netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-vxmc-5x29-h64v
GHSA-cq5f-wv7p-5gfc
GHSA-fjq9-452g-jg3q
GHSA-x3x9-349x-2485
GHSA-cq5f-wv7p-5gfc
GHSA-fjq9-452g-jg3q
GHSA-x3x9-349x-2485
This commit is contained in:
advisory-database[bot]
2024-11-18 23:47:04 +00:00
parent 3649cf4b00
commit db41310983
7 changed files with 381 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/07/GHSA-vxmc-5x29-h64v/GHSA-vxmc-5x29-h64v.json → advisories/github-reviewed/2024/07/GHSA-vxmc-5x29-h64v/GHSA-vxmc-5x29-h64v.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vxmc-5x29-h64v",
"modified": "2024-07-11T18:31:14Z",
"modified": "2024-11-18T23:46:00Z",
"published": "2024-07-11T18:31:14Z",
"aliases": [
"CVE-2024-6485"
],
"summary": "Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes",
"details": "A security vulnerability has been discovered in bootstrap that could enable Cross-Site Scripting (XSS) attacks. The vulnerability is associated with the data-loading-text attribute within the button plugin. This vulnerability can be exploited by injecting malicious JavaScript code into the attribute, which would then be executed when the button's loading state is triggered.",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "bootstrap"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.4.0"
},
{
"fixed": "3.4.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6485"
},
{
"type": "PACKAGE",
"url": "https://github.com/twbs/bootstrap"
},
{
"type": "WEB",
"url": "https://www.herodevs.com/vulnerability-directory/cve-2024-6485"
@@ -31,8 +54,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-11-18T23:46:00Z",
"nvd_published_at": "2024-07-11T17:15:17Z"
}
}
advisories/github-reviewed/2024/11/GHSA-cq5f-wv7p-5gfc/GHSA-cq5f-wv7p-5gfc.json
+118
View File
@@ -0,0 +1,118 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cq5f-wv7p-5gfc",
"modified": "2024-11-18T23:46:21Z",
"published": "2024-11-18T12:30:43Z",
"aliases": [
"CVE-2024-48896"
],
"summary": "Moodle leaks user names",
"details": "A vulnerability was found in Moodle. It is possible for users with the \"send message\" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.14"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.3.0"
},
{
"fixed": "4.3.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.4.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48896"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318822"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
}
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-11-18T23:46:20Z",
"nvd_published_at": "2024-11-18T12:15:18Z"
}
}
advisories/github-reviewed/2024/11/GHSA-fjq9-452g-jg3q/GHSA-fjq9-452g-jg3q.json
+118
View File
@@ -0,0 +1,118 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fjq9-452g-jg3q",
"modified": "2024-11-18T23:46:44Z",
"published": "2024-11-18T12:30:43Z",
"aliases": [
"CVE-2024-48898"
],
"summary": "moodle: Some users can delete audiences of other reports",
"details": "A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.14"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.3.0"
},
{
"fixed": "4.3.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.4.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48898"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318820"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-11-18T23:46:44Z",
"nvd_published_at": "2024-11-18T12:15:18Z"
}
}
advisories/github-reviewed/2024/11/GHSA-x3x9-349x-2485/GHSA-x3x9-349x-2485.json
+118
View File
@@ -0,0 +1,118 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x3x9-349x-2485",
"modified": "2024-11-18T23:46:24Z",
"published": "2024-11-18T12:30:43Z",
"aliases": [
"CVE-2024-48897"
],
"summary": "moodle: IDOR in edit/delete RSS feed",
"details": "A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.14"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.3.0"
},
{
"fixed": "4.3.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.4.0"
},
{
"fixed": "4.4.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48897"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318821"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
}
],
"database_specific": {
"cwe_ids": [
"CWE-285"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-11-18T23:46:24Z",
"nvd_published_at": "2024-11-18T12:15:18Z"
}
}
advisories/unreviewed/2024/11/GHSA-cq5f-wv7p-5gfc/GHSA-cq5f-wv7p-5gfc.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cq5f-wv7p-5gfc",
"modified": "2024-11-18T18:30:55Z",
"published": "2024-11-18T12:30:43Z",
"aliases": [
"CVE-2024-48896"
],
"details": "A vulnerability was found in Moodle. It is possible for users with the \"send message\" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48896"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318822"
}
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-18T12:15:18Z"
}
}
advisories/unreviewed/2024/11/GHSA-fjq9-452g-jg3q/GHSA-fjq9-452g-jg3q.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fjq9-452g-jg3q",
"modified": "2024-11-18T18:30:55Z",
"published": "2024-11-18T12:30:43Z",
"aliases": [
"CVE-2024-48898"
],
"details": "A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48898"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318820"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-18T12:15:18Z"
}
}
advisories/unreviewed/2024/11/GHSA-x3x9-349x-2485/GHSA-x3x9-349x-2485.json
-35
View File
@@ -1,35 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x3x9-349x-2485",
"modified": "2024-11-18T12:30:43Z",
"published": "2024-11-18T12:30:43Z",
"aliases": [
"CVE-2024-48897"
],
"details": "A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48897"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318821"
}
],
"database_specific": {
"cwe_ids": [
"CWE-285"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-18T12:15:18Z"
}
}