Advisory Database Sync

advisories/github-reviewed/2024/10/GHSA-cm5g-3pgc-8rg4/GHSA-cm5g-3pgc-8rg4.json

@@ -1,11 +1,12 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-cm5g-3pgc-8rg4",
-  "modified": "2024-11-07T00:30:36Z",
+  "modified": "2024-11-25T21:31:20Z",
   "published": "2024-10-29T18:30:37Z",
   "aliases": [
     "CVE-2024-10491"
   ],
+  "summary": "Express ressource injection",
   "details": "A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.\n\nThe issue arises from improper sanitization in `Link` header values, which can allow a combination of characters like `,`, `;`, and `<>` to preload malicious resources.\n\nThis vulnerability is especially relevant for dynamic parameters.",
   "severity": [
     {
@@ -14,7 +15,25 @@
     }
   ],
   "affected": [
-
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "express"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "3.21.4"
+            }
+          ]
+        }
+      ]
+    }
   ],
   "references": [
     {
@@ -31,8 +50,8 @@
       "CWE-74"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-11-25T21:31:20Z",
     "nvd_published_at": "2024-10-29T17:15:03Z"
   }
 }

advisories/unreviewed/2023/07/GHSA-ww86-3cc2-9g27/GHSA-ww86-3cc2-9g27.json

@@ -28,7 +28,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-434"
     ],
     "severity": "CRITICAL",
     "github_reviewed": false,

advisories/unreviewed/2024/02/GHSA-8m6h-q36w-xvg7/GHSA-8m6h-q36w-xvg7.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8m6h-q36w-xvg7",
-  "modified": "2024-02-15T09:30:35Z",
+  "modified": "2024-11-25T21:30:48Z",
   "published": "2024-02-15T09:30:35Z",
   "aliases": [
     "CVE-2024-0353"
@@ -21,6 +21,14 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0353"
     },
+    {
+      "type": "WEB",
+      "url": "https://packetstormsecurity.com/files/179495/ESET-NOD32-Antivirus-17.2.7.0-Unquoted-Service-Path.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://packetstormsecurity.com/files/182464/ESET-NOD32-Antivirus-18.0.12.0-Unquoted-Service-Path.html"
+    },
     {
       "type": "WEB",
       "url": "https://support.eset.com/en/ca8612-eset-customer-advisory-link-following-local-privilege-escalation-vulnerability-in-eset-products-for-windows-fixed"

advisories/unreviewed/2024/02/GHSA-xx6x-c9h6-h6fv/GHSA-xx6x-c9h6-h6fv.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-xx6x-c9h6-h6fv",
-  "modified": "2024-02-26T18:30:31Z",
+  "modified": "2024-11-25T21:30:48Z",
   "published": "2024-02-26T18:30:31Z",
   "aliases": [
     "CVE-2024-26465"
   ],
   "details": "A DOM based cross-site scripting (XSS) vulnerability in the component /beep/Beep.Instrument.js of stewdio beep.js before commit ef22ad7 allows attackers to execute arbitrary Javascript via sending a crafted URL.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-79"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-02-26T16:27:59Z"

advisories/unreviewed/2024/03/GHSA-3r58-xjch-5xjp/GHSA-3r58-xjch-5xjp.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3r58-xjch-5xjp",
-  "modified": "2024-03-18T06:30:51Z",
+  "modified": "2024-11-25T21:30:48Z",
   "published": "2024-03-18T06:30:51Z",
   "aliases": [
     "CVE-2021-47157"
   ],
   "details": "The Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
 
@@ -29,9 +32,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-346"
     ],
-    "severity": null,
+    "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-03-18T05:15:06Z"

advisories/unreviewed/2024/04/GHSA-fc5p-cp62-fgpc/GHSA-fc5p-cp62-fgpc.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-fc5p-cp62-fgpc",
-  "modified": "2024-04-26T03:30:29Z",
+  "modified": "2024-11-25T21:30:48Z",
   "published": "2024-04-26T03:30:29Z",
   "aliases": [
     "CVE-2024-33667"
   ],
   "details": "An issue was discovered in Zammad before 6.3.0. An authenticated agent could perform a remote Denial of Service attack by calling an endpoint that accepts a generic method name, which was not properly sanitized against an allowlist.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-862"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-04-26T01:15:46Z"

advisories/unreviewed/2024/04/GHSA-p5g2-89mm-prg6/GHSA-p5g2-89mm-prg6.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-p5g2-89mm-prg6",
-  "modified": "2024-04-11T03:35:00Z",
+  "modified": "2024-11-25T21:30:48Z",
   "published": "2024-04-11T03:35:00Z",
   "aliases": [
     "CVE-2024-26019"
   ],
   "details": "Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
   ],
   "affected": [
 
