diff --git a/advisories/github-reviewed/2024/08/GHSA-frvj-cfq4-3228/GHSA-frvj-cfq4-3228.json b/advisories/github-reviewed/2024/08/GHSA-frvj-cfq4-3228/GHSA-frvj-cfq4-3228.json index 7b21d439c52..3cace53d786 100644 --- a/advisories/github-reviewed/2024/08/GHSA-frvj-cfq4-3228/GHSA-frvj-cfq4-3228.json +++ b/advisories/github-reviewed/2024/08/GHSA-frvj-cfq4-3228/GHSA-frvj-cfq4-3228.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-frvj-cfq4-3228", - "modified": "2024-08-02T21:13:14Z", + "modified": "2024-08-02T21:32:26Z", "published": "2024-08-02T21:13:13Z", "aliases": [ "CVE-2024-36116" @@ -22,7 +22,7 @@ { "package": { "ecosystem": "Maven", - "name": "com.dzikoysk:reposilite-backend" + "name": "com.reposilite:reposilite-backend" }, "ranges": [ { diff --git a/advisories/unreviewed/2022/10/GHSA-6prj-5r8w-3x38/GHSA-6prj-5r8w-3x38.json b/advisories/unreviewed/2022/10/GHSA-6prj-5r8w-3x38/GHSA-6prj-5r8w-3x38.json index e1908e88bd2..6f6e51e4ccf 100644 --- a/advisories/unreviewed/2022/10/GHSA-6prj-5r8w-3x38/GHSA-6prj-5r8w-3x38.json +++ b/advisories/unreviewed/2022/10/GHSA-6prj-5r8w-3x38/GHSA-6prj-5r8w-3x38.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6prj-5r8w-3x38", - "modified": "2022-10-21T12:00:22Z", + "modified": "2024-08-02T21:31:32Z", "published": "2022-10-18T19:00:33Z", "aliases": [ "CVE-2022-41479" @@ -24,6 +24,14 @@ { "type": "WEB", "url": "https://github.com/IthacaLabs/DevExpress/tree/main/ASP.NET_Web_Forms_Build_19.2.3" + }, + { + "type": "WEB", + "url": "https://supportcenter.devexpress.com/ticket/details/t1171808/penetration-test-idor-source-code-cve-2022-41479" + }, + { + "type": "WEB", + "url": "https://supportcenter.devexpress.com/ticket/details/t190349/false-positive-vulnerabilities-known-alerts-detected-by-various-security-scanners-and" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/02/GHSA-35j4-pxc2-3gcf/GHSA-35j4-pxc2-3gcf.json b/advisories/unreviewed/2024/02/GHSA-35j4-pxc2-3gcf/GHSA-35j4-pxc2-3gcf.json index 4ef843dec87..f25dea31e44 100644 --- a/advisories/unreviewed/2024/02/GHSA-35j4-pxc2-3gcf/GHSA-35j4-pxc2-3gcf.json +++ b/advisories/unreviewed/2024/02/GHSA-35j4-pxc2-3gcf/GHSA-35j4-pxc2-3gcf.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-35j4-pxc2-3gcf", - "modified": "2024-02-26T18:30:31Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-02-26T18:30:31Z", "aliases": [ "CVE-2024-25344" ], "details": "Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remtoe attacker to execute arbitrary code and obtain sensitive information via the settings.php, settings+company.php, settings_defaults.php,settings_integrations.php, settings_invoice.php, settings_localization.php, settings_mail.php components.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-26T16:27:58Z" diff --git a/advisories/unreviewed/2024/03/GHSA-268q-c8pq-99pj/GHSA-268q-c8pq-99pj.json b/advisories/unreviewed/2024/03/GHSA-268q-c8pq-99pj/GHSA-268q-c8pq-99pj.json index 1e6fd6f34f8..13c1cfd05f6 100644 --- a/advisories/unreviewed/2024/03/GHSA-268q-c8pq-99pj/GHSA-268q-c8pq-99pj.json +++ b/advisories/unreviewed/2024/03/GHSA-268q-c8pq-99pj/GHSA-268q-c8pq-99pj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-268q-c8pq-99pj", - "modified": "2024-03-20T21:31:14Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-20T21:31:14Z", "aliases": [ "CVE-2024-25294" ], "details": "An SSRF issue in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the FileDownloader.java, proxyDownload,URL parameters.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-918" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-20T21:15:30Z" diff --git a/advisories/unreviewed/2024/03/GHSA-3j55-px9j-gc5p/GHSA-3j55-px9j-gc5p.json b/advisories/unreviewed/2024/03/GHSA-3j55-px9j-gc5p/GHSA-3j55-px9j-gc5p.json index 12ea5a99bda..e28e40fe500 100644 --- a/advisories/unreviewed/2024/03/GHSA-3j55-px9j-gc5p/GHSA-3j55-px9j-gc5p.json +++ b/advisories/unreviewed/2024/03/GHSA-3j55-px9j-gc5p/GHSA-3j55-px9j-gc5p.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-3j55-px9j-gc5p", - "modified": "2024-03-13T15:31:03Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-13T15:31:03Z", "aliases": [ "CVE-2024-28430" ], "details": "DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalog_edit.php.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-13T13:15:47Z" diff --git a/advisories/unreviewed/2024/03/GHSA-52q4-4w7h-h6vp/GHSA-52q4-4w7h-h6vp.json b/advisories/unreviewed/2024/03/GHSA-52q4-4w7h-h6vp/GHSA-52q4-4w7h-h6vp.json index 2aacbb60172..fdcbb064cc7 100644 --- a/advisories/unreviewed/2024/03/GHSA-52q4-4w7h-h6vp/GHSA-52q4-4w7h-h6vp.json +++ b/advisories/unreviewed/2024/03/GHSA-52q4-4w7h-h6vp/GHSA-52q4-4w7h-h6vp.