netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-08-19 18:33:31 +00:00
parent 1bebe30508
commit e04e827c0f
65 changed files with 1252 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2023/03/GHSA-9g2x-mr5w-6mrm/GHSA-9g2x-mr5w-6mrm.json
+1 -1
View File
@@ -40,7 +40,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/02/GHSA-259r-2fr5-87c3/GHSA-259r-2fr5-87c3.json
+1
View File
@@ -28,6 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-287"
],
"severity": "CRITICAL",
advisories/unreviewed/2024/02/GHSA-44qr-8pf6-6q33/GHSA-44qr-8pf6-6q33.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-44qr-8pf6-6q33",
"modified": "2024-02-13T06:30:28Z",
"modified": "2024-08-19T18:32:01Z",
"published": "2024-02-13T06:30:28Z",
"aliases": [
"CVE-2022-48623"
],
"details": "The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-13T05:15:08Z"
advisories/unreviewed/2024/02/GHSA-4p3v-h475-6j2m/GHSA-4p3v-h475-6j2m.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4p3v-h475-6j2m",
"modified": "2024-02-13T18:38:23Z",
"modified": "2024-08-19T18:32:02Z",
"published": "2024-02-13T18:38:23Z",
"aliases": [
"CVE-2023-50808"
],
"details": "Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-13T18:15:47Z"
advisories/unreviewed/2024/02/GHSA-77vw-jrxp-2648/GHSA-77vw-jrxp-2648.json
+1
View File
@@ -32,6 +32,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-122",
"CWE-787"
],
"severity": "HIGH",
advisories/unreviewed/2024/04/GHSA-ggw3-6ch2-q6vf/GHSA-ggw3-6ch2-q6vf.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-ggw3-6ch2-q6vf",
"modified": "2024-04-01T15:30:29Z",
"modified": "2024-08-19T18:32:02Z",
"published": "2024-04-01T15:30:29Z",
"aliases": [
"CVE-2024-30871"
],
"details": "netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/applyhardware.php.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-01T13:17:40Z"
advisories/unreviewed/2024/04/GHSA-h54m-6vwp-4wpq/GHSA-h54m-6vwp-4wpq.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h54m-6vwp-4wpq",
"modified": "2024-04-01T18:30:56Z",
"modified": "2024-08-19T18:32:02Z",
"published": "2024-04-01T18:30:56Z",
"aliases": [
"CVE-2024-30860"
],
"details": "netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/export_excel_user.php.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-01T16:15:31Z"
advisories/unreviewed/2024/04/GHSA-m98g-cw9w-r9qw/GHSA-m98g-cw9w-r9qw.json
+13 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m98g-cw9w-r9qw",
"modified": "2024-08-15T21:31:19Z",
"modified": "2024-08-19T18:32:02Z",
"published": "2024-04-25T18:30:39Z",
"aliases": [
"CVE-2024-32358"
@@ -25,6 +25,18 @@
"type": "WEB",
"url": "https://gist.github.com/rootlili/a6b6c89591f4773857ae81b7ca5898bc"
},
{
"type": "WEB",
"url": "https://gitee.com/JPressProjects/jpress/releases/tag/v5.1.0"
},
{
"type": "WEB",
"url": "https://github.com/JPressProjects/jpress/releases/tag/v5.1.0"
},
{
"type": "WEB",
"url": "https://www.jpress.cn/download"
},
{
"type": "WEB",
"url": "https://www.wolai.com/catr00t/2LujDzjjcrAjUYpWtcusXD"
advisories/unreviewed/2024/05/GHSA-2625-j643-gg22/GHSA-2625-j643-gg22.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2625-j643-gg22",
"modified": "2024-05-31T21:30:54Z",
"modified": "2024-08-19T18:32:02Z",
"published": "2024-05-31T21:30:54Z",
"aliases": [
"CVE-2024-36844"
],
"details": "libmodbus v3.1.6 was discovered to contain a use-after-free via the ctx->backend pointer. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted message sent to the unit-test-server.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-31T20:15:10Z"
advisories/unreviewed/2024/05/GHSA-383m-3rgc-734c/GHSA-383m-3rgc-734c.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-383m-3rgc-734c",
"modified": "2024-05-14T18:30:44Z",
"modified": "2024-08-19T18:32:02Z",
"published": "2024-05-14T18:30:44Z",
"aliases": [
"CVE-2022-32505"
],