@@ -33,9 +36,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-79"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-04-11T03:15:09Z"

advisories/unreviewed/2024/04/GHSA-wq89-j555-p43g/GHSA-wq89-j555-p43g.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-wq89-j555-p43g",
-  "modified": "2024-04-15T06:30:34Z",
+  "modified": "2024-11-25T21:30:48Z",
   "published": "2024-04-15T06:30:34Z",
   "aliases": [
     "CVE-2024-1712"
   ],
   "details": "The Carousel Slider WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-79"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-04-15T05:15:14Z"

advisories/unreviewed/2024/05/GHSA-m29j-f39x-2r24/GHSA-m29j-f39x-2r24.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-m29j-f39x-2r24",
-  "modified": "2024-05-14T18:30:46Z",
+  "modified": "2024-11-25T21:30:48Z",
   "published": "2024-05-14T18:30:46Z",
   "aliases": [
     "CVE-2024-32606"
   ],
   "details": "HDF5 Library through 1.14.3 may attempt to dereference uninitialized values in h5tools_str_sprint in tools/lib/h5tools_str.c (called from h5tools_dump_simple_data in tools/lib/h5tools_dump.c).",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-908"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-05-14T15:36:45Z"

advisories/unreviewed/2024/06/GHSA-4xhv-qc2f-6267/GHSA-4xhv-qc2f-6267.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4xhv-qc2f-6267",
-  "modified": "2024-06-29T21:30:47Z",
+  "modified": "2024-11-25T21:30:48Z",
   "published": "2024-06-29T21:30:47Z",
   "aliases": [
     "CVE-2024-39846"
   ],
   "details": "NewPass before 1.2.0 stores passwords (rather than password hashes) directly, which makes it easier to obtain unauthorized access to sensitive information. NOTE: in each case, data at rest is encrypted, but is decrypted within process memory during use.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
   ],
   "affected": [
 
@@ -29,9 +32,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-312"
     ],
-    "severity": null,
+    "severity": "LOW",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-06-29T21:15:09Z"

advisories/unreviewed/2024/07/GHSA-28xh-chph-8x29/GHSA-28xh-chph-8x29.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-28xh-chph-8x29",
-  "modified": "2024-07-10T09:30:41Z",
+  "modified": "2024-11-25T21:30:48Z",
   "published": "2024-07-10T09:30:41Z",
   "aliases": [
     "CVE-2024-39490"
   ],
   "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: fix missing sk_buff release in seg6_input_core\n\nThe seg6_input() function is responsible for adding the SRH into a\npacket, delegating the operation to the seg6_input_core(). This function\nuses the skb_cow_head() to ensure that there is sufficient headroom in\nthe sk_buff for accommodating the link-layer header.\nIn the event that the skb_cow_header() function fails, the\nseg6_input_core() catches the error but it does not release the sk_buff,\nwhich will result in a memory leak.\n\nThis issue was introduced in commit af3b5158b89d (\"ipv6: sr: fix BUG due\nto headroom too small after SRH push\") and persists even after commit\n7a3f5b0de364 (\"netfilter: add netfilter hooks to SRv6 data plane\"),\nwhere the entire seg6_input() code was refactored to deal with netfilter\nhooks.\n\nThe proposed patch addresses the identified memory leak by requiring the\nseg6_input_core() function to release the sk_buff in the event that\nskb_cow_head() fails.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
   ],
   "affected": [
 
@@ -41,9 +44,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-401"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-07-10T08:15:11Z"

advisories/unreviewed/2024/09/GHSA-354q-9jjr-5vm7/GHSA-354q-9jjr-5vm7.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-354q-9jjr-5vm7",
-  "modified": "2024-09-30T21:02:13Z",
+  "modified": "2024-11-25T21:30:48Z",
   "published": "2024-09-30T21:02:13Z",
   "aliases": [
     "CVE-2024-28811"
   ],
   "details": "An issue was discovered in Infinera hiT 7300 5.60.50. A web application allows a remote privileged attacker to execute applications contained in a specific OS directory via HTTP invocations.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-94"
     ],
-    "severity": null,
+    "severity": "LOW",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-09-30T19:15:04Z"

advisories/unreviewed/2024/09/GHSA-cwq5-xwx7-85wm/GHSA-cwq5-xwx7-85wm.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-cwq5-xwx7-85wm",
-  "modified": "2024-09-10T12:30:35Z",
+  "modified": "2024-11-25T21:30:48Z",
   "published": "2024-09-06T06:31:41Z",
   "aliases": [
     "CVE-2024-45751"
   ],
   "details": "tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
+    }
   ],
   "affected": [
 
