Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/red-discordbot@3.0.0rc1
Typepypi
Namespace
Namered-discordbot
Version3.0.0rc1
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version3.4.1
Latest_non_vulnerable_version3.4.1
Affected_by_vulnerabilities
0
url VCID-bd1p-1gv9-q3dg
vulnerability_id VCID-bd1p-1gv9-q3dg
summary Red Discord Bot before version 3.4.1 has an unauthorized privilege escalation exploit in the Mod module. This exploit allows Discord users with a high privilege level within the guild to bypass hierarchy checks when the application is in a specific condition that is beyond that user's control. By abusing this exploit, it is possible to perform destructive actions within the guild the user has high privileges in. This exploit has been fixed in version 3.4.1. As a workaround, unloading the Mod module with unload mod or, disabling the massban command with command disable global massban can render this exploit not accessible. We still highly recommend updating to 3.4.1 to completely patch this issue.
references
0
reference_url https://github.com/Cog-Creators/Red-DiscordBot/commit/726bfd38adfdfaef760412a68e01447b470f438b
reference_id
reference_type
scores
url https://github.com/Cog-Creators/Red-DiscordBot/commit/726bfd38adfdfaef760412a68e01447b470f438b
1
reference_url https://github.com/Cog-Creators/Red-DiscordBot/releases/tag/3.4.1
reference_id
reference_type
scores
url https://github.com/Cog-Creators/Red-DiscordBot/releases/tag/3.4.1
2
reference_url https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-mp9m-g7qj-6vqr
reference_id
reference_type
scores
url https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-mp9m-g7qj-6vqr
fixed_packages
0
url pkg:pypi/red-discordbot@3.4.1
purl pkg:pypi/red-discordbot@3.4.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/red-discordbot@3.4.1
aliases CVE-2020-15278, GHSA-mp9m-g7qj-6vqr, PYSEC-2020-267
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-bd1p-1gv9-q3dg
1
url VCID-tyaj-tzft-2ba8
vulnerability_id VCID-tyaj-tzft-2ba8
summary Red Discord Bot before versions 3.3.12 and 3.4 has a Remote Code Execution vulnerability in the Streams module. This exploit allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. As a workaround, unloading the Trivia module with `unload streams` can render this exploit not accessible. It is highly recommended updating to 3.3.12 or 3.4 to completely patch this issue.
references
0
reference_url https://github.com/Cog-Creators/Red-DiscordBot/pull/4183
reference_id
reference_type
scores
url https://github.com/Cog-Creators/Red-DiscordBot/pull/4183
1
reference_url https://github.com/Cog-Creators/Red-DiscordBot/pull/4183/commits/e269ea0d3bc88417163c18431b1df38a9be92bfc
reference_id
reference_type
scores
url https://github.com/Cog-Creators/Red-DiscordBot/pull/4183/commits/e269ea0d3bc88417163c18431b1df38a9be92bfc
2
reference_url https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-7257-96vg-qf6x
reference_id
reference_type
scores
url https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-7257-96vg-qf6x
fixed_packages
0
url pkg:pypi/red-discordbot@3.3.12
purl pkg:pypi/red-discordbot@3.3.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-bd1p-1gv9-q3dg
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/red-discordbot@3.3.12
aliases CVE-2020-15147, GHSA-7257-96vg-qf6x, PYSEC-2020-266
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-tyaj-tzft-2ba8
2
url VCID-wy1w-6hzy-9bbf
vulnerability_id VCID-wy1w-6hzy-9bbf
summary In Red Discord Bot before version 3.3.11, a RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information. This critical exploit has been fixed on version 3.3.11.
references
0
reference_url https://github.com/Cog-Creators/Red-DiscordBot/pull/4175/commits/9ab536235bafc2b42c3c17d7ce26f1cc64482a81
reference_id
reference_type
scores
url https://github.com/Cog-Creators/Red-DiscordBot/pull/4175/commits/9ab536235bafc2b42c3c17d7ce26f1cc64482a81
1
reference_url https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-55j9-849x-26h4
reference_id
reference_type
scores
url https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-55j9-849x-26h4
fixed_packages
0
url pkg:pypi/red-discordbot@3.3.11
purl pkg:pypi/red-discordbot@3.3.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-bd1p-1gv9-q3dg
1
vulnerability VCID-tyaj-tzft-2ba8
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/red-discordbot@3.3.11
aliases CVE-2020-15140, GHSA-55j9-849x-26h4, PYSEC-2020-265
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wy1w-6hzy-9bbf
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/red-discordbot@3.0.0rc1