netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-09-04 15:32:01 +00:00
parent 18ff27d49c
commit 09633fab13
34 changed files with 814 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2023/11/GHSA-68hx-hv9v-7v3w/GHSA-68hx-hv9v-7v3w.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-68hx-hv9v-7v3w",
"modified": "2023-11-08T18:30:31Z",
"modified": "2024-09-04T15:30:31Z",
"published": "2023-11-08T18:30:31Z",
"aliases": [
"CVE-2023-5759"
advisories/unreviewed/2023/11/GHSA-8qp7-8q8f-4335/GHSA-8qp7-8q8f-4335.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8qp7-8q8f-4335",
"modified": "2023-11-08T18:30:31Z",
"modified": "2024-09-04T15:30:31Z",
"published": "2023-11-08T18:30:31Z",
"aliases": [
"CVE-2023-45319"
advisories/unreviewed/2023/11/GHSA-m86c-6g87-95pq/GHSA-m86c-6g87-95pq.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m86c-6g87-95pq",
"modified": "2023-11-16T18:30:25Z",
"modified": "2024-09-04T15:30:32Z",
"published": "2023-11-08T18:30:31Z",
"aliases": [
"CVE-2023-5913"
advisories/unreviewed/2023/11/GHSA-x43q-54p7-vw63/GHSA-x43q-54p7-vw63.json
+2 -1
View File
@@ -28,7 +28,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-226"
"CWE-226",
"CWE-269"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/08/GHSA-4hvh-m426-wv8w/GHSA-4hvh-m426-wv8w.json
+1 -1
View File
@@ -32,7 +32,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"severity": "CRITICAL",
"github_reviewed": false,
advisories/unreviewed/2024/08/GHSA-9chr-m38j-w26g/GHSA-9chr-m38j-w26g.json
+3 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9chr-m38j-w26g",
"modified": "2024-08-30T00:31:23Z",
"modified": "2024-09-04T15:30:33Z",
"published": "2024-08-30T00:31:23Z",
"aliases": [
"CVE-2024-1545"
@@ -28,7 +28,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-1256"
"CWE-1256",
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2024/08/GHSA-jq7g-hrpq-8mxh/GHSA-jq7g-hrpq-8mxh.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jq7g-hrpq-8mxh",
"modified": "2024-08-30T06:30:38Z",
"modified": "2024-09-04T15:30:33Z",
"published": "2024-08-30T06:30:38Z",
"aliases": [
"CVE-2024-4401"
advisories/unreviewed/2024/08/GHSA-p7fr-35j6-p64g/GHSA-p7fr-35j6-p64g.json
+3 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p7fr-35j6-p64g",
"modified": "2024-08-30T00:31:23Z",
"modified": "2024-09-04T15:30:33Z",
"published": "2024-08-30T00:31:23Z",
"aliases": [
"CVE-2024-2881"
@@ -28,7 +28,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-1256"
"CWE-1256",
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2024/08/GHSA-w782-gjg9-cjx6/GHSA-w782-gjg9-cjx6.json
+1
View File
@@ -28,6 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-208"
],
"severity": "MODERATE",
advisories/unreviewed/2024/08/GHSA-x5hw-48mf-cq3m/GHSA-x5hw-48mf-cq3m.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x5hw-48mf-cq3m",
"modified": "2024-08-30T00:31:23Z",
"modified": "2024-09-04T15:30:33Z",
"published": "2024-08-30T00:31:23Z",
"aliases": [
"CVE-2024-6670"
advisories/unreviewed/2024/09/GHSA-27hp-p4cr-qf56/GHSA-27hp-p4cr-qf56.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-27hp-p4cr-qf56",
"modified": "2024-09-04T15:30:35Z",
"published": "2024-09-04T15:30:35Z",
"aliases": [
"CVE-2024-8407"
],
"details": "A vulnerability was found in alwindoss akademy up to 35caccea888ed63d5489e211c99edff1f62efdba. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file cmd/akademy/handler/handlers.go. The manipulation of the argument emailAddress leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8407"
},
{
"type": "WEB",
"url": "https://github.com/alwindoss/akademy/issues/1"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.276487"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.276487"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.397340"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-04T14:15:15Z"
}
}
advisories/unreviewed/2024/09/GHSA-4c4w-77f9-v9mq/GHSA-4c4w-77f9-v9mq.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4c4w-77f9-v9mq",
"modified": "2024-09-04T00:31:16Z",
"modified": "2024-09-04T15:30:33Z",
"published": "2024-09-04T00:31:16Z",
"aliases": [
"CVE-2024-7970"
],
"details": "Out of bounds write in V8 in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -31,7 +34,7 @@
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-03T23:15:23Z"
advisories/unreviewed/2024/09/GHSA-4j5r-p7p6-v9j4/GHSA-4j5r-p7p6-v9j4.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4j5r-p7p6-v9j4",
"modified": "2024-09-04T15:30:34Z",
"published": "2024-09-04T15:30:34Z",
"aliases": [
"CVE-2024-7834"
],
"details": "A local privilege escalation is caused by Overwolf\nloading and executing certain dynamic link library files from a user-writeable\nfolder in SYSTEM context on launch. This allows an attacker with unprivileged\naccess to the system to run arbitrary code with SYSTEM privileges by placing a\nmalicious .dll file in the respective location.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7834"
},
{
"type": "WEB",
"url": "https://www.cirosec.de/sa/sa-2024-004"
}
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-04T13:15:07Z"
}
}
advisories/unreviewed/2024/09/GHSA-794f-5gfq-xmmq/GHSA-794f-5gfq-xmmq.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-794f-5gfq-xmmq",
"modified": "2024-09-03T15:30:46Z",
"modified": "2024-09-04T15:30:33Z",
"published": "2024-09-03T15:30:46Z",
"aliases": [
"CVE-2024-8383"