"details": "An issue was discovered on certain Nuki Home Solutions devices. It is possible to send multiple BLE malformed packets to block some of the functionality and reboot the device. This affects Nuki Smart Lock 3.0 before 3.3.5 and Nuki Smart Lock 2.0 before 2.12.4.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N"
}
],
"affected": [
@@ -39,7 +42,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T10:43:41Z"
advisories/unreviewed/2024/05/GHSA-9cm6-r59j-22jc/GHSA-9cm6-r59j-22jc.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9cm6-r59j-22jc",
"modified": "2024-05-22T15:31:01Z",
"modified": "2024-08-19T18:32:02Z",
"published": "2024-05-22T15:31:01Z",
"aliases": [
"CVE-2024-35561"
],
"details": "idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=add&nohrefStr=close.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T14:15:09Z"
advisories/unreviewed/2024/05/GHSA-9phc-8693-5w9q/GHSA-9phc-8693-5w9q.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9phc-8693-5w9q",
"modified": "2024-05-23T18:30:56Z",
"modified": "2024-08-19T18:32:02Z",
"published": "2024-05-23T18:30:55Z",
"aliases": [
"CVE-2024-35085"
],
"details": "J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-23T17:15:30Z"
advisories/unreviewed/2024/05/GHSA-jh7g-4fx4-rhh4/GHSA-jh7g-4fx4-rhh4.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jh7g-4fx4-rhh4",
"modified": "2024-05-14T18:31:02Z",
"modified": "2024-08-19T18:32:02Z",
"published": "2024-05-14T18:31:02Z",
"aliases": [
"CVE-2024-35011"
],
"details": "idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=rev&nohrefStr=close.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T16:17:30Z"
advisories/unreviewed/2024/05/GHSA-pw4q-cgcg-f9p5/GHSA-pw4q-cgcg-f9p5.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pw4q-cgcg-f9p5",
"modified": "2024-05-16T15:31:37Z",
"modified": "2024-08-19T18:32:02Z",
"published": "2024-05-16T15:31:37Z",
"aliases": [
"CVE-2024-34957"
],
"details": "idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/sysImages_deal.php?mudi=infoSet.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-16T15:15:47Z"
advisories/unreviewed/2024/06/GHSA-273h-mfpf-cvq6/GHSA-273h-mfpf-cvq6.json
+2 -1
View File
@@ -28,7 +28,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-416"
"CWE-416",
"CWE-762"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/06/GHSA-5mvf-mw2h-9f35/GHSA-5mvf-mw2h-9f35.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5mvf-mw2h-9f35",
"modified": "2024-06-19T15:30:55Z",
"modified": "2024-08-19T18:32:03Z",
"published": "2024-06-19T15:30:55Z",
"aliases": [
"CVE-2021-47585"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix memory leak in __add_inode_ref()\n\nLine 1169 (#3) allocates a memory chunk for victim_name by kmalloc(),\nbut when the function returns in line 1184 (#4) victim_name allocated\nby line 1169 (#3) is not freed, which will lead to a memory leak.\nThere is a similar snippet of code in this function as allocating a memory\nchunk for victim_name in line 1104 (#1) as well as releasing the memory\nin line 1116 (#2).\n\nWe should kfree() victim_name when the return value of backref_in_log()\nis less than zero and before the function returns in line 1184 (#4).\n\n1057 static inline int __add_inode_ref(struct btrfs_trans_handle *trans,\n1058 \t\t\t\t struct btrfs_root *root,\n1059 \t\t\t\t struct btrfs_path *path,\n1060 \t\t\t\t struct btrfs_root *log_root,\n1061 \t\t\t\t struct btrfs_inode *dir,\n1062 \t\t\t\t struct btrfs_inode *inode,\n1063 \t\t\t\t u64 inode_objectid, u64 parent_objectid,\n1064 \t\t\t\t u64 ref_index, char *name, int namelen,\n1065 \t\t\t\t int *search_done)\n1066 {\n\n1104 \tvictim_name = kmalloc(victim_name_len, GFP_NOFS);\n\t// #1: kmalloc (victim_name-1)\n1105 \tif (!victim_name)\n1106 \t\treturn -ENOMEM;\n\n1112\tret = backref_in_log(log_root, &search_key,\n1113\t\t\tparent_objectid, victim_name,\n1114\t\t\tvictim_name_len);\n1115\tif (ret < 0) {\n1116\t\tkfree(victim_name); // #2: kfree (victim_name-1)\n1117\t\treturn ret;\n1118\t} else if (!ret) {\n\n1169 \tvictim_name = kmalloc(victim_name_len, GFP_NOFS);\n\t// #3: kmalloc (victim_name-2)\n1170 \tif (!victim_name)\n1171 \t\treturn -ENOMEM;\n\n1180 \tret = backref_in_log(log_root, &search_key,\n1181 \t\t\tparent_objectid, victim_name,\n1182 \t\t\tvictim_name_len);\n1183 \tif (ret < 0) {\n1184 \t\treturn ret; // #4: missing kfree (victim_name-2)\n1185 \t} else if (!ret) {\n\n1241 \treturn 0;\n1242 }",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-19T15:15:53Z"