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-52q4-4w7h-h6vp", - "modified": "2024-03-27T06:30:32Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-27T06:30:32Z", "aliases": [ "CVE-2023-29134" ], "details": "An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. There is mishandling of backticks to smartSplit.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" + } ], "affected": [ @@ -41,9 +44,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-20" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-27T06:15:08Z" diff --git a/advisories/unreviewed/2024/03/GHSA-5vqc-63mj-rggw/GHSA-5vqc-63mj-rggw.json b/advisories/unreviewed/2024/03/GHSA-5vqc-63mj-rggw/GHSA-5vqc-63mj-rggw.json index 149c873cb54..a2ec2ed7e0d 100644 --- a/advisories/unreviewed/2024/03/GHSA-5vqc-63mj-rggw/GHSA-5vqc-63mj-rggw.json +++ b/advisories/unreviewed/2024/03/GHSA-5vqc-63mj-rggw/GHSA-5vqc-63mj-rggw.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5vqc-63mj-rggw", - "modified": "2024-03-20T15:32:46Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-20T15:32:46Z", "aliases": [ "CVE-2024-28581" ], "details": "Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the _assignPixel<>() function when reading images in TARGA format.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-20T06:15:11Z" diff --git a/advisories/unreviewed/2024/03/GHSA-746c-3fpg-6m7j/GHSA-746c-3fpg-6m7j.json b/advisories/unreviewed/2024/03/GHSA-746c-3fpg-6m7j/GHSA-746c-3fpg-6m7j.json index adb48622bc2..75acbb35652 100644 --- a/advisories/unreviewed/2024/03/GHSA-746c-3fpg-6m7j/GHSA-746c-3fpg-6m7j.json +++ b/advisories/unreviewed/2024/03/GHSA-746c-3fpg-6m7j/GHSA-746c-3fpg-6m7j.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-746c-3fpg-6m7j", - "modified": "2024-03-21T03:36:46Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-21T03:36:46Z", "aliases": [ "CVE-2024-25359" ], "details": "An issue in zuoxingdong lagom v.0.1.2 allows a local attacker to execute arbitrary code via the pickle_load function of the serialize.py file.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-21T02:52:14Z" diff --git a/advisories/unreviewed/2024/03/GHSA-7rg9-mm6v-qwrq/GHSA-7rg9-mm6v-qwrq.json b/advisories/unreviewed/2024/03/GHSA-7rg9-mm6v-qwrq/GHSA-7rg9-mm6v-qwrq.json index d7ce3a180ec..3ee42716ff7 100644 --- a/advisories/unreviewed/2024/03/GHSA-7rg9-mm6v-qwrq/GHSA-7rg9-mm6v-qwrq.json +++ b/advisories/unreviewed/2024/03/GHSA-7rg9-mm6v-qwrq/GHSA-7rg9-mm6v-qwrq.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-7rg9-mm6v-qwrq", - "modified": "2024-03-20T15:32:43Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-20T15:32:43Z", "aliases": [ "CVE-2024-28567" ], "details": "Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the FreeImage_CreateICCProfile() function when reading images in TIFF format.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-20T06:15:09Z" diff --git a/advisories/unreviewed/2024/03/GHSA-9gc2-35h9-mhj5/GHSA-9gc2-35h9-mhj5.json b/advisories/unreviewed/2024/03/GHSA-9gc2-35h9-mhj5/GHSA-9gc2-35h9-mhj5.json index eee23a09544..d6225489e01 100644 --- a/advisories/unreviewed/2024/03/GHSA-9gc2-35h9-mhj5/GHSA-9gc2-35h9-mhj5.json +++ b/advisories/unreviewed/2024/03/GHSA-9gc2-35h9-mhj5/GHSA-9gc2-35h9-mhj5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9gc2-35h9-mhj5", - "modified": "2024-03-20T15:32:45Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-20T15:32:45Z", "aliases": [ "CVE-2024-28575" ], "details": "Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the opj_j2k_read_mct() function when reading images in J2K format.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-20T06:15:10Z" diff --git a/advisories/unreviewed/2024/03/GHSA-c7gv-5x7r-f2g7/GHSA-c7gv-5x7r-f2g7.json b/advisories/unreviewed/2024/03/GHSA-c7gv-5x7r-f2g7/GHSA-c7gv-5x7r-f2g7.json index 6d83d139a5b..3ad61e139d7 100644 --- a/advisories/unreviewed/2024/03/GHSA-c7gv-5x7r-f2g7/GHSA-c7gv-5x7r-f2g7.json +++ b/advisories/unreviewed/2024/03/GHSA-c7gv-5x7r-f2g7/GHSA-c7gv-5x7r-f2g7.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-c7gv-5x7r-f2g7", - "modified": "2024-03-20T15:32:43Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-20T15:32:43Z", "aliases": [ "CVE-2024-28568" ], "details": "Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the read_iptc_profile() function when reading images in TIFF format.