netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3366-9287-7qpr
GHSA-6vjf-48fh-vxxj
GHSA-cp8m-h777-g4p3
GHSA-q3gg-m8hr-h4x4
GHSA-xfg6-62px-cxc2
GHSA-6vjf-48fh-vxxj
GHSA-cp8m-h777-g4p3
GHSA-xfg6-62px-cxc2
This commit is contained in:
advisory-database[bot]
2024-02-21 00:07:00 +00:00
parent bfdd9f3e0f
commit ee7262f66c
8 changed files with 520 additions and 130 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/02/GHSA-3366-9287-7qpr/GHSA-3366-9287-7qpr.json
+69
View File
@@ -0,0 +1,69 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3366-9287-7qpr",
"modified": "2024-02-21T00:04:24Z",
"published": "2024-02-21T00:04:24Z",
"aliases": [
"CVE-2024-26129"
],
"summary": "Path disclosure in JavaScript variable",
"details": "### Impact\nPath disclosure in JavaScript variable\n\n### Patches\nPatch in PrestaShop 8.1.4\n\n### References\nhttps://owasp.org/www-community/attacks/Full_Path_Disclosure\n\nThanks to https://github.com/hugo-fasone\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "prestashop/prestashop"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "8.1.0"
},
{
"fixed": "8.1.4"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3366-9287-7qpr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26129"
},
{
"type": "WEB",
"url": "https://github.com/PrestaShop/PrestaShop/commit/444bd0dea581659918fe2067541b9863cf099dd5"
},
{
"type": "PACKAGE",
"url": "https://github.com/PrestaShop/PrestaShop"
},
{
"type": "WEB",
"url": "https://owasp.org/www-community/attacks/Full_Path_Disclosure"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-02-21T00:04:24Z",
"nvd_published_at": "2024-02-19T22:15:49Z"
}
}
advisories/github-reviewed/2024/02/GHSA-6vjf-48fh-vxxj/GHSA-6vjf-48fh-vxxj.json
+111
View File
@@ -0,0 +1,111 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6vjf-48fh-vxxj",
"modified": "2024-02-21T00:05:33Z",
"published": "2024-02-19T18:31:32Z",
"aliases": [
"CVE-2024-25979"
],
"summary": "Improper Handling of Parameters in moodle",
"details": "The URL parameters accepted by forum search were not limited to the allowed parameters.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.3.0"
},
{
"fixed": "4.3.3"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.9"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25979"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/6eaeeda6cf759672def05a85afe9e4d521739166"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264095"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=455635"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-69774"
}
],
"database_specific": {
"cwe_ids": [
"CWE-233"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-02-21T00:05:33Z",
"nvd_published_at": "2024-02-19T17:15:08Z"
}
}
advisories/github-reviewed/2024/02/GHSA-cp8m-h777-g4p3/GHSA-cp8m-h777-g4p3.json
+111
View File
@@ -0,0 +1,111 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cp8m-h777-g4p3",
"modified": "2024-02-21T00:06:05Z",
"published": "2024-02-19T18:31:32Z",
"aliases": [
"CVE-2024-25980"
],
"summary": "Improper Access Control in moodle",
"details": "Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.3.0"
},
{
"fixed": "4.3.3"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.9"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25980"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/662192fcecdefdaae79f55db96bd64dbcdeef85b"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264096"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=455636"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80501"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-02-21T00:06:04Z",
"nvd_published_at": "2024-02-19T17:15:09Z"
}
}
advisories/github-reviewed/2024/02/GHSA-q3gg-m8hr-h4x4/GHSA-q3gg-m8hr-h4x4.json
+65
View File
File diff suppressed because one or more lines are too long
advisories/github-reviewed/2024/02/GHSA-xfg6-62px-cxc2/GHSA-xfg6-62px-cxc2.json
+164
View File
@@ -0,0 +1,164 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xfg6-62px-cxc2",
"modified": "2024-02-21T00:04:53Z",
"published": "2024-02-19T15:30:38Z",
"aliases": [
"CVE-2024-1597"
],
"summary": "SQL injection in pgjdbc",
"details": "pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.postgresql:postgresql"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "42.7.0"
},
{
"fixed": "42.7.2"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.postgresql:postgresql"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "42.6.0"
},
{
"fixed": "42.6.1"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.postgresql:postgresql"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "42.5.0"
},
{
"fixed": "42.5.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.postgresql:postgresql"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "42.4.0"
},
{
"fixed": "42.4.4"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.postgresql:postgresql"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "42.3.0"
},
{
"fixed": "42.3.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.postgresql:postgresql"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "42.2.8"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1597"
},
{
"type": "WEB",
"url": "https://github.com/pgjdbc/pgjdbc/commit/06abfb78a627277a580d4df825f210e96a4e14ee"
},
{
"type": "WEB",
"url": "https://github.com/pgjdbc/pgjdbc/commit/93b0fcb2711d9c1e3a2a03134369738a02a58b40"
},
{
"type": "PACKAGE",
"url": "https://github.com/pgjdbc/pgjdbc"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-02-21T00:04:53Z",
"nvd_published_at": "2024-02-19T13:15:07Z"
}
}
advisories/unreviewed/2024/02/GHSA-6vjf-48fh-vxxj/GHSA-6vjf-48fh-vxxj.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6vjf-48fh-vxxj",
"modified": "2024-02-19T18:31:32Z",
"published": "2024-02-19T18:31:32Z",
"aliases": [
"CVE-2024-25979"
],
"details": "The URL parameters accepted by forum search were not limited to the allowed parameters.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25979"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264095"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=455635"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-69774"
}
],
"database_specific": {
"cwe_ids": [
"CWE-233"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-19T17:15:08Z"
}
}
advisories/unreviewed/2024/02/GHSA-cp8m-h777-g4p3/GHSA-cp8m-h777-g4p3.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cp8m-h777-g4p3",
"modified": "2024-02-19T18:31:32Z",
"published": "2024-02-19T18:31:32Z",
"aliases": [
"CVE-2024-25980"
],
"details": "Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25980"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2264096"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=455636"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-80501"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-19T17:15:09Z"
}
}
advisories/unreviewed/2024/02/GHSA-xfg6-62px-cxc2/GHSA-xfg6-62px-cxc2.json
-38
View File
@@ -1,38 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xfg6-62px-cxc2",
"modified": "2024-02-19T15:30:38Z",
"published": "2024-02-19T15:30:38Z",
"aliases": [
"CVE-2024-1597"
],
"details": "pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.8 are affected.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "WEB",
"url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1597"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-19T13:15:07Z"
}
}