From 23da8d5815cfc9059db018717f2501bf0cfbb47d Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 27 Nov 2024 18:35:20 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-mj5p-5fc7-225v.json | 4 +- .../GHSA-4cqh-vv5h-qg69.json | 6 +- .../GHSA-rww7-mm5m-vx73.json | 6 +- .../GHSA-w92h-gfcv-m7wv.json | 6 +- .../GHSA-xcf7-g637-p7f5.json | 6 +- .../GHSA-mg79-3wxp-f4x4.json | 6 +- .../GHSA-r3hw-f5jc-27w8.json | 4 +- .../GHSA-r7r5-2rqh-r972.json | 6 +- .../GHSA-g77x-hh5w-qpw7.json | 17 +++--- .../GHSA-j78w-6r6c-3p5g.json | 15 ++--- .../GHSA-m7f8-xj6j-5x9x.json | 15 ++--- .../GHSA-rmmj-g3w6-w438.json | 15 ++--- .../GHSA-wh8c-8787-2j2f.json | 15 ++--- .../GHSA-px3f-fc5j-2fqv.json | 10 ++-- .../GHSA-pq5w-h3jm-m95c.json | 10 ++-- .../GHSA-xqmw-9249-4m7x.json | 7 +-- .../GHSA-29fm-rc5r-j557.json | 15 ++--- .../GHSA-328f-543x-9jvg.json | 15 ++--- .../GHSA-4c64-c9rj-qw7x.json | 15 ++--- .../GHSA-4f2j-5xcx-5g9w.json | 15 ++--- .../GHSA-4grr-9vhg-g98w.json | 17 +++--- .../GHSA-4gwv-fpmg-cmv2.json | 29 +++++++++ .../GHSA-4jp9-q9g7-48gr.json | 15 ++--- .../GHSA-4xv5-h636-p47w.json | 15 ++--- .../GHSA-53mx-8hhc-gmp3.json | 17 +++--- .../GHSA-556r-96q6-ppp2.json | 13 ++-- .../GHSA-62x5-4rjc-x8j3.json | 15 ++--- .../GHSA-678g-9vjx-fwpj.json | 15 ++--- .../GHSA-6fxv-v3gm-9m2r.json | 15 ++--- .../GHSA-73pw-pffq-gh67.json | 33 ++++++++++ .../GHSA-76ph-jc9g-v47h.json | 15 ++--- .../GHSA-7r4q-q89f-2mcg.json | 15 ++--- .../GHSA-845f-27fw-gjw9.json | 15 ++--- .../GHSA-8737-h7fg-9xgj.json | 18 +++--- .../GHSA-8948-x7rf-6ghj.json | 15 ++--- .../GHSA-8g7q-j2w9-qr8r.json | 17 +++--- .../GHSA-8hmj-4h9r-668v.json | 17 +++--- .../GHSA-8pc5-29j8-pcjq.json | 15 ++--- .../GHSA-9j72-p63r-h27h.json | 10 +--- .../GHSA-9jv6-m6hq-4qf7.json | 15 ++--- .../GHSA-c62v-4w5f-p7pw.json | 15 ++--- .../GHSA-c97r-q93g-fc5c.json | 15 ++--- .../GHSA-cf97-gpjm-x8fj.json | 15 ++--- .../GHSA-cg9q-fmpx-v2mf.json | 25 ++++++++ .../GHSA-ch98-87fr-x9f7.json | 15 ++--- .../GHSA-cmh5-78pc-x57w.json | 4 +- .../GHSA-cpxj-fx45-9pgm.json | 15 ++--- .../GHSA-fwxq-3f52-5cmc.json | 29 +++++++++ .../GHSA-fx99-8m8g-rfwx.json | 15 ++--- .../GHSA-g4gg-7gqp-cf6m.json | 17 +++--- .../GHSA-g772-w9v5-7985.json | 15 ++--- .../GHSA-gmcv-67g3-vrwj.json | 36 +++++++++++ .../GHSA-gr5x-8j97-qq23.json | 15 ++--- .../GHSA-h43c-gg33-qj9g.json | 15 ++--- .../GHSA-h7q2-h7p3-jwmj.json | 15 ++--- .../GHSA-h8gv-f7pf-7c4p.json | 15 ++--- .../GHSA-hcgq-c6f2-4jh5.json | 45 ++++++++++++++ .../GHSA-hf9m-wphx-73hw.json | 15 ++--- .../GHSA-jpj5-4r47-rch8.json | 15 ++--- .../GHSA-m59j-fmqm-3q93.json | 17 +++--- .../GHSA-m7vh-7qm6-rq42.json | 33 ++++++++++ .../GHSA-mf47-w2f7-gc7f.json | 15 ++--- .../GHSA-mjcw-r3mg-3848.json | 15 ++--- .../GHSA-p3xg-2r2p-7rm4.json | 15 ++--- .../GHSA-p9h5-xg4q-c272.json | 15 ++--- .../GHSA-p9vw-xw86-3f2w.json | 15 ++--- .../GHSA-ph52-wh83-m7pg.json | 60 +++++++++++++++++++ .../GHSA-pm6r-99f9-h4r7.json | 33 ++++++++++ .../GHSA-qxf6-g9x3-8w74.json | 17 +++--- .../GHSA-r2pf-gw8f-9x87.json | 15 ++--- .../GHSA-r4vw-x7gf-4r43.json | 35 +++++++++++ .../GHSA-r5vq-m2mp-cpfj.json | 40 +++++++++++++ .../GHSA-rh22-rcv2-42x3.json | 15 ++--- .../GHSA-v6rg-qv6j-p6gp.json | 15 ++--- .../GHSA-vh5p-6rcm-5x83.json | 15 ++--- .../GHSA-w4qv-rrv4-jm4w.json | 15 ++--- .../GHSA-xc2q-wjq7-w4gw.json | 4 +- .../GHSA-xjmh-6wp6-74q8.json | 15 ++--- .../GHSA-xrg9-2q4w-gf5c.json | 17 +++--- .../GHSA-xx8w-4q6h-66xg.json | 15 ++--- 80 files changed, 871 insertions(+), 460 deletions(-) create mode 100644 advisories/unreviewed/2024/11/GHSA-4gwv-fpmg-cmv2/GHSA-4gwv-fpmg-cmv2.json create mode 100644 advisories/unreviewed/2024/11/GHSA-73pw-pffq-gh67/GHSA-73pw-pffq-gh67.json create mode 100644 advisories/unreviewed/2024/11/GHSA-cg9q-fmpx-v2mf/GHSA-cg9q-fmpx-v2mf.json create mode 100644 advisories/unreviewed/2024/11/GHSA-fwxq-3f52-5cmc/GHSA-fwxq-3f52-5cmc.json create mode 100644 advisories/unreviewed/2024/11/GHSA-gmcv-67g3-vrwj/GHSA-gmcv-67g3-vrwj.json create mode 100644 advisories/unreviewed/2024/11/GHSA-hcgq-c6f2-4jh5/GHSA-hcgq-c6f2-4jh5.json create mode 100644 advisories/unreviewed/2024/11/GHSA-m7vh-7qm6-rq42/GHSA-m7vh-7qm6-rq42.json create mode 100644 advisories/unreviewed/2024/11/GHSA-ph52-wh83-m7pg/GHSA-ph52-wh83-m7pg.json create mode 100644 advisories/unreviewed/2024/11/GHSA-pm6r-99f9-h4r7/GHSA-pm6r-99f9-h4r7.json create mode 100644 advisories/unreviewed/2024/11/GHSA-r4vw-x7gf-4r43/GHSA-r4vw-x7gf-4r43.json create mode 100644 advisories/unreviewed/2024/11/GHSA-r5vq-m2mp-cpfj/GHSA-r5vq-m2mp-cpfj.json diff --git a/advisories/unreviewed/2022/05/GHSA-mj5p-5fc7-225v/GHSA-mj5p-5fc7-225v.json b/advisories/unreviewed/2022/05/GHSA-mj5p-5fc7-225v/GHSA-mj5p-5fc7-225v.json index efc26dbd2bc..f1b8f9821be 100644 --- a/advisories/unreviewed/2022/05/GHSA-mj5p-5fc7-225v/GHSA-mj5p-5fc7-225v.json +++ b/advisories/unreviewed/2022/05/GHSA-mj5p-5fc7-225v/GHSA-mj5p-5fc7-225v.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2023/06/GHSA-4cqh-vv5h-qg69/GHSA-4cqh-vv5h-qg69.json b/advisories/unreviewed/2023/06/GHSA-4cqh-vv5h-qg69/GHSA-4cqh-vv5h-qg69.json index 505d159fdd7..56b05baffe6 100644 --- a/advisories/unreviewed/2023/06/GHSA-4cqh-vv5h-qg69/GHSA-4cqh-vv5h-qg69.json +++ b/advisories/unreviewed/2023/06/GHSA-4cqh-vv5h-qg69/GHSA-4cqh-vv5h-qg69.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,7 +26,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-346" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/06/GHSA-rww7-mm5m-vx73/GHSA-rww7-mm5m-vx73.json b/advisories/unreviewed/2023/06/GHSA-rww7-mm5m-vx73/GHSA-rww7-mm5m-vx73.json index bb1f608477a..31eb5fcd0c6 100644 --- a/advisories/unreviewed/2023/06/GHSA-rww7-mm5m-vx73/GHSA-rww7-mm5m-vx73.json +++ b/advisories/unreviewed/2023/06/GHSA-rww7-mm5m-vx73/GHSA-rww7-mm5m-vx73.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -32,7 +30,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-565" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/06/GHSA-w92h-gfcv-m7wv/GHSA-w92h-gfcv-m7wv.json b/advisories/unreviewed/2023/06/GHSA-w92h-gfcv-m7wv/GHSA-w92h-gfcv-m7wv.json index 7df26208e56..a1463b76fb1 100644 --- a/advisories/unreviewed/2023/06/GHSA-w92h-gfcv-m7wv/GHSA-w92h-gfcv-m7wv.json +++ b/advisories/unreviewed/2023/06/GHSA-w92h-gfcv-m7wv/GHSA-w92h-gfcv-m7wv.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,7 +26,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/06/GHSA-xcf7-g637-p7f5/GHSA-xcf7-g637-p7f5.json b/advisories/unreviewed/2023/06/GHSA-xcf7-g637-p7f5/GHSA-xcf7-g637-p7f5.json index d9b079c1656..244dd758039 100644 --- a/advisories/unreviewed/2023/06/GHSA-xcf7-g637-p7f5/GHSA-xcf7-g637-p7f5.json +++ b/advisories/unreviewed/2023/06/GHSA-xcf7-g637-p7f5/GHSA-xcf7-g637-p7f5.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -32,7 +30,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-306" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/07/GHSA-mg79-3wxp-f4x4/GHSA-mg79-3wxp-f4x4.json b/advisories/unreviewed/2023/07/GHSA-mg79-3wxp-f4x4/GHSA-mg79-3wxp-f4x4.json index 041f77f3c22..81215ff3afa 100644 --- a/advisories/unreviewed/2023/07/GHSA-mg79-3wxp-f4x4/GHSA-mg79-3wxp-f4x4.json +++ b/advisories/unreviewed/2023/07/GHSA-mg79-3wxp-f4x4/GHSA-mg79-3wxp-f4x4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mg79-3wxp-f4x4", - "modified": "2024-04-04T06:00:40Z", + "modified": "2024-11-27T18:33:59Z", "published": "2023-07-11T21:30:58Z", "aliases": [ "CVE-2023-20575" @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2023/07/GHSA-r3hw-f5jc-27w8/GHSA-r3hw-f5jc-27w8.json b/advisories/unreviewed/2023/07/GHSA-r3hw-f5jc-27w8/GHSA-r3hw-f5jc-27w8.json index 968b750973c..46281c7a0d9 100644 --- a/advisories/unreviewed/2023/07/GHSA-r3hw-f5jc-27w8/GHSA-r3hw-f5jc-27w8.json +++ b/advisories/unreviewed/2023/07/GHSA-r3hw-f5jc-27w8/GHSA-r3hw-f5jc-27w8.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2023/07/GHSA-r7r5-2rqh-r972/GHSA-r7r5-2rqh-r972.json b/advisories/unreviewed/2023/07/GHSA-r7r5-2rqh-r972/GHSA-r7r5-2rqh-r972.json index d1481f83862..0f35cea3380 100644 --- a/advisories/unreviewed/2023/07/GHSA-r7r5-2rqh-r972/GHSA-r7r5-2rqh-r972.json +++ b/advisories/unreviewed/2023/07/GHSA-r7r5-2rqh-r972/GHSA-r7r5-2rqh-r972.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -36,7 +34,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-77" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/04/GHSA-g77x-hh5w-qpw7/GHSA-g77x-hh5w-qpw7.json b/advisories/unreviewed/2024/04/GHSA-g77x-hh5w-qpw7/GHSA-g77x-hh5w-qpw7.json index 7c3566d1690..88ac531c5c3 100644 --- a/advisories/unreviewed/2024/04/GHSA-g77x-hh5w-qpw7/GHSA-g77x-hh5w-qpw7.json +++ b/advisories/unreviewed/2024/04/GHSA-g77x-hh5w-qpw7/GHSA-g77x-hh5w-qpw7.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-g77x-hh5w-qpw7", - "modified": "2024-04-08T03:30:52Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-04-08T03:30:52Z", "aliases": [ "CVE-2023-52345" ], "details": "In modem driver, there is a possible system crash due to improper input validation. This could lead to local information disclosure with System execution privileges needed", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,10 +25,8 @@ } ], "database_specific": { - "cwe_ids": [ - - ], - "severity": null, + "cwe_ids": [], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-08T03:15:08Z" diff --git a/advisories/unreviewed/2024/04/GHSA-j78w-6r6c-3p5g/GHSA-j78w-6r6c-3p5g.json b/advisories/unreviewed/2024/04/GHSA-j78w-6r6c-3p5g/GHSA-j78w-6r6c-3p5g.json index 691c899ade2..7dd8376b0c0 100644 --- a/advisories/unreviewed/2024/04/GHSA-j78w-6r6c-3p5g/GHSA-j78w-6r6c-3p5g.json +++ b/advisories/unreviewed/2024/04/GHSA-j78w-6r6c-3p5g/GHSA-j78w-6r6c-3p5g.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-j78w-6r6c-3p5g", - "modified": "2024-04-08T03:30:52Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-04-08T03:30:52Z", "aliases": [ "CVE-2023-52350" ], "details": "In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -25,9 +26,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-08T03:15:08Z" diff --git a/advisories/unreviewed/2024/04/GHSA-m7f8-xj6j-5x9x/GHSA-m7f8-xj6j-5x9x.json b/advisories/unreviewed/2024/04/GHSA-m7f8-xj6j-5x9x/GHSA-m7f8-xj6j-5x9x.json index 25a8fe4b0f9..77d736cb428 100644 --- a/advisories/unreviewed/2024/04/GHSA-m7f8-xj6j-5x9x/GHSA-m7f8-xj6j-5x9x.json +++ b/advisories/unreviewed/2024/04/GHSA-m7f8-xj6j-5x9x/GHSA-m7f8-xj6j-5x9x.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-m7f8-xj6j-5x9x", - "modified": "2024-04-08T03:30:53Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-04-08T03:30:53Z", "aliases": [ "CVE-2023-52536" ], "details": "In faceid service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -25,9 +26,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-125" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-08T03:15:08Z" diff --git a/advisories/unreviewed/2024/04/GHSA-rmmj-g3w6-w438/GHSA-rmmj-g3w6-w438.json b/advisories/unreviewed/2024/04/GHSA-rmmj-g3w6-w438/GHSA-rmmj-g3w6-w438.json index 5ea8b9ed72c..7718ad590fb 100644 --- a/advisories/unreviewed/2024/04/GHSA-rmmj-g3w6-w438/GHSA-rmmj-g3w6-w438.json +++ b/advisories/unreviewed/2024/04/GHSA-rmmj-g3w6-w438/GHSA-rmmj-g3w6-w438.