From 304bb6bf5db610519bc656e79d9b681216b200de Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 29 Jan 2024 12:31:18 +0000 Subject: [PATCH] Publish Advisories GHSA-4h85-vpxq-834q GHSA-9w3h-593p-q56r GHSA-m3mr-pjj3-2g74 GHSA-m525-p4rf-7h93 GHSA-q87w-hjgf-6vfw --- .../GHSA-4h85-vpxq-834q.json | 38 ++++++++++++++ .../GHSA-9w3h-593p-q56r.json | 50 +++++++++++++++++++ .../GHSA-m3mr-pjj3-2g74.json | 35 +++++++++++++ .../GHSA-m525-p4rf-7h93.json | 38 ++++++++++++++ .../GHSA-q87w-hjgf-6vfw.json | 38 ++++++++++++++ 5 files changed, 199 insertions(+) create mode 100644 advisories/unreviewed/2024/01/GHSA-4h85-vpxq-834q/GHSA-4h85-vpxq-834q.json create mode 100644 advisories/unreviewed/2024/01/GHSA-9w3h-593p-q56r/GHSA-9w3h-593p-q56r.json create mode 100644 advisories/unreviewed/2024/01/GHSA-m3mr-pjj3-2g74/GHSA-m3mr-pjj3-2g74.json create mode 100644 advisories/unreviewed/2024/01/GHSA-m525-p4rf-7h93/GHSA-m525-p4rf-7h93.json create mode 100644 advisories/unreviewed/2024/01/GHSA-q87w-hjgf-6vfw/GHSA-q87w-hjgf-6vfw.json diff --git a/advisories/unreviewed/2024/01/GHSA-4h85-vpxq-834q/GHSA-4h85-vpxq-834q.json b/advisories/unreviewed/2024/01/GHSA-4h85-vpxq-834q/GHSA-4h85-vpxq-834q.json new file mode 100644 index 00000000000..f8735ca6fc6 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-4h85-vpxq-834q/GHSA-4h85-vpxq-834q.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4h85-vpxq-834q", + "modified": "2024-01-29T12:30:20Z", + "published": "2024-01-29T12:30:20Z", + "aliases": [ + "CVE-2024-23792" + ], + "details": "When adding attachments to ticket comments, \nanother user can add attachments as well impersonating the orginal user. The attack requires a \nlogged-in other user to know the UUID. While the legitimate user \ncompletes the comment, the malicious user can add more files to the \ncomment.\n\nThis issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23792" + }, + { + "type": "WEB", + "url": "https://otrs.com/release-notes/otrs-security-advisory-2024-03/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-29T10:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-9w3h-593p-q56r/GHSA-9w3h-593p-q56r.json b/advisories/unreviewed/2024/01/GHSA-9w3h-593p-q56r/GHSA-9w3h-593p-q56r.json new file mode 100644 index 00000000000..1d6ce87eddb --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-9w3h-593p-q56r/GHSA-9w3h-593p-q56r.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9w3h-593p-q56r", + "modified": "2024-01-29T12:30:20Z", + "published": "2024-01-29T12:30:20Z", + "aliases": [ + "CVE-2023-5378" + ], + "details": "Improper Input Validation vulnerability in MegaBIP and already unsupported SmodBIP software allows for Stored XSS.This issue affects SmodBIP in all versions and MegaBIP in versions up to 4.36.2 (newer versions were not tested; the vendor has not confirmed fixing the vulnerability). \n\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5378" + }, + { + "type": "WEB", + "url": "https://cert.pl/en/posts/2023/12/CVE-2023-5378" + }, + { + "type": "WEB", + "url": "https://cert.pl/posts/2023/12/CVE-2023-5378" + }, + { + "type": "WEB", + "url": "https://megabip.pl/" + }, + { + "type": "WEB", + "url": "https://smod.pl/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-29T12:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-m3mr-pjj3-2g74/GHSA-m3mr-pjj3-2g74.json b/advisories/unreviewed/2024/01/GHSA-m3mr-pjj3-2g74/GHSA-m3mr-pjj3-2g74.json new file mode 100644 index 00000000000..5587b74e3d1 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-m3mr-pjj3-2g74/GHSA-m3mr-pjj3-2g74.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m3mr-pjj3-2g74", + "modified": "2024-01-29T12:30:20Z", + "published": "2024-01-29T12:30:20Z", + "aliases": [ + "CVE-2023-46838" + ], + "details": "Transmit requests in Xen's virtual network protocol can consist of\nmultiple parts. While not really useful, except for the initial part\nany of them may be of zero length, i.e. carry no data at all. Besides a\ncertain initial portion of the to be transferred data, these parts are\ndirectly translated into what Linux calls SKB fragments. Such converted\nrequest parts can, when for a particular SKB they are all of length\nzero, lead to a de-reference of NULL in core networking code.\n", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46838" + }, + { + "type": "WEB", + "url": "https://xenbits.xenproject.org/xsa/advisory-448.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-29T11:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-m525-p4rf-7h93/GHSA-m525-p4rf-7h93.json b/advisories/unreviewed/2024/01/GHSA-m525-p4rf-7h93/GHSA-m525-p4rf-7h93.json new file mode 100644 index 00000000000..8439470e40c --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-m525-p4rf-7h93/GHSA-m525-p4rf-7h93.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m525-p4rf-7h93", + "modified": "2024-01-29T12:30:20Z", + "published": "2024-01-29T12:30:20Z", + "aliases": [ + "CVE-2024-23790" + ], + "details": "Improper Input Validation vulnerability in the upload functionality for user avatars allows functionality misuse due to missing check of filetypes.\nThis issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023 through 2023.1.1.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23790" + }, + { + "type": "WEB", + "url": "https://otrs.com/release-notes/otrs-security-advisory-2024-01/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-29T10:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-q87w-hjgf-6vfw/GHSA-q87w-hjgf-6vfw.json b/advisories/unreviewed/2024/01/GHSA-q87w-hjgf-6vfw/GHSA-q87w-hjgf-6vfw.json new file mode 100644 index 00000000000..77ff5e2ddc0 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-q87w-hjgf-6vfw/GHSA-q87w-hjgf-6vfw.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q87w-hjgf-6vfw", + "modified": "2024-01-29T12:30:20Z", + "published": "2024-01-29T12:30:20Z", + "aliases": [ + "CVE-2024-23791" + ], + "details": "Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23791" + }, + { + "type": "WEB", + "url": "https://otrs.com/release-notes/otrs-security-advisory-2024-02/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-29T10:15:08Z" + } +} \ No newline at end of file