netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-4f92-w438-f484
GHSA-2vgj-3pvg-xh4w
GHSA-8mm6-wmpp-mmm3
GHSA-cvw9-c57h-3397
GHSA-hf29-9hfh-w63j
This commit is contained in:
advisory-database[bot]
2024-07-05 20:05:22 +00:00
parent 68778ee216
commit f35c451611
5 changed files with 244 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/05/GHSA-4f92-w438-f484/GHSA-4f92-w438-f484.json → advisories/github-reviewed/2024/05/GHSA-4f92-w438-f484/GHSA-4f92-w438-f484.json
+28 -5
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4f92-w438-f484",
"modified": "2024-07-03T18:38:36Z",
"modified": "2024-07-05T20:04:18Z",
"published": "2024-05-02T12:30:40Z",
"aliases": [
"CVE-2024-3955"
],
"details": "URL GET parameter \"logtime\" utilized within the \"downloadlog\" function from \"cbpi/http_endpoints/http_system.py\" is subsequently passed to the \"os.system\" function in \"cbpi/controller/system_controller.py\" without prior validation allowing to execute arbitrary code.This issue affects CraftBeerPi 4: from 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7).\n\n",
"summary": "CraftBeerPi 4 allows arbitrary code execution",
"details": "URL GET parameter \"logtime\" utilized within the \"downloadlog\" function from \"cbpi/http_endpoints/http_system.py\" is subsequently passed to the \"os.system\" function in \"cbpi/controller/system_controller.py\" without prior validation allowing arbitrary code execution. This issue affects CraftBeerPi 4: from 4.0.0.58 (commit 563fae9) before 4.4.1.a1 (commit 57572c7).\n\n",
"severity": [
{
"type": "CVSS_V3",
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "cbpi4"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0.58"
},
{
"fixed": "4.4.1.a1"
}
]
}
]
}
],
"references": [
{
@@ -32,6 +51,10 @@
{
"type": "WEB",
"url": "https://cert.pl/posts/2024/05/CVE-2024-3955"
},
{
"type": "PACKAGE",
"url": "https://github.com/PiBrewing/craftbeerpi4"
}
],
"database_specific": {
@@ -39,8 +62,8 @@
"CWE-94"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-07-05T20:04:18Z",
"nvd_published_at": "2024-05-02T10:15:08Z"
}
}
advisories/unreviewed/2024/07/GHSA-2vgj-3pvg-xh4w/GHSA-2vgj-3pvg-xh4w.json → advisories/github-reviewed/2024/07/GHSA-2vgj-3pvg-xh4w/GHSA-2vgj-3pvg-xh4w.json
+28 -5
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2vgj-3pvg-xh4w",
"modified": "2024-07-04T18:31:10Z",
"modified": "2024-07-05T20:04:44Z",
"published": "2024-07-04T18:31:10Z",
"aliases": [
"CVE-2024-39931"
],
"details": "Gogs through 0.13.0 allows deletion of internal files.",
"summary": "Gogs allows deletion of internal files",
"details": "Gogs through 0.13.0 allows deletion of internal files. ",
"severity": [
{
"type": "CVSS_V3",
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/gogs/gogs"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.13.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39931"
},
{
"type": "PACKAGE",
"url": "https://github.com/gogs/gogs"
},
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/releases"
@@ -35,8 +58,8 @@
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-07-05T20:04:44Z",
"nvd_published_at": "2024-07-04T16:15:02Z"
}
}
advisories/unreviewed/2024/07/GHSA-8mm6-wmpp-mmm3/GHSA-8mm6-wmpp-mmm3.json → advisories/github-reviewed/2024/07/GHSA-8mm6-wmpp-mmm3/GHSA-8mm6-wmpp-mmm3.json
+24 -9
View File
@@ -1,12 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8mm6-wmpp-mmm3",
"modified": "2024-07-04T18:31:11Z",
"modified": "2024-07-05T20:04:48Z",
"published": "2024-07-04T18:31:11Z",
"aliases": [
"CVE-2024-39933"
],
"details": "Gogs through 0.13.0 allows argument injection during the tagging of a new release.",
"summary": "Gogs allows argument injection during the tagging of a new release",
"details": "Gogs through 0.13.0 allows argument injection during the tagging of a new release. This vulnerability is still unfixed as of the time of this advisory being published.",
"severity": [
{
"type": "CVSS_V3",
@@ -14,17 +15,31 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/gogs/gogs"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.13.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39933"
},
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/releases"
},
{
"type": "WEB",
"url": "https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1"
@@ -35,8 +50,8 @@
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-07-05T20:04:48Z",