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-rmmj-g3w6-w438", - "modified": "2024-04-08T03:30:52Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-04-08T03:30:52Z", "aliases": [ "CVE-2023-52352" ], "details": "In Network Adapter Service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges needed", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -25,9 +26,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-862" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-08T03:15:08Z" diff --git a/advisories/unreviewed/2024/04/GHSA-wh8c-8787-2j2f/GHSA-wh8c-8787-2j2f.json b/advisories/unreviewed/2024/04/GHSA-wh8c-8787-2j2f/GHSA-wh8c-8787-2j2f.json index c14264e34e2..48520b64a6c 100644 --- a/advisories/unreviewed/2024/04/GHSA-wh8c-8787-2j2f/GHSA-wh8c-8787-2j2f.json +++ b/advisories/unreviewed/2024/04/GHSA-wh8c-8787-2j2f/GHSA-wh8c-8787-2j2f.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-wh8c-8787-2j2f", - "modified": "2024-04-08T03:30:52Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-04-08T03:30:52Z", "aliases": [ "CVE-2023-52349" ], "details": "In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -25,9 +26,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-08T03:15:08Z" diff --git a/advisories/unreviewed/2024/07/GHSA-px3f-fc5j-2fqv/GHSA-px3f-fc5j-2fqv.json b/advisories/unreviewed/2024/07/GHSA-px3f-fc5j-2fqv/GHSA-px3f-fc5j-2fqv.json index 60aa1fa2993..89fc5db3c6d 100644 --- a/advisories/unreviewed/2024/07/GHSA-px3f-fc5j-2fqv/GHSA-px3f-fc5j-2fqv.json +++ b/advisories/unreviewed/2024/07/GHSA-px3f-fc5j-2fqv/GHSA-px3f-fc5j-2fqv.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-px3f-fc5j-2fqv", - "modified": "2024-11-08T21:33:51Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-07-10T21:30:38Z", "aliases": [ "CVE-2024-5910" @@ -17,9 +17,7 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Red" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,6 +26,10 @@ { "type": "WEB", "url": "https://security.paloaltonetworks.com/CVE-2024-5910" + }, + { + "type": "WEB", + "url": "https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/08/GHSA-pq5w-h3jm-m95c/GHSA-pq5w-h3jm-m95c.json b/advisories/unreviewed/2024/08/GHSA-pq5w-h3jm-m95c/GHSA-pq5w-h3jm-m95c.json index 3610bdd1988..0f4b68f28eb 100644 --- a/advisories/unreviewed/2024/08/GHSA-pq5w-h3jm-m95c/GHSA-pq5w-h3jm-m95c.json +++ b/advisories/unreviewed/2024/08/GHSA-pq5w-h3jm-m95c/GHSA-pq5w-h3jm-m95c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-pq5w-h3jm-m95c", - "modified": "2024-08-22T15:31:18Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-08-21T21:30:46Z", "aliases": [ "CVE-2024-7971" @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,6 +26,10 @@ { "type": "WEB", "url": "https://issues.chromium.org/issues/360700873" + }, + { + "type": "WEB", + "url": "https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/08/GHSA-xqmw-9249-4m7x/GHSA-xqmw-9249-4m7x.json b/advisories/unreviewed/2024/08/GHSA-xqmw-9249-4m7x/GHSA-xqmw-9249-4m7x.json index 8e42946ea4a..6013d9c64af 100644 --- a/advisories/unreviewed/2024/08/GHSA-xqmw-9249-4m7x/GHSA-xqmw-9249-4m7x.json +++ b/advisories/unreviewed/2024/08/GHSA-xqmw-9249-4m7x/GHSA-xqmw-9249-4m7x.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xqmw-9249-4m7x", - "modified": "2024-08-13T18:31:15Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-08-13T18:31:15Z", "aliases": [ "CVE-2023-31339" @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,6 +26,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-125", "CWE-20" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2024/11/GHSA-29fm-rc5r-j557/GHSA-29fm-rc5r-j557.json b/advisories/unreviewed/2024/11/GHSA-29fm-rc5r-j557/GHSA-29fm-rc5r-j557.json index 22852f40097..a54f40a0e38 100644 --- a/advisories/unreviewed/2024/11/GHSA-29fm-rc5r-j557/GHSA-29fm-rc5r-j557.json +++ b/advisories/unreviewed/2024/11/GHSA-29fm-rc5r-j557/GHSA-29fm-rc5r-j557.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-29fm-rc5r-j557", - "modified": "2024-11-15T21:30:47Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-11-15T21:30:47Z", "aliases": [ "CVE-2024-51330" ], "details": "An issue in UltiMaker Cura v.4.41 and 5.8.1 and before allows a local attacker to execute arbitrary code via Inter-process communication (IPC) mechanism between Cura application and CuraEngine processes, localhost network stack, printing settings and G-code processing and transmission components, Ultimaker 3D Printers.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -25,9 +26,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-15T19:15:08Z" diff --git a/advisories/unreviewed/2024/11/GHSA-328f-543x-9jvg/GHSA-328f-543x-9jvg.json b/advisories/unreviewed/2024/11/GHSA-328f-543x-9jvg/GHSA-328f-543x-9jvg.json index 4614637bbd9..f411a7dfe3b 100644 --- a/advisories/unreviewed/2024/11/GHSA-328f-543x-9jvg/GHSA-328f-543x-9jvg.json +++ b/advisories/unreviewed/2024/11/GHSA-328f-543x-9jvg/GHSA-328f-543x-9jvg.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-328f-543x-9jvg", - "modified": "2024-11-19T03:31:07Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-11-19T03:31:07Z", "aliases": [ "CVE-2024-50271" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsignal: restore the override_rlimit logic\n\nPrior to commit d64696905554 (\"Reimplement RLIMIT_SIGPENDING on top of\nucounts\") UCOUNT_RLIMIT_SIGPENDING rlimit was not enforced for a class of\nsignals. However now it's enforced unconditionally, even if\noverride_rlimit is set. This behavior change caused production issues. \n\nFor example, if the limit is reached and a process receives a SIGSEGV\nsignal, sigqueue_alloc fails to allocate the necessary resources for the\nsignal delivery, preventing the signal from being delivered with siginfo. \nThis prevents the process from correctly identifying the fault address and\nhandling the error. From the user-space perspective, applications are\nunaware that the limit has been reached and that the siginfo is\neffectively 'corrupted'. This can lead to unpredictable behavior and\ncrashes, as we observed with java applications.\n\nFix this by passing override_rlimit into inc_rlimit_get_ucounts() and skip\nthe comparison to max there if override_rlimit is set. This effectively\nrestores the old behavior.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -37,9 +38,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-770" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-19T02:16:29Z" diff --git a/advisories/unreviewed/2024/11/GHSA-4c64-c9rj-qw7x/GHSA-4c64-c9rj-qw7x.json b/advisories/unreviewed/2024/11/GHSA-4c64-c9rj-qw7x/GHSA-4c64-c9rj-qw7x.json index d39b25622a4..9c4afd7a905 100644 --- a/advisories/unreviewed/2024/11/GHSA-4c64-c9rj-qw7x/GHSA-4c64-c9rj-qw7x.json +++ b/advisories/unreviewed/2024/11/GHSA-4c64-c9rj-qw7x/GHSA-4c64-c9rj-qw7x.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-4c64-c9rj-qw7x", - "modified": "2024-11-25T21:30:50Z", + "modified": "2024-11-27T18:34:03Z", "published": "2024-11-25T21:30:50Z", "aliases": [ "CVE-2024-53556" ], "details": "An Open Redirect vulnerability in Taiga v6.8.1 allows attackers to redirect users to arbitrary websites via appending a crafted link to /login?next= in the login page URL.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -29,9 +30,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-25T21:15:21Z" diff --git a/advisories/unreviewed/2024/11/GHSA-4f2j-5xcx-5g9w/GHSA-4f2j-5xcx-5g9w.json b/advisories/unreviewed/2024/11/GHSA-4f2j-5xcx-5g9w/GHSA-4f2j-5xcx-5g9w.json index fc1939b2d7b..1e662b2c188 100644 --- a/advisories/unreviewed/2024/11/GHSA-4f2j-5xcx-5g9w/GHSA-4f2j-5xcx-5g9w.json +++ b/advisories/unreviewed/2024/11/GHSA-4f2j-5xcx-5g9w/GHSA-4f2j-5xcx-5g9w.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-4f2j-5xcx-5g9w", - "modified": "2024-11-19T18:31:07Z", + "modified": "2024-11-27T18:34:01Z", "published": "2024-11-19T18:31:07Z", "aliases": [ "CVE-2024-53079" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/thp: fix deferred split unqueue naming and locking\n\nRecent changes are putting more pressure on THP deferred split queues:\nunder load revealing long-standing races, causing list_del corruptions,\n\"Bad page state\"s and worse (I keep BUGs in both of those, so usually\ndon't get to see how badly they end up without). The relevant recent\nchanges being 6.8's mTHP, 6.10's mTHP swapout, and 6.12's mTHP swapin,\nimproved swap allocation, and underused THP splitting.\n\nBefore fixing locking: rename misleading folio_undo_large_rmappable(),\nwhich does not undo large_rmappable, to folio_unqueue_deferred_split(),\nwhich is what it does. But that and its out-of-line __callee are mm\ninternals of very limited usability: add comment and WARN_ON_ONCEs to\ncheck usage; and return a bool to say if a deferred split was unqueued,\nwhich can then be used in WARN_ON_ONCEs around safety checks (sparing\ncallers the arcane conditionals in __folio_unqueue_deferred_split()).\n\nJust omit the folio_unqueue_deferred_split() from free_unref_folios(), all\nof whose callers now call it beforehand (and if any forget then bad_page()\nwill tell) - except for its caller put_pages_list(), which itself no\nlonger has any callers (and will be deleted separately).\n\nSwapout: mem_cgroup_swapout() has been resetting folio->memcg_data 0\nwithout checking and unqueueing a THP folio from deferred split list;\nwhich is unfortunate, since the split_queue_lock depends on the memcg\n(when memcg is enabled); so swapout has been unqueueing such THPs later,\nwhen freeing the folio, using the pgdat's lock instead: potentially\ncorrupting the memcg's list. __remove_mapping() has frozen refcount to 0\nhere, so no problem with calling folio_unqueue_deferred_split() before\nresetting memcg_data.\n\nThat goes back to 5.4 commit 87eaceb3faa5 (\"mm: thp: make deferred split\nshrinker memcg aware\"): which included a check on swapcache before adding\nto deferred queue, but no check on deferred queue before adding THP to\nswapcache. That worked fine with the usual sequence of events in reclaim\n(though there were a couple of rare ways in which a THP on deferred queue\ncould have been swapped out), but 6.12 commit dafff3f4c850 (\"mm: split\nunderused THPs\") avoids splitting underused THPs in reclaim, which makes\nswapcache THPs on deferred queue commonplace.\n\nKeep the check on swapcache before adding to deferred queue? Yes: it is\nno longer essential, but preserves the existing behaviour, and is likely\nto be a worthwhile optimization (vmstat showed much more traffic on the\nqueue under swapping load if the check was removed); update its comment.\n\nMemcg-v1 move (deprecated): mem_cgroup_move_account() has been changing\nfolio->memcg_data without checking and unqueueing a THP folio from the\ndeferred list, sometimes corrupting \"from\" memcg's list, like swapout. \nRefcount is non-zero here, so folio_unqueue_deferred_split() can only be\nused in a WARN_ON_ONCE to validate the fix, which must be done earlier:\nmem_cgroup_move_charge_pte_range() first try to split the THP (splitting\nof course unqueues), or skip it if that fails. Not ideal, but moving\ncharge has been requested, and khugepaged should repair the THP later:\nnobody wants new custom unqueueing code just for this deprecated case.\n\nThe 87eaceb3faa5 commit did have the code to move from one deferred list\nto another (but was not conscious of its unsafety while refcount non-0);\nbut that was removed by 5.6 commit fac0516b5534 (\"mm: thp: don't need care\ndeferred split queue in memcg charge move path\"), which argued that the\nexistence of a PMD mapping guarantees that the THP cannot be on a deferred\nlist. As above, false in rare cases, and now commonly false.\n\nBackport to 6.11 should be straightforward. Earlier backports must take\ncare that other _deferred_list fixes and dependencies are included. There\nis not a strong case for backports, but they can fix cornercases.