mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Advisory Database Sync
This commit is contained in:
advisory-database[bot]
@@ -50,9 +50,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-02-08T18:47:28Z",
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-229x-22xc-2f2w",
|
||||
"modified": "2024-06-07T21:39:43Z",
|
||||
"published": "2024-06-07T21:39:43Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Zendframework Local file disclosure via XXE injection in Zend_XmlRpc",
|
||||
"details": "Zend_XmlRpc is vulnerable to XML eXternal Entity (XXE) Injection attacks. The SimpleXMLElement class (SimpleXML PHP extension) is used in an insecure way to parse XML data. External entities can be specified by adding a specific DOCTYPE element to XML-RPC requests. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.\n\n",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-2jx7-xg83-j2m7",
|
||||
"modified": "2024-06-07T21:39:23Z",
|
||||
"published": "2024-06-07T21:39:23Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Zendframework Denial of Service vector via XEE injection",
|
||||
"details": "`Zend_Dom`, `Zend_Feed`, `Zend_Soap`, and `Zend_XmlRpc` are vulnerable to XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.\n\n",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-2x36-qhx3-7m5f",
|
||||
"modified": "2024-06-07T22:24:52Z",
|
||||
"published": "2024-06-07T22:24:52Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select",
|
||||
"details": "The implementation of the ORDER BY SQL statement in Zend_Db_Select of Zend Framework 1 contains a potential SQL injection when the query string passed contains parentheses.\n\nFor instance, the following code is affected by this issue:\n```\n$db = Zend_Db::factory( /* options here */ );\n$select = $db->select()\n ->from(array('p' => 'products'))\n ->order('MD5(1); drop table products');\necho $select;\n```\nThis code produce the string:\n```\nSELECT \"p\".* FROM \"products\" AS \"p\" ORDER BY MD5(1);drop table products ASC\n```\ninstead of the correct one:\n```\nSELECT \"p\".* FROM \"products\" AS \"p\" ORDER BY \"MD5(1);drop table products\" ASC\n```\nThe SQL injection occurs because we create a new Zend_Db_Expr() object, in presence of parentheses, passing directly the value without any filter on the string.",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-4j9x-g4x8-vcmf",
|
||||
"modified": "2024-06-07T21:15:56Z",
|
||||
"published": "2024-06-07T21:15:56Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "ZendFramework potential XML eXternal Entity injection vectors",
|
||||
"details": "`Zend_Feed_Rss` and `Zend_Feed_Atom` were found to contain potential XML eXternal Entity (XXE) vectors due to insecure usage of PHP's DOM extension. External entities could be specified by adding a specific DOCTYPE element to feeds; exploiting this vulnerability could coerce opening arbitrary files and/or TCP connections.\n\nA similar issue was fixed for 1.11.13 and 1.12.0, in the `Zend_Feed::import()` factory method; however, the reporter of the issue discovered that the individual classes contained similar functionality in their constructors which remained vulnerable.",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-4v57-pwvf-x35j",
|
||||
"modified": "2024-06-07T21:59:20Z",
|
||||
"published": "2024-06-07T21:59:20Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Zendframework potential Cross-site Scripting vector in `Zend_Service_ReCaptcha_MailHide`",
|
||||
"details": "`Zend_Service_ReCaptcha_MailHide` had a potential XSS vulnerability. Due to the fact that the email address was never validated, and because its use of `htmlentities()` did not include the encoding argument, it was potentially possible for a malicious user aware of the issue to inject a specially crafted multibyte string as an attack via the CAPTCHA's email argument",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-4vf6-mq7w-3hp6",
|
||||
"modified": "2024-06-07T22:09:17Z",
|
||||
"published": "2024-06-07T22:09:17Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Zend_Filter_StripTags vulnerable to Cross-site Scripting when comments allowed",
|
||||
"details": "Zend_Filter_StripTags contained an optional setting to allow whitelisting HTML comments in filtered text. Microsoft Internet Explorer and several other browsers allow developers to create conditional functionality via HTML comments, including execution of script events and rendering of additional commented markup. By allowing whitelisting of HTML comments, a malicious user could potentially include XSS exploits within HTML comments that would then be rendered in the final output.\n\n",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-6fqw-j3vm-7f66",
