netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-8r2w-phx4-mgpv
GHSA-8v7v-6mmm-xjxm
GHSA-f848-r5g6-6gpf
GHSA-fvf9-2hjp-w936
GHSA-m396-2x3h-v3v4
GHSA-q938-82fw-wfcf
GHSA-8v7v-6mmm-xjxm
GHSA-m396-2x3h-v3v4
This commit is contained in:
advisory-database[bot]
2024-04-24 20:36:04 +00:00
parent 59d4c23bff
commit c7600fb7a0
8 changed files with 205 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-8r2w-phx4-mgpv/GHSA-8r2w-phx4-mgpv.json → advisories/github-reviewed/2022/05/GHSA-8r2w-phx4-mgpv/GHSA-8r2w-phx4-mgpv.json
+28 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8r2w-phx4-mgpv",
"modified": "2022-11-17T18:30:29Z",
"modified": "2024-04-24T20:34:41Z",
"published": "2022-05-24T17:26:59Z",
"aliases": [
"CVE-2020-13828"
],
"summary": "Dolibarr stored Cross-Site Scripting (XSS) vulnerability",
"details": "Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the subject, message, or address parameter; adherents/card.php with the societe or address parameter; product/card.php with the label or customcode parameter; or societe/card.php with the alias or barcode parameter.",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "11.0.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13828"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-002"
@@ -30,9 +53,9 @@
"cwe_ids": [
"CWE-79"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:34:41Z",
"nvd_published_at": "2020-08-31T16:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-8v7v-6mmm-xjxm/GHSA-8v7v-6mmm-xjxm.json
+61
View File
@@ -0,0 +1,61 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8v7v-6mmm-xjxm",
"modified": "2024-04-24T20:35:18Z",
"published": "2022-05-24T17:20:55Z",
"aliases": [
"CVE-2020-14443"
],
"summary": "Dolibarr SQL injection vulnerability in accountancy/customer/card.php",
"details": "A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.4 and below allows remote authenticated users to execute arbitrary SQL commands via the id parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "11.0.5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14443"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/40e16672e3aa4e9208ea7a4829f30507dcdfc4ba"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:35:18Z",
"nvd_published_at": "2020-06-18T18:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-f848-r5g6-6gpf/GHSA-f848-r5g6-6gpf.json → advisories/github-reviewed/2022/05/GHSA-f848-r5g6-6gpf/GHSA-f848-r5g6-6gpf.json
+19 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f848-r5g6-6gpf",
"modified": "2022-11-17T18:30:29Z",
"modified": "2024-04-24T20:35:34Z",
"published": "2022-05-24T17:18:11Z",
"aliases": [
"CVE-2020-13240"
],
"summary": "Dolibarr Stored Cross-site Scripting",
"details": "The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.",
"severity": [
{
@@ -14,13 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"versions": [
"11.0.4"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13240"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://www.dubget.com/stored-xss-via-file-upload.html"
@@ -29,11 +42,12 @@
"database_specific": {
"cwe_ids": [
"CWE-276",
"CWE-668"
"CWE-668",
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:35:34Z",
"nvd_published_at": "2020-05-20T15:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-fvf9-2hjp-w936/GHSA-fvf9-2hjp-w936.json → advisories/github-reviewed/2022/05/GHSA-fvf9-2hjp-w936/GHSA-fvf9-2hjp-w936.json
+18 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fvf9-2hjp-w936",
"modified": "2022-11-17T18:30:29Z",
"modified": "2024-04-24T20:35:29Z",
"published": "2022-05-24T17:18:12Z",
"aliases": [
"CVE-2020-13239"
],
"summary": "Dolibarr Stored Cross-site Scripting via file upload",
"details": "The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.",
"severity": [
{
@@ -14,13 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"versions": [
"11.0.4"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13239"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://www.dubget.com/stored-xss-via-file-upload.html"
@@ -30,9 +43,9 @@
"cwe_ids": [
"CWE-79"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:35:29Z",
"nvd_published_at": "2020-05-20T15:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-m396-2x3h-v3v4/GHSA-m396-2x3h-v3v4.json
+61
View File
@@ -0,0 +1,61 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m396-2x3h-v3v4",
"modified": "2024-04-24T20:35:00Z",
"published": "2022-05-24T17:21:18Z",
"aliases": [
"CVE-2020-14475"
],
"summary": "Dolibarr reflected cross-site scripting (XSS) vulnerability",
"details": "A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.4 and below allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "11.0.5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14475"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/22ca5e067189bffe8066df26df923a386f044c08"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:35:00Z",
"nvd_published_at": "2020-06-19T17:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-q938-82fw-wfcf/GHSA-q938-82fw-wfcf.json → advisories/github-reviewed/2022/05/GHSA-q938-82fw-wfcf/GHSA-q938-82fw-wfcf.json
+18 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q938-82fw-wfcf",
"modified": "2022-11-17T18:30:29Z",
"modified": "2024-04-24T20:35:39Z",
"published": "2022-05-24T17:15:34Z",
"aliases": [
"CVE-2020-11823"
],
"summary": "Dolibarr stored Cross-site Scripting vulnerability",
"details": "In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page. This may lead to stealing of the admin account.",
"severity": [
{
@@ -14,7 +15,15 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"versions": [
"10.0.6"
]
}
],
"references": [
{
@@ -24,15 +33,19 @@
{
"type": "WEB",
"url": "https://fatihhcelik.blogspot.com/2020/04/dolibarr-stored-xss.html"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:35:39Z",
"nvd_published_at": "2020-04-16T19:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-8v7v-6mmm-xjxm/GHSA-8v7v-6mmm-xjxm.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8v7v-6mmm-xjxm",
"modified": "2022-05-24T17:20:55Z",
"published": "2022-05-24T17:20:55Z",
"aliases": [
"CVE-2020-14443"
],
"details": "A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14443"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/40e16672e3aa4e9208ea7a4829f30507dcdfc4ba"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-18T18:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-m396-2x3h-v3v4/GHSA-m396-2x3h-v3v4.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m396-2x3h-v3v4",
"modified": "2022-11-17T18:30:30Z",
"published": "2022-05-24T17:21:18Z",
"aliases": [
"CVE-2020-14475"
],
"details": "A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14475"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/22ca5e067189bffe8066df26df923a386f044c08"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-19T17:15:00Z"
}
}