From 3abe8a4a54ab39dec423f6ac5ecdc6a754744718 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 20 Jun 2024 21:33:19 +0000 Subject: [PATCH] Publish Advisories GHSA-3pp9-5jvj-qcv4 GHSA-679m-qrhj-wgh2 GHSA-6r7r-h64q-j8pj GHSA-7f3w-mgjh-m27h GHSA-7hqq-74mf-cgjh GHSA-fcx5-mpm6-vwm3 GHSA-mpmm-q7jf-hx4p GHSA-mr2m-75hp-m2f7 GHSA-p9ff-j98v-p435 GHSA-vhhg-73hp-mrc2 --- .../GHSA-3pp9-5jvj-qcv4.json | 38 ++++++++++++++++++ .../GHSA-679m-qrhj-wgh2.json | 38 ++++++++++++++++++ .../GHSA-6r7r-h64q-j8pj.json | 38 ++++++++++++++++++ .../GHSA-7f3w-mgjh-m27h.json | 35 +++++++++++++++++ .../GHSA-7hqq-74mf-cgjh.json | 35 +++++++++++++++++ .../GHSA-fcx5-mpm6-vwm3.json | 35 +++++++++++++++++ .../GHSA-mpmm-q7jf-hx4p.json | 38 ++++++++++++++++++ .../GHSA-mr2m-75hp-m2f7.json | 38 ++++++++++++++++++ .../GHSA-p9ff-j98v-p435.json | 39 +++++++++++++++++++ .../GHSA-vhhg-73hp-mrc2.json | 38 ++++++++++++++++++ 10 files changed, 372 insertions(+) create mode 100644 advisories/unreviewed/2024/06/GHSA-3pp9-5jvj-qcv4/GHSA-3pp9-5jvj-qcv4.json create mode 100644 advisories/unreviewed/2024/06/GHSA-679m-qrhj-wgh2/GHSA-679m-qrhj-wgh2.json create mode 100644 advisories/unreviewed/2024/06/GHSA-6r7r-h64q-j8pj/GHSA-6r7r-h64q-j8pj.json create mode 100644 advisories/unreviewed/2024/06/GHSA-7f3w-mgjh-m27h/GHSA-7f3w-mgjh-m27h.json create mode 100644 advisories/unreviewed/2024/06/GHSA-7hqq-74mf-cgjh/GHSA-7hqq-74mf-cgjh.json create mode 100644 advisories/unreviewed/2024/06/GHSA-fcx5-mpm6-vwm3/GHSA-fcx5-mpm6-vwm3.json create mode 100644 advisories/unreviewed/2024/06/GHSA-mpmm-q7jf-hx4p/GHSA-mpmm-q7jf-hx4p.json create mode 100644 advisories/unreviewed/2024/06/GHSA-mr2m-75hp-m2f7/GHSA-mr2m-75hp-m2f7.json create mode 100644 advisories/unreviewed/2024/06/GHSA-p9ff-j98v-p435/GHSA-p9ff-j98v-p435.json create mode 100644 advisories/unreviewed/2024/06/GHSA-vhhg-73hp-mrc2/GHSA-vhhg-73hp-mrc2.json diff --git a/advisories/unreviewed/2024/06/GHSA-3pp9-5jvj-qcv4/GHSA-3pp9-5jvj-qcv4.json b/advisories/unreviewed/2024/06/GHSA-3pp9-5jvj-qcv4/GHSA-3pp9-5jvj-qcv4.json new file mode 100644 index 00000000000..38ea4565efe --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-3pp9-5jvj-qcv4/GHSA-3pp9-5jvj-qcv4.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3pp9-5jvj-qcv4", + "modified": "2024-06-20T21:31:45Z", + "published": "2024-06-20T21:31:45Z", + "aliases": [ + "CVE-2024-38082" + ], + "details": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38082" + }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38082" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T20:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-679m-qrhj-wgh2/GHSA-679m-qrhj-wgh2.json b/advisories/unreviewed/2024/06/GHSA-679m-qrhj-wgh2/GHSA-679m-qrhj-wgh2.json new file mode 100644 index 00000000000..290fd9f2216 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-679m-qrhj-wgh2/GHSA-679m-qrhj-wgh2.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-679m-qrhj-wgh2", + "modified": "2024-06-20T21:31:45Z", + "published": "2024-06-20T21:31:45Z", + "aliases": [ + "CVE-2024-36071" + ], + "details": "Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files used during the installation process. This occurs because of an Untrusted Search Path.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36071" + }, + { + "type": "WEB", + "url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T21:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-6r7r-h64q-j8pj/GHSA-6r7r-h64q-j8pj.json b/advisories/unreviewed/2024/06/GHSA-6r7r-h64q-j8pj/GHSA-6r7r-h64q-j8pj.json new file mode 100644 index 00000000000..a0446ededc1 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-6r7r-h64q-j8pj/GHSA-6r7r-h64q-j8pj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6r7r-h64q-j8pj", + "modified": "2024-06-20T21:31:45Z", + "published": "2024-06-20T21:31:45Z", + "aliases": [ + "CVE-2024-6153" + ], + "details": "Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels software on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Updater service. The issue results from the lack of proper validation of version information before performing an update. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-19481.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6153" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-803" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-693" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T20:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-7f3w-mgjh-m27h/GHSA-7f3w-mgjh-m27h.json b/advisories/unreviewed/2024/06/GHSA-7f3w-mgjh-m27h/GHSA-7f3w-mgjh-m27h.json new file mode 100644 index 00000000000..9b413f7aa96 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-7f3w-mgjh-m27h/GHSA-7f3w-mgjh-m27h.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7f3w-mgjh-m27h", + "modified": "2024-06-20T21:31:45Z", + "published": "2024-06-20T21:31:45Z", + "aliases": [ + "CVE-2024-29390" + ], + "details": "Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add-expense.php' page. An attacker can exploit the 'item' parameter in a POST request to execute arbitrary SQL commands in the backend database. This can be done by injecting specially crafted SQL queries that make the database perform time-consuming operations, thereby confirming the presence of the SQL injection vulnerability based on the delay in the server's response.