netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2q75-f7cp-w86q
GHSA-wprr-mc54-c62q
GHSA-6p2j-228c-wmvm
GHSA-7rc4-v56c-j5pm
GHSA-8f5f-8xpp-8qfr
GHSA-gq7m-h265-px53
GHSA-pqjf-jm5p-23mq
GHSA-v77g-99m4-2vmq
This commit is contained in:
advisory-database[bot]
2024-10-14 21:32:02 +00:00
parent 69449e0a5f
commit fd85726f3f
8 changed files with 264 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-2q75-f7cp-w86q/GHSA-2q75-f7cp-w86q.json
+15 -4
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2q75-f7cp-w86q",
"modified": "2023-02-04T00:15:51Z",
"modified": "2024-10-14T21:30:24Z",
"published": "2022-05-17T04:30:18Z",
"aliases": [
"CVE-2012-5500"
@@ -9,13 +9,20 @@
"summary": "Plone contains Cross-site Request Forgery",
"details": "The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "plone"
"name": "Plone"
},
"ranges": [
{
@@ -34,7 +41,7 @@
{
"package": {
"ecosystem": "PyPI",
"name": "plone"
"name": "Plone"
},
"ranges": [
{
@@ -76,6 +83,10 @@
"type": "PACKAGE",
"url": "https://github.com/plone/plone"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-42.yaml"
},
{
"type": "WEB",
"url": "https://plone.org/products/plone-hotfix/releases/20121106"
advisories/github-reviewed/2022/05/GHSA-wprr-mc54-c62q/GHSA-wprr-mc54-c62q.json
+32 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wprr-mc54-c62q",
"modified": "2023-02-14T01:01:02Z",
"modified": "2024-10-14T21:31:16Z",
"published": "2022-05-17T04:30:15Z",
"aliases": [
"CVE-2012-5508"
@@ -9,7 +9,14 @@
"summary": "Exposure of Sensitive Information in Plone",
"details": "The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for password resets via unspecified vectors. NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6661 was assigned for the PRNG reseeding issue in Zope.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
@@ -30,6 +37,25 @@
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "Plone"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.3a0"
},
{
"fixed": "4.3b1"
}
]
}
]
}
],
"references": [
@@ -49,6 +75,10 @@
"type": "WEB",
"url": "https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-50.yaml"
},
{
"type": "WEB",
"url": "https://plone.org/products/plone-hotfix/releases/20121124"
advisories/unreviewed/2024/10/GHSA-6p2j-228c-wmvm/GHSA-6p2j-228c-wmvm.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6p2j-228c-wmvm",
"modified": "2024-10-14T21:30:26Z",
"published": "2024-10-14T21:30:26Z",
"aliases": [
"CVE-2023-48082"
],
"details": "Nagios XI before 5.11.3 2024R1 was discovered to improperly handle API keys generation (randomly-generated), allowing attackers to possibly generate the same set of API keys for all users and utilize them to authenticate.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48082"
},
{
"type": "WEB",
"url": "https://www.nagios.com/change-log"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-14T19:15:10Z"
}
}
advisories/unreviewed/2024/10/GHSA-7rc4-v56c-j5pm/GHSA-7rc4-v56c-j5pm.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7rc4-v56c-j5pm",
"modified": "2024-10-14T21:30:26Z",
"published": "2024-10-14T21:30:26Z",
"aliases": [
"CVE-2024-48822"
],
"details": "Privilege escalation in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges via the FtpConfig.php page.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48822"
},
{
"type": "WEB",
"url": "https://daly.wtf/multiple-vulnerabilities-discovered-in-automatic-systems-software"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-14T21:15:11Z"
}
}
advisories/unreviewed/2024/10/GHSA-8f5f-8xpp-8qfr/GHSA-8f5f-8xpp-8qfr.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8f5f-8xpp-8qfr",
"modified": "2024-10-14T21:30:27Z",
"published": "2024-10-14T21:30:26Z",
"aliases": [
"CVE-2024-48821"
],
"details": "Cross Site Scripting vulnerability in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges via the FtpConfig.php component.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48821"
},
{
"type": "WEB",
"url": "https://daly.wtf/multiple-vulnerabilities-discovered-in-automatic-systems-software"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-14T21:15:11Z"
}
}
advisories/unreviewed/2024/10/GHSA-gq7m-h265-px53/GHSA-gq7m-h265-px53.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gq7m-h265-px53",
"modified": "2024-10-14T21:30:27Z",
"published": "2024-10-14T21:30:27Z",
"aliases": [
"CVE-2024-6207"
],
"details": "CVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html  and send a specially crafted CIP message to the device. If exploited, a threat actor could help prevent access to the legitimate user and end connections to connected devices including the workstation. To recover the controllers, a download is required which ends any process that the controller is running.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6207"
},
{
"type": "WEB",
"url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1707.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-14T21:15:12Z"
}
}
advisories/unreviewed/2024/10/GHSA-pqjf-jm5p-23mq/GHSA-pqjf-jm5p-23mq.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pqjf-jm5p-23mq",
"modified": "2024-10-14T21:30:26Z",
"published": "2024-10-14T21:30:26Z",
"aliases": [
"CVE-2024-48823"
],
"details": "Local file inclusion in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges via the PassageAutoServer.php page.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48823"
},
{
"type": "WEB",
"url": "https://daly.wtf/multiple-vulnerabilities-discovered-in-automatic-systems-software"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-14T21:15:11Z"
}
}
advisories/unreviewed/2024/10/GHSA-v77g-99m4-2vmq/GHSA-v77g-99m4-2vmq.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v77g-99m4-2vmq",
"modified": "2024-10-14T21:30:27Z",
"published": "2024-10-14T21:30:27Z",
"aliases": [
"CVE-2024-48824"
],
"details": "An issue in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to obtain sensitive information via the Racine & FileName parameters in the download-file.php component.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48824"
},
{
"type": "WEB",
"url": "https://daly.wtf/multiple-vulnerabilities-discovered-in-automatic-systems-software"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-14T21:15:11Z"
}
}