|
||||
"modified": "2024-06-07T22:27:32Z",
|
||||
"published": "2024-06-07T22:27:32Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Zendframework1 Potential SQL injection in ORDER and GROUP functions",
|
||||
"details": "The implementation of ORDER BY and GROUP BY in Zend_Db_Select remained prone to SQL injection when a combination of SQL expressions and comments were used. This security patch provides a comprehensive solution that identifies and removes comments prior to checking validity of the statement to ensure no SQLi vectors occur.\n\nThe implementation of ORDER BY and GROUP BY in Zend_Db_Select of ZF1 is vulnerable by the following SQL injection:\n```\n$db = Zend_Db::factory(/* options here */);\n$select = new Zend_Db_Select($db);\n$select->from('p');\n$select->order(\"MD5(\\\"a(\\\");DELETE FROM p2; #)\"); // same with group()\n```\nThe above $select will render the following SQL statement:\n```\nSELECT `p`.* FROM `p` ORDER BY MD5(\"a(\");DELETE FROM p2; #) ASC\n```\ninstead of the correct one:\n```\nSELECT \"p\".* FROM \"p\" ORDER BY \"MD5(\"\"a(\"\");DELETE FROM p2; #)\" ASC\n```\nThis security fix can be considered an improvement of the previous ZF2016-02 and ZF2014-04 advisories.\n\nAs a final consideration, we recommend developers either never use user input for these operations, or filter user input thoroughly prior to invoking Zend_Db. You can use the Zend_Db_Select::quoteInto() method to filter the input data, as shown in this example:\n```\n$db = Zend_Db::factory(...);\n$input = \"MD5(\\\"a(\\\");DELETE FROM p2; #)\"; // user input can be an attack\n$order = $db->quoteInto(\"SQL statement for ORDER\", $input);\n\n$select = new Zend_Db_Select($db);\n$select->from('p');\n$select->order($order); // same with group()\n```",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-6v7p-5qcq-268c",
|
||||
"modified": "2024-06-07T22:06:01Z",
|
||||
"published": "2024-06-07T22:06:01Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Zend-Navigation vulnerable to Cross-site Scripting",
|
||||
"details": "Many Zend Framework 2 view helpers were using the `escapeHtml()` view helper in order to escape HTML attributes, instead of the more appropriate `escapeHtmlAttr()`. In situations where user data and/or JavaScript is used to seed attributes, this can lead to potential cross site scripting (XSS) attack vectors.\n\nVulnerable view helpers include:\n\n- All `Zend\\Form` view helpers.\n- Most `Zend\\Navigation` (aka `Zend\\View\\Helper\\Navigation\\*`) view helpers.\n- All \"HTML Element\" view helpers: `htmlFlash()`, `htmlPage()`, `htmlQuickTime()`.\n- `Zend\\View\\Helper\\Gravatar`",
|
||||
"severity": [
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-78hm-5hjw-58mh",
|
||||
"modified": "2024-06-07T22:15:42Z",
|
||||
"published": "2024-06-07T22:14:49Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "ua-parser/uap-php ReDoS vulnerability",
|
||||
"details": "A regex expression in ua-parser/uap-php could lead to a ReDoS vulnerability in versions prior to 3.8.0.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-848f-mph5-9pm9",
|
||||
"modified": "2024-06-07T22:27:02Z",
|
||||
"published": "2024-06-07T22:27:02Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability",
|
||||
"details": "In Zend Framework, Zend_Captcha_Word (v1) and Zend\\Captcha\\Word (v2) generate a \"word\" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal array_rand() function. This function does not generate sufficient entropy due to its usage of rand() instead of more cryptographically secure methods such as openssl_pseudo_random_bytes(). This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-8x2v-pcg7-94f4",
|
||||
"modified": "2024-06-07T21:49:11Z",
|
||||
"published": "2024-06-07T21:49:11Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Zend-JSON vulnerable to XXE/XEE attacks",
|
||||
"details": "Numerous components utilizing PHP's DOMDocument, SimpleXML, and xml_parse functionality are vulnerable to two types of attacks:\n\n- XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.\n- XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-8xhv-gqm4-3w99",
|
||||
"modified": "2024-06-07T22:26:25Z",
|
||||
