netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-12-04 21:32:29 +00:00
parent 8d99a743bf
commit ec89f3f566
35 changed files with 363 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/02/GHSA-48f4-cx87-w7mh/GHSA-48f4-cx87-w7mh.json
+8 -7
View File
@@ -1,18 +1,19 @@
{
"schema_version": "1.4.0",
"id": "GHSA-48f4-cx87-w7mh",
"modified": "2024-02-21T00:31:31Z",
"modified": "2024-12-04T21:30:50Z",
"published": "2024-02-21T00:31:31Z",
"aliases": [
"CVE-2023-50923"
],
"details": "In QUIC in RFC 9000, the Latency Spin Bit specification (section 17.4) does not strictly constrain the bit value when the feature is disabled, which might allow remote attackers to construct a covert channel with data represented as changes to the bit value. NOTE: The \"Sheridan, S., Keane, A. (2015). In Proceedings of the 14th European Conference on Cyber Warfare and Security (ECCWS), University of Hertfordshire, Hatfield, UK.\" paper says \"Modern Internet communication protocols provide an almost infinite number of ways in which data can be hidden or embed whithin seemingly normal network traffic.\"",
"severity": [
],
"affected": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -33,9 +34,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-21T00:15:07Z"
advisories/unreviewed/2024/02/GHSA-wqm3-jgh5-wqrh/GHSA-wqm3-jgh5-wqrh.json
+8 -7
View File
@@ -1,18 +1,19 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wqm3-jgh5-wqrh",
"modified": "2024-02-29T00:30:23Z",
"modified": "2024-12-04T21:30:50Z",
"published": "2024-02-29T00:30:23Z",
"aliases": [
"CVE-2024-26450"
],
"details": "Cross Site Scripting vulnerability in Piwigo before v.14.2.0 allows a remote attacker to escalate privileges via the batch function on the admin page.",
"severity": [
],
"affected": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "WEB",
@@ -25,9 +26,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-28T22:15:26Z"
advisories/unreviewed/2024/03/GHSA-469c-p6p8-wh33/GHSA-469c-p6p8-wh33.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-469c-p6p8-wh33",
"modified": "2024-03-03T12:30:31Z",
"modified": "2024-12-04T21:30:50Z",
"published": "2024-03-03T12:30:31Z",
"aliases": [
"CVE-2024-26469"
],
"details": "Server-Side Request Forgery (SSRF) vulnerability in Tunis Soft \"Product Designer\" (productdesigner) module for PrestaShop before version 1.178.36, allows remote attackers to cause a denial of service (DoS) and escalate privileges via the url parameter in the postProcess() method.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-03T10:15:06Z"
advisories/unreviewed/2024/03/GHSA-j2cw-j27w-3f6m/GHSA-j2cw-j27w-3f6m.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j2cw-j27w-3f6m",
"modified": "2024-03-13T21:31:02Z",
"modified": "2024-12-04T21:30:50Z",
"published": "2024-03-08T03:31:24Z",
"aliases": [
"CVE-2024-23249"
],
"details": "The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.4. Processing a file may lead to a denial-of-service or potentially disclose memory contents.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-404"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-08T02:15:48Z"
advisories/unreviewed/2024/03/GHSA-wwvg-qmhg-chgp/GHSA-wwvg-qmhg-chgp.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wwvg-qmhg-chgp",
"modified": "2024-05-01T18:30:36Z",
"modified": "2024-12-04T21:30:50Z",
"published": "2024-03-20T15:32:39Z",
"aliases": [
"CVE-2024-28565"
],
"details": "Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the psdParser::ReadImageData() function when reading images in PSD format.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -32,8 +37,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-120"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-20T06:15:09Z"
advisories/unreviewed/2024/04/GHSA-23r4-x5xc-qw4f/GHSA-23r4-x5xc-qw4f.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-23r4-x5xc-qw4f",
"modified": "2024-04-10T18:30:47Z",
"modified": "2024-12-04T21:30:51Z",
"published": "2024-04-10T18:30:47Z",
"aliases": [
"CVE-2024-23735"
],
"details": "Cross Site Scripting (XSS) vulnerability in in the S/MIME certificate upload functionality of the User Profile pages in savignano S/Notify before 4.0.0 for Confluence allows attackers to manipulate user data via specially crafted certificate.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -24,8 +29,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-10T16:15:09Z"
advisories/unreviewed/2024/04/GHSA-5473-w6gq-5r5g/GHSA-5473-w6gq-5r5g.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5473-w6gq-5r5g",
"modified": "2024-07-03T21:39:42Z",
"modified": "2024-12-04T21:30:51Z",
"published": "2024-04-28T00:30:23Z",
"aliases": [
"CVE-2023-52722"
],
"details": "An issue was discovered in Artifex Ghostscript through 10.01.0. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 standard.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
}
],
"affected": [],
"references": [
{
@@ -25,7 +30,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-28T00:15:07Z"
advisories/unreviewed/2024/04/GHSA-95fq-qfw9-w29v/GHSA-95fq-qfw9-w29v.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-95fq-qfw9-w29v",