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -33,9 +34,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-667" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-19T18:15:27Z" diff --git a/advisories/unreviewed/2024/11/GHSA-4grr-9vhg-g98w/GHSA-4grr-9vhg-g98w.json b/advisories/unreviewed/2024/11/GHSA-4grr-9vhg-g98w/GHSA-4grr-9vhg-g98w.json index 4472dcdf64e..80d3bc9d11e 100644 --- a/advisories/unreviewed/2024/11/GHSA-4grr-9vhg-g98w/GHSA-4grr-9vhg-g98w.json +++ b/advisories/unreviewed/2024/11/GHSA-4grr-9vhg-g98w/GHSA-4grr-9vhg-g98w.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-4grr-9vhg-g98w", - "modified": "2024-11-19T03:31:07Z", + "modified": "2024-11-27T18:34:01Z", "published": "2024-11-19T03:31:07Z", "aliases": [ "CVE-2024-50275" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64/sve: Discard stale CPU state when handling SVE traps\n\nThe logic for handling SVE traps manipulates saved FPSIMD/SVE state\nincorrectly, and a race with preemption can result in a task having\nTIF_SVE set and TIF_FOREIGN_FPSTATE clear even though the live CPU state\nis stale (e.g. with SVE traps enabled). This has been observed to result\nin warnings from do_sve_acc() where SVE traps are not expected while\nTIF_SVE is set:\n\n| if (test_and_set_thread_flag(TIF_SVE))\n| WARN_ON(1); /* SVE access shouldn't have trapped */\n\nWarnings of this form have been reported intermittently, e.g.\n\n https://lore.kernel.org/linux-arm-kernel/CA+G9fYtEGe_DhY2Ms7+L7NKsLYUomGsgqpdBj+QwDLeSg=JhGg@mail.gmail.com/\n https://lore.kernel.org/linux-arm-kernel/000000000000511e9a060ce5a45c@google.com/\n\nThe race can occur when the SVE trap handler is preempted before and\nafter manipulating the saved FPSIMD/SVE state, starting and ending on\nthe same CPU, e.g.\n\n| void do_sve_acc(unsigned long esr, struct pt_regs *regs)\n| {\n| // Trap on CPU 0 with TIF_SVE clear, SVE traps enabled\n| // task->fpsimd_cpu is 0.\n| // per_cpu_ptr(&fpsimd_last_state, 0) is task.\n|\n| ...\n|\n| // Preempted; migrated from CPU 0 to CPU 1.\n| // TIF_FOREIGN_FPSTATE is set.\n|\n| get_cpu_fpsimd_context();\n|\n| if (test_and_set_thread_flag(TIF_SVE))\n| WARN_ON(1); /* SVE access shouldn't have trapped */\n|\n| sve_init_regs() {\n| if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) {\n| ...\n| } else {\n| fpsimd_to_sve(current);\n| current->thread.fp_type = FP_STATE_SVE;\n| }\n| }\n|\n| put_cpu_fpsimd_context();\n|\n| // Preempted; migrated from CPU 1 to CPU 0.\n| // task->fpsimd_cpu is still 0\n| // If per_cpu_ptr(&fpsimd_last_state, 0) is still task then:\n| // - Stale HW state is reused (with SVE traps enabled)\n| // - TIF_FOREIGN_FPSTATE is cleared\n| // - A return to userspace skips HW state restore\n| }\n\nFix the case where the state is not live and TIF_FOREIGN_FPSTATE is set\nby calling fpsimd_flush_task_state() to detach from the saved CPU\nstate. This ensures that a subsequent context switch will not reuse the\nstale CPU state, and will instead set TIF_FOREIGN_FPSTATE, forcing the\nnew state to be reloaded from memory prior to a return to userspace.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -32,10 +33,8 @@ } ], "database_specific": { - "cwe_ids": [ - - ], - "severity": null, + "cwe_ids": [], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-19T02:16:29Z" diff --git a/advisories/unreviewed/2024/11/GHSA-4gwv-fpmg-cmv2/GHSA-4gwv-fpmg-cmv2.json b/advisories/unreviewed/2024/11/GHSA-4gwv-fpmg-cmv2/GHSA-4gwv-fpmg-cmv2.json new file mode 100644 index 00000000000..f073e443651 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-4gwv-fpmg-cmv2/GHSA-4gwv-fpmg-cmv2.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4gwv-fpmg-cmv2", + "modified": "2024-11-27T18:34:04Z", + "published": "2024-11-27T18:34:04Z", + "aliases": [ + "CVE-2024-54003" + ], + "details": "Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54003" + }, + { + "type": "WEB", + "url": "https://www.jenkins.io/security/advisory/2024-11-27/#SECURITY-3467" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-27T17:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-4jp9-q9g7-48gr/GHSA-4jp9-q9g7-48gr.json b/advisories/unreviewed/2024/11/GHSA-4jp9-q9g7-48gr/GHSA-4jp9-q9g7-48gr.json index 6a46bc8b379..b836a047d02 100644 --- a/advisories/unreviewed/2024/11/GHSA-4jp9-q9g7-48gr/GHSA-4jp9-q9g7-48gr.json +++ b/advisories/unreviewed/2024/11/GHSA-4jp9-q9g7-48gr/GHSA-4jp9-q9g7-48gr.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-4jp9-q9g7-48gr", - "modified": "2024-11-26T15:31:02Z", + "modified": "2024-11-27T18:34:03Z", "published": "2024-11-26T15:31:02Z", "aliases": [ "CVE-2024-11697" ], "details": "When handling keypress events, an attacker may have been able to trick a user into bypassing the \"Open Executable File?\" confirmation dialog. This could have led to malicious code execution. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -41,9 +42,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-26T14:15:19Z" diff --git a/advisories/unreviewed/2024/11/GHSA-4xv5-h636-p47w/GHSA-4xv5-h636-p47w.json b/advisories/unreviewed/2024/11/GHSA-4xv5-h636-p47w/GHSA-4xv5-h636-p47w.json index 173c9792247..1a1942f8541 100644 --- a/advisories/unreviewed/2024/11/GHSA-4xv5-h636-p47w/GHSA-4xv5-h636-p47w.json +++ b/advisories/unreviewed/2024/11/GHSA-4xv5-h636-p47w/GHSA-4xv5-h636-p47w.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-4xv5-h636-p47w", - "modified": "2024-11-20T18:32:18Z", + "modified": "2024-11-27T18:34:02Z", "published": "2024-11-20T18:32:18Z", "aliases": [ "CVE-2024-29292" ], "details": "Multiple OS Command Injection vulnerabilities affecting Kasda KW6512 router software version KW6512_Linux_V1.0 enable an authenticated remote attacker to execute arbitrary OS commands via Quick Setup and Internet page parameters passed to internet.cgi.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -29,9 +30,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-77" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-20T18:15:22Z" diff --git a/advisories/unreviewed/2024/11/GHSA-53mx-8hhc-gmp3/GHSA-53mx-8hhc-gmp3.json b/advisories/unreviewed/2024/11/GHSA-53mx-8hhc-gmp3/GHSA-53mx-8hhc-gmp3.json index 290c177227f..58f1d3038cc 100644 --- a/advisories/unreviewed/2024/11/GHSA-53mx-8hhc-gmp3/GHSA-53mx-8hhc-gmp3.json +++ b/advisories/unreviewed/2024/11/GHSA-53mx-8hhc-gmp3/GHSA-53mx-8hhc-gmp3.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-53mx-8hhc-gmp3", - "modified": "2024-11-26T15:31:01Z", + "modified": "2024-11-27T18:34:03Z", "published": "2024-11-26T15:31:01Z", "aliases": [ "CVE-2024-11691" ], "details": "An attacker could have caused memory corruption due to a flaw in Apple's GPU driver; this can be avoided by working around the flaw. \n*Note: This issue only affected macOS operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, and Thunderbird < 128.5.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -48,10 +49,8 @@ } ], "database_specific": { - "cwe_ids": [ - - ], - "severity": null, + "cwe_ids": [], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-26T14:15:18Z" diff --git a/advisories/unreviewed/2024/11/GHSA-556r-96q6-ppp2/GHSA-556r-96q6-ppp2.json b/advisories/unreviewed/2024/11/GHSA-556r-96q6-ppp2/GHSA-556r-96q6-ppp2.json index cf077369ea6..74136690830 100644 --- a/advisories/unreviewed/2024/11/GHSA-556r-96q6-ppp2/GHSA-556r-96q6-ppp2.json +++ b/advisories/unreviewed/2024/11/GHSA-556r-96q6-ppp2/GHSA-556r-96q6-ppp2.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-556r-96q6-ppp2", - "modified": "2024-11-13T18:32:04Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-11-13T18:32:04Z", "aliases": [ "CVE-2024-9413" ], "details": "The transport_message_handler function in SCP-Firmware release versions 2.11.0-2.15.0 does not properly handle errors, potentially allowing an Application Processor (AP) to cause a buffer overflow in System Control Processor (SCP) firmware.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -27,7 +28,7 @@ "cwe_ids": [ "CWE-755" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-13T17:15:12Z" diff --git a/advisories/unreviewed/2024/11/GHSA-62x5-4rjc-x8j3/GHSA-62x5-4rjc-x8j3.json b/advisories/unreviewed/2024/11/GHSA-62x5-4rjc-x8j3/GHSA-62x5-4rjc-x8j3.json index c137f724185..fd44af1a380 100644 --- a/advisories/unreviewed/2024/11/GHSA-62x5-4rjc-x8j3/GHSA-62x5-4rjc-x8j3.json +++ b/advisories/unreviewed/2024/11/GHSA-62x5-4rjc-x8j3/GHSA-62x5-4rjc-x8j3.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-62x5-4rjc-x8j3", - "modified": "2024-11-22T21:32:15Z", + "modified": "2024-11-27T18:34:02Z", "published": "2024-11-22T21:32:15Z", "aliases": [ "CVE-2024-52726" ], "details": "CRMEB v5.4.0 is vulnerable to Arbitrary file read in the save_basics function which allows an attacker to obtain sensitive information", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -29,9 +30,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-125" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-22T19:15:07Z" diff --git a/advisories/unreviewed/2024/11/GHSA-678g-9vjx-fwpj/GHSA-678g-9vjx-fwpj.json b/advisories/unreviewed/2024/11/GHSA-678g-9vjx-fwpj/GHSA-678g-9vjx-fwpj.json index e97e8eacf2d..4b1523557b8 100644 --- a/advisories/unreviewed/2024/11/GHSA-678g-9vjx-fwpj/GHSA-678g-9vjx-fwpj.json +++ b/advisories/unreviewed/2024/11/GHSA-678g-9vjx-fwpj/GHSA-678g-9vjx-fwpj.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-678g-9vjx-fwpj", - "modified": "2024-11-27T15:31:45Z", + "modified": "2024-11-27T18:34:04Z", "published": "2024-11-27T15:31:45Z", "aliases": [ "CVE-2024-53635" ], "details": "A Reflected Cross Site Scripting (XSS) vulnerability was found in /covid-tms/patient-search-report.php in PHPGurukul COVID 19 Testing Management System v1.0, which allows remote attackers to execute arbitrary code via the searchdata POST request parameter.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -25,9 +26,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-27T14:15:19Z" diff --git a/advisories/unreviewed/2024/11/GHSA-6fxv-v3gm-9m2r/GHSA-6fxv-v3gm-9m2r.json b/advisories/unreviewed/2024/11/GHSA-6fxv-v3gm-9m2r/GHSA-6fxv-v3gm-9m2r.json index 59b67c94a34..3d79e209f1b 100644 --- a/advisories/unreviewed/2024/11/GHSA-6fxv-v3gm-9m2r/GHSA-6fxv-v3gm-9m2r.json +++ b/advisories/unreviewed/2024/11/GHSA-6fxv-v3gm-9m2r/GHSA-6fxv-v3gm-9m2r.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-6fxv-v3gm-9m2r", - "modified": "2024-11-19T03:31:08Z", + "modified": "2024-11-27T18:34:01Z", "published": "2024-11-19T03:31:08Z", "aliases": [ "CVE-2024-50278" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix potential out-of-bounds access on the first resume\n\nOut-of-bounds access occurs if the fast device is expanded unexpectedly\nbefore the first-time resume of the cache table. This happens because\nexpanding the fast device requires reloading the cache table for\ncache_create to allocate new in-core data structures that fit the new\nsize, and the check in cache_preresume is not performed during the\nfirst resume, leading to the issue.\n\nReproduce steps:\n\n1. prepare component devices:\n\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ndmsetup create cdata --table \"0 65536 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 524288 linear /dev/sdc 262144\"\ndd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\n\n2. load a cache table of 512 cache blocks, and deliberately expand the\n fast device before resuming the cache, making the in-core data\n structures inadequate.