96",
"modified": "2024-05-21T18:31:24Z",
"modified": "2024-08-20T18:31:14Z",
"published": "2024-05-21T18:31:24Z",
"aliases": [
"CVE-2024-34240"
],
"details": "QDOCS Smart School 7.0.0 is vulnerable to Cross Site Scripting (XSS) resulting in arbitrary code execution in admin functions related to adding or updating records.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T18:15:09Z"
advisories/unreviewed/2024/05/GHSA-hp95-552p-6qxj/GHSA-hp95-552p-6qxj.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hp95-552p-6qxj",
"modified": "2024-05-16T18:30:31Z",
"modified": "2024-08-20T18:31:14Z",
"published": "2024-05-16T18:30:31Z",
"aliases": [
"CVE-2023-48643"
],
"details": "Shrubbery tac_plus 2.x, 3.x. and 4.x through F4.0.4.28 allows unauthenticated Remote Command Execution. The product allows users to configure authorization checks as shell commands through the tac_plus.cfg configuration file. These are executed when a client sends an authorization request with a username that has pre-authorization directives configured. However, it is possible to inject additional commands into these checks because strings from TACACS+ packets are used as command-line arguments. If the installation lacks a a pre-shared secret (there is no pre-shared secret by default), then the injection can be triggered without authentication. (The attacker needs to know a username configured to use a pre-authorization command.) NOTE: this is related to CVE-2023-45239 but the issue is in the original Shrubbery product, not Meta's fork.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-16T16:15:08Z"
advisories/unreviewed/2024/05/GHSA-mgj2-4fwc-v47j/GHSA-mgj2-4fwc-v47j.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mgj2-4fwc-v47j",
"modified": "2024-05-22T15:30:59Z",
"modified": "2024-08-20T18:31:15Z",
"published": "2024-05-22T15:30:59Z",
"aliases": [
"CVE-2024-35409"
],
"details": "WeBid 1.1.2 is vulnerable to SQL Injection via admin/tax.php.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T14:15:08Z"
advisories/unreviewed/2024/05/GHSA-p3rv-p6mh-g8xg/GHSA-p3rv-p6mh-g8xg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p3rv-p6mh-g8xg",
"modified": "2024-05-14T18:30:51Z",
"modified": "2024-08-20T18:31:14Z",
"published": "2024-05-14T18:30:51Z",
"aliases": [
"CVE-2024-35099"
],
"details": "TOTOLINK LR350 V9.3.5u.6698_B20230810 was discovered to contain a stack overflow via the password parameter in the function loginAuth.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-120"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T15:39:39Z"
advisories/unreviewed/2024/05/GHSA-ppwh-5frw-h5v9/GHSA-ppwh-5frw-h5v9.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-ppwh-5frw-h5v9",
"modified": "2024-05-14T18:31:00Z",
"modified": "2024-08-20T18:31:14Z",
"published": "2024-05-14T18:31:00Z",
"aliases": [
"CVE-2024-32350"
],
"details": "TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the \"ipsecPsk\" parameter in the \"cstecgi.cgi\" binary.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T16:17:02Z"
advisories/unreviewed/2024/05/GHSA-r73q-v44r-mw6r/GHSA-r73q-v44r-mw6r.json
+1 -1
View File
@@ -28,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "CRITICAL",
"github_reviewed": false,
advisories/unreviewed/2024/05/GHSA-rqg9-hrw2-mxcf/GHSA-rqg9-hrw2-mxcf.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rqg9-hrw2-mxcf",
"modified": "2024-05-14T18:31:00Z",
"modified": "2024-08-20T18:31:14Z",
"published": "2024-05-14T18:31:00Z",
"aliases": [
"CVE-2024-32351"
],
"details": "TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the \"mru\" parameter in the \"cstecgi.cgi\" binary.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T16:17:02Z"
advisories/unreviewed/2024/05/GHSA-v5r5-978f-9w52/GHSA-v5r5-978f-9w52.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v5r5-978f-9w52",
"modified": "2024-05-22T15:31:00Z",
"modified": "2024-08-20T18:31:14Z",
"published": "2024-05-22T15:31:00Z",
"aliases": [
"CVE-2024-35556"
],
"details": "idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsSys_deal.php?mudi=infoSet.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T14:15:09Z"
advisories/unreviewed/2024/05/GHSA-v8r8-56x7-prx6/GHSA-v8r8-56x7-prx6.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v8r8-56x7-prx6",
"modified": "2024-05-20T18:31:23Z",
"modified": "2024-08-20T18:31:14Z",
"published": "2024-05-20T18:31:23Z",
"aliases": [
"CVE-2024-34193"
],
"details": "smanga 3.2.7 does not filter the file parameter at the PHP/get file flow.php interface, resulting in a path traversal vulnerability that can cause arbitrary file reading.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-20T18:15:10Z"

Some files were not shown because too many files have changed in this diff Show More