netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-6frc-vfw9-wm27
GHSA-74c7-r9m3-hvj4
GHSA-7789-v767-37r5
GHSA-9986-6m4g-25f6
GHSA-9v7m-f3cv-68rw
GHSA-jjgq-jq8g-24w4
GHSA-jm38-vmgp-j7rx
GHSA-29qv-hhg4-6x96
This commit is contained in:
advisory-database[bot]
2024-04-24 20:43:00 +00:00
parent ebee53a429
commit e1990c380e
8 changed files with 225 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-6frc-vfw9-wm27/GHSA-6frc-vfw9-wm27.json → advisories/github-reviewed/2022/05/GHSA-6frc-vfw9-wm27/GHSA-6frc-vfw9-wm27.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6frc-vfw9-wm27",
"modified": "2022-05-14T03:51:58Z",
"modified": "2024-04-24T20:40:39Z",
"published": "2022-05-14T03:51:58Z",
"aliases": [
"CVE-2017-17900"
],
"summary": "Dolibarr SQL injection vulnerability in fourn/index.php",
"details": "SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the socid parameter.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.5"
}
]
}
]
}
],
"references": [
{
@@ -24,6 +43,10 @@
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/4a5988accbb770b74105baacd5a034689272128c"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
}
],
"database_specific": {
@@ -31,8 +54,8 @@
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:40:39Z",
"nvd_published_at": "2017-12-27T17:08:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-74c7-r9m3-hvj4/GHSA-74c7-r9m3-hvj4.json → advisories/github-reviewed/2022/05/GHSA-74c7-r9m3-hvj4/GHSA-74c7-r9m3-hvj4.json
+30 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-74c7-r9m3-hvj4",
"modified": "2022-05-17T00:53:04Z",
"modified": "2024-04-24T20:41:14Z",
"published": "2022-05-17T00:53:04Z",
"aliases": [
"CVE-2017-14239"
],
"summary": "Dolibarr cross-site scripting (XSS) vulnerability",
"details": "Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2) CompanyAddress, (3) CompanyZip, (4) CompanyTown, (5) Fax, (6) EMail, (7) Web, (8) ManagingDirectors, (9) Note, (10) Capital, (11) ProfId1, (12) ProfId2, (13) ProfId3, (14) ProfId4, (15) ProfId5, or (16) ProfId6 parameter to htdocs/admin/company.php.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.1"
}
]
}
],
"versions": [
"6.0.0"
]
}
],
"references": [
{
@@ -24,6 +46,10 @@
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/d26b2a694de30f95e46ea54ea72cc54f0d38e548"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
}
],
"database_specific": {
@@ -31,8 +57,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:41:13Z",
"nvd_published_at": "2017-09-11T09:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-7789-v767-37r5/GHSA-7789-v767-37r5.json → advisories/github-reviewed/2022/05/GHSA-7789-v767-37r5/GHSA-7789-v767-37r5.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7789-v767-37r5",
"modified": "2022-05-14T03:51:58Z",
"modified": "2024-04-24T20:40:51Z",
"published": "2022-05-14T03:51:58Z",
"aliases": [
"CVE-2017-17899"
],
"summary": "Dolibarr SQL injection vulnerability in adherents/subscription/info.php",
"details": "SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the rowid parameter.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.5"
}
]
}
]
}
],
"references": [
{
@@ -24,6 +43,10 @@
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/4a5988accbb770b74105baacd5a034689272128c"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
}
],
"database_specific": {
@@ -31,8 +54,8 @@
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:40:51Z",
"nvd_published_at": "2017-12-27T17:08:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-9986-6m4g-25f6/GHSA-9986-6m4g-25f6.json → advisories/github-reviewed/2022/05/GHSA-9986-6m4g-25f6/GHSA-9986-6m4g-25f6.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9986-6m4g-25f6",
"modified": "2022-05-14T03:23:30Z",
"modified": "2024-04-24T20:40:35Z",
"published": "2022-05-14T03:23:30Z",
"aliases": [
"CVE-2017-18260"
],
"summary": "Dolibarr SQL injection vulnerability",
"details": "Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php (viewstatut parameter) or comm/propal/list.php (propal_statut parameter, aka search_statut parameter).",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "7.0.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18260"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-010"
@@ -31,8 +54,8 @@
