diff --git a/advisories/unreviewed/2024/02/GHSA-6c2q-w54r-h6fv/GHSA-6c2q-w54r-h6fv.json b/advisories/unreviewed/2024/02/GHSA-6c2q-w54r-h6fv/GHSA-6c2q-w54r-h6fv.json index 6697333ccc6..d1e13c6b6ab 100644 --- a/advisories/unreviewed/2024/02/GHSA-6c2q-w54r-h6fv/GHSA-6c2q-w54r-h6fv.json +++ b/advisories/unreviewed/2024/02/GHSA-6c2q-w54r-h6fv/GHSA-6c2q-w54r-h6fv.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-6c2q-w54r-h6fv", - "modified": "2024-02-13T15:31:12Z", + "modified": "2024-04-18T21:30:31Z", "published": "2024-02-13T15:31:12Z", "aliases": [ "CVE-2024-1309" ], "details": "Uncontrolled Resource Consumption vulnerability in Honeywell Niagara Framework on Windows, Linux, QNX allows Content Spoofing.This issue affects Niagara Framework: before Niagara AX 3.8.1, before Niagara 4.1.\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" + } ], "affected": [ @@ -25,6 +28,10 @@ { "type": "WEB", "url": "https://www.honeywell.com/us/en/product-security" + }, + { + "type": "WEB", + "url": "https://www.kb.cert.org/vuls/id/417980" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/04/GHSA-3g64-2wg6-7p8r/GHSA-3g64-2wg6-7p8r.json b/advisories/unreviewed/2024/04/GHSA-3g64-2wg6-7p8r/GHSA-3g64-2wg6-7p8r.json new file mode 100644 index 00000000000..51413c94578 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-3g64-2wg6-7p8r/GHSA-3g64-2wg6-7p8r.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3g64-2wg6-7p8r", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-30921" + ], + "details": "Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the photo.php component.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30921" + }, + { + "type": "WEB", + "url": "https://chocapikk.com/posts/2024/derbynet-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T21:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-3v4v-f26h-73ch/GHSA-3v4v-f26h-73ch.json b/advisories/unreviewed/2024/04/GHSA-3v4v-f26h-73ch/GHSA-3v4v-f26h-73ch.json new file mode 100644 index 00000000000..ff2df7f3f84 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-3v4v-f26h-73ch/GHSA-3v4v-f26h-73ch.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3v4v-f26h-73ch", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-23557" + ], + "details": "HCL Connections contains a user enumeration vulnerability. Certain actions could allow an attacker to determine if the user is valid or not, leading to a possible brute force attack.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23557" + }, + { + "type": "WEB", + "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0112488" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T19:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-66x4-8vc7-5pm4/GHSA-66x4-8vc7-5pm4.json b/advisories/unreviewed/2024/04/GHSA-66x4-8vc7-5pm4/GHSA-66x4-8vc7-5pm4.json new file mode 100644 index 00000000000..02f60fd7587 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-66x4-8vc7-5pm4/GHSA-66x4-8vc7-5pm4.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-66x4-8vc7-5pm4", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-29987" + ], + "details": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29987" + }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29987" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T19:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-7pwr-cfrc-px4f/GHSA-7pwr-cfrc-px4f.json b/advisories/unreviewed/2024/04/GHSA-7pwr-cfrc-px4f/GHSA-7pwr-cfrc-px4f.json new file mode 100644 index 00000000000..c66760eb0dd --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-7pwr-cfrc-px4f/GHSA-7pwr-cfrc-px4f.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7pwr-cfrc-px4f", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2023-3758" + ], + "details": "A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3758" + }, + { + "type": "WEB", + "url": "https://github.com/SSSD/sssd/pull/7302" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1919" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1920" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1921" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1922" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2023-3758" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2223762" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-285" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T19:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-7xjx-6mf4-7xgc/GHSA-7xjx-6mf4-7xgc.json b/advisories/unreviewed/2024/04/GHSA-7xjx-6mf4-7xgc/GHSA-7xjx-6mf4-7xgc.json new file mode 100644 index 00000000000..bd69850ab61 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-7xjx-6mf4-7xgc/GHSA-7xjx-6mf4-7xgc.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7xjx-6mf4-7xgc", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-30923" + ], + "details": "SQL Injection vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the where Clause in Racer Document Rendering", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30923" + }, + { + "type": "WEB", + "url": "https://chocapikk.com/posts/2024/derbynet-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T21:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-m2rv-2ggp-66m7/GHSA-m2rv-2ggp-66m7.json b/advisories/unreviewed/2024/04/GHSA-m2rv-2ggp-66m7/GHSA-m2rv-2ggp-66m7.json new file mode 100644 index 00000000000..a000c4cd150 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-m2rv-2ggp-66m7/GHSA-m2rv-2ggp-66m7.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m2rv-2ggp-66m7", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-20380" + ], + "details": "A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\nThe vulnerability is due to an issue in the C to Rust foreign function interface. An attacker could exploit this vulnerability by submitting a crafted file containing HTML content to be scanned by ClamAV on an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20380" + }, + { + "type": "WEB", + "url": "https://blog.clamav.net/2024/04/clamav-131-123-106-patch-versions.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-475" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T20:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-mx2h-33cr-3q5j/GHSA-mx2h-33cr-3q5j.json b/advisories/unreviewed/2024/04/GHSA-mx2h-33cr-3q5j/GHSA-mx2h-33cr-3q5j.json new file mode 100644 index 00000000000..4ed2e9ad765 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-mx2h-33cr-3q5j/GHSA-mx2h-33cr-3q5j.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mx2h-33cr-3q5j", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-30107" + ], + "details": "HCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized users in certain scenarios.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30107" + }, + { + "type": "WEB", + "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0112489" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T21:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-pcqx-8h4p-6r69/GHSA-pcqx-8h4p-6r69.json b/advisories/unreviewed/2024/04/GHSA-pcqx-8h4p-6r69/GHSA-pcqx-8h4p-6r69.json new file mode 100644 index 00000000000..ab90577dfdb --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-pcqx-8h4p-6r69/GHSA-pcqx-8h4p-6r69.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pcqx-8h4p-6r69", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-30922" + ], + "details": "SQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document Rendering.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30922" + }, + { + "type": "WEB", + "url": "https://chocapikk.com/posts/2024/derbynet-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T21:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-qr57-vvq6-cv59/GHSA-qr57-vvq6-cv59.json b/advisories/unreviewed/2024/04/GHSA-qr57-vvq6-cv59/GHSA-qr57-vvq6-cv59.json new file mode 100644 index 00000000000..8e5da8d3a16 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-qr57-vvq6-cv59/GHSA-qr57-vvq6-cv59.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qr57-vvq6-cv59", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-29986" + ], + "details": "Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29986" + }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29986" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-359" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T19:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-w597-3p68-qvch/GHSA-w597-3p68-qvch.json b/advisories/unreviewed/2024/04/GHSA-w597-3p68-qvch/GHSA-w597-3p68-qvch.json new file mode 100644 index 00000000000..6d3bc4a6911 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-w597-3p68-qvch/GHSA-w597-3p68-qvch.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w597-3p68-qvch", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-30920" + ], + "details": "Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30920" + }, + { + "type": "WEB", + "url": "https://chocapikk.com/posts/2024/derbynet-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T21:15:07Z" + } +} \ No newline at end of file