netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2wr3-hxqg-qp94
GHSA-36v8-vqh8-c3xx
GHSA-4w7h-gpmh-m45h
GHSA-8x22-q779-qc73
GHSA-9gh2-q9mq-954r
GHSA-cmxr-2hxf-h3pv
GHSA-f9f9-xpjp-mr3p
GHSA-g5xw-mprp-v5xf
GHSA-px7f-qj7m-m4v6
GHSA-rrh2-f5v6-9vq7
GHSA-x4wm-g2rr-c6j2
GHSA-xwvr-585h-3fff
This commit is contained in:
advisory-database[bot]
2024-03-27 21:32:06 +00:00
parent 83b3b1adff
commit 2611046dc8
12 changed files with 556 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/03/GHSA-2wr3-hxqg-qp94/GHSA-2wr3-hxqg-qp94.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2wr3-hxqg-qp94",
"modified": "2024-03-27T21:30:47Z",
"published": "2024-03-27T21:30:47Z",
"aliases": [
"CVE-2024-2994"
],
"details": "A vulnerability was found in Tenda FH1203 2.0.1.6. It has been declared as critical. Affected by this vulnerability is the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the argument mac leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258163. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2994"
},
{
"type": "WEB",
"url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/GetParentControlInfo.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.258163"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.258163"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.301373"
}
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T20:15:09Z"
}
}
advisories/unreviewed/2024/03/GHSA-36v8-vqh8-c3xx/GHSA-36v8-vqh8-c3xx.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-36v8-vqh8-c3xx",
"modified": "2024-03-27T18:32:38Z",
"modified": "2024-03-27T21:30:47Z",
"published": "2024-03-27T18:32:38Z",
"aliases": [
"CVE-2024-29945"
@@ -24,6 +24,10 @@
{
"type": "WEB",
"url": "https://advisory.splunk.com/advisories/SVD-2024-0301"
},
{
"type": "WEB",
"url": "https://research.splunk.com/application/9a67e749-d291-40dd-8376-d422e7ecf8b5"
}
],
"database_specific": {
advisories/unreviewed/2024/03/GHSA-4w7h-gpmh-m45h/GHSA-4w7h-gpmh-m45h.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4w7h-gpmh-m45h",
"modified": "2024-03-27T21:30:47Z",
"published": "2024-03-27T21:30:47Z",
"aliases": [
"CVE-2024-2991"
],
"details": "A vulnerability has been found in Tenda FH1203 2.0.1.6 and classified as critical. This vulnerability affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258160. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2991"
},
{
"type": "WEB",
"url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/formWriteFacMac.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.258160"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.258160"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.301366"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T19:15:49Z"
}
}
advisories/unreviewed/2024/03/GHSA-8x22-q779-qc73/GHSA-8x22-q779-qc73.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8x22-q779-qc73",
"modified": "2024-03-27T21:30:47Z",
"published": "2024-03-27T21:30:47Z",
"aliases": [
"CVE-2024-2996"
],
"details": "A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320. It has been classified as problematic. Affected is an unknown function of the component Page Title Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258198 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2996"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/115tr5PJ_RmSlaLR_jLXPyJse6ojSFRxu/view?usp=drivesdk"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.258198"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.258198"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.301376"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T20:15:10Z"
}
}
advisories/unreviewed/2024/03/GHSA-9gh2-q9mq-954r/GHSA-9gh2-q9mq-954r.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9gh2-q9mq-954r",
"modified": "2024-03-27T21:30:47Z",
"published": "2024-03-27T21:30:47Z",
"aliases": [
"CVE-2024-2993"
],
"details": "A vulnerability was found in Tenda FH1203 2.0.1.6. It has been classified as critical. Affected is the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258162 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2993"
},
{
"type": "WEB",
"url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/formQuickIndex.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.258162"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.258162"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.301372"
}
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T20:15:08Z"
}
}
advisories/unreviewed/2024/03/GHSA-cmxr-2hxf-h3pv/GHSA-cmxr-2hxf-h3pv.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cmxr-2hxf-h3pv",
"modified": "2024-03-27T21:30:47Z",
"published": "2024-03-27T21:30:47Z",
"aliases": [
"CVE-2024-2990"
],
"details": "A vulnerability, which was classified as critical, was found in Tenda FH1203 2.0.1.6. This affects the function formexeCommand of the file /goform/execCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258159. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2990"
},
{
"type": "WEB",
"url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/formexeCommand.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.258159"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.258159"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.301365"
}
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T19:15:49Z"
}
}
advisories/unreviewed/2024/03/GHSA-f9f9-xpjp-mr3p/GHSA-f9f9-xpjp-mr3p.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f9f9-xpjp-mr3p",