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-20T06:15:09Z" diff --git a/advisories/unreviewed/2024/03/GHSA-fcwm-gx7c-6hgc/GHSA-fcwm-gx7c-6hgc.json b/advisories/unreviewed/2024/03/GHSA-fcwm-gx7c-6hgc/GHSA-fcwm-gx7c-6hgc.json index 1769bf39f6b..0762a565ec3 100644 --- a/advisories/unreviewed/2024/03/GHSA-fcwm-gx7c-6hgc/GHSA-fcwm-gx7c-6hgc.json +++ b/advisories/unreviewed/2024/03/GHSA-fcwm-gx7c-6hgc/GHSA-fcwm-gx7c-6hgc.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-fcwm-gx7c-6hgc", - "modified": "2024-03-20T15:32:46Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-20T15:32:46Z", "aliases": [ "CVE-2024-28580" ], "details": "Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the ReadData() function when reading images in RAS format.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-20T06:15:11Z" diff --git a/advisories/unreviewed/2024/03/GHSA-fwx6-53vm-r73w/GHSA-fwx6-53vm-r73w.json b/advisories/unreviewed/2024/03/GHSA-fwx6-53vm-r73w/GHSA-fwx6-53vm-r73w.json index c54d3fb1f9b..f73dcb5deb0 100644 --- a/advisories/unreviewed/2024/03/GHSA-fwx6-53vm-r73w/GHSA-fwx6-53vm-r73w.json +++ b/advisories/unreviewed/2024/03/GHSA-fwx6-53vm-r73w/GHSA-fwx6-53vm-r73w.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-fwx6-53vm-r73w", - "modified": "2024-03-20T15:32:45Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-20T15:32:45Z", "aliases": [ "CVE-2024-28574" ], "details": "Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the opj_j2k_copy_default_tcp_and_create_tcd() function when reading images in J2K format.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-20T06:15:10Z" diff --git a/advisories/unreviewed/2024/03/GHSA-g27m-qx37-w989/GHSA-g27m-qx37-w989.json b/advisories/unreviewed/2024/03/GHSA-g27m-qx37-w989/GHSA-g27m-qx37-w989.json index 6c100115287..6dca6a9b749 100644 --- a/advisories/unreviewed/2024/03/GHSA-g27m-qx37-w989/GHSA-g27m-qx37-w989.json +++ b/advisories/unreviewed/2024/03/GHSA-g27m-qx37-w989/GHSA-g27m-qx37-w989.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-g27m-qx37-w989", - "modified": "2024-03-13T15:31:05Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-13T15:31:05Z", "aliases": [ "CVE-2024-28668" ], "details": "DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/mychannel_add.php", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-13T13:15:48Z" diff --git a/advisories/unreviewed/2024/03/GHSA-g2c5-xvv5-fcwr/GHSA-g2c5-xvv5-fcwr.json b/advisories/unreviewed/2024/03/GHSA-g2c5-xvv5-fcwr/GHSA-g2c5-xvv5-fcwr.json index 8cd43abd55c..6437fdb921f 100644 --- a/advisories/unreviewed/2024/03/GHSA-g2c5-xvv5-fcwr/GHSA-g2c5-xvv5-fcwr.json +++ b/advisories/unreviewed/2024/03/GHSA-g2c5-xvv5-fcwr/GHSA-g2c5-xvv5-fcwr.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-g2c5-xvv5-fcwr", - "modified": "2024-03-21T03:36:46Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-21T03:36:46Z", "aliases": [ "CVE-2024-25239" ], "details": "SQL Injection vulnerability in Sourcecodester Employee Management System v1.0 allows attackers to run arbitrary SQL commands via crafted POST request to /emloyee_akpoly/Account/login.php.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-21T02:52:13Z" diff --git a/advisories/unreviewed/2024/03/GHSA-ghhv-pj7q-4j6f/GHSA-ghhv-pj7q-4j6f.json b/advisories/unreviewed/2024/03/GHSA-ghhv-pj7q-4j6f/GHSA-ghhv-pj7q-4j6f.json index 71bd2a6f480..6beca5ffaad 100644 --- a/advisories/unreviewed/2024/03/GHSA-ghhv-pj7q-4j6f/GHSA-ghhv-pj7q-4j6f.json +++ b/advisories/unreviewed/2024/03/GHSA-ghhv-pj7q-4j6f/GHSA-ghhv-pj7q-4j6f.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-ghhv-pj7q-4j6f", - "modified": "2024-03-26T00:32:02Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-26T00:32:02Z", "aliases": [ "CVE-2024-29302" ], "details": "SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection via update-employee.php.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-26T00:15:08Z" diff --git a/advisories/unreviewed/2024/03/GHSA-gmc8-q8c9-x758/GHSA-gmc8-q8c9-x758.json b/advisories/unreviewed/2024/03/GHSA-gmc8-q8c9-x758/GHSA-gmc8-q8c9-x758.json index daab523700c..bbb351cb83a 100644 --- a/advisories/unreviewed/2024/03/GHSA-gmc8-q8c9-x758/GHSA-gmc8-q8c9-x758.json +++ b/advisories/unreviewed/2024/03/GHSA-gmc8-q8c9-x758/GHSA-gmc8-q8c9-x758.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-gmc8-q8c9-x758", - "modified": "2024-03-26T12:31:27Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-26T12:31:27Z", "aliases": [ "CVE-2024-28131" ], "details": "EasyRange Ver 1.41 contains an issue with the executable file search path when displaying an extracted file on Explorer, which may lead to loading an executable file resides in the same folder where the extracted file is placed. If this vulnerability is exploited, arbitrary code may be executed with the privilege of the running program. Note that the developer was unreachable, therefore, users should consider stop using EasyRange Ver 1.41.