diff --git a/advisories/github-reviewed/2021/05/GHSA-xg2h-wx96-xgxr/GHSA-xg2h-wx96-xgxr.json b/advisories/github-reviewed/2021/05/GHSA-xg2h-wx96-xgxr/GHSA-xg2h-wx96-xgxr.json index 8f9b6eb52de..dc15002c45b 100644 --- a/advisories/github-reviewed/2021/05/GHSA-xg2h-wx96-xgxr/GHSA-xg2h-wx96-xgxr.json +++ b/advisories/github-reviewed/2021/05/GHSA-xg2h-wx96-xgxr/GHSA-xg2h-wx96-xgxr.json @@ -3,14 +3,10 @@ "id": "GHSA-xg2h-wx96-xgxr", "modified": "2024-05-20T21:15:51Z", "published": "2021-05-21T16:26:06Z", - "aliases": [ - - ], + "aliases": [], "summary": "RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be", "details": "### Impact\n\nA security-sensitive bug was discovered by Open Source Developer *Erik Sundell of Sundell Open Source Consulting AB*.\n\nThe functions `RandomAlphaNumeric(int)` and `CryptoRandomAlphaNumeric(int)` are not as random as they should be. Small values of `int` in the functions above will return a smaller subset of results than they should. For example, `RandomAlphaNumeric(1)` will always return a digit in the 0-9 range, while `RandomAlphaNumeric(4)` will return around ~7 million of the ~13M possible permutations.\n\nThis is considered a security release because programs that rely upon random generators for passwords are at an increased risk of brute force-style password guessing. There is also a higher probability of collision.\n\nThe problem was the result of a mistaken regular expression that only accepted random strings if they contained a digit from `[0-9]`. That restriction has been removed.\n\n### Patches\n\nThis issue has been corrected in v1.1.1.\n\n### Workarounds\n\nIf you cannot upgrade to v1.1.1, you can work around the issue by calling `RandomAlphaNumericCustom(N, true, true)`|`CryptoRandomAlphaNumericCustom(N, true, true)` instead. (Where `N` is the desired length, and `true` is the literal boolean `true`.) ", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { @@ -55,9 +51,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "LOW", "github_reviewed": true, "github_reviewed_at": "2021-05-21T14:36:56Z", diff --git a/advisories/github-reviewed/2021/06/GHSA-56hp-xqp3-w2jf/GHSA-56hp-xqp3-w2jf.json b/advisories/github-reviewed/2021/06/GHSA-56hp-xqp3-w2jf/GHSA-56hp-xqp3-w2jf.json index e0a2829156d..997aa4c3add 100644 --- a/advisories/github-reviewed/2021/06/GHSA-56hp-xqp3-w2jf/GHSA-56hp-xqp3-w2jf.json +++ b/advisories/github-reviewed/2021/06/GHSA-56hp-xqp3-w2jf/GHSA-56hp-xqp3-w2jf.json @@ -8,9 +8,7 @@ ], "summary": "Helm passes repository credentials to alternate domain", "details": "While working on the Helm source, a Helm core maintainer discovered a situation where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository.\n\n### Impact\n\nThe `index.yaml` within a Helm chart repository contains a reference where to get the chart archive for each version of a chart. The reference can be relative to the `index.yaml` file or a URL to location. The URL can point to any domain and this is a feature leveraged by Helm users. For example, an `index.yaml` file can be hosted on GitHub pages while the chart archives are hosted as GitHub releases. These are on different domain names and the `index.yaml` file points to the other domain.\n\nWhen a username and password were associated with a Helm repository the username and password were also passed on to other domains referenced in the `index.yaml` file. This occurred when Helm went to retrieve a specific chart archive on the other domain.\n\n### Patches\n\nThis issue has been resolved in 3.6.1.\n\nThere is a slight behavior change to credential handling with regard to repositories. Usernames and passwords are only passed to the URL location of the Helm repository by default. The username and password are scoped to the scheme, host, and port of the Helm repository. To pass the username and password to other domains Helm may encounter when it goes to retrieve a chart, the new `--pass-credentials` flag can be used. This flag restores the old behavior for a single repository as an opt-in behavior.\n\n### Workarounds\n\nIf you use a username and password for a Helm repository you can audit the Helm repository in order to check for another domain being used that could have received the credentials. In the `index.yaml` file for that repository, look for another domain in the `urls` list for the chart versions. If there is another domain found and that chart version was pulled or installed the credentials would have been passed on.\n\n### For more information\n\nHelm's security policy is spelled out in detail in our [SECURITY](https://github.com/helm/community/blob/master/SECURITY.md) document.\n", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2021/06/GHSA-7jr6-prv4-5wf5/GHSA-7jr6-prv4-5wf5.json b/advisories/github-reviewed/2021/06/GHSA-7jr6-prv4-5wf5/GHSA-7jr6-prv4-5wf5.json index cc0a291a82a..491fd83e035 100644 --- a/advisories/github-reviewed/2021/06/GHSA-7jr6-prv4-5wf5/GHSA-7jr6-prv4-5wf5.json +++ b/advisories/github-reviewed/2021/06/GHSA-7jr6-prv4-5wf5/GHSA-7jr6-prv4-5wf5.json @@ -4,9 +4,7 @@ "modified": "2024-05-20T21:26:28Z", "published": "2021-06-23T18:14:31Z", "withdrawn": "2024-05-20T21:26:28Z", - "aliases": [ - - ], + "aliases": [], "summary": "Duplicate Advisory: Helm passes repository credentials to alternate domain", "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-56hp-xqp3-w2jf. This link is maintained to preserve external references.\n\n## Original Description\nHelm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This issue has been resolved in 3.6.1. There is a workaround through which one may check for improperly passed credentials. One may use a username and password for a Helm repository and may audit the Helm repository in order to check for another domain being used that could have received the credentials. In the `index.yaml` file for that repository, one may look for another domain in the `urls` list for the chart versions. If there is another domain found and that chart version was pulled or installed, the credentials would be passed on.", "severity": [ diff --git a/advisories/github-reviewed/2021/06/GHSA-gq5r-cc4w-g8xf/GHSA-gq5r-cc4w-g8xf.json b/advisories/github-reviewed/2021/06/GHSA-gq5r-cc4w-g8xf/GHSA-gq5r-cc4w-g8xf.json index f9c9c36624f..ea144a2df90 100644 --- a/advisories/github-reviewed/2021/06/GHSA-gq5r-cc4w-g8xf/GHSA-gq5r-cc4w-g8xf.json +++ b/advisories/github-reviewed/2021/06/GHSA-gq5r-cc4w-g8xf/GHSA-gq5r-cc4w-g8xf.json @@ -4,9 +4,7 @@ "modified": "2024-05-20T20:18:56Z", "published": "2021-06-23T17:25:08Z", "withdrawn": "2024-05-20T20:18:56Z", - "aliases": [ - - ], + "aliases": [], "summary": "Duplicate Advisory: gosaml2 is vulnerable to NULL Pointer Dereference from malformed XML signatures", "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-prjq-f4q3-fvfr. This link is maintained to preserve external references.\n\n## Original Description\nThis affects all versions less than 0.7.0 of package github.com/russellhaering/gosaml2. There is a crash on null pointer dereference caused by sending malformed XML signatures.", "severity": [ diff --git a/advisories/github-reviewed/2021/06/GHSA-qj26-7grj-whg3/GHSA-qj26-7grj-whg3.json b/advisories/github-reviewed/2021/06/GHSA-qj26-7grj-whg3/GHSA-qj26-7grj-whg3.json index 9db831cf78c..2e1d14ed8cb 100644 --- a/advisories/github-reviewed/2021/06/GHSA-qj26-7grj-whg3/GHSA-qj26-7grj-whg3.json +++ b/advisories/github-reviewed/2021/06/GHSA-qj26-7grj-whg3/GHSA-qj26-7grj-whg3.json @@ -66,9 +66,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2021-05-20T21:04:58Z", diff --git a/advisories/github-reviewed/2022/01/GHSA-3qpm-h9ch-px3c/GHSA-3qpm-h9ch-px3c.json b/advisories/github-reviewed/2022/01/GHSA-3qpm-h9ch-px3c/GHSA-3qpm-h9ch-px3c.json index a2c1f412ace..0f12f438595 100644 --- a/advisories/github-reviewed/2022/01/GHSA-3qpm-h9ch-px3c/GHSA-3qpm-h9ch-px3c.json +++ b/advisories/github-reviewed/2022/01/GHSA-3qpm-h9ch-px3c/GHSA-3qpm-h9ch-px3c.json @@ -3,9 +3,7 @@ "id": "GHSA-3qpm-h9ch-px3c", "modified": "2022-01-04T22:06:05Z", "published": "2022-01-06T18:31:23Z", - "aliases": [ - - ], + "aliases": [], "summary": "Remote code injection, Improper Input Validation and Uncontrolled Recursion in Log4j library", "details": "### Summary\nThe version used of Log4j, the library used for logging by PowerNukkit, is subject to a remote code execution vulnerability via the ldap JNDI parser.\nIt's well detailed at [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) and CVE-2021-45105(https://github.com/advisories/GHSA-p6xc-xr62-6r2g).\n\n### Impact\nMalicious client code could be used to send messages and cause remote code execution on the server.\n\n### Patches\nPowerNukkit `1.5.2.1` is a patch-release that only updates the Log4j version to `2.17.0` and should be used instead of `1.5.2.0`.\nAll versions prior to `1.5.2.1` are affected and are not patched.\n\n### Workarounds\nIf you can't upgrade, you can use the `-Dlog4j2.formatMsgNoLookups=true` startup argument as remediation, as this prevents the vulnerability from happening.\n\n### References\nhttps://github.com/advisories/GHSA-jfh8-c2jp-5v3q\nhttps://github.com/advisories/GHSA-p6xc-xr62-6r2g\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the PowerNukkit repository](https://github.com/PowerNukkit/PowerNukkit/issues)\n", "severity": [ diff --git a/advisories/github-reviewed/2022/01/GHSA-4xww-6h7v-29jg/GHSA-4xww-6h7v-29jg.json b/advisories/github-reviewed/2022/01/GHSA-4xww-6h7v-29jg/GHSA-4xww-6h7v-29jg.json index 5913f2876e5..f1eba336cd0 100644 --- a/advisories/github-reviewed/2022/01/GHSA-4xww-6h7v-29jg/GHSA-4xww-6h7v-29jg.json +++ b/advisories/github-reviewed/2022/01/GHSA-4xww-6h7v-29jg/GHSA-4xww-6h7v-29jg.json @@ -8,9 +8,7 @@ ], "summary": "User enumeration in livehelperchat", "details": "livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information. There is an observable discrepancy between errors generated for users that exist and those that do not.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/01/GHSA-fqgw-6qj5-8hmp/GHSA-fqgw-6qj5-8hmp.json b/advisories/github-reviewed/2022/01/GHSA-fqgw-6qj5-8hmp/GHSA-fqgw-6qj5-8hmp.json index 1430257396c..3b62a738a6f 100644 --- a/advisories/github-reviewed/2022/01/GHSA-fqgw-6qj5-8hmp/GHSA-fqgw-6qj5-8hmp.json +++ b/advisories/github-reviewed/2022/01/GHSA-fqgw-6qj5-8hmp/GHSA-fqgw-6qj5-8hmp.json @@ -8,9 +8,7 @@ ], "summary": "Infinite Loop in Apache James", "details": "In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial Of Service attack. The IMAP user needs to be authenticated to exploit this vulnerability. This affected Apache James prior to version 3.6.1. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/01/GHSA-gp6j-vx54-5pmf/GHSA-gp6j-vx54-5pmf.json b/advisories/github-reviewed/2022/01/GHSA-gp6j-vx54-5pmf/GHSA-gp6j-vx54-5pmf.json index 392ec49a6c0..dc196cc5ceb 100644 --- a/advisories/github-reviewed/2022/01/GHSA-gp6j-vx54-5pmf/GHSA-gp6j-vx54-5pmf.json +++ b/advisories/github-reviewed/2022/01/GHSA-gp6j-vx54-5pmf/GHSA-gp6j-vx54-5pmf.json @@ -3,14 +3,10 @@ "id": "GHSA-gp6j-vx54-5pmf", "modified": "2022-01-04T22:41:52Z", "published": "2022-01-06T18:30:26Z", - "aliases": [ - - ], + "aliases": [], "summary": "Incorrect validation of parties IDs leaks secret keys in Secret-sharing scheme", "details": "# Summary\n\nIn the threshold signature scheme, participants start by dividing secrets into shares using a secret sharing scheme. The Verifiable Secret Sharing scheme generates shares from the user’s IDs but does not properly validate them. Using a malicious ID will make other users reveal their secrets during the secret-sharing procedure. In addition, a second issue resulting from lack of validation could cause nodes to crash when sent maliciously formed user IDs.