Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-03 05:16:46 +00:00
parent 35bf236a74
commit dc024b3843
965 changed files with 1348 additions and 4044 deletions
@@ -8,9 +8,7 @@
  ],
  "summary": "jplayer Cross Site Scripting vulnerability",
  "details": "Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, a different vulnerability than CVE-2013-1942 and CVE-2013-2023, as demonstrated by using the alert function in the jQuery parameter.  NOTE: these are the same parameters as CVE-2013-1942, but the fix for CVE-2013-1942 uses a blacklist for the jQuery parameter.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Fat Free CRM allows remote attackers to obtain sensitive information via a direct request",
  "details": "Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for `users/1.json`.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Fat Free CRM vulnerable to SQL Injection",
  "details": "Multiple SQL injection vulnerabilities in `app/controllers/home_controller.rb` in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Fat Free CRM vulnerable to Exposure of Sensitive Information",
  "details": "Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for `users/1.xml`, a different vulnerability than CVE-2013-7224.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Fat Free CRM contains Cross-site Request Forgery vulnerablilities",
  "details": "Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a `protect_from_forgery` line in `app/controllers/application_controller.rb`.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Fat Free CRM subject to Cross-site Scripting",
  "details": "Multiple cross-site scripting (XSS) vulnerabilities in `app/views/layouts/application.html.haml` in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) first name, or (3) last name in a (a) create or (b) edit user action.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Code injection in Apache Zeppelin Shell",
  "details": "Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin.\n\nThe attackers can use Shell interpreter as a code generation gateway, and execute the generated code as a normal way.\nThis issue affects Apache Zeppelin: from 0.10.1 before 0.11.1.\n\nUsers are recommended to upgrade to version 0.11.1, which doesn't have Shell interpreter by default.\n\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-265q-222x-52m6",
  "modified": "2024-05-28T13:01:48Z",
  "published": "2024-05-28T13:01:48Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector",
  "details": "A potential SQL injection vulnerability was identified by using the silverstripe/postgresql database adapter. While unlikely to be exploitable, we have patched silverstripe/framework to ensure that table names are safely escaped before being passed to database adapters or user code.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-55pp-293f-3365",
  "modified": "2024-05-28T17:21:00Z",
  "published": "2024-05-28T17:21:00Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "silverstripe/userforms file upload exposure on UserForms module",
  "details": "The [userforms module](https://github.com/silverstripe/silverstripe-userforms) allows CMS administrators to create public facing forms with file upload abilities. These files are uploaded into a predictable public path on the website, unless configured otherwise by the CMS administrator setting up the form. While the name of the uploaded file itself is not predictable, certain actions taken by CMS authors could expose it. For example, submission notification emails contain a link to the file without authorisation checks.\n\nIn 3.0.0 this field is disabled by default, but re-enabled upon installation of the [secure assets module](https://github.com/silverstripe-labs/silverstripe-secureassets). When this is installed, the field can once again be used within a form, and will automatically lock this folder to a secure list of users, which can then be configured further by an administrator.\n\nExisting file upload fields will not be disabled, but will require re-enabling via config or installation of secure assets to become editable again.\n\nIf any upload field points or is pointed to a folder that is not secured, and the secure assets module is present, then that folder will have the secure permissions applied automatically.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-cwgq-83w5-8jfq",
  "modified": "2024-05-28T12:59:05Z",
  "published": "2024-05-28T12:59:05Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "silverstripe/framework has possible denial of service attack vector when flushing",
  "details": "A possible denial of service attack vector has been identified in the dev/build system controller.\n\ndev/build now has its own URL token, similar to flushtoken, to ensure users are authenticated when running dev/build outside of dev environments.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-m2hh-2m46-x6j5",
  "modified": "2024-05-28T12:53:45Z",
  "published": "2024-05-28T12:53:45Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "silverstripe/framework may disclose database credentials during connection failure",