\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-427" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-26T10:15:09Z" diff --git a/advisories/unreviewed/2024/03/GHSA-h8vf-mrp9-h5cj/GHSA-h8vf-mrp9-h5cj.json b/advisories/unreviewed/2024/03/GHSA-h8vf-mrp9-h5cj/GHSA-h8vf-mrp9-h5cj.json index e5c62fd6ab1..a17ce8fc4c4 100644 --- a/advisories/unreviewed/2024/03/GHSA-h8vf-mrp9-h5cj/GHSA-h8vf-mrp9-h5cj.json +++ b/advisories/unreviewed/2024/03/GHSA-h8vf-mrp9-h5cj/GHSA-h8vf-mrp9-h5cj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-h8vf-mrp9-h5cj", - "modified": "2024-03-18T03:30:32Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-18T03:30:32Z", "aliases": [ "CVE-2024-24230" ], "details": "Komm.One CMS 10.4.2.14 has a Server-Side Template Injection (SSTI) vulnerability via the Velocity template engine. It allows remote attackers to execute arbitrary code via a URL that specifies java.lang.Runtime in conjunction with getRuntime().exec followed by an OS command.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-18T02:15:06Z" diff --git a/advisories/unreviewed/2024/03/GHSA-p94v-hr2q-pvmg/GHSA-p94v-hr2q-pvmg.json b/advisories/unreviewed/2024/03/GHSA-p94v-hr2q-pvmg/GHSA-p94v-hr2q-pvmg.json index a4accfa97ab..832ff9b4081 100644 --- a/advisories/unreviewed/2024/03/GHSA-p94v-hr2q-pvmg/GHSA-p94v-hr2q-pvmg.json +++ b/advisories/unreviewed/2024/03/GHSA-p94v-hr2q-pvmg/GHSA-p94v-hr2q-pvmg.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-p94v-hr2q-pvmg", - "modified": "2024-03-20T15:32:43Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-20T15:32:43Z", "aliases": [ "CVE-2024-28566" ], "details": "Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the AssignPixel() function when reading images in TIFF format.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-20T06:15:09Z" diff --git a/advisories/unreviewed/2024/03/GHSA-p9m7-r75h-rrfp/GHSA-p9m7-r75h-rrfp.json b/advisories/unreviewed/2024/03/GHSA-p9m7-r75h-rrfp/GHSA-p9m7-r75h-rrfp.json index 5607f61d016..899f66cf1d7 100644 --- a/advisories/unreviewed/2024/03/GHSA-p9m7-r75h-rrfp/GHSA-p9m7-r75h-rrfp.json +++ b/advisories/unreviewed/2024/03/GHSA-p9m7-r75h-rrfp/GHSA-p9m7-r75h-rrfp.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-p9m7-r75h-rrfp", - "modified": "2024-03-21T15:31:55Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-21T15:31:55Z", "aliases": [ "CVE-2024-29243" ], "details": "Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the vpn_client_ip parameter at /apply.cgi.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-120" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-21T15:16:54Z" diff --git a/advisories/unreviewed/2024/03/GHSA-pvg5-mc56-6fv7/GHSA-pvg5-mc56-6fv7.json b/advisories/unreviewed/2024/03/GHSA-pvg5-mc56-6fv7/GHSA-pvg5-mc56-6fv7.json index dfd51016a96..92e48745ed8 100644 --- a/advisories/unreviewed/2024/03/GHSA-pvg5-mc56-6fv7/GHSA-pvg5-mc56-6fv7.json +++ b/advisories/unreviewed/2024/03/GHSA-pvg5-mc56-6fv7/GHSA-pvg5-mc56-6fv7.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-pvg5-mc56-6fv7", - "modified": "2024-03-19T12:30:41Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-19T12:30:41Z", "aliases": [ "CVE-2024-2613" ], "details": "Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash. This vulnerability affects Firefox < 124.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-1021" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-19T12:15:09Z" diff --git a/advisories/unreviewed/2024/03/GHSA-q423-wx9h-q4v8/GHSA-q423-wx9h-q4v8.json b/advisories/unreviewed/2024/03/GHSA-q423-wx9h-q4v8/GHSA-q423-wx9h-q4v8.json index 862cc06cce6..6f737c15072 100644 --- a/advisories/unreviewed/2024/03/GHSA-q423-wx9h-q4v8/GHSA-q423-wx9h-q4v8.json +++ b/advisories/unreviewed/2024/03/GHSA-q423-wx9h-q4v8/GHSA-q423-wx9h-q4v8.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-q423-wx9h-q4v8", - "modified": "2024-03-07T09:30:32Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-07T09:30:32Z", "aliases": [ "CVE-2023-41503" ], "details": "Student Enrollment In PHP v1.0 was discovered to contain a SQL injection vulnerability via the Login function.