\n\n# Details\n\nThe creation of Parties IDs does not properly validate for maliciously chosen IDs. Parties generate the secret shares in `binance-chain/tss-lib` codebase that `keep-network/keep-ecdsa` uses by evaluating the polynomial with the other parties’ IDs. It is critical that these party ids are non-zero because evaluating the polynomial at point 0 reveals the secret.\n\nThere is a check that these ids are not zero, but this is insufficient since it is not performed modulo the curve order. Therefore, one can set their ID equal to the order of the elliptic curve, which equals 0 during the polynomial evaluation modulo the curve order.\n```\n shares := make(Shares, num)\n for i := 0; i < num; i++ {\n if indexes[i].Cmp(big.NewInt(0)) == 0 {\n return nil, nil, fmt.Errorf(\"party index should not be 0\")\n }\n share := evaluatePolynomial(ec, threshold, poly, indexes[i])\n shares[i] = &Share{Threshold: threshold, ID: indexes[i], Share: share}\n }\n```\n(https://github.com/binance-chain/tss-lib/blob/73560daec7f83d7355107ea9b5e59d16de8765be/crypto/vss/feldman_vss.go#L64-L70)\n\nThus, a party with an ID equal to the order of the curve will receive the secret key as its share.\n\nAnother issue with the tss-lib implementation was the lack of verification for modularly equal user IDs that can cause nodes to crash during key generation or resharing.\n\n# Timeline\n\n### 6 December 2021, 20:28 CET\nThe team is informed by Trail of Bits about the issue in `binance-chain/tss-lib`. The vulnerability was already disclosed with Binance and they have implemented fixes in their recent commits. We are advised to update our dependency to the most recent `binance-chain/tss-lib` version.\n\n### 7 December 2021, 9:10 CET\nThe team confirms with Trail of Bits we started the work on a fix.\n\n### 7 December 2021, 20:03 CET\nThe team informs Trail of Bits that we found a potential problem in Binance's fix that may lead to the signing code failing with Go panic. We identified the problematic line and suggested its removal.\n\nTo address the vulnerability in the protocol, it is required to ensure that:\n- all indexes are non-zero,\n- all indexes are non-zero modulo the curve order,\n- all indexes are unique modulo the curve order.\n\nThe first two are guarded in `CheckIndexes` function by:\n```\nvMod := new(big.Int).Mod(v, ec.Params().N)\nif vMod.Cmp(zero) == 0 {\n return nil, errors.New(\"party index should not be 0\")\n}\n```\nThe last one is guarded by:\n```\nif sortutil.Dedupe(sortutil.BigIntSlice(dup)) < len(indexes) {\n return nil, errors.New(\"duplicate in indexes\")\n}\n```\nHowever, `CheckIndexes` was additionally modified to update values of passed indexes by doing `indexes[i] = vMod`.\n\nThis line was not backward-compatible and caused signatures to fail with `panic: runtime error: invalid memory address or nil pointer dereference` in case the signing group was generated with at least one `PartyID.Key` higher than `ec.Params().N`. This would also be problematic for new code that constructs such `PartyID` - we tested that key generation completed successfully but signing failed with the mentioned panic.\n\n### 8 December 2021, 12:49 CET\nTrail of Bits confirmed the line we flagged is not critical to the security of the protocol.\n\n### 8 December 2021, 15:29 CET\nThe team informed Trail of Bits we are planning to open a PR to `binance-chain/tss-lib` with a fix and we suggest extending the embargo for communicating this issue for one more week, until Friday, Dec 17h to give everyone more time update their code given the problem was found. We also ask Trail of Bits to get in touch with Binance to review our fix given that we are not going to provide a sufficient explanation in the commit and PR description to do not threaten the security of projects that have already upgraded their dependency.\n\n### 8 December 2021, 18:17 CET\n\nThe team informs Trail of Bits about opening a PR https://github.com/binance-chain/tss-lib/pull/155 and explains all the details of the issue.\n\nThe problematic scenario is:\n\n1. We start the keygen by creating `PartyID` for each member. The `PartyID` struct has `Id` and `Key` fields. We set `PartyID.Key` that is higher than the elliptic curve's `N`.\n2. This goes to tss-lib which starts the round 1 code (`ecdsa/keygen/round_1.go`). It takes `PartyID.Key` of each member and assembles the `ids` slice. This slice is thrown into `CheckIndexes` which overwrites each element by doing the modulo `N`.\n3. After returning from `CheckIndexes` the modified `ids` slice is used to set the `Ks` slice in the final `LocalPartySaveData` which is received by each group member as keygen final result.\n4. Each member takes this `LocalPartySaveData` and saves it on disk.\n5. Upon signing, we do the same as in point 1, so we construct `PartyID`s in the same way and start the protocol. At this point, `PartyID.Key` is higher than curve's `N`.\n6. Before starting round 1 of signing, `LocalPartySaveData` obtained at keygen and our `PartyID`s built at point 5 are used in `BuildLocalSaveDataSubset` to build a new `LocalPartySaveData` instance.\n7. `BuildLocalSaveDataSubset` is the place where things go wrong because `Key` field of each `PartyID` from point 5 doesn't correspond to encoded `Ks` elements of `LocalPartySaveData` obtained after keygen, the final `LocalPartySaveData` is corrupted, and cause panic upon validation before signing round 1.\n\n### 8 December 2021, 21:50 CET\n\nTrail of Bits confirms they are going to followup with Binance and they agree to extend the embargo by a week.\n\n### 8 December 2021, 15:16 CET\n\nTrail of Bits validates the problematic scenario we described and our fix. Trail of Bits reaches to Binance and recommends merging our fix and in addition to some other fixes that would secure the code to do not panic even if `LocalPartySaveData` has corrupted data.\n\n### 10 December 2021, 8:16 CET\n\nBinance merges our fix https://github.com/binance-chain/tss-lib/commit/cd95cee01ea2af6d4aa8316612803be944d5369a\n\n### 13 December 2021, 8:35 CET\n\nBinance applies more fixes so that even in case of `LocalPartySaveData` corrupted, the code is not going to panic.\n\n### 15 December 2021\n\nThe team releases a new version of the client, v1.8.1, and announces the need for an upgrade.\nhttps://github.com/keep-network/keep-ecdsa/releases/tag/v1.8.1", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { @@ -47,9 +43,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2022-01-04T22:41:52Z", diff --git a/advisories/github-reviewed/2022/01/GHSA-mw25-f5r2-hpc6/GHSA-mw25-f5r2-hpc6.json b/advisories/github-reviewed/2022/01/GHSA-mw25-f5r2-hpc6/GHSA-mw25-f5r2-hpc6.json index e0f81effe15..fa8b56a9e34 100644 --- a/advisories/github-reviewed/2022/01/GHSA-mw25-f5r2-hpc6/GHSA-mw25-f5r2-hpc6.json +++ b/advisories/github-reviewed/2022/01/GHSA-mw25-f5r2-hpc6/GHSA-mw25-f5r2-hpc6.json @@ -8,9 +8,7 @@ ], "summary": "Insertion of Sensitive Information into Log File in Apache Geode", "details": "Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix \"sysprop-\", \"javax.net.ssl\", or \"security-\". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-2hp4-8h6h-93rr/GHSA-2hp4-8h6h-93rr.json b/advisories/github-reviewed/2022/05/GHSA-2hp4-8h6h-93rr/GHSA-2hp4-8h6h-93rr.json index 195ed96beda..cefa9e8bbaa 100644 --- a/advisories/github-reviewed/2022/05/GHSA-2hp4-8h6h-93rr/GHSA-2hp4-8h6h-93rr.json +++ b/advisories/github-reviewed/2022/05/GHSA-2hp4-8h6h-93rr/GHSA-2hp4-8h6h-93rr.json @@ -8,9 +8,7 @@ ], "summary": "Typo3 Backend History Module Vulnerable to XSS", "details": "The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access, which allows remote authenticated editors to read the history of arbitrary records via a crafted URL.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-4x28-j85r-668q/GHSA-4x28-j85r-668q.json b/advisories/github-reviewed/2022/05/GHSA-4x28-j85r-668q/GHSA-4x28-j85r-668q.json index 296ebffa15a..5b35d9571d6 100644 --- a/advisories/github-reviewed/2022/05/GHSA-4x28-j85r-668q/GHSA-4x28-j85r-668q.json +++ b/advisories/github-reviewed/2022/05/GHSA-4x28-j85r-668q/GHSA-4x28-j85r-668q.json @@ -8,9 +8,7 @@ ], "summary": "ForkCMS Directory Traversal vulnerability", "details": "Directory traversal vulnerability in `frontend/core/engine/javascript.php` in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a `..` (dot dot) in the module parameter to `frontend/js.php`.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-56f8-g68r-j699/GHSA-56f8-g68r-j699.json b/advisories/github-reviewed/2022/05/GHSA-56f8-g68r-j699/GHSA-56f8-g68r-j699.json index 44c7bd76357..cdff7c2348b 100644 --- a/advisories/github-reviewed/2022/05/GHSA-56f8-g68r-j699/GHSA-56f8-g68r-j699.json +++ b/advisories/github-reviewed/2022/05/GHSA-56f8-g68r-j699/GHSA-56f8-g68r-j699.json @@ -8,9 +8,7 @@ ], "summary": "Cross-site Scripting in Apache Struts", "details": "Multiple Cross-Site Scripting (XSS) in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation (DMI) is enabled, the action name is generated dynamically base on request parameters. This allows to call non-existing page and method to produce error page with injected code as below. As of Struts 2.2.3 the action names are escaped when automatically generated error pages are rendered.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-7gg8-3r6j-5g55/GHSA-7gg8-3r6j-5g55.json b/advisories/github-reviewed/2022/05/GHSA-7gg8-3r6j-5g55/GHSA-7gg8-3r6j-5g55.json index b4f7d61ecec..638766f7c97 100644 --- a/advisories/github-reviewed/2022/05/GHSA-7gg8-3r6j-5g55/GHSA-7gg8-3r6j-5g55.json +++ b/advisories/github-reviewed/2022/05/GHSA-7gg8-3r6j-5g55/GHSA-7gg8-3r6j-5g55.json @@ -8,9 +8,7 @@ ], "summary": "Typo3 Backend Configuration XSS Vulnerability", "details": "The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-7w6c-5pr4-7qvp/GHSA-7w6c-5pr4-7qvp.json b/advisories/github-reviewed/2022/05/GHSA-7w6c-5pr4-7qvp/GHSA-7w6c-5pr4-7qvp.json index 9ab2ac81a7a..24afd646899 100644 --- a/advisories/github-reviewed/2022/05/GHSA-7w6c-5pr4-7qvp/GHSA-7w6c-5pr4-7qvp.json +++ b/advisories/github-reviewed/2022/05/GHSA-7w6c-5pr4-7qvp/GHSA-7w6c-5pr4-7qvp.json @@ -8,9 +8,7 @@ ], "summary": "Typo3 Backend XSS Vulnerability", "details": "Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-88r4-38gc-97p4/GHSA-88r4-38gc-97p4.json b/advisories/github-reviewed/2022/05/GHSA-88r4-38gc-97p4/GHSA-88r4-38gc-97p4.json index 30f6e709242..b85b937b42d 100644 --- a/advisories/github-reviewed/2022/05/GHSA-88r4-38gc-97p4/GHSA-88r4-38gc-97p4.json +++ b/advisories/github-reviewed/2022/05/GHSA-88r4-38gc-97p4/GHSA-88r4-38gc-97p4.json @@ -8,9 +8,7 @@ ], "summary": "Apache Axis2 Vulnerable to XML Signature wrapping attack", "details": "Apache Axis2 allows remote attackers to forge messages and bypass authentication via an \"XML Signature wrapping attack.\"", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-947m-vgqc-x6v4/GHSA-947m-vgqc-x6v4.json b/advisories/github-reviewed/2022/05/GHSA-947m-vgqc-x6v4/GHSA-947m-vgqc-x6v4.json index 12e3ce139fd..ad1dfdf46d4 100644 --- a/advisories/github-reviewed/2022/05/GHSA-947m-vgqc-x6v4/GHSA-947m-vgqc-x6v4.json +++ b/advisories/github-reviewed/2022/05/GHSA-947m-vgqc-x6v4/GHSA-947m-vgqc-x6v4.json @@ -8,9 +8,7 @@ ], "summary": "Typo3 Backend History Module Vulnerable to SQL Injection", "details": "SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 Due to missing encoding of user input, the history module is susceptible to SQL Injection and Cross-Site Scripting. A valid backend login is required to exploit this vulnerability.