netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-6v28-q95m-93qr
GHSA-75v5-6885-59f9
GHSA-9w5h-67gf-xvv8
GHSA-f4hc-q562-cc5r
This commit is contained in:
advisory-database[bot]
2025-03-20 20:51:31 +00:00
parent ac5b819c81
commit ce8deba7bd
4 changed files with 125 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2025/03/GHSA-6v28-q95m-93qr/GHSA-6v28-q95m-93qr.json → advisories/github-reviewed/2025/03/GHSA-6v28-q95m-93qr/GHSA-6v28-q95m-93qr.json
+34 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6v28-q95m-93qr",
"modified": "2025-03-20T12:32:48Z",
"modified": "2025-03-20T20:50:47Z",
"published": "2025-03-20T12:32:48Z",
"aliases": [
"CVE-2024-8524"
],
"summary": "AgentScope directory traversal vulnerability in /read-examples",
"details": "A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint.",
"severity": [
{
@@ -13,12 +14,40 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "agentscope"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8524"
},
{
"type": "PACKAGE",
"url": "https://github.com/modelscope/agentscope"
},
{
"type": "WEB",
"url": "https://github.com/modelscope/agentscope/blob/af8e45ded37b3834c981473b309239e0102473d0/src/agentscope/studio/_app.py#L642"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/cc4acf33-700d-4220-8a8a-db28f5c4cc8f"
@@ -26,11 +55,12 @@
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-73"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-20T20:50:47Z",
"nvd_published_at": "2025-03-20T10:15:42Z"
}
}
advisories/unreviewed/2025/03/GHSA-75v5-6885-59f9/GHSA-75v5-6885-59f9.json → advisories/github-reviewed/2025/03/GHSA-75v5-6885-59f9/GHSA-75v5-6885-59f9.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-75v5-6885-59f9",
"modified": "2025-03-20T12:32:48Z",
"modified": "2025-03-20T20:50:34Z",
"published": "2025-03-20T12:32:48Z",
"aliases": [
"CVE-2024-8487"
],
"summary": "AgentScope Cross-Origin Resource Sharing (CORS) vulnerability",
"details": "A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can lead to unauthorized data access, information disclosure, and potential further exploitation, thereby compromising the integrity and confidentiality of the system.",
"severity": [
{
@@ -13,12 +14,36 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "agentscope"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8487"
},
{
"type": "PACKAGE",
"url": "https://github.com/modelscope/agentscope"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/7aca7507-a94e-4e63-83a2-15648e5c4067"
@@ -29,8 +54,8 @@
"CWE-346"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-20T20:50:34Z",
"nvd_published_at": "2025-03-20T10:15:42Z"
}
}
advisories/unreviewed/2025/03/GHSA-9w5h-67gf-xvv8/GHSA-9w5h-67gf-xvv8.json → advisories/github-reviewed/2025/03/GHSA-9w5h-67gf-xvv8/GHSA-9w5h-67gf-xvv8.json
+29 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9w5h-67gf-xvv8",
"modified": "2025-03-20T12:32:48Z",
"modified": "2025-03-20T20:51:02Z",
"published": "2025-03-20T12:32:48Z",
"aliases": [
"CVE-2024-8502"
],
"summary": "AgentScope Deserialization Vulnerability",
"details": "A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.create_agent method, where serialized input is deserialized using dill.loads, enabling an attacker to execute arbitrary commands on the server.",
"severity": [
{
@@ -13,12 +14,36 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "agentscope"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.6a3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8502"
},
{
"type": "PACKAGE",
"url": "https://github.com/modelscope/agentscope"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/7a42da2a-2ae5-442d-aff9-c9a3b47870eb"
@@ -29,8 +54,8 @@
"CWE-502"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-20T20:51:02Z",
"nvd_published_at": "2025-03-20T10:15:42Z"
}
}
advisories/unreviewed/2025/03/GHSA-f4hc-q562-cc5r/GHSA-f4hc-q562-cc5r.json → advisories/github-reviewed/2025/03/GHSA-f4hc-q562-cc5r/GHSA-f4hc-q562-cc5r.json
+33 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f4hc-q562-cc5r",
"modified": "2025-03-20T12:32:48Z",
"modified": "2025-03-20T20:50:09Z",
"published": "2025-03-20T12:32:48Z",
"aliases": [
"CVE-2024-8438"
],
"summary": "AgentScope Path Traversal in /api/file",
"details": "A path traversal vulnerability exists in modelscope/agentscope version v.0.0.4. The API endpoint `/api/file` does not properly sanitize the `path` parameter, allowing an attacker to read arbitrary files on the server.",
"severity": [
{
@@ -13,12 +14,40 @@
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "agentscope"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8438"
},
{
"type": "PACKAGE",
"url": "https://github.com/modelscope/agentscope"
},
{
"type": "WEB",
"url": "https://github.com/modelscope/agentscope/blob/af8e45ded37b3834c981473b309239e0102473d0/src/agentscope/studio/_app.py#L578"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/3f170c58-42ee-422d-ab6f-32c7aa05b974"
@@ -29,8 +58,8 @@
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2025-03-20T20:50:09Z",
"nvd_published_at": "2025-03-20T10:15:42Z"
}
}