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-07T09:15:38Z" diff --git a/advisories/unreviewed/2024/03/GHSA-qj32-mm73-xjg5/GHSA-qj32-mm73-xjg5.json b/advisories/unreviewed/2024/03/GHSA-qj32-mm73-xjg5/GHSA-qj32-mm73-xjg5.json index 21acd2b7a4f..9ec2c52689a 100644 --- a/advisories/unreviewed/2024/03/GHSA-qj32-mm73-xjg5/GHSA-qj32-mm73-xjg5.json +++ b/advisories/unreviewed/2024/03/GHSA-qj32-mm73-xjg5/GHSA-qj32-mm73-xjg5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-qj32-mm73-xjg5", - "modified": "2024-03-20T21:31:14Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-20T21:31:14Z", "aliases": [ "CVE-2024-29474" ], "details": "OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Management module.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-20T21:15:32Z" diff --git a/advisories/unreviewed/2024/03/GHSA-rrf2-65m6-wmqp/GHSA-rrf2-65m6-wmqp.json b/advisories/unreviewed/2024/03/GHSA-rrf2-65m6-wmqp/GHSA-rrf2-65m6-wmqp.json index 18410747985..1e1e9aa53e7 100644 --- a/advisories/unreviewed/2024/03/GHSA-rrf2-65m6-wmqp/GHSA-rrf2-65m6-wmqp.json +++ b/advisories/unreviewed/2024/03/GHSA-rrf2-65m6-wmqp/GHSA-rrf2-65m6-wmqp.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rrf2-65m6-wmqp", - "modified": "2024-03-20T15:32:45Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-20T15:32:45Z", "aliases": [ "CVE-2024-28573" ], "details": "Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the jpeg_read_exif_profile() function when reading images in JPEG format.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-20T06:15:10Z" diff --git a/advisories/unreviewed/2024/03/GHSA-vcwc-59rg-8254/GHSA-vcwc-59rg-8254.json b/advisories/unreviewed/2024/03/GHSA-vcwc-59rg-8254/GHSA-vcwc-59rg-8254.json index 9a8546f9886..37f9aefe597 100644 --- a/advisories/unreviewed/2024/03/GHSA-vcwc-59rg-8254/GHSA-vcwc-59rg-8254.json +++ b/advisories/unreviewed/2024/03/GHSA-vcwc-59rg-8254/GHSA-vcwc-59rg-8254.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-vcwc-59rg-8254", - "modified": "2024-03-20T15:32:46Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-03-20T15:32:46Z", "aliases": [ "CVE-2024-28582" ], "details": "Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the rgbe_RGBEToFloat() function when reading images in HDR format.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-20T06:15:11Z" diff --git a/advisories/unreviewed/2024/07/GHSA-2hxw-2gfv-p3w2/GHSA-2hxw-2gfv-p3w2.json b/advisories/unreviewed/2024/07/GHSA-2hxw-2gfv-p3w2/GHSA-2hxw-2gfv-p3w2.json index da2d7ddf1d1..29c6f85d88b 100644 --- a/advisories/unreviewed/2024/07/GHSA-2hxw-2gfv-p3w2/GHSA-2hxw-2gfv-p3w2.json +++ b/advisories/unreviewed/2024/07/GHSA-2hxw-2gfv-p3w2/GHSA-2hxw-2gfv-p3w2.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/07/GHSA-789f-c4f8-rfp7/GHSA-789f-c4f8-rfp7.json b/advisories/unreviewed/2024/07/GHSA-789f-c4f8-rfp7/GHSA-789f-c4f8-rfp7.json index 49f8e3010f8..2ad628b8729 100644 --- a/advisories/unreviewed/2024/07/GHSA-789f-c4f8-rfp7/GHSA-789f-c4f8-rfp7.json +++ b/advisories/unreviewed/2024/07/GHSA-789f-c4f8-rfp7/GHSA-789f-c4f8-rfp7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-789f-c4f8-rfp7", - "modified": "2024-07-25T18:32:37Z", + "modified": "2024-08-02T21:31:34Z", "published": "2024-07-25T18:32:37Z", "aliases": [ "CVE-2024-40873" diff --git a/advisories/unreviewed/2024/07/GHSA-8w32-6chg-qv5f/GHSA-8w32-6chg-qv5f.json b/advisories/unreviewed/2024/07/GHSA-8w32-6chg-qv5f/GHSA-8w32-6chg-qv5f.json index de357557304..46def0d8ca2 100644 --- a/advisories/unreviewed/2024/07/GHSA-8w32-6chg-qv5f/GHSA-8w32-6chg-qv5f.json +++ b/advisories/unreviewed/2024/07/GHSA-8w32-6chg-qv5f/GHSA-8w32-6chg-qv5f.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-8w32-6chg-qv5f", - "modified": "2024-07-03T18:48:29Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-07-03T18:48:29Z", "aliases": [ "CVE-2024-29509" ], "details": "Artifex Ghostscript before 10.03.0 has a heap-based overflow when PDFPassword (e.g., for runpdf) has a \\000 byte in the middle.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-03T18:15:04Z" diff --git a/advisories/unreviewed/2024/07/GHSA-9gvv-47x2-579h/GHSA-9gvv-47x2-579h.json b/advisories/unreviewed/2024/07/GHSA-9gvv-47x2-579h/GHSA-9gvv-47x2-579h.json index b9f20ee4ac3..abc87990f30 100644 --- a/advisories/unreviewed/2024/07/GHSA-9gvv-47x2-579h/GHSA-9gvv-47x2-579h.json +++ b/advisories/unreviewed/2024/07/GHSA-9gvv-47x2-579h/GHSA-9gvv-47x2-579h.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-78", "CWE-94" ], "severity": "CRITICAL", diff --git a/advisories/unreviewed/2024/07/GHSA-c2r9-6vp5-5wv7/GHSA-c2r9-6vp5-5wv7.json b/advisories/unreviewed/2024/07/GHSA-c2r9-6vp5-5wv7/GHSA-c2r9-6vp5-5wv7.json index 3a769044539..f4750e0d102 100644 --- a/advisories/unreviewed/2024/07/GHSA-c2r9-6vp5-5wv7/GHSA-c2r9-6vp5-5wv7.json +++ b/advisories/unreviewed/2024/07/GHSA-c2r9-6vp5-5wv7/GHSA-c2r9-6vp5-5wv7.