netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-07-30 21:33:01 +00:00
parent fdc565967c
commit 2c26608333
51 changed files with 1005 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/03/GHSA-pv98-48f2-5vjr/GHSA-pv98-48f2-5vjr.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pv98-48f2-5vjr",
"modified": "2024-07-29T09:36:13Z",
"modified": "2024-07-30T21:31:25Z",
"published": "2024-03-03T00:30:32Z",
"aliases": [
"CVE-2024-26621"
@@ -117,6 +117,10 @@
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/07/29/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/07/30/2"
}
],
"database_specific": {
advisories/unreviewed/2024/07/GHSA-22g4-7m96-g7pp/GHSA-22g4-7m96-g7pp.json
+51
View File
@@ -0,0 +1,51 @@
{
"schema_version": "1.4.0",
"id": "GHSA-22g4-7m96-g7pp",
"modified": "2024-07-30T21:31:27Z",
"published": "2024-07-30T21:31:27Z",
"aliases": [
"CVE-2024-41437"
],
"details": "A heap buffer overflow in the function cp_unfilter() (/vendor/cute_png.h) of hicolor v0.5.0 allows attackers to cause a Denial of Service (DoS) via a crafted PNG file.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41437"
},
{
"type": "WEB",
"url": "https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r1-cp_unfilter-cute_png-1019c11/poc/sample6.png"
},
{
"type": "WEB",
"url": "https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r1-cp_unfilter-cute_png-1019c11/vulDescription.assets/image-20240530183857985.png"
},
{
"type": "WEB",
"url": "https://github.com/Helson-S/FuzzyTesting/blob/master/hicolor/heapof-r1-cp_unfilter-cute_png-1019c11/vulDescription.md"
},
{
"type": "WEB",
"url": "https://github.com/Helson-S/FuzzyTesting/tree/master/hicolor/heapof-r1-cp_unfilter-cute_png-1019c11"
},
{
"type": "WEB",
"url": "https://github.com/Helson-S/FuzzyTesting/tree/master/hicolor/heapof-r1-cp_unfilter-cute_png-1019c11/poc"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-30T19:15:10Z"
}
}
advisories/unreviewed/2024/07/GHSA-26mh-xhv7-944g/GHSA-26mh-xhv7-944g.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-26mh-xhv7-944g",
"modified": "2024-07-30T21:31:28Z",
"published": "2024-07-30T21:31:28Z",
"aliases": [
"CVE-2024-39012"
],
"details": "ais-ltd strategyen v0.4.0 was discovered to contain a prototype pollution via the function mergeObjects. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39012"
},
{
"type": "WEB",
"url": "https://gist.github.com/mestrtee/acfbd724a4b73bfb5d030575b653453c"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-30T20:15:04Z"
}
}
advisories/unreviewed/2024/07/GHSA-273f-pp2q-7h53/GHSA-273f-pp2q-7h53.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-273f-pp2q-7h53",
"modified": "2024-07-30T21:31:29Z",
"published": "2024-07-30T21:31:29Z",
"aliases": [
"CVE-2024-7273"
],
"details": "A vulnerability classified as critical was found in itsourcecode Alton Management System 1.0. This vulnerability affects unknown code of the file search.php. The manipulation of the argument rcode leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273142 is the identifier assigned to this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7273"
},
{
"type": "WEB",
"url": "https://github.com/DeepMountains/Mirage/blob/main/CVE8-1.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.273142"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.273142"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.381089"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-30T21:15:10Z"
}
}
advisories/unreviewed/2024/07/GHSA-27rx-w643-mrjg/GHSA-27rx-w643-mrjg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-27rx-w643-mrjg",
"modified": "2024-07-30T09:32:04Z",
"modified": "2024-07-30T21:31:27Z",
"published": "2024-07-30T09:32:04Z",
"aliases": [
"CVE-2024-42225"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: replace skb_put with skb_put_zero\n\nAvoid potentially reusing uninitialized data",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -41,9 +44,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-908"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-30T08:15:07Z"