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-94c2-g68f-9r98/GHSA-94c2-g68f-9r98.json b/advisories/github-reviewed/2022/05/GHSA-94c2-g68f-9r98/GHSA-94c2-g68f-9r98.json index 30cd1652b20..73ecf19d2f0 100644 --- a/advisories/github-reviewed/2022/05/GHSA-94c2-g68f-9r98/GHSA-94c2-g68f-9r98.json +++ b/advisories/github-reviewed/2022/05/GHSA-94c2-g68f-9r98/GHSA-94c2-g68f-9r98.json @@ -8,9 +8,7 @@ ], "summary": "Typo3 API XSS Vulnerability", "details": "Incomplete blacklist vulnerability in the `t3lib_div::quoteJSvalue` API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-9m5v-vq4f-mrvf/GHSA-9m5v-vq4f-mrvf.json b/advisories/github-reviewed/2022/05/GHSA-9m5v-vq4f-mrvf/GHSA-9m5v-vq4f-mrvf.json index 02555dac913..6eca3a593b1 100644 --- a/advisories/github-reviewed/2022/05/GHSA-9m5v-vq4f-mrvf/GHSA-9m5v-vq4f-mrvf.json +++ b/advisories/github-reviewed/2022/05/GHSA-9m5v-vq4f-mrvf/GHSA-9m5v-vq4f-mrvf.json @@ -8,9 +8,7 @@ ], "summary": "Zend Framework XXE Vulnerability", "details": "The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-h5p3-7mg6-hgj4/GHSA-h5p3-7mg6-hgj4.json b/advisories/github-reviewed/2022/05/GHSA-h5p3-7mg6-hgj4/GHSA-h5p3-7mg6-hgj4.json index 5b891b46644..4e40c3260b7 100644 --- a/advisories/github-reviewed/2022/05/GHSA-h5p3-7mg6-hgj4/GHSA-h5p3-7mg6-hgj4.json +++ b/advisories/github-reviewed/2022/05/GHSA-h5p3-7mg6-hgj4/GHSA-h5p3-7mg6-hgj4.json @@ -8,9 +8,7 @@ ], "summary": "Zend Framework XEE Vulnerability", "details": "(1) `Zend_Dom`, (2) `Zend_Feed`, and (3) `Zend_Soap` in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-j5fj-m342-mgcm/GHSA-j5fj-m342-mgcm.json b/advisories/github-reviewed/2022/05/GHSA-j5fj-m342-mgcm/GHSA-j5fj-m342-mgcm.json index 9dea9e11274..0bb1906bea2 100644 --- a/advisories/github-reviewed/2022/05/GHSA-j5fj-m342-mgcm/GHSA-j5fj-m342-mgcm.json +++ b/advisories/github-reviewed/2022/05/GHSA-j5fj-m342-mgcm/GHSA-j5fj-m342-mgcm.json @@ -8,9 +8,7 @@ ], "summary": "Fork CMS Multiple XSS Vulnerabilities", "details": "Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) type or (2) querystring parameters to `private/en/error` or (3) name parameter to `private/en/locale/index`.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-jh4x-4wmf-67pr/GHSA-jh4x-4wmf-67pr.json b/advisories/github-reviewed/2022/05/GHSA-jh4x-4wmf-67pr/GHSA-jh4x-4wmf-67pr.json index 4ed0de8c079..b9adffa2699 100644 --- a/advisories/github-reviewed/2022/05/GHSA-jh4x-4wmf-67pr/GHSA-jh4x-4wmf-67pr.json +++ b/advisories/github-reviewed/2022/05/GHSA-jh4x-4wmf-67pr/GHSA-jh4x-4wmf-67pr.json @@ -8,9 +8,7 @@ ], "summary": "Zend Framework XEE Vulnerability", "details": "(1) `Zend_Dom`, (2) `Zend_Feed`, (3) `Zend_Soap`, and (4) `Zend_XmlRpc` in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 allow remote attackers to cause a denial of service (CPU consumption) via recursive or circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-p9wg-jvj4-cx26/GHSA-p9wg-jvj4-cx26.json b/advisories/github-reviewed/2022/05/GHSA-p9wg-jvj4-cx26/GHSA-p9wg-jvj4-cx26.json index f6ab010708e..21deab39b89 100644 --- a/advisories/github-reviewed/2022/05/GHSA-p9wg-jvj4-cx26/GHSA-p9wg-jvj4-cx26.json +++ b/advisories/github-reviewed/2022/05/GHSA-p9wg-jvj4-cx26/GHSA-p9wg-jvj4-cx26.json @@ -8,9 +8,7 @@ ], "summary": "Typo3 Install Tool XSS Vulnerability", "details": "Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-q388-j7cw-ff7w/GHSA-q388-j7cw-ff7w.json b/advisories/github-reviewed/2022/05/GHSA-q388-j7cw-ff7w/GHSA-q388-j7cw-ff7w.json index 0af93d36d98..d0362d53095 100644 --- a/advisories/github-reviewed/2022/05/GHSA-q388-j7cw-ff7w/GHSA-q388-j7cw-ff7w.json +++ b/advisories/github-reviewed/2022/05/GHSA-q388-j7cw-ff7w/GHSA-q388-j7cw-ff7w.json @@ -8,9 +8,7 @@ ], "summary": "Path Traversal in Eclipse Mojarra", "details": "Multiple path traversal flaws where found in Mojarra JSF2 implementation for identifying resources by name or from libraries. An unauthenticated remote attacker can use these flaws to gather otherwise undisclosed information from within an application's root.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-qfr3-29w6-hwpg/GHSA-qfr3-29w6-hwpg.json b/advisories/github-reviewed/2022/05/GHSA-qfr3-29w6-hwpg/GHSA-qfr3-29w6-hwpg.json index f2ab7bebbb4..db7594207b2 100644 --- a/advisories/github-reviewed/2022/05/GHSA-qfr3-29w6-hwpg/GHSA-qfr3-29w6-hwpg.json +++ b/advisories/github-reviewed/2022/05/GHSA-qfr3-29w6-hwpg/GHSA-qfr3-29w6-hwpg.json @@ -8,9 +8,7 @@ ], "summary": "Typo3 Exception Handler XSS", "details": "Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-qjjq-rcq8-jw6j/GHSA-qjjq-rcq8-jw6j.json b/advisories/github-reviewed/2022/05/GHSA-qjjq-rcq8-jw6j/GHSA-qjjq-rcq8-jw6j.json index ff747e1e1fc..21457031996 100644 --- a/advisories/github-reviewed/2022/05/GHSA-qjjq-rcq8-jw6j/GHSA-qjjq-rcq8-jw6j.json +++ b/advisories/github-reviewed/2022/05/GHSA-qjjq-rcq8-jw6j/GHSA-qjjq-rcq8-jw6j.json @@ -8,9 +8,7 @@ ], "summary": "Elefant CMS Multiple XSS Vulnerabilities", "details": "Multiple cross-site scripting (XSS) vulnerabilities in `apps/admin/handlers/preview.php` in Elefant CMS 1.0.x before 1.0.2-Beta and 1.1.x before 1.1.5-Beta allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) body parameter to admin/preview.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-qmmw-ch2q-j6xx/GHSA-qmmw-ch2q-j6xx.json b/advisories/github-reviewed/2022/05/GHSA-qmmw-ch2q-j6xx/GHSA-qmmw-ch2q-j6xx.json index 91f9f5972ca..0e19f9e76de 100644 --- a/advisories/github-reviewed/2022/05/GHSA-qmmw-ch2q-j6xx/GHSA-qmmw-ch2q-j6xx.json +++ b/advisories/github-reviewed/2022/05/GHSA-qmmw-ch2q-j6xx/GHSA-qmmw-ch2q-j6xx.json @@ -8,9 +8,7 @@ ], "summary": "Typo3 Backend API XSS Vulnerability", "details": "Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-rgf6-9q7g-55qg/GHSA-rgf6-9q7g-55qg.json b/advisories/github-reviewed/2022/05/GHSA-rgf6-9q7g-55qg/GHSA-rgf6-9q7g-55qg.json index adacfa42b02..9dbb8587df8 100644 --- a/advisories/github-reviewed/2022/05/GHSA-rgf6-9q7g-55qg/GHSA-rgf6-9q7g-55qg.json +++ b/advisories/github-reviewed/2022/05/GHSA-rgf6-9q7g-55qg/GHSA-rgf6-9q7g-55qg.json @@ -8,9 +8,7 @@ ], "summary": "Typo3 Function Menu API XSS Vulnerability", "details": "Cross-site scripting (XSS) vulnerability in the function menu API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-v358-rvxr-wffx/GHSA-v358-rvxr-wffx.json b/advisories/github-reviewed/2022/05/GHSA-v358-rvxr-wffx/GHSA-v358-rvxr-wffx.json index 7581f209325..97d5c375adf 100644 --- a/advisories/github-reviewed/2022/05/GHSA-v358-rvxr-wffx/GHSA-v358-rvxr-wffx.json +++ b/advisories/github-reviewed/2022/05/GHSA-v358-rvxr-wffx/GHSA-v358-rvxr-wffx.json @@ -8,9 +8,7 @@ ], "summary": "Silverstripe XSS Vulnerabilities", "details": "Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via \n1. a crafted string to the `AbsoluteLinks`\n1. `BigSummary`\n1. `ContextSummary`\n1. `EscapeXML`\n1. `FirstParagraph`\n1. `FirstSentence`\n1. `Initial`\n1. `LimitCharacters`\n1. `LimitSentences`\n1. `LimitWordCount`\n1. `LimitWordCountXML`\n1. `Lower`\n1. `LowerCase`\n1. `NoHTML`\n1. `Summary`\n1. `Upper`\n1. `UpperCase`, or \n1. `URL` method in a template, \n\ndifferent vectors than CVE-2012-0976.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-v3fg-x8jw-m974/GHSA-v3fg-x8jw-m974.json b/advisories/github-reviewed/2022/05/GHSA-v3fg-x8jw-m974/GHSA-v3fg-x8jw-m974.json index 84ba191b2dd..11597292888 100644 --- a/advisories/github-reviewed/2022/05/GHSA-v3fg-x8jw-m974/GHSA-v3fg-x8jw-m974.json +++ b/advisories/github-reviewed/2022/05/GHSA-v3fg-x8jw-m974/GHSA-v3fg-x8jw-m974.json @@ -8,9 +8,7 @@ ], "summary": "Fork CMS XSS via Highlight Parameter", "details": "Cross-site scripting (XSS) vulnerability in `backend/core/engine/base.php` in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-v6c7-8qx5-8gmp/GHSA-v6c7-8qx5-8gmp.json b/advisories/github-reviewed/2022/05/GHSA-v6c7-8qx5-8gmp/GHSA-v6c7-8qx5-8gmp.json index 60c3d4b566d..21e5f36c32f 100644 --- a/advisories/github-reviewed/2022/05/GHSA-v6c7-8qx5-8gmp/GHSA-v6c7-8qx5-8gmp.json +++ b/advisories/github-reviewed/2022/05/GHSA-v6c7-8qx5-8gmp/GHSA-v6c7-8qx5-8gmp.json @@ -8,9 +8,7 @@ ], "summary": "Deserialization of Untrusted Data in Apache Tomcat", "details": "The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. \n\nNOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue. Regardless the tomcat maintainers have altered the behavior of this method in version 7.0.39.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-w563-rq37-cvq5/GHSA-w563-rq37-cvq5.json b/advisories/github-reviewed/2022/05/GHSA-w563-rq37-cvq5/GHSA-w563-rq37-cvq5.json index 6d4b3f43a40..ae24827fcd7 100644 --- a/advisories/github-reviewed/2022/05/GHSA-w563-rq37-cvq5/GHSA-w563-rq37-cvq5.json +++ b/advisories/github-reviewed/2022/05/GHSA-w563-rq37-cvq5/GHSA-w563-rq37-cvq5.json @@ -8,9 +8,7 @@ ], "summary": "Typo3 Backend History Module Vulnerable to XSS", "details": "Cross-site scripting (XSS) vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2022/05/GHSA-x8h4-xf47-pqc3/GHSA-x8h4-xf47-pqc3.json b/advisories/github-reviewed/2022/05/GHSA-x8h4-xf47-pqc3/GHSA-x8h4-xf47-pqc3.json index f777392a0aa..7e297e7c48c 100644 --- a/advisories/github-reviewed/2022/05/GHSA-x8h4-xf47-pqc3/GHSA-x8h4-xf47-pqc3.json +++ b/advisories/github-reviewed/2022/05/GHSA-x8h4-xf47-pqc3/GHSA-x8h4-xf47-pqc3.json @@ -8,9 +8,7 @@ ], "summary": "OpenStack Keystone Token authorization for a user in a disabled tenant is allowed", "details": "OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant.", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { diff --git a/advisories/github-reviewed/2023/09/GHSA-jcr6-4frq-9gjj/GHSA-jcr6-4frq-9gjj.json b/advisories/github-reviewed/2023/09/GHSA-jcr6-4frq-9gjj/GHSA-jcr6-4frq-9gjj.json index bc0952c9206..6c4cb623eb5 100644 --- a/advisories/github-reviewed/2023/09/GHSA-jcr6-4frq-9gjj/GHSA-jcr6-4frq-9gjj.json +++ b/advisories/github-reviewed/2023/09/GHSA-jcr6-4frq-9gjj/GHSA-jcr6-4frq-9gjj.json @@ -3,14 +3,10 @@ "id": "GHSA-jcr6-4frq-9gjj", "modified": "2023-09-13T14:04:07Z", "published": "2023-09-11T20:43:31Z", - "aliases": [ - - ], + "aliases": [], "summary": "Users vulnerable to unaligned read of `*const *const c_char` pointer", "details": "Affected versions dereference a potentially unaligned pointer. The pointer is commonly unaligned in practice, resulting in undefined behavior.\n\nIn some build modes, this is observable as a panic followed by abort. In other build modes the UB may manifest in some other way, including the possibility of working correctly in some architectures.\n\nThe crate is not currently maintained, so a patched version is not available.\n\n## Recommended alternatives\n- [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate)\n- [`sysinfo`](https://crates.io/crates/sysinfo)\n", - "severity": [ - - ], + "severity": [], "affected": [ { "package": { @@ -47,9 +43,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-09-11T20:43:31Z", diff --git a/advisories/github-reviewed/2023/12/GHSA-rqxc-9p8h-xqgq/GHSA-rqxc-9p8h-xqgq.json b/advisories/github-reviewed/2023/12/GHSA-rqxc-9p8h-xqgq/GHSA-rqxc-9p8h-xqgq.json index c5cac633f0c..9be3c0d5231 100644 --- a/advisories/github-reviewed/2023/12/GHSA-rqxc-9p8h-xqgq/GHSA-rqxc-9p8h-xqgq.json +++ b/advisories/github-reviewed/2023/12/GHSA-rqxc-9p8h-xqgq/GHSA-rqxc-9p8h-xqgq.json @@ -4,9 +4,7 @@ "modified": "2023-12-28T18:45:19Z", "published": "2023-12-24T06:30:31Z", "withdrawn": "2023-12-28T18:45:19Z", - "aliases": [ - - ], + "aliases": [], "summary": "Duplicate Advisory: ActiveAdmin vulnerable to CSV injection", "details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-xhvv-3jww-c487. This link is maintained to preserve external references.