"modified": "2024-04-01T15:30:29Z",
"modified": "2024-12-04T21:30:50Z",
"published": "2024-04-01T15:30:29Z",
"aliases": [
"CVE-2024-30864"
],
"details": "netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/config_ISCGroupTimePolicy.php.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-01T15:15:50Z"
advisories/unreviewed/2024/04/GHSA-g9gh-7wv9-6wcr/GHSA-g9gh-7wv9-6wcr.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g9gh-7wv9-6wcr",
"modified": "2024-04-30T00:30:34Z",
"modified": "2024-12-04T21:30:51Z",
"published": "2024-04-30T00:30:34Z",
"aliases": [
"CVE-2023-52724"
],
"details": "Open Networking Foundation SD-RAN onos-kpimon 0.4.7 allows out-of-bounds array access in the processIndicationFormat1 function.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-787"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-30T00:15:07Z"
advisories/unreviewed/2024/04/GHSA-gj98-2c7c-vmc4/GHSA-gj98-2c7c-vmc4.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gj98-2c7c-vmc4",
"modified": "2024-04-05T15:30:31Z",
"modified": "2024-12-04T21:30:50Z",
"published": "2024-04-05T15:30:31Z",
"aliases": [
"CVE-2024-31852"
],
"details": "LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is \"we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production.\"",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -33,7 +38,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-05T15:15:08Z"
advisories/unreviewed/2024/04/GHSA-wxwf-hc4j-fc3q/GHSA-wxwf-hc4j-fc3q.json
+3 -1
View File
@@ -25,7 +25,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-190"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2024/05/GHSA-7296-qmw6-c5cw/GHSA-7296-qmw6-c5cw.json
+8 -7
View File
@@ -1,18 +1,19 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7296-qmw6-c5cw",
"modified": "2024-05-21T18:31:22Z",
"modified": "2024-12-04T21:30:51Z",
"published": "2024-05-21T18:31:22Z",
"aliases": [
"CVE-2023-52829"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix possible out-of-bound write in ath12k_wmi_ext_hal_reg_caps()\n\nreg_cap.phy_id is extracted from WMI event and could be an unexpected value\nin case some errors happen. As a result out-of-bound write may occur to\nsoc->hal_reg_cap. Fix it by validating reg_cap.phy_id before using it.\n\nThis is found during code review.\n\nCompile tested only.",
"severity": [
],
"affected": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -33,9 +34,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T16:15:20Z"
advisories/unreviewed/2024/05/GHSA-8j9h-4rqp-j66g/GHSA-8j9h-4rqp-j66g.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8j9h-4rqp-j66g",
"modified": "2024-05-04T21:30:33Z",
"modified": "2024-12-04T21:30:51Z",
"published": "2024-05-04T21:30:33Z",
"aliases": [
"CVE-2024-34468"
],
"details": "Rukovoditel before 3.5.3 allows XSS via user_photo to My Page.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-04T20:15:07Z"
advisories/unreviewed/2024/05/GHSA-wcx3-63mm-h8x6/GHSA-wcx3-63mm-h8x6.json
+8 -7
View File
@@ -1,18 +1,19 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wcx3-63mm-h8x6",
"modified": "2024-06-10T18:30:57Z",
"modified": "2024-12-04T21:30:51Z",
"published": "2024-05-05T21:30:30Z",
"aliases": [
"CVE-2024-34500"
],
"details": "An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.",
"severity": [
],
"affected": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -33,9 +34,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-05T19:15:07Z"
advisories/unreviewed/2024/06/GHSA-vjx7-hf5r-chv4/GHSA-vjx7-hf5r-chv4.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vjx7-hf5r-chv4",
"modified": "2024-06-24T06:30:55Z",
"modified": "2024-12-04T21:30:51Z",
"published": "2024-06-24T06:30:55Z",
"aliases": [
"CVE-2024-4900"
],
"details": "The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above role to perform Open redirect attacks against any user viewing a malicious post",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -21,7 +26,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-24T06:15:11Z"
advisories/unreviewed/2024/09/GHSA-rqj4-hg4x-qw45/GHSA-rqj4-hg4x-qw45.json
+3 -1
View File
@@ -29,7 +29,9 @@
}
],
"database_specific": {
"cwe_ids": [],
"cwe_ids": [
"CWE-476"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
advisories/unreviewed/2024/11/GHSA-397j-j3xj-vcr3/GHSA-397j-j3xj-vcr3.json
+3 -4
View File
@@ -17,9 +17,7 @@
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -44,7 +42,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-74"
"CWE-74",
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2024/11/GHSA-4f47-wxrx-fmj7/GHSA-4f47-wxrx-fmj7.json
+1 -3
View File
@@ -17,9 +17,7 @@
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
advisories/unreviewed/2024/11/GHSA-5r88-6jm3-pfvc/GHSA-5r88-6jm3-pfvc.json
+1 -3
View File
@@ -17,9 +17,7 @@
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
advisories/unreviewed/2024/11/GHSA-82vh-c6r8-fwq3/GHSA-82vh-c6r8-fwq3.json
+2 -1
View File
@@ -46,7 +46,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-74"
"CWE-74",
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,

Some files were not shown because too many files have changed in this diff Show More