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:40:35Z",
"nvd_published_at": "2018-04-11T03:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-9v7m-f3cv-68rw/GHSA-9v7m-f3cv-68rw.json → advisories/github-reviewed/2022/05/GHSA-9v7m-f3cv-68rw/GHSA-9v7m-f3cv-68rw.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9v7m-f3cv-68rw",
"modified": "2022-05-14T03:52:03Z",
"modified": "2024-04-24T20:41:03Z",
"published": "2022-05-14T03:52:03Z",
"aliases": [
"CVE-2017-17897"
],
"summary": "Dolibarr SQL injection vulnerability in comm/multiprix.php",
"details": "SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.5"
}
]
}
]
}
],
"references": [
{
@@ -24,6 +43,10 @@
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/4a5988accbb770b74105baacd5a034689272128c"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
}
],
"database_specific": {
@@ -31,8 +54,8 @@
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:41:03Z",
"nvd_published_at": "2017-12-27T17:08:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-jjgq-jq8g-24w4/GHSA-jjgq-jq8g-24w4.json → advisories/github-reviewed/2022/05/GHSA-jjgq-jq8g-24w4/GHSA-jjgq-jq8g-24w4.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jjgq-jq8g-24w4",
"modified": "2022-05-17T01:05:38Z",
"modified": "2024-04-24T20:41:24Z",
"published": "2022-05-17T01:05:38Z",
"aliases": [
"CVE-2017-14242"
],
"summary": "Dolibarr SQL injection vulnerability in don/list.php",
"details": "SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.1"
}
]
}
]
}
],
"references": [
{
@@ -24,6 +43,10 @@
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/33e2179b65331d9d9179b59d746817c5be1fecdb"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
}
],
"database_specific": {
@@ -31,8 +54,8 @@
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:41:24Z",
"nvd_published_at": "2017-09-11T09:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-jm38-vmgp-j7rx/GHSA-jm38-vmgp-j7rx.json → advisories/github-reviewed/2022/05/GHSA-jm38-vmgp-j7rx/GHSA-jm38-vmgp-j7rx.json
+30 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jm38-vmgp-j7rx",
"modified": "2022-05-14T03:51:58Z",
"modified": "2024-04-24T20:40:45Z",
"published": "2022-05-14T03:51:58Z",
"aliases": [
"CVE-2017-17898"
],
"summary": "Dolibarr sensitive information disclosure",
"details": "Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, which allows remote attackers to obtain sensitive information.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.5"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 6.0.4"
}
}
],
"references": [
{
@@ -28,6 +50,10 @@
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/6a62e139604dbbd5729e57df2433b37a5950c35c"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
}
],
"database_specific": {
@@ -35,8 +61,8 @@
"CWE-200"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:40:45Z",
"nvd_published_at": "2017-12-27T17:08:00Z"
}
}
advisories/unreviewed/2022/09/GHSA-29qv-hhg4-6x96/GHSA-29qv-hhg4-6x96.json → advisories/github-reviewed/2022/09/GHSA-29qv-hhg4-6x96/GHSA-29qv-hhg4-6x96.json
+30 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-29qv-hhg4-6x96",
"modified": "2022-09-10T00:00:35Z",
"modified": "2024-04-24T20:41:54Z",
"published": "2022-09-07T00:01:53Z",
"aliases": [
"CVE-2022-34867"
],
"summary": "Unauthenticated Sensitive Information Disclosure vulnerability",
"details": "Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin <= 2.0.8 at WordPress allows attackers to list and delete submissions. Affects only versions from 2.0.0 to 2.0.8.",
"severity": [
{
@@ -14,7 +15,28 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "libreform/libreform"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.9"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.0.8"
}
}
],
"references": [
{
@@ -25,6 +47,10 @@
"type": "WEB",
"url": "https://github.com/libreform/libreform/pull/54/files"
},
{
"type": "PACKAGE",
"url": "https://github.com/libreform/libreform"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/libreform/wordpress-wp-libre-form-2-plugin-2-0-8-unauthenticated-sensitive-information-disclosure-vulnerability"
@@ -36,8 +62,8 @@
"CWE-668"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:41:54Z",
"nvd_published_at": "2022-09-06T18:15:00Z"
}
}