Advisory Database Sync

advisories/unreviewed/2023/08/GHSA-ccmh-37rx-6pp5/GHSA-ccmh-37rx-6pp5.json

@@ -21,6 +21,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4456"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2023:4933"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/security/cve/CVE-2023-4456"

advisories/unreviewed/2023/08/GHSA-f3rm-cm42-4w4f/GHSA-f3rm-cm42-4w4f.json

@@ -24,6 +24,10 @@
     {
       "type": "WEB",
       "url": "https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface"
+    },
+    {
+      "type": "WEB",
+      "url": "http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html"
     }
   ],
   "database_specific": {

advisories/unreviewed/2023/09/GHSA-2pgp-5w4w-9255/GHSA-2pgp-5w4w-9255.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2pgp-5w4w-9255",
-  "modified": "2023-09-11T12:30:17Z",
+  "modified": "2023-09-13T18:31:26Z",
   "published": "2023-09-11T12:30:17Z",
   "aliases": [
     "CVE-2023-3612"
@@ -24,6 +24,10 @@
     {
       "type": "WEB",
       "url": "https://www.sk-cert.sk/sk/threat/sk-cert-bezpecnostne-varovanie-v20230811-10"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.sk-cert.sk/threat/sk-cert-bezpecnostne-varovanie-v20230811-10"
     }
   ],
   "database_specific": {

advisories/unreviewed/2023/09/GHSA-2qp5-3jc8-pprj/GHSA-2qp5-3jc8-pprj.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2qp5-3jc8-pprj",
+  "modified": "2023-09-13T18:31:26Z",
+  "published": "2023-09-13T18:31:26Z",
+  "aliases": [
+    "CVE-2023-4828"
+  ],
+  "details": "An improper check for an exceptional condition in the Insider Threat Management (ITM) Server could be used by an attacker to change the configuration of any already-registered agent so that all future agent communications are sent to an attacker-chosen URL. An attacker must first successfully obtain valid agent credentials and target agent hostname. All versions prior to 7.14.3.69 are affected.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4828"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-008"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-754"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}

advisories/unreviewed/2023/09/GHSA-346q-rm44-2j2v/GHSA-346q-rm44-2j2v.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-346q-rm44-2j2v",
+  "modified": "2023-09-13T18:31:26Z",
+  "published": "2023-09-13T18:31:26Z",
+  "aliases": [
+    "CVE-2023-20233"
+  ],
+  "details": "A vulnerability in the Connectivity Fault Management (CFM) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\n\n This vulnerability is due to incorrect processing of invalid continuity check messages (CCMs). An attacker could exploit this vulnerability by sending crafted CCMs to an affected device. A successful exploit could allow the attacker to cause the CFM service to crash when a user displays information about maintenance end points (MEPs) for peer MEPs on an affected device.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20233"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xr-cfm-3pWN8MKt"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}

advisories/unreviewed/2023/09/GHSA-3fqx-hqc3-q3wf/GHSA-3fqx-hqc3-q3wf.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3fqx-hqc3-q3wf",
-  "modified": "2023-09-11T21:30:17Z",
+  "modified": "2023-09-13T18:31:26Z",
   "published": "2023-09-11T21:30:17Z",
   "aliases": [
     "CVE-2023-35679"
   ],
   "details": "In MtpPropertyValue of MtpProperty.h, there is a possible out of bounds read due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
+    }
   ],
   "affected": [
 
@@ -29,7 +32,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-125"
     ],
     "severity": null,
     "github_reviewed": false,

advisories/unreviewed/2023/09/GHSA-3r84-hhrv-2935/GHSA-3r84-hhrv-2935.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3r84-hhrv-2935",
-  "modified": "2023-09-11T21:30:17Z",
+  "modified": "2023-09-13T18:31:26Z",
   "published": "2023-09-11T21:30:17Z",
   "aliases": [
     "CVE-2023-35676"
   ],
   "details": "In createQuickShareAction of SaveImageInBackgroundTask.java, there is a possible way to trigger a background activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
 