\n\n## Original Description\ncsv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.", "severity": [ diff --git a/advisories/unreviewed/2021/12/GHSA-22jj-744v-92v5/GHSA-22jj-744v-92v5.json b/advisories/unreviewed/2021/12/GHSA-22jj-744v-92v5/GHSA-22jj-744v-92v5.json index 7a75762f468..4a87a80edaf 100644 --- a/advisories/unreviewed/2021/12/GHSA-22jj-744v-92v5/GHSA-22jj-744v-92v5.json +++ b/advisories/unreviewed/2021/12/GHSA-22jj-744v-92v5/GHSA-22jj-744v-92v5.json @@ -7,12 +7,8 @@ "CVE-2021-4177" ], "details": "livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-24wc-68mr-7mcq/GHSA-24wc-68mr-7mcq.json b/advisories/unreviewed/2021/12/GHSA-24wc-68mr-7mcq/GHSA-24wc-68mr-7mcq.json index d0e43e376f2..97ceafd5c6d 100644 --- a/advisories/unreviewed/2021/12/GHSA-24wc-68mr-7mcq/GHSA-24wc-68mr-7mcq.json +++ b/advisories/unreviewed/2021/12/GHSA-24wc-68mr-7mcq/GHSA-24wc-68mr-7mcq.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-2fwv-796r-67vv/GHSA-2fwv-796r-67vv.json b/advisories/unreviewed/2021/12/GHSA-2fwv-796r-67vv/GHSA-2fwv-796r-67vv.json index dfe1cce84f2..9ba339864d5 100644 --- a/advisories/unreviewed/2021/12/GHSA-2fwv-796r-67vv/GHSA-2fwv-796r-67vv.json +++ b/advisories/unreviewed/2021/12/GHSA-2fwv-796r-67vv/GHSA-2fwv-796r-67vv.json @@ -7,12 +7,8 @@ "CVE-2021-20165" ], "details": "Trendnet AC2600 TEW-827DRU version 2.08B01 does not properly implement csrf protections. Most pages lack proper usage of CSRF protections or mitigations. Additionally, pages that do make use of CSRF tokens are trivially bypassable as the server does not appear to validate them properly (i.e. re-using an old token or finding the token thru some other method is possible).", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-2pj8-x98c-rm2q/GHSA-2pj8-x98c-rm2q.json b/advisories/unreviewed/2021/12/GHSA-2pj8-x98c-rm2q/GHSA-2pj8-x98c-rm2q.json index be2a3d0e075..5730378bb79 100644 --- a/advisories/unreviewed/2021/12/GHSA-2pj8-x98c-rm2q/GHSA-2pj8-x98c-rm2q.json +++ b/advisories/unreviewed/2021/12/GHSA-2pj8-x98c-rm2q/GHSA-2pj8-x98c-rm2q.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-2qvc-r469-79f4/GHSA-2qvc-r469-79f4.json b/advisories/unreviewed/2021/12/GHSA-2qvc-r469-79f4/GHSA-2qvc-r469-79f4.json index ea74a2b41ad..2098ba97eb4 100644 --- a/advisories/unreviewed/2021/12/GHSA-2qvc-r469-79f4/GHSA-2qvc-r469-79f4.json +++ b/advisories/unreviewed/2021/12/GHSA-2qvc-r469-79f4/GHSA-2qvc-r469-79f4.json @@ -7,12 +7,8 @@ "CVE-2021-38688" ], "details": "An improper authentication vulnerability has been reported to affect Android App Qfile. If exploited, this vulnerability allows attackers to compromise app and access information We have already fixed this vulnerability in the following versions of Qfile: Qfile 3.0.0.1105 and later", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-2rvj-jqm9-chgx/GHSA-2rvj-jqm9-chgx.json b/advisories/unreviewed/2021/12/GHSA-2rvj-jqm9-chgx/GHSA-2rvj-jqm9-chgx.json index ce1d076cda8..5ae99d580cd 100644 --- a/advisories/unreviewed/2021/12/GHSA-2rvj-jqm9-chgx/GHSA-2rvj-jqm9-chgx.json +++ b/advisories/unreviewed/2021/12/GHSA-2rvj-jqm9-chgx/GHSA-2rvj-jqm9-chgx.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-3366-5rqh-74c5/GHSA-3366-5rqh-74c5.json b/advisories/unreviewed/2021/12/GHSA-3366-5rqh-74c5/GHSA-3366-5rqh-74c5.json index 366d52f40ec..66f3e094bde 100644 --- a/advisories/unreviewed/2021/12/GHSA-3366-5rqh-74c5/GHSA-3366-5rqh-74c5.json +++ b/advisories/unreviewed/2021/12/GHSA-3366-5rqh-74c5/GHSA-3366-5rqh-74c5.json @@ -7,12 +7,8 @@ "CVE-2021-24969" ], "details": "The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template AJAX action, any authenticated users such as subscriber is able to call it and perform Cross-Site Scripting attacks", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-3398-v46q-wcp6/GHSA-3398-v46q-wcp6.json b/advisories/unreviewed/2021/12/GHSA-3398-v46q-wcp6/GHSA-3398-v46q-wcp6.json index 4b2cc3501e5..b0d4c92bf1d 100644 --- a/advisories/unreviewed/2021/12/GHSA-3398-v46q-wcp6/GHSA-3398-v46q-wcp6.json +++ b/advisories/unreviewed/2021/12/GHSA-3398-v46q-wcp6/GHSA-3398-v46q-wcp6.json @@ -7,12 +7,8 @@ "CVE-2021-20133" ], "details": "Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set the \"message of the day\" banner to any file on the system, allowing them to read all or some of the contents of those files. Such sensitive information as hashed credentials, hardcoded plaintext passwords for other services, configuration files, and private keys can be disclosed in this fashion. Improper handling of filenames that identify virtual resources, such as \"/dev/urandom\" allows an attacker to effect a denial of service attack against the command line interfaces of the Quagga services (zebra and ripd).", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-33mq-pfqq-c55m/GHSA-33mq-pfqq-c55m.json b/advisories/unreviewed/2021/12/GHSA-33mq-pfqq-c55m/GHSA-33mq-pfqq-c55m.json index 4b270ec2187..07a740fcd4d 100644 --- a/advisories/unreviewed/2021/12/GHSA-33mq-pfqq-c55m/GHSA-33mq-pfqq-c55m.json +++ b/advisories/unreviewed/2021/12/GHSA-33mq-pfqq-c55m/GHSA-33mq-pfqq-c55m.json @@ -7,12 +7,8 @@ "CVE-2021-24979" ], "details": "The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-33mw-354r-24rw/GHSA-33mw-354r-24rw.json b/advisories/unreviewed/2021/12/GHSA-33mw-354r-24rw/GHSA-33mw-354r-24rw.json index 90110e33d71..2ffb0fd7ec0 100644 --- a/advisories/unreviewed/2021/12/GHSA-33mw-354r-24rw/GHSA-33mw-354r-24rw.json +++ b/advisories/unreviewed/2021/12/GHSA-33mw-354r-24rw/GHSA-33mw-354r-24rw.json @@ -7,12 +7,8 @@ "CVE-2020-21236" ], "details": "A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-38gc-w4h9-7pmf/GHSA-38gc-w4h9-7pmf.json b/advisories/unreviewed/2021/12/GHSA-38gc-w4h9-7pmf/GHSA-38gc-w4h9-7pmf.json index a06ad9c30c1..742e64ecdc5 100644 --- a/advisories/unreviewed/2021/12/GHSA-38gc-w4h9-7pmf/GHSA-38gc-w4h9-7pmf.json +++ b/advisories/unreviewed/2021/12/GHSA-38gc-w4h9-7pmf/GHSA-38gc-w4h9-7pmf.json @@ -7,12 +7,8 @@ "CVE-2021-35034" ], "details": "An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the correct token can be intercepted.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-3c38-2c7r-g6j4/GHSA-3c38-2c7r-g6j4.json b/advisories/unreviewed/2021/12/GHSA-3c38-2c7r-g6j4/GHSA-3c38-2c7r-g6j4.json index 5248157c30b..24c3c72b903 100644 --- a/advisories/unreviewed/2021/12/GHSA-3c38-2c7r-g6j4/GHSA-3c38-2c7r-g6j4.json +++ b/advisories/unreviewed/2021/12/GHSA-3c38-2c7r-g6j4/GHSA-3c38-2c7r-g6j4.json @@ -7,12 +7,8 @@ "CVE-2021-24992" ], "details": "The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-42pj-96jc-q58w/GHSA-42pj-96jc-q58w.json b/advisories/unreviewed/2021/12/GHSA-42pj-96jc-q58w/GHSA-42pj-96jc-q58w.json index 8597bc470c6..1fd5ebcae8d 100644 --- a/advisories/unreviewed/2021/12/GHSA-42pj-96jc-q58w/GHSA-42pj-96jc-q58w.json +++ b/advisories/unreviewed/2021/12/GHSA-42pj-96jc-q58w/GHSA-42pj-96jc-q58w.json @@ -7,12 +7,8 @@ "CVE-2021-25993" ], "details": "In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to account takeover when accessed by the victim.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-4542-p548-wpv7/GHSA-4542-p548-wpv7.json b/advisories/unreviewed/2021/12/GHSA-4542-p548-wpv7/GHSA-4542-p548-wpv7.json index 20147421d62..a13a6303490 100644 --- a/advisories/unreviewed/2021/12/GHSA-4542-p548-wpv7/GHSA-4542-p548-wpv7.json +++ b/advisories/unreviewed/2021/12/GHSA-4542-p548-wpv7/GHSA-4542-p548-wpv7.json @@ -7,12 +7,8 @@ "CVE-2021-32993" ], "details": "IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) contains hard-coded credentials, such as a password or a cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-47jc-2cqh-wc8g/GHSA-47jc-2cqh-wc8g.json b/advisories/unreviewed/2021/12/GHSA-47jc-2cqh-wc8g/GHSA-47jc-2cqh-wc8g.json index 19b87789fad..8937025c6cf 100644 --- a/advisories/unreviewed/2021/12/GHSA-47jc-2cqh-wc8g/GHSA-47jc-2cqh-wc8g.json +++ b/advisories/unreviewed/2021/12/GHSA-47jc-2cqh-wc8g/GHSA-47jc-2cqh-wc8g.json @@ -7,12 +7,8 @@ "CVE-2021-20175" ], "details": "Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the SOAP interface. By default, all communication to/from the device's SOAP Interface (port 5000) is sent via HTTP, which causes potentially sensitive information (such as usernames and passwords) to be transmitted in cleartext", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-4wgm-82f7-qm8p/GHSA-4wgm-82f7-qm8p.json b/advisories/unreviewed/2021/12/GHSA-4wgm-82f7-qm8p/GHSA-4wgm-82f7-qm8p.json index 65885d59442..bba34aba6ae 100644 --- a/advisories/unreviewed/2021/12/GHSA-4wgm-82f7-qm8p/GHSA-4wgm-82f7-qm8p.json +++ b/advisories/unreviewed/2021/12/GHSA-4wgm-82f7-qm8p/GHSA-4wgm-82f7-qm8p.json @@ -7,12 +7,8 @@ "CVE-2021-20157" ], "details": "It is possible for an unauthenticated, malicious user to force the device to reboot due to a hidden administrative command.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,9 +20,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2021/12/GHSA-52mg-x4rg-p64j/GHSA-52mg-x4rg-p64j.json b/advisories/unreviewed/2021/12/GHSA-52mg-x4rg-p64j/GHSA-52mg-x4rg-p64j.json index 6bf841e2f5c..1d004344e45 100644 --- a/advisories/unreviewed/2021/12/GHSA-52mg-x4rg-p64j/GHSA-52mg-x4rg-p64j.json +++ b/advisories/unreviewed/2021/12/GHSA-52mg-x4rg-p64j/GHSA-52mg-x4rg-p64j.json @@ -7,12 +7,8 @@ "CVE-2021-44161" ], "details": "Changing MOTP (Mobile One Time Password) system’s specific function parameter has insufficient validation for user input. A attacker in local area network can perform SQL injection attack to read, modify or delete backend database without authentication.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-5pg4-q67x-c7x9/GHSA-5pg4-q67x-c7x9.json b/advisories/unreviewed/2021/12/GHSA-5pg4-q67x-c7x9/GHSA-5pg4-q67x-c7x9.json index 59a04fb69a5..911c585667c 100644 --- a/advisories/unreviewed/2021/12/GHSA-5pg4-q67x-c7x9/GHSA-5pg4-q67x-c7x9.json +++ b/advisories/unreviewed/2021/12/GHSA-5pg4-q67x-c7x9/GHSA-5pg4-q67x-c7x9.json @@ -7,12 +7,8 @@ "CVE-2021-25989" ], "details": "In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability in the markdown editor. It can be exploited by making a victim a Leader of a group which triggers the payload for them.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-5rm5-xp9h-jf8q/GHSA-5rm5-xp9h-jf8q.json b/advisories/unreviewed/2021/12/GHSA-5rm5-xp9h-jf8q/GHSA-5rm5-xp9h-jf8q.json index ee2212bd982..bc0d14aa302 100644 --- a/advisories/unreviewed/2021/12/GHSA-5rm5-xp9h-jf8q/GHSA-5rm5-xp9h-jf8q.json +++ b/advisories/unreviewed/2021/12/GHSA-5rm5-xp9h-jf8q/GHSA-5rm5-xp9h-jf8q.json @@ -7,12 +7,8 @@ "CVE-2021-20149" ], "details": "Trendnet AC2600 TEW-827DRU version 2.08B01 does not have sufficient access controls for the WAN interface. The default iptables ruleset for governing access to services on the device only apply to IPv4. All services running on the devices are accessible via the WAN interface via IPv6 by default.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-5x52-v7fr-j269/GHSA-5x52-v7fr-j269.json b/advisories/unreviewed/2021/12/GHSA-5x52-v7fr-j269/GHSA-5x52-v7fr-j269.json index 64a0b699b02..4dbab35d15c 100644 --- a/advisories/unreviewed/2021/12/GHSA-5x52-v7fr-j269/GHSA-5x52-v7fr-j269.json +++ b/advisories/unreviewed/2021/12/GHSA-5x52-v7fr-j269/GHSA-5x52-v7fr-j269.json @@ -7,12 +7,8 @@ "CVE-2021-4179" ], "details": "livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-628p-46mw-v4f9/GHSA-628p-46mw-v4f9.json b/advisories/unreviewed/2021/12/GHSA-628p-46mw-v4f9/GHSA-628p-46mw-v4f9.json index 173531517d7..927f575c4de 100644 --- a/advisories/unreviewed/2021/12/GHSA-628p-46mw-v4f9/GHSA-628p-46mw-v4f9.json +++ b/advisories/unreviewed/2021/12/GHSA-628p-46mw-v4f9/GHSA-628p-46mw-v4f9.json @@ -7,12 +7,8 @@ "CVE-2021-4161" ], "details": "The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. This could give an attacker admin rights through the HTTP web server.