Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-02 05:04:42 +00:00
parent 60cc33b4b8
commit e21524f0eb
948 changed files with 2035 additions and 6105 deletions
@@ -8,9 +8,7 @@
  ],
  "summary": "Directory Traversal in geddy",
  "details": "Versions 13.0.8 and earlier of geddy are vulnerable to a directory traversal attack via URI encoded attack vectors.\n\n### Proof of Concept\n```\nhttp://localhost:4000/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd\n```\n\n\n## Recommendation\n\nUpdate geddy to version >= 13.0.8",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Downloads Resources over HTTP in alto-saxophone",
  "details": "Affected versions of `alto-saxophone` insecurely download an executable over an unencrypted HTTP connection. \n\nIn scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `alto-saxophone`.\n\n\n## Recommendation\n\nUpdate to version 2.25.1 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Denial of Service in nes",
  "details": "Affected versions of `nes` are vulnerable to denial of service when given an invalid `cookie` header, and websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to throw and exit.\n\n\n## Recommendation\n\nUpdate to version 6.4.1 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -4,14 +4,10 @@
  "modified": "2020-06-16T21:36:51Z",
  "published": "2018-07-31T18:21:46Z",
  "withdrawn": "2020-06-16T20:55:57Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "High severity vulnerability that affects rubyzip",
  "details": "Withdrawn, accidental duplicate publish.\n\nThe Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses \"../\" pathname substrings to write arbitrary files to the filesystem.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -44,9 +40,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:55:57Z",
@@ -4,14 +4,10 @@
  "modified": "2021-12-02T23:14:26Z",
  "published": "2018-08-13T20:48:52Z",
  "withdrawn": "2020-06-16T20:52:48Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Moderate severity vulnerability that affects actionview",
  "details": "Withdrawn, accidental duplicate publish.\n\nDirectory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0752.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -69,9 +65,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:52:48Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Downloads Resources over HTTP in haxe3",
  "details": "Affected versions of `haxe3` insecurely download an executable over an unencrypted HTTP connection. \n\nIn scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `haxe3`.\n\n\n## Recommendation\n\nNo patch is currently available for this vulnerability. This vulnerability has been left unpatched for several years, despite active maintenance on the package. Because of this, it appears that the package author has accepted the risk, and is unlikely to patch this package in the future.\n\nThe best mitigation is currently to avoid using this package, using a different package if available. \n\nAlternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -4,14 +4,10 @@
  "modified": "2020-06-16T20:51:48Z",
  "published": "2018-09-17T21:54:22Z",
  "withdrawn": "2020-06-16T20:51:08Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Moderate severity vulnerability that affects actionpack",
  "details": "Withdrawn, accidental duplicate publish.\n\nDirectory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /..%2F sequence.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -82,9 +78,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:51:08Z",
@@ -4,14 +4,10 @@
  "modified": "2020-06-16T21:42:52Z",
  "published": "2018-09-17T21:57:23Z",
  "withdrawn": "2020-06-16T20:54:03Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Moderate severity vulnerability that affects activesupport",
  "details": "Withdrawn, accidental duplicate publish.\n\nThe (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -82,9 +78,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:54:03Z",
@@ -4,14 +4,10 @@
  "modified": "2020-06-16T21:59:24Z",
  "published": "2018-10-09T00:38:09Z",
  "withdrawn": "2020-06-16T20:53:33Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Moderate severity vulnerability that affects mustache",
  "details": "Withdrawn, accidental duplicate publish.\n\nmustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -44,9 +40,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:53:33Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-3m2r-q8x3-xmf7",
  "modified": "2021-12-03T14:27:36Z",
  "published": "2018-10-16T19:59:48Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Moderate severity vulnerability that affects Microsoft.AspNetCore.All, Microsoft.AspNetCore.Server.Kestrel.Core, Microsoft.AspNetCore.Server.Kestrel.Transport.Abstractions, and Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv",
