diff --git a/advisories/unreviewed/2024/06/GHSA-8f46-hh28-cq8h/GHSA-8f46-hh28-cq8h.json b/advisories/unreviewed/2024/06/GHSA-8f46-hh28-cq8h/GHSA-8f46-hh28-cq8h.json index a79add3654d..c7f54d5d78b 100644 --- a/advisories/unreviewed/2024/06/GHSA-8f46-hh28-cq8h/GHSA-8f46-hh28-cq8h.json +++ b/advisories/unreviewed/2024/06/GHSA-8f46-hh28-cq8h/GHSA-8f46-hh28-cq8h.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-8f46-hh28-cq8h", - "modified": "2024-06-07T15:30:40Z", + "modified": "2024-11-05T15:30:33Z", "published": "2024-06-07T15:30:40Z", "aliases": [ "CVE-2024-36788" ], "details": "Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 does not properly set the HTTPOnly flag for cookies. This allows attackers to possibly intercept and access sensitive communications between the router and connected devices.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-06-07T15:15:50Z" diff --git a/advisories/unreviewed/2024/10/GHSA-p38m-32qc-f4cg/GHSA-p38m-32qc-f4cg.json b/advisories/unreviewed/2024/10/GHSA-p38m-32qc-f4cg/GHSA-p38m-32qc-f4cg.json index 96ad3e557c8..2c4242b6cdb 100644 --- a/advisories/unreviewed/2024/10/GHSA-p38m-32qc-f4cg/GHSA-p38m-32qc-f4cg.json +++ b/advisories/unreviewed/2024/10/GHSA-p38m-32qc-f4cg/GHSA-p38m-32qc-f4cg.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-259" + "CWE-259", + "CWE-798" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-242c-pm42-hqwq/GHSA-242c-pm42-hqwq.json b/advisories/unreviewed/2024/11/GHSA-242c-pm42-hqwq/GHSA-242c-pm42-hqwq.json new file mode 100644 index 00000000000..cd891bc994e --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-242c-pm42-hqwq/GHSA-242c-pm42-hqwq.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-242c-pm42-hqwq", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-52015" + ], + "details": "Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip parameter at bsw_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52015" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_43/43.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-387f-x58r-3vw7/GHSA-387f-x58r-3vw7.json b/advisories/unreviewed/2024/11/GHSA-387f-x58r-3vw7/GHSA-387f-x58r-3vw7.json new file mode 100644 index 00000000000..d1d852de918 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-387f-x58r-3vw7/GHSA-387f-x58r-3vw7.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-387f-x58r-3vw7", + "modified": "2024-11-05T15:30:36Z", + "published": "2024-11-05T15:30:36Z", + "aliases": [ + "CVE-2024-50993" + ], + "details": "Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at admin_account.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50993" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_39/39.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-4f3c-9wh3-6773/GHSA-4f3c-9wh3-6773.json b/advisories/unreviewed/2024/11/GHSA-4f3c-9wh3-6773/GHSA-4f3c-9wh3-6773.json new file mode 100644 index 00000000000..388f6bb6543 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-4f3c-9wh3-6773/GHSA-4f3c-9wh3-6773.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4f3c-9wh3-6773", + "modified": "2024-11-05T15:30:35Z", + "published": "2024-11-05T15:30:35Z", + "aliases": [ + "CVE-2024-10841" + ], + "details": "A vulnerability classified as critical was found in romadebrian WEB-Sekolah 1.0. Affected by this vulnerability is an unknown functionality of the file /Proses_Kirim.php of the component Mail Handler. The manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10841" + }, + { + "type": "WEB", + "url": "https://github.com/2537463005/a/blob/main/WEB-Sekolah%E5%90%8E%E5%8F%B0%E5%AD%98%E5%82%A8%E5%9E%8Bxss.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283087" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283087" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-707" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T14:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-4fw5-75q7-v8g7/GHSA-4fw5-75q7-v8g7.json b/advisories/unreviewed/2024/11/GHSA-4fw5-75q7-v8g7/GHSA-4fw5-75q7-v8g7.json new file mode 100644 index 00000000000..050ee633f30 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-4fw5-75q7-v8g7/GHSA-4fw5-75q7-v8g7.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4fw5-75q7-v8g7", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-50996" + ], + "details": "Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the bpa_server parameter at genie_bpa.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50996" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_37/37.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-4r2j-6r55-j9g2/GHSA-4r2j-6r55-j9g2.json b/advisories/unreviewed/2024/11/GHSA-4r2j-6r55-j9g2/GHSA-4r2j-6r55-j9g2.json new file mode 100644 index 00000000000..fea5ddc966d --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-4r2j-6r55-j9g2/GHSA-4r2j-6r55-j9g2.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4r2j-6r55-j9g2", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-52018" + ], + "details": "Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name parameter at genie_dyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52018" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_53/53.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-5fv9-2vmx-f4m6/GHSA-5fv9-2vmx-f4m6.json b/advisories/unreviewed/2024/11/GHSA-5fv9-2vmx-f4m6/GHSA-5fv9-2vmx-f4m6.json new file mode 100644 index 00000000000..acef41b6466 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-5fv9-2vmx-f4m6/GHSA-5fv9-2vmx-f4m6.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5fv9-2vmx-f4m6", + "modified": "2024-11-05T15:30:34Z", + "published": "2024-11-05T15:30:34Z", + "aliases": [ + "CVE-2024-10840" + ], + "details": "A vulnerability classified as problematic has been found in romadebrian WEB-Sekolah 1.0. Affected is an unknown function of the file /Admin/akun_edit.php of the component Backend. The manipulation of the argument kode leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10840" + }, + { + "type": "WEB", + "url": "https://github.com/2537463005/a/blob/main/WEB-Sekolah%E5%90%8E%E5%8F%B0%E5%AD%98%E5%82%A8%E5%9E%8Bxss.