mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Advisory Database Sync
This commit is contained in:
advisory-database[bot]
@@ -8,9 +8,7 @@
|
||||
],
|
||||
"summary": "Cross-site request forgery in Apache ActiveMQ",
|
||||
"details": "Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -8,9 +8,7 @@
|
||||
],
|
||||
"summary": "Improper Input Validation in Apache CXF",
|
||||
"details": "The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3f2c-jm6v-cr35",
|
||||
"modified": "2024-09-18T16:11:35Z",
|
||||
"modified": "2024-11-18T16:26:22Z",
|
||||
"published": "2022-05-17T00:27:18Z",
|
||||
"aliases": [
|
||||
"CVE-2016-9014"
|
||||
@@ -132,10 +132,8 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"cwe_ids": [],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-07-31T22:41:12Z",
|
||||
"nvd_published_at": "2016-12-09T20:59:00Z"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-46x4-9jmv-jc8p",
|
||||
"modified": "2024-09-18T14:43:08Z",
|
||||
"modified": "2024-11-18T16:26:23Z",
|
||||
"published": "2022-05-17T03:43:00Z",
|
||||
"aliases": [
|
||||
"CVE-2016-2048"
|
||||
@@ -73,7 +73,7 @@
|
||||
"cwe_ids": [
|
||||
"CWE-284"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-07-31T22:43:10Z",
|
||||
"nvd_published_at": "2016-02-08T19:59:00Z"
|
||||
|
||||
@@ -8,9 +8,7 @@
|
||||
],
|
||||
"summary": "Uncontrolled Resource Consumption in Apache CXF",
|
||||
"details": "Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -129,9 +129,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-07-31T18:44:08Z",
|
||||
|
||||
@@ -8,9 +8,7 @@
|
||||
],
|
||||
"summary": "Cobbler subject to Command Injection",
|
||||
"details": "A Command Injection in action_power.py in Cobbler prior to v2.6.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -8,9 +8,7 @@
|
||||
],
|
||||
"summary": "Unescaped parameters in the PostgreSQL JDBC driver",
|
||||
"details": "Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the \"standard_conforming_strings\" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks. NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -91,9 +89,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-02-14T00:32:49Z",
|
||||
|
||||
@@ -8,9 +8,7 @@
|
||||
],
|
||||
"summary": "OpenStack Image Service (Glance) allows remote authenticated users to bypass access restrictions",
|
||||
"details": "OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -86,9 +84,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-02-08T17:59:13Z",
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-q7q2-qf2q-rw3w",
|
||||
"modified": "2024-09-18T19:51:12Z",
|
||||
"modified": "2024-11-18T16:26:23Z",
|
||||
"published": "2022-05-17T03:07:00Z",
|
||||
"aliases": [
|
||||
"CVE-2014-1418"
|
||||
@@ -150,7 +150,7 @@
|
||||
"cwe_ids": [
|
||||
"CWE-349"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-08-16T22:54:50Z",
|
||||
"nvd_published_at": "2014-05-16T15:55:00Z"
|
||||
|
||||
@@ -129,9 +129,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-04-29T16:38:00Z",
|
||||
|
||||
@@ -8,9 +8,7 @@
|
||||
],
|
||||
"summary": "Command injection in docker-tester",
|
||||
"details": "OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in the 'ports' entry of a crafted docker-compose.yml file.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -122,9 +122,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2022-07-21T21:38:28Z",
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-fjh6-p566-wr6q",
|
||||
"modified": "2022-07-21T22:35:12Z",
|
||||
"published": "2022-07-21T22:35:12Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "skylot jadx affected by Incorrect Behavior Order in vulnerable dependency",
|
||||
