From 360e7853f875990870f6333b073307b4f615ac96 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 11 Nov 2024 03:31:48 +0000 Subject: [PATCH] Publish Advisories GHSA-mrh2-c3xg-pf82 GHSA-qx55-5x5m-94cr GHSA-w6q8-438w-w9r4 GHSA-xwr3-f5gh-9v6w --- .../GHSA-mrh2-c3xg-pf82.json | 39 +++++++++++++ .../GHSA-qx55-5x5m-94cr.json | 54 +++++++++++++++++ .../GHSA-w6q8-438w-w9r4.json | 58 +++++++++++++++++++ .../GHSA-xwr3-f5gh-9v6w.json | 35 +++++++++++ 4 files changed, 186 insertions(+) create mode 100644 advisories/unreviewed/2024/11/GHSA-mrh2-c3xg-pf82/GHSA-mrh2-c3xg-pf82.json create mode 100644 advisories/unreviewed/2024/11/GHSA-qx55-5x5m-94cr/GHSA-qx55-5x5m-94cr.json create mode 100644 advisories/unreviewed/2024/11/GHSA-w6q8-438w-w9r4/GHSA-w6q8-438w-w9r4.json create mode 100644 advisories/unreviewed/2024/11/GHSA-xwr3-f5gh-9v6w/GHSA-xwr3-f5gh-9v6w.json diff --git a/advisories/unreviewed/2024/11/GHSA-mrh2-c3xg-pf82/GHSA-mrh2-c3xg-pf82.json b/advisories/unreviewed/2024/11/GHSA-mrh2-c3xg-pf82/GHSA-mrh2-c3xg-pf82.json new file mode 100644 index 00000000000..f4800e9e927 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-mrh2-c3xg-pf82/GHSA-mrh2-c3xg-pf82.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mrh2-c3xg-pf82", + "modified": "2024-11-11T03:30:45Z", + "published": "2024-11-11T03:30:45Z", + "aliases": [ + "CVE-2024-48939" + ], + "details": "Insufficient validation performed on the REST API License file in Paxton Net2 before 6.07.14023.5015 (SR4) enables use of the REST API with an invalid License File. Attackers may be able to retrieve access-log data.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48939" + }, + { + "type": "WEB", + "url": "https://paxton-access.co.uk" + }, + { + "type": "WEB", + "url": "https://seclists.org/fulldisclosure/2024/Oct/3" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T01:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-qx55-5x5m-94cr/GHSA-qx55-5x5m-94cr.json b/advisories/unreviewed/2024/11/GHSA-qx55-5x5m-94cr/GHSA-qx55-5x5m-94cr.json new file mode 100644 index 00000000000..a54e9b972e6 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-qx55-5x5m-94cr/GHSA-qx55-5x5m-94cr.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qx55-5x5m-94cr", + "modified": "2024-11-11T03:30:45Z", + "published": "2024-11-11T03:30:45Z", + "aliases": [ + "CVE-2024-11060" + ], + "details": "A vulnerability classified as critical has been found in Jinher Network Collaborative Management Platform 金和数字化智能办公平台 1.0. Affected is an unknown function of the file /C6/JHSoft.Web.AcceptAip/AcceptShow.aspx/. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11060" + }, + { + "type": "WEB", + "url": "https://github.com/Sy0ung/CVE/blob/main/verdors/JinherNetwork/Jinher-OA-System/SQLi-1.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283806" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283806" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.440344" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T01:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w6q8-438w-w9r4/GHSA-w6q8-438w-w9r4.json b/advisories/unreviewed/2024/11/GHSA-w6q8-438w-w9r4/GHSA-w6q8-438w-w9r4.json new file mode 100644 index 00000000000..65e60f911a8 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w6q8-438w-w9r4/GHSA-w6q8-438w-w9r4.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w6q8-438w-w9r4", + "modified": "2024-11-11T03:30:45Z", + "published": "2024-11-11T03:30:45Z", + "aliases": [ + "CVE-2024-11061" + ], + "details": "A vulnerability classified as critical was found in Tenda AC10 16.03.10.13. Affected by this vulnerability is the function FUN_0044db3c of the file /goform/fast_setting_wifi_set. The manipulation of the argument timeZone leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11061" + }, + { + "type": "WEB", + "url": "https://tasty-foxtrot-3a8.notion.site/Tenda-AC10v4-FUN_0044db3c-stack-overflow-13a0448e619580ae96fee2899545e159" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283807" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283807" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.440825" + }, + { + "type": "WEB", + "url": "https://www.tenda.com.cn" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-119" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T01:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-xwr3-f5gh-9v6w/GHSA-xwr3-f5gh-9v6w.json b/advisories/unreviewed/2024/11/GHSA-xwr3-f5gh-9v6w/GHSA-xwr3-f5gh-9v6w.json new file mode 100644 index 00000000000..e7d6db0ecf7 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-xwr3-f5gh-9v6w/GHSA-xwr3-f5gh-9v6w.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xwr3-f5gh-9v6w", + "modified": "2024-11-11T03:30:45Z", + "published": "2024-11-11T03:30:45Z", + "aliases": [ + "CVE-2024-41992" + ], + "details": "Wi-Fi Alliance wfa_dut (in Wi-Fi Test Suite) through 9.0.0 allows OS command injection via 802.11x frames because the system() library function is used. For example, on Arcadyan FMIMG51AX000J devices, this leads to wfaTGSendPing remote code execution as root via traffic to TCP port 8000 or 8080 on a LAN interface. On other devices, this may be exploitable over a WAN interface.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41992" + }, + { + "type": "WEB", + "url": "https://ssd-disclosure.com/ssd-advisory-arcadyan-fmimg51ax000j-wifi-alliance-rce" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T01:15:04Z" + } +} \ No newline at end of file