diff --git a/advisories/github-reviewed/2024/06/GHSA-47f6-5gq3-vx9c/GHSA-47f6-5gq3-vx9c.json b/advisories/github-reviewed/2024/06/GHSA-47f6-5gq3-vx9c/GHSA-47f6-5gq3-vx9c.json index e9450ad5b51..b96be1f34e1 100644 --- a/advisories/github-reviewed/2024/06/GHSA-47f6-5gq3-vx9c/GHSA-47f6-5gq3-vx9c.json +++ b/advisories/github-reviewed/2024/06/GHSA-47f6-5gq3-vx9c/GHSA-47f6-5gq3-vx9c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-47f6-5gq3-vx9c", - "modified": "2024-06-20T06:30:54Z", + "modified": "2024-06-20T09:30:58Z", "published": "2024-06-10T21:36:32Z", "aliases": [ "CVE-2024-35241" @@ -75,6 +75,10 @@ "type": "PACKAGE", "url": "https://github.com/composer/composer" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC" diff --git a/advisories/github-reviewed/2024/06/GHSA-5357-c2jx-v7qh/GHSA-5357-c2jx-v7qh.json b/advisories/github-reviewed/2024/06/GHSA-5357-c2jx-v7qh/GHSA-5357-c2jx-v7qh.json index 677f8936653..63bbd96de5c 100644 --- a/advisories/github-reviewed/2024/06/GHSA-5357-c2jx-v7qh/GHSA-5357-c2jx-v7qh.json +++ b/advisories/github-reviewed/2024/06/GHSA-5357-c2jx-v7qh/GHSA-5357-c2jx-v7qh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-5357-c2jx-v7qh", - "modified": "2024-06-18T12:30:41Z", + "modified": "2024-06-20T09:30:57Z", "published": "2024-06-09T21:30:33Z", "aliases": [ "CVE-2024-37568" @@ -52,6 +52,10 @@ "type": "WEB", "url": "https://github.com/pypa/advisory-database/tree/main/vulns/authlib/PYSEC-2024-52.yaml" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FHJI32SN4FNAUVNALVGOKWHNSQ6XS3M5" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZI7HYGN7VZAYFV6UV3SRLYF7QGERXIU" diff --git a/advisories/github-reviewed/2024/06/GHSA-v9qv-c7wm-wgmf/GHSA-v9qv-c7wm-wgmf.json b/advisories/github-reviewed/2024/06/GHSA-v9qv-c7wm-wgmf/GHSA-v9qv-c7wm-wgmf.json index c361b618846..f99265ef0ce 100644 --- a/advisories/github-reviewed/2024/06/GHSA-v9qv-c7wm-wgmf/GHSA-v9qv-c7wm-wgmf.json +++ b/advisories/github-reviewed/2024/06/GHSA-v9qv-c7wm-wgmf/GHSA-v9qv-c7wm-wgmf.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-v9qv-c7wm-wgmf", - "modified": "2024-06-20T06:30:54Z", + "modified": "2024-06-20T09:30:58Z", "published": "2024-06-10T21:36:25Z", "aliases": [ "CVE-2024-35242" @@ -75,6 +75,10 @@ "type": "PACKAGE", "url": "https://github.com/composer/composer" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PO4MU2BC7VR6LMHEX4X7DKGHVFXZV2MC" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLPJHM2WWSYU2F6KHW2BYFGYL4IGTKHC" diff --git a/advisories/unreviewed/2024/06/GHSA-2g5v-h9c6-j9cv/GHSA-2g5v-h9c6-j9cv.json b/advisories/unreviewed/2024/06/GHSA-2g5v-h9c6-j9cv/GHSA-2g5v-h9c6-j9cv.json new file mode 100644 index 00000000000..f3ed9773a89 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-2g5v-h9c6-j9cv/GHSA-2g5v-h9c6-j9cv.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2g5v-h9c6-j9cv", + "modified": "2024-06-20T09:30:59Z", + "published": "2024-06-20T09:30:59Z", + "aliases": [ + "CVE-2024-38619" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb-storage: alauda: Check whether the media is initialized\n\nThe member \"uzonesize\" of struct alauda_info will remain 0\nif alauda_init_media() fails, potentially causing divide errors\nin alauda_read_data() and alauda_write_lba().\n- Add a member \"media_initialized\" to struct alauda_info.\n- Change a condition in alauda_check_media() to ensure the\n first initialization.\n- Add an error check for the return value of alauda_init_media().", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38619" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/16637fea001ab3c8df528a8995b3211906165a30" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T07:15:41Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-32q5-2wwg-3v4v/GHSA-32q5-2wwg-3v4v.json b/advisories/unreviewed/2024/06/GHSA-32q5-2wwg-3v4v/GHSA-32q5-2wwg-3v4v.json new file mode 100644 index 00000000000..744dac2ea6e --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-32q5-2wwg-3v4v/GHSA-32q5-2wwg-3v4v.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-32q5-2wwg-3v4v", + "modified": "2024-06-20T09:30:59Z", + "published": "2024-06-20T09:30:59Z", + "aliases": [ + "CVE-2024-4098" + ], + "details": "The Shariff Wrapper plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 4.6.13 via the shariff3uu_fetch_sharecounts function. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4098" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/shariff/trunk/shariff.php#L410" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3103137" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f49fba00-c576-4a1a-8b0b-9ebed3e3d090?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T07:15:41Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-9f4g-pfx6-5g99/GHSA-9f4g-pfx6-5g99.json b/advisories/unreviewed/2024/06/GHSA-9f4g-pfx6-5g99/GHSA-9f4g-pfx6-5g99.json new file mode 100644 index 00000000000..1d909199b88 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-9f4g-pfx6-5g99/GHSA-9f4g-pfx6-5g99.