],
"details": "Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems don't have a trusted newsreader installed by default, an unscrupulous program that the user downloaded could register itself as a handler. The website that served the application download could then launch that application at will This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Firefox ESR < 115.15.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
@@ -39,7 +42,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-03T13:15:05Z"
advisories/unreviewed/2024/09/GHSA-99ph-h865-m6x2/GHSA-99ph-h865-m6x2.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-99ph-h865-m6x2",
"modified": "2024-09-04T15:30:36Z",
"published": "2024-09-04T15:30:36Z",
"aliases": [
"CVE-2024-7077"
],
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos allows Reflected XSS.This issue affects Semtek Sempos: through 31072024.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7077"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-24-1396"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-04T15:15:14Z"
}
}
advisories/unreviewed/2024/09/GHSA-c52g-pq8x-mvmm/GHSA-c52g-pq8x-mvmm.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c52g-pq8x-mvmm",
"modified": "2024-09-04T15:30:36Z",
"published": "2024-09-04T15:30:36Z",
"aliases": [
"CVE-2024-8409"
],
"details": "A vulnerability classified as problematic has been found in ABCD ABCD2 up to 2.2.0-beta-1. This affects an unknown part of the file /common/show_image.php. The manipulation of the argument image leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8409"
},
{
"type": "WEB",
"url": "https://github.com/peritocibernetico/ABCD_Vulnerabilities"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.276489"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.276489"
}
],
"database_specific": {
"cwe_ids": [
"CWE-24"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-04T15:15:14Z"
}
}
advisories/unreviewed/2024/09/GHSA-cv3c-47qp-r5cq/GHSA-cv3c-47qp-r5cq.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cv3c-47qp-r5cq",
"modified": "2024-09-04T15:30:34Z",
"published": "2024-09-04T15:30:34Z",
"aliases": [
"CVE-2024-44383"
],
"details": "WAYOS FBM-291W v19.09.11 is vulnerable to Command Execution via msp_info_htm.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44383"
},
{
"type": "WEB",
"url": "https://github.com/GroundCTL2MajorTom/pocs/blob/main/wayos_%20FBM_291W.md"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-04T13:15:06Z"
}
}
advisories/unreviewed/2024/09/GHSA-g5jh-57wm-p79m/GHSA-g5jh-57wm-p79m.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g5jh-57wm-p79m",
"modified": "2024-09-04T15:30:36Z",
"published": "2024-09-04T15:30:36Z",
"aliases": [
"CVE-2024-8418"
],
"details": "A flaw was found in Aardvark-dns versions 1.12.0 and 1.12.1. They contain a denial of service vulnerability due to serial processing of TCP DNS queries. This flaw allows a malicious client to keep a TCP connection open indefinitely, causing other DNS queries to time out and resulting in a denial of service for all other containers using aardvark-dns.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8418"
},
{
"type": "WEB",
"url": "https://github.com/containers/aardvark-dns/issues/500"
},
{
"type": "WEB",
"url": "https://github.com/containers/aardvark-dns/pull/503"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-8418"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309683"
}
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-04T15:15:15Z"
}
}
advisories/unreviewed/2024/09/GHSA-gmvf-rv8w-2hrh/GHSA-gmvf-rv8w-2hrh.json
+55
View File
@@ -0,0 +1,55 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gmvf-rv8w-2hrh",
"modified": "2024-09-04T15:30:35Z",
"published": "2024-09-04T15:30:35Z",
"aliases": [
"CVE-2024-45506"
],
"details": "HAProxy 2.9.x before 2.9.10, 3.0.x before 3.0.4, and 3.1.x through 3.1-dev6 allows a remote denial of service.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45506"
},
{
"type": "WEB",
"url": "https://www.haproxy.org"
},
{
"type": "WEB",
"url": "https://www.haproxy.org/download/3.1/src/CHANGELOG"
},
{
"type": "WEB",
"url": "https://www.mail-archive.com/haproxy%40formilux.org/msg45280.html"
},
{
"type": "WEB",
"url": "https://www.mail-archive.com/haproxy%40formilux.org/msg45281.html"
},
{
"type": "WEB",
"url": "http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=c725db17e8416ffb3c1537aea756356228ce5e3c"
},
{
"type": "WEB",
"url": "http://git.haproxy.org/?p=haproxy-3.0.git%3Ba=commitdiff%3Bh=d636e515453320c6e122c313c661a8ac7d387c7f"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-04T15:15:14Z"
}
}
advisories/unreviewed/2024/09/GHSA-gp3v-m4q9-3v8h/GHSA-gp3v-m4q9-3v8h.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gp3v-m4q9-3v8h",
"modified": "2024-09-04T15:30:35Z",
"published": "2024-09-04T15:30:35Z",
"aliases": [
"CVE-2024-7012"
],
"details": "An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) and could potentially enable unauthorized users to gain administrative access.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7012"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-7012"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2299429"
}
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-04T14:15:14Z"
}
}

Some files were not shown because too many files have changed in this diff Show More