\n\ndmsetup create cache --notable\ndmsetup reload cache --table \"0 524288 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\"\ndmsetup reload cdata --table \"0 131072 linear /dev/sdc 8192\"\ndmsetup resume cdata\ndmsetup resume cache\n\n3. suspend the cache to write out the in-core dirty bitset and hint\n array, leading to out-of-bounds access to the dirty bitset at offset\n 0x40:\n\ndmsetup suspend cache\n\nKASAN reports:\n\n BUG: KASAN: vmalloc-out-of-bounds in is_dirty_callback+0x2b/0x80\n Read of size 8 at addr ffffc90000085040 by task dmsetup/90\n\n (...snip...)\n The buggy address belongs to the virtual mapping at\n [ffffc90000085000, ffffc90000087000) created by:\n cache_ctr+0x176a/0x35f0\n\n (...snip...)\n Memory state around the buggy address:\n ffffc90000084f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc90000084f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n >ffffc90000085000: 00 00 00 00 00 00 00 00 f8 f8 f8 f8 f8 f8 f8 f8\n ^\n ffffc90000085080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc90000085100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n\nFix by checking the size change on the first resume.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -53,9 +54,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-125" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-19T02:16:30Z" diff --git a/advisories/unreviewed/2024/11/GHSA-73pw-pffq-gh67/GHSA-73pw-pffq-gh67.json b/advisories/unreviewed/2024/11/GHSA-73pw-pffq-gh67/GHSA-73pw-pffq-gh67.json new file mode 100644 index 00000000000..695eb9d3b4c --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-73pw-pffq-gh67/GHSA-73pw-pffq-gh67.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-73pw-pffq-gh67", + "modified": "2024-11-27T18:34:04Z", + "published": "2024-11-27T18:34:04Z", + "aliases": [ + "CVE-2024-9369" + ], + "details": "Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9369" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/368208152" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-27T18:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-76ph-jc9g-v47h/GHSA-76ph-jc9g-v47h.json b/advisories/unreviewed/2024/11/GHSA-76ph-jc9g-v47h/GHSA-76ph-jc9g-v47h.json index 8d28b6bd18f..f21a383dc8d 100644 --- a/advisories/unreviewed/2024/11/GHSA-76ph-jc9g-v47h/GHSA-76ph-jc9g-v47h.json +++ b/advisories/unreviewed/2024/11/GHSA-76ph-jc9g-v47h/GHSA-76ph-jc9g-v47h.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-76ph-jc9g-v47h", - "modified": "2024-11-20T18:32:17Z", + "modified": "2024-11-27T18:34:01Z", "published": "2024-11-20T18:32:17Z", "aliases": [ "CVE-2024-51163" ], "details": "Local File Inclusion vulnerability in Vegam Solutions Vegam 4i v.6.3.47.0 and earlier allows a remote attacker to obtain sensitive information via the print labelling function.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -25,9 +26,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-125" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-20T17:15:18Z" diff --git a/advisories/unreviewed/2024/11/GHSA-7r4q-q89f-2mcg/GHSA-7r4q-q89f-2mcg.json b/advisories/unreviewed/2024/11/GHSA-7r4q-q89f-2mcg/GHSA-7r4q-q89f-2mcg.json index 56f5cac532d..2d096cc71c1 100644 --- a/advisories/unreviewed/2024/11/GHSA-7r4q-q89f-2mcg/GHSA-7r4q-q89f-2mcg.json +++ b/advisories/unreviewed/2024/11/GHSA-7r4q-q89f-2mcg/GHSA-7r4q-q89f-2mcg.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-7r4q-q89f-2mcg", - "modified": "2024-11-26T15:31:03Z", + "modified": "2024-11-27T18:34:03Z", "published": "2024-11-26T15:31:02Z", "aliases": [ "CVE-2024-11702" ], "details": "Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-based clipboard history if enabled. This vulnerability affects Firefox < 133 and Thunderbird < 133.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -33,9 +34,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-838" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-26T14:15:19Z" diff --git a/advisories/unreviewed/2024/11/GHSA-845f-27fw-gjw9/GHSA-845f-27fw-gjw9.json b/advisories/unreviewed/2024/11/GHSA-845f-27fw-gjw9/GHSA-845f-27fw-gjw9.json index b8e730737ce..a90b2dbcaaa 100644 --- a/advisories/unreviewed/2024/11/GHSA-845f-27fw-gjw9/GHSA-845f-27fw-gjw9.json +++ b/advisories/unreviewed/2024/11/GHSA-845f-27fw-gjw9/GHSA-845f-27fw-gjw9.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-845f-27fw-gjw9", - "modified": "2024-11-26T15:31:02Z", + "modified": "2024-11-27T18:34:03Z", "published": "2024-11-26T15:31:02Z", "aliases": [ "CVE-2024-11700" ], "details": "Malicious websites may have been able to user intent confirmation through tapjacking. This could have led to users unknowingly approving the launch of external applications, potentially exposing them to underlying vulnerabilities. This vulnerability affects Firefox < 133 and Thunderbird < 133.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -33,9 +34,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-1021" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-26T14:15:19Z" diff --git a/advisories/unreviewed/2024/11/GHSA-8737-h7fg-9xgj/GHSA-8737-h7fg-9xgj.json b/advisories/unreviewed/2024/11/GHSA-8737-h7fg-9xgj/GHSA-8737-h7fg-9xgj.json index 4328e4c1af5..8125188f092 100644 --- a/advisories/unreviewed/2024/11/GHSA-8737-h7fg-9xgj/GHSA-8737-h7fg-9xgj.json +++ b/advisories/unreviewed/2024/11/GHSA-8737-h7fg-9xgj/GHSA-8737-h7fg-9xgj.json @@ -1,18 +1,14 @@ { "schema_version": "1.4.0", "id": "GHSA-8737-h7fg-9xgj", - "modified": "2024-11-27T15:31:46Z", + "modified": "2024-11-27T18:34:04Z", "published": "2024-11-27T15:31:46Z", "aliases": [ "CVE-2024-53920" ], "details": "In elisp-mode.el in GNU Emacs through 30.0.92, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -30,15 +26,17 @@ "type": "WEB", "url": "https://git.savannah.gnu.org/cgit/emacs.git/tree/ChangeLog.4" }, + { + "type": "WEB", + "url": "https://news.ycombinator.com/item?id=42256409" + }, { "type": "WEB", "url": "https://yhetil.org/emacs/CAFXAjY5f4YfHAtZur1RAqH34UbYU56_t6t2Er0YEh1Sb7-W=hg%40mail.gmail.com" } ], "database_specific": { - "cwe_ids": [ - - ], + "cwe_ids": [], "severity": null, "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/11/GHSA-8948-x7rf-6ghj/GHSA-8948-x7rf-6ghj.json b/advisories/unreviewed/2024/11/GHSA-8948-x7rf-6ghj/GHSA-8948-x7rf-6ghj.json index 0bb7a16148c..ff6cadc9a6a 100644 --- a/advisories/unreviewed/2024/11/GHSA-8948-x7rf-6ghj/GHSA-8948-x7rf-6ghj.json +++ b/advisories/unreviewed/2024/11/GHSA-8948-x7rf-6ghj/GHSA-8948-x7rf-6ghj.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-8948-x7rf-6ghj", - "modified": "2024-11-15T21:30:47Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-11-15T21:30:47Z", "aliases": [ "CVE-2024-49592" ], "details": "McAfee Trial Installer 16.0.53 has Incorrect Access Control that leads to Local Escalation of Privileges.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -25,9 +26,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-427" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-15T21:15:11Z" diff --git a/advisories/unreviewed/2024/11/GHSA-8g7q-j2w9-qr8r/GHSA-8g7q-j2w9-qr8r.json b/advisories/unreviewed/2024/11/GHSA-8g7q-j2w9-qr8r/GHSA-8g7q-j2w9-qr8r.json index 6642cacc8a6..e4e24d85730 100644 --- a/advisories/unreviewed/2024/11/GHSA-8g7q-j2w9-qr8r/GHSA-8g7q-j2w9-qr8r.json +++ b/advisories/unreviewed/2024/11/GHSA-8g7q-j2w9-qr8r/GHSA-8g7q-j2w9-qr8r.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-8g7q-j2w9-qr8r", - "modified": "2024-11-08T06:30:48Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-11-08T06:30:48Z", "aliases": [ "CVE-2024-50189" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: amd_sfh: Switch to device-managed dmam_alloc_coherent()\n\nUsing the device-managed version allows to simplify clean-up in probe()\nerror path.\n\nAdditionally, this device-managed ensures proper cleanup, which helps to\nresolve memory errors, page faults, btrfs going read-only, and btrfs\ndisk corruption.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -40,10 +41,8 @@ } ], "database_specific": { - "cwe_ids": [ - - ], - "severity": null, + "cwe_ids": [], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-08T06:15:15Z" diff --git a/advisories/unreviewed/2024/11/GHSA-8hmj-4h9r-668v/GHSA-8hmj-4h9r-668v.json b/advisories/unreviewed/2024/11/GHSA-8hmj-4h9r-668v/GHSA-8hmj-4h9r-668v.json index 6766aa57a58..0ff77883b08 100644 --- a/advisories/unreviewed/2024/11/GHSA-8hmj-4h9r-668v/GHSA-8hmj-4h9r-668v.json +++ b/advisories/unreviewed/2024/11/GHSA-8hmj-4h9r-668v/GHSA-8hmj-4h9r-668v.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-8hmj-4h9r-668v", - "modified": "2024-11-08T06:30:48Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-11-08T06:30:48Z", "aliases": [ "CVE-2024-50188" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: phy: dp83869: fix memory corruption when enabling fiber\n\nWhen configuring the fiber port, the DP83869 PHY driver incorrectly\ncalls linkmode_set_bit() with a bit mask (1 << 10) rather than a bit\nnumber (10). This corrupts some other memory location -- in case of\narm64 the priv pointer in the same structure.\n\nSince the advertising flags are updated from supported at the end of the\nfunction the incorrect line isn't needed at all and can be removed.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -44,10 +45,8 @@ } ], "database_specific": { - "cwe_ids": [ - - ], - "severity": null, + "cwe_ids": [], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-08T06:15:15Z" diff --git a/advisories/unreviewed/2024/11/GHSA-8pc5-29j8-pcjq/GHSA-8pc5-29j8-pcjq.json b/advisories/unreviewed/2024/11/GHSA-8pc5-29j8-pcjq/GHSA-8pc5-29j8-pcjq.json index f6f470c6818..02ae604be58 100644 --- a/advisories/unreviewed/2024/11/GHSA-8pc5-29j8-pcjq/GHSA-8pc5-29j8-pcjq.json +++ b/advisories/unreviewed/2024/11/GHSA-8pc5-29j8-pcjq/GHSA-8pc5-29j8-pcjq.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-8pc5-29j8-pcjq", - "modified": "2024-11-27T15:31:45Z", + "modified": "2024-11-27T18:34:04Z", "published": "2024-11-27T15:31:45Z", "aliases": [ "CVE-2024-46055" ], "details": "OpenVidReview 1.0 is vulnerable to Cross Site Scripting (XSS) in review names.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -33,9 +34,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-27T15:15:26Z" diff --git a/advisories/unreviewed/2024/11/GHSA-9j72-p63r-h27h/GHSA-9j72-p63r-h27h.json b/advisories/unreviewed/2024/11/GHSA-9j72-p63r-h27h/GHSA-9j72-p63r-h27h.json index 4ec4fd58fb3..1e5d9bcb1dd 100644 --- a/advisories/unreviewed/2024/11/GHSA-9j72-p63r-h27h/GHSA-9j72-p63r-h27h.json +++ b/advisories/unreviewed/2024/11/GHSA-9j72-p63r-h27h/GHSA-9j72-p63r-h27h.json @@ -7,12 +7,8 @@ "CVE-2024-44786" ], "details": "Incorrect access control in Meabilis CMS 1.0 allows attackers to access other users' address books via unspecified vectors.", - "severity": [ - - ], - "affected": [ - - ], + "severity": [], + "affected": [], "references": [ { "type": "ADVISORY", @@ -25,7 +21,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-276" ], "severity": null, "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-9jv6-m6hq-4qf7/GHSA-9jv6-m6hq-4qf7.json b/advisories/unreviewed/2024/11/GHSA-9jv6-m6hq-4qf7/GHSA-9jv6-m6hq-4qf7.json index 6783590a123..768950b1716 100644 --- a/advisories/unreviewed/2024/11/GHSA-9jv6-m6hq-4qf7/GHSA-9jv6-m6hq-4qf7.json +++ b/advisories/unreviewed/2024/11/GHSA-9jv6-m6hq-4qf7/GHSA-9jv6-m6hq-4qf7.