@@ -29,13 +32,17 @@
     {
       "type": "WEB",
       "url": "https://www.openwall.com/lists/oss-security/2024/09/07/2"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2024/09/07/2"
     }
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-338"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-09-06T05:15:13Z"

advisories/unreviewed/2024/10/GHSA-33v4-22cq-m9g2/GHSA-33v4-22cq-m9g2.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-33v4-22cq-m9g2",
-  "modified": "2024-10-26T12:30:43Z",
+  "modified": "2024-11-25T21:30:48Z",
   "published": "2024-10-26T12:30:43Z",
   "aliases": [
     "CVE-2024-9772"

advisories/unreviewed/2024/10/GHSA-w6g8-4xp6-6cr3/GHSA-w6g8-4xp6-6cr3.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-w6g8-4xp6-6cr3",
-  "modified": "2024-10-12T06:31:30Z",
+  "modified": "2024-11-25T21:30:48Z",
   "published": "2024-10-12T06:31:30Z",
   "aliases": [
     "CVE-2024-9776"

advisories/unreviewed/2024/11/GHSA-2c4h-jg67-pgcw/GHSA-2c4h-jg67-pgcw.json

@@ -28,7 +28,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-119"
+      "CWE-119",
+      "CWE-787"
     ],
     "severity": "HIGH",
     "github_reviewed": false,

advisories/unreviewed/2024/11/GHSA-363w-4gjr-hxxf/GHSA-363w-4gjr-hxxf.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-363w-4gjr-hxxf",
-  "modified": "2024-11-19T18:31:07Z",
+  "modified": "2024-11-25T21:30:49Z",
   "published": "2024-11-19T18:31:07Z",
   "aliases": [
     "CVE-2024-53070"
   ],
   "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: dwc3: fix fault at system suspend if device was already runtime suspended\n\nIf the device was already runtime suspended then during system suspend\nwe cannot access the device registers else it will crash.\n\nAlso we cannot access any registers after dwc3_core_exit() on some\nplatforms so move the dwc3_enable_susphy() call to the top.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
   ],
   "affected": [
 
@@ -43,7 +46,7 @@
     "cwe_ids": [
 
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-11-19T18:15:26Z"

advisories/unreviewed/2024/11/GHSA-37xg-wj5r-mvrr/GHSA-37xg-wj5r-mvrr.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-37xg-wj5r-mvrr",
-  "modified": "2024-11-15T18:30:51Z",
+  "modified": "2024-11-25T21:30:48Z",
   "published": "2024-11-15T18:30:51Z",
   "aliases": [
     "CVE-2024-46462"
   ],
   "details": "By default, dedicated folders of ZEDMAIL for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of ZEDMAIL has to be modified to prevent this vulnerability.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-276"
     ],
-    "severity": null,
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-11-15T18:15:28Z"

advisories/unreviewed/2024/11/GHSA-3h3v-7x89-cc9g/GHSA-3h3v-7x89-cc9g.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3h3v-7x89-cc9g",
-  "modified": "2024-11-14T00:31:11Z",
+  "modified": "2024-11-25T21:30:48Z",
   "published": "2024-11-14T00:31:11Z",
   "aliases": [
     "CVE-2024-40405"
   ],
   "details": "Incorrect access control in Cybele Software Thinfinity Workspace before v7.0.3.109 allows attackers to gain access to a secondary broker via a crafted request.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-306"
     ],
-    "severity": null,
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-11-13T23:15:03Z"

advisories/unreviewed/2024/11/GHSA-3pc7-c3mc-73r6/GHSA-3pc7-c3mc-73r6.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3pc7-c3mc-73r6",
-  "modified": "2024-11-15T18:30:52Z",
+  "modified": "2024-11-25T21:30:48Z",
   "published": "2024-11-15T18:30:52Z",
   "aliases": [
     "CVE-2024-46465"
   ],
   "details": "By default, dedicated folders of CRYHOD for Windows up to 2024.3 can be accessed by other users to misuse technical files and make them perform tasks with higher privileges. Configuration of CRYHOD has to be modified to prevent this vulnerability.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-276"
     ],
-    "severity": null,
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-11-15T18:15:28Z"