From 14fced448e90735ee6ecf62c7bc5008def991933 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 19 Sep 2024 09:37:32 +0000 Subject: [PATCH] Publish Advisories GHSA-j8gh-87rx-c7w9 GHSA-qqv8-ph7f-h3f7 GHSA-6f83-4pfw-m3vj GHSA-cjc3-7r36-pp49 GHSA-mxf3-c3v5-9jpv GHSA-prr3-v2fg-ggg7 GHSA-r7mf-5w8w-4x2h GHSA-xrp2-m33g-q2cv --- .../GHSA-j8gh-87rx-c7w9.json | 10 ++++- .../GHSA-qqv8-ph7f-h3f7.json | 10 ++++- .../GHSA-6f83-4pfw-m3vj.json | 38 +++++++++++++++++ .../GHSA-cjc3-7r36-pp49.json | 42 +++++++++++++++++++ .../GHSA-mxf3-c3v5-9jpv.json | 38 +++++++++++++++++ .../GHSA-prr3-v2fg-ggg7.json | 42 +++++++++++++++++++ .../GHSA-r7mf-5w8w-4x2h.json | 2 +- .../GHSA-xrp2-m33g-q2cv.json | 38 +++++++++++++++++ 8 files changed, 217 insertions(+), 3 deletions(-) create mode 100644 advisories/unreviewed/2024/09/GHSA-6f83-4pfw-m3vj/GHSA-6f83-4pfw-m3vj.json create mode 100644 advisories/unreviewed/2024/09/GHSA-cjc3-7r36-pp49/GHSA-cjc3-7r36-pp49.json create mode 100644 advisories/unreviewed/2024/09/GHSA-mxf3-c3v5-9jpv/GHSA-mxf3-c3v5-9jpv.json create mode 100644 advisories/unreviewed/2024/09/GHSA-prr3-v2fg-ggg7/GHSA-prr3-v2fg-ggg7.json create mode 100644 advisories/unreviewed/2024/09/GHSA-xrp2-m33g-q2cv/GHSA-xrp2-m33g-q2cv.json diff --git a/advisories/github-reviewed/2024/09/GHSA-j8gh-87rx-c7w9/GHSA-j8gh-87rx-c7w9.json b/advisories/github-reviewed/2024/09/GHSA-j8gh-87rx-c7w9/GHSA-j8gh-87rx-c7w9.json index e4e2f04aacf..38420e2b81b 100644 --- a/advisories/github-reviewed/2024/09/GHSA-j8gh-87rx-c7w9/GHSA-j8gh-87rx-c7w9.json +++ b/advisories/github-reviewed/2024/09/GHSA-j8gh-87rx-c7w9/GHSA-j8gh-87rx-c7w9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j8gh-87rx-c7w9", - "modified": "2024-09-19T03:30:31Z", + "modified": "2024-09-19T09:36:03Z", "published": "2024-09-17T00:31:06Z", "aliases": [ "CVE-2024-45496" @@ -48,6 +48,14 @@ "type": "WEB", "url": "https://github.com/openshift/openshift-controller-manager/commit/3af3628103f9ddc3b825e6e5243ec58e85311046" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:6687" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:6689" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:6691" diff --git a/advisories/github-reviewed/2024/09/GHSA-qqv8-ph7f-h3f7/GHSA-qqv8-ph7f-h3f7.json b/advisories/github-reviewed/2024/09/GHSA-qqv8-ph7f-h3f7/GHSA-qqv8-ph7f-h3f7.json index 80a400f01ab..f5a09f26108 100644 --- a/advisories/github-reviewed/2024/09/GHSA-qqv8-ph7f-h3f7/GHSA-qqv8-ph7f-h3f7.json +++ b/advisories/github-reviewed/2024/09/GHSA-qqv8-ph7f-h3f7/GHSA-qqv8-ph7f-h3f7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qqv8-ph7f-h3f7", - "modified": "2024-09-19T03:30:31Z", + "modified": "2024-09-19T09:36:03Z", "published": "2024-09-17T00:31:06Z", "aliases": [ "CVE-2024-7387" @@ -48,6 +48,14 @@ "type": "WEB", "url": "https://github.com/openshift/builder/commit/0b62633adfa2836465202bc851885e078ec888d1" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:6687" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:6689" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:6691" diff --git a/advisories/unreviewed/2024/09/GHSA-6f83-4pfw-m3vj/GHSA-6f83-4pfw-m3vj.json b/advisories/unreviewed/2024/09/GHSA-6f83-4pfw-m3vj/GHSA-6f83-4pfw-m3vj.json new file mode 100644 index 00000000000..37141894b3b --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-6f83-4pfw-m3vj/GHSA-6f83-4pfw-m3vj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6f83-4pfw-m3vj", + "modified": "2024-09-19T09:36:03Z", + "published": "2024-09-19T09:36:03Z", + "aliases": [ + "CVE-2024-47088" + ], + "details": "This vulnerability exists in Apex Softcell LD Geo due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack on login OTP, which could lead to gain unauthorized access to other user accounts.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47088" + }, + { + "type": "WEB", + "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0296" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-307" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-19T07:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-cjc3-7r36-pp49/GHSA-cjc3-7r36-pp49.json b/advisories/unreviewed/2024/09/GHSA-cjc3-7r36-pp49/GHSA-cjc3-7r36-pp49.json new file mode 100644 index 00000000000..e16dfaf958d --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-cjc3-7r36-pp49/GHSA-cjc3-7r36-pp49.