Advisory Database Sync

advisories/unreviewed/2023/06/GHSA-2pww-2c9q-m4hw/GHSA-2pww-2c9q-m4hw.json

@@ -28,7 +28,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-119"
+      "CWE-119",
+      "CWE-125"
     ],
     "severity": "HIGH",
     "github_reviewed": false,

advisories/unreviewed/2024/02/GHSA-7hw4-x97q-5wx2/GHSA-7hw4-x97q-5wx2.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7hw4-x97q-5wx2",
-  "modified": "2024-02-22T15:30:39Z",
+  "modified": "2024-11-20T18:32:14Z",
   "published": "2024-02-22T15:30:39Z",
   "aliases": [
     "CVE-2024-26281"
   ],
   "details": "Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin sites in the URL bar. This vulnerability affects Firefox for iOS < 123.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
+    }
   ],
   "affected": [
 
@@ -29,9 +32,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-79"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-02-22T15:15:08Z"

advisories/unreviewed/2024/03/GHSA-5x9p-3r7q-7j42/GHSA-5x9p-3r7q-7j42.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-5x9p-3r7q-7j42",
-  "modified": "2024-03-13T21:31:02Z",
+  "modified": "2024-11-20T18:32:14Z",
   "published": "2024-03-08T03:31:25Z",
   "aliases": [
     "CVE-2024-23279"
   ],
   "details": "A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive data.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    }
   ],
   "affected": [
 
@@ -31,7 +34,7 @@
     "cwe_ids": [
 
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-03-08T02:15:49Z"

advisories/unreviewed/2024/03/GHSA-f8q5-x5fj-x8wj/GHSA-f8q5-x5fj-x8wj.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-f8q5-x5fj-x8wj",
-  "modified": "2024-03-13T21:31:01Z",
+  "modified": "2024-11-20T18:32:14Z",
   "published": "2024-03-08T03:31:24Z",
   "aliases": [
     "CVE-2024-23205"
   ],
   "details": "A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.4, iOS 17.4 and iPadOS 17.4. An app may be able to access sensitive user data.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
   ],
   "affected": [
 
@@ -33,9 +36,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-922"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-03-08T02:15:47Z"

advisories/unreviewed/2024/03/GHSA-vcq2-59g4-9rm6/GHSA-vcq2-59g4-9rm6.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vcq2-59g4-9rm6",
-  "modified": "2024-05-01T18:30:37Z",
+  "modified": "2024-11-20T18:32:14Z",
   "published": "2024-03-27T03:31:17Z",
   "aliases": [
     "CVE-2024-25394"
   ],
   "details": "A buffer overflow occurs in utilities/ymodem/ry_sy.c in RT-Thread through 5.0.2 because of an incorrect sprintf call or a missing '\\0' character.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
+    }
   ],
   "affected": [
 
@@ -43,7 +46,7 @@
     "cwe_ids": [
       "CWE-120"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-03-27T03:15:11Z"

advisories/unreviewed/2024/04/GHSA-46ff-m72j-q8vp/GHSA-46ff-m72j-q8vp.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-46ff-m72j-q8vp",
-  "modified": "2024-04-26T03:30:29Z",
+  "modified": "2024-11-20T18:32:14Z",
   "published": "2024-04-26T03:30:29Z",
   "aliases": [
     "CVE-2023-47252"
   ],
   "details": "An issue was discovered in PnpSmm in Insyde InsydeH2O with kernel 5.0 through 5.6. There is a possible out-of-bounds access in the SMM communication buffer, leading to tampering. The PNP-related SMI sub-functions do not verify data size before getting it from the communication buffer, which could lead to possible circumstances where the data immediately following the command buffer could be destroyed with a fixed value. This is fixed in kernel 5.2 v05.28.45, kernel 5.3 v05.37.45, kernel 5.4 v05.45.45, kernel 5.5 v05.53.45, and kernel 5.6 v05.60.45.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-787"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-04-26T03:15:06Z"

advisories/unreviewed/2024/04/GHSA-96w6-xc3m-h7gp/GHSA-96w6-xc3m-h7gp.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-96w6-xc3m-h7gp",
-  "modified": "2024-04-30T21:30:32Z",
+  "modified": "2024-11-20T18:32:14Z",
   "published": "2024-04-30T21:30:32Z",
   "aliases": [
     "CVE-2024-34088"
   ],
   "details": "In FRRouting (FRR) through 9.1, it is possible for the get_edge() function in ospf_te.c in the OSPF daemon to return a NULL pointer. In cases where calling functions do not handle the returned NULL value, the OSPF daemon crashes, leading to denial of service.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-476"
     ],
-    "severity": null,
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-04-30T19:15:23Z"

