netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-gcgw-q47m-prvj
GHSA-p2vx-qj66-88q3
GHSA-rpjw-97p8-p2xp
GHSA-rv9j-c866-gp5h
This commit is contained in:
advisory-database[bot]
2024-01-09 18:26:31 +00:00
parent e69d0d912a
commit ebca3576d8
4 changed files with 103 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2023/12/GHSA-gcgw-q47m-prvj/GHSA-gcgw-q47m-prvj.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gcgw-q47m-prvj",
"modified": "2023-12-15T03:53:07Z",
"modified": "2024-01-09T18:25:39Z",
"published": "2023-12-12T03:31:45Z",
"aliases": [
"CVE-2023-50422"
@@ -155,6 +155,10 @@
"type": "WEB",
"url": "https://me.sap.com/notes/3411067"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3413475"
},
{
"type": "WEB",
"url": "https://mvnrepository.com/artifact/com.sap.cloud.security.xsuaa/spring-xsuaa"
advisories/github-reviewed/2023/12/GHSA-p2vx-qj66-88q3/GHSA-p2vx-qj66-88q3.json
+9 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p2vx-qj66-88q3",
"modified": "2023-12-20T17:57:49Z",
"modified": "2024-01-09T18:25:33Z",
"published": "2023-12-12T03:31:45Z",
"aliases": [
"CVE-2023-49583"
@@ -48,6 +48,14 @@
"type": "WEB",
"url": "https://me.sap.com/notes/3411067"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3412456"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3413475"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/@sap/xssec"
advisories/github-reviewed/2024/01/GHSA-rpjw-97p8-p2xp/GHSA-rpjw-97p8-p2xp.json
+8
View File
@@ -44,9 +44,17 @@
"type": "PACKAGE",
"url": "https://github.com/GilaCMS/gila"
},
{
"type": "WEB",
"url": "https://github.com/GilaCMS/gila/security/policy"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/176301/GilaCMS-1.15.4-SQL-Injection.html"
},
{
"type": "WEB",
"url": "http://gilacms.com"
}
],
"database_specific": {
advisories/github-reviewed/2024/01/GHSA-rv9j-c866-gp5h/GHSA-rv9j-c866-gp5h.json
+81
View File
@@ -0,0 +1,81 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rv9j-c866-gp5h",
"modified": "2024-01-09T18:25:47Z",
"published": "2024-01-09T18:25:47Z",
"aliases": [
"CVE-2024-21643"
],
"summary": "Microsoft.IdentityModel.Protocols.SignedHttpRequest remote code execution vulnerability",
"details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\nAnyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Microsoft.IdentityModel trusts the `jku`claim by default for the `SignedHttpRequest`protocol. This raises the possibility to make any remote or local `HTTP GET` request. \n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\nThe vulnerability has been fixed in Microsoft.IdentityModel.Protocols.SignedHttpRequest. Users **should** update **all** their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher, if using Microsoft.IdentityModel.Protocols.SignedHttpRequest.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\nNo, users must upgrade.\n\n### References\n_Are there any links users can visit to find out more?_\nhttps://aka.ms/IdentityModel/Jan2024/jku",
"severity": [
],
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.IdentityModel.Protocols.SignedHttpRequest"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.34.0"
}
]
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Microsoft.IdentityModel.Protocols.SignedHttpRequest"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0-preview"
},
{
"fixed": "7.1.2"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/security/advisories/GHSA-rv9j-c866-gp5h"
},
{
"type": "PACKAGE",
"url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet"
},
{
"type": "WEB",
"url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/6.34.0"
},
{
"type": "WEB",
"url": "https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases/tag/7.1.2"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-01-09T18:25:47Z",
"nvd_published_at": null
}
}