advisories/unreviewed/2023/09/GHSA-5hxg-4c73-j4wf/GHSA-5hxg-4c73-j4wf.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5hxg-4c73-j4wf",
+  "modified": "2023-09-13T18:31:26Z",
+  "published": "2023-09-13T18:31:26Z",
+  "aliases": [
+    "CVE-2023-20191"
+  ],
+  "details": "A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL.\n\n This vulnerability is due to incomplete support for this feature. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to bypass an ACL on the affected device.\n\n   There are workarounds that address this vulnerability.\n\n   \n\n \n This advisory is part of the September 2023 release of the Cisco IOS XR Software Security Advisory Bundled Publication. For a complete list of the advisories and links to them, see Cisco Event Response: September 2023 Semiannual Cisco IOS XR Software Security Advisory Bundled Publication .",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20191"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dnx-acl-PyzDkeYF"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}

advisories/unreviewed/2023/09/GHSA-6677-fgc8-98h4/GHSA-6677-fgc8-98h4.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6677-fgc8-98h4",
+  "modified": "2023-09-13T18:31:26Z",
+  "published": "2023-09-13T18:31:26Z",
+  "aliases": [
+    "CVE-2023-3280"
+  ],
+  "details": "A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to disable the agent.\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3280"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.paloaltonetworks.com/CVE-2023-3280"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-755"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}

advisories/unreviewed/2023/09/GHSA-69cm-qhp7-ch23/GHSA-69cm-qhp7-ch23.json

@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-69cm-qhp7-ch23",
+  "modified": "2023-09-13T18:31:26Z",
+  "published": "2023-09-13T18:31:26Z",
+  "aliases": [
+    "CVE-2023-2680"
+  ],
+  "details": "This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2680"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/security/cve/CVE-2023-2680"
+    },
+    {
+      "type": "WEB",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2203387"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}

advisories/unreviewed/2023/09/GHSA-6mqc-xv9m-7m85/GHSA-6mqc-xv9m-7m85.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6mqc-xv9m-7m85",
-  "modified": "2023-09-11T21:30:17Z",
+  "modified": "2023-09-13T18:31:26Z",
   "published": "2023-09-11T21:30:17Z",
   "aliases": [
     "CVE-2023-35677"
   ],
   "details": "In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission check. This could lead to local denial of service (factory reset or continuous locking) with no additional execution privileges needed. User interaction is not needed for exploitation.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
   ],
   "affected": [
 

advisories/unreviewed/2023/09/GHSA-6v48-qpg5-fj4m/GHSA-6v48-qpg5-fj4m.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6v48-qpg5-fj4m",
+  "modified": "2023-09-13T18:31:26Z",
+  "published": "2023-09-13T18:31:26Z",
+  "aliases": [
+    "CVE-2023-20135"
+  ],
+  "details": "A vulnerability in Cisco IOS XR Software image verification checks could allow an authenticated, local attacker to execute arbitrary code on the underlying operating system.\n\n This vulnerability is due to a time-of-check, time-of-use (TOCTOU) race condition when an install query regarding an ISO image is performed during an install operation that uses an ISO image. An attacker could exploit this vulnerability by modifying an ISO image and then carrying out install requests in parallel. A successful exploit could allow the attacker to execute arbitrary code on an affected device.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20135"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-lnt-L9zOkBz5"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}

advisories/unreviewed/2023/09/GHSA-7f5q-x8vx-pfrp/GHSA-7f5q-x8vx-pfrp.json

@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7f5q-x8vx-pfrp",
+  "modified": "2023-09-13T18:31:26Z",
+  "published": "2023-09-13T18:31:26Z",
+  "aliases": [
+    "CVE-2023-4155"
+  ],
+  "details": "A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the `VMGEXIT` handler recursively. If an attacker manages to call the handler multiple times, they can trigger a stack overflow and cause a denial of service or potentially guest-to-host escape in kernel configurations without stack guard pages (`CONFIG_VMAP_STACK`).",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4155"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/security/cve/CVE-2023-4155"
+    },
+    {
+      "type": "WEB",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2213802"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}

advisories/unreviewed/2023/09/GHSA-8h46-vgr3-9j7m/GHSA-8h46-vgr3-9j7m.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8h46-vgr3-9j7m",
+  "modified": "2023-09-13T18:31:26Z",
+  "published": "2023-09-13T18:31:26Z",
+  "aliases": [
+    "CVE-2023-4803"
+  ],
+  "details": "A reflected cross-site scripting vulnerability in the WriteWindowTitle endpoint of the Insider Threat Management (ITM) Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to 7.14.3.69 are affected.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4803"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-007"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}