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-62w4-6v3m-2j3j/GHSA-62w4-6v3m-2j3j.json b/advisories/unreviewed/2021/12/GHSA-62w4-6v3m-2j3j/GHSA-62w4-6v3m-2j3j.json index e536447d5df..4cf4a2cb150 100644 --- a/advisories/unreviewed/2021/12/GHSA-62w4-6v3m-2j3j/GHSA-62w4-6v3m-2j3j.json +++ b/advisories/unreviewed/2021/12/GHSA-62w4-6v3m-2j3j/GHSA-62w4-6v3m-2j3j.json @@ -7,12 +7,8 @@ "CVE-2021-20152" ], "details": "Trendnet AC2600 TEW-827DRU version 2.08B01 lacks proper authentication to the bittorrent functionality. If enabled, anyone is able to visit and modify settings and files via the Bittorent web client by visiting: http://192.168.10.1:9091/transmission/web/", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-68wq-r372-q8gf/GHSA-68wq-r372-q8gf.json b/advisories/unreviewed/2021/12/GHSA-68wq-r372-q8gf/GHSA-68wq-r372-q8gf.json index 2d5ec735716..62f2585bdf0 100644 --- a/advisories/unreviewed/2021/12/GHSA-68wq-r372-q8gf/GHSA-68wq-r372-q8gf.json +++ b/advisories/unreviewed/2021/12/GHSA-68wq-r372-q8gf/GHSA-68wq-r372-q8gf.json @@ -7,12 +7,8 @@ "CVE-2018-17875" ], "details": "A remote code execution issue in the ping command on Poly Trio 8800 5.7.1.4145 devices allows remote authenticated users to execute commands via unspecified vectors.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,9 +24,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2021/12/GHSA-6crc-x5g7-hpmc/GHSA-6crc-x5g7-hpmc.json b/advisories/unreviewed/2021/12/GHSA-6crc-x5g7-hpmc/GHSA-6crc-x5g7-hpmc.json index 2cf7c692323..842d70f7053 100644 --- a/advisories/unreviewed/2021/12/GHSA-6crc-x5g7-hpmc/GHSA-6crc-x5g7-hpmc.json +++ b/advisories/unreviewed/2021/12/GHSA-6crc-x5g7-hpmc/GHSA-6crc-x5g7-hpmc.json @@ -7,12 +7,8 @@ "CVE-2021-45427" ], "details": "Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files without any authentication due to incorrect access control and directory traversal.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-6w2f-q3rq-jh8v/GHSA-6w2f-q3rq-jh8v.json b/advisories/unreviewed/2021/12/GHSA-6w2f-q3rq-jh8v/GHSA-6w2f-q3rq-jh8v.json index d0f38f6742f..cea719f1e97 100644 --- a/advisories/unreviewed/2021/12/GHSA-6w2f-q3rq-jh8v/GHSA-6w2f-q3rq-jh8v.json +++ b/advisories/unreviewed/2021/12/GHSA-6w2f-q3rq-jh8v/GHSA-6w2f-q3rq-jh8v.json @@ -7,12 +7,8 @@ "CVE-2021-20156" ], "details": "Trendnet AC2600 TEW-827DRU version 2.08B01 contains an improper access control configuration that could allow for a malicious firmware update. It is possible to manually install firmware that may be malicious in nature as there does not appear to be any signature validation done to determine if it is from a known and trusted source. This includes firmware updates that are done via the automated \"check for updates\" in the admin interface. If an attacker is able to masquerade as the update server, the device will not verify that the firmware updates downloaded are legitimate.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-6x2m-2w3q-qqp5/GHSA-6x2m-2w3q-qqp5.json b/advisories/unreviewed/2021/12/GHSA-6x2m-2w3q-qqp5/GHSA-6x2m-2w3q-qqp5.json index f11b69530fd..16a171521b5 100644 --- a/advisories/unreviewed/2021/12/GHSA-6x2m-2w3q-qqp5/GHSA-6x2m-2w3q-qqp5.json +++ b/advisories/unreviewed/2021/12/GHSA-6x2m-2w3q-qqp5/GHSA-6x2m-2w3q-qqp5.json @@ -7,12 +7,8 @@ "CVE-2021-45732" ], "details": "Netgear Nighthawk R6700 version 1.0.4.120 makes use of a hardcoded credential. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted/obfuscated. By extracting the configuration using readily available public tools, a user can reconfigure settings not intended to be manipulated, repackage the configuration, and restore a backup causing these settings to be changed.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-756v-gg77-ccw5/GHSA-756v-gg77-ccw5.json b/advisories/unreviewed/2021/12/GHSA-756v-gg77-ccw5/GHSA-756v-gg77-ccw5.json index 4d0a3fae01a..fa69f2a7331 100644 --- a/advisories/unreviewed/2021/12/GHSA-756v-gg77-ccw5/GHSA-756v-gg77-ccw5.json +++ b/advisories/unreviewed/2021/12/GHSA-756v-gg77-ccw5/GHSA-756v-gg77-ccw5.json @@ -7,12 +7,8 @@ "CVE-2021-20166" ], "details": "Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-778x-386c-73gw/GHSA-778x-386c-73gw.json b/advisories/unreviewed/2021/12/GHSA-778x-386c-73gw/GHSA-778x-386c-73gw.json index 88df4497315..ee14ff1822a 100644 --- a/advisories/unreviewed/2021/12/GHSA-778x-386c-73gw/GHSA-778x-386c-73gw.json +++ b/advisories/unreviewed/2021/12/GHSA-778x-386c-73gw/GHSA-778x-386c-73gw.json @@ -7,12 +7,8 @@ "CVE-2021-35035" ], "details": "A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenticated attacker to obtain sensitive information from the configuration file.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-7c52-4c49-68xc/GHSA-7c52-4c49-68xc.json b/advisories/unreviewed/2021/12/GHSA-7c52-4c49-68xc/GHSA-7c52-4c49-68xc.json index 2336c6b8e40..d12f7505c7e 100644 --- a/advisories/unreviewed/2021/12/GHSA-7c52-4c49-68xc/GHSA-7c52-4c49-68xc.json +++ b/advisories/unreviewed/2021/12/GHSA-7c52-4c49-68xc/GHSA-7c52-4c49-68xc.json @@ -7,12 +7,8 @@ "CVE-2021-45908" ], "details": "An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a while loop. An attacker has little influence over the data written to the stack, making it unlikely that the flow of control can be subverted.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-7ggp-fc92-x5m6/GHSA-7ggp-fc92-x5m6.json b/advisories/unreviewed/2021/12/GHSA-7ggp-fc92-x5m6/GHSA-7ggp-fc92-x5m6.json index 32c3168743d..8855dd782b9 100644 --- a/advisories/unreviewed/2021/12/GHSA-7ggp-fc92-x5m6/GHSA-7ggp-fc92-x5m6.json +++ b/advisories/unreviewed/2021/12/GHSA-7ggp-fc92-x5m6/GHSA-7ggp-fc92-x5m6.json @@ -7,12 +7,8 @@ "CVE-2021-20171" ], "details": "Netgear RAX43 version 1.0.3.96 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are stored in plaintext on the device. For example, the admin password is stored in plaintext in the primary configuration file on the device.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-7m57-3qxm-fc4j/GHSA-7m57-3qxm-fc4j.json b/advisories/unreviewed/2021/12/GHSA-7m57-3qxm-fc4j/GHSA-7m57-3qxm-fc4j.json index 6d8822ec418..6e7272e46e9 100644 --- a/advisories/unreviewed/2021/12/GHSA-7m57-3qxm-fc4j/GHSA-7m57-3qxm-fc4j.json +++ b/advisories/unreviewed/2021/12/GHSA-7m57-3qxm-fc4j/GHSA-7m57-3qxm-fc4j.json @@ -7,12 +7,8 @@ "CVE-2021-43550" ], "details": "The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information, which affects the communications between Patient Information Center iX (PIC iX) Versions C.02 and C.03 and Efficia CM Series Revisions A.01 to C.0x and 4.0.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-7p6q-fmrv-hfqg/GHSA-7p6q-fmrv-hfqg.json b/advisories/unreviewed/2021/12/GHSA-7p6q-fmrv-hfqg/GHSA-7p6q-fmrv-hfqg.json index 1f21366aae8..358a210b5d9 100644 --- a/advisories/unreviewed/2021/12/GHSA-7p6q-fmrv-hfqg/GHSA-7p6q-fmrv-hfqg.json +++ b/advisories/unreviewed/2021/12/GHSA-7p6q-fmrv-hfqg/GHSA-7p6q-fmrv-hfqg.json @@ -7,12 +7,8 @@ "CVE-2020-7878" ], "details": "An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9 and earlier versions (CVE-2020-7878). This issue is due to missing support for integrity check.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-7v5f-6mfx-4g37/GHSA-7v5f-6mfx-4g37.json b/advisories/unreviewed/2021/12/GHSA-7v5f-6mfx-4g37/GHSA-7v5f-6mfx-4g37.json index 66b29c0018e..4d0bbb39c1e 100644 --- a/advisories/unreviewed/2021/12/GHSA-7v5f-6mfx-4g37/GHSA-7v5f-6mfx-4g37.json +++ b/advisories/unreviewed/2021/12/GHSA-7v5f-6mfx-4g37/GHSA-7v5f-6mfx-4g37.json @@ -7,12 +7,8 @@ "CVE-2021-45813" ], "details": "SLICAN WebCTI 1.01 2015 is affected by a Cross Site Scripting (XSS) vulnerability. The attacker can steal the user's session by injecting malicious JavaScript codes which leads to Session Hijacking and cause user's credentials theft.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-7v67-49jp-7j47/GHSA-7v67-49jp-7j47.json b/advisories/unreviewed/2021/12/GHSA-7v67-49jp-7j47/GHSA-7v67-49jp-7j47.json index e4faf8a079c..55b3e351c1b 100644 --- a/advisories/unreviewed/2021/12/GHSA-7v67-49jp-7j47/GHSA-7v67-49jp-7j47.json +++ b/advisories/unreviewed/2021/12/GHSA-7v67-49jp-7j47/GHSA-7v67-49jp-7j47.json @@ -7,12 +7,8 @@ "CVE-2020-7883" ], "details": "Printchaser v2.2021.804.1 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the argument, variable in the activeX module. This can be leveraged for code execution.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-7vmc-m88v-6vfg/GHSA-7vmc-m88v-6vfg.json b/advisories/unreviewed/2021/12/GHSA-7vmc-m88v-6vfg/GHSA-7vmc-m88v-6vfg.json index 29607c6e26f..e31da19ae60 100644 --- a/advisories/unreviewed/2021/12/GHSA-7vmc-m88v-6vfg/GHSA-7vmc-m88v-6vfg.json +++ b/advisories/unreviewed/2021/12/GHSA-7vmc-m88v-6vfg/GHSA-7vmc-m88v-6vfg.json @@ -7,12 +7,8 @@ "CVE-2020-21238" ], "details": "An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-7wvg-v832-h9xq/GHSA-7wvg-v832-h9xq.json b/advisories/unreviewed/2021/12/GHSA-7wvg-v832-h9xq/GHSA-7wvg-v832-h9xq.json index 18662e0fd6e..d7bb64e9f3b 100644 --- a/advisories/unreviewed/2021/12/GHSA-7wvg-v832-h9xq/GHSA-7wvg-v832-h9xq.json +++ b/advisories/unreviewed/2021/12/GHSA-7wvg-v832-h9xq/GHSA-7wvg-v832-h9xq.json @@ -7,12 +7,8 @@ "CVE-2021-36722" ], "details": "Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on the affected endpoints. The SQLi caused by CWE-209: Generation of Error Message Containig Sensetive Information, showing parts of the aspx code and the webroot location , information an attacker can leverage to further compromise the host.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-8397-33w7-cmhc/GHSA-8397-33w7-cmhc.json b/advisories/unreviewed/2021/12/GHSA-8397-33w7-cmhc/GHSA-8397-33w7-cmhc.json index fdbc32f21f2..1a1b51bbed1 100644 --- a/advisories/unreviewed/2021/12/GHSA-8397-33w7-cmhc/GHSA-8397-33w7-cmhc.json +++ b/advisories/unreviewed/2021/12/GHSA-8397-33w7-cmhc/GHSA-8397-33w7-cmhc.json @@ -7,12 +7,8 @@ "CVE-2021-38687" ], "details": "A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Surveillance Station: QTS 5.0.0 (64 bit): Surveillance Station 5.2.0.4.2 ( 2021/10/26 ) and later QTS 5.0.0 (32 bit): Surveillance Station 5.2.0.3.2 ( 2021/10/26 ) and later QTS 4.3.6 (64 bit): Surveillance Station 5.1.5.4.6 ( 2021/10/26 ) and later QTS 4.3.6 (32 bit): Surveillance Station 5.1.5.3.6 ( 2021/10/26 ) and later QTS 4.3.3: Surveillance Station 5.1.5.3.6 ( 2021/10/26 ) and later", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-8r96-wwm9-5vjv/GHSA-8r96-wwm9-5vjv.json b/advisories/unreviewed/2021/12/GHSA-8r96-wwm9-5vjv/GHSA-8r96-wwm9-5vjv.json index a81c2da6a1b..6007c413337 100644 --- a/advisories/unreviewed/2021/12/GHSA-8r96-wwm9-5vjv/GHSA-8r96-wwm9-5vjv.json +++ b/advisories/unreviewed/2021/12/GHSA-8r96-wwm9-5vjv/GHSA-8r96-wwm9-5vjv.json @@ -7,12 +7,8 @@ "CVE-2021-20167" ], "details": "Netgear RAX43 version 1.0.3.96 contains a command injection vulnerability. The readycloud cgi application is vulnerable to command injection in the name parameter.