diff --git a/advisories/unreviewed/2024/02/GHSA-76cv-2f7v-55xx/GHSA-76cv-2f7v-55xx.json b/advisories/unreviewed/2024/02/GHSA-76cv-2f7v-55xx/GHSA-76cv-2f7v-55xx.json new file mode 100644 index 00000000000..b0a834b42bb --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-76cv-2f7v-55xx/GHSA-76cv-2f7v-55xx.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-76cv-2f7v-55xx", + "modified": "2024-02-04T21:30:44Z", + "published": "2024-02-04T21:30:44Z", + "aliases": [ + "CVE-2021-46903" + ], + "details": "An issue was discovered in LTOS-Web-Interface in Meinberg LANTIME-Firmware before 6.24.029 MBGID-9343 and 7 before 7.04.008 MBGID-6303. An admin can delete required user accounts (in violation of expected access control).", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46903" + }, + { + "type": "WEB", + "url": "https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2021-03-meinberg-lantime-firmware-v7-04-008-und-v6-24-029.htm" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-04T21:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-9jx4-4hmg-8h59/GHSA-9jx4-4hmg-8h59.json b/advisories/unreviewed/2024/02/GHSA-9jx4-4hmg-8h59/GHSA-9jx4-4hmg-8h59.json new file mode 100644 index 00000000000..deebae5cba5 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-9jx4-4hmg-8h59/GHSA-9jx4-4hmg-8h59.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9jx4-4hmg-8h59", + "modified": "2024-02-04T21:30:44Z", + "published": "2024-02-04T21:30:44Z", + "aliases": [ + "CVE-2021-46902" + ], + "details": "An issue was discovered in LTOS-Web-Interface in Meinberg LANTIME-Firmware before 6.24.029 MBGID-9343 and 7 before 7.04.008 MBGID-6303. Path validation is mishandled, and thus an admin can read or delete files in violation of expected access controls.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46902" + }, + { + "type": "WEB", + "url": "https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2021-03-meinberg-lantime-firmware-v7-04-008-und-v6-24-029.htm" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-04T21:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-gh68-jm46-84rf/GHSA-gh68-jm46-84rf.json b/advisories/unreviewed/2024/02/GHSA-gh68-jm46-84rf/GHSA-gh68-jm46-84rf.json new file mode 100644 index 00000000000..509eeb9286b --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-gh68-jm46-84rf/GHSA-gh68-jm46-84rf.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gh68-jm46-84rf", + "modified": "2024-02-04T21:30:43Z", + "published": "2024-02-04T21:30:43Z", + "aliases": [ + "CVE-2023-52425" + ], + "details": "libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52425" + }, + { + "type": "WEB", + "url": "https://github.com/libexpat/libexpat/pull/789" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-04T20:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-mp2w-hjcj-f5g9/GHSA-mp2w-hjcj-f5g9.json b/advisories/unreviewed/2024/02/GHSA-mp2w-hjcj-f5g9/GHSA-mp2w-hjcj-f5g9.json new file mode 100644 index 00000000000..0067c91daa9 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-mp2w-hjcj-f5g9/GHSA-mp2w-hjcj-f5g9.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mp2w-hjcj-f5g9", + "modified": "2024-02-04T21:30:43Z", + "published": "2024-02-04T21:30:43Z", + "aliases": [ + "CVE-2023-52426" + ], + "details": "libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52426" + }, + { + "type": "WEB", + "url": "https://github.com/libexpat/libexpat/pull/777" + }, + { + "type": "WEB", + "url": "https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404" + }, + { + "type": "WEB", + "url": "https://cwe.mitre.org/data/definitions/776.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-04T20:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-mpwj-fcr6-x34c/GHSA-mpwj-fcr6-x34c.json b/advisories/unreviewed/2024/02/GHSA-mpwj-fcr6-x34c/GHSA-mpwj-fcr6-x34c.json new file mode 100644 index 00000000000..827877e682a --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-mpwj-fcr6-x34c/GHSA-mpwj-fcr6-x34c.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mpwj-fcr6-x34c", + "modified": "2024-02-04T21:30:43Z", + "published": "2024-02-04T21:30:43Z", + "aliases": [ + "CVE-2021-4435" + ], + "details": "An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4435" + }, + { + "type": "WEB", + "url": "https://github.com/yarnpkg/yarn/commit/67fcce88935e45092ffa2674c08053f1ef5268a1" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2021-4435" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262284" + }, + { + "type": "WEB", + "url": "https://github.com/yarnpkg/yarn/releases/tag/v1.22.13" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-426" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-04T20:15:45Z" + } +} \ No newline at end of file