netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-78vx-ggch-wghm
GHSA-rvq6-mrpv-m6rm
This commit is contained in:
advisory-database[bot]
2024-09-16 22:15:24 +00:00
parent ec59940e82
commit d7584de36f
2 changed files with 35 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-78vx-ggch-wghm/GHSA-78vx-ggch-wghm.json
+19 -4
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-78vx-ggch-wghm",
"modified": "2023-08-29T21:47:28Z",
"modified": "2024-09-16T22:14:25Z",
"published": "2022-05-17T05:12:01Z",
"aliases": [
"CVE-2012-3442"
@@ -9,13 +9,20 @@
"summary": "Django Allows Redirect via Data URL",
"details": "The (1) `django.http.HttpResponseRedirect` and (2) `django.http.HttpResponsePermanentRedirect` classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a `data:` URL.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "django"
"name": "Django"
},
"ranges": [
{
@@ -34,7 +41,7 @@
{
"package": {
"ecosystem": "PyPI",
"name": "django"
"name": "Django"
},
"ranges": [
{
@@ -68,6 +75,10 @@
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2012-2.yaml"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2012/jul/30/security-releases-issued"
@@ -76,6 +87,10 @@
"type": "WEB",
"url": "http://www.debian.org/security/2012/dsa-2529"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:143"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2012/07/31/1"
advisories/github-reviewed/2022/05/GHSA-rvq6-mrpv-m6rm/GHSA-rvq6-mrpv-m6rm.json
+16 -9
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rvq6-mrpv-m6rm",
"modified": "2024-05-16T18:28:00Z",
"modified": "2024-09-16T22:13:37Z",
"published": "2022-05-17T03:07:04Z",
"aliases": [
"CVE-2014-0472"
@@ -9,7 +9,14 @@
"summary": "Code Injection in Django",
"details": "The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a \"dotted Python path.\"",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
@@ -51,7 +58,7 @@
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.5.0"
"introduced": "1.5"
},
{
"fixed": "1.5.6"
@@ -75,7 +82,7 @@
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.6.0"
"introduced": "1.6"
},
{
"fixed": "1.6.3"
@@ -106,6 +113,10 @@
"type": "PACKAGE",
"url": "https://github.com/django/django"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/django/PYSEC-2014-1.yaml"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2014/apr/21/security"
@@ -122,10 +133,6 @@
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0457.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/61281"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2014/dsa-2934"
@@ -139,7 +146,7 @@
"cwe_ids": [
"CWE-94"
],
"severity": "MODERATE",
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2023-02-23T23:29:51Z",
"nvd_published_at": "2014-04-23T15:55:00Z"