From 3bc1beff85d08d47b551437b47c0150374d986d6 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 18 Apr 2024 21:31:37 +0000 Subject: [PATCH] Publish Advisories GHSA-6c2q-w54r-h6fv GHSA-3g64-2wg6-7p8r GHSA-3v4v-f26h-73ch GHSA-66x4-8vc7-5pm4 GHSA-7pwr-cfrc-px4f GHSA-7xjx-6mf4-7xgc GHSA-m2rv-2ggp-66m7 GHSA-mx2h-33cr-3q5j GHSA-pcqx-8h4p-6r69 GHSA-qr57-vvq6-cv59 GHSA-w597-3p68-qvch --- .../GHSA-6c2q-w54r-h6fv.json | 11 +++- .../GHSA-3g64-2wg6-7p8r.json | 35 +++++++++++ .../GHSA-3v4v-f26h-73ch.json | 38 ++++++++++++ .../GHSA-66x4-8vc7-5pm4.json | 38 ++++++++++++ .../GHSA-7pwr-cfrc-px4f.json | 62 +++++++++++++++++++ .../GHSA-7xjx-6mf4-7xgc.json | 35 +++++++++++ .../GHSA-m2rv-2ggp-66m7.json | 38 ++++++++++++ .../GHSA-mx2h-33cr-3q5j.json | 38 ++++++++++++ .../GHSA-pcqx-8h4p-6r69.json | 35 +++++++++++ .../GHSA-qr57-vvq6-cv59.json | 38 ++++++++++++ .../GHSA-w597-3p68-qvch.json | 35 +++++++++++ 11 files changed, 401 insertions(+), 2 deletions(-) create mode 100644 advisories/unreviewed/2024/04/GHSA-3g64-2wg6-7p8r/GHSA-3g64-2wg6-7p8r.json create mode 100644 advisories/unreviewed/2024/04/GHSA-3v4v-f26h-73ch/GHSA-3v4v-f26h-73ch.json create mode 100644 advisories/unreviewed/2024/04/GHSA-66x4-8vc7-5pm4/GHSA-66x4-8vc7-5pm4.json create mode 100644 advisories/unreviewed/2024/04/GHSA-7pwr-cfrc-px4f/GHSA-7pwr-cfrc-px4f.json create mode 100644 advisories/unreviewed/2024/04/GHSA-7xjx-6mf4-7xgc/GHSA-7xjx-6mf4-7xgc.json create mode 100644 advisories/unreviewed/2024/04/GHSA-m2rv-2ggp-66m7/GHSA-m2rv-2ggp-66m7.json create mode 100644 advisories/unreviewed/2024/04/GHSA-mx2h-33cr-3q5j/GHSA-mx2h-33cr-3q5j.json create mode 100644 advisories/unreviewed/2024/04/GHSA-pcqx-8h4p-6r69/GHSA-pcqx-8h4p-6r69.json create mode 100644 advisories/unreviewed/2024/04/GHSA-qr57-vvq6-cv59/GHSA-qr57-vvq6-cv59.json create mode 100644 advisories/unreviewed/2024/04/GHSA-w597-3p68-qvch/GHSA-w597-3p68-qvch.json diff --git a/advisories/unreviewed/2024/02/GHSA-6c2q-w54r-h6fv/GHSA-6c2q-w54r-h6fv.json b/advisories/unreviewed/2024/02/GHSA-6c2q-w54r-h6fv/GHSA-6c2q-w54r-h6fv.json index 6697333ccc6..d1e13c6b6ab 100644 --- a/advisories/unreviewed/2024/02/GHSA-6c2q-w54r-h6fv/GHSA-6c2q-w54r-h6fv.json +++ b/advisories/unreviewed/2024/02/GHSA-6c2q-w54r-h6fv/GHSA-6c2q-w54r-h6fv.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-6c2q-w54r-h6fv", - "modified": "2024-02-13T15:31:12Z", + "modified": "2024-04-18T21:30:31Z", "published": "2024-02-13T15:31:12Z", "aliases": [ "CVE-2024-1309" ], "details": "Uncontrolled Resource Consumption vulnerability in Honeywell Niagara Framework on Windows, Linux, QNX allows Content Spoofing.This issue affects Niagara Framework: before Niagara AX 3.8.1, before Niagara 4.1.\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" + } ], "affected": [ @@ -25,6 +28,10 @@ { "type": "WEB", "url": "https://www.honeywell.com/us/en/product-security" + }, + { + "type": "WEB", + "url": "https://www.kb.cert.org/vuls/id/417980" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/04/GHSA-3g64-2wg6-7p8r/GHSA-3g64-2wg6-7p8r.json b/advisories/unreviewed/2024/04/GHSA-3g64-2wg6-7p8r/GHSA-3g64-2wg6-7p8r.json new file mode 100644 index 00000000000..51413c94578 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-3g64-2wg6-7p8r/GHSA-3g64-2wg6-7p8r.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3g64-2wg6-7p8r", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-30921" + ], + "details": "Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the photo.php component.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30921" + }, + { + "type": "WEB", + "url": "https://chocapikk.com/posts/2024/derbynet-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T21:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-3v4v-f26h-73ch/GHSA-3v4v-f26h-73ch.json b/advisories/unreviewed/2024/04/GHSA-3v4v-f26h-73ch/GHSA-3v4v-f26h-73ch.json new file mode 100644 index 00000000000..ff2df7f3f84 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-3v4v-f26h-73ch/GHSA-3v4v-f26h-73ch.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3v4v-f26h-73ch", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-23557" + ], + "details": "HCL Connections contains a user enumeration vulnerability. Certain actions could allow an attacker to determine if the user is valid or not, leading to a possible brute force attack.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23557" + }, + { + "type": "WEB", + "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0112488" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T19:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-66x4-8vc7-5pm4/GHSA-66x4-8vc7-5pm4.json b/advisories/unreviewed/2024/04/GHSA-66x4-8vc7-5pm4/GHSA-66x4-8vc7-5pm4.json new file mode 100644 index 00000000000..02f60fd7587 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-66x4-8vc7-5pm4/GHSA-66x4-8vc7-5pm4.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-66x4-8vc7-5pm4", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-29987" + ], + "details": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29987" + }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29987" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T19:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-7pwr-cfrc-px4f/GHSA-7pwr-cfrc-px4f.json b/advisories/unreviewed/2024/04/GHSA-7pwr-cfrc-px4f/GHSA-7pwr-cfrc-px4f.json new file mode 100644 index 00000000000..c66760eb0dd --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-7pwr-cfrc-px4f/GHSA-7pwr-cfrc-px4f.