netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-98c8-36p9-gw66
GHSA-j772-hpmw-32rm
GHSA-rhjj-f6gq-6gx2
This commit is contained in:
advisory-database[bot]
2024-05-14 21:19:38 +00:00
parent 04c04209ae
commit c7f989bd65
3 changed files with 95 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-98c8-36p9-gw66/GHSA-98c8-36p9-gw66.json → advisories/github-reviewed/2022/05/GHSA-98c8-36p9-gw66/GHSA-98c8-36p9-gw66.json
+32 -5
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-98c8-36p9-gw66",
"modified": "2022-05-17T01:57:32Z",
"modified": "2024-05-14T21:19:05Z",
"published": "2022-05-17T01:57:31Z",
"aliases": [
"CVE-2015-3156"
],
"details": "The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/redis/service.py, _write_mycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::_run_prepare function in trove/guestagent/strategies/restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysql_impl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, _get_actual_db_status function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbase_impl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.",
"summary": "Openstack DBaaS (Trove) Improper Link Resolution Before File Access ",
"details": "The `_write_config` function in `trove/guestagent/datastore/experimental/mongodb/service.py`, `reset_configuration` function in `trove/guestagent/datastore/experimental/postgresql/service/config.py`, `write_config` function in `trove/guestagent/datastore/experimental/redis/service.py`, `_write_mycnf` function in `trove/guestagent/datastore/mysql/service.py`, `InnoBackupEx::_run_prepare` function in `trove/guestagent/strategies/restore/mysql_impl.py`, `InnoBackupEx::cmd` function in `trove/guestagent/strategies/backup/mysql_impl.py`,`MySQLDump::cmd` in `trove/guestagent/strategies/backup/mysql_impl.py`, `InnoBackupExIncremental::cmd` function in `trove/guestagent/strategies/backup/mysql_impl.py`, `_get_actual_db_status` function in `trove/guestagent/datastore/experimental/cassandra/system.py` and `trove/guestagent/datastore/experimental/cassandra/service.py`, and multiple class CbBackup methods in `trove/guestagent/strategies/backup/experimental/couchbase_impl.py` in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.",
"severity": [
{
"type": "CVSS_V3",
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "trove"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.0a0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3156"
},
{
"type": "WEB",
"url": "https://github.com/openstack/trove/commit/61774984aa2bacfe89867fc39a402a6a4cfb8f33"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/trove/+bug/1398195"
@@ -29,6 +52,10 @@
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1216073"
},
{
"type": "PACKAGE",
"url": "https://github.com/openstack/trove"
},
{
"type": "WEB",
"url": "https://github.com/openstack/trove/blob/master/trove/guestagent/datastore/experimental/cassandra/service.py#L230"
@@ -71,8 +98,8 @@
"CWE-59"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:19:05Z",
"nvd_published_at": "2017-08-11T21:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-j772-hpmw-32rm/GHSA-j772-hpmw-32rm.json → advisories/github-reviewed/2022/05/GHSA-j772-hpmw-32rm/GHSA-j772-hpmw-32rm.json
+28 -5
View File
@@ -1,17 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j772-hpmw-32rm",
"modified": "2022-05-17T01:47:00Z",
"modified": "2024-05-14T21:18:27Z",
"published": "2022-05-17T01:47:00Z",
"aliases": [
"CVE-2012-2094"
],
"details": "Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in horizon/static/horizon/js/horizon.js in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the guest console.",
"summary": "OpenStack Horizon Cross-site scripting (XSS) vulnerability",
"details": "Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in `horizon/static/horizon/js/horizon.js` in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the guest console.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "horizon"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
]
}
]
}
],
"references": [
{
@@ -22,6 +41,10 @@
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/7f8c788aa70db98ac904f37fa4197fcabb802942"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/ab2e27522aaeb0268fcc121bd3eff5a4485f313c"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/horizon/+bug/977944"
@@ -60,8 +83,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:18:27Z",
"nvd_published_at": "2012-06-05T22:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-rhjj-f6gq-6gx2/GHSA-rhjj-f6gq-6gx2.json → advisories/github-reviewed/2022/05/GHSA-rhjj-f6gq-6gx2/GHSA-rhjj-f6gq-6gx2.json
+35 -4
View File
@@ -1,23 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rhjj-f6gq-6gx2",
"modified": "2022-05-17T03:17:25Z",
"modified": "2024-05-14T21:19:10Z",
"published": "2022-05-17T03:17:25Z",
"aliases": [
"CVE-2015-3219"
],
"summary": "OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability",
"details": "Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "horizon"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0a0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3219"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/28d8f49786d6df297b2574514916fa782e941e09"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/84da479739fbfff75d9492d00fd0ed1a31ea52b3"
},
{
"type": "WEB",
"url": "https://github.com/openstack/horizon/commit/dab92e7d2f576caea8f81c8e22a516fb45633794"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/horizon/+bug/1453074"
@@ -52,8 +83,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-05-14T21:19:10Z",
"nvd_published_at": "2015-08-20T20:59:00Z"
}
}