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283086" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283086" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-707" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T13:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-5q3c-q96r-vr6x/GHSA-5q3c-q96r-vr6x.json b/advisories/unreviewed/2024/11/GHSA-5q3c-q96r-vr6x/GHSA-5q3c-q96r-vr6x.json new file mode 100644 index 00000000000..44849224623 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-5q3c-q96r-vr6x/GHSA-5q3c-q96r-vr6x.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5q3c-q96r-vr6x", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51001" + ], + "details": "Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the sysDNSHost parameter at ddns.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51001" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_41/41.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-5x44-vxm3-fqv4/GHSA-5x44-vxm3-fqv4.json b/advisories/unreviewed/2024/11/GHSA-5x44-vxm3-fqv4/GHSA-5x44-vxm3-fqv4.json new file mode 100644 index 00000000000..ba2a706e520 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-5x44-vxm3-fqv4/GHSA-5x44-vxm3-fqv4.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5x44-vxm3-fqv4", + "modified": "2024-11-05T15:30:36Z", + "published": "2024-11-05T15:30:36Z", + "aliases": [ + "CVE-2024-50995" + ], + "details": "Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the share_name parameter at usb_remote_smb_conf.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50995" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_40/40.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-683q-j7j9-j863/GHSA-683q-j7j9-j863.json b/advisories/unreviewed/2024/11/GHSA-683q-j7j9-j863/GHSA-683q-j7j9-j863.json new file mode 100644 index 00000000000..8ad9cc4316f --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-683q-j7j9-j863/GHSA-683q-j7j9-j863.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-683q-j7j9-j863", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51007" + ], + "details": "Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at wireless.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51007" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_54/54.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-79wp-x2px-mc9v/GHSA-79wp-x2px-mc9v.json b/advisories/unreviewed/2024/11/GHSA-79wp-x2px-mc9v/GHSA-79wp-x2px-mc9v.json new file mode 100644 index 00000000000..ae74ce2d234 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-79wp-x2px-mc9v/GHSA-79wp-x2px-mc9v.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-79wp-x2px-mc9v", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-52023" + ], + "details": "Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at pppoe2.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52023" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_52/52.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-7h26-mwqv-pxpv/GHSA-7h26-mwqv-pxpv.json b/advisories/unreviewed/2024/11/GHSA-7h26-mwqv-pxpv/GHSA-7h26-mwqv-pxpv.json new file mode 100644 index 00000000000..3a45e197c09 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-7h26-mwqv-pxpv/GHSA-7h26-mwqv-pxpv.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7h26-mwqv-pxpv", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-52029" + ], + "details": "Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at genie_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52029" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_60/60.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-7mpv-9qrc-wxrj/GHSA-7mpv-9qrc-wxrj.json b/advisories/unreviewed/2024/11/GHSA-7mpv-9qrc-wxrj/GHSA-7mpv-9qrc-wxrj.json new file mode 100644 index 00000000000..f8161e70b6e --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-7mpv-9qrc-wxrj/GHSA-7mpv-9qrc-wxrj.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7mpv-9qrc-wxrj", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51017" + ], + "details": "Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the l2tp_user_netmask parameter at l2tp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51017" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_59/59.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-88m6-45c8-3f97/GHSA-88m6-45c8-3f97.json b/advisories/unreviewed/2024/11/GHSA-88m6-45c8-3f97/GHSA-88m6-45c8-3f97.json new file mode 100644 index 00000000000..46ed0f3bda6 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-88m6-45c8-3f97/GHSA-88m6-45c8-3f97.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-88m6-45c8-3f97", + "modified": "2024-11-05T15:30:34Z", + "published": "2024-11-05T15:30:34Z", + "aliases": [ + "CVE-2024-10329" + ], + "details": "The Ultimate Bootstrap Elements for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6 via the 'ube_get_page_templates' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the contents of templates that are private.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10329" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/ultimate-bootstrap-elements-for-elementor/trunk/inc/functions/core.php#L239" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3176562" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3af83ec2-9ebb-4cca-8523-8fe9b1517825?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T14:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-8cmh-6vqw-c3j2/GHSA-8cmh-6vqw-c3j2.json b/advisories/unreviewed/2024/11/GHSA-8cmh-6vqw-c3j2/GHSA-8cmh-6vqw-c3j2.json new file mode 100644 index 00000000000..b4fa2cb38a3 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-8cmh-6vqw-c3j2/GHSA-8cmh-6vqw-c3j2.