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7pwr-cfrc-px4f", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2023-3758" + ], + "details": "A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3758" + }, + { + "type": "WEB", + "url": "https://github.com/SSSD/sssd/pull/7302" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1919" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1920" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1921" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1922" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2023-3758" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2223762" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-285" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T19:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-7xjx-6mf4-7xgc/GHSA-7xjx-6mf4-7xgc.json b/advisories/unreviewed/2024/04/GHSA-7xjx-6mf4-7xgc/GHSA-7xjx-6mf4-7xgc.json new file mode 100644 index 00000000000..bd69850ab61 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-7xjx-6mf4-7xgc/GHSA-7xjx-6mf4-7xgc.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7xjx-6mf4-7xgc", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-30923" + ], + "details": "SQL Injection vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the where Clause in Racer Document Rendering", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30923" + }, + { + "type": "WEB", + "url": "https://chocapikk.com/posts/2024/derbynet-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T21:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-m2rv-2ggp-66m7/GHSA-m2rv-2ggp-66m7.json b/advisories/unreviewed/2024/04/GHSA-m2rv-2ggp-66m7/GHSA-m2rv-2ggp-66m7.json new file mode 100644 index 00000000000..a000c4cd150 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-m2rv-2ggp-66m7/GHSA-m2rv-2ggp-66m7.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m2rv-2ggp-66m7", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-20380" + ], + "details": "A vulnerability in the HTML parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\nThe vulnerability is due to an issue in the C to Rust foreign function interface. An attacker could exploit this vulnerability by submitting a crafted file containing HTML content to be scanned by ClamAV on an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20380" + }, + { + "type": "WEB", + "url": "https://blog.clamav.net/2024/04/clamav-131-123-106-patch-versions.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-475" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T20:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-mx2h-33cr-3q5j/GHSA-mx2h-33cr-3q5j.json b/advisories/unreviewed/2024/04/GHSA-mx2h-33cr-3q5j/GHSA-mx2h-33cr-3q5j.json new file mode 100644 index 00000000000..4ed2e9ad765 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-mx2h-33cr-3q5j/GHSA-mx2h-33cr-3q5j.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mx2h-33cr-3q5j", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-30107" + ], + "details": "HCL Connections contains a broken access control vulnerability that may expose sensitive information to unauthorized users in certain scenarios.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30107" + }, + { + "type": "WEB", + "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0112489" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T21:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-pcqx-8h4p-6r69/GHSA-pcqx-8h4p-6r69.json b/advisories/unreviewed/2024/04/GHSA-pcqx-8h4p-6r69/GHSA-pcqx-8h4p-6r69.json new file mode 100644 index 00000000000..ab90577dfdb --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-pcqx-8h4p-6r69/GHSA-pcqx-8h4p-6r69.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pcqx-8h4p-6r69", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-30922" + ], + "details": "SQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document Rendering.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30922" + }, + { + "type": "WEB", + "url": "https://chocapikk.com/posts/2024/derbynet-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T21:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-qr57-vvq6-cv59/GHSA-qr57-vvq6-cv59.json b/advisories/unreviewed/2024/04/GHSA-qr57-vvq6-cv59/GHSA-qr57-vvq6-cv59.json new file mode 100644 index 00000000000..8e5da8d3a16 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-qr57-vvq6-cv59/GHSA-qr57-vvq6-cv59.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qr57-vvq6-cv59", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-29986" + ], + "details": "Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29986" + }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29986" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-359" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T19:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-w597-3p68-qvch/GHSA-w597-3p68-qvch.json b/advisories/unreviewed/2024/04/GHSA-w597-3p68-qvch/GHSA-w597-3p68-qvch.json new file mode 100644 index 00000000000..6d3bc4a6911 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-w597-3p68-qvch/GHSA-w597-3p68-qvch.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w597-3p68-qvch", + "modified": "2024-04-18T21:30:31Z", + "published": "2024-04-18T21:30:31Z", + "aliases": [ + "CVE-2024-30920" + ], + "details": "Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30920" + }, + { + "type": "WEB", + "url": "https://chocapikk.com/posts/2024/derbynet-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-18T21:15:07Z" + } +} \ No newline at end of file