diff options
| author | Florian Smeets <flo@FreeBSD.org> | 2024-02-11 10:49:23 +0100 |
|---|---|---|
| committer | Florian Smeets <flo@FreeBSD.org> | 2024-02-13 21:00:16 +0100 |
| commit | b3506d6b828b0a211bedcadc9b3489ce1d53eb32 (patch) | |
| tree | c216ed44bb071717ee281250efcd8e3cf91a4799 | |
| parent | f33c4e2d0b69a467d8f99524138b854dac842629 (diff) | |
| download | freebsd-ports-b3506d6b828b0a211bedcadc9b3489ce1d53eb32.zip | |
security/vuxml: add phpmyfaq < 3.2.5
| -rw-r--r-- | security/vuxml/vuln/2024.xml | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index b9cafe0dcc71..5ce1aa06740f 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,38 @@ + <vuln vid="cbfc1591-c8c0-11ee-b45a-589cfc0f81b0"> + <topic>phpmyfaq -- multiple vulnerabilities</topic> + <affects> + <package> + <name>phpmyfaq-php81</name> + <name>phpmyfaq-php82</name> + <name>phpmyfaq-php83</name> + <range><lt>3.2.5</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>phpMyFAQ team reports:</p> + <blockquote cite="https://www.phpmyfaq.de/security/advisory-2024-02-05"> + <p>phpMyFAQ doesn't implement sufficient checks to avoid XSS when + storing on attachments filenames. The 'sharing FAQ' functionality + allows any unauthenticated actor to misuse the phpMyFAQ application + to send arbitrary emails to a large range of targets. phpMyFAQ's + user removal page allows an attacker to spoof another user's + detail, and in turn make a compelling phishing case for removing + another user's account.</p> + </blockquote> + </body> + </description> + <references> + <url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7m8g-fprr-47fx</url> + <url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9hhf-xmcw-r3xg</url> + <url>https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6648-6g96-mg35</url> + </references> + <dates> + <discovery>2024-02-05</discovery> + <entry>2024-02-11</entry> + </dates> + </vuln> + <vuln vid="f161a5ad-c9bd-11ee-b7a7-353f1e043d9a"> <topic>openexr -- Heap Overflow in Scanline Deep Data Parsing</topic> <affects> |