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8cmh-6vqw-c3j2", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-50997" + ], + "details": "Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip parameter at pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50997" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_43/43.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-8vx7-5vg4-3p7c/GHSA-8vx7-5vg4-3p7c.json b/advisories/unreviewed/2024/11/GHSA-8vx7-5vg4-3p7c/GHSA-8vx7-5vg4-3p7c.json new file mode 100644 index 00000000000..1902da9acd7 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-8vx7-5vg4-3p7c/GHSA-8vx7-5vg4-3p7c.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8vx7-5vg4-3p7c", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51022" + ], + "details": "Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the ssid parameter in bridge_wireless_main.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51022" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_55/55.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-927w-m77q-8hq6/GHSA-927w-m77q-8hq6.json b/advisories/unreviewed/2024/11/GHSA-927w-m77q-8hq6/GHSA-927w-m77q-8hq6.json new file mode 100644 index 00000000000..3b293e5904d --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-927w-m77q-8hq6/GHSA-927w-m77q-8hq6.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-927w-m77q-8hq6", + "modified": "2024-11-05T15:30:36Z", + "published": "2024-11-05T15:30:36Z", + "aliases": [ + "CVE-2024-50994" + ], + "details": "Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component ipv6_fix.cgi via the ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, and ipv6_lan_length parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50994" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_36/36.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-986m-4392-3r23/GHSA-986m-4392-3r23.json b/advisories/unreviewed/2024/11/GHSA-986m-4392-3r23/GHSA-986m-4392-3r23.json new file mode 100644 index 00000000000..4d7ec00924f --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-986m-4392-3r23/GHSA-986m-4392-3r23.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-986m-4392-3r23", + "modified": "2024-11-05T15:30:36Z", + "published": "2024-11-05T15:30:36Z", + "aliases": [ + "CVE-2024-10845" + ], + "details": "A vulnerability has been found in 1000 Projects Bookstore Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file book_detail.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10845" + }, + { + "type": "WEB", + "url": "https://github.com/hbuzs/CVE/issues/3" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283090" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283090" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.436999" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-707" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-c5r9-g2wg-76jp/GHSA-c5r9-g2wg-76jp.json b/advisories/unreviewed/2024/11/GHSA-c5r9-g2wg-76jp/GHSA-c5r9-g2wg-76jp.json new file mode 100644 index 00000000000..db4e0437bfc --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-c5r9-g2wg-76jp/GHSA-c5r9-g2wg-76jp.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c5r9-g2wg-76jp", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51003" + ], + "details": "Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multiple stack overflow vulnerabilities in the component ap_mode.cgi via the apmode_dns1_pri and apmode_dns1_sec parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51003" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_49/49.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-c6x8-9hqx-m583/GHSA-c6x8-9hqx-m583.json b/advisories/unreviewed/2024/11/GHSA-c6x8-9hqx-m583/GHSA-c6x8-9hqx-m583.json new file mode 100644 index 00000000000..1574842dbe6 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-c6x8-9hqx-m583/GHSA-c6x8-9hqx-m583.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c6x8-9hqx-m583", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-51023" + ], + "details": "D-Link DIR_823G 1.0.2B05 was discovered to contain a command injection vulnerability via the Address parameter in the SetNetworkTomographySettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51023" + }, + { + "type": "WEB", + "url": "https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_42/42.md" + }, + { + "type": "WEB", + "url": "https://www.dlink.com/en/security-bulletin" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-cggp-gq97-wfj7/GHSA-cggp-gq97-wfj7.json b/advisories/unreviewed/2024/11/GHSA-cggp-gq97-wfj7/GHSA-cggp-gq97-wfj7.json new file mode 100644 index 00000000000..706dc4f11a4 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-cggp-gq97-wfj7/GHSA-cggp-gq97-wfj7.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cggp-gq97-wfj7", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-52013" + ], + "details": "Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip parameter at wiz_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52013" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_43/43.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-cmv3-c9g2-j3g5/GHSA-cmv3-c9g2-j3g5.json b/advisories/unreviewed/2024/11/GHSA-cmv3-c9g2-j3g5/GHSA-cmv3-c9g2-j3g5.json new file mode 100644 index 00000000000..1e78a3b7e66 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-cmv3-c9g2-j3g5/GHSA-cmv3-c9g2-j3g5.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cmv3-c9g2-j3g5", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51006" + ], + "details": "Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the ipv6_static_ip parameter in the ipv6_tunnel function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51006" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_46/46.