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-122" + "CWE-122", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/07/GHSA-f8f7-g44v-jxm9/GHSA-f8f7-g44v-jxm9.json b/advisories/unreviewed/2024/07/GHSA-f8f7-g44v-jxm9/GHSA-f8f7-g44v-jxm9.json index ce2ef975bca..26d9d1809b8 100644 --- a/advisories/unreviewed/2024/07/GHSA-f8f7-g44v-jxm9/GHSA-f8f7-g44v-jxm9.json +++ b/advisories/unreviewed/2024/07/GHSA-f8f7-g44v-jxm9/GHSA-f8f7-g44v-jxm9.json @@ -32,7 +32,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/07/GHSA-g5x6-xpv4-w4mm/GHSA-g5x6-xpv4-w4mm.json b/advisories/unreviewed/2024/07/GHSA-g5x6-xpv4-w4mm/GHSA-g5x6-xpv4-w4mm.json index f16e87a724f..abd11008b07 100644 --- a/advisories/unreviewed/2024/07/GHSA-g5x6-xpv4-w4mm/GHSA-g5x6-xpv4-w4mm.json +++ b/advisories/unreviewed/2024/07/GHSA-g5x6-xpv4-w4mm/GHSA-g5x6-xpv4-w4mm.json @@ -36,7 +36,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-120" + "CWE-120", + "CWE-787" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/07/GHSA-mgpw-5w39-9553/GHSA-mgpw-5w39-9553.json b/advisories/unreviewed/2024/07/GHSA-mgpw-5w39-9553/GHSA-mgpw-5w39-9553.json index 432afabf78e..5c2c443ac27 100644 --- a/advisories/unreviewed/2024/07/GHSA-mgpw-5w39-9553/GHSA-mgpw-5w39-9553.json +++ b/advisories/unreviewed/2024/07/GHSA-mgpw-5w39-9553/GHSA-mgpw-5w39-9553.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-122" + "CWE-122", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/07/GHSA-ppc6-pqcq-584g/GHSA-ppc6-pqcq-584g.json b/advisories/unreviewed/2024/07/GHSA-ppc6-pqcq-584g/GHSA-ppc6-pqcq-584g.json index 2cfda5c9a48..310c1afc546 100644 --- a/advisories/unreviewed/2024/07/GHSA-ppc6-pqcq-584g/GHSA-ppc6-pqcq-584g.json +++ b/advisories/unreviewed/2024/07/GHSA-ppc6-pqcq-584g/GHSA-ppc6-pqcq-584g.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/07/GHSA-vjrw-gxxj-h5j4/GHSA-vjrw-gxxj-h5j4.json b/advisories/unreviewed/2024/07/GHSA-vjrw-gxxj-h5j4/GHSA-vjrw-gxxj-h5j4.json index 6ebdd7e9402..3fce2d5e1a9 100644 --- a/advisories/unreviewed/2024/07/GHSA-vjrw-gxxj-h5j4/GHSA-vjrw-gxxj-h5j4.json +++ b/advisories/unreviewed/2024/07/GHSA-vjrw-gxxj-h5j4/GHSA-vjrw-gxxj-h5j4.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-122" + "CWE-122", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/07/GHSA-w2wv-53w9-5r3r/GHSA-w2wv-53w9-5r3r.json b/advisories/unreviewed/2024/07/GHSA-w2wv-53w9-5r3r/GHSA-w2wv-53w9-5r3r.json index 386e49a2403..93a45b17d70 100644 --- a/advisories/unreviewed/2024/07/GHSA-w2wv-53w9-5r3r/GHSA-w2wv-53w9-5r3r.json +++ b/advisories/unreviewed/2024/07/GHSA-w2wv-53w9-5r3r/GHSA-w2wv-53w9-5r3r.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-w2wv-53w9-5r3r", - "modified": "2024-07-03T18:48:30Z", + "modified": "2024-08-02T21:31:33Z", "published": "2024-07-03T18:48:30Z", "aliases": [ "CVE-2024-29508" ], "details": "Artifex Ghostscript before 10.0.3.0 has a heap-based pointer disclosure (observable in a constructed BaseFont name) in the function pdf_base_font_alloc.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } ], "affected": [ @@ -35,7 +38,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-03T18:15:04Z" diff --git a/advisories/unreviewed/2024/08/GHSA-2fqr-cx7q-3ph8/GHSA-2fqr-cx7q-3ph8.json b/advisories/unreviewed/2024/08/GHSA-2fqr-cx7q-3ph8/GHSA-2fqr-cx7q-3ph8.json new file mode 100644 index 00000000000..8051cb29635 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-2fqr-cx7q-3ph8/GHSA-2fqr-cx7q-3ph8.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2fqr-cx7q-3ph8", + "modified": "2024-08-02T21:31:34Z", + "published": "2024-08-02T21:31:34Z", + "aliases": [ + "CVE-2024-7319" + ], + "details": "An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7319" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-7319" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258810" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-02T21:16:31Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-cqcg-4g39-cjvj/GHSA-cqcg-4g39-cjvj.json b/advisories/unreviewed/2024/08/GHSA-cqcg-4g39-cjvj/GHSA-cqcg-4g39-cjvj.json new file mode 100644 index 00000000000..5089b10259b --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-cqcg-4g39-cjvj/GHSA-cqcg-4g39-cjvj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cqcg-4g39-cjvj", + "modified": "2024-08-02T21:31:34Z", + "published": "2024-08-02T21:31:34Z", + "aliases": [ + "CVE-2024-22169" + ], + "details": "WD Discovery\nversions prior to 5.0.589 contain a misconfiguration in the Node.js environment\nsettings that could allow code execution by utilizing the 'ELECTRON_RUN_AS_NODE' environment variable.