From 15c16fbbde1e197f4c674d365da081c1c46dafd4 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 29 Apr 2024 00:31:42 +0000 Subject: [PATCH] Publish Advisories GHSA-3jf3-8c3v-79gx GHSA-7hpg-wrjj-gghq GHSA-7m59-rfr2-gh4p GHSA-r92g-h2wj-6rv5 --- .../GHSA-3jf3-8c3v-79gx.json | 31 ++++++++++++ .../GHSA-7hpg-wrjj-gghq.json | 6 ++- .../GHSA-7m59-rfr2-gh4p.json | 35 +++++++++++++ .../GHSA-r92g-h2wj-6rv5.json | 50 +++++++++++++++++++ 4 files changed, 121 insertions(+), 1 deletion(-) create mode 100644 advisories/unreviewed/2024/04/GHSA-3jf3-8c3v-79gx/GHSA-3jf3-8c3v-79gx.json create mode 100644 advisories/unreviewed/2024/04/GHSA-7m59-rfr2-gh4p/GHSA-7m59-rfr2-gh4p.json create mode 100644 advisories/unreviewed/2024/04/GHSA-r92g-h2wj-6rv5/GHSA-r92g-h2wj-6rv5.json diff --git a/advisories/unreviewed/2024/04/GHSA-3jf3-8c3v-79gx/GHSA-3jf3-8c3v-79gx.json b/advisories/unreviewed/2024/04/GHSA-3jf3-8c3v-79gx/GHSA-3jf3-8c3v-79gx.json new file mode 100644 index 00000000000..1687def7cc3 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-3jf3-8c3v-79gx/GHSA-3jf3-8c3v-79gx.json @@ -0,0 +1,31 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3jf3-8c3v-79gx", + "modified": "2024-04-29T00:30:42Z", + "published": "2024-04-29T00:30:42Z", + "aliases": [ + "CVE-2024-33331" + ], + "details": "Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-33891. Reason: This candidate is a reservation duplicate of CVE-2024-33891. Notes: All CVE users should reference CVE-2024-33891 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33331" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-28T23:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-7hpg-wrjj-gghq/GHSA-7hpg-wrjj-gghq.json b/advisories/unreviewed/2024/04/GHSA-7hpg-wrjj-gghq/GHSA-7hpg-wrjj-gghq.json index 57ceec15a30..d27dd9ae863 100644 --- a/advisories/unreviewed/2024/04/GHSA-7hpg-wrjj-gghq/GHSA-7hpg-wrjj-gghq.json +++ b/advisories/unreviewed/2024/04/GHSA-7hpg-wrjj-gghq/GHSA-7hpg-wrjj-gghq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7hpg-wrjj-gghq", - "modified": "2024-04-20T00:31:52Z", + "modified": "2024-04-29T00:30:40Z", "published": "2024-04-10T15:30:40Z", "aliases": [ "CVE-2024-31309" @@ -22,6 +22,10 @@ "type": "WEB", "url": "https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc" }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00021.html" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV" diff --git a/advisories/unreviewed/2024/04/GHSA-7m59-rfr2-gh4p/GHSA-7m59-rfr2-gh4p.json b/advisories/unreviewed/2024/04/GHSA-7m59-rfr2-gh4p/GHSA-7m59-rfr2-gh4p.json new file mode 100644 index 00000000000..2617c1c87f6 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-7m59-rfr2-gh4p/GHSA-7m59-rfr2-gh4p.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7m59-rfr2-gh4p", + "modified": "2024-04-29T00:30:42Z", + "published": "2024-04-29T00:30:42Z", + "aliases": [ + "CVE-2024-33899" + ], + "details": "RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33899" + }, + { + "type": "WEB", + "url": "https://www.rarlab.com/rarnew.htm" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-29T00:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-r92g-h2wj-6rv5/GHSA-r92g-h2wj-6rv5.json b/advisories/unreviewed/2024/04/GHSA-r92g-h2wj-6rv5/GHSA-r92g-h2wj-6rv5.json new file mode 100644 index 00000000000..5e0a54a8d8f --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-r92g-h2wj-6rv5/GHSA-r92g-h2wj-6rv5.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r92g-h2wj-6rv5", + "modified": "2024-04-29T00:30:42Z", + "published": "2024-04-29T00:30:42Z", + "aliases": [ + "CVE-2024-33891" + ], + "details": "Delinea Secret Server before 11.7.000001 allows attackers to bypass authentication via the SOAP API in SecretServer/webservices/SSWebService.asmx. This is related to a hardcoded key, the use of the integer 2 for the Admin user, and removal of the oauthExpirationId attribute.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33891" + }, + { + "type": "WEB", + "url": "https://delinea.com/products/secret-server" + }, + { + "type": "WEB", + "url": "https://docs.delinea.com/online-help/secret-server/release-notes/ss-rn-11-7-000001.htm" + }, + { + "type": "WEB", + "url": "https://straightblast.medium.com/all-your-secrets-are-belong-to-us-a-delinea-secret-server-authn-authz-bypass-adc26c800ad3" + }, + { + "type": "WEB", + "url": "https://trust.delinea.com/?tcuUid=17aaf4ef-ada9-46d5-bf97-abd3b07daae3" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-28T23:15:07Z" + } +} \ No newline at end of file