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-cv53-45x5-8276/GHSA-cv53-45x5-8276.json b/advisories/unreviewed/2024/11/GHSA-cv53-45x5-8276/GHSA-cv53-45x5-8276.json new file mode 100644 index 00000000000..c1e453a6334 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-cv53-45x5-8276/GHSA-cv53-45x5-8276.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cv53-45x5-8276", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-52021" + ], + "details": "Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at bsw_fix.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52021" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_47/47.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-cwr8-h375-g4q5/GHSA-cwr8-h375-g4q5.json b/advisories/unreviewed/2024/11/GHSA-cwr8-h375-g4q5/GHSA-cwr8-h375-g4q5.json new file mode 100644 index 00000000000..0671d252381 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-cwr8-h375-g4q5/GHSA-cwr8-h375-g4q5.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cwr8-h375-g4q5", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51008" + ], + "details": "Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name parameter at wiz_dyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51008" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_53/53.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-cx3q-ggpf-wqc5/GHSA-cx3q-ggpf-wqc5.json b/advisories/unreviewed/2024/11/GHSA-cx3q-ggpf-wqc5/GHSA-cx3q-ggpf-wqc5.json new file mode 100644 index 00000000000..ae44aac05f4 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-cx3q-ggpf-wqc5/GHSA-cx3q-ggpf-wqc5.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cx3q-ggpf-wqc5", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51019" + ], + "details": "Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pppoe_localnetmask parameter at pppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51019" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_61/61.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-frj8-xg2w-q7rw/GHSA-frj8-xg2w-q7rw.json b/advisories/unreviewed/2024/11/GHSA-frj8-xg2w-q7rw/GHSA-frj8-xg2w-q7rw.json new file mode 100644 index 00000000000..2b46b7b9547 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-frj8-xg2w-q7rw/GHSA-frj8-xg2w-q7rw.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-frj8-xg2w-q7rw", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-52020" + ], + "details": "Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at wiz_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52020" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_47/47.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-g6xg-7v4w-32vg/GHSA-g6xg-7v4w-32vg.json b/advisories/unreviewed/2024/11/GHSA-g6xg-7v4w-32vg/GHSA-g6xg-7v4w-32vg.json new file mode 100644 index 00000000000..bccb778289e --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-g6xg-7v4w-32vg/GHSA-g6xg-7v4w-32vg.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g6xg-7v4w-32vg", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51020" + ], + "details": "Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the apn parameter at usbISP_detail_edit.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51020" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_63/63.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-gg8c-h9qw-qwrh/GHSA-gg8c-h9qw-qwrh.json b/advisories/unreviewed/2024/11/GHSA-gg8c-h9qw-qwrh/GHSA-gg8c-h9qw-qwrh.json new file mode 100644 index 00000000000..83238b18cd0 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-gg8c-h9qw-qwrh/GHSA-gg8c-h9qw-qwrh.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gg8c-h9qw-qwrh", + "modified": "2024-11-05T15:30:35Z", + "published": "2024-11-05T15:30:35Z", + "aliases": [ + "CVE-2023-29115" + ], + "details": "In certain conditions a request directed to the Waybox Enel X Web management application could cause a denial-of-service (e.g. reboot).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29115" + }, + { + "type": "WEB", + "url": "https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-gv3h-6f48-rrfp/GHSA-gv3h-6f48-rrfp.json b/advisories/unreviewed/2024/11/GHSA-gv3h-6f48-rrfp/GHSA-gv3h-6f48-rrfp.json new file mode 100644 index 00000000000..3eafced2b94 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-gv3h-6f48-rrfp/GHSA-gv3h-6f48-rrfp.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gv3h-6f48-rrfp", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-52022" + ], + "details": "Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component wlg_adv.cgi via the apmode_gateway parameter. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52022" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_48/48.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-gw9j-jrgv-94wc/GHSA-gw9j-jrgv-94wc.json b/advisories/unreviewed/2024/11/GHSA-gw9j-jrgv-94wc/GHSA-gw9j-jrgv-94wc.json new file mode 100644 index 00000000000..5dab9be0e7b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-gw9j-jrgv-94wc/GHSA-gw9j-jrgv-94wc.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gw9j-jrgv-94wc", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51000" + ], + "details": "Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component wireless.cgi via the opmode, opmode_an, and opmode_an_2 parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51000" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_35/35.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-h4jp-rw7w-8x59/GHSA-h4jp-rw7w-8x59.json b/advisories/unreviewed/2024/11/GHSA-h4jp-rw7w-8x59/GHSA-h4jp-rw7w-8x59.json new file mode 100644 index 00000000000..22e90ef1181 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-h4jp-rw7w-8x59/GHSA-h4jp-rw7w-8x59.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h4jp-rw7w-8x59", + "modified": "2024-11-05T15:30:34Z", + "published": "2024-11-05T15:30:34Z", + "aliases": [ + "CVE-2024-7059" + ], + "details": "A high-severity vulnerability that can lead to arbitrary code execution on the system hosting the Web SDK role was found in the Genetec Security Center product line.