netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-08-07 15:32:40 +00:00
parent 6fdacbf4fd
commit e9c938be19
26 changed files with 615 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/03/GHSA-gjpq-v684-hwg5/GHSA-gjpq-v684-hwg5.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gjpq-v684-hwg5",
"modified": "2024-03-21T03:36:45Z",
"modified": "2024-08-07T15:30:37Z",
"published": "2024-03-21T03:36:45Z",
"aliases": [
"CVE-2023-49980"
],
"details": "A directory listing vulnerability in Best Student Result Management System v1.0 allows attackers to list directories and sensitive files within the application without requiring authorization.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-21T02:49:38Z"
advisories/unreviewed/2024/07/GHSA-hjv2-rmr7-p354/GHSA-hjv2-rmr7-p354.json
+1 -1
View File
@@ -32,7 +32,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2024/07/GHSA-vfxc-84q8-h5w2/GHSA-vfxc-84q8-h5w2.json
+2 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vfxc-84q8-h5w2",
"modified": "2024-07-09T09:30:55Z",
"modified": "2024-08-07T15:30:38Z",
"published": "2024-07-09T09:30:55Z",
"aliases": [
"CVE-2024-3603"
@@ -32,7 +32,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2024/08/GHSA-3j9x-hj5x-f35c/GHSA-3j9x-hj5x-f35c.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3j9x-hj5x-f35c",
"modified": "2024-08-07T15:30:42Z",
"published": "2024-08-07T15:30:42Z",
"aliases": [
"CVE-2024-7580"
],
"details": "A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/system.html. The manipulation of the argument uploadedFile with the input ;whoami leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7580"
},
{
"type": "WEB",
"url": "https://github.com/Push3AX/vul/blob/main/Alien%20Technology%20/ALR-F800.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.273860"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.273860"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.382481"
}
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-07T15:15:56Z"
}
}
advisories/unreviewed/2024/08/GHSA-4r7q-rwrj-9wg2/GHSA-4r7q-rwrj-9wg2.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4r7q-rwrj-9wg2",
"modified": "2024-08-06T21:30:48Z",
"modified": "2024-08-07T15:30:39Z",
"published": "2024-08-06T21:30:47Z",
"aliases": [
"CVE-2024-7533"
],
"details": "Use after free in Sharing in Google Chrome on iOS prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -31,7 +34,7 @@
"cwe_ids": [
"CWE-416"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-06T21:16:03Z"
advisories/unreviewed/2024/08/GHSA-5wvf-7fq8-m4w6/GHSA-5wvf-7fq8-m4w6.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5wvf-7fq8-m4w6",
"modified": "2024-08-07T12:31:28Z",
"modified": "2024-08-07T15:30:41Z",
"published": "2024-08-07T12:31:28Z",
"aliases": [
"CVE-2024-7266"
advisories/unreviewed/2024/08/GHSA-6f79-7mqv-qvj3/GHSA-6f79-7mqv-qvj3.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6f79-7mqv-qvj3",
"modified": "2024-08-07T15:30:42Z",
"published": "2024-08-07T15:30:42Z",
"aliases": [
"CVE-2024-7578"
],
"details": "A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been classified as critical. Affected is an unknown function of the file /var/www/cmd.php. The manipulation of the argument cmd leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7578"
},
{
"type": "WEB",
"url": "https://github.com/Push3AX/vul/blob/main/Alien%20Technology%20/ALR-F800.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.273858"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.273858"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.382469"
}
],
"database_specific": {
"cwe_ids": [
"CWE-285"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-07T13:16:00Z"
}
}
advisories/unreviewed/2024/08/GHSA-795c-9xpc-xw6g/GHSA-795c-9xpc-xw6g.json
+43
View File
@@ -0,0 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-795c-9xpc-xw6g",
"modified": "2024-08-07T15:30:42Z",
"published": "2024-08-07T15:30:42Z",
"aliases": [
"CVE-2024-41990"
],
"details": "An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41990"
},
{
"type": "WEB",
"url": "https://docs.djangoproject.com/en/dev/releases/security"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#%21forum/django-announce"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2024/aug/06/security-releases"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-07T15:15:56Z"
}
}
advisories/unreviewed/2024/08/GHSA-87qc-q3w7-7m8w/GHSA-87qc-q3w7-7m8w.json
+9 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-87qc-q3w7-7m8w",
"modified": "2024-08-01T21:31:40Z",
"modified": "2024-08-07T15:30:39Z",
"published": "2024-08-01T15:32:20Z",
"aliases": [
"CVE-2024-6923"
@@ -29,6 +29,14 @@
"type": "WEB",
"url": "https://github.com/python/cpython/pull/122233"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7"
},
{
"type": "WEB",
"url": "https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0"
},
{
"type": "WEB",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW"
advisories/unreviewed/2024/08/GHSA-8pv9-qh96-9hc6/GHSA-8pv9-qh96-9hc6.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8pv9-qh96-9hc6",
"modified": "2024-08-07T15:30:42Z",
"published": "2024-08-07T15:30:42Z",
"aliases": [
"CVE-2024-43045"
],
"details": "Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' \"My Views\".",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43045"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2024-08-07/#SECURITY-3349"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-07T14:15:33Z"
}
