netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-c36v-fmgq-m8hx
GHSA-2r5h-6r7v-5m7c
GHSA-5c58-w9xc-qcj9
GHSA-2r5h-6r7v-5m7c
GHSA-5c58-w9xc-qcj9
This commit is contained in:
advisory-database[bot]
2024-04-25 22:11:12 +00:00
parent e95b4e714e
commit ca481b6c2f
5 changed files with 280 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2021/09/GHSA-c36v-fmgq-m8hx/GHSA-c36v-fmgq-m8hx.json
+2 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c36v-fmgq-m8hx",
"modified": "2022-09-11T22:24:21Z",
"modified": "2024-04-25T22:09:12Z",
"published": "2021-09-07T22:57:14Z",
"aliases": [
"CVE-2021-3757"
@@ -25,7 +25,7 @@
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
"introduced": "7.0.0"
},
{
"fixed": "9.0.6"
advisories/github-reviewed/2022/05/GHSA-2r5h-6r7v-5m7c/GHSA-2r5h-6r7v-5m7c.json
+97
View File
@@ -0,0 +1,97 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2r5h-6r7v-5m7c",
"modified": "2024-04-25T22:09:29Z",
"published": "2022-05-17T01:36:50Z",
"aliases": [
"CVE-2013-1348"
],
"summary": "Symphony Vulnerable to PHP Code Injection via YAML Parsing",
"details": "The `Yaml::parse` function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397.",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/symfony"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.22"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/yaml"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.22"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1348"
},
{
"type": "WEB",
"url": "https://github.com/symfony/symfony/commit/ac756bf39e646b4e130fad058d10a0228dbd9779"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81550"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2013-1348.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/yaml/CVE-2013-1348.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/symfony/symfony"
},
{
"type": "WEB",
"url": "https://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20150612022223/http://www.securityfocus.com/bid/57574"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T22:09:29Z",
"nvd_published_at": "2014-06-02T15:55:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-5c58-w9xc-qcj9/GHSA-5c58-w9xc-qcj9.json
+181
View File
@@ -0,0 +1,181 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5c58-w9xc-qcj9",
"modified": "2024-04-25T22:09:04Z",
"published": "2022-05-17T03:34:11Z",
"aliases": [
"CVE-2015-2308"
],
"summary": "Symfony Vulnerable to PHP Eval Injection",
"details": "Applications with ESI support (and SSI support as of Symfony 2.6) enabled and using the Symfony built-in reverse proxy (the `Symfony\\Component\\HttpKernel\\HttpCache class) are vulnerable to PHP code injection; a malicious user can inject PHP code that will be executed by the server.\n\nHttpCache uses eval() to execute files in its cache when they contain ESI tags (and only when ESI is enabled). The vulnerability comes from the fact that PHP allows contents of <script language=\"php\"> tags to be executed (and this kind of PHP tags is always available regardless of the configuration), but there were not escaped before the evaluation.\n\nA possible exploit comes from websites also vulnerable to Cross-Site Scripting as an attacker can successfully conduct a PHP code injection attack by passing such a tag in a user submitted variable (for which proper output escaping was not applied).",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/symfony"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.3.27"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/symfony"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.5.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/symfony"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/http-kernel"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.3.27"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/http-kernel"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.5.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "symfony/http-kernel"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.6"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2308"
},
{
"type": "WEB",
"url": "https://github.com/symfony/symfony/pull/14167/commits/195c57e1f50765aff33137689b16e126a689056a"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2015-2308.yaml"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-2308.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/symfony/symfony"
},
{
"type": "WEB",
"url": "https://symfony.com/blog/cve-2015-2308-esi-code-injection"
},
{
"type": "WEB",
"url": "https://symfony.com/cve-2015-2308"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200228084751/http://www.securityfocus.com/bid/75357"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN19578958/index.html"
},
{
"type": "WEB",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2015-000089"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T22:09:04Z",
"nvd_published_at": "2015-06-24T10:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-2r5h-6r7v-5m7c/GHSA-2r5h-6r7v-5m7c.json
-47
View File
@@ -1,47 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2r5h-6r7v-5m7c",
"modified": "2022-05-17T01:36:50Z",
"published": "2022-05-17T01:36:50Z",
"aliases": [
"CVE-2013-1348"
],
"details": "The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1348"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/81550"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/51980"
},
{
"type": "WEB",
"url": "http://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/57574"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-06-02T15:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-5c58-w9xc-qcj9/GHSA-5c58-w9xc-qcj9.json
-47
View File
@@ -1,47 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5c58-w9xc-qcj9",
"modified": "2022-05-17T03:34:11Z",
"published": "2022-05-17T03:34:11Z",
"aliases": [
"CVE-2015-2308"
],
"details": "Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language=\"php\" attribute of a SCRIPT element.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2308"
},
{
"type": "WEB",
"url": "https://symfony.com/blog/cve-2015-2308-esi-code-injection"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN19578958/index.html"
},
{
"type": "WEB",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2015-000089"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/75357"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-06-24T10:59:00Z"
}
}