From 2eeb1747383bb5a5d1e138a99dbef50bd0cba12f Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 27 Mar 2025 09:31:59 +0000 Subject: [PATCH] Publish Advisories GHSA-wm5r-jw2j-wfcp GHSA-3vwf-8mrh-29c3 GHSA-m3r2-m5rw-rgmh GHSA-qpm4-gcrr-cxr5 GHSA-rjr7-mrw5-5m4x GHSA-rx8f-q5hr-3gm3 --- .../GHSA-wm5r-jw2j-wfcp.json | 1 + .../GHSA-3vwf-8mrh-29c3.json | 36 +++++++++++++++++++ .../GHSA-m3r2-m5rw-rgmh.json | 36 +++++++++++++++++++ .../GHSA-qpm4-gcrr-cxr5.json | 36 +++++++++++++++++++ .../GHSA-rjr7-mrw5-5m4x.json | 36 +++++++++++++++++++ .../GHSA-rx8f-q5hr-3gm3.json | 36 +++++++++++++++++++ 6 files changed, 181 insertions(+) create mode 100644 advisories/unreviewed/2025/03/GHSA-3vwf-8mrh-29c3/GHSA-3vwf-8mrh-29c3.json create mode 100644 advisories/unreviewed/2025/03/GHSA-m3r2-m5rw-rgmh/GHSA-m3r2-m5rw-rgmh.json create mode 100644 advisories/unreviewed/2025/03/GHSA-qpm4-gcrr-cxr5/GHSA-qpm4-gcrr-cxr5.json create mode 100644 advisories/unreviewed/2025/03/GHSA-rjr7-mrw5-5m4x/GHSA-rjr7-mrw5-5m4x.json create mode 100644 advisories/unreviewed/2025/03/GHSA-rx8f-q5hr-3gm3/GHSA-rx8f-q5hr-3gm3.json diff --git a/advisories/unreviewed/2024/08/GHSA-wm5r-jw2j-wfcp/GHSA-wm5r-jw2j-wfcp.json b/advisories/unreviewed/2024/08/GHSA-wm5r-jw2j-wfcp/GHSA-wm5r-jw2j-wfcp.json index 35a2091fb6b..13d829c54c3 100644 --- a/advisories/unreviewed/2024/08/GHSA-wm5r-jw2j-wfcp/GHSA-wm5r-jw2j-wfcp.json +++ b/advisories/unreviewed/2024/08/GHSA-wm5r-jw2j-wfcp/GHSA-wm5r-jw2j-wfcp.json @@ -26,6 +26,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-287", "CWE-94" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2025/03/GHSA-3vwf-8mrh-29c3/GHSA-3vwf-8mrh-29c3.json b/advisories/unreviewed/2025/03/GHSA-3vwf-8mrh-29c3/GHSA-3vwf-8mrh-29c3.json new file mode 100644 index 00000000000..e691648cd65 --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-3vwf-8mrh-29c3/GHSA-3vwf-8mrh-29c3.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3vwf-8mrh-29c3", + "modified": "2025-03-27T09:30:31Z", + "published": "2025-03-27T09:30:31Z", + "aliases": [ + "CVE-2024-45354" + ], + "details": "A code execution vulnerability exists in the Xiaomi shop applicationproduct. The vulnerability is caused by improper input validation and can be exploited by attackers to execute malicious code.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45354" + }, + { + "type": "WEB", + "url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=552" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-346" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T07:15:38Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-m3r2-m5rw-rgmh/GHSA-m3r2-m5rw-rgmh.json b/advisories/unreviewed/2025/03/GHSA-m3r2-m5rw-rgmh/GHSA-m3r2-m5rw-rgmh.json new file mode 100644 index 00000000000..1075edaaf3d --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-m3r2-m5rw-rgmh/GHSA-m3r2-m5rw-rgmh.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m3r2-m5rw-rgmh", + "modified": "2025-03-27T09:30:31Z", + "published": "2025-03-27T09:30:31Z", + "aliases": [ + "CVE-2024-45353" + ], + "details": "An intent redriction vulnerability exists in the Xiaomi quick App framework application product. The vulnerability is caused by improper input validation and can be exploited by attackers tointent redriction.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45353" + }, + { + "type": "WEB", + "url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=551" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-346" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T07:15:38Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-qpm4-gcrr-cxr5/GHSA-qpm4-gcrr-cxr5.json b/advisories/unreviewed/2025/03/GHSA-qpm4-gcrr-cxr5/GHSA-qpm4-gcrr-cxr5.json new file mode 100644 index 00000000000..86f91c9398f --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-qpm4-gcrr-cxr5/GHSA-qpm4-gcrr-cxr5.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qpm4-gcrr-cxr5", + "modified": "2025-03-27T09:30:31Z", + "published": "2025-03-27T09:30:31Z", + "aliases": [ + "CVE-2024-45355" + ], + "details": "A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45355" + }, + { + "type": "WEB", + "url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=553" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-306" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T07:15:38Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-rjr7-mrw5-5m4x/GHSA-rjr7-mrw5-5m4x.json b/advisories/unreviewed/2025/03/GHSA-rjr7-mrw5-5m4x/GHSA-rjr7-mrw5-5m4x.json new file mode 100644 index 00000000000..d896edd0a9d --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-rjr7-mrw5-5m4x/GHSA-rjr7-mrw5-5m4x.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rjr7-mrw5-5m4x", + "modified": "2025-03-27T09:30:31Z", + "published": "2025-03-27T09:30:31Z", + "aliases": [ + "CVE-2024-45361" + ], + "details": "A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to leak sensitive user information.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45361" + }, + { + "type": "WEB", + "url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=558" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-319" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T08:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-rx8f-q5hr-3gm3/GHSA-rx8f-q5hr-3gm3.json b/advisories/unreviewed/2025/03/GHSA-rx8f-q5hr-3gm3/GHSA-rx8f-q5hr-3gm3.json new file mode 100644 index 00000000000..d66fce6e2ee --- /dev/null +++ b/advisories/unreviewed/2025/03/GHSA-rx8f-q5hr-3gm3/GHSA-rx8f-q5hr-3gm3.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rx8f-q5hr-3gm3", + "modified": "2025-03-27T09:30:31Z", + "published": "2025-03-27T09:30:31Z", + "aliases": [ + "CVE-2024-45356" + ], + "details": "A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45356" + }, + { + "type": "WEB", + "url": "https://trust.mi.com/zh-CN/misrc/bulletins/advisory?cveId=554" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-306" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-03-27T08:15:16Z" + } +} \ No newline at end of file