From 00cd35a97de18e9628a28f0945e47b6d61cc3e1c Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 20 Jun 2024 00:31:55 +0000 Subject: [PATCH] Publish Advisories GHSA-2gf4-m97g-cvpw GHSA-cpcx-r2gq-x893 GHSA-g779-vpj7-v6c4 GHSA-ph5m-227m-fc5g GHSA-rg42-f9ww-x3w7 --- .../GHSA-2gf4-m97g-cvpw.json | 39 +++++++++++++++++ .../GHSA-cpcx-r2gq-x893.json | 42 +++++++++++++++++++ .../GHSA-g779-vpj7-v6c4.json | 39 +++++++++++++++++ .../GHSA-ph5m-227m-fc5g.json | 39 +++++++++++++++++ .../GHSA-rg42-f9ww-x3w7.json | 39 +++++++++++++++++ 5 files changed, 198 insertions(+) create mode 100644 advisories/unreviewed/2024/06/GHSA-2gf4-m97g-cvpw/GHSA-2gf4-m97g-cvpw.json create mode 100644 advisories/unreviewed/2024/06/GHSA-cpcx-r2gq-x893/GHSA-cpcx-r2gq-x893.json create mode 100644 advisories/unreviewed/2024/06/GHSA-g779-vpj7-v6c4/GHSA-g779-vpj7-v6c4.json create mode 100644 advisories/unreviewed/2024/06/GHSA-ph5m-227m-fc5g/GHSA-ph5m-227m-fc5g.json create mode 100644 advisories/unreviewed/2024/06/GHSA-rg42-f9ww-x3w7/GHSA-rg42-f9ww-x3w7.json diff --git a/advisories/unreviewed/2024/06/GHSA-2gf4-m97g-cvpw/GHSA-2gf4-m97g-cvpw.json b/advisories/unreviewed/2024/06/GHSA-2gf4-m97g-cvpw/GHSA-2gf4-m97g-cvpw.json new file mode 100644 index 00000000000..d595c1ee259 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-2gf4-m97g-cvpw/GHSA-2gf4-m97g-cvpw.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2gf4-m97g-cvpw", + "modified": "2024-06-20T00:30:46Z", + "published": "2024-06-20T00:30:46Z", + "aliases": [ + "CVE-2024-6102" + ], + "details": "Out of bounds memory access in Dawn in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6102" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/339169163" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T00:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-cpcx-r2gq-x893/GHSA-cpcx-r2gq-x893.json b/advisories/unreviewed/2024/06/GHSA-cpcx-r2gq-x893/GHSA-cpcx-r2gq-x893.json new file mode 100644 index 00000000000..b5dd029a60e --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-cpcx-r2gq-x893/GHSA-cpcx-r2gq-x893.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cpcx-r2gq-x893", + "modified": "2024-06-20T00:30:46Z", + "published": "2024-06-20T00:30:46Z", + "aliases": [ + "CVE-2024-5182" + ], + "details": "A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated `model` parameter, an attacker can traverse the directory structure and target files outside of the intended directory, leading to the deletion of sensitive data. This vulnerability is due to insufficient input validation and sanitization of the `model` parameter.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5182" + }, + { + "type": "WEB", + "url": "https://github.com/mudler/localai/commit/1a3dedece06cab1acc3332055d285ac540a47f0e" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/f7a87f29-c22a-48e8-9fce-b6d5a273e545" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T00:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-g779-vpj7-v6c4/GHSA-g779-vpj7-v6c4.json b/advisories/unreviewed/2024/06/GHSA-g779-vpj7-v6c4/GHSA-g779-vpj7-v6c4.json new file mode 100644 index 00000000000..2a281ef6e08 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-g779-vpj7-v6c4/GHSA-g779-vpj7-v6c4.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g779-vpj7-v6c4", + "modified": "2024-06-20T00:30:46Z", + "published": "2024-06-20T00:30:46Z", + "aliases": [ + "CVE-2024-6100" + ], + "details": "Type Confusion in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6100" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/344608204" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-843" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T00:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-ph5m-227m-fc5g/GHSA-ph5m-227m-fc5g.json b/advisories/unreviewed/2024/06/GHSA-ph5m-227m-fc5g/GHSA-ph5m-227m-fc5g.json new file mode 100644 index 00000000000..c9d93640462 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-ph5m-227m-fc5g/GHSA-ph5m-227m-fc5g.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ph5m-227m-fc5g", + "modified": "2024-06-20T00:30:47Z", + "published": "2024-06-20T00:30:47Z", + "aliases": [ + "CVE-2024-6103" + ], + "details": "Use after free in Dawn in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6103" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/344639860" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T00:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-rg42-f9ww-x3w7/GHSA-rg42-f9ww-x3w7.json b/advisories/unreviewed/2024/06/GHSA-rg42-f9ww-x3w7/GHSA-rg42-f9ww-x3w7.json new file mode 100644 index 00000000000..80c787bf663 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-rg42-f9ww-x3w7/GHSA-rg42-f9ww-x3w7.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rg42-f9ww-x3w7", + "modified": "2024-06-20T00:30:46Z", + "published": "2024-06-20T00:30:46Z", + "aliases": [ + "CVE-2024-6101" + ], + "details": "Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6101" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_18.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/343748812" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T00:15:09Z" + } +} \ No newline at end of file