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-9jv6-m6hq-4qf7", - "modified": "2024-11-22T21:32:15Z", + "modified": "2024-11-27T18:34:02Z", "published": "2024-11-22T21:32:15Z", "aliases": [ "CVE-2024-37782" ], "details": "An LDAP injection vulnerability in the login page of Gladinet CentreStack v13.12.9934.54690 allows attackers to access sensitive data or execute arbitrary commands via a crafted payload injected into the username field.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -33,9 +34,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-77" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-22T18:15:17Z" diff --git a/advisories/unreviewed/2024/11/GHSA-c62v-4w5f-p7pw/GHSA-c62v-4w5f-p7pw.json b/advisories/unreviewed/2024/11/GHSA-c62v-4w5f-p7pw/GHSA-c62v-4w5f-p7pw.json index 9b190dec912..a6cdfda9d88 100644 --- a/advisories/unreviewed/2024/11/GHSA-c62v-4w5f-p7pw/GHSA-c62v-4w5f-p7pw.json +++ b/advisories/unreviewed/2024/11/GHSA-c62v-4w5f-p7pw/GHSA-c62v-4w5f-p7pw.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-c62v-4w5f-p7pw", - "modified": "2024-11-19T03:31:08Z", + "modified": "2024-11-27T18:34:01Z", "published": "2024-11-19T03:31:08Z", "aliases": [ "CVE-2024-50288" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: vivid: fix buffer overwrite when using > 32 buffers\n\nThe maximum number of buffers that can be requested was increased to\n64 for the video capture queue. But video capture used a must_blank\narray that was still sized for 32 (VIDEO_MAX_FRAME). This caused an\nout-of-bounds write when using buffer indices >= 32.\n\nCreate a new define MAX_VID_CAP_BUFFERS that is used to access the\nmust_blank array and set max_num_buffers for the video capture queue.\n\nThis solves a crash reported by:\n\n\thttps://bugzilla.kernel.org/show_bug.cgi?id=219258", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -29,9 +30,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-19T02:16:31Z" diff --git a/advisories/unreviewed/2024/11/GHSA-c97r-q93g-fc5c/GHSA-c97r-q93g-fc5c.json b/advisories/unreviewed/2024/11/GHSA-c97r-q93g-fc5c/GHSA-c97r-q93g-fc5c.json index d7d77406107..ef003514b6b 100644 --- a/advisories/unreviewed/2024/11/GHSA-c97r-q93g-fc5c/GHSA-c97r-q93g-fc5c.json +++ b/advisories/unreviewed/2024/11/GHSA-c97r-q93g-fc5c/GHSA-c97r-q93g-fc5c.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-c97r-q93g-fc5c", - "modified": "2024-11-27T15:31:45Z", + "modified": "2024-11-27T18:34:03Z", "published": "2024-11-27T15:31:45Z", "aliases": [ "CVE-2024-53603" ], "details": "A SQL Injection vulnerability was found in /covid-tms/password-recovery.php in PHPGurukul COVID 19 Testing Management System v1.0, which allows remote attackers to execute arbitrary code via the contactno POST request parameter.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -25,9 +26,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-27T14:15:18Z" diff --git a/advisories/unreviewed/2024/11/GHSA-cf97-gpjm-x8fj/GHSA-cf97-gpjm-x8fj.json b/advisories/unreviewed/2024/11/GHSA-cf97-gpjm-x8fj/GHSA-cf97-gpjm-x8fj.json index 8b233b1c58f..c92415bcf05 100644 --- a/advisories/unreviewed/2024/11/GHSA-cf97-gpjm-x8fj/GHSA-cf97-gpjm-x8fj.json +++ b/advisories/unreviewed/2024/11/GHSA-cf97-gpjm-x8fj/GHSA-cf97-gpjm-x8fj.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-cf97-gpjm-x8fj", - "modified": "2024-11-19T03:31:08Z", + "modified": "2024-11-27T18:34:01Z", "published": "2024-11-19T03:31:08Z", "aliases": [ "CVE-2024-50284" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix the missing xa_store error check\n\nxa_store() can fail, it return xa_err(-EINVAL) if the entry cannot\nbe stored in an XArray, or xa_err(-ENOMEM) if memory allocation failed,\nso check error for xa_store() to fix it.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -37,9 +38,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-754" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-19T02:16:30Z" diff --git a/advisories/unreviewed/2024/11/GHSA-cg9q-fmpx-v2mf/GHSA-cg9q-fmpx-v2mf.json b/advisories/unreviewed/2024/11/GHSA-cg9q-fmpx-v2mf/GHSA-cg9q-fmpx-v2mf.json new file mode 100644 index 00000000000..a9e4959a80e --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-cg9q-fmpx-v2mf/GHSA-cg9q-fmpx-v2mf.json @@ -0,0 +1,25 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cg9q-fmpx-v2mf", + "modified": "2024-11-27T18:34:04Z", + "published": "2024-11-27T18:34:04Z", + "aliases": [ + "CVE-2024-53254" + ], + "details": "Rejected reason: This CVE is a duplicate of another CVE.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53254" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-27T18:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-ch98-87fr-x9f7/GHSA-ch98-87fr-x9f7.json b/advisories/unreviewed/2024/11/GHSA-ch98-87fr-x9f7/GHSA-ch98-87fr-x9f7.json index 1d4822c573c..16bd26a26c0 100644 --- a/advisories/unreviewed/2024/11/GHSA-ch98-87fr-x9f7/GHSA-ch98-87fr-x9f7.json +++ b/advisories/unreviewed/2024/11/GHSA-ch98-87fr-x9f7/GHSA-ch98-87fr-x9f7.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-ch98-87fr-x9f7", - "modified": "2024-11-19T03:31:07Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-11-19T03:31:07Z", "aliases": [ "CVE-2024-50272" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfilemap: Fix bounds checking in filemap_read()\n\nIf the caller supplies an iocb->ki_pos value that is close to the\nfilesystem upper limit, and an iterator with a count that causes us to\noverflow that limit, then filemap_read() enters an infinite loop.\n\nThis behaviour was discovered when testing xfstests generic/525 with the\n\"localio\" optimisation for loopback NFS mounts.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -37,9 +38,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-835" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-19T02:16:29Z" diff --git a/advisories/unreviewed/2024/11/GHSA-cmh5-78pc-x57w/GHSA-cmh5-78pc-x57w.json b/advisories/unreviewed/2024/11/GHSA-cmh5-78pc-x57w/GHSA-cmh5-78pc-x57w.json index 8ccf26c303b..a73c4025107 100644 --- a/advisories/unreviewed/2024/11/GHSA-cmh5-78pc-x57w/GHSA-cmh5-78pc-x57w.json +++ b/advisories/unreviewed/2024/11/GHSA-cmh5-78pc-x57w/GHSA-cmh5-78pc-x57w.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-cpxj-fx45-9pgm/GHSA-cpxj-fx45-9pgm.json b/advisories/unreviewed/2024/11/GHSA-cpxj-fx45-9pgm/GHSA-cpxj-fx45-9pgm.json index 705015a9b2b..f7ed806f871 100644 --- a/advisories/unreviewed/2024/11/GHSA-cpxj-fx45-9pgm/GHSA-cpxj-fx45-9pgm.json +++ b/advisories/unreviewed/2024/11/GHSA-cpxj-fx45-9pgm/GHSA-cpxj-fx45-9pgm.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-cpxj-fx45-9pgm", - "modified": "2024-11-26T15:31:01Z", + "modified": "2024-11-27T18:34:03Z", "published": "2024-11-26T15:31:01Z", "aliases": [ "CVE-2024-11692" ], "details": "An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -41,9 +42,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-290" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-26T14:15:18Z" diff --git a/advisories/unreviewed/2024/11/GHSA-fwxq-3f52-5cmc/GHSA-fwxq-3f52-5cmc.json b/advisories/unreviewed/2024/11/GHSA-fwxq-3f52-5cmc/GHSA-fwxq-3f52-5cmc.json new file mode 100644 index 00000000000..270816f7b36 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-fwxq-3f52-5cmc/GHSA-fwxq-3f52-5cmc.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fwxq-3f52-5cmc", + "modified": "2024-11-27T18:34:04Z", + "published": "2024-11-27T18:34:04Z", + "aliases": [ + "CVE-2024-54004" + ], + "details": "Jenkins Filesystem List Parameter Plugin 0.0.14 and earlier does not restrict the path used for the File system objects list Parameter, allowing attackers with Item/Configure permission to enumerate file names on the Jenkins controller file system.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54004" + }, + { + "type": "WEB", + "url": "https://www.jenkins.io/security/advisory/2024-11-27/#SECURITY-3367" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-27T17:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-fx99-8m8g-rfwx/GHSA-fx99-8m8g-rfwx.json b/advisories/unreviewed/2024/11/GHSA-fx99-8m8g-rfwx/GHSA-fx99-8m8g-rfwx.json index f51d26bb0f3..74e64318598 100644 --- a/advisories/unreviewed/2024/11/GHSA-fx99-8m8g-rfwx/GHSA-fx99-8m8g-rfwx.json +++ b/advisories/unreviewed/2024/11/GHSA-fx99-8m8g-rfwx/GHSA-fx99-8m8g-rfwx.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-fx99-8m8g-rfwx", - "modified": "2024-11-19T18:31:07Z", + "modified": "2024-11-27T18:34:01Z", "published": "2024-11-19T18:31:07Z", "aliases": [ "CVE-2024-53080" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panthor: Lock XArray when getting entries for the VM\n\nSimilar to commit cac075706f29 (\"drm/panthor: Fix race when converting\ngroup handle to group object\") we need to use the XArray's internal\nlocking when retrieving a vm pointer from there.\n\nv2: Removed part of the patch that was trying to protect fetching\nthe heap pointer from XArray, as that operation is protected by\nthe @pool->lock.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -29,9 +30,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-667" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-19T18:15:27Z" diff --git a/advisories/unreviewed/2024/11/GHSA-g4gg-7gqp-cf6m/GHSA-g4gg-7gqp-cf6m.json b/advisories/unreviewed/2024/11/GHSA-g4gg-7gqp-cf6m/GHSA-g4gg-7gqp-cf6m.json index 244ceccb7d8..d7402b372ae 100644 --- a/advisories/unreviewed/2024/11/GHSA-g4gg-7gqp-cf6m/GHSA-g4gg-7gqp-cf6m.json +++ b/advisories/unreviewed/2024/11/GHSA-g4gg-7gqp-cf6m/GHSA-g4gg-7gqp-cf6m.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-g4gg-7gqp-cf6m", - "modified": "2024-11-19T18:31:06Z", + "modified": "2024-11-27T18:34:01Z", "published": "2024-11-19T18:31:06Z", "aliases": [ "CVE-2024-53044" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext()\n\nThis command:\n\n$ tc qdisc replace dev eth0 ingress_block 1 egress_block 1 clsact\nError: block dev insert failed: -EBUSY.\n\nfails because user space requests the same block index to be set for\nboth ingress and egress.\n\n[ side note, I don't think it even failed prior to commit 913b47d3424e\n (\"net/sched: Introduce tc block netdev tracking infra\"), because this\n is a command from an old set of notes of mine which used to work, but\n alas, I did not scientifically bisect this ]\n\nThe problem is not that it fails, but rather, that the second time\naround, it fails differently (and irrecoverably):\n\n$ tc qdisc replace dev eth0 ingress_block 1 egress_block 1 clsact\nError: dsa_core: Flow block cb is busy.\n\n[ another note: the extack is added by me for illustration purposes.\n the context of the problem is that clsact_init() obtains the same\n &q->ingress_block pointer as &q->egress_block, and since we call\n tcf_block_get_ext() on both of them, \"dev\" will be added to the\n block->ports xarray twice, thus failing the operation: once through\n the ingress block pointer, and once again through the egress block\n pointer. the problem itself is that when xa_insert() fails, we have\n emitted a FLOW_BLOCK_BIND command through ndo_setup_tc(), but the\n offload never sees a corresponding FLOW_BLOCK_UNBIND. ]\n\nEven correcting the bad user input, we still cannot recover:\n\n$ tc qdisc replace dev swp3 ingress_block 1 egress_block 2 clsact\nError: dsa_core: Flow block cb is busy.\n\nBasically the only way to recover is to reboot the system, or unbind and\nrebind the net device driver.\n\nTo fix the bug, we need to fill the correct error teardown path which\nwas missed during code movement, and call tcf_block_offload_unbind()\nwhen xa_insert() fails.