advisories/unreviewed/2023/09/GHSA-922c-wmf5-rmhj/GHSA-922c-wmf5-rmhj.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-922c-wmf5-rmhj",
-  "modified": "2023-09-11T15:31:01Z",
+  "modified": "2023-09-13T18:31:26Z",
   "published": "2023-09-11T15:31:01Z",
   "aliases": [
     "CVE-2023-41000"
   ],
   "details": "GPAC through 2.2.1 has a use-after-free vulnerability in the function gf_bifs_flush_command_list in bifs/memory_decoder.c.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
+    }
   ],
   "affected": [
 
@@ -25,7 +28,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-416"
     ],
     "severity": null,
     "github_reviewed": false,

advisories/unreviewed/2023/09/GHSA-93fj-26p2-qqgh/GHSA-93fj-26p2-qqgh.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-93fj-26p2-qqgh",
-  "modified": "2023-09-12T15:30:20Z",
+  "modified": "2023-09-13T18:31:26Z",
   "published": "2023-09-12T15:30:20Z",
   "aliases": [
     "CVE-2023-39637"
   ],
   "details": "D-Link DIR-816 A2 1.10 B05 was discovered to contain a command injection vulnerability via the component /goform/Diagnosis.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
 
@@ -37,7 +40,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-77"
     ],
     "severity": null,
     "github_reviewed": false,

advisories/unreviewed/2023/09/GHSA-cp42-9j6q-v649/GHSA-cp42-9j6q-v649.json

@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cp42-9j6q-v649",
+  "modified": "2023-09-13T18:31:26Z",
+  "published": "2023-09-13T18:31:26Z",
+  "aliases": [
+    "CVE-2023-3301"
+  ],
+  "details": "A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3301"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/security/cve/CVE-2023-3301"
+    },
+    {
+      "type": "WEB",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215784"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}

advisories/unreviewed/2023/09/GHSA-f2fh-jcp2-h8mp/GHSA-f2fh-jcp2-h8mp.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-f2fh-jcp2-h8mp",
-  "modified": "2023-09-11T09:31:44Z",
+  "modified": "2023-09-13T18:31:26Z",
   "published": "2023-09-11T09:31:44Z",
   "aliases": [
     "CVE-2023-4104"
   ],
   "details": "An invalid Polkit Authentication check and missing authentication requirements for D-Bus methods allowed any local user to configure arbitrary VPN setups.\n*This bug only affects Mozilla VPN on Linux. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN client for Linux < v2.16.1.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
+    }
   ],
   "affected": [
 
@@ -45,7 +48,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-862"
     ],
     "severity": null,
     "github_reviewed": false,

advisories/unreviewed/2023/09/GHSA-fj9m-2hq3-2ghm/GHSA-fj9m-2hq3-2ghm.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-fj9m-2hq3-2ghm",
+  "modified": "2023-09-13T18:31:26Z",
+  "published": "2023-09-13T18:31:26Z",
+  "aliases": [
+    "CVE-2023-4801"
+  ],
+  "details": "An improper certification validation vulnerability in the Insider Threat Management (ITM) Agent for MacOS could be used by an anonymous actor on an adjacent network to establish a man-in-the-middle position between the agent and the ITM server after the agent has registered. All versions prior to 7.14.3.69 are affected. Agents for Windows, Linux, and Cloud are unaffected.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4801"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-006"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-295"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": null
+  }
+}

advisories/unreviewed/2023/09/GHSA-grh3-7c9c-hj98/GHSA-grh3-7c9c-hj98.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-grh3-7c9c-hj98",
-  "modified": "2023-09-11T21:30:17Z",
+  "modified": "2023-09-13T18:31:26Z",
   "published": "2023-09-11T21:30:17Z",
   "aliases": [
     "CVE-2023-35675"
   ],
   "details": "In loadMediaResumptionControls of MediaResumeListener.kt, there is a possible way to play and listen to media files played by another user on the same device due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
   ],
   "affected": [