Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-04 05:12:09 +00:00
parent 6f0e45fda9
commit f04bf8c3e1
942 changed files with 1267 additions and 3801 deletions
@@ -74,9 +74,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-01T10:59:36Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Cross-Site Request Forgery in Spring Framework",
  "details": "The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -49,9 +49,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-30T22:42:51Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Cross-Site Request Forgery in Spring Framework",
  "details": "The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Cross-Site Request Forgery in Spring Framework",
  "details": "The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Missing XML Validation in Spring Framework",
  "details": "The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152.  NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Access bypass in Drupal core",
  "details": "The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -104,9 +102,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-27T14:01:16Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-w9mr-28mw-j8hg",
  "modified": "2023-04-27T15:52:24Z",
  "published": "2023-04-26T19:44:00Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Hop-by-hop abuse to malform header mutator",
  "details": "### Impact\n\nDownstream services relying on the presence of headers set by the `header` mutator could be exploited. A client can drop the header set by the `header` mutator by including that header's name in the `Connection` header. Example minimal config:\n\n```yaml\n- id: 'example'\n  upstream:\n    url: 'https://example.com'\n  match:\n    url: 'http://127.0.0.1:4455/'\n    methods:\n      - GET\n  authenticators:\n    - handler: anonymous\n  authorizer:\n    handler: allow\n  mutators:\n    - handler: header\n      config:\n        headers:\n          X-Subject: {{ .Subject }}\n```\n\n```\ncurl -H \"Connection: close,x-subject\" http://127.0.0.1:4455/\n```\n\nThe `X-Subject` header will not arrive at the downstream server. It is completely dropped. In case the downstream server handles such a request in an unexpected way, an attacker can exploit this, assuming they know or guess the internal header name.\n\n### Patches\n\nc5cc7f736dc84185034be4356057d1c7a656d797\n\n### Workarounds\n\nThe downstream server should handle the case that an expected header is not set by responding with an appropriate error.\n\n### References\n\nSee background info in https://github.com/golang/go/issues/50580",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -43,9 +39,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-26T19:44:00Z",
@@ -62,9 +62,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-10T21:19:42Z",
@@ -84,9 +84,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-16T20:45:55Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "pretix mishandles file validation",
  "details": "pretix before 2024.1.1 mishandles file validation.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -47,9 +45,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-26T22:14:44Z",
@@ -8,9 +8,7 @@
  ],
  "summary": "Helm shows secrets in clear text",
  "details": "An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values).",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-2fhr-8r8r-qp56",
  "modified": "2024-06-07T20:37:45Z",
  "published": "2024-06-07T20:37:45Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "ZendFramework Information Disclosure and Insufficient Entropy vulnerability",
  "details": "In Zend Framework, `Zend_Captcha_Word` (v1) and `Zend\\Captcha\\Word` (v2) generate a \"word\" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's `internal array_rand()` function. This function does not generate sufficient entropy due to its usage of `rand()` instead of more cryptographically secure methods such as `openssl_pseudo_random_bytes()`. This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-2rcw-9hrm-8q7q",
  "modified": "2024-06-07T19:47:52Z",
  "published": "2024-06-07T19:47:52Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "TYPO3 Cross-Site Scripting in Frontend User Login",
  "details": "Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile.\n\nTemplate patterns that are affected are\n\n- ###FEUSER_[fieldName]### using system extension felogin\n- <!--###USERNAME###--> for regular frontend rendering (pattern can be defined individually using TypoScript setting config.USERNAME_substToken)",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-5gmf-3c43-q73v",
  "modified": "2024-06-07T20:50:55Z",
  "published": "2024-06-07T20:50:55Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "ZendFramework vulnerable to Cross-site Scripting",
  "details": "`Zend\\Debug`, `Zend\\Feed\\PubSubHubbub`, `Zend\\Log\\Formatter\\Xml`, `Zend\\Tag\\Cloud\\Decorator`, `Zend\\Uri`, `Zend\\View\\Helper\\HeadStyle, Zend\\View\\Helper\\Navigation\\Sitemap`, and `Zend\\View\\Helper\\Placeholder\\Container\\AbstractStandalone` were not using `Zend\\Escaper` when escaping HTML, HTML attributes, and/or URLs. While most were performing some escaping, because they were not using context-appropriate escaping mechanisms, they could potentially be exploited to perform Cross Site Scripting (XSS) attacks.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-62f6-h68r-3jpw",
  "modified": "2024-06-07T20:20:21Z",
  "published": "2024-06-07T20:20:21Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Zendframework session validation vulnerability",
  "details": "`Zend\\Session` session validators do not work as expected if set prior to the start of a session.\n\nFor instance, the following test case fails (where `$this->manager` is an instance of `Zend\\Session\\SessionManager`):\n```\n$this\n    ->manager\n    ->getValidatorChain()\n    ->attach('session.validate', array(new RemoteAddr(), 'isValid'));\n\n$this->manager->start();\n\n$this->assertSame(\n    array(\n        'Zend\\Session\\Validator\\RemoteAddr' =3D> '',\n    ),\n    $_SESSION['__ZF']['_VALID']\n);\n```\nThe implication is that subsequent calls to `Zend\\Session\\SessionManager#start()` (in later requests, assuming a session was created) will not have any validator metadata attached, which causes any validator metadata to be re-built from scratch, thus marking the session as valid.\n\nAn attacker is thus able to simply ignore session validators such as RemoteAddr or HttpUserAgent, since the \"signature\" that these validators check against is not being stored in the session.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-6487-3qvg-8px9",
  "modified": "2024-06-07T19:55:04Z",
  "published": "2024-06-07T19:55:04Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "TYPO3 Information Disclosure in Install Tool",
  "details": "The Install Tool exposes the current TYPO3 version number to non-authenticated users.\n",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-7q33-hxwj-7p8v",
  "modified": "2024-06-07T19:44:49Z",
  "published": "2024-06-07T19:44:49Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "TYPO3 Cross-Site Scripting in Backend Modal Component",
  "details": "Failing to properly encode user input, notifications shown in modal windows in the TYPO3 backend are vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-8q77-cv62-jj38",
  "modified": "2024-06-07T20:04:04Z",
  "published": "2024-06-07T20:04:04Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Zendframework has potential Cross-site Scripting vector in multiple view helpers",
  "details": "Many Zend Framework 2 view helpers were using the `escapeHtml()` view helper in order to escape HTML attributes, instead of the more appropriate `escapeHtmlAttr()`. In situations where user data and/or JavaScript is used to seed attributes, this can lead to potential cross site scripting (XSS) attack vectors.\n\nVulnerable view helpers include:\n\n- All `Zend\\Form` view helpers.\n- Most `Zend\\Navigation` (aka `Zend\\View\\Helper\\Navigation\\*`) view helpers.\n- All \"HTML Element\" view helpers: `htmlFlash()`, `htmlPage()`, `htmlQuickTime()`.\n- `Zend\\View\\Helper\\Gravatar`",
  "severity": [
--- a/Show More
+++ b/Show More