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-8v3c-9hr5-hqm7/GHSA-8v3c-9hr5-hqm7.json b/advisories/unreviewed/2021/12/GHSA-8v3c-9hr5-hqm7/GHSA-8v3c-9hr5-hqm7.json index d2e982a8750..2385c3a1862 100644 --- a/advisories/unreviewed/2021/12/GHSA-8v3c-9hr5-hqm7/GHSA-8v3c-9hr5-hqm7.json +++ b/advisories/unreviewed/2021/12/GHSA-8v3c-9hr5-hqm7/GHSA-8v3c-9hr5-hqm7.json @@ -7,12 +7,8 @@ "CVE-2021-20132" ], "details": "Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 use default hard-coded credentials, which can allow a remote attacker to gain administrative access to the zebra or ripd those services. Both are running with root privileges on the router (i.e., as the \"admin\" user, UID 0).", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-8wp2-r2mg-m256/GHSA-8wp2-r2mg-m256.json b/advisories/unreviewed/2021/12/GHSA-8wp2-r2mg-m256/GHSA-8wp2-r2mg-m256.json index b131c84b5ac..1f25a4b246a 100644 --- a/advisories/unreviewed/2021/12/GHSA-8wp2-r2mg-m256/GHSA-8wp2-r2mg-m256.json +++ b/advisories/unreviewed/2021/12/GHSA-8wp2-r2mg-m256/GHSA-8wp2-r2mg-m256.json @@ -7,12 +7,8 @@ "CVE-2021-20169" ], "details": "Netgear RAX43 version 1.0.3.96 does not utilize secure communications to the web interface. By default, all communication to/from the device is sent via HTTP, which causes potentially sensitive information (such as usernames and passwords) to be transmitted in cleartext.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-92fp-r453-7wpg/GHSA-92fp-r453-7wpg.json b/advisories/unreviewed/2021/12/GHSA-92fp-r453-7wpg/GHSA-92fp-r453-7wpg.json index 9b1637ee869..8cb346e1703 100644 --- a/advisories/unreviewed/2021/12/GHSA-92fp-r453-7wpg/GHSA-92fp-r453-7wpg.json +++ b/advisories/unreviewed/2021/12/GHSA-92fp-r453-7wpg/GHSA-92fp-r453-7wpg.json @@ -7,12 +7,8 @@ "CVE-2021-4176" ], "details": "livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-92gj-cjfc-w72m/GHSA-92gj-cjfc-w72m.json b/advisories/unreviewed/2021/12/GHSA-92gj-cjfc-w72m/GHSA-92gj-cjfc-w72m.json index 7666da5af9e..70b053cbbd3 100644 --- a/advisories/unreviewed/2021/12/GHSA-92gj-cjfc-w72m/GHSA-92gj-cjfc-w72m.json +++ b/advisories/unreviewed/2021/12/GHSA-92gj-cjfc-w72m/GHSA-92gj-cjfc-w72m.json @@ -7,12 +7,8 @@ "CVE-2021-23147" ], "details": "Netgear Nighthawk R6700 version 1.0.4.120 does not have sufficient protections for the UART console. A malicious actor with physical access to the device is able to connect to the UART port via a serial connection and execute commands as the root user without authentication.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-952v-h4m8-6pcg/GHSA-952v-h4m8-6pcg.json b/advisories/unreviewed/2021/12/GHSA-952v-h4m8-6pcg/GHSA-952v-h4m8-6pcg.json index 44d3a0578d7..a02f4cae855 100644 --- a/advisories/unreviewed/2021/12/GHSA-952v-h4m8-6pcg/GHSA-952v-h4m8-6pcg.json +++ b/advisories/unreviewed/2021/12/GHSA-952v-h4m8-6pcg/GHSA-952v-h4m8-6pcg.json @@ -7,12 +7,8 @@ "CVE-2021-40579" ], "details": "https://www.sourcecodester.com/ Online Enrollment Management System in PHP and PayPal Free Source Code 1.0 is affected by: Incorrect Access Control. The impact is: gain privileges (remote).", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-974q-xv7x-qw7f/GHSA-974q-xv7x-qw7f.json b/advisories/unreviewed/2021/12/GHSA-974q-xv7x-qw7f/GHSA-974q-xv7x-qw7f.json index 0da0866c719..21f2397be95 100644 --- a/advisories/unreviewed/2021/12/GHSA-974q-xv7x-qw7f/GHSA-974q-xv7x-qw7f.json +++ b/advisories/unreviewed/2021/12/GHSA-974q-xv7x-qw7f/GHSA-974q-xv7x-qw7f.json @@ -7,12 +7,8 @@ "CVE-2021-20162" ], "details": "Trendnet AC2600 TEW-827DRU version 2.08B01 stores credentials in plaintext. Usernames and passwords are stored in plaintext in the config files on the device. For example, /etc/config/cameo contains the admin password in plaintext.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-9869-mhm7-vvmm/GHSA-9869-mhm7-vvmm.json b/advisories/unreviewed/2021/12/GHSA-9869-mhm7-vvmm/GHSA-9869-mhm7-vvmm.json index 1b2ecd8df58..fdac7f06aae 100644 --- a/advisories/unreviewed/2021/12/GHSA-9869-mhm7-vvmm/GHSA-9869-mhm7-vvmm.json +++ b/advisories/unreviewed/2021/12/GHSA-9869-mhm7-vvmm/GHSA-9869-mhm7-vvmm.json @@ -7,12 +7,8 @@ "CVE-2021-25991" ], "details": "In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,9 +24,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2021/12/GHSA-9fpv-f8f2-2jm6/GHSA-9fpv-f8f2-2jm6.json b/advisories/unreviewed/2021/12/GHSA-9fpv-f8f2-2jm6/GHSA-9fpv-f8f2-2jm6.json index 135c4023f18..a47d844a65f 100644 --- a/advisories/unreviewed/2021/12/GHSA-9fpv-f8f2-2jm6/GHSA-9fpv-f8f2-2jm6.json +++ b/advisories/unreviewed/2021/12/GHSA-9fpv-f8f2-2jm6/GHSA-9fpv-f8f2-2jm6.json @@ -7,12 +7,8 @@ "CVE-2020-22057" ], "details": "The WinRin0x64.sys and WinRing0.sys low-level drivers in EVGA Precision XOC version v6.2.7 were discovered to be configured with the default security descriptor which allows attackers to access sensitive components and data.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,9 +20,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2021/12/GHSA-c9fh-qp5h-24w7/GHSA-c9fh-qp5h-24w7.json b/advisories/unreviewed/2021/12/GHSA-c9fh-qp5h-24w7/GHSA-c9fh-qp5h-24w7.json index 6ec547d32df..4d74be88ec4 100644 --- a/advisories/unreviewed/2021/12/GHSA-c9fh-qp5h-24w7/GHSA-c9fh-qp5h-24w7.json +++ b/advisories/unreviewed/2021/12/GHSA-c9fh-qp5h-24w7/GHSA-c9fh-qp5h-24w7.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-cvrj-cr4m-fg2f/GHSA-cvrj-cr4m-fg2f.json b/advisories/unreviewed/2021/12/GHSA-cvrj-cr4m-fg2f/GHSA-cvrj-cr4m-fg2f.json index 1e0bbed2ded..daf80c5baf7 100644 --- a/advisories/unreviewed/2021/12/GHSA-cvrj-cr4m-fg2f/GHSA-cvrj-cr4m-fg2f.json +++ b/advisories/unreviewed/2021/12/GHSA-cvrj-cr4m-fg2f/GHSA-cvrj-cr4m-fg2f.json @@ -7,12 +7,8 @@ "CVE-2021-36724" ], "details": "ForeScout - SecureConnector Local Service DoS - A low privilaged user which doesn't have permissions to shutdown the secure connector service writes a large amount of characters in the installationPath. This will cause the buffer to overflow and override the stack cookie causing the service to crash.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-cx29-cqmj-72f7/GHSA-cx29-cqmj-72f7.json b/advisories/unreviewed/2021/12/GHSA-cx29-cqmj-72f7/GHSA-cx29-cqmj-72f7.json index c8a3e64decd..fd8f82a6908 100644 --- a/advisories/unreviewed/2021/12/GHSA-cx29-cqmj-72f7/GHSA-cx29-cqmj-72f7.json +++ b/advisories/unreviewed/2021/12/GHSA-cx29-cqmj-72f7/GHSA-cx29-cqmj-72f7.json @@ -7,12 +7,8 @@ "CVE-2021-20155" ], "details": "Trendnet AC2600 TEW-827DRU version 2.08B01 makes use of hardcoded credentials. It is possible to backup and restore device configurations via the management web interface. These devices are encrypted using a hardcoded password of \"12345678\".", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-f373-v3ww-mcwj/GHSA-f373-v3ww-mcwj.json b/advisories/unreviewed/2021/12/GHSA-f373-v3ww-mcwj/GHSA-f373-v3ww-mcwj.json index 2f23d2cb099..61f4de00e18 100644 --- a/advisories/unreviewed/2021/12/GHSA-f373-v3ww-mcwj/GHSA-f373-v3ww-mcwj.json +++ b/advisories/unreviewed/2021/12/GHSA-f373-v3ww-mcwj/GHSA-f373-v3ww-mcwj.json @@ -7,12 +7,8 @@ "CVE-2021-24997" ], "details": "The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to send messages as an arbitrary user", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-f8jj-6823-vfgv/GHSA-f8jj-6823-vfgv.json b/advisories/unreviewed/2021/12/GHSA-f8jj-6823-vfgv/GHSA-f8jj-6823-vfgv.json index 2319801c61d..cce627bce95 100644 --- a/advisories/unreviewed/2021/12/GHSA-f8jj-6823-vfgv/GHSA-f8jj-6823-vfgv.json +++ b/advisories/unreviewed/2021/12/GHSA-f8jj-6823-vfgv/GHSA-f8jj-6823-vfgv.json @@ -7,12 +7,8 @@ "CVE-2021-25990" ], "details": "In “ifme”, versions v7.22.0 to v7.31.4 are vulnerable against self-stored XSS in the contacts field as it allows loading XSS payloads fetched via an iframe.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-ffwq-4c3g-rwmp/GHSA-ffwq-4c3g-rwmp.json b/advisories/unreviewed/2021/12/GHSA-ffwq-4c3g-rwmp/GHSA-ffwq-4c3g-rwmp.json index fe4114767cd..fed934d8eee 100644 --- a/advisories/unreviewed/2021/12/GHSA-ffwq-4c3g-rwmp/GHSA-ffwq-4c3g-rwmp.json +++ b/advisories/unreviewed/2021/12/GHSA-ffwq-4c3g-rwmp/GHSA-ffwq-4c3g-rwmp.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-fwv7-9j7c-rjhr/GHSA-fwv7-9j7c-rjhr.json b/advisories/unreviewed/2021/12/GHSA-fwv7-9j7c-rjhr/GHSA-fwv7-9j7c-rjhr.json index e9a0a4e821c..4cc1a362bd2 100644 --- a/advisories/unreviewed/2021/12/GHSA-fwv7-9j7c-rjhr/GHSA-fwv7-9j7c-rjhr.json +++ b/advisories/unreviewed/2021/12/GHSA-fwv7-9j7c-rjhr/GHSA-fwv7-9j7c-rjhr.json @@ -7,12 +7,8 @@ "CVE-2021-25988" ], "details": "In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally request to the admin.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-gjmr-rw74-6fvm/GHSA-gjmr-rw74-6fvm.json b/advisories/unreviewed/2021/12/GHSA-gjmr-rw74-6fvm/GHSA-gjmr-rw74-6fvm.json index a5774a57277..81169d5e009 100644 --- a/advisories/unreviewed/2021/12/GHSA-gjmr-rw74-6fvm/GHSA-gjmr-rw74-6fvm.json +++ b/advisories/unreviewed/2021/12/GHSA-gjmr-rw74-6fvm/GHSA-gjmr-rw74-6fvm.json @@ -7,12 +7,8 @@ "CVE-2021-45335" ], "details": "Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of scans, and therefore evade detection or delete arbitrary system files.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-gv42-v83p-3gw3/GHSA-gv42-v83p-3gw3.json b/advisories/unreviewed/2021/12/GHSA-gv42-v83p-3gw3/GHSA-gv42-v83p-3gw3.json index 1af322c9efe..82ff72ece85 100644 --- a/advisories/unreviewed/2021/12/GHSA-gv42-v83p-3gw3/GHSA-gv42-v83p-3gw3.json +++ b/advisories/unreviewed/2021/12/GHSA-gv42-v83p-3gw3/GHSA-gv42-v83p-3gw3.json @@ -7,12 +7,8 @@ "CVE-2021-37400" ], "details": "An attacker may obtain the user credentials from the communication between the PLC and the software. As a result, the PLC user program may be uploaded, altered, and/or downloaded.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-h5xm-qm7g-wc4p/GHSA-h5xm-qm7g-wc4p.json b/advisories/unreviewed/2021/12/GHSA-h5xm-qm7g-wc4p/GHSA-h5xm-qm7g-wc4p.json index 9be66d332e1..18d3ea2f6f0 100644 --- a/advisories/unreviewed/2021/12/GHSA-h5xm-qm7g-wc4p/GHSA-h5xm-qm7g-wc4p.json +++ b/advisories/unreviewed/2021/12/GHSA-h5xm-qm7g-wc4p/GHSA-h5xm-qm7g-wc4p.json @@ -7,12 +7,8 @@ "CVE-2021-24797" ], "details": "The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-h85j-72xp-mx96/GHSA-h85j-72xp-mx96.json b/advisories/unreviewed/2021/12/GHSA-h85j-72xp-mx96/GHSA-h85j-72xp-mx96.json index db265e25c92..01385379c1b 100644 --- a/advisories/unreviewed/2021/12/GHSA-h85j-72xp-mx96/GHSA-h85j-72xp-mx96.json +++ b/advisories/unreviewed/2021/12/GHSA-h85j-72xp-mx96/GHSA-h85j-72xp-mx96.json @@ -7,12 +7,8 @@ "CVE-2019-20082" ], "details": "ASUS RT-N53 3.0.0.4.376.3754 devices have a buffer overflow via a long lan_dns1_x or lan_dns2_x parameter to Advanced_LAN_Content.asp.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-hgvj-q3gx-63jm/GHSA-hgvj-q3gx-63jm.json b/advisories/unreviewed/2021/12/GHSA-hgvj-q3gx-63jm/GHSA-hgvj-q3gx-63jm.json index e5c14d9788b..5d2f0168226 100644 --- a/advisories/unreviewed/2021/12/GHSA-hgvj-q3gx-63jm/GHSA-hgvj-q3gx-63jm.json +++ b/advisories/unreviewed/2021/12/GHSA-hgvj-q3gx-63jm/GHSA-hgvj-q3gx-63jm.json @@ -7,12 +7,8 @@ "CVE-2021-20163" ], "details": "Trendnet AC2600 TEW-827DRU version 2.08B01 leaks information via the ftp web page. Usernames and passwords for all ftp users are revealed in plaintext on the ftpserver.asp page.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-hqq7-2rg7-fxx5/GHSA-hqq7-2rg7-fxx5.json b/advisories/unreviewed/2021/12/GHSA-hqq7-2rg7-fxx5/GHSA-hqq7-2rg7-fxx5.json index 26e7a5fb25f..f8c8ea7a296 100644 --- a/advisories/unreviewed/2021/12/GHSA-hqq7-2rg7-fxx5/GHSA-hqq7-2rg7-fxx5.json +++ b/advisories/unreviewed/2021/12/GHSA-hqq7-2rg7-fxx5/GHSA-hqq7-2rg7-fxx5.json @@ -7,12 +7,8 @@ "CVE-2021-20151" ], "details": "Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's management software manages web sessions based on IP address rather than verifying client cookies/session tokens/etc. This allows an attacker (whether from a different computer, different web browser on the same machine, etc.) to take over an existing session. This does require the attacker to be able to spoof or take over original IP address of the original user's session.