\n\n[ last note, fundamentally I blame the label naming convention in\n tcf_block_get_ext() for the bug. The labels should be named after what\n they do, not after the error path that jumps to them. This way, it is\n obviously wrong that two labels pointing to the same code mean\n something is wrong, and checking the code correctness at the goto site\n is also easier ]", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,10 +29,8 @@ } ], "database_specific": { - "cwe_ids": [ - - ], - "severity": null, + "cwe_ids": [], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-19T18:15:24Z" diff --git a/advisories/unreviewed/2024/11/GHSA-g772-w9v5-7985/GHSA-g772-w9v5-7985.json b/advisories/unreviewed/2024/11/GHSA-g772-w9v5-7985/GHSA-g772-w9v5-7985.json index 20961ffd494..1ff522c2f73 100644 --- a/advisories/unreviewed/2024/11/GHSA-g772-w9v5-7985/GHSA-g772-w9v5-7985.json +++ b/advisories/unreviewed/2024/11/GHSA-g772-w9v5-7985/GHSA-g772-w9v5-7985.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-g772-w9v5-7985", - "modified": "2024-11-15T00:31:50Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-11-15T00:31:50Z", "aliases": [ "CVE-2024-39707" ], "details": "Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could lead to a possible roll-back attack in certain platforms. This is fixed in: kernel 5.2, version 05.29.19; kernel 5.3, version 05.38.19; kernel 5.4, version 05.46.19; kernel 5.5, version 05.54.19; kernel 5.6, version 05.61.19.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -25,9 +26,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-306" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-14T22:15:16Z" diff --git a/advisories/unreviewed/2024/11/GHSA-gmcv-67g3-vrwj/GHSA-gmcv-67g3-vrwj.json b/advisories/unreviewed/2024/11/GHSA-gmcv-67g3-vrwj/GHSA-gmcv-67g3-vrwj.json new file mode 100644 index 00000000000..d515bf1cf4c --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-gmcv-67g3-vrwj/GHSA-gmcv-67g3-vrwj.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gmcv-67g3-vrwj", + "modified": "2024-11-27T18:34:04Z", + "published": "2024-11-27T18:34:04Z", + "aliases": [ + "CVE-2024-21703" + ], + "details": "This Medium severity Security Misconfiguration vulnerability was introduced in version 8.8.1 of Confluence Data Center and Server for Windows installations.\n\n\n\nThis Security Misconfiguration vulnerability, with a CVSS Score of 6.4 allows an authenticated attacker of the Windows host to read sensitive information about the Confluence Data Center configuration which has high impact to confidentiality, high impact to integrity, high impact to availability, and no user interaction.\n\n\n\nAtlassian recommends that Confluence Data Center and Server customers upgrade to the latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n\n* Confluence Data Center and Server 7.19: Upgrade to a release greater than or equal to 7.19.18 \n* Confluence Data Center and Server 8.5: Upgrade to a release greater than or equal to 8.5.5\n* Confluence Data Center and Server 8.7: Upgrade to a release greater than or equal to 8.7.2\n* Confluence Data Center and Server 8.8: Upgrade to a release greater than or equal to 8.8.0\n\n\n\nSee the release notes (https://confluence.atlassian.com/conf88/confluence-release-notes-1354501008.html ). You can download the latest version of Confluence Data Center and Server from the download center (https://www.atlassian.com/software/confluence/download-archives ). \n\nThis vulnerability was reported via our Atlassian Bug Bounty Program by Chris Elliot.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21703" + }, + { + "type": "WEB", + "url": "https://jira.atlassian.com/browse/CONFSERVER-98413" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-732" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-27T17:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-gr5x-8j97-qq23/GHSA-gr5x-8j97-qq23.json b/advisories/unreviewed/2024/11/GHSA-gr5x-8j97-qq23/GHSA-gr5x-8j97-qq23.json index f6f97e0ecc0..0b5ebc425cc 100644 --- a/advisories/unreviewed/2024/11/GHSA-gr5x-8j97-qq23/GHSA-gr5x-8j97-qq23.json +++ b/advisories/unreviewed/2024/11/GHSA-gr5x-8j97-qq23/GHSA-gr5x-8j97-qq23.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-gr5x-8j97-qq23", - "modified": "2024-11-22T21:32:15Z", + "modified": "2024-11-27T18:34:02Z", "published": "2024-11-22T21:32:15Z", "aliases": [ "CVE-2024-53438" ], "details": "EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter, which is directly interpolated into the SQL query without proper sanitization or validation, allowing attackers to execute arbitrary SQL commands.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -25,9 +26,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-22T17:15:10Z" diff --git a/advisories/unreviewed/2024/11/GHSA-h43c-gg33-qj9g/GHSA-h43c-gg33-qj9g.json b/advisories/unreviewed/2024/11/GHSA-h43c-gg33-qj9g/GHSA-h43c-gg33-qj9g.json index ee7eecfc6d4..1162274d990 100644 --- a/advisories/unreviewed/2024/11/GHSA-h43c-gg33-qj9g/GHSA-h43c-gg33-qj9g.json +++ b/advisories/unreviewed/2024/11/GHSA-h43c-gg33-qj9g/GHSA-h43c-gg33-qj9g.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-h43c-gg33-qj9g", - "modified": "2024-11-26T15:31:02Z", + "modified": "2024-11-27T18:34:03Z", "published": "2024-11-26T15:31:02Z", "aliases": [ "CVE-2024-11705" ], "details": "`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior conflicted with the PKCS#11 v3.0 specification, which allows `phKey` to be NULL for certain mechanisms. This vulnerability affects Firefox < 133 and Thunderbird < 133.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -33,9 +34,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-26T14:15:19Z" diff --git a/advisories/unreviewed/2024/11/GHSA-h7q2-h7p3-jwmj/GHSA-h7q2-h7p3-jwmj.json b/advisories/unreviewed/2024/11/GHSA-h7q2-h7p3-jwmj/GHSA-h7q2-h7p3-jwmj.json index 9cbc76d418a..35fefdd69f0 100644 --- a/advisories/unreviewed/2024/11/GHSA-h7q2-h7p3-jwmj/GHSA-h7q2-h7p3-jwmj.json +++ b/advisories/unreviewed/2024/11/GHSA-h7q2-h7p3-jwmj/GHSA-h7q2-h7p3-jwmj.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-h7q2-h7p3-jwmj", - "modified": "2024-11-19T03:31:07Z", + "modified": "2024-11-27T18:34:01Z", "published": "2024-11-19T03:31:07Z", "aliases": [ "CVE-2024-50277" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm: fix a crash if blk_alloc_disk fails\n\nIf blk_alloc_disk fails, the variable md->disk is set to an error value.\ncleanup_mapped_device will see that md->disk is non-NULL and it will\nattempt to access it, causing a crash on this statement\n\"md->disk->private_data = NULL;\".", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -29,9 +30,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-19T02:16:30Z" diff --git a/advisories/unreviewed/2024/11/GHSA-h8gv-f7pf-7c4p/GHSA-h8gv-f7pf-7c4p.json b/advisories/unreviewed/2024/11/GHSA-h8gv-f7pf-7c4p/GHSA-h8gv-f7pf-7c4p.json index e98b3a1afb6..4c73e8309dc 100644 --- a/advisories/unreviewed/2024/11/GHSA-h8gv-f7pf-7c4p/GHSA-h8gv-f7pf-7c4p.json +++ b/advisories/unreviewed/2024/11/GHSA-h8gv-f7pf-7c4p/GHSA-h8gv-f7pf-7c4p.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-h8gv-f7pf-7c4p", - "modified": "2024-11-26T15:31:02Z", + "modified": "2024-11-27T18:34:03Z", "published": "2024-11-26T15:31:02Z", "aliases": [ "CVE-2024-11704" ], "details": "A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the same symmetric key could have been freed twice, potentially leading to memory corruption. This vulnerability affects Firefox < 133 and Thunderbird < 133.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -33,9 +34,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-415" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-26T14:15:19Z" diff --git a/advisories/unreviewed/2024/11/GHSA-hcgq-c6f2-4jh5/GHSA-hcgq-c6f2-4jh5.json b/advisories/unreviewed/2024/11/GHSA-hcgq-c6f2-4jh5/GHSA-hcgq-c6f2-4jh5.json new file mode 100644 index 00000000000..9448e5f2fe8 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-hcgq-c6f2-4jh5/GHSA-hcgq-c6f2-4jh5.json @@ -0,0 +1,45 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hcgq-c6f2-4jh5", + "modified": "2024-11-27T18:34:04Z", + "published": "2024-11-27T18:34:04Z", + "aliases": [ + "CVE-2024-51228" + ], + "details": "An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX-N300RT V2.1.8-B20171113.1408 and TOTOLINK-CX-N300RT V2.1.8-B20191010.1107 and TOTOLINK-CX-N302RE V2.0.2-B20170511.1523 allows a remote attacker to execute arbitrary code via the /boafrm/formSysCmd component.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51228" + }, + { + "type": "WEB", + "url": "https://github.com/yckuo-sdc/totolink-boa-api-vulnerabilities" + }, + { + "type": "WEB", + "url": "https://totolink.tw/support_view/A3002RU" + }, + { + "type": "WEB", + "url": "https://totolink.tw/support_view/N150RT" + }, + { + "type": "WEB", + "url": "https://www.totolink.tw/products_view/N300RT" + }, + { + "type": "WEB", + "url": "https://www.totolink.tw/products_view/N302RE" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-27T17:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hf9m-wphx-73hw/GHSA-hf9m-wphx-73hw.json b/advisories/unreviewed/2024/11/GHSA-hf9m-wphx-73hw/GHSA-hf9m-wphx-73hw.json index 677a03ef4d8..81f956460d4 100644 --- a/advisories/unreviewed/2024/11/GHSA-hf9m-wphx-73hw/GHSA-hf9m-wphx-73hw.json +++ b/advisories/unreviewed/2024/11/GHSA-hf9m-wphx-73hw/GHSA-hf9m-wphx-73hw.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-hf9m-wphx-73hw", - "modified": "2024-11-22T21:32:15Z", + "modified": "2024-11-27T18:34:02Z", "published": "2024-11-22T21:32:15Z", "aliases": [ "CVE-2024-50657" ], "details": "An issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, specifically in the checkPassCodeIsValid method", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -29,9 +30,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-276" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-22T18:15:17Z" diff --git a/advisories/unreviewed/2024/11/GHSA-jpj5-4r47-rch8/GHSA-jpj5-4r47-rch8.json b/advisories/unreviewed/2024/11/GHSA-jpj5-4r47-rch8/GHSA-jpj5-4r47-rch8.json index 7b0472fe9c1..cf990bd4c41 100644 --- a/advisories/unreviewed/2024/11/GHSA-jpj5-4r47-rch8/GHSA-jpj5-4r47-rch8.json +++ b/advisories/unreviewed/2024/11/GHSA-jpj5-4r47-rch8/GHSA-jpj5-4r47-rch8.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-jpj5-4r47-rch8", - "modified": "2024-11-15T21:30:47Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-11-15T21:30:47Z", "aliases": [ "CVE-2024-44758" ], "details": "An arbitrary file upload vulnerability in the component /Production/UploadFile of NUS-M9 ERP Management Software v3.0.0 allows attackers to execute arbitrary code via uploading crafted files.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -29,9 +30,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-15T21:15:09Z" diff --git a/advisories/unreviewed/2024/11/GHSA-m59j-fmqm-3q93/GHSA-m59j-fmqm-3q93.json b/advisories/unreviewed/2024/11/GHSA-m59j-fmqm-3q93/GHSA-m59j-fmqm-3q93.json index 2c9071aa5a3..54248094427 100644 --- a/advisories/unreviewed/2024/11/GHSA-m59j-fmqm-3q93/GHSA-m59j-fmqm-3q93.json +++ b/advisories/unreviewed/2024/11/GHSA-m59j-fmqm-3q93/GHSA-m59j-fmqm-3q93.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-m59j-fmqm-3q93", - "modified": "2024-11-26T15:31:02Z", + "modified": "2024-11-27T18:34:03Z", "published": "2024-11-26T15:31:02Z", "aliases": [ "CVE-2024-11698" ], "details": "A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dialog was opened during the transition. This issue left users unable to exit fullscreen mode using standard actions like pressing \"Esc\" or accessing right-click menus, resulting in a disrupted browsing experience until the browser is restarted. \n*This bug only affects the application when running on macOS. Other operating systems are unaffected.