netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-11-29 21:32:37 +00:00
parent 6db6a99654
commit 2ef989163a
58 changed files with 736 additions and 147 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/03/GHSA-6mxw-q763-w6p8/GHSA-6mxw-q763-w6p8.json
+1 -3
View File
@@ -13,9 +13,7 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
advisories/unreviewed/2024/03/GHSA-rf8x-xcjr-27mf/GHSA-rf8x-xcjr-27mf.json
+1 -3
View File
@@ -13,9 +13,7 @@
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
advisories/unreviewed/2024/11/GHSA-25rm-3r9j-mwmf/GHSA-25rm-3r9j-mwmf.json
+1 -3
View File
@@ -13,9 +13,7 @@
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
advisories/unreviewed/2024/11/GHSA-2gx6-qrpp-c4p3/GHSA-2gx6-qrpp-c4p3.json
+37
View File
@@ -0,0 +1,37 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2gx6-qrpp-c4p3",
"modified": "2024-11-29T21:31:04Z",
"published": "2024-11-29T21:31:04Z",
"aliases": [
"CVE-2024-35371"
],
"details": "Ant-Media-Serverv2.8.2 is affected by Improper Output Neutralization for Logs. The vulnerability stems from insufficient input sanitization in the logging mechanism. Without proper filtering or validation, user-controllable data, such as identifiers or other sensitive information, can be included in log entries without restrictions.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35371"
},
{
"type": "WEB",
"url": "https://github.com/ant-media/ant-media-server/commit/4d4763bd4fd06e515c19544e5170ca0f34c9ce45"
},
{
"type": "WEB",
"url": "https://gist.github.com/1047524396/4eb17867f2e375f4824274c5e7b4d384"
},
{
"type": "WEB",
"url": "https://github.com/ant-media/Ant-Media-Server/blob/ams-v2.8.2/src/main/java/io/antmedia/rest/RestServiceBase.java#L356"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-29T20:15:20Z"
}
}
advisories/unreviewed/2024/11/GHSA-2p25-rmjx-pfqv/GHSA-2p25-rmjx-pfqv.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2p25-rmjx-pfqv",
"modified": "2024-11-08T06:30:48Z",
"modified": "2024-11-29T21:31:01Z",
"published": "2024-11-08T06:30:48Z",
"aliases": [
"CVE-2024-50181"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D\n\nFor i.MX7D DRAM related mux clock, the clock source change should ONLY\nbe done done in low level asm code without accessing DRAM, and then\ncalling clk API to sync the HW clock status with clk tree, it should never\ntouch real clock source switch via clk API, so CLK_SET_PARENT_GATE flag\nshould NOT be added, otherwise, DRAM's clock parent will be disabled when\nDRAM is active, and system will hang.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -41,7 +46,7 @@
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-08T06:15:15Z"
advisories/unreviewed/2024/11/GHSA-34jr-r2pr-95hh/GHSA-34jr-r2pr-95hh.json
+1 -3
View File
@@ -13,9 +13,7 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
advisories/unreviewed/2024/11/GHSA-3cq2-fh6p-8w28/GHSA-3cq2-fh6p-8w28.json
+8 -3
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3cq2-fh6p-8w28",
"modified": "2024-11-28T06:32:42Z",
"modified": "2024-11-29T21:31:03Z",
"published": "2024-11-28T06:32:42Z",
"aliases": [
"CVE-2024-38389"
],
"details": "There is an Out-of-bounds read vulnerability in TELLUS (v4.0.19.0 and earlier) and TELLUS Lite (v4.0.19.0 and earlier). If a user opens a specially crafted file, information may be disclosed and/or arbitrary code may be executed.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
@@ -27,7 +32,7 @@
"cwe_ids": [
"CWE-125"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-28T03:15:16Z"
advisories/unreviewed/2024/11/GHSA-3vv9-rrp8-6jqf/GHSA-3vv9-rrp8-6jqf.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3vv9-rrp8-6jqf",
"modified": "2024-11-08T06:30:49Z",
"modified": "2024-11-29T21:31:02Z",
"published": "2024-11-08T06:30:49Z",
"aliases": [
"CVE-2024-50196"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: ocelot: fix system hang on level based interrupts\n\nThe current implementation only calls chained_irq_enter() and\nchained_irq_exit() if it detects pending interrupts.\n\n```\nfor (i = 0; i < info->stride; i++) {\n\turegmap_read(info->map, id_reg + 4 * i, &reg);\n\tif (!reg)\n\t\tcontinue;\n\n\tchained_irq_enter(parent_chip, desc);\n```\n\nHowever, in case of GPIO pin configured in level mode and the parent\ncontroller configured in edge mode, GPIO interrupt might be lowered by the\nhardware. In the result, if the interrupt is short enough, the parent\ninterrupt is still pending while the GPIO interrupt is cleared;\nchained_irq_enter() never gets called and the system hangs trying to\nservice the parent interrupt.\n\nMoving chained_irq_enter() and chained_irq_exit() outside the for loop\nensures that they are called even when GPIO interrupt is lowered by the\nhardware.\n\nThe similar code with chained_irq_enter() / chained_irq_exit() functions\nwrapping interrupt checking loop may be found in many other drivers:\n```\ngrep -r -A 10 chained_irq_enter drivers/pinctrl\n```",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
@@ -36,8 +41,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-754"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-08T06:15:16Z"
