netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-9f57-9rhg-4hvm
GHSA-9gff-5v8w-x922
GHSA-q4xq-445g-g6ch
GHSA-vxm9-8mfw-vc6g
GHSA-x5vx-95h7-rv4p
This commit is contained in:
advisory-database[bot]
2025-02-20 20:20:10 +00:00
parent 8e65a670db
commit cd1a04bbca
5 changed files with 219 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/02/GHSA-9f57-9rhg-4hvm/GHSA-9f57-9rhg-4hvm.json → advisories/github-reviewed/2025/02/GHSA-9f57-9rhg-4hvm/GHSA-9f57-9rhg-4hvm.json
+33 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9f57-9rhg-4hvm",
"modified": "2025-02-20T03:32:03Z",
"modified": "2025-02-20T20:18:50Z",
"published": "2025-02-20T03:32:03Z",
"aliases": [
"CVE-2025-23020"
],
"summary": "Kwik hash collision vulnerability",
"details": "An issue was discovered in Kwik before 0.10.1. A hash collision vulnerability (in the hash table used to manage connections) allows remote attackers to cause a considerable CPU load on the server (a Hash DoS attack) by initiating connections with colliding Source Connection IDs (SCIDs).",
"severity": [
{
@@ -13,16 +14,44 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "tech.kwik:kwik"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.10.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23020"
},
{
"type": "WEB",
"url": "https://github.com/ptrd/kwik/commit/b0733d72bad76bc5d8df2f4a7792ebb2539ebdc8"
},
{
"type": "WEB",
"url": "https://github.com/ncc-pbottine/QUIC-Hash-Dos-Advisory"
},
{
"type": "PACKAGE",
"url": "https://github.com/ptrd/kwik"
},
{
"type": "WEB",
"url": "https://github.com/ptrd/kwik/releases/tag/v0.10.1"
@@ -33,8 +62,8 @@
"CWE-407"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-02-20T20:18:50Z",
"nvd_published_at": "2025-02-20T03:15:12Z"
}
}
advisories/unreviewed/2025/02/GHSA-9gff-5v8w-x922/GHSA-9gff-5v8w-x922.json → advisories/github-reviewed/2025/02/GHSA-9gff-5v8w-x922/GHSA-9gff-5v8w-x922.json
+30 -5
View File
@@ -1,19 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9gff-5v8w-x922",
"modified": "2025-02-20T12:31:15Z",
"modified": "2025-02-20T20:18:36Z",
"published": "2025-02-20T12:31:15Z",
"aliases": [
"CVE-2025-0868"
],
"summary": "DocsGPT Allows Remote Code Execution",
"details": "A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint.\n\nThis issue affects DocsGPT: from 0.8.1 through 0.12.0.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "docsgpt"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0.8.1"
},
{
"last_affected": "0.12.0"
}
]
}
]
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -30,6 +51,10 @@
{
"type": "WEB",
"url": "https://github.com/arc53/DocsGPT"
},
{
"type": "PACKAGE",
"url": "https://github.com/arc53/docsgpt"
}
],
"database_specific": {
@@ -37,8 +62,8 @@
"CWE-77"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-02-20T20:18:36Z",
"nvd_published_at": "2025-02-20T12:15:10Z"
}
}
advisories/unreviewed/2025/02/GHSA-q4xq-445g-g6ch/GHSA-q4xq-445g-g6ch.json → advisories/github-reviewed/2025/02/GHSA-q4xq-445g-g6ch/GHSA-q4xq-445g-g6ch.json
+31 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q4xq-445g-g6ch",
"modified": "2025-02-18T18:33:21Z",
"modified": "2025-02-20T20:19:28Z",
"published": "2025-02-18T18:33:21Z",
"aliases": [
"CVE-2024-4028"
],
"summary": "Keycloak allows cross-site scripting (XSS)",
"details": "A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items (Resource and Permissions) from the admin console, leading to a stored cross-site scripting (XSS) attack.",
"severity": [
{
@@ -13,7 +14,27 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "26.1.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -26,15 +47,20 @@
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2276418"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
"CWE-20",
"CWE-79"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-02-20T20:19:28Z",
"nvd_published_at": "2025-02-18T18:15:25Z"
}
}
advisories/unreviewed/2025/02/GHSA-vxm9-8mfw-vc6g/GHSA-vxm9-8mfw-vc6g.json → advisories/github-reviewed/2025/02/GHSA-vxm9-8mfw-vc6g/GHSA-vxm9-8mfw-vc6g.json
+33 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vxm9-8mfw-vc6g",
"modified": "2025-02-20T03:32:03Z",
"modified": "2025-02-20T20:19:01Z",
"published": "2025-02-20T03:32:03Z",
"aliases": [
"CVE-2025-1293"
],
"summary": "Hermes improperly validates a JWT",
"details": "Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. This vulnerability, CVE-2025-1293, was fixed in Hermes 0.5.0.",
"severity": [
{
@@ -13,15 +14,43 @@
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp-forge/hermes"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1293"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp-forge/hermes/commit/e36d479616099bd0c8dfde6786ea671f112d9106"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2025-03-hashicorp-hermes-improperly-validates-aws-alb-jwts-which-may-lead-to-authentication-bypass/73371"
},
{
"type": "PACKAGE",
"url": "https://github.com/hashicorp-forge/hermes"
}
],
"database_specific": {
@@ -29,8 +58,8 @@
"CWE-1390"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-02-20T20:19:01Z",
"nvd_published_at": "2025-02-20T01:15:09Z"
}
}
advisories/github-reviewed/2025/02/GHSA-x5vx-95h7-rv4p/GHSA-x5vx-95h7-rv4p.json
+92
View File
File diff suppressed because one or more lines are too long