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7059" + }, + { + "type": "WEB", + "url": "https://resources.genetec.com/security-advisories/high-severity-vulnerability-affecting-security-center-web-sdk-role" + }, + { + "type": "WEB", + "url": "https://ressources.genetec.com/bulletins-de-securite/vulnerabilite-de-haute-severite-affectant-le-role-sdk-web-de-security-center" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-470" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T13:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hm8p-5985-v4pm/GHSA-hm8p-5985-v4pm.json b/advisories/unreviewed/2024/11/GHSA-hm8p-5985-v4pm/GHSA-hm8p-5985-v4pm.json new file mode 100644 index 00000000000..2f519f90f61 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-hm8p-5985-v4pm/GHSA-hm8p-5985-v4pm.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hm8p-5985-v4pm", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51014" + ], + "details": "Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the ssid_an parameter in bridge_wireless_main.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51014" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_56/56.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hv6q-xm2j-9hqv/GHSA-hv6q-xm2j-9hqv.json b/advisories/unreviewed/2024/11/GHSA-hv6q-xm2j-9hqv/GHSA-hv6q-xm2j-9hqv.json new file mode 100644 index 00000000000..0372562f641 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-hv6q-xm2j-9hqv/GHSA-hv6q-xm2j-9hqv.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hv6q-xm2j-9hqv", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-51024" + ], + "details": "D-Link DIR_823G 1.0.2B05 was discovered to contain a command injection vulnerability via the HostName parameter in the SetWanSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51024" + }, + { + "type": "WEB", + "url": "https://github.com/pjqwudi1/my_vuln/blob/main/D-link4/vuln_43/43.md" + }, + { + "type": "WEB", + "url": "https://www.dlink.com/en/security-bulletin" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-j6w2-m443-3c2h/GHSA-j6w2-m443-3c2h.json b/advisories/unreviewed/2024/11/GHSA-j6w2-m443-3c2h/GHSA-j6w2-m443-3c2h.json new file mode 100644 index 00000000000..54f64370bec --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-j6w2-m443-3c2h/GHSA-j6w2-m443-3c2h.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j6w2-m443-3c2h", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-50999" + ], + "details": "Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at password.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50999" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_38/38.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-jcvh-w2rh-mxx9/GHSA-jcvh-w2rh-mxx9.json b/advisories/unreviewed/2024/11/GHSA-jcvh-w2rh-mxx9/GHSA-jcvh-w2rh-mxx9.json new file mode 100644 index 00000000000..60195bb8bda --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-jcvh-w2rh-mxx9/GHSA-jcvh-w2rh-mxx9.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jcvh-w2rh-mxx9", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51004" + ], + "details": "Netgear R8500 v1.0.2.160 and R7000P v1.3.3.154 were discovered to multiple stack overflow vulnerabilities in the component usb_device.cgi via the cifs_user, read_access, and write_access parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51004" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_51/51.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-jrj5-q7r9-2m35/GHSA-jrj5-q7r9-2m35.json b/advisories/unreviewed/2024/11/GHSA-jrj5-q7r9-2m35/GHSA-jrj5-q7r9-2m35.json new file mode 100644 index 00000000000..a65fb6ec25b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-jrj5-q7r9-2m35/GHSA-jrj5-q7r9-2m35.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jrj5-q7r9-2m35", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51002" + ], + "details": "Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the l2tp_user_ip parameter at l2tp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51002" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_42/42.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-jvqw-pf7r-4f2p/GHSA-jvqw-pf7r-4f2p.json b/advisories/unreviewed/2024/11/GHSA-jvqw-pf7r-4f2p/GHSA-jvqw-pf7r-4f2p.json new file mode 100644 index 00000000000..22844e6a2b1 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-jvqw-pf7r-4f2p/GHSA-jvqw-pf7r-4f2p.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jvqw-pf7r-4f2p", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51018" + ], + "details": "Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51018" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_60/60.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-m2pm-j5cr-9fm9/GHSA-m2pm-j5cr-9fm9.json b/advisories/unreviewed/2024/11/GHSA-m2pm-j5cr-9fm9/GHSA-m2pm-j5cr-9fm9.json new file mode 100644 index 00000000000..eb82e1a5960 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-m2pm-j5cr-9fm9/GHSA-m2pm-j5cr-9fm9.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m2pm-j5cr-9fm9", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-51021" + ], + "details": "Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a command injection vulnerability via the wan_gateway parameter at genie_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51021" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_57/57.