diff --git a/advisories/unreviewed/2024/07/GHSA-638w-x7fx-cgrj/GHSA-638w-x7fx-cgrj.json b/advisories/unreviewed/2024/07/GHSA-638w-x7fx-cgrj/GHSA-638w-x7fx-cgrj.json new file mode 100644 index 00000000000..a13d7bcc86d --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-638w-x7fx-cgrj/GHSA-638w-x7fx-cgrj.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-638w-x7fx-cgrj", + "modified": "2024-07-05T03:30:42Z", + "published": "2024-07-05T03:30:42Z", + "aliases": [ + "CVE-2024-34481" + ], + "details": "drupal-wiki.com Drupal Wiki before 8.31.1 allows XSS via comments, captions, and image titles of a Wiki page.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34481" + }, + { + "type": "WEB", + "url": "https://drupal-wiki.com/drupal-wiki-update-8-31" + }, + { + "type": "WEB", + "url": "https://seclists.org/fulldisclosure/2024/May/4" + }, + { + "type": "WEB", + "url": "https://www.secuvera.de/advisories/secuvera-SA-2024-02.txt" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-05T02:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-7q4j-f74f-6h5j/GHSA-7q4j-f74f-6h5j.json b/advisories/unreviewed/2024/07/GHSA-7q4j-f74f-6h5j/GHSA-7q4j-f74f-6h5j.json new file mode 100644 index 00000000000..89704a9e38d --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-7q4j-f74f-6h5j/GHSA-7q4j-f74f-6h5j.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7q4j-f74f-6h5j", + "modified": "2024-07-05T03:30:41Z", + "published": "2024-07-05T03:30:41Z", + "aliases": [ + "CVE-2023-52340" + ], + "details": "The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily, e.g., leading to a denial of service (network is unreachable errors) when IPv6 packets are sent in a loop via a raw socket.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52340" + }, + { + "type": "WEB", + "url": "https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=af6d10345ca76670c1b7c37799f0d5576ccef277" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-05T02:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-7xfq-9m67-9j5j/GHSA-7xfq-9m67-9j5j.json b/advisories/unreviewed/2024/07/GHSA-7xfq-9m67-9j5j/GHSA-7xfq-9m67-9j5j.json new file mode 100644 index 00000000000..81b64b2509e --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-7xfq-9m67-9j5j/GHSA-7xfq-9m67-9j5j.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7xfq-9m67-9j5j", + "modified": "2024-07-05T03:30:42Z", + "published": "2024-07-05T03:30:42Z", + "aliases": [ + "CVE-2024-36041" + ], + "details": "KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the session-restore feature to execute arbitrary code as the victim (on the next boot) via earlier use of the /tmp directory.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36041" + }, + { + "type": "WEB", + "url": "https://github.com/KDE/plasma-workspace/tags" + }, + { + "type": "WEB", + "url": "https://invent.kde.org/plasma/plasma-workspace" + }, + { + "type": "WEB", + "url": "https://kde.org/info/security/advisory-20240531-1.txt" + }, + { + "type": "WEB", + "url": "https://www.x.org/releases/X11R7.7/doc/libSM/xsmp.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-05T02:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-r4v4-w9pv-6fph/GHSA-r4v4-w9pv-6fph.json b/advisories/unreviewed/2024/07/GHSA-r4v4-w9pv-6fph/GHSA-r4v4-w9pv-6fph.json new file mode 100644 index 00000000000..14d87226299 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-r4v4-w9pv-6fph/GHSA-r4v4-w9pv-6fph.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r4v4-w9pv-6fph", + "modified": "2024-07-05T03:30:42Z", + "published": "2024-07-05T03:30:42Z", + "aliases": [ + "CVE-2024-32498" + ], + "details": "An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32498" + }, + { + "type": "WEB", + "url": "https://launchpad.net/bugs/2059809" + }, + { + "type": "WEB", + "url": "https://www.openwall.com/lists/oss-security/2024/07/02/2" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-05T02:15:09Z" + } +} \ No newline at end of file