* This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -40,10 +41,8 @@ } ], "database_specific": { - "cwe_ids": [ - - ], - "severity": null, + "cwe_ids": [], + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-26T14:15:19Z" diff --git a/advisories/unreviewed/2024/11/GHSA-m7vh-7qm6-rq42/GHSA-m7vh-7qm6-rq42.json b/advisories/unreviewed/2024/11/GHSA-m7vh-7qm6-rq42/GHSA-m7vh-7qm6-rq42.json new file mode 100644 index 00000000000..add1a5ba0fc --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-m7vh-7qm6-rq42/GHSA-m7vh-7qm6-rq42.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m7vh-7qm6-rq42", + "modified": "2024-11-27T18:34:04Z", + "published": "2024-11-27T18:34:04Z", + "aliases": [ + "CVE-2024-31976" + ], + "details": "EnGenius EWS356-FIR 1.1.30 and earlier devices allow a remote attacker to execute arbitrary OS commands via the Controller connectivity parameter.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31976" + }, + { + "type": "WEB", + "url": "https://github.com/actuator/cve/blob/main/Engenius/CVE-2024-31976" + }, + { + "type": "WEB", + "url": "https://github.com/actuator/cve/tree/main/EnGenius/EWS356-FIT" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-27T17:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-mf47-w2f7-gc7f/GHSA-mf47-w2f7-gc7f.json b/advisories/unreviewed/2024/11/GHSA-mf47-w2f7-gc7f/GHSA-mf47-w2f7-gc7f.json index d5cb82fd350..92741fa9ad3 100644 --- a/advisories/unreviewed/2024/11/GHSA-mf47-w2f7-gc7f/GHSA-mf47-w2f7-gc7f.json +++ b/advisories/unreviewed/2024/11/GHSA-mf47-w2f7-gc7f/GHSA-mf47-w2f7-gc7f.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-mf47-w2f7-gc7f", - "modified": "2024-11-19T03:31:07Z", + "modified": "2024-11-27T18:34:01Z", "published": "2024-11-19T03:31:07Z", "aliases": [ "CVE-2024-50273" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reinitialize delayed ref list after deleting it from the list\n\nAt insert_delayed_ref() if we need to update the action of an existing\nref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head's\nref_add_list using list_del(), which leaves the ref's add_list member\nnot reinitialized, as list_del() sets the next and prev members of the\nlist to LIST_POISON1 and LIST_POISON2, respectively.\n\nIf later we end up calling drop_delayed_ref() against the ref, which can\nhappen during merging or when destroying delayed refs due to a transaction\nabort, we can trigger a crash since at drop_delayed_ref() we call\nlist_empty() against the ref's add_list, which returns false since\nthe list was not reinitialized after the list_del() and as a consequence\nwe call list_del() again at drop_delayed_ref(). This results in an\ninvalid list access since the next and prev members are set to poison\npointers, resulting in a splat if CONFIG_LIST_HARDENED and\nCONFIG_DEBUG_LIST are set or invalid poison pointer dereferences\notherwise.\n\nSo fix this by deleting from the list with list_del_init() instead.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -53,9 +54,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-908" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-19T02:16:29Z" diff --git a/advisories/unreviewed/2024/11/GHSA-mjcw-r3mg-3848/GHSA-mjcw-r3mg-3848.json b/advisories/unreviewed/2024/11/GHSA-mjcw-r3mg-3848/GHSA-mjcw-r3mg-3848.json index fc5482d4229..b7c92030946 100644 --- a/advisories/unreviewed/2024/11/GHSA-mjcw-r3mg-3848/GHSA-mjcw-r3mg-3848.json +++ b/advisories/unreviewed/2024/11/GHSA-mjcw-r3mg-3848/GHSA-mjcw-r3mg-3848.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-mjcw-r3mg-3848", - "modified": "2024-11-26T15:31:02Z", + "modified": "2024-11-27T18:34:03Z", "published": "2024-11-26T15:31:02Z", "aliases": [ "CVE-2024-11694" ], "details": "Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, and Thunderbird < 128.5.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -45,9 +46,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-26T14:15:18Z" diff --git a/advisories/unreviewed/2024/11/GHSA-p3xg-2r2p-7rm4/GHSA-p3xg-2r2p-7rm4.json b/advisories/unreviewed/2024/11/GHSA-p3xg-2r2p-7rm4/GHSA-p3xg-2r2p-7rm4.json index dcf3e6613ab..3d1f3907238 100644 --- a/advisories/unreviewed/2024/11/GHSA-p3xg-2r2p-7rm4/GHSA-p3xg-2r2p-7rm4.json +++ b/advisories/unreviewed/2024/11/GHSA-p3xg-2r2p-7rm4/GHSA-p3xg-2r2p-7rm4.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-p3xg-2r2p-7rm4", - "modified": "2024-11-19T18:31:07Z", + "modified": "2024-11-27T18:34:01Z", "published": "2024-11-19T18:31:07Z", "aliases": [ "CVE-2024-53081" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: ar0521: don't overflow when checking PLL values\n\nThe PLL checks are comparing 64 bit integers with 32 bit\nones, as reported by Coverity. Depending on the values of\nthe variables, this may underflow.\n\nFix it ensuring that both sides of the expression are u64.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -37,9 +38,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-191" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-19T18:15:27Z" diff --git a/advisories/unreviewed/2024/11/GHSA-p9h5-xg4q-c272/GHSA-p9h5-xg4q-c272.json b/advisories/unreviewed/2024/11/GHSA-p9h5-xg4q-c272/GHSA-p9h5-xg4q-c272.json index 40bcadd1eea..7d3595bda1d 100644 --- a/advisories/unreviewed/2024/11/GHSA-p9h5-xg4q-c272/GHSA-p9h5-xg4q-c272.json +++ b/advisories/unreviewed/2024/11/GHSA-p9h5-xg4q-c272/GHSA-p9h5-xg4q-c272.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-p9h5-xg4q-c272", - "modified": "2024-11-20T21:30:49Z", + "modified": "2024-11-27T18:34:02Z", "published": "2024-11-20T21:30:49Z", "aliases": [ "CVE-2024-33439" ], "details": "An issue in Kasda LinkSmart Router KW5515 v1.7 and before allows an authenticated remote attacker to execute arbitrary OS commands via cgi parameters.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -25,9 +26,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-77" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-20T19:15:06Z" diff --git a/advisories/unreviewed/2024/11/GHSA-p9vw-xw86-3f2w/GHSA-p9vw-xw86-3f2w.json b/advisories/unreviewed/2024/11/GHSA-p9vw-xw86-3f2w/GHSA-p9vw-xw86-3f2w.json index bd46e45e61e..13c5fb6b576 100644 --- a/advisories/unreviewed/2024/11/GHSA-p9vw-xw86-3f2w/GHSA-p9vw-xw86-3f2w.json +++ b/advisories/unreviewed/2024/11/GHSA-p9vw-xw86-3f2w/GHSA-p9vw-xw86-3f2w.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-p9vw-xw86-3f2w", - "modified": "2024-11-26T15:31:02Z", + "modified": "2024-11-27T18:34:03Z", "published": "2024-11-26T15:31:02Z", "aliases": [ "CVE-2024-11701" ], "details": "The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133 and Thunderbird < 133.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -33,9 +34,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-290" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-26T14:15:19Z" diff --git a/advisories/unreviewed/2024/11/GHSA-ph52-wh83-m7pg/GHSA-ph52-wh83-m7pg.json b/advisories/unreviewed/2024/11/GHSA-ph52-wh83-m7pg/GHSA-ph52-wh83-m7pg.json new file mode 100644 index 00000000000..0d41bf681cf --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-ph52-wh83-m7pg/GHSA-ph52-wh83-m7pg.json @@ -0,0 +1,60 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ph52-wh83-m7pg", + "modified": "2024-11-27T18:34:04Z", + "published": "2024-11-27T18:34:04Z", + "aliases": [ + "CVE-2024-11860" + ], + "details": "A vulnerability classified as critical has been found in SourceCodester Best House Rental Management System 1.0. This affects an unknown part of the file /rental/ajax.php?action=delete_tenant of the component POST Request Handler. The manipulation of the argument id leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11860" + }, + { + "type": "WEB", + "url": "https://drive.google.com/file/d/1CyjtknGVqn5QO_R1WZX-hoGH8ae5DjRq/view" + }, + { + "type": "WEB", + "url": "https://github.com/YasserREED/YasserREED-CVEs/blob/main/Best%20house%20rental%20management%20system%20project%20in%20php/Unauthorized%20Tenant%20Deletion.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.286245" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.286245" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.449684" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-27T17:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-pm6r-99f9-h4r7/GHSA-pm6r-99f9-h4r7.json b/advisories/unreviewed/2024/11/GHSA-pm6r-99f9-h4r7/GHSA-pm6r-99f9-h4r7.json new file mode 100644 index 00000000000..8581eb5427a --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-pm6r-99f9-h4r7/GHSA-pm6r-99f9-h4r7.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pm6r-99f9-h4r7", + "modified": "2024-11-27T18:34:04Z", + "published": "2024-11-27T18:34:04Z", + "aliases": [ + "CVE-2024-37816" + ], + "details": "Quectel EC25-EUX EC25EUXGAR08A05M1G was discovered to contain a stack overflow.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37816" + }, + { + "type": "WEB", + "url": "https://github.com/quectel-official/Quectel-Security" + }, + { + "type": "WEB", + "url": "http://quectel.com" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-27T17:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-qxf6-g9x3-8w74/GHSA-qxf6-g9x3-8w74.json b/advisories/unreviewed/2024/11/GHSA-qxf6-g9x3-8w74/GHSA-qxf6-g9x3-8w74.json index 747e6827ce0..9fbecbfdb04 100644 --- a/advisories/unreviewed/2024/11/GHSA-qxf6-g9x3-8w74/GHSA-qxf6-g9x3-8w74.json +++ b/advisories/unreviewed/2024/11/GHSA-qxf6-g9x3-8w74/GHSA-qxf6-g9x3-8w74.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-qxf6-g9x3-8w74", - "modified": "2024-11-26T15:31:01Z", + "modified": "2024-11-27T18:34:03Z", "published": "2024-11-26T15:31:01Z", "aliases": [ "CVE-2024-11693" ], "details": "The executable file warning was not presented when downloading .library-ms files. \n*Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -40,10 +41,8 @@ } ], "database_specific": { - "cwe_ids": [ - - ], - "severity": null, + "cwe_ids": [], + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-26T14:15:18Z" diff --git a/advisories/unreviewed/2024/11/GHSA-r2pf-gw8f-9x87/GHSA-r2pf-gw8f-9x87.json b/advisories/unreviewed/2024/11/GHSA-r2pf-gw8f-9x87/GHSA-r2pf-gw8f-9x87.json index b600ea565e4..4befce2eef0 100644 --- a/advisories/unreviewed/2024/11/GHSA-r2pf-gw8f-9x87/GHSA-r2pf-gw8f-9x87.json +++ b/advisories/unreviewed/2024/11/GHSA-r2pf-gw8f-9x87/GHSA-r2pf-gw8f-9x87.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-r2pf-gw8f-9x87", - "modified": "2024-11-21T21:33:32Z", + "modified": "2024-11-27T18:34:02Z", "published": "2024-11-21T21:33:32Z", "aliases": [ "CVE-2024-51367" ], "details": "An arbitrary file upload vulnerability in the component \\Users\\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitrary code via uploading a crafted .xml file.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -29,9 +30,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-21T20:15:44Z" diff --git a/advisories/unreviewed/2024/11/GHSA-r4vw-x7gf-4r43/GHSA-r4vw-x7gf-4r43.json b/advisories/unreviewed/2024/11/GHSA-r4vw-x7gf-4r43/GHSA-r4vw-x7gf-4r43.json new file mode 100644 index 00000000000..eb31ea66d9f --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-r4vw-x7gf-4r43/GHSA-r4vw-x7gf-4r43.