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-m3v4-qcj6-c3h3/GHSA-m3v4-qcj6-c3h3.json b/advisories/unreviewed/2024/11/GHSA-m3v4-qcj6-c3h3/GHSA-m3v4-qcj6-c3h3.json index b2c82263887..f01ef72a475 100644 --- a/advisories/unreviewed/2024/11/GHSA-m3v4-qcj6-c3h3/GHSA-m3v4-qcj6-c3h3.json +++ b/advisories/unreviewed/2024/11/GHSA-m3v4-qcj6-c3h3/GHSA-m3v4-qcj6-c3h3.json @@ -48,7 +48,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-121" + "CWE-121", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-m9fp-x7x4-9799/GHSA-m9fp-x7x4-9799.json b/advisories/unreviewed/2024/11/GHSA-m9fp-x7x4-9799/GHSA-m9fp-x7x4-9799.json new file mode 100644 index 00000000000..2cb2c992746 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-m9fp-x7x4-9799/GHSA-m9fp-x7x4-9799.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m9fp-x7x4-9799", + "modified": "2024-11-05T15:30:35Z", + "published": "2024-11-05T15:30:35Z", + "aliases": [ + "CVE-2023-29114" + ], + "details": "System logs could be accessed through web management application due to a lack of access control.\n\n\nAn attacker can obtain the following sensitive information:\n\n•     Wi-Fi access point credentials to which the EV charger can connect.\n\n•     APN web address and credentials.\n\n•     IPSEC credentials.\n\n•     Web interface access credentials for user and admin accounts.\n\n•     JuiceBox system components (software installed, model, firmware version, etc.).\n\n•     C2G configuration details.\n\n•     Internal IP addresses.\n\n•     OTA firmware update configurations (DNS servers).\n\nAll the credentials are stored in logs in an unencrypted plaintext format.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29114" + }, + { + "type": "WEB", + "url": "https://support-emobility.enelx.com/content/dam/enelxmobility/italia/documenti/manuali-schede-tecniche/Waybox-3-Security-Bulletin-06-2024-V1.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-p3qx-8gpx-2q8q/GHSA-p3qx-8gpx-2q8q.json b/advisories/unreviewed/2024/11/GHSA-p3qx-8gpx-2q8q/GHSA-p3qx-8gpx-2q8q.json new file mode 100644 index 00000000000..ee68645154d --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-p3qx-8gpx-2q8q/GHSA-p3qx-8gpx-2q8q.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p3qx-8gpx-2q8q", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51011" + ], + "details": "Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at pppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51011" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_52/52.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-p597-59q3-qvc8/GHSA-p597-59q3-qvc8.json b/advisories/unreviewed/2024/11/GHSA-p597-59q3-qvc8/GHSA-p597-59q3-qvc8.json new file mode 100644 index 00000000000..78556e72055 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-p597-59q3-qvc8/GHSA-p597-59q3-qvc8.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p597-59q3-qvc8", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51009" + ], + "details": "Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at ether.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51009" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_47/47.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-pf38-5qmv-cmhv/GHSA-pf38-5qmv-cmhv.json b/advisories/unreviewed/2024/11/GHSA-pf38-5qmv-cmhv/GHSA-pf38-5qmv-cmhv.json new file mode 100644 index 00000000000..9e33d64fabb --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-pf38-5qmv-cmhv/GHSA-pf38-5qmv-cmhv.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pf38-5qmv-cmhv", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51010" + ], + "details": "Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component ap_mode.cgi via the apmode_gateway parameter. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51010" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_48/48.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-pjg9-f4hq-p885/GHSA-pjg9-f4hq-p885.json b/advisories/unreviewed/2024/11/GHSA-pjg9-f4hq-p885/GHSA-pjg9-f4hq-p885.json new file mode 100644 index 00000000000..d097d79ab9d --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-pjg9-f4hq-p885/GHSA-pjg9-f4hq-p885.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pjg9-f4hq-p885", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51016" + ], + "details": "Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the addName%d parameter in usb_approve.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51016" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_58/58.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-pr2f-gqh3-f57w/GHSA-pr2f-gqh3-f57w.json b/advisories/unreviewed/2024/11/GHSA-pr2f-gqh3-f57w/GHSA-pr2f-gqh3-f57w.json new file mode 100644 index 00000000000..ec38d667a42 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-pr2f-gqh3-f57w/GHSA-pr2f-gqh3-f57w.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pr2f-gqh3-f57w", + "modified": "2024-11-05T15:30:34Z", + "published": "2024-11-05T15:30:34Z", + "aliases": [ + "CVE-2024-10263" + ], + "details": "The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.4. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10263" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3179272/tickera-event-ticketing-system" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6e5e9249-9705-4cfa-9c8e-2e002190562b?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T13:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-pwwg-vrcr-33hq/GHSA-pwwg-vrcr-33hq.json b/advisories/unreviewed/2024/11/GHSA-pwwg-vrcr-33hq/GHSA-pwwg-vrcr-33hq.json new file mode 100644 index 00000000000..0b93f67fdc8 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-pwwg-vrcr-33hq/GHSA-pwwg-vrcr-33hq.