"published": "2024-06-07T22:26:25Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "ZendFramework1 Potential Insufficient Entropy Vulnerability",
|
||||
"details": "We discovered several methods used to generate random numbers in ZF1 that potentially used insufficient entropy. These random number generators are used in the following method calls:\n```\nZend_Ldap_Attribute::createPassword\nZend_Form_Element_Hash::_generateHash\nZend_Gdata_HttpClient::filterHttpRequest\nZend_Filter_Encrypt_Mcrypt::_srand\nZend_OpenId::randomBytes\n```\nIn each case, the methods were using rand() or mt_rand(), neither of which can generate cryptographically secure values. This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.\n\nMoreover, we discovered a potential security issue in the usage of the [openssl_random_pseudo_bytes()](http://php.net/manual/en/function.openssl-random-pseudo-bytes.php) function in Zend_Crypt_Math::randBytes, reported in PHP BUG [#70014](https://bugs.php.net/bug.php?id=70014), and the security implications reported in a discussion [on the random_compat library.](https://github.com/paragonie/random_compat/issues/96)",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-97h7-mf38-g9mf",
|
||||
"modified": "2024-06-07T22:19:44Z",
|
||||
"published": "2024-06-07T22:19:44Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Adminer file disclosure vulnerability",
|
||||
"details": "Adminer script versions up to 4.6.2 contains file disclosure vulnerability.",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-9v78-h226-2rmq",
|
||||
"modified": "2024-06-07T22:24:08Z",
|
||||
"published": "2024-06-07T22:24:08Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Zendframework potential security issue in login mechanism",
|
||||
"details": "Using the Consumer component of ZendOpenId (or Zend_OpenId in ZF1), it is possible to login using an arbitrary OpenID account (without knowing any secret information) by using a malicious OpenID Provider. That means OpenID it is possible to login using arbitrary OpenID Identity (MyOpenID, Google, etc), which are not under the control of our own OpenID Provider. Thus, we are able to impersonate any OpenID Identity against the framework.\n\nMoreover, the Consumer accepts OpenID tokens with arbitrary signed elements. The framework does not check if, for example, both openid.claimed_id and openid.endpoint_url are signed. It is just sufficient to sign one parameter. According to https://openid.net/specs/openid-authentication-2_0.html#positive_assertions, at least op_endpoint, return_to, response_nonce, assoc_handle, and, if present in the response, claimed_id and identity, must be signed.",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-cg8w-5jrc-675g",
|
||||
"modified": "2024-06-07T21:52:12Z",
|
||||
"published": "2024-06-07T21:52:12Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Zend-HTTP URL Rewrite vulnerability",
|
||||
"details": "zend-diactoros (and, by extension, Expressive), zend-http (and, by extension, Zend Framework MVC projects), and zend-feed (specifically, its PubSubHubbub sub-component) each contain a potential URL rewrite exploit. In each case, marshaling a request URI includes logic that introspects HTTP request headers that are specific to a given server-side URL rewrite mechanism.\n\nWhen these headers are present on systems not running the specific URL rewriting mechanism, the logic would still trigger, allowing a malicious client or proxy to emulate the headers to request arbitrary content.",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-cxf7-m5g2-v594",
|
||||
"modified": "2024-06-07T21:20:03Z",
|
||||
"published": "2024-06-07T21:19:22Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Zend-Mail remote code execution in zend-mail via Sendmail adapter",
|
||||
"details": "When using the zend-mail component to send email via the `Zend\\Mail\\Transport\\Sendmail` transport, a malicious user may be able to inject arbitrary parameters to the system sendmail program. The attack is performed by providing additional quote characters within an address; when unsanitized, they can be interpreted as additional command line arguments, leading to the vulnerability.