diff --git a/advisories/unreviewed/2024/06/GHSA-2gf4-m97g-cvpw/GHSA-2gf4-m97g-cvpw.json b/advisories/unreviewed/2024/06/GHSA-2gf4-m97g-cvpw/GHSA-2gf4-m97g-cvpw.json new file mode 100644 index 00000000000..d595c1ee259 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-2gf4-m97g-cvpw/GHSA-2gf4-m97g-cvpw.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2gf4-m97g-cvpw", + "modified": "2024-06-20T00:30:46Z", + "published": "2024-06-20T00:30:46Z", + "aliases": [ + "CVE-2024-6102" + ], + "details": "Out of bounds memory access in Dawn in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6102" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/339169163" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T00:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-cpcx-r2gq-x893/GHSA-cpcx-r2gq-x893.json b/advisories/unreviewed/2024/06/GHSA-cpcx-r2gq-x893/GHSA-cpcx-r2gq-x893.json new file mode 100644 index 00000000000..b5dd029a60e --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-cpcx-r2gq-x893/GHSA-cpcx-r2gq-x893.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cpcx-r2gq-x893", + "modified": "2024-06-20T00:30:46Z", + "published": "2024-06-20T00:30:46Z", + "aliases": [ + "CVE-2024-5182" + ], + "details": "A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated `model` parameter, an attacker can traverse the directory structure and target files outside of the intended directory, leading to the deletion of sensitive data. This vulnerability is due to insufficient input validation and sanitization of the `model` parameter.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5182" + }, + { + "type": "WEB", + "url": "https://github.com/mudler/localai/commit/1a3dedece06cab1acc3332055d285ac540a47f0e" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/f7a87f29-c22a-48e8-9fce-b6d5a273e545" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T00:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-g779-vpj7-v6c4/GHSA-g779-vpj7-v6c4.json b/advisories/unreviewed/2024/06/GHSA-g779-vpj7-v6c4/GHSA-g779-vpj7-v6c4.json new file mode 100644 index 00000000000..2a281ef6e08 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-g779-vpj7-v6c4/GHSA-g779-vpj7-v6c4.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g779-vpj7-v6c4", + "modified": "2024-06-20T00:30:46Z", + "published": "2024-06-20T00:30:46Z", + "aliases": [ + "CVE-2024-6100" + ], + "details": "Type Confusion in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6100" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/344608204" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-843" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T00:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-ph5m-227m-fc5g/GHSA-ph5m-227m-fc5g.json b/advisories/unreviewed/2024/06/GHSA-ph5m-227m-fc5g/GHSA-ph5m-227m-fc5g.json new file mode 100644 index 00000000000..c9d93640462 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-ph5m-227m-fc5g/GHSA-ph5m-227m-fc5g.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ph5m-227m-fc5g", + "modified": "2024-06-20T00:30:47Z", + "published": "2024-06-20T00:30:47Z", + "aliases": [ + "CVE-2024-6103" + ], + "details": "Use after free in Dawn in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6103" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/344639860" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T00:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-rg42-f9ww-x3w7/GHSA-rg42-f9ww-x3w7.json b/advisories/unreviewed/2024/06/GHSA-rg42-f9ww-x3w7/GHSA-rg42-f9ww-x3w7.json new file mode 100644 index 00000000000..80c787bf663 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-rg42-f9ww-x3w7/GHSA-rg42-f9ww-x3w7.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rg42-f9ww-x3w7", + "modified": "2024-06-20T00:30:46Z", + "published": "2024-06-20T00:30:46Z", + "aliases": [ + "CVE-2024-6101" + ], + "details": "Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6101" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/343748812" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T00:15:09Z" + } +} \ No newline at end of file