Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-13 18:33:25 +00:00
parent 2cdb17a748
commit 0960212d88
52 changed files with 394 additions and 114 deletions
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-287"
+      "CWE-287",
+      "CWE-306"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7537-7q22-h2h7",
-  "modified": "2024-03-13T21:31:02Z",
+  "modified": "2024-12-13T18:31:54Z",
  "published": "2024-03-08T03:31:25Z",
  "aliases": [
    "CVE-2024-23259"
  ],
  "details": "The issue was addressed with improved checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. Processing web content may lead to a denial-of-service.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -33,7 +38,7 @@
  ],
  "database_specific": {
    "cwe_ids": [],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-08T02:15:48Z"
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-qqc8-rv37-79q5",
-  "modified": "2024-03-15T09:30:37Z",
+  "modified": "2024-12-13T18:31:55Z",
  "published": "2024-03-15T09:30:37Z",
  "aliases": [
    "CVE-2024-28053"
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-400"
+      "CWE-400",
+      "CWE-770"
    ],
    "severity": "LOW",
    "github_reviewed": false,
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-400"
+      "CWE-400",
+      "CWE-770"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-639"
+      "CWE-639",
+      "CWE-863"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-347"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -33,7 +33,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-918"
+    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -30,7 +30,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-284"
+      "CWE-284",
+      "CWE-863"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c87h-375h-xrrv",
-  "modified": "2024-08-14T03:31:07Z",
+  "modified": "2024-12-13T18:31:55Z",
  "published": "2024-08-13T18:31:15Z",
  "aliases": [
    "CVE-2023-31341"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-224h-vf26-wvfw",
-  "modified": "2024-12-12T15:31:08Z",
+  "modified": "2024-12-13T18:31:56Z",
  "published": "2024-12-12T15:31:08Z",
  "aliases": [
    "CVE-2024-28143"
  ],
  "details": "The password change function at /cgi/admin.cgi does not require the current/old password, which makes the application vulnerable to account takeover. An attacker can use this to forcefully set a new password within the -rsetpass+-aaction+- parameter for a user without knowing the old password, e.g. by exploiting a CSRF issue.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -27,7 +32,7 @@
    "cwe_ids": [
      "CWE-620"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-12T14:15:22Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2j3v-9566-775v",
-  "modified": "2024-12-12T21:30:47Z",
+  "modified": "2024-12-13T18:31:56Z",
  "published": "2024-12-12T21:30:47Z",
  "aliases": [
    "CVE-2024-54811"
  ],
  "details": "A SQL injection vulnerability in /index.php in PHPGurukul Park Ticketing Management System v1.0 allows an attacker to execute arbitrary SQL commands via the \"login\" parameter.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -20,8 +25,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-12T19:15:13Z"
@@ -0,0 +1,31 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3gr3-rr4m-976p",
+  "modified": "2024-12-13T18:31:56Z",
+  "published": "2024-12-13T18:31:56Z",
+  "aliases": [
+    "CVE-2024-46971"
+  ],
+  "details": "Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46971"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-362"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-13T18:15:20Z"
+  }
+}
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3m98-m7jj-v78v",
-  "modified": "2024-12-12T03:33:06Z",
+  "modified": "2024-12-13T18:31:55Z",
  "published": "2024-12-12T03:33:06Z",
  "aliases": [
    "CVE-2024-54489"
  ],
  "details": "A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. Running a mount command may unexpectedly execute arbitrary code.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -29,7 +34,7 @@
  ],
  "database_specific": {
    "cwe_ids": [],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-12T02:15:30Z"
@@ -42,7 +42,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-89"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-58f5-8jq5-r8p2",
-  "modified": "2024-12-12T03:33:06Z",
+  "modified": "2024-12-13T18:31:55Z",
  "published": "2024-12-12T03:33:06Z",
  "aliases": [
    "CVE-2024-54510"
  ],
  "details": "A race condition was addressed with improved locking. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to leak sensitive kernel state.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -44,8 +49,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-362"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-12T02:15:31Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5hph-wf32-7rmr",
-  "modified": "2024-12-12T21:30:46Z",
+  "modified": "2024-12-13T18:31:55Z",
  "published": "2024-12-11T00:31:27Z",
  "aliases": [
    "CVE-2024-52865"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5mvv-6ghv-vm4v",
-  "modified": "2024-12-12T18:30:55Z",
+  "modified": "2024-12-13T18:31:56Z",
  "published": "2024-12-12T18:30:55Z",
  "aliases": [
    "CVE-2024-54810"
  ],
  "details": "A SQL Injection vulnerability was found in /preschool/admin/password-recovery.php in PHPGurukul Pre-School Enrollment System Project v1.0, which allows remote attackers to execute arbitrary code via the mobileno parameter.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -20,8 +25,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-12T18:15:25Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5xh8-mfhp-x7wc",
-  "modified": "2024-12-11T18:30:42Z",
+  "modified": "2024-12-13T18:31:55Z",
  "published": "2024-12-10T18:31:07Z",
  "aliases": [
    "CVE-2024-45493"
@@ -23,6 +23,10 @@
      "type": "WEB",
      "url": "https://us.msasafety.com/fieldserver"
    },
+    {
+      "type": "WEB",
+      "url": "https://us.msasafety.com/security-notices"
+    },
    {
      "type": "WEB",
      "url": "https://us.msasafety.com/security-notices:"
--- a/Show More
+++ b/Show More