advisories/unreviewed/2024/07/GHSA-28mc-g557-92m7/GHSA-28mc-g557-92m7.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-28mc-g557-92m7",
"modified": "2024-07-30T21:31:28Z",
"published": "2024-07-30T21:31:28Z",
"aliases": [
"CVE-2024-38986"
],
"details": "Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge methods of lodash to merge objects.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38986"
},
{
"type": "WEB",
"url": "https://gist.github.com/mestrtee/b20c3aee8bea16e1863933778da6e4cb"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-30T20:15:03Z"
}
}
advisories/unreviewed/2024/07/GHSA-3ghx-8gmm-9rg3/GHSA-3ghx-8gmm-9rg3.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3ghx-8gmm-9rg3",
"modified": "2024-07-30T21:31:29Z",
"published": "2024-07-30T21:31:29Z",
"aliases": [
"CVE-2024-41611"
],
"details": "In D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely to the Telnet service and perform arbitrary commands.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41611"
},
{
"type": "WEB",
"url": "https://github.com/Nop3z/CVE/blob/main/dlink/dir-820/Dlink-860L-hardcoded-vulnerability.md"
},
{
"type": "WEB",
"url": "https://www.dlink.com/en/security-bulletin"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-30T20:15:04Z"
}
}
advisories/unreviewed/2024/07/GHSA-3wqv-582c-6cpc/GHSA-3wqv-582c-6cpc.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3wqv-582c-6cpc",
"modified": "2024-07-30T21:31:27Z",
"published": "2024-07-30T21:31:27Z",
"aliases": [
"CVE-2024-3930"
],
"details": "In versions of Akana API Platform prior to 2024.1.0 a flaw resulting in XML External Entity (XXE) was discovered.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3930"
},
{
"type": "WEB",
"url": "https://portal.perforce.com/s/detail/a91PA000001SUKLYA4"
}
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-30T19:15:10Z"
}
}
advisories/unreviewed/2024/07/GHSA-45f8-hpxx-pqmq/GHSA-45f8-hpxx-pqmq.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-45f8-hpxx-pqmq",
"modified": "2024-07-29T18:30:39Z",
"modified": "2024-07-30T21:31:26Z",
"published": "2024-07-29T18:30:39Z",
"aliases": [
"CVE-2024-42066"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix potential integer overflow in page size calculation\n\nExplicitly cast tbo->page_alignment to u64 before bit-shifting to\nprevent overflow when assigning to min_page_size.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-29T16:15:06Z"
advisories/unreviewed/2024/07/GHSA-45vr-76fp-gmwx/GHSA-45vr-76fp-gmwx.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-45vr-76fp-gmwx",
"modified": "2024-07-30T21:31:28Z",
"published": "2024-07-30T21:31:28Z",
"aliases": [
"CVE-2024-36572"
],
"details": "Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaults, mergeBranch, and Object.setObjectValue.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36572"
},
{
"type": "WEB",
"url": "https://github.com/allpro/form-manager/issues/1"
},
{
"type": "WEB",
"url": "https://gist.github.com/mestrtee/1771ab4fba733ca898b6e2463dc6ed19"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-30T20:15:03Z"
}
}
advisories/unreviewed/2024/07/GHSA-47v5-cr23-pw2c/GHSA-47v5-cr23-pw2c.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-47v5-cr23-pw2c",
"modified": "2024-07-29T18:30:39Z",
"modified": "2024-07-30T21:31:26Z",
"published": "2024-07-29T18:30:39Z",
"aliases": [
"CVE-2024-42069"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: mana: Fix possible double free in error handling path\n\nWhen auxiliary_device_add() returns error and then calls\nauxiliary_device_uninit(), callback function adev_release\ncalls kfree(madev). We shouldn't call kfree(madev) again\nin the error handling path. Set 'madev' to NULL.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-29T16:15:06Z"
advisories/unreviewed/2024/07/GHSA-4fx6-x999-g2xc/GHSA-4fx6-x999-g2xc.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4fx6-x999-g2xc",
"modified": "2024-07-29T18:30:39Z",
"modified": "2024-07-30T21:31:25Z",
"published": "2024-07-29T18:30:39Z",
"aliases": [