\nAny malicious application operating with standard user permissions can exploit\nthis vulnerability, enabling code execution within WD Discovery application's\ncontext. WD Discovery version 5.0.589 addresses this issue by disabling certain\nfeatures and fuses in Electron. The attack vector for this issue requires the victim to have the WD Discovery app installed on their device.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22169" + }, + { + "type": "WEB", + "url": "https://www.westerndigital.com/support/product-security/wdc-24004-wd-discovery-desktop-app-version-5-0-589" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-02T19:16:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-fj4r-983x-g27c/GHSA-fj4r-983x-g27c.json b/advisories/unreviewed/2024/08/GHSA-fj4r-983x-g27c/GHSA-fj4r-983x-g27c.json new file mode 100644 index 00000000000..6dcdad1260d --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-fj4r-983x-g27c/GHSA-fj4r-983x-g27c.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fj4r-983x-g27c", + "modified": "2024-08-02T21:31:34Z", + "published": "2024-08-02T21:31:34Z", + "aliases": [ + "CVE-2024-38887" + ], + "details": "An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to expand control over the operating system from the database due to the execution of commands with unnecessary privileges.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38887" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.273371" + }, + { + "type": "WEB", + "url": "http://caterease.com" + }, + { + "type": "WEB", + "url": "http://horizon.com" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-02T21:16:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-p844-wjq6-m36r/GHSA-p844-wjq6-m36r.json b/advisories/unreviewed/2024/08/GHSA-p844-wjq6-m36r/GHSA-p844-wjq6-m36r.json index 1967ac9058d..df1f501de5b 100644 --- a/advisories/unreviewed/2024/08/GHSA-p844-wjq6-m36r/GHSA-p844-wjq6-m36r.json +++ b/advisories/unreviewed/2024/08/GHSA-p844-wjq6-m36r/GHSA-p844-wjq6-m36r.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-p844-wjq6-m36r", - "modified": "2024-08-01T06:30:34Z", + "modified": "2024-08-02T21:31:34Z", "published": "2024-08-01T06:30:34Z", "aliases": [ "CVE-2024-2872" ], "details": "The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-01T06:15:02Z" diff --git a/advisories/unreviewed/2024/08/GHSA-pwxm-h2xg-rwv6/GHSA-pwxm-h2xg-rwv6.json b/advisories/unreviewed/2024/08/GHSA-pwxm-h2xg-rwv6/GHSA-pwxm-h2xg-rwv6.json new file mode 100644 index 00000000000..68042d0be67 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-pwxm-h2xg-rwv6/GHSA-pwxm-h2xg-rwv6.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pwxm-h2xg-rwv6", + "modified": "2024-08-02T21:31:34Z", + "published": "2024-08-02T21:31:34Z", + "aliases": [ + "CVE-2024-38889" + ], + "details": "An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform SQL Injection due to improper neutralization of special elements used in an SQL command.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38889" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.273373" + }, + { + "type": "WEB", + "url": "http://caterease.com" + }, + { + "type": "WEB", + "url": "http://horizon.com" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-02T20:17:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-qw3c-q5mw-r893/GHSA-qw3c-q5mw-r893.json b/advisories/unreviewed/2024/08/GHSA-qw3c-q5mw-r893/GHSA-qw3c-q5mw-r893.json new file mode 100644 index 00000000000..b93ce0ca982 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-qw3c-q5mw-r893/GHSA-qw3c-q5mw-r893.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qw3c-q5mw-r893", + "modified": "2024-08-02T21:31:34Z", + "published": "2024-08-02T21:31:34Z", + "aliases": [ + "CVE-2024-38888" + ], + "details": "An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform a Password Brute Forcing attack due to improper restriction of excessive authentication attempts.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38888" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.273372" + }, + { + "type": "WEB", + "url": "http://caterease.com" + }, + { + "type": "WEB", + "url": "http://horizon.com" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-02T20:17:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-r94j-mwf9-qj2r/GHSA-r94j-mwf9-qj2r.json b/advisories/unreviewed/2024/08/GHSA-r94j-mwf9-qj2r/GHSA-r94j-mwf9-qj2r.json new file mode 100644 index 00000000000..984845add11 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-r94j-mwf9-qj2r/GHSA-r94j-mwf9-qj2r.