"nvd_published_at": "2024-07-04T16:15:02Z"
}
}
advisories/github-reviewed/2024/07/GHSA-cvw9-c57h-3397/GHSA-cvw9-c57h-3397.json
+141
View File
@@ -0,0 +1,141 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cvw9-c57h-3397",
"modified": "2024-07-05T20:03:55Z",
"published": "2024-07-05T20:03:55Z",
"aliases": [
"CVE-2024-39683"
],
"summary": "ZITADEL Vulnerable to Session Information Leakage",
"details": "### Impact\n\nZITADEL provides users the ability to list all user sessions of the current user agent (browser) by API and in the Console UI.\n\nDue to a missing check, user sessions without that information (e.g. when created though the session service) were incorrectly listed exposing potentially other user's sessions.\n\nNote that the Login UI was never affected and there was no possibility to take over such a session.\n\n### Patches\n\n2.x versions are fixed on >= [2.55.1](https://github.com/zitadel/zitadel/releases/tag/v2.55.1)\n2.54.x versions are fixed on >= [2.54.5](https://github.com/zitadel/zitadel/releases/tag/v2.54.5)\n2.53.x versions are fixed on >= [2.53.8](https://github.com/zitadel/zitadel/releases/tag/v2.53.8)\n\nZITADEL recommends upgrading to the latest versions available in due course.\n\n### Workarounds\n\nThere is no workaround since a patch is already available.\n\n### References\n\n- https://github.com/zitadel/zitadel/pull/8231\n- https://discord.com/channels/927474939156643850/1254096852937347153\n- https://github.com/zitadel/zitadel/issues/8213\n\n### Questions\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\nThanks to @cybertransformer, @Avolicious, @AmirhoseinBrz and @srividyaj for finding and reporting the vulnerability.\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/zitadel/zitadel"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.53.8"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.53.7"
}
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/zitadel/zitadel"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.54.0"
},
{
"fixed": "2.54.5"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.54.4"
}
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/zitadel/zitadel"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.55.0"
},
{
"fixed": "2.55.1"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-cvw9-c57h-3397"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39683"
},
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/issues/8213"
},
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/pull/8231"
},
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/commit/4a262e42abac2208b02fefaf68ba1a5121649f04"
},
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/commit/c2093ce01507ca8fc811609ff5d391693360c3da"
},
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/commit/d04f208486a418a45b884b9ca8433e5ad9790d73"
},
{
"type": "WEB",
"url": "https://discord.com/channels/927474939156643850/1254096852937347153"
},
{
"type": "PACKAGE",
"url": "https://github.com/zitadel/zitadel"
},
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.53.8"
},
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.54.5"
},
{
"type": "WEB",
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.55.1"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-07-05T20:03:55Z",
"nvd_published_at": "2024-07-03T20:15:04Z"
}
}
advisories/unreviewed/2024/07/GHSA-hf29-9hfh-w63j/GHSA-hf29-9hfh-w63j.json → advisories/github-reviewed/2024/07/GHSA-hf29-9hfh-w63j/GHSA-hf29-9hfh-w63j.json
+23 -8
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hf29-9hfh-w63j",
"modified": "2024-07-04T18:31:11Z",
"modified": "2024-07-05T20:04:46Z",
"published": "2024-07-04T18:31:11Z",
"aliases": [
"CVE-2024-39932"
],
"summary": "Gogs allows argument injection during the previewing of changes",
"details": "Gogs through 0.13.0 allows argument injection during the previewing of changes.",
"severity": [
{
@@ -14,17 +15,31 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/gogs/gogs"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.13.0"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39932"
},
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/releases"
},
{
"type": "WEB",
"url": "https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1"
@@ -35,8 +50,8 @@
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-07-05T20:04:46Z",
"nvd_published_at": "2024-07-04T16:15:02Z"
}
}