From e1baf0f27432cfad20f43ab0c229915d38983cbc Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 13 Dec 2024 20:37:13 +0000 Subject: [PATCH] Publish Advisories GHSA-832w-fhmw-w4f4 GHSA-8vwh-pr89-4mw2 GHSA-m3r7-8gw7-qwvc GHSA-w9j7-phm3-f97j --- .../GHSA-832w-fhmw-w4f4.json | 69 +++++++++++++++++++ .../GHSA-8vwh-pr89-4mw2.json | 65 +++++++++++++++++ .../GHSA-m3r7-8gw7-qwvc.json | 65 +++++++++++++++++ .../GHSA-w9j7-phm3-f97j.json | 61 ++++++++++++++++ 4 files changed, 260 insertions(+) create mode 100644 advisories/github-reviewed/2024/12/GHSA-832w-fhmw-w4f4/GHSA-832w-fhmw-w4f4.json create mode 100644 advisories/github-reviewed/2024/12/GHSA-8vwh-pr89-4mw2/GHSA-8vwh-pr89-4mw2.json create mode 100644 advisories/github-reviewed/2024/12/GHSA-m3r7-8gw7-qwvc/GHSA-m3r7-8gw7-qwvc.json create mode 100644 advisories/github-reviewed/2024/12/GHSA-w9j7-phm3-f97j/GHSA-w9j7-phm3-f97j.json diff --git a/advisories/github-reviewed/2024/12/GHSA-832w-fhmw-w4f4/GHSA-832w-fhmw-w4f4.json b/advisories/github-reviewed/2024/12/GHSA-832w-fhmw-w4f4/GHSA-832w-fhmw-w4f4.json new file mode 100644 index 00000000000..e788e4eb5c2 --- /dev/null +++ b/advisories/github-reviewed/2024/12/GHSA-832w-fhmw-w4f4/GHSA-832w-fhmw-w4f4.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-832w-fhmw-w4f4", + "modified": "2024-12-13T20:36:23Z", + "published": "2024-12-13T20:36:22Z", + "aliases": [ + "CVE-2024-55890" + ], + "summary": "D-Tale allows Remote Code Execution through the Custom Filter Input", + "details": "### Impact\nUsers hosting D-Tale publicly can be vulnerable to remote code execution allowing attackers to run malicious code on the server.\n\n### Patches\nUsers should upgrade to version 3.16.1 where the `update-settings` endpoint blocks the ability for users to update the `enable_custom_filters` flag. You can find out more information on how to turn that flag on [here](https://github.com/man-group/dtale#custom-filter)\n\n### Workarounds\nThe only workaround for versions earlier than 3.16.1 is to only host D-Tale to trusted users.\n\n### References\nSee \"Custom Filter\" [documentation](https://github.com/man-group/dtale#custom-filter)\n", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "dtale" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.16.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/man-group/dtale/security/advisories/GHSA-832w-fhmw-w4f4" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55890" + }, + { + "type": "WEB", + "url": "https://github.com/man-group/dtale/commit/1e26ed3ca12fe83812b90f12a2b3e5fb0b740f7a" + }, + { + "type": "PACKAGE", + "url": "https://github.com/man-group/dtale" + }, + { + "type": "WEB", + "url": "https://github.com/man-group/dtale#custom-filter" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-12-13T20:36:22Z", + "nvd_published_at": "2024-12-13T18:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/12/GHSA-8vwh-pr89-4mw2/GHSA-8vwh-pr89-4mw2.json b/advisories/github-reviewed/2024/12/GHSA-8vwh-pr89-4mw2/GHSA-8vwh-pr89-4mw2.json new file mode 100644 index 00000000000..6df6b494f43 --- /dev/null +++ b/advisories/github-reviewed/2024/12/GHSA-8vwh-pr89-4mw2/GHSA-8vwh-pr89-4mw2.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8vwh-pr89-4mw2", + "modified": "2024-12-13T20:35:43Z", + "published": "2024-12-13T20:35:43Z", + "aliases": [ + "CVE-2024-55661" + ], + "summary": "Laravel Pulse Allows Remote Code Execution via Unprotected Query Method", + "details": "A vulnerability has been discovered in Laravel Pulse that could allow remote code execution through the public `remember()` method in the `Laravel\\Pulse\\Livewire\\Concerns\\RemembersQueries` trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application.\n\n### Impact\n\nAn authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method that meets the following criteria:\n\n- The callable is a function or static method\n- The callable has no parameters or no strict parameter types\n\n### Vulnerable Components\n\n- The `remember(callable $query, string $key = '')` method in `Laravel\\Pulse\\Livewire\\Concerns\\RemembersQueries`\n- Affects all Pulse card components that use this trait\n\n### Attack Vectors\n\nThe vulnerability can be exploited through Livewire component interactions, for example:\n\n```php\nwire:click=\"remember('\\\\Illuminate\\\\Support\\\\Facades\\\\Config::all', 'config')\"\n```\n\n### Credit\n\nThank you to Jeremy Angele for reporting this vulnerability.