mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Advisory Database Sync
This commit is contained in:
advisory-database[bot]
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3jr7-qfmv-8m22",
|
||||
"modified": "2024-10-14T18:30:26Z",
|
||||
"published": "2024-10-14T18:30:26Z",
|
||||
"aliases": [
|
||||
"CVE-2024-48798"
|
||||
],
|
||||
"details": "An issue in Hubble Connected (com.hubbleconnected.vervelife) 2.00.81 allows a remote attacker to obtain sensitive information via the firmware update process.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48798"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.hubbleconnected.vervelife/com.hubbleconnected.vervelife.md"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://hubbleconnected.com"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T17:15:13Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3pc3-p9j7-xvq6",
|
||||
"modified": "2024-10-14T18:30:25Z",
|
||||
"published": "2024-10-14T18:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45737"
|
||||
],
|
||||
"details": "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could change the maintenance mode state of App Key Value Store (KVStore) through a Cross-Site Request Forgery (CSRF).",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45737"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://advisory.splunk.com/advisories/SVD-2024-1007"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://research.splunk.com/application/34bac267-a89b-4bd7-a072-a48eef1f15b8"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-352"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T17:15:12Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-443j-grxv-2pgv",
|
||||
"modified": "2024-10-14T18:30:25Z",
|
||||
"published": "2024-10-14T18:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2023-50780"
|
||||
],
|
||||
"details": "Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE.\n\n\nUsers are recommended to upgrade to version 2.29.0 or later, which fixes the issue.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50780"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://lists.apache.org/thread/63b78shqz312phsx7v1ryr7jv7bprg58"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-285"
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T16:15:03Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4vmx-gm8x-gpjr",
|
||||
"modified": "2024-10-14T18:30:25Z",
|
||||
"published": "2024-10-14T18:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45740"
|
||||
],
|
||||
"details": "In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could craft a malicious payload through Scheduled Views that could result in execution of unauthorized JavaScript code in the browser of a user.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45740"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://advisory.splunk.com/advisories/SVD-2024-1010"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://research.splunk.com/application/d4f55f7c-6518-4122-a197-951fe0f21b25"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T17:15:13Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-587p-xc7x-rjh8",
|
||||
"modified": "2024-10-14T18:30:25Z",
|
||||
"published": "2024-10-14T18:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45738"
|
||||
],
|
||||
"details": "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure could happen if you configure the Splunk Enterprise `REST_Calls` log channel at the DEBUG logging level.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45738"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://advisory.splunk.com/advisories/SVD-2024-1008"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://research.splunk.com/application/93dc7182-c5da-4085-82ec-401abf33d623"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-200"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T17:15:12Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-5f4q-95cp-q722",
|
||||
"modified": "2024-10-14T18:30:25Z",
|
||||
"published": "2024-10-14T18:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45735"
|
||||
],
|
||||
"details": "In Splunk Enterprise versions below 9.2.3 and 9.1.6, and Splunk Secure Gateway versions on Splunk Cloud Platform versions below 3.4.259, 3.6.17, and 3.7.0, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles can see App Key Value Store (KV Store) deployment configuration and public/private keys in the Splunk Secure Gateway App.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45735"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://advisory.splunk.com/advisories/SVD-2024-1005"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://research.splunk.com/application/0a3d6035-7bef-4dfa-b01e-84349edac3b4"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-284"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T17:15:12Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-5g3x-vvf6-gwg2",
|
||||
"modified": "2024-10-14T18:30:25Z",
|
||||
"published": "2024-10-14T18:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2024-48150"
|
||||
],
|
||||
"details": "D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_451208 function.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48150"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/fu37kola/cve/blob/main/D-Link/DIR-820L/D-Link%20DIR-820L%20Stack%20Overflow%20Vulnerability.md"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T16:15:03Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-72c9-vcqr-cxj8",
|
||||
"modified": "2024-10-14T18:30:26Z",
|
||||
"published": "2024-10-14T18:30:26Z",
|
||||
"aliases": [
|
||||
"CVE-2024-48797"
|
||||
],
|
||||
"details": "An issue in PCS Engineering Preston Cinema (com.prestoncinema.app) 0.2.0 allows a remote attacker to obtain sensitive information via the firmware update process.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48797"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.prestoncinema.app/com.prestoncinema.app.md"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.pcsengineering.net"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T17:15:13Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-7p24-phjr-m5fc",
|
||||
"modified": "2024-10-14T18:30:25Z",
|
||||
"published": "2024-10-14T18:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45732"
|
||||
],
|
||||
"details": "In Splunk Enterprise versions below 9.3.1, and 9.2.0 versions below 9.2.3, and Splunk Cloud Platform versions below 9.2.2403.103, 9.1.2312.200, 9.1.2312.110 and 9.1.2308.208, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could run a search as the \"nobody\" Splunk user in the SplunkDeploymentServerConfig app. This could let the low-privileged user access potentially restricted data.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45732"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://advisory.splunk.com/advisories/SVD-2024-1002"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://research.splunk.com/application/f765c3fe-c3b6-4afe-a932-11dd4f3a024f"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-862"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T17:15:11Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-8h7j-q956-7h6g",
|
||||
"modified": "2024-10-14T18:30:26Z",
|
||||
"published": "2024-10-14T18:30:26Z",
|
||||
"aliases": [
|
||||
"CVE-2024-48793"
|
||||
],
|
||||