"details": "### Impact\nVulnerable library protobuf-java 3.11.4 (CVE-2021-22569)\n\n### Patches\nDependency updated in jadx 1.4.3\n\n### References\nAccording to the AquaSecurity report:\n\n\nAlso, Maven repository have links to this and other vulnerabilities from dependencies:\nhttps://mvnrepository.com/artifact/com.google.protobuf/protobuf-java/3.11.4",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -8,9 +8,7 @@
|
||||
],
|
||||
"summary": "personnummer/dart vulnerable to Improper Input Validation",
|
||||
"details": "This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure.\n\nThe vulnerability is determined to be low severity.\n\n### Impact\n\nThis vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer. \n\n### Patches\n\nThe issue have been patched in all repositories. The following versions should be updated to as soon as possible:\n\n[C#](https://github.com/advisories/GHSA-qv8q-v995-72gr) 3.0.2 \nD 3.0.1 \n[Dart](https://github.com/advisories/GHSA-4xh4-v2pq-jvhm) 3.0.3 \nElixir 3.0.0 \n[Go](https://github.com/advisories/GHSA-hv53-vf5m-8q94) 3.0.1 \n[Java](https://github.com/advisories/GHSA-q3vw-4jx3-rrr2) 3.3.0 \n[JavaScript](https://github.com/advisories/GHSA-vpgc-7h78-gx8f) 3.1.0 \nKotlin 1.1.0 \nLua 3.0.1 \n[PHP](https://github.com/advisories/GHSA-2p6g-gjp8-ggg9) 3.0.2 \nPerl 3.0.0 \n[Python](https://github.com/advisories/GHSA-rxq3-5249-8hgg) 3.0.2 \n[Ruby](https://github.com/advisories/GHSA-vp9c-fpxx-744v) 3.0.1 \n[Rust](https://github.com/advisories/GHSA-28r9-pq4c-wp3c) 3.0.0 \nScala 3.0.1 \nSwift 1.0.1 \n\nIf you are using any of the earlier packages, please update to latest.\n\n### Workarounds\n\nThe issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be\n000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not\n000x.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)\n* Email us at [Personnummer Email](mailto:security@personnummer.dev)",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
|
||||
@@ -54,9 +54,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-01-27T01:01:27Z",
|
||||
|
||||
@@ -3,14 +3,10 @@
|
||||
"id": "GHSA-4q83-7cq4-p6wg",
|
||||
"modified": "2023-02-04T00:30:37Z",
|
||||
"published": "2023-02-04T00:30:37Z",
|
||||
"aliases": [
|
||||
|
||||
],
|
||||
"aliases": [],
|
||||
"summary": "`tokio::io::ReadHalf<T>::unsplit` is Unsound",
|
||||
"details": "`tokio::io::ReadHalf<T>::unsplit` can violate the `Pin` contract\n\nThe soundness issue is described in the [tokio/issues#5372](https://github.com/tokio-rs/tokio/issues/5372)\n\nSpecific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf)\nis unusual, combined with the difficulty of making any arbitrary use-after-free\nexploitable in Rust without doing a lot of careful alignment of data types in\nthe surrounding code.\n\nThe `tokio` feature `io-util` is also required to be enabled to trigger this\nsoundness issue.\n\nThanks to zachs18 reporting the issue to Tokio team responsibly and taiki-e\nand carllerche appropriately responding and fixing the soundness bug.\n\nTokio before 0.2.0 used `futures` 0.1 that did not have `Pin`, so it is not\naffected by this issue.\n",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"severity": [],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
@@ -85,9 +81,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "LOW",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-02-04T00:30:37Z",
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-8jxm-xp43-qh3q",
|
||||
"modified": "2024-09-06T22:23:19Z",
|
||||
"modified": "2024-11-18T16:26:30Z",
|
||||
"published": "2023-06-21T22:08:34Z",
|
||||
"aliases": [
|
||||
"CVE-2023-34758"
|
||||
@@ -89,7 +89,7 @@
|
||||
"cwe_ids": [
|
||||
"CWE-327"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2023-06-21T22:08:34Z",
|
||||
"nvd_published_at": "2023-06-26T20:15:10Z"
|
||||
|
||||
File diff suppressed because one or more lines are too long
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user