Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-09-25 15:32:42 +00:00
parent 3800d216ac
commit 3cb5df5e78
44 changed files with 663 additions and 68 deletions
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-502"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5x5v-v8qh-gwrg",
-  "modified": "2022-05-17T04:16:35Z",
+  "modified": "2024-09-25T15:31:10Z",
  "published": "2022-05-17T04:16:35Z",
  "aliases": [
    "CVE-2015-1383"
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-284"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-400"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-269"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-6r7v-r49r-49r5",
-  "modified": "2024-06-10T09:31:05Z",
+  "modified": "2024-09-25T15:31:10Z",
  "published": "2024-06-10T09:31:05Z",
  "aliases": [
    "CVE-2024-35717"
@@ -56,7 +56,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-284"
+      "CWE-284",
+      "CWE-863"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-122"
+      "CWE-122",
+      "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-qjqc-63v2-7m34",
-  "modified": "2024-06-10T09:31:05Z",
+  "modified": "2024-09-25T15:31:10Z",
  "published": "2024-06-10T09:31:05Z",
  "aliases": [
    "CVE-2024-35720"
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-122"
+      "CWE-122",
+      "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2m8v-gj6w-pvrw",
+  "modified": "2024-09-25T15:31:13Z",
+  "published": "2024-09-25T15:31:13Z",
+  "aliases": [
+    "CVE-2024-43990"
+  ],
+  "details": "Insertion of Sensitive Information into Log File vulnerability in StylemixThemes Masterstudy LMS Starter.This issue affects Masterstudy LMS Starter: from n/a through 1.1.8.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43990"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/vulnerability/ms-lms-starter-theme/wordpress-masterstudy-lms-starter-theme-1-1-8-sensitive-data-exposure-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-532"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-25T15:15:14Z"
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2q3v-8m45-45jg",
-  "modified": "2024-09-25T06:30:42Z",
+  "modified": "2024-09-25T15:31:12Z",
  "published": "2024-09-25T06:30:42Z",
  "aliases": [
    "CVE-2024-6845"
  ],
  "details": "The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-25T06:15:05Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-38h7-7925-fvwv",
-  "modified": "2024-09-25T12:30:40Z",
+  "modified": "2024-09-25T15:31:12Z",
  "published": "2024-09-25T12:30:40Z",
  "aliases": [
    "CVE-2024-31145"
  ],
  "details": "Certain PCI devices in a system might be assigned Reserved Memory\nRegions (specified via Reserved Memory Region Reporting, \"RMRR\") for\nIntel VT-d or Unity Mapping ranges for AMD-Vi.  These are typically used\nfor platform tasks such as legacy USB emulation.\n\nSince the precise purpose of these regions is unknown, once a device\nassociated with such a region is active, the mappings of these regions\nneed to remain continuouly accessible by the device.  In the logic\nestablishing these mappings, error handling was flawed, resulting in\nsuch mappings to potentially remain in place when they should have been\nremoved again.  Respective guests would then gain access to memory\nregions which they aren't supposed to have access to.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-400"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-25T11:15:12Z"
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3hwv-fr9j-3wjq",
+  "modified": "2024-09-25T15:31:13Z",
+  "published": "2024-09-25T15:31:13Z",
+  "aliases": [
+    "CVE-2024-46461"
+  ],
+  "details": "VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the target user's privileges.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46461"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.videolan.org/security/sb-vlc3021.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-25T15:15:14Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3x94-47mg-35rf",
+  "modified": "2024-09-25T15:31:12Z",
+  "published": "2024-09-25T15:31:12Z",
+  "aliases": [
+    "CVE-2024-7576"
+  ],
+  "details": "In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7576"
+    },
+    {
+      "type": "WEB",
+      "url": "https://docs.telerik.com/devtools/wpf/knowledge-base/unsafe-deserialization-cve-2024-7576"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-502"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-25T14:15:05Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4wh3-4hcw-ph3f",
+  "modified": "2024-09-25T15:31:13Z",
+  "published": "2024-09-25T15:31:13Z",
+  "aliases": [
+    "CVE-2024-7679"
+  ],
+  "details": "In Progress Telerik UI for WinForms versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7679"
+    },
+    {
+      "type": "WEB",
+      "url": "https://docs.telerik.com/devtools/winforms/knowledge-base/command-injection-cve-2024-7679"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-77"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-25T14:15:06Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5mvr-wqp8-rqpq",
+  "modified": "2024-09-25T15:31:13Z",
+  "published": "2024-09-25T15:31:13Z",
+  "aliases": [
+    "CVE-2024-22893"
+  ],
+  "details": "OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime. This can allow attackers to obtain information about the password hash using a timing attack.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22893"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gist.github.com/mdickopp/10e4a4ba3d7ded8315a1613ee7f2541e"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-25T15:15:13Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6cm4-chj3-vwmx",
+  "modified": "2024-09-25T15:31:13Z",
+  "published": "2024-09-25T15:31:13Z",
+  "aliases": [
+    "CVE-2024-30128"
+  ],
+  "details": "HCL Nomad server on Domino is affected by an open proxy vulnerability in which an unauthenticated attacker can mask their original source IP address.  This may enable an attacker to trick the user into exposing sensitive information.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30128"
+    },
+    {
+      "type": "WEB",
+      "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0115504"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-25T15:15:13Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6q8c-85p2-954c",
+  "modified": "2024-09-25T15:31:13Z",
+  "published": "2024-09-25T15:31:12Z",
+  "aliases": [
+    "CVE-2024-8316"
+  ],
+  "details": "In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8316"
+    },
+    {
+      "type": "WEB",
+      "url": "https://docs.telerik.com/devtools/wpf/knowledge-base/unsafe-deserialization-cve-2024-8316"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-502"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-25T14:15:06Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6xmx-57h5-2fhv",
+  "modified": "2024-09-25T15:31:13Z",
+  "published": "2024-09-25T15:31:13Z",
+  "aliases": [
+    "CVE-2024-43237"
+  ],
+  "details": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in TaxoPress WordPress Tag Cloud Plugin – Tag Groups.This issue affects WordPress Tag Cloud Plugin – Tag Groups: from n/a through 2.0.3.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43237"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/vulnerability/tag-groups/wordpress-tag-groups-plugin-2-0-3-sensitive-data-exposure-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-200"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-25T15:15:14Z"
+  }
+}
--- a/Show More
+++ b/Show More