  "details": "Microsoft made an internal discovery of a security vulnerability in version 2.x of ASP.NET Core where\na specially crafted request can cause excess resource consumption in Kestrel.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -100,9 +96,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T20:55:28Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "HTML Injection in shout",
  "details": "Affected versions of `shout` do not escape the `/topic` command in messages, and are therefore vulnerable to cross-site scripting.\n\n\n## Recommendation\n\nUpdate to version 0.50.0 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Downloads Resources over HTTP in selenium-download",
  "details": "Affected versions of `selenium-download` insecurely download an executable over an unencrypted HTTP connection. \n\nIn scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-download`.\n\n\n## Recommendation\n\nUpdate to version 2.0.7 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Resources Downloaded over Insecure Protocol in igniteui",
  "details": "Affected versions of `igniteui` download Javascript and CSS resources over an unencrypted HTTP connection. An attacker with a privileged network position can intercept and view or modify any content sent or recieved over an unencrypted HTTP connection.\n\n\n\n\n## Recommendation\n\nThe `igniteui` package has been deprecated by the package author and now exists under [`ignite-ui`](https://preview.npmjs.com/package/ignite-ui), which should be used in place of this package.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Potential SQL Injection in sequelize",
  "details": "Affected versions of `sequelize` are vulnerable to SQL Injection when user input is passed into `findOne` or into a statement such as `where: \"user input\"`.\n\n\n\n## Recommendation\n\nUpdate to version 3.0.0 or later.\n\nVersion 3.0.0 will introduce a number of breaking changes.\nThankfully, the project authors have provided a 2.x -> 3.x [upgrade guide](https://github.com/sequelize/sequelize/wiki/Upgrade-from-2.0-to-3.0) to ease this transition.\n\nIf upgrading is not an option, it is also possible to mitigate this by ensuring that all uses of `where: \"input\"` and `findOne(\"input\")` are properly sanitized, such as by the use of a wrapper function.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Downloads Resources over HTTP in webdriver-launcher",
  "details": "Affected versions of `webdriver-launcher` insecurely download an executable over an unencrypted HTTP connection. \n\nIn scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `webdriver-launcher`.\n\n\n## Recommendation\n\nNo patch is currently available for this vulnerability, and the package has not seen an update since 2011.\n\nThe best mitigation is currently to avoid using this package, using a different package if available. \n\nAlternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Downloads Resources over HTTP in operadriver",
  "details": "operadriver is a Opera Driver for Selenium.\n\noperadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks.  It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.\n\n\n## Recommendation\n\nUpdate to version 0.2.3 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Downloads Resources over HTTP in box2d-native",
  "details": "Affected versions of `box2d-native` insecurely download an executable over an unencrypted HTTP connection. \n\nIn scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `box2d-native`.\n\n\n## Recommendation\n\nNo patch is currently available for this vulnerability.\n\nThe best mitigation is currently to avoid using this package, using a different package if available. \n\nAlternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Downloads Resources over HTTP in macaca-chromedriver-zxa",
  "details": "Affected versions of `macaca-chromedriver-zxa` insecurely download an executable over an unencrypted HTTP connection. \n\nIn scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `macaca-chromedriver-zxa`.\n\n\n## Recommendation\n\nThe best mitigation is to manually set the download URL to a safe HTTPS server via the `CHROMEDRIVER_CDNURL` environment variable.\n\nAlternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Downloads Resources over HTTP in rs-brightcove",
  "details": "Affected versions of `rs-brightcove` insecurely download an executable over an unencrypted HTTP connection. \n\nIn scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `rs-brightcove`.\n\n\n## Recommendation\n\nNo patch is currently available for this vulnerability.\n\nThe best mitigation is currently to avoid using this package, using a different package if available. \n\nAlternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Path Traversal in http-live-simulator",
  "details": "Versions of `http-live-simulator` prior to 1.0.6 are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. \n\n\n## Recommendation\n\nUpgrade to version 1.0.6",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
--- a/Show More
+++ b/Show More