"CVE-2024-42064"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Skip pipe if the pipe idx not set properly\n\n[why]\nDriver crashes when pipe idx not set properly\n\n[how]\nAdd code to skip the pipe that idx not set properly",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -31,7 +34,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-29T16:15:06Z"
advisories/unreviewed/2024/07/GHSA-4hjh-qjjx-6vx4/GHSA-4hjh-qjjx-6vx4.json
+7 -4
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2024/07/GHSA-4qj9-whm7-4cr2/GHSA-4qj9-whm7-4cr2.json
+1 -1
View File
@@ -32,7 +32,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/07/GHSA-5h8j-93h4-mm7v/GHSA-5h8j-93h4-mm7v.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5h8j-93h4-mm7v",
"modified": "2024-07-29T18:30:40Z",
"modified": "2024-07-30T21:31:26Z",
"published": "2024-07-29T18:30:40Z",
"aliases": [
"CVE-2024-42070"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers\n\nregister store validation for NFT_DATA_VALUE is conditional, however,\nthe datatype is always either NFT_DATA_VALUE or NFT_DATA_VERDICT. This\nonly requires a new helper function to infer the register type from the\nset datatype so this conditional check can be removed. Otherwise,\npointer to chain object can be leaked through the registers.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -53,9 +56,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-29T16:15:06Z"
advisories/unreviewed/2024/07/GHSA-64jr-8qg8-gh2j/GHSA-64jr-8qg8-gh2j.json
+2 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-64jr-8qg8-gh2j",
"modified": "2024-07-10T09:30:41Z",
"modified": "2024-07-30T21:31:25Z",
"published": "2024-07-10T09:30:41Z",
"aliases": [
"CVE-2024-5664"
@@ -40,7 +40,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2024/07/GHSA-6764-gfvg-wvf4/GHSA-6764-gfvg-wvf4.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6764-gfvg-wvf4",
"modified": "2024-07-30T09:32:04Z",
"modified": "2024-07-30T21:31:27Z",
"published": "2024-07-30T09:32:04Z",
"aliases": [
"CVE-2024-42227"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Fix overlapping copy within dml_core_mode_programming\n\n[WHY]\n&mode_lib->mp.Watermark and &locals->Watermark are\nthe same address. memcpy may lead to unexpected behavior.\n\n[HOW]\nmemmove should be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -31,7 +34,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-30T08:15:07Z"
advisories/unreviewed/2024/07/GHSA-68vf-xmgr-pxm6/GHSA-68vf-xmgr-pxm6.json
+7 -4
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2024/07/GHSA-6xvq-4crp-429f/GHSA-6xvq-4crp-429f.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6xvq-4crp-429f",
"modified": "2024-07-29T18:30:40Z",
"modified": "2024-07-30T21:31:26Z",
"published": "2024-07-29T18:30:40Z",
"aliases": [
"CVE-2024-42081"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/xe_devcoredump: Check NULL before assignments\n\nAssign 'xe_devcoredump_snapshot *' and 'xe_device *' only if\n'coredump' is not NULL.\n\nv2\n- Fix commit messages.\n\nv3\n- Define variables before code.(Ashutosh/Jose)\n\nv4\n- Drop return check for coredump_to_xe. (Jose/Rodrigo)\n\nv5\n- Modify misleading commit message. (Matt)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-29T16:15:07Z"
advisories/unreviewed/2024/07/GHSA-7wph-5wjx-7rgv/GHSA-7wph-5wjx-7rgv.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7wph-5wjx-7rgv",
"modified": "2024-07-29T18:30:40Z",
"modified": "2024-07-30T21:31:26Z",
"published": "2024-07-29T18:30:40Z",
"aliases": [
"CVE-2024-42079"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix NULL pointer dereference in gfs2_log_flush\n\nIn gfs2_jindex_free(), set sdp->sd_jdesc to NULL under the log flush\nlock to provide exclusion against gfs2_log_flush().\n\nIn gfs2_log_flush(), check if sdp->sd_jdesc is non-NULL before\ndereferencing it. Otherwise, we could run into a NULL pointer\ndereference when outstanding glock work races with an unmount\n(glock_work_func -> run_queue -> do_xmote -> inode_go_sync ->\ngfs2_log_flush).",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-29T16:15:07Z"

Some files were not shown because too many files have changed in this diff Show More