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r94j-mwf9-qj2r", + "modified": "2024-08-02T21:31:34Z", + "published": "2024-08-02T21:31:34Z", + "aliases": [ + "CVE-2024-38891" + ], + "details": "An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Sniffing Network Traffic attack due to the cleartext transmission of sensitive information.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38891" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.273375" + }, + { + "type": "WEB", + "url": "http://caterease.com" + }, + { + "type": "WEB", + "url": "http://horizon.com" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-02T21:16:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-rpcc-p8xm-rc6p/GHSA-rpcc-p8xm-rc6p.json b/advisories/unreviewed/2024/08/GHSA-rpcc-p8xm-rc6p/GHSA-rpcc-p8xm-rc6p.json new file mode 100644 index 00000000000..97afad72bb5 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-rpcc-p8xm-rc6p/GHSA-rpcc-p8xm-rc6p.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rpcc-p8xm-rc6p", + "modified": "2024-08-02T21:31:34Z", + "published": "2024-08-02T21:31:34Z", + "aliases": [ + "CVE-2024-3056" + ], + "details": "A flaw was found in Podman. This issue may allow an attacker to create a specially crafted container that, when configured to share the same IPC with at least one other container, can create a large number of IPC resources in /dev/shm. The malicious container will continue to exhaust resources until it is out-of-memory (OOM) killed. While the malicious container's cgroup will be removed, the IPC resources it created are not. Those resources are tied to the IPC namespace that will not be removed until all containers using it are stopped, and one non-malicious container is holding the namespace open. The malicious container is restarted, either automatically or by attacker control, repeating the process and increasing the amount of memory consumed. With a container configured to restart always, such as `podman run --restart=always`, this can result in a memory-based denial of service of the system.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3056" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-3056" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2270717" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-02T21:16:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-wpjv-3phj-f64x/GHSA-wpjv-3phj-f64x.json b/advisories/unreviewed/2024/08/GHSA-wpjv-3phj-f64x/GHSA-wpjv-3phj-f64x.json new file mode 100644 index 00000000000..e43a303b42e --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-wpjv-3phj-f64x/GHSA-wpjv-3phj-f64x.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wpjv-3phj-f64x", + "modified": "2024-08-02T21:31:34Z", + "published": "2024-08-02T21:31:34Z", + "aliases": [ + "CVE-2024-28298" + ], + "details": "SQL injection vulnerability in BM SOFT BMPlanning 1.0.0.1 allows authenticated users to execute arbitrary SQL commands via the SEC_IDF, LIE_IDF, PLANF_IDF, CLI_IDF, DOS_IDF, and possibly other parameters to /BMServerR.dll/BMRest.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28298" + }, + { + "type": "WEB", + "url": "https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2024-28298_BMPlanning%28BM-Soft%29_Authenticated%20SQLI.pdf" + }, + { + "type": "WEB", + "url": "https://www.e-bmsoft.com" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-02T19:16:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-xrw6-rg6p-44v6/GHSA-xrw6-rg6p-44v6.json b/advisories/unreviewed/2024/08/GHSA-xrw6-rg6p-44v6/GHSA-xrw6-rg6p-44v6.json new file mode 100644 index 00000000000..a6cfefc07ef --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-xrw6-rg6p-44v6/GHSA-xrw6-rg6p-44v6.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xrw6-rg6p-44v6", + "modified": "2024-08-02T21:31:34Z", + "published": "2024-08-02T21:31:34Z", + "aliases": [ + "CVE-2024-28297" + ], + "details": "SQL injection vulnerability in AzureSoft MyHorus 4.3.5 allows authenticated users to execute arbitrary SQL commands via unspecified vectors.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28297" + }, + { + "type": "WEB", + "url": "https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2024-28297_MYHorus%28AzureSoft%29_Pre-Authenticated%20SQLI.pdf" + }, + { + "type": "WEB", + "url": "https://www.azursoft.com" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-02T19:16:30Z" + } +} \ No newline at end of file