advisories/unreviewed/2024/04/GHSA-f985-cwrv-f4qp/GHSA-f985-cwrv-f4qp.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-f985-cwrv-f4qp",
-  "modified": "2024-04-16T18:31:35Z",
+  "modified": "2024-11-20T18:32:14Z",
   "published": "2024-04-16T18:31:35Z",
   "aliases": [
     "CVE-2024-3860"
   ],
   "details": "An out-of-memory condition during object initialization could result in an empty shape list. If the JIT subsequently traced the object it would crash. This vulnerability affects Firefox < 125.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
   ],
   "affected": [
 
@@ -29,9 +32,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-401"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-04-16T16:15:08Z"

advisories/unreviewed/2024/04/GHSA-ffrq-jj39-9cw2/GHSA-ffrq-jj39-9cw2.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-ffrq-jj39-9cw2",
-  "modified": "2024-04-30T00:30:34Z",
+  "modified": "2024-11-20T18:32:14Z",
   "published": "2024-04-30T00:30:34Z",
   "aliases": [
     "CVE-2023-50432"
   ],
   "details": "simple-dhcp-server through ec976d2 allows remote attackers to cause a denial of service (daemon crash) by sending a DHCP packet without any option fields, which causes free_packet in dhcp_packet.c to dereference a NULL pointer.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-476"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-04-29T22:15:06Z"

advisories/unreviewed/2024/04/GHSA-fq8p-83c5-pghx/GHSA-fq8p-83c5-pghx.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-fq8p-83c5-pghx",
-  "modified": "2024-04-28T15:30:29Z",
+  "modified": "2024-11-20T18:32:14Z",
   "published": "2024-04-28T15:30:29Z",
   "aliases": [
     "CVE-2022-48646"
   ],
   "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsfc/siena: fix null pointer dereference in efx_hard_start_xmit\n\nLike in previous patch for sfc, prevent potential (but unlikely) NULL\npointer dereference.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
   ],
   "affected": [
 
@@ -31,7 +34,7 @@
     "cwe_ids": [
       "CWE-476"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-04-28T13:15:07Z"

advisories/unreviewed/2024/05/GHSA-2955-j2mm-qvcq/GHSA-2955-j2mm-qvcq.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2955-j2mm-qvcq",
-  "modified": "2024-05-03T18:30:36Z",
+  "modified": "2024-11-20T18:32:15Z",
   "published": "2024-05-03T18:30:36Z",
   "aliases": [
     "CVE-2022-48696"
   ],
   "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nregmap: spi: Reserve space for register address/padding\n\nCurrently the max_raw_read and max_raw_write limits in regmap_spi struct\ndo not take into account the additional size of the transmitted register\naddress and padding.  This may result in exceeding the maximum permitted\nSPI message size, which could cause undefined behaviour, e.g. data\ncorruption.\n\nFix regmap_get_spi_bus() to properly adjust the above mentioned limits\nby reserving space for the register address/padding as set in the regmap\nconfiguration.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
+    }
   ],
   "affected": [
 
@@ -29,9 +32,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-120"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-05-03T16:15:08Z"

advisories/unreviewed/2024/05/GHSA-57w2-rvhr-q6hq/GHSA-57w2-rvhr-q6hq.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-57w2-rvhr-q6hq",
-  "modified": "2024-05-23T18:30:55Z",
+  "modified": "2024-11-20T18:32:15Z",
   "published": "2024-05-23T18:30:55Z",
   "aliases": [
     "CVE-2024-34932"
   ],
   "details": "A SQL injection vulnerability in /model/update_exam.php in Campcodes Complete Web-Based School Management System 1.0 allows an attacker to execute arbitrary SQL commands via the name parameter.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-89"
     ],
-    "severity": null,
+    "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-05-23T17:15:30Z"

advisories/unreviewed/2024/05/GHSA-64f6-885c-52vw/GHSA-64f6-885c-52vw.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-64f6-885c-52vw",
-  "modified": "2024-05-14T18:31:05Z",
+  "modified": "2024-11-20T18:32:15Z",
   "published": "2024-05-14T18:31:05Z",
   "aliases": [
     "CVE-2024-4772"
   ],
   "details": "An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values. This vulnerability affects Firefox < 126.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    }
   ],
   "affected": [
 