\n", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "laravel/pulse" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.3.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/laravel/pulse/security/advisories/GHSA-8vwh-pr89-4mw2" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55661" + }, + { + "type": "WEB", + "url": "https://github.com/laravel/pulse/commit/d1a5bf2eca36c6e3bedb4ceecd45df7d002a1ebc" + }, + { + "type": "PACKAGE", + "url": "https://github.com/laravel/pulse" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-12-13T20:35:43Z", + "nvd_published_at": "2024-12-13T16:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/12/GHSA-m3r7-8gw7-qwvc/GHSA-m3r7-8gw7-qwvc.json b/advisories/github-reviewed/2024/12/GHSA-m3r7-8gw7-qwvc/GHSA-m3r7-8gw7-qwvc.json new file mode 100644 index 00000000000..7af5968d45a --- /dev/null +++ b/advisories/github-reviewed/2024/12/GHSA-m3r7-8gw7-qwvc/GHSA-m3r7-8gw7-qwvc.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m3r7-8gw7-qwvc", + "modified": "2024-12-13T20:36:08Z", + "published": "2024-12-13T20:36:08Z", + "aliases": [ + "CVE-2024-55889" + ], + "summary": "thorsten/phpmyfaq Unintended File Download Triggered by Embedded Frames", + "details": "### Summary\nA vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in an

and save FAQ record\n5. once the edit page reloads, the malicious code will be downloaded onto the local machine without user interaction:\n![image](https://github.com/user-attachments/assets/b10e137f-de01-4268-8f9c-0b440ae45349)\n\n(uploaded a POC for easy demonstration: https://roy.demo.phpmyfaq.de/admin/index.php?action=editentry&id=20&lang=en\nalthough a fresh installation overwrites this demo instance every 24 hours)\n\n(as a logged in normal user, visit: https://roy.demo.phpmyfaq.de/content/1/20/en/20.html)\n\n### Impact\nMalicious code or binaries could be dropped on visitors' machines when visiting the FAQ platform. Take a worm or ransomware for instance. \n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "thorsten/phpmyfaq" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.2.10" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-m3r7-8gw7-qwvc" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55889" + }, + { + "type": "WEB", + "url": "https://github.com/thorsten/phpMyFAQ/commit/fa0f7368dc3288eedb1915def64ef8fb270f711d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/thorsten/phpMyFAQ" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-451" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-12-13T20:36:08Z", + "nvd_published_at": "2024-12-13T14:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/12/GHSA-w9j7-phm3-f97j/GHSA-w9j7-phm3-f97j.json b/advisories/github-reviewed/2024/12/GHSA-w9j7-phm3-f97j/GHSA-w9j7-phm3-f97j.json new file mode 100644 index 00000000000..3f42dd48816 --- /dev/null +++ b/advisories/github-reviewed/2024/12/GHSA-w9j7-phm3-f97j/GHSA-w9j7-phm3-f97j.json @@ -0,0 +1,61 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w9j7-phm3-f97j", + "modified": "2024-12-13T20:35:57Z", + "published": "2024-12-13T20:35:57Z", + "aliases": [ + "CVE-2024-55887" + ], + "summary": "Ucum-java has an XXE vulnerability in XML parsing", + "details": "### Impact\nXML parsing performed by the UcumEssenceService is vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host system. This impacts use cases where ucum is being used to within a host where external clients can submit XML.\n\n### Patches\nRelease 1.0.9 of ucum fixes this vulnerability\n\n### Workarounds\nEnsure that the source xml for instantiating UcumEssenceService is trusted.\n\n### References\n* https://cwe.mitre.org/data/definitions/611.html\n* https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#jaxp-documentbuilderfactory-saxparserfactory-and-dom4j\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.fhir:ucum" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.0.9" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/FHIR/Ucum-java/security/advisories/GHSA-w9j7-phm3-f97j" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55887" + }, + { + "type": "PACKAGE", + "url": "https://github.com/FHIR/Ucum-java" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-611" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-12-13T20:35:57Z", + "nvd_published_at": "2024-12-13T16:15:28Z" + } +} \ No newline at end of file