advisories/unreviewed/2024/11/GHSA-49pw-2xfg-hw49/GHSA-49pw-2xfg-hw49.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-49pw-2xfg-hw49",
"modified": "2024-11-29T18:34:03Z",
"modified": "2024-11-29T21:31:03Z",
"published": "2024-11-29T18:34:03Z",
"aliases": [
"CVE-2024-36624"
],
"details": "Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -28,8 +33,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-29T18:15:08Z"
advisories/unreviewed/2024/11/GHSA-4qmh-7fxc-x74p/GHSA-4qmh-7fxc-x74p.json
+1 -3
View File
@@ -13,9 +13,7 @@
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
advisories/unreviewed/2024/11/GHSA-59cm-59x5-cwhh/GHSA-59cm-59x5-cwhh.json
+1 -3
View File
@@ -13,9 +13,7 @@
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
advisories/unreviewed/2024/11/GHSA-5m9p-9w9f-5c87/GHSA-5m9p-9w9f-5c87.json
+1 -3
View File
@@ -13,9 +13,7 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
advisories/unreviewed/2024/11/GHSA-678m-q2m4-g7rf/GHSA-678m-q2m4-g7rf.json
+2 -4
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-678m-q2m4-g7rf",
"modified": "2024-11-20T09:32:54Z",
"modified": "2024-11-29T21:31:02Z",
"published": "2024-11-20T09:32:54Z",
"aliases": [
"CVE-2024-10900"
@@ -13,9 +13,7 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
advisories/unreviewed/2024/11/GHSA-6gqq-xj74-45f9/GHSA-6gqq-xj74-45f9.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6gqq-xj74-45f9",
"modified": "2024-11-29T06:35:29Z",
"modified": "2024-11-29T21:31:03Z",
"published": "2024-11-29T06:35:29Z",
"aliases": [
"CVE-2024-54123"
],
"details": "Backdrop CMS before 1.28.4 and 1.29.x before 1.29.2 allows XSS via an SVG document, if the SVG tag is allowed for a text format.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [],
"references": [
{
@@ -20,8 +25,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-29T04:15:03Z"
advisories/unreviewed/2024/11/GHSA-6hr7-2c35-r8xm/GHSA-6hr7-2c35-r8xm.json
+11 -4
View File
@@ -1,13 +1,18 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6hr7-2c35-r8xm",
"modified": "2024-11-08T18:30:49Z",
"modified": "2024-11-29T21:31:01Z",
"published": "2024-11-08T06:30:48Z",
"aliases": [
"CVE-2024-50180"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: sisfb: Fix strbuf array overflow\n\nThe values of the variables xres and yres are placed in strbuf.\nThese variables are obtained from strbuf1.\nThe strbuf1 array contains digit characters\nand a space if the array contains non-digit characters.\nThen, when executing sprintf(strbuf, \"%ux%ux8\", xres, yres);\nmore than 16 bytes will be written to strbuf.\nIt is suggested to increase the size of the strbuf array to 24.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
"severity": [],
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
@@ -48,8 +53,10 @@
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"cwe_ids": [
"CWE-787"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-08T06:15:15Z"
advisories/unreviewed/2024/11/GHSA-6wff-g5m3-3vrq/GHSA-6wff-g5m3-3vrq.json
+37
View File
@@ -0,0 +1,37 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6wff-g5m3-3vrq",
"modified": "2024-11-29T21:31:04Z",
"published": "2024-11-29T21:31:04Z",
"aliases": [
"CVE-2024-35367"
],
"details": "FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35367"
},
{
"type": "WEB",
"url": "https://github.com/ffmpeg/ffmpeg/commit/09e6840cf7a3ee07a73c3ae88a020bf27ca1a667"
},
{
"type": "WEB",
"url": "https://gist.github.com/1047524396/9754a44845578358f6a403447c458ca4"
},
{
"type": "WEB",
"url": "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/ppc/vp8dsp_altivec.c#L53"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-29T20:15:19Z"
}
}
advisories/unreviewed/2024/11/GHSA-7q22-x757-cmgc/GHSA-7q22-x757-cmgc.json
+37
View File
@@ -0,0 +1,37 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7q22-x757-cmgc",
"modified": "2024-11-29T21:31:03Z",
"published": "2024-11-29T21:31:03Z",
"aliases": [
"CVE-2024-36611"
],
"details": "In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service.",
"severity": [],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36611"
},
{
"type": "WEB",
"url": "https://github.com/symfony/symfony/commit/a804ca15fcad279d7727b91d12a667fd5b925995"
},
{
"type": "WEB",
"url": "https://gist.github.com/1047524396/3581425e0911b716cf8ce4fa30e41e6c"
},
{
"type": "WEB",
"url": "https://github.com/symfony/symfony/blob/v7.0.7/src/Symfony/Component/Security/Http/Authenticator/FormLoginAuthenticator.php#L132"
}
],
"database_specific": {
"cwe_ids": [],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-29T19:15:06Z"
}
}
advisories/unreviewed/2024/11/GHSA-87xg-hm48-6q4p/GHSA-87xg-hm48-6q4p.json
+1 -3
View File
@@ -13,9 +13,7 @@
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
advisories/unreviewed/2024/11/GHSA-8cpm-86gf-2992/GHSA-8cpm-86gf-2992.json
+1 -3
View File
@@ -13,9 +13,7 @@
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
advisories/unreviewed/2024/11/GHSA-8p49-gjw4-jcmp/GHSA-8p49-gjw4-jcmp.json
+8 -3
View File
File diff suppressed because one or more lines are too long

Some files were not shown because too many files have changed in this diff Show More