@@ -29,9 +32,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-338"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-05-14T18:15:15Z"

advisories/unreviewed/2024/06/GHSA-g39c-xg27-wmff/GHSA-g39c-xg27-wmff.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-g39c-xg27-wmff",
-  "modified": "2024-06-04T15:30:58Z",
+  "modified": "2024-11-20T18:32:15Z",
   "published": "2024-06-04T15:30:58Z",
   "aliases": [
     "CVE-2024-36801"
   ],
   "details": "A SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the lgid parameter in Download.php.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-89"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-06-04T13:15:52Z"

advisories/unreviewed/2024/07/GHSA-6q4v-q7vf-h7fh/GHSA-6q4v-q7vf-h7fh.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6q4v-q7vf-h7fh",
-  "modified": "2024-07-09T21:30:39Z",
+  "modified": "2024-11-20T18:32:15Z",
   "published": "2024-07-09T21:30:39Z",
   "aliases": [
     "CVE-2024-39181"
   ],
   "details": "Shenzhen Libituo Technology Co., Ltd LBT-T300-T400 v3.2 was discovered to contain a buffer overflow via the ApCliSsid parameter in thegenerate_conf_router() function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-120"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-07-09T21:15:15Z"

advisories/unreviewed/2024/07/GHSA-mrg8-h43c-3q4j/GHSA-mrg8-h43c-3q4j.json

@@ -32,7 +32,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-476"
     ],
     "severity": "MODERATE",
     "github_reviewed": false,

advisories/unreviewed/2024/09/GHSA-4mjg-849g-c6rf/GHSA-4mjg-849g-c6rf.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4mjg-849g-c6rf",
-  "modified": "2024-09-27T15:30:33Z",
+  "modified": "2024-11-20T18:32:15Z",
   "published": "2024-09-27T15:30:33Z",
   "aliases": [
     "CVE-2024-46825"
   ],
   "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: use IWL_FW_CHECK for link ID check\n\nThe lookup function iwl_mvm_rcu_fw_link_id_to_link_conf() is\nnormally called with input from the firmware, so it should use\nIWL_FW_CHECK() instead of WARN_ON().",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
   ],
   "affected": [
 
@@ -35,7 +38,7 @@
     "cwe_ids": [
 
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-09-27T13:15:15Z"

advisories/unreviewed/2024/09/GHSA-6qfm-4c78-cfqr/GHSA-6qfm-4c78-cfqr.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6qfm-4c78-cfqr",
-  "modified": "2024-09-18T09:30:37Z",
+  "modified": "2024-11-20T18:32:15Z",
   "published": "2024-09-18T09:30:37Z",
   "aliases": [
     "CVE-2024-46774"
   ],
   "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/rtas: Prevent Spectre v1 gadget construction in sys_rtas()\n\nSmatch warns:\n\n  arch/powerpc/kernel/rtas.c:1932 __do_sys_rtas() warn: potential\n  spectre issue 'args.args' [r] (local cap)\n\nThe 'nargs' and 'nret' locals come directly from a user-supplied\nbuffer and are used as indexes into a small stack-based array and as\ninputs to copy_to_user() after they are subject to bounds checks.\n\nUse array_index_nospec() after the bounds checks to clamp these values\nfor speculative execution.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
+    }
   ],
   "affected": [
 
@@ -29,9 +32,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-787"
     ],
-    "severity": null,
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-09-18T08:15:05Z"

advisories/unreviewed/2024/09/GHSA-73cx-rxj3-qqfq/GHSA-73cx-rxj3-qqfq.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-73cx-rxj3-qqfq",
-  "modified": "2024-09-27T15:30:34Z",
+  "modified": "2024-11-20T18:32:15Z",
   "published": "2024-09-27T15:30:33Z",
   "aliases": [
     "CVE-2024-46817"
   ],
   "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6\n\n[Why]\nCoverity reports OVERRUN warning. Should abort amdgpu_dm\ninitialize.\n\n[How]\nReturn failure to amdgpu_dm_init.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
   ],
   "affected": [
 
@@ -51,7 +54,7 @@
     "cwe_ids": [
 
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-09-27T13:15:14Z"