"modified": "2024-03-27T21:30:48Z",
"published": "2024-03-27T21:30:48Z",
"aliases": [
"CVE-2024-2999"
],
"details": "A vulnerability classified as critical has been found in Campcodes Online Art Gallery Management System 1.0. This affects an unknown part of the file /admin/adminHome.php. The manipulation of the argument uname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258201 was assigned to this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2999"
},
{
"type": "WEB",
"url": "https://github.com/E1CHO/cve_hub/blob/main/Online%20Art%20Gallery%20Management%20System%20-%20vuln%201.pdf"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.258201"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.258201"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.304765"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T21:15:49Z"
}
}
advisories/unreviewed/2024/03/GHSA-g5xw-mprp-v5xf/GHSA-g5xw-mprp-v5xf.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g5xw-mprp-v5xf",
"modified": "2024-03-27T21:30:47Z",
"published": "2024-03-27T21:30:47Z",
"aliases": [
"CVE-2024-2995"
],
"details": "A vulnerability was found in NUUO Camera up to 20240319 and classified as problematic. This issue affects some unknown processing of the file /deletefile.php. The manipulation of the argument filename leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258197 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2995"
},
{
"type": "WEB",
"url": "https://h0e4a0r1t.github.io/2024/vulns/Arbitrary%20file%20deletion%20vulnerability%20exists%20in%20nuuo%20camera-deletefile.php.pdf"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.258197"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.258197"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.301068"
}
],
"database_specific": {
"cwe_ids": [
"CWE-404"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T20:15:09Z"
}
}
advisories/unreviewed/2024/03/GHSA-px7f-qj7m-m4v6/GHSA-px7f-qj7m-m4v6.json
+51
View File
@@ -0,0 +1,51 @@
{
"schema_version": "1.4.0",
"id": "GHSA-px7f-qj7m-m4v6",
"modified": "2024-03-27T21:30:47Z",
"published": "2024-03-27T21:30:47Z",
"aliases": [
"CVE-2024-28085"
],
"details": "wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. (Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked.) There may be plausible scenarios where this leads to account takeover.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "WEB",
"url": "https://github.com/util-linux/util-linux/security/advisories/GHSA-xv2h-c6ww-mrjq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28085"
},
{
"type": "WEB",
"url": "https://github.com/skyler-ferrante/CVE-2024-28085"
},
{
"type": "WEB",
"url": "https://mirrors.edge.kernel.org/pub/linux/utils/util-linux"
},
{
"type": "WEB",
"url": "https://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2024/03/27/5"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T19:15:48Z"
}
}
advisories/unreviewed/2024/03/GHSA-rrh2-f5v6-9vq7/GHSA-rrh2-f5v6-9vq7.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rrh2-f5v6-9vq7",
"modified": "2024-03-27T21:30:47Z",
"published": "2024-03-27T21:30:47Z",
"aliases": [
"CVE-2024-2997"
],
"details": "A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument Category Name/Model Name/Brand Name/Unit Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258199. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2997"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1Zx_JnAf6QArTtfoSuzESkBasZSrNzmFF/view?usp=drivesdk"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.258199"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.258199"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.301380"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T21:15:48Z"
}
}
advisories/unreviewed/2024/03/GHSA-x4wm-g2rr-c6j2/GHSA-x4wm-g2rr-c6j2.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x4wm-g2rr-c6j2",
"modified": "2024-03-27T21:30:47Z",
"published": "2024-03-27T21:30:47Z",
"aliases": [
"CVE-2024-2992"
],
"details": "A vulnerability was found in Tenda FH1203 2.0.1.6 and classified as critical. This issue affects the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258161 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2992"
},
{
"type": "WEB",
"url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/FH/FH1203/formSetCfm.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.258161"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.258161"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.301371"
}
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T19:15:50Z"
}
}
advisories/unreviewed/2024/03/GHSA-xwvr-585h-3fff/GHSA-xwvr-585h-3fff.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xwvr-585h-3fff",
"modified": "2024-03-27T21:30:48Z",
"published": "2024-03-27T21:30:48Z",
"aliases": [
"CVE-2024-2998"
],
"details": "A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Store Update Page. The manipulation of the argument Store Name/Store Address leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258200. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2998"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1cE1gmFmPCjomWmHbBEvWCYg0dPEWkFoR/view?usp=drivesdk"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.258200"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.258200"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.301381"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T21:15:49Z"
}
}