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9f4g-pfx6-5g99", + "modified": "2024-06-20T09:30:59Z", + "published": "2024-06-20T09:30:59Z", + "aliases": [ + "CVE-2024-29012" + ], + "details": "Stack-based buffer overflow vulnerability in the SonicOS HTTP server allows an authenticated remote attacker to cause Denial of Service (DoS) via sscanf function.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29012" + }, + { + "type": "WEB", + "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0008" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-121" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T09:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-hcr7-cqwc-q5gq/GHSA-hcr7-cqwc-q5gq.json b/advisories/unreviewed/2024/06/GHSA-hcr7-cqwc-q5gq/GHSA-hcr7-cqwc-q5gq.json new file mode 100644 index 00000000000..c76a0e9530c --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-hcr7-cqwc-q5gq/GHSA-hcr7-cqwc-q5gq.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hcr7-cqwc-q5gq", + "modified": "2024-06-20T09:30:59Z", + "published": "2024-06-20T09:30:59Z", + "aliases": [ + "CVE-2024-34693" + ], + "details": "Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table.This issue affects Apache Superset: before 3.1.3 and version 4.0.0\n\nUsers are recommended to upgrade to version 4.0.1 or 3.1.3, which fixes the issue.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34693" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/1803x1s34m7r71h1k0q1njol8k6fmyon" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T09:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-hgcx-j4cv-mmh5/GHSA-hgcx-j4cv-mmh5.json b/advisories/unreviewed/2024/06/GHSA-hgcx-j4cv-mmh5/GHSA-hgcx-j4cv-mmh5.json new file mode 100644 index 00000000000..60c3202a1c6 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-hgcx-j4cv-mmh5/GHSA-hgcx-j4cv-mmh5.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hgcx-j4cv-mmh5", + "modified": "2024-06-20T09:30:59Z", + "published": "2024-06-20T09:30:59Z", + "aliases": [ + "CVE-2024-29013" + ], + "details": "Heap-based buffer overflow vulnerability in the SonicOS SSL-VPN allows an authenticated remote attacker to cause Denial of Service (DoS) via memcpy function.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29013" + }, + { + "type": "WEB", + "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0009" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-122" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T09:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-hm88-xqxr-4jwr/GHSA-hm88-xqxr-4jwr.json b/advisories/unreviewed/2024/06/GHSA-hm88-xqxr-4jwr/GHSA-hm88-xqxr-4jwr.json new file mode 100644 index 00000000000..cfd61d3cb93 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-hm88-xqxr-4jwr/GHSA-hm88-xqxr-4jwr.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hm88-xqxr-4jwr", + "modified": "2024-06-20T09:30:59Z", + "published": "2024-06-20T09:30:59Z", + "aliases": [ + "CVE-2023-25646" + ], + "details": "There is an unauthorized access vulnerability in ZTE H388X. If H388X is caused by brute-force serial port cracking,attackers with common user permissions can use this vulnerability to obtain elevated permissions on the affected device by performing specific operations.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25646" + }, + { + "type": "WEB", + "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1035844" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-281" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T07:15:41Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-xhv2-gw9c-73rm/GHSA-xhv2-gw9c-73rm.json b/advisories/unreviewed/2024/06/GHSA-xhv2-gw9c-73rm/GHSA-xhv2-gw9c-73rm.json new file mode 100644 index 00000000000..3c8500668eb --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-xhv2-gw9c-73rm/GHSA-xhv2-gw9c-73rm.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xhv2-gw9c-73rm", + "modified": "2024-06-20T09:30:59Z", + "published": "2024-06-20T09:30:59Z", + "aliases": [ + "CVE-2024-38620" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HCI: Remove HCI_AMP support\n\nSince BT_HS has been remove HCI_AMP controllers no longer has any use so\nremove it along with the capability of creating AMP controllers.\n\nSince we no longer need to differentiate between AMP and Primary\ncontrollers, as only HCI_PRIMARY is left, this also remove\nhdev->dev_type altogether.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38620" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5af2e235b0d5b797e9531a00c50058319130e156" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/84a4bb6548a29326564f0e659fb8064503ecc1c7" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/af1d425b6dc67cd67809f835dd7afb6be4d43e03" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/d3c7b012d912b31ad23b9349c0e499d6dddd48ec" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T08:15:38Z" + } +} \ No newline at end of file