advisories/unreviewed/2024/06/GHSA-5xg5-ffcr-c2cc/GHSA-5xg5-ffcr-c2cc.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5xg5-ffcr-c2cc",
"modified": "2024-06-19T15:30:55Z",
"modified": "2024-08-19T18:32:03Z",
"published": "2024-06-19T15:30:55Z",
"aliases": [
"CVE-2021-47596"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hns3: fix use-after-free bug in hclgevf_send_mbx_msg\n\nCurrently, the hns3_remove function firstly uninstall client instance,\nand then uninstall acceletion engine device. The netdevice is freed in\nclient instance uninstall process, but acceletion engine device uninstall\nprocess still use it to trace runtime information. This causes a use after\nfree problem.\n\nSo fixes it by check the instance register state to avoid use after free.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-19T15:15:54Z"
advisories/unreviewed/2024/06/GHSA-9xpc-qh7h-4926/GHSA-9xpc-qh7h-4926.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9xpc-qh7h-4926",
"modified": "2024-06-10T18:31:06Z",
"modified": "2024-08-19T18:32:02Z",
"published": "2024-06-10T18:31:06Z",
"aliases": [
"CVE-2024-31613"
],
"details": "BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery (CSRF) in name=\"head_code\" or name=\"foot_code.\"",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-10T16:15:13Z"
advisories/unreviewed/2024/06/GHSA-cq4f-h5g8-8r5h/GHSA-cq4f-h5g8-8r5h.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cq4f-h5g8-8r5h",
"modified": "2024-06-20T12:31:21Z",
"modified": "2024-08-19T18:32:03Z",
"published": "2024-06-20T12:31:21Z",
"aliases": [
"CVE-2022-48735"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: Fix UAF of leds class devs at unbinding\n\nThe LED class devices that are created by HD-audio codec drivers are\nregistered via devm_led_classdev_register() and associated with the\nHD-audio codec device. Unfortunately, it turned out that the devres\nrelease doesn't work for this case; namely, since the codec resource\nrelease happens before the devm call chain, it triggers a NULL\ndereference or a UAF for a stale set_brightness_delay callback.\n\nFor fixing the bug, this patch changes the LED class device register\nand unregister in a manual manner without devres, keeping the\ninstances in hda_gen_spec.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-20T12:15:11Z"
advisories/unreviewed/2024/06/GHSA-f558-fw4f-vm2c/GHSA-f558-fw4f-vm2c.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f558-fw4f-vm2c",
"modified": "2024-06-20T12:31:21Z",
"modified": "2024-08-19T18:32:03Z",
"published": "2024-06-20T12:31:21Z",
"aliases": [
"CVE-2022-48740"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nselinux: fix double free of cond_list on error paths\n\nOn error path from cond_read_list() and duplicate_policydb_cond_list()\nthe cond_list_destroy() gets called a second time in caller functions,\nresulting in NULL pointer deref. Fix this by resetting the\ncond_list_len to 0 in cond_list_destroy(), making subsequent calls a\nnoop.\n\nAlso consistently reset the cond_list pointer to NULL after freeing.\n\n[PM: fix line lengths in the description]",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-415"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-20T12:15:12Z"

Some files were not shown because too many files have changed in this diff Show More