netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-32f8-hmr3-7vxg
GHSA-878h-rqcq-mv3x
GHSA-m5vv-6r4h-3vj9
GHSA-qfjh-mvq6-c5p8
GHSA-m5vv-6r4h-3vj9
This commit is contained in:
advisory-database[bot]
2024-06-11 19:57:32 +00:00
parent 1f107541b6
commit d90333d6b4
5 changed files with 303 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/06/GHSA-32f8-hmr3-7vxg/GHSA-32f8-hmr3-7vxg.json → advisories/github-reviewed/2024/06/GHSA-32f8-hmr3-7vxg/GHSA-32f8-hmr3-7vxg.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-32f8-hmr3-7vxg",
"modified": "2024-06-11T18:30:50Z",
"modified": "2024-06-11T19:57:05Z",
"published": "2024-06-11T18:30:50Z",
"aliases": [
"CVE-2024-35252"
],
"summary": "Azure Storage Movement Client Library Denial of Service Vulnerability",
"details": "Azure Storage Movement Client Library Denial of Service Vulnerability",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.Azure.Storage.DataMovement"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35252"
},
{
"type": "PACKAGE",
"url": "https://github.com/Azure/azure-storage-net-data-movement"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35252"
@@ -31,8 +54,8 @@
"CWE-1104"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-06-11T19:57:04Z",
"nvd_published_at": "2024-06-11T17:16:02Z"
}
}
advisories/unreviewed/2024/06/GHSA-878h-rqcq-mv3x/GHSA-878h-rqcq-mv3x.json → advisories/github-reviewed/2024/06/GHSA-878h-rqcq-mv3x/GHSA-878h-rqcq-mv3x.json
+28 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-878h-rqcq-mv3x",
"modified": "2024-06-11T15:31:08Z",
"modified": "2024-06-11T19:56:07Z",
"published": "2024-06-04T21:32:21Z",
"aliases": [
"CVE-2024-37273"
],
"summary": "Jan path traversal vulnerability",
"details": "An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@janhq/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.1.11"
}
]
}
]
}
],
"references": [
{
@@ -24,15 +43,20 @@
{
"type": "WEB",
"url": "https://github.com/HackAllSec/CVEs/tree/main/Jan%20Arbitrary%20File%20Upload%20vulnerability"
},
{
"type": "PACKAGE",
"url": "https://github.com/janhq/jan"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-434"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-06-11T19:56:07Z",
"nvd_published_at": "2024-06-04T19:20:15Z"
}
}
advisories/github-reviewed/2024/06/GHSA-m5vv-6r4h-3vj9/GHSA-m5vv-6r4h-3vj9.json
+221
View File
@@ -0,0 +1,221 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m5vv-6r4h-3vj9",
"modified": "2024-06-11T19:57:01Z",
"published": "2024-06-11T18:30:50Z",
"aliases": [
"CVE-2024-35255"
],
"summary": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability",
"details": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "azure-identity"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.16.1"
}
]
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@azure/identity"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.1"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.azure:azure-identity"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.12.2"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "msal"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.28.0"
}
]
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@azure/msal-node"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.9.2"
}
]
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.Identity.Client"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.61.3"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/Azure/azure-sdk-for-go/sdk/azidentity"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.6.0"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.microsoft.azure:msal4j"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.15.1"
}
]
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Azure.Identity"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.11.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35255"
},
{
"type": "WEB",
"url": "https://github.com/Azure/azure-sdk-for-go/commit/50774cd9709905523136fb05e8c85a50e8984499"
},
{
"type": "WEB",
"url": "https://github.com/Azure/azure-sdk-for-js/commit/c6aa75d312ae463e744163cedfd8fc480cc8d492"
},
{
"type": "WEB",
"url": "https://github.com/Azure/azure-sdk-for-python/commit/cb065acd7d0f957327dc4f02d1646d4e51a94178"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255"
}
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-06-11T19:57:01Z",
"nvd_published_at": "2024-06-11T17:16:03Z"
}
}
advisories/unreviewed/2024/06/GHSA-qfjh-mvq6-c5p8/GHSA-qfjh-mvq6-c5p8.json → advisories/github-reviewed/2024/06/GHSA-qfjh-mvq6-c5p8/GHSA-qfjh-mvq6-c5p8.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qfjh-mvq6-c5p8",
"modified": "2024-06-11T15:31:08Z",
"modified": "2024-06-11T19:56:05Z",
"published": "2024-06-04T21:32:20Z",
"aliases": [
"CVE-2024-36858"
],
"summary": "Jan path traversal vulnerability",
"details": "An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@janhq/core"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.1.11"
}
]
}
]
}
],
"references": [
{
@@ -24,6 +43,10 @@
{
"type": "WEB",
"url": "https://github.com/HackAllSec/CVEs/tree/main/Jan%20Arbitrary%20File%20Upload%20vulnerability"
},
{
"type": "PACKAGE",
"url": "https://github.com/janhq/jan"
}
],
"database_specific": {
@@ -31,8 +54,8 @@
"CWE-434"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-06-11T19:56:05Z",
"nvd_published_at": "2024-06-04T19:20:14Z"
}
}
advisories/unreviewed/2024/06/GHSA-m5vv-6r4h-3vj9/GHSA-m5vv-6r4h-3vj9.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m5vv-6r4h-3vj9",
"modified": "2024-06-11T18:30:50Z",
"published": "2024-06-11T18:30:50Z",
"aliases": [
"CVE-2024-35255"
],
"details": "Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35255"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-35255"
}
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-11T17:16:03Z"
}
}