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29390" + }, + { + "type": "WEB", + "url": "https://github.com/CyberSentryX/CVE_Hunting/blob/main/CVE-2024-29390/README.md" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T21:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-7hqq-74mf-cgjh/GHSA-7hqq-74mf-cgjh.json b/advisories/unreviewed/2024/06/GHSA-7hqq-74mf-cgjh/GHSA-7hqq-74mf-cgjh.json new file mode 100644 index 00000000000..7490b873a5e --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-7hqq-74mf-cgjh/GHSA-7hqq-74mf-cgjh.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7hqq-74mf-cgjh", + "modified": "2024-06-20T21:31:45Z", + "published": "2024-06-20T21:31:45Z", + "aliases": [ + "CVE-2024-31586" + ], + "details": "A Cross Site Scripting (XSS) vulnerability exists in Computer Laboratory Management System version 1.0. This vulnerability allows a remote attacker to execute arbitrary code via the Borrower Name, Department, and Remarks parameters.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31586" + }, + { + "type": "WEB", + "url": "https://github.com/CyberSentryX/CVE_Hunting/tree/main/CVE-2024-31586" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T21:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-fcx5-mpm6-vwm3/GHSA-fcx5-mpm6-vwm3.json b/advisories/unreviewed/2024/06/GHSA-fcx5-mpm6-vwm3/GHSA-fcx5-mpm6-vwm3.json new file mode 100644 index 00000000000..f443fc5c302 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-fcx5-mpm6-vwm3/GHSA-fcx5-mpm6-vwm3.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fcx5-mpm6-vwm3", + "modified": "2024-06-20T21:31:45Z", + "published": "2024-06-20T21:31:45Z", + "aliases": [ + "CVE-2024-30848" + ], + "details": "Cross-site scripting (XSS) vulnerability in SilverSky E-mail service version 5.0.3126 allows remote attackers to inject arbitrary web script or HTML via the version parameter.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30848" + }, + { + "type": "WEB", + "url": "https://github.com/Excis3/CVE-Disclosure/blob/main/CVE-2024-30848.md" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T21:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-mpmm-q7jf-hx4p/GHSA-mpmm-q7jf-hx4p.json b/advisories/unreviewed/2024/06/GHSA-mpmm-q7jf-hx4p/GHSA-mpmm-q7jf-hx4p.json new file mode 100644 index 00000000000..8dbbf0ab714 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-mpmm-q7jf-hx4p/GHSA-mpmm-q7jf-hx4p.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mpmm-q7jf-hx4p", + "modified": "2024-06-20T21:31:45Z", + "published": "2024-06-20T21:31:45Z", + "aliases": [ + "CVE-2024-6147" + ], + "details": "Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Poly Plantronics Hub. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Spokes Update Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18271.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6147" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-802" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-59" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T20:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-mr2m-75hp-m2f7/GHSA-mr2m-75hp-m2f7.json b/advisories/unreviewed/2024/06/GHSA-mr2m-75hp-m2f7/GHSA-mr2m-75hp-m2f7.json new file mode 100644 index 00000000000..4f04604db98 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-mr2m-75hp-m2f7/GHSA-mr2m-75hp-m2f7.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mr2m-75hp-m2f7", + "modified": "2024-06-20T21:31:45Z", + "published": "2024-06-20T21:31:45Z", + "aliases": [ + "CVE-2024-6154" + ], + "details": "Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the current user on the host system. Was ZDI-CAN-20450.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6154" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-804" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-122" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T20:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-p9ff-j98v-p435/GHSA-p9ff-j98v-p435.json b/advisories/unreviewed/2024/06/GHSA-p9ff-j98v-p435/GHSA-p9ff-j98v-p435.json new file mode 100644 index 00000000000..b586e526f69 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-p9ff-j98v-p435/GHSA-p9ff-j98v-p435.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p9ff-j98v-p435", + "modified": "2024-06-20T21:31:45Z", + "published": "2024-06-20T21:31:45Z", + "aliases": [ + "CVE-2024-37818" + ], + "details": "Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitive information via a crafted GET request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37818" + }, + { + "type": "WEB", + "url": "https://medium.com/%40barkadevaibhav491/server-side-request-forgery-in-strapi-e02d5fe218ab" + }, + { + "type": "WEB", + "url": "https://strapi.io" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T19:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-vhhg-73hp-mrc2/GHSA-vhhg-73hp-mrc2.json b/advisories/unreviewed/2024/06/GHSA-vhhg-73hp-mrc2/GHSA-vhhg-73hp-mrc2.json new file mode 100644 index 00000000000..03934b549ee --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-vhhg-73hp-mrc2/GHSA-vhhg-73hp-mrc2.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vhhg-73hp-mrc2", + "modified": "2024-06-20T21:31:45Z", + "published": "2024-06-20T21:31:45Z", + "aliases": [ + "CVE-2024-38093" + ], + "details": "Microsoft Edge (Chromium-based) Spoofing Vulnerability", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38093" + }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38093" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-20T20:15:18Z" + } +} \ No newline at end of file