}
advisories/unreviewed/2024/08/GHSA-cmm9-h7p3-233m/GHSA-cmm9-h7p3-233m.json
+1 -1
View File
@@ -28,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2024/08/GHSA-cq2c-35gp-j9qc/GHSA-cq2c-35gp-j9qc.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cq2c-35gp-j9qc",
"modified": "2024-08-07T12:31:28Z",
"modified": "2024-08-07T15:30:41Z",
"published": "2024-08-07T12:31:28Z",
"aliases": [
"CVE-2024-7267"
advisories/unreviewed/2024/08/GHSA-fjrj-vrrh-qjx6/GHSA-fjrj-vrrh-qjx6.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fjrj-vrrh-qjx6",
"modified": "2024-08-07T06:31:10Z",
"modified": "2024-08-07T15:30:40Z",
"published": "2024-08-07T06:31:10Z",
"aliases": [
"CVE-2024-6494"
],
"details": "The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS) attacks.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-07T06:16:47Z"
advisories/unreviewed/2024/08/GHSA-g494-wr54-xx2g/GHSA-g494-wr54-xx2g.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g494-wr54-xx2g",
"modified": "2024-08-06T18:30:57Z",
"modified": "2024-08-07T15:30:39Z",
"published": "2024-08-06T18:30:57Z",
"aliases": [
"CVE-2024-7000"
],
"details": "Use after free in CSS in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -31,7 +34,7 @@
"cwe_ids": [
"CWE-416"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-06T16:15:50Z"
advisories/unreviewed/2024/08/GHSA-g682-677f-3p88/GHSA-g682-677f-3p88.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g682-677f-3p88",
"modified": "2024-08-07T15:30:42Z",
"published": "2024-08-07T15:30:42Z",
"aliases": [
"CVE-2024-7579"
],
"details": "A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been declared as critical. Affected by this vulnerability is the function popen of the file /var/www/cgi-bin/upgrade.cgi of the component File Name Handler. The manipulation of the argument uploadedFile leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7579"
},
{
"type": "WEB",
"url": "https://github.com/Push3AX/vul/blob/main/Alien%20Technology%20/ALR-F800.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.273859"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.273859"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.382470"
}
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-07T14:15:33Z"
}
}
advisories/unreviewed/2024/08/GHSA-h856-ffvv-xvr4/GHSA-h856-ffvv-xvr4.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h856-ffvv-xvr4",
"modified": "2024-08-07T15:30:42Z",
"published": "2024-08-07T15:30:42Z",
"aliases": [
"CVE-2024-43044"
],
"details": "Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43044"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2024-08-07/#SECURITY-3430"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-07T14:15:33Z"
}
}
advisories/unreviewed/2024/08/GHSA-jh75-99hh-qvx9/GHSA-jh75-99hh-qvx9.json
+43
View File
@@ -0,0 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jh75-99hh-qvx9",
"modified": "2024-08-07T15:30:42Z",
"published": "2024-08-07T15:30:42Z",
"aliases": [
"CVE-2024-41989"
],
"details": "An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41989"
},
{
"type": "WEB",
"url": "https://docs.djangoproject.com/en/dev/releases/security"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#%21forum/django-announce"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2024/aug/06/security-releases"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-07T15:15:56Z"
}
}
advisories/unreviewed/2024/08/GHSA-jvvm-gq28-8rgc/GHSA-jvvm-gq28-8rgc.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jvvm-gq28-8rgc",
"modified": "2024-08-07T12:31:28Z",
"modified": "2024-08-07T15:30:40Z",
"published": "2024-08-07T12:31:28Z",
"aliases": [
"CVE-2024-7265"
advisories/unreviewed/2024/08/GHSA-m6mx-rh5g-59hg/GHSA-m6mx-rh5g-59hg.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m6mx-rh5g-59hg",
"modified": "2024-08-07T15:30:42Z",
"published": "2024-08-07T15:30:41Z",
"aliases": [
"CVE-2024-7355"
],
"details": "The Organization chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_input’ and 'node_description' parameter in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure charts can be extended to subscribers.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7355"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/organization-chart/trunk/admin/assets/js/tree_page.js#L207"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/organization-chart/trunk/admin/assets/js/tree_page.js#L217"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3131569/#file0"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/organization-chart/#developers"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/04641506-5b0e-48bc-ad50-c81dda996ecf?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-07T13:16:00Z"
}
}
advisories/unreviewed/2024/08/GHSA-pv4p-cwwg-4rph/GHSA-pv4p-cwwg-4rph.json
+43
View File
@@ -0,0 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pv4p-cwwg-4rph",
"modified": "2024-08-07T15:30:42Z",
"published": "2024-08-07T15:30:42Z",
"aliases": [
"CVE-2024-42005"
],
"details": "An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42005"
},
{
"type": "WEB",
"url": "https://docs.djangoproject.com/en/dev/releases/security"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#%21forum/django-announce"
},
{
"type": "WEB",
"url": "https://www.djangoproject.com/weblog/2024/aug/06/security-releases"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-07T15:15:56Z"
}
}

Some files were not shown because too many files have changed in this diff Show More