Publish Advisories

GHSA-638w-x7fx-cgrj
GHSA-7q4j-f74f-6h5j
GHSA-7xfq-9m67-9j5j
GHSA-r4v4-w9pv-6fph

advisories/unreviewed/2024/07/GHSA-638w-x7fx-cgrj/GHSA-638w-x7fx-cgrj.json

@@ -0,0 +1,43 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-638w-x7fx-cgrj",
+  "modified": "2024-07-05T03:30:42Z",
+  "published": "2024-07-05T03:30:42Z",
+  "aliases": [
+    "CVE-2024-34481"
+  ],
+  "details": "drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34481"
+    },
+    {
+      "type": "WEB",
+      "url": "https://drupal-wiki.com/drupal-wiki-update-8-31"
+    },
+    {
+      "type": "WEB",
+      "url": "https://seclists.org/fulldisclosure/2024/May/4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.secuvera.de/advisories/secuvera-SA-2024-02.txt"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-05T02:15:09Z"
+  }
+}

advisories/unreviewed/2024/07/GHSA-7q4j-f74f-6h5j/GHSA-7q4j-f74f-6h5j.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7q4j-f74f-6h5j",
+  "modified": "2024-07-05T03:30:41Z",
+  "published": "2024-07-05T03:30:41Z",
+  "aliases": [
+    "CVE-2023-52340"
+  ],
+  "details": "The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily, e.g., leading to a denial of service (network is unreachable errors) when IPv6 packets are sent in a loop via a raw socket.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52340"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=af6d10345ca76670c1b7c37799f0d5576ccef277"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-05T02:15:09Z"
+  }
+}

advisories/unreviewed/2024/07/GHSA-7xfq-9m67-9j5j/GHSA-7xfq-9m67-9j5j.json

@@ -0,0 +1,47 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7xfq-9m67-9j5j",
+  "modified": "2024-07-05T03:30:42Z",
+  "published": "2024-07-05T03:30:42Z",
+  "aliases": [
+    "CVE-2024-36041"
+  ],
+  "details": "KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the session-restore feature to execute arbitrary code as the victim (on the next boot) via earlier use of the /tmp directory.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36041"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/KDE/plasma-workspace/tags"
+    },
+    {
+      "type": "WEB",
+      "url": "https://invent.kde.org/plasma/plasma-workspace"
+    },
+    {
+      "type": "WEB",
+      "url": "https://kde.org/info/security/advisory-20240531-1.txt"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.x.org/releases/X11R7.7/doc/libSM/xsmp.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-05T02:15:10Z"
+  }
+}

advisories/unreviewed/2024/07/GHSA-r4v4-w9pv-6fph/GHSA-r4v4-w9pv-6fph.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-r4v4-w9pv-6fph",
+  "modified": "2024-07-05T03:30:42Z",
+  "published": "2024-07-05T03:30:42Z",
+  "aliases": [
+    "CVE-2024-32498"
+  ],
+  "details": "An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32498"
+    },
+    {
+      "type": "WEB",
+      "url": "https://launchpad.net/bugs/2059809"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.openwall.com/lists/oss-security/2024/07/02/2"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-05T02:15:09Z"
+  }
+}