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-jfjg-288w-6ffp/GHSA-jfjg-288w-6ffp.json b/advisories/unreviewed/2021/12/GHSA-jfjg-288w-6ffp/GHSA-jfjg-288w-6ffp.json index 46ec87161e3..8ae6f38dc14 100644 --- a/advisories/unreviewed/2021/12/GHSA-jfjg-288w-6ffp/GHSA-jfjg-288w-6ffp.json +++ b/advisories/unreviewed/2021/12/GHSA-jfjg-288w-6ffp/GHSA-jfjg-288w-6ffp.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-jg98-xfvf-7pvv/GHSA-jg98-xfvf-7pvv.json b/advisories/unreviewed/2021/12/GHSA-jg98-xfvf-7pvv/GHSA-jg98-xfvf-7pvv.json index 6b15b8364d0..eff6613f87a 100644 --- a/advisories/unreviewed/2021/12/GHSA-jg98-xfvf-7pvv/GHSA-jg98-xfvf-7pvv.json +++ b/advisories/unreviewed/2021/12/GHSA-jg98-xfvf-7pvv/GHSA-jg98-xfvf-7pvv.json @@ -7,12 +7,8 @@ "CVE-2021-45885" ], "details": "An issue was discovered in Stormshield Network Security (SNS) 4.2.2 through 4.2.7 (fixed in 4.2.8). Under a specific update-migration scenario, the first SSH password change does not properly clear the old password.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-jh4v-x3g4-f2hj/GHSA-jh4v-x3g4-f2hj.json b/advisories/unreviewed/2021/12/GHSA-jh4v-x3g4-f2hj/GHSA-jh4v-x3g4-f2hj.json index 0459e7694a0..5af59e452ac 100644 --- a/advisories/unreviewed/2021/12/GHSA-jh4v-x3g4-f2hj/GHSA-jh4v-x3g4-f2hj.json +++ b/advisories/unreviewed/2021/12/GHSA-jh4v-x3g4-f2hj/GHSA-jh4v-x3g4-f2hj.json @@ -7,12 +7,8 @@ "CVE-2021-24980" ], "details": "The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in an admin page", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-jv5v-53vg-gcm3/GHSA-jv5v-53vg-gcm3.json b/advisories/unreviewed/2021/12/GHSA-jv5v-53vg-gcm3/GHSA-jv5v-53vg-gcm3.json index 947866dc73e..447aebb696b 100644 --- a/advisories/unreviewed/2021/12/GHSA-jv5v-53vg-gcm3/GHSA-jv5v-53vg-gcm3.json +++ b/advisories/unreviewed/2021/12/GHSA-jv5v-53vg-gcm3/GHSA-jv5v-53vg-gcm3.json @@ -7,12 +7,8 @@ "CVE-2021-24902" ], "details": "The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-jwgj-g8f9-jfg6/GHSA-jwgj-g8f9-jfg6.json b/advisories/unreviewed/2021/12/GHSA-jwgj-g8f9-jfg6/GHSA-jwgj-g8f9-jfg6.json index 00bf2a8cad7..c19d66865ab 100644 --- a/advisories/unreviewed/2021/12/GHSA-jwgj-g8f9-jfg6/GHSA-jwgj-g8f9-jfg6.json +++ b/advisories/unreviewed/2021/12/GHSA-jwgj-g8f9-jfg6/GHSA-jwgj-g8f9-jfg6.json @@ -7,12 +7,8 @@ "CVE-2021-38680" ], "details": "A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Kazoo Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Kazoo Server: Kazoo Server 4.11.20 and later", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-m5r3-7h55-8p6v/GHSA-m5r3-7h55-8p6v.json b/advisories/unreviewed/2021/12/GHSA-m5r3-7h55-8p6v/GHSA-m5r3-7h55-8p6v.json index a59e2f8a20a..bf9a8a9a85b 100644 --- a/advisories/unreviewed/2021/12/GHSA-m5r3-7h55-8p6v/GHSA-m5r3-7h55-8p6v.json +++ b/advisories/unreviewed/2021/12/GHSA-m5r3-7h55-8p6v/GHSA-m5r3-7h55-8p6v.json @@ -7,12 +7,8 @@ "CVE-2021-37401" ], "details": "An attacker may obtain the user credentials from file servers, backup repositories, or ZLD files saved in SD cards. As a result, the PLC user program may be uploaded, altered, and/or downloaded.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-m9jg-hj4g-7m6r/GHSA-m9jg-hj4g-7m6r.json b/advisories/unreviewed/2021/12/GHSA-m9jg-hj4g-7m6r/GHSA-m9jg-hj4g-7m6r.json index 8d0f6888c9e..ba3a8fc1862 100644 --- a/advisories/unreviewed/2021/12/GHSA-m9jg-hj4g-7m6r/GHSA-m9jg-hj4g-7m6r.json +++ b/advisories/unreviewed/2021/12/GHSA-m9jg-hj4g-7m6r/GHSA-m9jg-hj4g-7m6r.json @@ -7,12 +7,8 @@ "CVE-2021-20174" ], "details": "Netgear Nighthawk R6700 version 1.0.4.120 does not utilize secure communication methods to the web interface. By default, all communication to/from the device's web interface is sent via HTTP, which causes potentially sensitive information (such as usernames and passwords) to be transmitted in cleartext.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-mc2w-7m72-6cv7/GHSA-mc2w-7m72-6cv7.json b/advisories/unreviewed/2021/12/GHSA-mc2w-7m72-6cv7/GHSA-mc2w-7m72-6cv7.json index 99719429cc8..f4d95e2166a 100644 --- a/advisories/unreviewed/2021/12/GHSA-mc2w-7m72-6cv7/GHSA-mc2w-7m72-6cv7.json +++ b/advisories/unreviewed/2021/12/GHSA-mc2w-7m72-6cv7/GHSA-mc2w-7m72-6cv7.json @@ -7,12 +7,8 @@ "CVE-2021-45425" ], "details": "Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScript codes.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-mcf9-rwvw-cv27/GHSA-mcf9-rwvw-cv27.json b/advisories/unreviewed/2021/12/GHSA-mcf9-rwvw-cv27/GHSA-mcf9-rwvw-cv27.json index e142161d749..74c499a3b53 100644 --- a/advisories/unreviewed/2021/12/GHSA-mcf9-rwvw-cv27/GHSA-mcf9-rwvw-cv27.json +++ b/advisories/unreviewed/2021/12/GHSA-mcf9-rwvw-cv27/GHSA-mcf9-rwvw-cv27.json @@ -7,12 +7,8 @@ "CVE-2021-33017" ], "details": "The standard access path of the IntelliBridge EC 40 and 60 Hub (C.00.04 and prior) requires authentication, but the product has an alternate path or channel that does not require authentication.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-mrgq-g6pr-vqcp/GHSA-mrgq-g6pr-vqcp.json b/advisories/unreviewed/2021/12/GHSA-mrgq-g6pr-vqcp/GHSA-mrgq-g6pr-vqcp.json index 5fefd059a0d..8ba06f18522 100644 --- a/advisories/unreviewed/2021/12/GHSA-mrgq-g6pr-vqcp/GHSA-mrgq-g6pr-vqcp.json +++ b/advisories/unreviewed/2021/12/GHSA-mrgq-g6pr-vqcp/GHSA-mrgq-g6pr-vqcp.json @@ -7,12 +7,8 @@ "CVE-2021-45903" ], "details": "A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-p2p9-3jf4-23jr/GHSA-p2p9-3jf4-23jr.json b/advisories/unreviewed/2021/12/GHSA-p2p9-3jf4-23jr/GHSA-p2p9-3jf4-23jr.json index 25aac7ae815..28dfdd8516d 100644 --- a/advisories/unreviewed/2021/12/GHSA-p2p9-3jf4-23jr/GHSA-p2p9-3jf4-23jr.json +++ b/advisories/unreviewed/2021/12/GHSA-p2p9-3jf4-23jr/GHSA-p2p9-3jf4-23jr.json @@ -7,12 +7,8 @@ "CVE-2021-38961" ], "details": "IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-p653-4j6m-xv68/GHSA-p653-4j6m-xv68.json b/advisories/unreviewed/2021/12/GHSA-p653-4j6m-xv68/GHSA-p653-4j6m-xv68.json index 8f603163768..4c1c18fc3f2 100644 --- a/advisories/unreviewed/2021/12/GHSA-p653-4j6m-xv68/GHSA-p653-4j6m-xv68.json +++ b/advisories/unreviewed/2021/12/GHSA-p653-4j6m-xv68/GHSA-p653-4j6m-xv68.json @@ -7,12 +7,8 @@ "CVE-2021-45815" ], "details": "Quectel UC20 UMTS/HSPA+ UC20 6.3.14 is affected by a Cross Site Scripting (XSS) vulnerability.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-p6gw-24qr-9gfc/GHSA-p6gw-24qr-9gfc.json b/advisories/unreviewed/2021/12/GHSA-p6gw-24qr-9gfc/GHSA-p6gw-24qr-9gfc.json index a9a6884364a..0e0d9ce1f15 100644 --- a/advisories/unreviewed/2021/12/GHSA-p6gw-24qr-9gfc/GHSA-p6gw-24qr-9gfc.json +++ b/advisories/unreviewed/2021/12/GHSA-p6gw-24qr-9gfc/GHSA-p6gw-24qr-9gfc.json @@ -7,12 +7,8 @@ "CVE-2021-21750" ], "details": "ZTE BigVideo Analysis product has a privilege escalation vulnerability. Due to improper management of the timed task modification privilege, an attacker with ordinary user permissions could exploit this vulnerability to gain unauthorized access.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-prpw-q7c7-2pvj/GHSA-prpw-q7c7-2pvj.json b/advisories/unreviewed/2021/12/GHSA-prpw-q7c7-2pvj/GHSA-prpw-q7c7-2pvj.json index a29fd6ac8e4..f78db9a6ba5 100644 --- a/advisories/unreviewed/2021/12/GHSA-prpw-q7c7-2pvj/GHSA-prpw-q7c7-2pvj.json +++ b/advisories/unreviewed/2021/12/GHSA-prpw-q7c7-2pvj/GHSA-prpw-q7c7-2pvj.json @@ -7,12 +7,8 @@ "CVE-2021-38876" ], "details": "IBM i 7.2, 7.3, and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 208404.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-qf29-4539-q2c7/GHSA-qf29-4539-q2c7.json b/advisories/unreviewed/2021/12/GHSA-qf29-4539-q2c7/GHSA-qf29-4539-q2c7.json index 9414539dbcb..557ad35c53f 100644 --- a/advisories/unreviewed/2021/12/GHSA-qf29-4539-q2c7/GHSA-qf29-4539-q2c7.json +++ b/advisories/unreviewed/2021/12/GHSA-qf29-4539-q2c7/GHSA-qf29-4539-q2c7.json @@ -7,12 +7,8 @@ "CVE-2020-29292" ], "details": "iBall WRD12EN 1.0.0 devices allow cross-site request forgery (CSRF) attacks as demonstrated by enabling DNS settings or modifying the range for IP addresses.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-qjw8-x3rv-fvrg/GHSA-qjw8-x3rv-fvrg.json b/advisories/unreviewed/2021/12/GHSA-qjw8-x3rv-fvrg/GHSA-qjw8-x3rv-fvrg.json index 538f100736a..0ee8aa362b2 100644 --- a/advisories/unreviewed/2021/12/GHSA-qjw8-x3rv-fvrg/GHSA-qjw8-x3rv-fvrg.json +++ b/advisories/unreviewed/2021/12/GHSA-qjw8-x3rv-fvrg/GHSA-qjw8-x3rv-fvrg.json @@ -7,12 +7,8 @@ "CVE-2021-45814" ], "details": "Nettmp NNT 5.1 is affected by a SQL injection vulnerability. An attacker can bypass authentication and access the panel with an administrative account.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-qmgf-hqxv-72p7/GHSA-qmgf-hqxv-72p7.json b/advisories/unreviewed/2021/12/GHSA-qmgf-hqxv-72p7/GHSA-qmgf-hqxv-72p7.json index 6c1947f9537..c8e536460ae 100644 --- a/advisories/unreviewed/2021/12/GHSA-qmgf-hqxv-72p7/GHSA-qmgf-hqxv-72p7.json +++ b/advisories/unreviewed/2021/12/GHSA-qmgf-hqxv-72p7/GHSA-qmgf-hqxv-72p7.json @@ -7,12 +7,8 @@ "CVE-2020-21237" ], "details": "An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-qq53-cmvg-m7m7/GHSA-qq53-cmvg-m7m7.json b/advisories/unreviewed/2021/12/GHSA-qq53-cmvg-m7m7/GHSA-qq53-cmvg-m7m7.json index ca42e0e31bf..376e5e7eee8 100644 --- a/advisories/unreviewed/2021/12/GHSA-qq53-cmvg-m7m7/GHSA-qq53-cmvg-m7m7.json +++ b/advisories/unreviewed/2021/12/GHSA-qq53-cmvg-m7m7/GHSA-qq53-cmvg-m7m7.json @@ -7,12 +7,8 @@ "CVE-2021-45907" ], "details": "An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a for loop. An attacker has little influence over the data written to the stack, making it unlikely that the flow of control can be subverted.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-qqj9-5rm5-5hhr/GHSA-qqj9-5rm5-5hhr.json b/advisories/unreviewed/2021/12/GHSA-qqj9-5rm5-5hhr/GHSA-qqj9-5rm5-5hhr.json index cff83171c0a..8fd8e2da4f6 100644 --- a/advisories/unreviewed/2021/12/GHSA-qqj9-5rm5-5hhr/GHSA-qqj9-5rm5-5hhr.json +++ b/advisories/unreviewed/2021/12/GHSA-qqj9-5rm5-5hhr/GHSA-qqj9-5rm5-5hhr.json @@ -7,12 +7,8 @@ "CVE-2021-20873" ], "details": "Yappli is an application development platform which provides the function to access a requested URL using Custom URL Scheme. When Android apps are developed with Yappli versions since v7.3.6 and prior to v9.30.0, they are vulnerable to improper authorization in Custom URL Scheme handler, and may be directed to unintended sites via a specially crafted URL.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-r5r4-9f2h-f6w2/GHSA-r5r4-9f2h-f6w2.json b/advisories/unreviewed/2021/12/GHSA-r5r4-9f2h-f6w2/GHSA-r5r4-9f2h-f6w2.json index 40e4bfc5c2b..7f16942cfd0 100644 --- a/advisories/unreviewed/2021/12/GHSA-r5r4-9f2h-f6w2/GHSA-r5r4-9f2h-f6w2.json +++ b/advisories/unreviewed/2021/12/GHSA-r5r4-9f2h-f6w2/GHSA-r5r4-9f2h-f6w2.json @@ -7,12 +7,8 @@ "CVE-2021-24984" ], "details": "The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-r9f4-jwv9-qjg8/GHSA-r9f4-jwv9-qjg8.json b/advisories/unreviewed/2021/12/GHSA-r9f4-jwv9-qjg8/GHSA-r9f4-jwv9-qjg8.json index 566b97fe94e..ac2a260fd5f 100644 --- a/advisories/unreviewed/2021/12/GHSA-r9f4-jwv9-qjg8/GHSA-r9f4-jwv9-qjg8.json +++ b/advisories/unreviewed/2021/12/GHSA-r9f4-jwv9-qjg8/GHSA-r9f4-jwv9-qjg8.json @@ -7,12 +7,8 @@ "CVE-2021-35032" ], "details": "A vulnerability in the 'libsal.so' of the Zyxel GS1900 series firmware version 2.60 could allow an authenticated local user to execute arbitrary OS commands via a crafted function call.