  "details": "When running SilverStripe 3.7 or 4.x in dev mode with the mysqli database driver, there is a potential to disclose the connection details.\n\nWe have blacklisted the sensitive parts of the connection information from being included in dev mode stack traces when database errors occur.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-p2v5-xcqm-4fv6",
  "modified": "2024-05-28T17:29:03Z",
  "published": "2024-05-28T17:29:03Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "silverstripe/taxonomy SQL Injection vulnerability",
  "details": "There is a vulnerability in silverstripe/taxonomy module that allows SQL injection. This affected controller (`TaxonomyDirectoryController`) is disabled by default and must be enabled by a developer for the exploit to be possible.\n\n",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-ppm4-r2vc-pg74",
  "modified": "2024-05-28T21:26:21Z",
  "published": "2024-05-28T21:26:21Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "SimpleSAMLphp Information Disclosure vulnerability",
  "details": "### Background\nSimpleSAMLphp 1.17 includes a preview of the new user interface to be included in the future version 2.0. This new user interface can be enabled by setting the usenewui configuration option to true, and it includes a new admin interface in a module called admin, which can be disabled.\n\n### Description\nThe new admin interface includes a way to view information about the host where SimpleSAMLphp is installed, by means of the phpinfo() PHP function. An endpoint that exposes the output of that function is included in the admin module for easier debugging.\n\nThe aforementioned endpoint had no checks for administrator privileges. This would allow any individual to access the given endpoint without authenticating, gathering information about the affected system.\n\n### Affected versions\nAll SimpleSAMLphp 1.17 versions up to 1.17.7 are affected, provided that the new, experimental use interface is enabled, together with the new admin module.\n\n### Impact\nAn attacker could leverage this issue by accessing the unprotected endpoint and gather intelligence about the host where SimpleSAMLphp is deployed, using it later for their own advantage in case other issues arise.\n\nHowever, the impact of this issue is deemed as low, given that the new user interface must be explicitly enabled by means of the usenewui configuration option, and the new admin module must also be enabled.\n\n### Resolution\nUpgrade to SimpleSAMLphp 1.17.8 or 1.18. This can be done by downloading the package, or by running composer update. Refer to the documentation for instructions on how to run composer.\n\nAlternatively, the issue can be mitigated by either disabling the new user interface by setting the usenewui configuration option to false, or by disabling the admin module in the configuration:\n```\n    'module.enable' => [\n        ...\n        'admin' => false,\n        ...\n    ],\n```",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-v858-922f-fj9v",
  "modified": "2024-05-28T18:26:35Z",
  "published": "2024-05-28T18:26:35Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "SimpleSAMLphp Link Injection vulnerability",
  "details": "### Background\nSeveral scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out.\n\n### Description\nThe following scripts were not checking the URLs obtained via the HTTP request before displaying them as the target of links that the user may click on:\n\n- www/logout.php\n- modules/core/www/no_cookie.php\nThe issue allowed attackers to display links targeting a malicious website inside a trusted site running SimpleSAMLphp, due to the lack of security checks involving the link_href and retryURL HTTP parameters, respectively. The issue was resolved by including a verification of the URLs received in the request against a white list of websites specified in the trusted.url.domains configuration option.\n\n### Affected versions\nAll SimpleSAMLphp versions prior to 1.14.4.\n\n### Impact\nA remote attacker could craft a link pointing to a trusted website running SimpleSAMLphp, including a parameter pointing to a malicious website, and try to fool the victim into visiting that website by clicking on a link in the page presented by SimpleSAMLphp.\n",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-wjg9-v8cf-f5q2",
  "modified": "2024-05-28T13:13:11Z",
  "published": "2024-05-28T13:13:11Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "silverstripe/graphql Cross-Site Request Forgery vulnerability",
  "details": "The GraphQL controller lacked any CSRF protection, meaning authenticated users could be forced or tricked into visiting a URL that would send a GET request to the affected web server that could mutate or destroy data without the user knowing.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-xc69-p8fc-m6m5",
  "modified": "2024-05-28T18:23:17Z",
  "published": "2024-05-28T18:23:17Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "silverstripe/subsites Unsafe SQL Query Construction (Safe Data Source)",
  "details": "There is a low level potential SQL injection vulnerability in the silverstripe/subsites module has been identified and fixed in version 2.1.1.\n\n",
  "severity": [
@@ -8,9 +8,7 @@
  ],
  "summary": "Server-Side Request Forgery in axios",
  "details": "axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
--- a/Show More
+++ b/Show More