Publish Advisories

GHSA-mrh2-c3xg-pf82 GHSA-qx55-5x5m-94cr GHSA-w6q8-438w-w9r4 GHSA-xwr3-f5gh-9v6w
2026-05-22 18:04:22 -07:00 · 2024-11-11 03:31:48 +00:00
parent a1e13cc2dc
commit 360e7853f8
4 changed files with 186 additions and 0 deletions
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mrh2-c3xg-pf82",
+  "modified": "2024-11-11T03:30:45Z",
+  "published": "2024-11-11T03:30:45Z",
+  "aliases": [
+    "CVE-2024-48939"
+  ],
+  "details": "Insufficient validation performed on the REST API License file in Paxton Net2 before 6.07.14023.5015 (SR4) enables use of the REST API with an invalid License File. Attackers may be able to retrieve access-log data.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48939"
+    },
+    {
+      "type": "WEB",
+      "url": "https://paxton-access.co.uk"
+    },
+    {
+      "type": "WEB",
+      "url": "https://seclists.org/fulldisclosure/2024/Oct/3"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-11T01:15:04Z"
+  }
+}
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qx55-5x5m-94cr",
+  "modified": "2024-11-11T03:30:45Z",
+  "published": "2024-11-11T03:30:45Z",
+  "aliases": [
+    "CVE-2024-11060"
+  ],
+  "details": "A vulnerability classified as critical has been found in Jinher Network Collaborative Management Platform 金和数字化智能办公平台 1.0. Affected is an unknown function of the file /C6/JHSoft.Web.AcceptAip/AcceptShow.aspx/. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11060"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Sy0ung/CVE/blob/main/verdors/JinherNetwork/Jinher-OA-System/SQLi-1.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.283806"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.283806"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.440344"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-11T01:15:04Z"
+  }
+}
@@ -0,0 +1,58 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-w6q8-438w-w9r4",
+  "modified": "2024-11-11T03:30:45Z",
+  "published": "2024-11-11T03:30:45Z",
+  "aliases": [
+    "CVE-2024-11061"
+  ],
+  "details": "A vulnerability classified as critical was found in Tenda AC10 16.03.10.13. Affected by this vulnerability is the function FUN_0044db3c of the file /goform/fast_setting_wifi_set. The manipulation of the argument timeZone leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11061"
+    },
+    {
+      "type": "WEB",
+      "url": "https://tasty-foxtrot-3a8.notion.site/Tenda-AC10v4-FUN_0044db3c-stack-overflow-13a0448e619580ae96fee2899545e159"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.283807"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.283807"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.440825"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.tenda.com.cn"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-119"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-11T01:15:04Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xwr3-f5gh-9v6w",
+  "modified": "2024-11-11T03:30:45Z",
+  "published": "2024-11-11T03:30:45Z",
+  "aliases": [
+    "CVE-2024-41992"
+  ],
+  "details": "Wi-Fi Alliance wfa_dut (in Wi-Fi Test Suite) through 9.0.0 allows OS command injection via 802.11x frames because the system() library function is used. For example, on Arcadyan FMIMG51AX000J devices, this leads to wfaTGSendPing remote code execution as root via traffic to TCP port 8000 or 8080 on a LAN interface. On other devices, this may be exploitable over a WAN interface.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41992"
+    },
+    {
+      "type": "WEB",
+      "url": "https://ssd-disclosure.com/ssd-advisory-arcadyan-fmimg51ax000j-wifi-alliance-rce"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-11T01:15:04Z"
+  }
+}