netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2qfc-48v5-4w5h
GHSA-597c-mh7m-48v7
GHSA-9327-mqm6-x97j
GHSA-j96g-47x2-46hv
GHSA-qc43-78vj-vg7p
GHSA-qv5p-6wrc-79wg
GHSA-2qfc-48v5-4w5h
This commit is contained in:
advisory-database[bot]
2024-04-25 21:38:36 +00:00
parent dc95ab44d7
commit de8bc3117f
7 changed files with 232 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-2qfc-48v5-4w5h/GHSA-2qfc-48v5-4w5h.json
+69
View File
@@ -0,0 +1,69 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2qfc-48v5-4w5h",
"modified": "2024-04-25T21:36:41Z",
"published": "2022-05-14T03:44:35Z",
"aliases": [
"CVE-2018-6520"
],
"summary": "SimpleSAMLphp Open redirection protection bypass",
"details": "SimpleSAMLphp before 1.15.2 allows remote attackers to bypass an open redirect protection mechanism via crafted authority data in a URL.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "simplesamlphp/simplesamlphp"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.15.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6520"
},
{
"type": "WEB",
"url": "https://github.com/simplesamlphp/simplesamlphp/issues/1473"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2018-6520.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/simplesamlphp/simplesamlphp"
},
{
"type": "WEB",
"url": "https://simplesamlphp.org/security/201801-02"
}
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:36:41Z",
"nvd_published_at": "2018-02-02T01:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-597c-mh7m-48v7/GHSA-597c-mh7m-48v7.json → advisories/github-reviewed/2022/05/GHSA-597c-mh7m-48v7/GHSA-597c-mh7m-48v7.json
+35 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-597c-mh7m-48v7",
"modified": "2022-05-13T01:42:46Z",
"modified": "2024-04-25T21:37:10Z",
"published": "2022-05-13T01:42:46Z",
"aliases": [
"CVE-2017-12867"
],
"summary": "SimpleSAMLphp Invalid token creation and validation",
"details": "The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset.",
"severity": [
{
@@ -14,13 +15,43 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "simplesamlphp/simplesamlphp"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.14.0"
},
{
"fixed": "1.14.15"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12867"
},
{
"type": "WEB",
"url": "https://github.com/simplesamlphp/simplesamlphp/commit/608f24c2d5afd70c2af050785d2b12f878b33c68"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2017-12867.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/simplesamlphp/simplesamlphp"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html"
@@ -39,8 +70,8 @@
"CWE-613"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:37:10Z",
"nvd_published_at": "2017-08-29T15:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-9327-mqm6-x97j/GHSA-9327-mqm6-x97j.json → advisories/github-reviewed/2022/05/GHSA-9327-mqm6-x97j/GHSA-9327-mqm6-x97j.json
+31 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9327-mqm6-x97j",
"modified": "2022-05-14T02:57:54Z",
"modified": "2024-04-25T21:36:32Z",
"published": "2022-05-14T02:57:54Z",
"aliases": [
"CVE-2016-3124"
],
"summary": "SimpleSAMLphp Information leakage issue in the sanitycheck module",
"details": "The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors.",
"severity": [
{
@@ -14,13 +15,39 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "simplesamlphp/simplesamlphp"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3124"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2016-3124.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/simplesamlphp/simplesamlphp"
},
{
"type": "WEB",
"url": "https://simplesamlphp.org/security/201603-01"
@@ -35,8 +62,8 @@
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:36:32Z",
"nvd_published_at": "2017-02-07T17:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-j96g-47x2-46hv/GHSA-j96g-47x2-46hv.json → advisories/github-reviewed/2022/05/GHSA-j96g-47x2-46hv/GHSA-j96g-47x2-46hv.json
+31 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j96g-47x2-46hv",
"modified": "2022-05-14T03:15:07Z",
"modified": "2024-04-25T21:36:37Z",
"published": "2022-05-14T03:15:07Z",
"aliases": [
"CVE-2017-12868"
],
"summary": "SimpleSAMLphp Session fixation issue and authentication bypass in the authcrypt module",
"details": "The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "simplesamlphp/simplesamlphp"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.14.12"
},
{
"fixed": "1.14.14"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +44,14 @@
"type": "WEB",
"url": "https://github.com/simplesamlphp/simplesamlphp/commit/4bc629658e7b7d17c9ac3fe0da7dc5df71f1b85e"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2017-12868.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/simplesamlphp/simplesamlphp"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html"
@@ -43,8 +70,8 @@
"CWE-384"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:36:37Z",
"nvd_published_at": "2017-09-01T13:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-qc43-78vj-vg7p/GHSA-qc43-78vj-vg7p.json → advisories/github-reviewed/2022/05/GHSA-qc43-78vj-vg7p/GHSA-qc43-78vj-vg7p.json
+35 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qc43-78vj-vg7p",
"modified": "2022-05-14T01:04:19Z",
"modified": "2024-04-25T21:36:51Z",
"published": "2022-05-14T01:04:19Z",
"aliases": [
"CVE-2017-12869"
],
"summary": "SimpleSAMLphp Authentication context bypass in the multiauth module",
"details": "The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input.",
"severity": [
{
@@ -14,13 +15,43 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "simplesamlphp/simplesamlphp"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.14.14"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12869"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2017-12869.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/simplesamlphp/simplesamlphp"
},
{
"type": "WEB",
"url": "https://github.com/simplesamlphp/simplesamlphp/blob/de98fc5bb663feea16686ae77958f759b4a7638d/docs/simplesamlphp-changelog-1.x.md?plain=1#L902C64-L902C79"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html"
@@ -39,8 +70,8 @@
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:36:51Z",
"nvd_published_at": "2017-09-01T13:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-qv5p-6wrc-79wg/GHSA-qv5p-6wrc-79wg.json → advisories/github-reviewed/2022/05/GHSA-qv5p-6wrc-79wg/GHSA-qv5p-6wrc-79wg.json
+31 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qv5p-6wrc-79wg",
"modified": "2022-05-13T01:53:07Z",
"modified": "2024-04-25T21:37:22Z",
"published": "2022-05-13T01:53:07Z",
"aliases": [
"CVE-2018-6521"
],
"summary": "SimpleSAMLphp Use of insecure connection charset (sqlauth module)",
"details": "The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might be a scenario in which this allows remote attackers to bypass intended access restrictions.",
"severity": [
{
@@ -14,13 +15,39 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "simplesamlphp/simplesamlphp"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.15.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6521"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2018-6521.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/simplesamlphp/simplesamlphp"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/02/msg00008.html"
@@ -39,8 +66,8 @@
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-25T21:37:22Z",
"nvd_published_at": "2018-02-02T01:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-2qfc-48v5-4w5h/GHSA-2qfc-48v5-4w5h.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2qfc-48v5-4w5h",
"modified": "2022-05-14T03:44:35Z",
"published": "2022-05-14T03:44:35Z",
"aliases": [
"CVE-2018-6520"
],
"details": "SimpleSAMLphp before 1.15.2 allows remote attackers to bypass an open redirect protection mechanism via crafted authority data in a URL.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-6520"
},
{
"type": "WEB",
"url": "https://simplesamlphp.org/security/201801-02"
}
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-02-02T01:29:00Z"
}
}