\n\nThe following example demonstrates injecting additional parameters to the sendmail binary via the From address:\n```\nuse Zend\\Mail;\n\n$mail = new Mail\\Message();\n$mail->setBody('This is the text of the email.');\n\n// inject additional parameters to sendmail command line\n$mail->setFrom('\"AAA\\\" params injection\"@domain', 'Sender\\'s name');\n\n$mail->addTo('hacker@localhost', 'Name of recipient');\n$mail->setSubject('TestSubject');\n\n$transport = new Mail\\Transport\\Sendmail();\n$transport->send($mail);\n```\nThe attack works because zend-mail filters the email addresses using the RFC 3696 specification, where the string \"AAA\\\" params injection\"@domain is considered a valid address. This validation is provided using the zend-validator component with the following parameters:\n```\nZend\\Validator\\EmailAddress(\n Zend\\Validator\\Hostname::ALLOW_DNS | Zend\\Validator\\Hostname::ALLOW_LOCAL\n)\n```\nThe above accepts local domain with any string specified by double quotes as the local part. While this is valid per RFC 3696, due to the fact that sender email addresses are provided to the sendmail binary via the command line, they create the vulnerability described above.",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-fq4p-86hh-42v9",
|
||||
"modified": "2024-06-07T22:07:30Z",
|
||||
"published": "2024-06-07T22:07:30Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Zend-Diactoros URL Rewrite vulnerability",
|
||||
"details": "zend-diactoros (and, by extension, Expressive), zend-http (and, by extension, Zend Framework MVC projects), and zend-feed (specifically, its PubSubHubbub sub-component) each contain a potential URL rewrite exploit. In each case, marshaling a request URI includes logic that introspects HTTP request headers that are specific to a given server-side URL rewrite mechanism.\n\nWhen these headers are present on systems not running the specific URL rewriting mechanism, the logic would still trigger, allowing a malicious client or proxy to emulate the headers to request arbitrary content.",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-gvpp-6jrj-5pqc",
|
||||
"modified": "2024-06-07T21:58:34Z",
|
||||
"published": "2024-06-07T21:58:34Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "Zend-Form vulnerable to Cross-site Scripting",
|
||||
"details": "Many Zend Framework 2 view helpers were using the escapeHtml() view helper in order to escape HTML attributes, instead of the more appropriate escapeHtmlAttr(). In situations where user data and/or JavaScript is used to seed attributes, this can lead to potential cross site scripting (XSS) attack vectors.\n\nVulnerable view helpers include:\n\n- All `Zend\\Form` view helpers.\n- Most `Zend\\Navigation` (aka `Zend\\View\\Helper\\Navigation\\*`) view helpers.\n- All \"HTML Element\" view helpers: `htmlFlash()`, `htmlPage()`, `htmlQuickTime()`.\n- `Zend\\View\\Helper\\Gravatar`",
|
||||
"severity": [
|
||||
|
||||
@@ -3,9 +3,7 @@
|
||||
"id": "GHSA-gwpm-pm6x-h7rj",
|
||||
"modified": "2024-06-07T21:38:38Z",
|
||||
"published": "2024-06-07T21:38:38Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "ZendFramework Cross-site Scripting vector in `Zend_Filter_StripTags`",
|
||||
"details": "`Zend_Filter_StripTags` is a filtering class analogous to PHP's `strip_tags()` function. In addition to stripping HTML tags and selectively keeping those provided in a whitelist, it also provides the ability to whitelist specific attributes to retain per whitelisted tag.\n\nThe reporter discovered that attributes that contained whitespace, and in paricular, line breaks, surrounding the attribute assignment operator would not be stripped, regardless of whether or not they were whitelisted. As examples of input affected:\n```\n<!-- newlines before and/or after assignment: -->\n<a href=\"http://framework.zend.com/issues\" onclick\n=\n\"alert('Broken'); return false;\">Issues</a>\n```\nWhen passed to the following code:\n```\n$filter = new Zend_Filter_StripTags(array('a' => array('href')));\n$value = $filter->($html);\n```\nthen the \"onclick\" attribute would remain, even though it was not specified in the tag's whitelist. This could open potential cross-site scripting attack (XSS) vectors.\n\n## Recommendations\nIf you were using `Zend_Filter_StripTags` and utlizing the attribute whitelisting functionality, you should immediately upgrade to Zend Framework 1.7.6 or above; regardless, it is always best to run the most current version of the framework.\n\nAlso, if relying on `Zend_Filter_StripTags` to prevent XSS, the only way to reliably do so is to strip all tags, and never to whitelist. If you are whitelisting, you should consider finding a reliable XSS filter through which to run your output; we recommend HTML Purifier.",
|
||||
"severity": [
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user