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cjc3-7r36-pp49", + "modified": "2024-09-19T09:36:03Z", + "published": "2024-09-19T09:36:03Z", + "aliases": [ + "CVE-2024-45770" + ], + "details": "A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45770" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-45770" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310451" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-59" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-19T09:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-mxf3-c3v5-9jpv/GHSA-mxf3-c3v5-9jpv.json b/advisories/unreviewed/2024/09/GHSA-mxf3-c3v5-9jpv/GHSA-mxf3-c3v5-9jpv.json new file mode 100644 index 00000000000..31453fdc991 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-mxf3-c3v5-9jpv/GHSA-mxf3-c3v5-9jpv.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mxf3-c3v5-9jpv", + "modified": "2024-09-19T09:36:03Z", + "published": "2024-09-19T09:36:03Z", + "aliases": [ + "CVE-2024-47089" + ], + "details": "This vulnerability exists in the Apex Softcell LD Geo due to improper validation of the transaction token ID in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating the transaction token ID in the API request leading to unauthorized access and modification of transactions belonging to other users.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47089" + }, + { + "type": "WEB", + "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0296" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-354" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-19T07:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-prr3-v2fg-ggg7/GHSA-prr3-v2fg-ggg7.json b/advisories/unreviewed/2024/09/GHSA-prr3-v2fg-ggg7/GHSA-prr3-v2fg-ggg7.json new file mode 100644 index 00000000000..8bf9805465e --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-prr3-v2fg-ggg7/GHSA-prr3-v2fg-ggg7.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-prr3-v2fg-ggg7", + "modified": "2024-09-19T09:36:03Z", + "published": "2024-09-19T09:36:03Z", + "aliases": [ + "CVE-2024-45769" + ], + "details": "A vulnerability was found in Performance Co-Pilot (PCP).  This flaw allows an attacker to send specially crafted data to the system, which could cause the program to misbehave or crash.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45769" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-45769" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310452" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-19T09:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-r7mf-5w8w-4x2h/GHSA-r7mf-5w8w-4x2h.json b/advisories/unreviewed/2024/09/GHSA-r7mf-5w8w-4x2h/GHSA-r7mf-5w8w-4x2h.json index 40b3835bce2..491c923616f 100644 --- a/advisories/unreviewed/2024/09/GHSA-r7mf-5w8w-4x2h/GHSA-r7mf-5w8w-4x2h.json +++ b/advisories/unreviewed/2024/09/GHSA-r7mf-5w8w-4x2h/GHSA-r7mf-5w8w-4x2h.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-r7mf-5w8w-4x2h", - "modified": "2024-09-19T06:31:36Z", + "modified": "2024-09-19T09:36:03Z", "published": "2024-09-19T06:31:36Z", "aliases": [ "CVE-2024-47085" diff --git a/advisories/unreviewed/2024/09/GHSA-xrp2-m33g-q2cv/GHSA-xrp2-m33g-q2cv.json b/advisories/unreviewed/2024/09/GHSA-xrp2-m33g-q2cv/GHSA-xrp2-m33g-q2cv.json new file mode 100644 index 00000000000..2bce029bb3b --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-xrp2-m33g-q2cv/GHSA-xrp2-m33g-q2cv.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xrp2-m33g-q2cv", + "modified": "2024-09-19T09:36:03Z", + "published": "2024-09-19T09:36:03Z", + "aliases": [ + "CVE-2024-47087" + ], + "details": "This vulnerability exists in Apex Softcell LD Geo due to improper validation of the certain parameters (Client ID, DPID or BOID) in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating parameters in the API request body leading to exposure of sensitive information belonging to other users.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47087" + }, + { + "type": "WEB", + "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0296" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-359" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-19T07:15:02Z" + } +} \ No newline at end of file