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-r9jc-5j5w-5h63/GHSA-r9jc-5j5w-5h63.json b/advisories/unreviewed/2021/12/GHSA-r9jc-5j5w-5h63/GHSA-r9jc-5j5w-5h63.json index 5795d1113e4..f6c0d835387 100644 --- a/advisories/unreviewed/2021/12/GHSA-r9jc-5j5w-5h63/GHSA-r9jc-5j5w-5h63.json +++ b/advisories/unreviewed/2021/12/GHSA-r9jc-5j5w-5h63/GHSA-r9jc-5j5w-5h63.json @@ -7,12 +7,8 @@ "CVE-2021-45812" ], "details": "NUUO Network Video Recorder NVRsolo 3.9.1 is affected by a Cross Site Scripting (XSS) vulnerability. An attacker can steal the user's session by injecting malicious JavaScript codes which leads to session hijacking.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-rfjp-9qrh-wm56/GHSA-rfjp-9qrh-wm56.json b/advisories/unreviewed/2021/12/GHSA-rfjp-9qrh-wm56/GHSA-rfjp-9qrh-wm56.json index a8cbf3c3dac..7c7586b53ca 100644 --- a/advisories/unreviewed/2021/12/GHSA-rfjp-9qrh-wm56/GHSA-rfjp-9qrh-wm56.json +++ b/advisories/unreviewed/2021/12/GHSA-rfjp-9qrh-wm56/GHSA-rfjp-9qrh-wm56.json @@ -7,12 +7,8 @@ "CVE-2021-4175" ], "details": "livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-rg5r-5ppf-cg7q/GHSA-rg5r-5ppf-cg7q.json b/advisories/unreviewed/2021/12/GHSA-rg5r-5ppf-cg7q/GHSA-rg5r-5ppf-cg7q.json index c4a8e8a0b5d..2029980bdf3 100644 --- a/advisories/unreviewed/2021/12/GHSA-rg5r-5ppf-cg7q/GHSA-rg5r-5ppf-cg7q.json +++ b/advisories/unreviewed/2021/12/GHSA-rg5r-5ppf-cg7q/GHSA-rg5r-5ppf-cg7q.json @@ -7,12 +7,8 @@ "CVE-2021-24753" ], "details": "The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-rmpw-3qc7-gg2j/GHSA-rmpw-3qc7-gg2j.json b/advisories/unreviewed/2021/12/GHSA-rmpw-3qc7-gg2j/GHSA-rmpw-3qc7-gg2j.json index ade692943f7..2484c47a7ef 100644 --- a/advisories/unreviewed/2021/12/GHSA-rmpw-3qc7-gg2j/GHSA-rmpw-3qc7-gg2j.json +++ b/advisories/unreviewed/2021/12/GHSA-rmpw-3qc7-gg2j/GHSA-rmpw-3qc7-gg2j.json @@ -7,12 +7,8 @@ "CVE-2021-24967" ], "details": "The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-v2pc-mrc3-9jc5/GHSA-v2pc-mrc3-9jc5.json b/advisories/unreviewed/2021/12/GHSA-v2pc-mrc3-9jc5/GHSA-v2pc-mrc3-9jc5.json index 54b93279d56..4dc7de9cfca 100644 --- a/advisories/unreviewed/2021/12/GHSA-v2pc-mrc3-9jc5/GHSA-v2pc-mrc3-9jc5.json +++ b/advisories/unreviewed/2021/12/GHSA-v2pc-mrc3-9jc5/GHSA-v2pc-mrc3-9jc5.json @@ -7,12 +7,8 @@ "CVE-2021-20170" ], "details": "Netgear RAX43 version 1.0.3.96 makes use of hardcoded credentials. It does not appear that normal users are intended to be able to manipulate configuration backups due to the fact that they are encrypted. This encryption is accomplished via a password-protected zip file with a hardcoded password (RAX50w!a4udk). By unzipping the configuration using this password, a user can reconfigure settings not intended to be manipulated, re-zip the configuration, and restore a backup causing these settings to be changed.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-v4h7-5mx9-q833/GHSA-v4h7-5mx9-q833.json b/advisories/unreviewed/2021/12/GHSA-v4h7-5mx9-q833/GHSA-v4h7-5mx9-q833.json index b5497037b22..abfe8f27c0b 100644 --- a/advisories/unreviewed/2021/12/GHSA-v4h7-5mx9-q833/GHSA-v4h7-5mx9-q833.json +++ b/advisories/unreviewed/2021/12/GHSA-v4h7-5mx9-q833/GHSA-v4h7-5mx9-q833.json @@ -7,12 +7,8 @@ "CVE-2021-20134" ], "details": "Quagga Services on D-Link DIR-2640 less than or equal to version 1.11B02 are affected by an absolute path traversal vulnerability that allows a remote, authenticated attacker to set an arbitrary file on the router's filesystem as the log file used by either Quagga service (zebra or ripd). Subsequent log messages will be appended to the file, prefixed by a timestamp and some logging metadata. Remote code execution can be achieved by using this vulnerability to append to a shell script on the router's filesystem, and then awaiting or triggering the execution of that script. A remote, unauthenticated root shell can easily be obtained on the device in this fashion.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-vq3f-hc79-r4pc/GHSA-vq3f-hc79-r4pc.json b/advisories/unreviewed/2021/12/GHSA-vq3f-hc79-r4pc/GHSA-vq3f-hc79-r4pc.json index fedc1a4f0fd..18ea6f277bb 100644 --- a/advisories/unreviewed/2021/12/GHSA-vq3f-hc79-r4pc/GHSA-vq3f-hc79-r4pc.json +++ b/advisories/unreviewed/2021/12/GHSA-vq3f-hc79-r4pc/GHSA-vq3f-hc79-r4pc.json @@ -7,12 +7,8 @@ "CVE-2021-20154" ], "details": "Trendnet AC2600 TEW-827DRU version 2.08B01 contains an security flaw in the web interface. HTTPS is not enabled on the device by default. This results in cleartext transmission of sensitive information such as passwords.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-vqqw-576h-989f/GHSA-vqqw-576h-989f.json b/advisories/unreviewed/2021/12/GHSA-vqqw-576h-989f/GHSA-vqqw-576h-989f.json index 234e6cbfe38..878b003b20f 100644 --- a/advisories/unreviewed/2021/12/GHSA-vqqw-576h-989f/GHSA-vqqw-576h-989f.json +++ b/advisories/unreviewed/2021/12/GHSA-vqqw-576h-989f/GHSA-vqqw-576h-989f.json @@ -7,12 +7,8 @@ "CVE-2021-43548" ], "details": "Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or incorrectly validates that the input has the properties required to process the data safely and correctly.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-wc43-284g-pqr5/GHSA-wc43-284g-pqr5.json b/advisories/unreviewed/2021/12/GHSA-wc43-284g-pqr5/GHSA-wc43-284g-pqr5.json index da5240287e1..83a39a90e26 100644 --- a/advisories/unreviewed/2021/12/GHSA-wc43-284g-pqr5/GHSA-wc43-284g-pqr5.json +++ b/advisories/unreviewed/2021/12/GHSA-wc43-284g-pqr5/GHSA-wc43-284g-pqr5.json @@ -7,12 +7,8 @@ "CVE-2021-4188" ], "details": "mruby is vulnerable to NULL Pointer Dereference", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-wcxq-f256-53xp/GHSA-wcxq-f256-53xp.json b/advisories/unreviewed/2021/12/GHSA-wcxq-f256-53xp/GHSA-wcxq-f256-53xp.json index 3be0e8f5738..61ff4df345b 100644 --- a/advisories/unreviewed/2021/12/GHSA-wcxq-f256-53xp/GHSA-wcxq-f256-53xp.json +++ b/advisories/unreviewed/2021/12/GHSA-wcxq-f256-53xp/GHSA-wcxq-f256-53xp.json @@ -7,12 +7,8 @@ "CVE-2021-45232" ], "details": "In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-wrgm-3c24-9q9r/GHSA-wrgm-3c24-9q9r.json b/advisories/unreviewed/2021/12/GHSA-wrgm-3c24-9q9r/GHSA-wrgm-3c24-9q9r.json index 1e5e76ad23b..1489b8c3fe7 100644 --- a/advisories/unreviewed/2021/12/GHSA-wrgm-3c24-9q9r/GHSA-wrgm-3c24-9q9r.json +++ b/advisories/unreviewed/2021/12/GHSA-wrgm-3c24-9q9r/GHSA-wrgm-3c24-9q9r.json @@ -7,12 +7,8 @@ "CVE-2021-20164" ], "details": "Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses credentials for the smb functionality of the device. Usernames and passwords for all smb users are revealed in plaintext on the smbserver.asp page.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-xc7r-5fm5-pmrv/GHSA-xc7r-5fm5-pmrv.json b/advisories/unreviewed/2021/12/GHSA-xc7r-5fm5-pmrv/GHSA-xc7r-5fm5-pmrv.json index 15ce63426bc..51443d59328 100644 --- a/advisories/unreviewed/2021/12/GHSA-xc7r-5fm5-pmrv/GHSA-xc7r-5fm5-pmrv.json +++ b/advisories/unreviewed/2021/12/GHSA-xc7r-5fm5-pmrv/GHSA-xc7r-5fm5-pmrv.json @@ -7,12 +7,8 @@ "CVE-2020-22061" ], "details": "SUPERAntispyware v8.0.0.1050 was discovered to contain an issue in the component saskutil64.sys. This issue allows attackers to arbitrarily write data to the device via IOCTL 0x9C402140.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,9 +20,7 @@ } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2021/12/GHSA-xghr-m3mr-m6m9/GHSA-xghr-m3mr-m6m9.json b/advisories/unreviewed/2021/12/GHSA-xghr-m3mr-m6m9/GHSA-xghr-m3mr-m6m9.json index a66e1157935..e83182e4dcd 100644 --- a/advisories/unreviewed/2021/12/GHSA-xghr-m3mr-m6m9/GHSA-xghr-m3mr-m6m9.json +++ b/advisories/unreviewed/2021/12/GHSA-xghr-m3mr-m6m9/GHSA-xghr-m3mr-m6m9.json @@ -7,12 +7,8 @@ "CVE-2021-35031" ], "details": "A vulnerability in the TFTP client of Zyxel GS1900 series firmware, XGS1210 series firmware, and XGS1250 series firmware, which could allow an authenticated LAN user to execute arbitrary OS commands via the GUI of the vulnerable device.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2021/12/GHSA-xqh9-rp73-qqh5/GHSA-xqh9-rp73-qqh5.json b/advisories/unreviewed/2021/12/GHSA-xqh9-rp73-qqh5/GHSA-xqh9-rp73-qqh5.json index 0b96c163788..234ee00f4d8 100644 --- a/advisories/unreviewed/2021/12/GHSA-xqh9-rp73-qqh5/GHSA-xqh9-rp73-qqh5.json +++ b/advisories/unreviewed/2021/12/GHSA-xqh9-rp73-qqh5/GHSA-xqh9-rp73-qqh5.json @@ -7,12 +7,8 @@ "CVE-2021-20153" ], "details": "Trendnet AC2600 TEW-827DRU version 2.08B01 contains a symlink vulnerability in the bittorrent functionality. If enabled, the bittorrent functionality is vulnerable to a symlink attack that could lead to remote code execution on the device. If an end user inserts a flash drive with a malicious symlink on it that the bittorrent client can write downloads to, then a user is able to download arbitrary files to any desired location on the devices filesystem, which could lead to remote code execution. Example directories vulnerable to this include \"config\", \"downloads\", and \"torrents\", though it should be noted that \"downloads\" is the only vector that allows for arbitrary files to be downloaded to arbitrary locations.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/01/GHSA-23gx-cm6v-952g/GHSA-23gx-cm6v-952g.json b/advisories/unreviewed/2022/01/GHSA-23gx-cm6v-952g/GHSA-23gx-cm6v-952g.json index 39a51b63703..58d36ec62f5 100644 --- a/advisories/unreviewed/2022/01/GHSA-23gx-cm6v-952g/GHSA-23gx-cm6v-952g.json +++ b/advisories/unreviewed/2022/01/GHSA-23gx-cm6v-952g/GHSA-23gx-cm6v-952g.json @@ -7,12 +7,8 @@ "CVE-2021-45829" ], "details": "HDF5 1.13.1-1 is affected by: segmentation fault, which causes a Denial of Service.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/01/GHSA-25fx-qmph-2r67/GHSA-25fx-qmph-2r67.json b/advisories/unreviewed/2022/01/GHSA-25fx-qmph-2r67/GHSA-25fx-qmph-2r67.json index cf4076f4fde..a0204de9f08 100644 --- a/advisories/unreviewed/2022/01/GHSA-25fx-qmph-2r67/GHSA-25fx-qmph-2r67.json +++ b/advisories/unreviewed/2022/01/GHSA-25fx-qmph-2r67/GHSA-25fx-qmph-2r67.json @@ -7,12 +7,8 @@ "CVE-2021-45929" ], "details": "Wasm3 0.5.0 has an out-of-bounds write in CompileBlock (called from CompileElseBlock and Compile_If).", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/01/GHSA-2gcw-452g-jcfj/GHSA-2gcw-452g-jcfj.json b/advisories/unreviewed/2022/01/GHSA-2gcw-452g-jcfj/GHSA-2gcw-452g-jcfj.json index dd8eced010d..7facd03fa98 100644 --- a/advisories/unreviewed/2022/01/GHSA-2gcw-452g-jcfj/GHSA-2gcw-452g-jcfj.json +++ b/advisories/unreviewed/2022/01/GHSA-2gcw-452g-jcfj/GHSA-2gcw-452g-jcfj.json @@ -7,12 +7,8 @@ "CVE-2021-45947" ], "details": "Wasm3 0.5.0 has an out-of-bounds write in Runtime_Release (called from EvaluateExpression and InitDataSegments).", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2022/01/GHSA-4m3c-5mq3-5qxq/GHSA-4m3c-5mq3-5qxq.json b/advisories/unreviewed/2022/01/GHSA-4m3c-5mq3-5qxq/GHSA-4m3c-5mq3-5qxq.json index acfdb9eb6a3..08fef0e7cc7 100644 --- a/advisories/unreviewed/2022/01/GHSA-4m3c-5mq3-5qxq/GHSA-4m3c-5mq3-5qxq.json +++ b/advisories/unreviewed/2022/01/GHSA-4m3c-5mq3-5qxq/GHSA-4m3c-5mq3-5qxq.json @@ -7,12 +7,8 @@ "CVE-2021-45928" ], "details": "libjxl b02d6b9, as used in libvips 8.11 through 8.11.2 and other products, has an out-of-bounds write in jxl::ModularFrameDecoder::DecodeGroup (called from jxl::FrameDecoder::ProcessACGroup and jxl::ThreadPool::RunCallState uWS::HttpParser::fenceAndConsumePostPadded<0 (called from uWS::HttpParser::consumePostPadded and std::__1::__function::__func