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r4vw-x7gf-4r43", + "modified": "2024-11-27T18:34:04Z", + "published": "2024-11-27T18:34:04Z", + "aliases": [ + "CVE-2024-7025" + ], + "details": "Integer overflow in Layout in Google Chrome prior to 129.0.6668.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7025" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/367764861" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-472" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-27T18:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-r5vq-m2mp-cpfj/GHSA-r5vq-m2mp-cpfj.json b/advisories/unreviewed/2024/11/GHSA-r5vq-m2mp-cpfj/GHSA-r5vq-m2mp-cpfj.json new file mode 100644 index 00000000000..3a348c5ebb0 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-r5vq-m2mp-cpfj/GHSA-r5vq-m2mp-cpfj.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r5vq-m2mp-cpfj", + "modified": "2024-11-27T18:34:02Z", + "published": "2024-11-27T18:34:02Z", + "aliases": [ + "CVE-2024-30896" + ], + "details": "InfluxDB through 2.7.10 allows allAccess administrators to retrieve all raw tokens via an \"influx auth ls\" command. NOTE: the supplier indicates that this is intentional but is a \"poor design choice\" that will be changed in a future release.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30896" + }, + { + "type": "WEB", + "url": "https://github.com/influxdata/influxdb/issues/24797" + }, + { + "type": "WEB", + "url": "https://github.com/XenoM0rph97/CVE-2024-30896" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-922" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-21T11:15:34Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-rh22-rcv2-42x3/GHSA-rh22-rcv2-42x3.json b/advisories/unreviewed/2024/11/GHSA-rh22-rcv2-42x3/GHSA-rh22-rcv2-42x3.json index fef580bf64c..c24cb40555c 100644 --- a/advisories/unreviewed/2024/11/GHSA-rh22-rcv2-42x3/GHSA-rh22-rcv2-42x3.json +++ b/advisories/unreviewed/2024/11/GHSA-rh22-rcv2-42x3/GHSA-rh22-rcv2-42x3.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-rh22-rcv2-42x3", - "modified": "2024-11-26T15:31:02Z", + "modified": "2024-11-27T18:34:03Z", "published": "2024-11-26T15:31:02Z", "aliases": [ "CVE-2024-11695" ], "details": "A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -41,9 +42,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-1021" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-26T14:15:19Z" diff --git a/advisories/unreviewed/2024/11/GHSA-v6rg-qv6j-p6gp/GHSA-v6rg-qv6j-p6gp.json b/advisories/unreviewed/2024/11/GHSA-v6rg-qv6j-p6gp/GHSA-v6rg-qv6j-p6gp.json index 30698cb142e..a94b07079fe 100644 --- a/advisories/unreviewed/2024/11/GHSA-v6rg-qv6j-p6gp/GHSA-v6rg-qv6j-p6gp.json +++ b/advisories/unreviewed/2024/11/GHSA-v6rg-qv6j-p6gp/GHSA-v6rg-qv6j-p6gp.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-v6rg-qv6j-p6gp", - "modified": "2024-11-19T03:31:08Z", + "modified": "2024-11-27T18:34:01Z", "published": "2024-11-19T03:31:08Z", "aliases": [ "CVE-2024-50279" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: fix out-of-bounds access to the dirty bitset when resizing\n\ndm-cache checks the dirty bits of the cache blocks to be dropped when\nshrinking the fast device, but an index bug in bitset iteration causes\nout-of-bounds access.\n\nReproduce steps:\n\n1. create a cache device of 1024 cache blocks (128 bytes dirty bitset)\n\ndmsetup create cmeta --table \"0 8192 linear /dev/sdc 0\"\ndmsetup create cdata --table \"0 131072 linear /dev/sdc 8192\"\ndmsetup create corig --table \"0 524288 linear /dev/sdc 262144\"\ndd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 oflag=direct\ndmsetup create cache --table \"0 524288 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\"\n\n2. shrink the fast device to 512 cache blocks, triggering out-of-bounds\n access to the dirty bitset (offset 0x80)\n\ndmsetup suspend cache\ndmsetup reload cdata --table \"0 65536 linear /dev/sdc 8192\"\ndmsetup resume cdata\ndmsetup resume cache\n\nKASAN reports:\n\n BUG: KASAN: vmalloc-out-of-bounds in cache_preresume+0x269/0x7b0\n Read of size 8 at addr ffffc900000f3080 by task dmsetup/131\n\n (...snip...)\n The buggy address belongs to the virtual mapping at\n [ffffc900000f3000, ffffc900000f5000) created by:\n cache_ctr+0x176a/0x35f0\n\n (...snip...)\n Memory state around the buggy address:\n ffffc900000f2f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900000f3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n >ffffc900000f3080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ^\n ffffc900000f3100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n ffffc900000f3180: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8\n\nFix by making the index post-incremented.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -53,9 +54,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-125" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-19T02:16:30Z" diff --git a/advisories/unreviewed/2024/11/GHSA-vh5p-6rcm-5x83/GHSA-vh5p-6rcm-5x83.json b/advisories/unreviewed/2024/11/GHSA-vh5p-6rcm-5x83/GHSA-vh5p-6rcm-5x83.json index 93a66e71317..42ad3230a5c 100644 --- a/advisories/unreviewed/2024/11/GHSA-vh5p-6rcm-5x83/GHSA-vh5p-6rcm-5x83.json +++ b/advisories/unreviewed/2024/11/GHSA-vh5p-6rcm-5x83/GHSA-vh5p-6rcm-5x83.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-vh5p-6rcm-5x83", - "modified": "2024-11-25T21:30:50Z", + "modified": "2024-11-27T18:34:03Z", "published": "2024-11-25T21:30:50Z", "aliases": [ "CVE-2024-50672" ], "details": "A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administrator account passwords via the \"Reset password\" feature. The vulnerability occurs due to insufficient validation of user input, which is used as a query in Mongoose's find() function. This makes it possible for attackers to perform a full takeover of the administrator account. Attackers can then use the newly gained administrative privileges to upload a custom plugin to perform remote code execution (RCE) on the server hosting the web application.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -29,9 +30,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-25T21:15:19Z" diff --git a/advisories/unreviewed/2024/11/GHSA-w4qv-rrv4-jm4w/GHSA-w4qv-rrv4-jm4w.json b/advisories/unreviewed/2024/11/GHSA-w4qv-rrv4-jm4w/GHSA-w4qv-rrv4-jm4w.json index 66ba109c53c..ba722d7ada2 100644 --- a/advisories/unreviewed/2024/11/GHSA-w4qv-rrv4-jm4w/GHSA-w4qv-rrv4-jm4w.json +++ b/advisories/unreviewed/2024/11/GHSA-w4qv-rrv4-jm4w/GHSA-w4qv-rrv4-jm4w.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-w4qv-rrv4-jm4w", - "modified": "2024-11-19T03:31:08Z", + "modified": "2024-11-27T18:34:01Z", "published": "2024-11-19T03:31:08Z", "aliases": [ "CVE-2024-50285" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: check outstanding simultaneous SMB operations\n\nIf Client send simultaneous SMB operations to ksmbd, It exhausts too much\nmemory through the \"ksmbd_work_cache”. It will cause OOM issue.\nksmbd has a credit mechanism but it can't handle this problem. This patch\nadd the check if it exceeds max credits to prevent this problem by assuming\nthat one smb request consumes at least one credit.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -33,9 +34,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-770" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-19T02:16:30Z" diff --git a/advisories/unreviewed/2024/11/GHSA-xc2q-wjq7-w4gw/GHSA-xc2q-wjq7-w4gw.json b/advisories/unreviewed/2024/11/GHSA-xc2q-wjq7-w4gw/GHSA-xc2q-wjq7-w4gw.json index d75deac3c10..a041bc49453 100644 --- a/advisories/unreviewed/2024/11/GHSA-xc2q-wjq7-w4gw/GHSA-xc2q-wjq7-w4gw.json +++ b/advisories/unreviewed/2024/11/GHSA-xc2q-wjq7-w4gw/GHSA-xc2q-wjq7-w4gw.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-xjmh-6wp6-74q8/GHSA-xjmh-6wp6-74q8.json b/advisories/unreviewed/2024/11/GHSA-xjmh-6wp6-74q8/GHSA-xjmh-6wp6-74q8.json index bbb15f7049c..c3071a38ac4 100644 --- a/advisories/unreviewed/2024/11/GHSA-xjmh-6wp6-74q8/GHSA-xjmh-6wp6-74q8.json +++ b/advisories/unreviewed/2024/11/GHSA-xjmh-6wp6-74q8/GHSA-xjmh-6wp6-74q8.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-xjmh-6wp6-74q8", - "modified": "2024-11-19T03:31:07Z", + "modified": "2024-11-27T18:34:00Z", "published": "2024-11-19T03:31:07Z", "aliases": [ "CVE-2024-50274" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nidpf: avoid vport access in idpf_get_link_ksettings\n\nWhen the device control plane is removed or the platform\nrunning device control plane is rebooted, a reset is detected\non the driver. On driver reset, it releases the resources and\nwaits for the reset to complete. If the reset fails, it takes\nthe error path and releases the vport lock. At this time if the\nmonitoring tools tries to access link settings, it call traces\nfor accessing released vport pointer.\n\nTo avoid it, move link_speed_mbps to netdev_priv structure\nwhich removes the dependency on vport pointer and the vport lock\nin idpf_get_link_ksettings. Also use netif_carrier_ok()\nto check the link status and adjust the offsetof to use link_up\ninstead of link_speed_mbps.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -29,9 +30,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-19T02:16:29Z" diff --git a/advisories/unreviewed/2024/11/GHSA-xrg9-2q4w-gf5c/GHSA-xrg9-2q4w-gf5c.json b/advisories/unreviewed/2024/11/GHSA-xrg9-2q4w-gf5c/GHSA-xrg9-2q4w-gf5c.json index 88bebe15aa9..94fd1b45d3c 100644 --- a/advisories/unreviewed/2024/11/GHSA-xrg9-2q4w-gf5c/GHSA-xrg9-2q4w-gf5c.json +++ b/advisories/unreviewed/2024/11/GHSA-xrg9-2q4w-gf5c/GHSA-xrg9-2q4w-gf5c.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-xrg9-2q4w-gf5c", - "modified": "2024-11-19T18:31:06Z", + "modified": "2024-11-27T18:34:01Z", "published": "2024-11-19T18:31:06Z", "aliases": [ "CVE-2024-53045" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: dapm: fix bounds checker error in dapm_widget_list_create\n\nThe widgets array in the snd_soc_dapm_widget_list has a __counted_by\nattribute attached to it, which points to the num_widgets variable. This\nattribute is used in bounds checking, and if it is not set before the\narray is filled, then the bounds sanitizer will issue a warning or a\nkernel panic if CONFIG_UBSAN_TRAP is set.\n\nThis patch sets the size of the widgets list calculated with\nlist_for_each as the initial value for num_widgets as it is used for\nallocating memory for the array. It is updated with the actual number of\nadded elements after the array is filled.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,10 +29,8 @@ } ], "database_specific": { - "cwe_ids": [ - - ], - "severity": null, + "cwe_ids": [], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-19T18:15:24Z" diff --git a/advisories/unreviewed/2024/11/GHSA-xx8w-4q6h-66xg/GHSA-xx8w-4q6h-66xg.json b/advisories/unreviewed/2024/11/GHSA-xx8w-4q6h-66xg/GHSA-xx8w-4q6h-66xg.json index acb243fe8d4..d16f4312233 100644 --- a/advisories/unreviewed/2024/11/GHSA-xx8w-4q6h-66xg/GHSA-xx8w-4q6h-66xg.json +++ b/advisories/unreviewed/2024/11/GHSA-xx8w-4q6h-66xg/GHSA-xx8w-4q6h-66xg.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-xx8w-4q6h-66xg", - "modified": "2024-11-20T18:32:17Z", + "modified": "2024-11-27T18:34:01Z", "published": "2024-11-20T18:32:17Z", "aliases": [ "CVE-2024-52771" ], "details": "DedeBIZ v6.3.0 was discovered to contain an arbitrary file deletion vulnerability via the component /admin/file_manage_view.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -29,9 +30,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-22" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-20T17:15:20Z"