netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-42vg-q6mw-cfh5
GHSA-66j3-66cp-6c2m
GHSA-8hxm-42v5-66hm
GHSA-r2w2-2r2x-fpcx
GHSA-42vg-q6mw-cfh5
GHSA-r2w2-2r2x-fpcx
This commit is contained in:
advisory-database[bot]
2025-04-12 02:33:07 +00:00
parent f4dde9e56e
commit cdfea5dc31
6 changed files with 330 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-42vg-q6mw-cfh5/GHSA-42vg-q6mw-cfh5.json
+79
View File
@@ -0,0 +1,79 @@
{
"schema_version": "1.4.0",
"id": "GHSA-42vg-q6mw-cfh5",
"modified": "2025-04-12T02:31:32Z",
"published": "2022-05-17T05:18:41Z",
"aliases": [
"CVE-2012-1826"
],
"summary": "dotCMS allows remote authenticated users to execute arbitrary Java code",
"details": "dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.dotcms:dotcms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.9"
},
{
"fixed": "1.9.5.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1826"
},
{
"type": "WEB",
"url": "https://github.com/dotCMS/dotCMS/issues/261"
},
{
"type": "WEB",
"url": "https://github.com/dotCMS/dotCMS/issues/281"
},
{
"type": "PACKAGE",
"url": "https://github.com/dotCMS/dotCMS"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20201208044614/https://gist.github.com/jtesser/2627440"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20210124000108/https://www.securityfocus.com/bid/53688"
},
{
"type": "WEB",
"url": "http://dotcms.com/dotCMSVersions"
},
{
"type": "WEB",
"url": "http://www.kb.cert.org/vuls/id/898083"
}
],
"database_specific": {
"cwe_ids": [],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-04-12T02:31:18Z",
"nvd_published_at": "2012-06-08T16:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-66j3-66cp-6c2m/GHSA-66j3-66cp-6c2m.json → advisories/github-reviewed/2022/05/GHSA-66j3-66cp-6c2m/GHSA-66j3-66cp-6c2m.json
+79 -14
View File
@@ -1,14 +1,78 @@
{
"schema_version": "1.4.0",
"id": "GHSA-66j3-66cp-6c2m",
"modified": "2025-04-11T03:58:00Z",
"modified": "2025-04-12T02:30:59Z",
"published": "2022-05-17T01:55:58Z",
"aliases": [
"CVE-2010-5099"
],
"summary": "TYPO3 Path Traversal vulnerability",
"details": "The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file types, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files, as demonstrated using path traversal sequences with %00 null bytes and CVE-2010-3714 to read the TYPO3 encryption key from localconf.php.",
"severity": [],
"affected": [],
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.16"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.3.0"
},
{
"fixed": "4.3.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.4.5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -18,18 +82,18 @@
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64180"
},
{
"type": "PACKAGE",
"url": "https://github.com/TYPO3/typo3"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20120801235059/http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022"
},
{
"type": "WEB",
"url": "http://blog.nibblesec.org/2010/12/typo3-sa-2010-020-typo3-sa-2010-022.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35770"
},
{
"type": "WEB",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/15856"
@@ -53,11 +117,12 @@
],
"database_specific": {
"cwe_ids": [
"CWE-20"
"CWE-20",
"CWE-22"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-04-12T02:30:59Z",
"nvd_published_at": "2012-05-30T20:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-8hxm-42v5-66hm/GHSA-8hxm-42v5-66hm.json → advisories/github-reviewed/2022/05/GHSA-8hxm-42v5-66hm/GHSA-8hxm-42v5-66hm.json
+54 -5
View File
@@ -1,14 +1,59 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8hxm-42v5-66hm",
"modified": "2025-04-11T03:59:08Z",
"modified": "2025-04-12T02:32:03Z",
"published": "2022-05-13T01:13:14Z",
"aliases": [
"CVE-2011-4298"
],
"summary": "Moodle vulnerable to Cross-Site Request Forgery",
"details": "Multiple cross-site request forgery (CSRF) vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data.",
"severity": [],
"affected": [],
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
@@ -18,6 +63,10 @@
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=747444"
},
{
"type": "PACKAGE",
"url": "https://git.moodle.org"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=48346fb11f8ced06a05c0618b02a3a925b34ec59"
@@ -36,8 +85,8 @@
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-04-12T02:32:03Z",
"nvd_published_at": "2012-07-11T10:26:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-r2w2-2r2x-fpcx/GHSA-r2w2-2r2x-fpcx.json
+118
View File
@@ -0,0 +1,118 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r2w2-2r2x-fpcx",
"modified": "2025-04-12T02:30:20Z",
"published": "2022-05-17T01:55:53Z",
"aliases": [
"CVE-2010-5103"
],
"summary": "TYPO3 SQL Injection vulnerability",
"details": "SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.",
"severity": [],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.16"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.3.0"
},
{
"fixed": "4.3.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.4.5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-5103"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64184"
},
{
"type": "PACKAGE",
"url": "https://github.com/TYPO3/typo3"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20120123102224/http://www.securityfocus.com/bid/45470"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20120801235059/http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2011/01/13/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/05/10/7"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/05/11/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/05/12/5"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-04-12T02:30:19Z",
"nvd_published_at": "2012-05-21T20:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-42vg-q6mw-cfh5/GHSA-42vg-q6mw-cfh5.json
-57
View File
@@ -1,57 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-42vg-q6mw-cfh5",
"modified": "2025-04-11T03:58:14Z",
"published": "2022-05-17T05:18:41Z",
"aliases": [
"CVE-2012-1826"
],
"details": "dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1826"
},
{
"type": "WEB",
"url": "https://github.com/dotCMS/dotCMS/issues/261"
},
{
"type": "WEB",
"url": "https://github.com/dotCMS/dotCMS/issues/281"
},
{
"type": "WEB",
"url": "https://gist.github.com/2627440"
},
{
"type": "WEB",
"url": "http://dotcms.com/dotCMSVersions"
},
{
"type": "WEB",
"url": "http://osvdb.org/82240"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/49276"
},
{
"type": "WEB",
"url": "http://www.kb.cert.org/vuls/id/898083"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/53688"
}
],
"database_specific": {
"cwe_ids": [],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-06-08T16:55:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-r2w2-2r2x-fpcx/GHSA-r2w2-2r2x-fpcx.json
-63
View File
@@ -1,63 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r2w2-2r2x-fpcx",
"modified": "2025-04-11T03:57:49Z",
"published": "2022-05-17T01:55:53Z",
"aliases": [
"CVE-2010-5103"
],
"details": "SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via unspecified vectors.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-5103"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64184"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35770"
},
{
"type": "WEB",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2011/01/13/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/05/10/7"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/05/11/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/05/12/5"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/70117"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/45470"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-05-21T20:55:00Z"
}
}