"details": "An issue in INATRONIC com.inatronic.bmw 2.7.1 allows a remote attacker to obtain sensitive information via the firmware update process.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48793"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://drivedeck.de"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.inatronic.bmw/com.inatronic.bmw.md"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T18:15:05Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-8ppq-7m96-536p",
|
||||
"modified": "2024-10-14T18:30:26Z",
|
||||
"published": "2024-10-14T18:30:26Z",
|
||||
"aliases": [
|
||||
"CVE-2024-48799"
|
||||
],
|
||||
"details": "An issue in LOREX TECHNOLOGY INC com.lorexcorp.lorexping 1.4.22 allows a remote attacker to obtain sensitive information via the firmware update process.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48799"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.lorexcorp.lorexping/com.lorexcorp.lorexping.md"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.lorex.com"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T17:15:13Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-f98v-q2j5-v4qc",
|
||||
"modified": "2024-10-14T18:30:25Z",
|
||||
"published": "2024-10-14T18:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45733"
|
||||
],
|
||||
"details": "In Splunk Enterprise for Windows versions below 9.2.3 and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could perform a Remote Code Execution (RCE) due to an insecure session storage configuration.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45733"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://advisory.splunk.com/advisories/SVD-2024-1003"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://research.splunk.com/application/c97e0704-d9c6-454d-89ba-1510a987bf72"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-502"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T17:15:11Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-fj8g-7f3j-g879",
|
||||
"modified": "2024-10-14T18:30:26Z",
|
||||
"published": "2024-10-14T18:30:26Z",
|
||||
"aliases": [
|
||||
"CVE-2024-48791"
|
||||
],
|
||||
"details": "An issue in Plug n Play Camera com.starvedia.mCamView.zwave 5.5.1 allows a remote attacker to obtain sensitive information via the firmware update process",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48791"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.starvedia.mCamView.zwave/com.starvedia.mCamView.zwave.md"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.starvedia.com"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T18:15:05Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-fqcp-xv9m-hcq2",
|
||||
"modified": "2024-10-14T18:30:26Z",
|
||||
"published": "2024-10-14T18:30:26Z",
|
||||
"aliases": [
|
||||
"CVE-2024-46535"
|
||||
],
|
||||
"details": "Jepaas v7.2.8 was discovered to contain a SQL injection vulnerability via the orderSQL parameter at /homePortal/loadUserMsg.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46535"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://gitee.com/ketr/jepaas-release/issues/IAPJ8H?from=project-issue"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T17:15:13Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-j6xh-hx47-7x23",
|
||||
"modified": "2024-10-14T18:30:25Z",
|
||||
"published": "2024-10-14T18:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45731"
|
||||
],
|
||||
"details": "In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the \"admin\" or \"power\" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for Windows is installed on a separate drive.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45731"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://advisory.splunk.com/advisories/SVD-2024-1001"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://research.splunk.com/application/c97e0704-d9c6-454d-89ba-1510a987bf72"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-23"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T17:15:11Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-j9m2-gxgg-6g4q",
|
||||
"modified": "2024-10-14T18:30:26Z",
|
||||
"published": "2024-10-14T18:30:26Z",
|
||||
"aliases": [
|
||||
"CVE-2024-48796"
|
||||
],
|
||||
"details": "An issue in EQUES com.eques.plug 1.0.1 allows a remote attacker to obtain sensitive information via the firmware update process.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48796"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.eques.plug/com.eques.plug.md"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.eques.cn/?lang=en"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T17:15:13Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-m8vr-gvfq-cv5f",
|
||||
"modified": "2024-10-14T18:30:26Z",
|
||||
"published": "2024-10-14T18:30:26Z",
|
||||
"aliases": [
|
||||
"CVE-2024-48789"
|
||||
],
|
||||
"details": "An issue in INATRONIC com.inatronic.drivedeck.home 2.6.23 allows a remote attacker to obtain sensitve information via the firmware update process.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48789"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://drivedeck.de"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.inatronic.drivedeck.home/com.inatronic.drivedeck.home.md"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T18:15:05Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-p26r-gfgc-c47h",
|
||||
"modified": "2024-10-14T18:30:26Z",
|
||||
"published": "2024-10-14T18:30:26Z",
|
||||
"aliases": [
|
||||
"CVE-2024-46528"
|
||||
],
|
||||
"details": "An Insecure Direct Object Reference (IDOR) vulnerability in KubeSphere v3.4.1 and v4.1.1 allows low-privileged authenticated attackers to access sensitive resources without proper authorization checks.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46528"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://okankurtulus.com.tr/2024/09/09/idor-vulnerability-in-kubesphere"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://kubesphere.com"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T18:15:03Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-p7rw-j46f-fvpg",
|
||||
"modified": "2024-10-14T18:30:25Z",
|
||||
"published": "2024-10-14T18:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2024-48153"
|
||||
],
|
||||
"details": "DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_subconfig function.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48153"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/tw11ty/CVE/blob/main/DrayTek/Vigor3900/Vigor3900%20command%20execution%20vulnerability.md"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T16:15:03Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-p8rh-8mh7-w4xh",
|
||||
"modified": "2024-10-14T18:30:25Z",
|
||||
"published": "2024-10-14T18:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45739"
|
||||
],
|
||||
"details": "In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users. This exposure could happen when you configure the Splunk Enterprise AdminManager log channel at the DEBUG logging level.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45739"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://advisory.splunk.com/advisories/SVD-2024-1009"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://research.splunk.com/application/93dc7182-c5da-4085-82ec-401abf33d623"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-200"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-10-14T17:15:12Z"
|
||||
}
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user