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pwwg-vrcr-33hq", + "modified": "2024-11-05T15:30:36Z", + "published": "2024-11-05T15:30:36Z", + "aliases": [ + "CVE-2024-10844" + ], + "details": "A vulnerability, which was classified as critical, was found in 1000 Projects Bookstore Management System 1.0. This affects an unknown part of the file search.php. The manipulation of the argument s leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10844" + }, + { + "type": "WEB", + "url": "https://github.com/sbm-98/CVE/issues/1" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283089" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283089" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.436969" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-707" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-q7wx-38r3-hr6h/GHSA-q7wx-38r3-hr6h.json b/advisories/unreviewed/2024/11/GHSA-q7wx-38r3-hr6h/GHSA-q7wx-38r3-hr6h.json new file mode 100644 index 00000000000..3b80b889edd --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-q7wx-38r3-hr6h/GHSA-q7wx-38r3-hr6h.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q7wx-38r3-hr6h", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51012" + ], + "details": "Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the ipv6_pri_dns parameter at ipv6_fix.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51012" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_45/45.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-qmvj-5x98-pxr6/GHSA-qmvj-5x98-pxr6.json b/advisories/unreviewed/2024/11/GHSA-qmvj-5x98-pxr6/GHSA-qmvj-5x98-pxr6.json new file mode 100644 index 00000000000..7e136bf51d7 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-qmvj-5x98-pxr6/GHSA-qmvj-5x98-pxr6.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qmvj-5x98-pxr6", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-52030" + ], + "details": "Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at ru_wan_flow.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52030" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_60/60.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-r8p4-whj5-6jwg/GHSA-r8p4-whj5-6jwg.json b/advisories/unreviewed/2024/11/GHSA-r8p4-whj5-6jwg/GHSA-r8p4-whj5-6jwg.json new file mode 100644 index 00000000000..8bfdc862086 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-r8p4-whj5-6jwg/GHSA-r8p4-whj5-6jwg.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r8p4-whj5-6jwg", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-52016" + ], + "details": "Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to multiple stack overflow vulnerabilities in the component wlg_adv.cgi via the apmode_dns1_pri and apmode_dns1_sec parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52016" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_49/49.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-rcj3-p7jf-6xjp/GHSA-rcj3-p7jf-6xjp.json b/advisories/unreviewed/2024/11/GHSA-rcj3-p7jf-6xjp/GHSA-rcj3-p7jf-6xjp.json new file mode 100644 index 00000000000..4cb59468d8c --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-rcj3-p7jf-6xjp/GHSA-rcj3-p7jf-6xjp.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rcj3-p7jf-6xjp", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-52026" + ], + "details": "Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at bsw_pppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52026" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_52/52.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-rprp-m5gh-mh5c/GHSA-rprp-m5gh-mh5c.json b/advisories/unreviewed/2024/11/GHSA-rprp-m5gh-mh5c/GHSA-rprp-m5gh-mh5c.json new file mode 100644 index 00000000000..d4fcb991a13 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-rprp-m5gh-mh5c/GHSA-rprp-m5gh-mh5c.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rprp-m5gh-mh5c", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51005" + ], + "details": "Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the share_name parameter at usb_remote_smb_conf.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51005" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_50/50.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-rvr8-cw39-527c/GHSA-rvr8-cw39-527c.json b/advisories/unreviewed/2024/11/GHSA-rvr8-cw39-527c/GHSA-rvr8-cw39-527c.json new file mode 100644 index 00000000000..878f611fad5 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-rvr8-cw39-527c/GHSA-rvr8-cw39-527c.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rvr8-cw39-527c", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-52024" + ], + "details": "Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at wizpppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52024" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_52/52.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-v3c2-xj8g-4r72/GHSA-v3c2-xj8g-4r72.json b/advisories/unreviewed/2024/11/GHSA-v3c2-xj8g-4r72/GHSA-v3c2-xj8g-4r72.json new file mode 100644 index 00000000000..a26f7769fa8 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-v3c2-xj8g-4r72/GHSA-v3c2-xj8g-4r72.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v3c2-xj8g-4r72", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-50998" + ], + "details": "Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component openvpn.cgi via the openvpn_service_port and openvpn_service_port_tun parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50998" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_44/44.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-v7wq-2339-37p8/GHSA-v7wq-2339-37p8.json b/advisories/unreviewed/2024/11/GHSA-v7wq-2339-37p8/GHSA-v7wq-2339-37p8.json new file mode 100644 index 00000000000..f97ace49431 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-v7wq-2339-37p8/GHSA-v7wq-2339-37p8.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v7wq-2339-37p8", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-52025" + ], + "details": "Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at geniepppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52025" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_52/52.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vc49-qqxj-g453/GHSA-vc49-qqxj-g453.json b/advisories/unreviewed/2024/11/GHSA-vc49-qqxj-g453/GHSA-vc49-qqxj-g453.json new file mode 100644 index 00000000000..091a92be06b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-vc49-qqxj-g453/GHSA-vc49-qqxj-g453.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vc49-qqxj-g453", + "modified": "2024-11-05T15:30:35Z", + "published": "2024-11-05T15:30:35Z", + "aliases": [ + "CVE-2024-10842" + ], + "details": "A vulnerability, which was classified as problematic, has been found in romadebrian WEB-Sekolah 1.0. Affected by this issue is some unknown functionality of the file /Admin/Proses_Edit_Akun.php of the component Backend. The manipulation of the argument Username_Baru/Password leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10842" + }, + { + "type": "WEB", + "url": "https://github.com/2537463005/a/blob/main/WEB-Sekolah%E5%90%8E%E5%8F%B0%E5%AD%98%E5%82%A8%E5%9E%8Bxss.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283088" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283088" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.429558" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-707" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T14:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vg97-cmqr-w7w5/GHSA-vg97-cmqr-w7w5.json b/advisories/unreviewed/2024/11/GHSA-vg97-cmqr-w7w5/GHSA-vg97-cmqr-w7w5.json new file mode 100644 index 00000000000..c314b1465eb --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-vg97-cmqr-w7w5/GHSA-vg97-cmqr-w7w5.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vg97-cmqr-w7w5", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-52017" + ], + "details": "Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at bridge_wireless_main.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52017" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear5/vuln_54/54.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vhp8-3pj4-3mvp/GHSA-vhp8-3pj4-3mvp.json b/advisories/unreviewed/2024/11/GHSA-vhp8-3pj4-3mvp/GHSA-vhp8-3pj4-3mvp.json new file mode 100644 index 00000000000..3ec4a04d1a2 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-vhp8-3pj4-3mvp/GHSA-vhp8-3pj4-3mvp.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vhp8-3pj4-3mvp", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-52028" + ], + "details": "Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at wiz_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52028" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_60/60.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vvg3-j47v-x7p2/GHSA-vvg3-j47v-x7p2.json b/advisories/unreviewed/2024/11/GHSA-vvg3-j47v-x7p2/GHSA-vvg3-j47v-x7p2.json new file mode 100644 index 00000000000..5bc1d9471a9 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-vvg3-j47v-x7p2/GHSA-vvg3-j47v-x7p2.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vvg3-j47v-x7p2", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-52019" + ], + "details": "Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at genie_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52019" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_47/47.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w2rm-ghcp-rwrp/GHSA-w2rm-ghcp-rwrp.json b/advisories/unreviewed/2024/11/GHSA-w2rm-ghcp-rwrp/GHSA-w2rm-ghcp-rwrp.json new file mode 100644 index 00000000000..90132c9f0f3 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w2rm-ghcp-rwrp/GHSA-w2rm-ghcp-rwrp.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w2rm-ghcp-rwrp", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51013" + ], + "details": "Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the RADIUSAddr%d_wla parameter at wireless.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51013" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_64/64.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-wg7j-6r9g-jjch/GHSA-wg7j-6r9g-jjch.json b/advisories/unreviewed/2024/11/GHSA-wg7j-6r9g-jjch/GHSA-wg7j-6r9g-jjch.json new file mode 100644 index 00000000000..90ddd26ca9d --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-wg7j-6r9g-jjch/GHSA-wg7j-6r9g-jjch.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wg7j-6r9g-jjch", + "modified": "2024-11-05T15:30:37Z", + "published": "2024-11-05T15:30:37Z", + "aliases": [ + "CVE-2024-51015" + ], + "details": "Netgear R7000P v1.3.3.154 was discovered to contain a command injection vulnerability via the device_name2 parameter at operation_mode.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51015" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear6/vuln_62/62.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-xf32-4q4v-xc47/GHSA-xf32-4q4v-xc47.json b/advisories/unreviewed/2024/11/GHSA-xf32-4q4v-xc47/GHSA-xf32-4q4v-xc47.json new file mode 100644 index 00000000000..4d315e88d9a --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-xf32-4q4v-xc47/GHSA-xf32-4q4v-xc47.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xf32-4q4v-xc47", + "modified": "2024-11-05T15:30:38Z", + "published": "2024-11-05T15:30:38Z", + "aliases": [ + "CVE-2024-52014" + ], + "details": "Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a stack overflow via the pptp_user_ip parameter at genie_pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52014" + }, + { + "type": "WEB", + "url": "https://github.com/wudipjq/my_vuln/blob/main/Netgear4/vuln_43/43.md" + }, + { + "type": "WEB", + "url": "https://www.netgear.com/about/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T15:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-xmg5-8cgx-r6mh/GHSA-xmg5-8cgx-r6mh.json b/advisories/unreviewed/2024/11/GHSA-xmg5-8cgx-r6mh/GHSA-xmg5-8cgx-r6mh.json index 03a7c0549a5..0f8268c91cd 100644 --- a/advisories/unreviewed/2024/11/GHSA-xmg5-8cgx-r6mh/GHSA-xmg5-8cgx-r6mh.json +++ b/advisories/unreviewed/2024/11/GHSA-xmg5-8cgx-r6mh/GHSA-xmg5-8cgx-r6mh.json @@ -48,7 +48,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-121" + "CWE-121", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false,