diff --git a/advisories/unreviewed/2024/10/GHSA-4rf2-7phj-4vwq/GHSA-4rf2-7phj-4vwq.json b/advisories/unreviewed/2024/10/GHSA-4rf2-7phj-4vwq/GHSA-4rf2-7phj-4vwq.json new file mode 100644 index 00000000000..b6ed51b1df2 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-4rf2-7phj-4vwq/GHSA-4rf2-7phj-4vwq.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4rf2-7phj-4vwq", + "modified": "2024-10-10T09:30:35Z", + "published": "2024-10-10T09:30:35Z", + "aliases": [ + "CVE-2024-9780" + ], + "details": "ITS dissector crash in Wireshark 4.4.0 allows denial of service via packet injection or crafted capture file", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9780" + }, + { + "type": "WEB", + "url": "https://gitlab.com/wireshark/wireshark/-/issues/20026" + }, + { + "type": "WEB", + "url": "https://www.wireshark.org/security/wnpa-sec-2024-12.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-456" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-10T07:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-53m6-g2mp-6mj7/GHSA-53m6-g2mp-6mj7.json b/advisories/unreviewed/2024/10/GHSA-53m6-g2mp-6mj7/GHSA-53m6-g2mp-6mj7.json new file mode 100644 index 00000000000..4afa3ba34aa --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-53m6-g2mp-6mj7/GHSA-53m6-g2mp-6mj7.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-53m6-g2mp-6mj7", + "modified": "2024-10-10T09:30:35Z", + "published": "2024-10-10T09:30:35Z", + "aliases": [ + "CVE-2024-6747" + ], + "details": "Information leakage in mknotifyd in Checkmk before 2.3.0p18, 2.2.0p36, 2.1.0p49 and in 2.0.0p39 (EOL) allows attacker to get potentially sensitive data", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6747" + }, + { + "type": "WEB", + "url": "https://checkmk.com/werk/17145" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-201" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-10T08:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-6qm6-gg4q-cvm5/GHSA-6qm6-gg4q-cvm5.json b/advisories/unreviewed/2024/10/GHSA-6qm6-gg4q-cvm5/GHSA-6qm6-gg4q-cvm5.json new file mode 100644 index 00000000000..4b12375a7f9 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-6qm6-gg4q-cvm5/GHSA-6qm6-gg4q-cvm5.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6qm6-gg4q-cvm5", + "modified": "2024-10-10T09:30:35Z", + "published": "2024-10-10T09:30:35Z", + "aliases": [ + "CVE-2024-9798" + ], + "details": "The health endpoint is public so everybody can see a list of all services. It is potentially valuable information for attackers.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9798" + }, + { + "type": "WEB", + "url": "https://github.com/zowe/api-layer" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-10T08:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-752v-9q7h-jp65/GHSA-752v-9q7h-jp65.json b/advisories/unreviewed/2024/10/GHSA-752v-9q7h-jp65/GHSA-752v-9q7h-jp65.json new file mode 100644 index 00000000000..5ddeb5a2948 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-752v-9q7h-jp65/GHSA-752v-9q7h-jp65.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-752v-9q7h-jp65", + "modified": "2024-10-10T09:30:35Z", + "published": "2024-10-10T09:30:35Z", + "aliases": [ + "CVE-2024-9781" + ], + "details": "AppleTalk and RELOAD Framing dissector crash in Wireshark 4.4.0 and 4.2.0 to 4.2.7 allows denial of service via packet injection or crafted capture file", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9781" + }, + { + "type": "WEB", + "url": "https://gitlab.com/wireshark/wireshark/-/issues/20114" + }, + { + "type": "WEB", + "url": "https://www.wireshark.org/security/wnpa-sec-2024-13.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-230" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-10T07:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-947m-jhcv-94rp/GHSA-947m-jhcv-94rp.json b/advisories/unreviewed/2024/10/GHSA-947m-jhcv-94rp/GHSA-947m-jhcv-94rp.json new file mode 100644 index 00000000000..052f32a60f9 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-947m-jhcv-94rp/GHSA-947m-jhcv-94rp.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-947m-jhcv-94rp", + "modified": "2024-10-10T09:30:35Z", + "published": "2024-10-10T09:30:35Z", + "aliases": [ + "CVE-2024-7049" + ], + "details": "In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7049" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/ee9e3532-8ef1-4599-bb59-b8e2ba43a1fc" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-488" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-10T08:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-hxx7-vhm6-3427/GHSA-hxx7-vhm6-3427.json b/advisories/unreviewed/2024/10/GHSA-hxx7-vhm6-3427/GHSA-hxx7-vhm6-3427.json new file mode 100644 index 00000000000..7c9f25b7676 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-hxx7-vhm6-3427/GHSA-hxx7-vhm6-3427.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hxx7-vhm6-3427", + "modified": "2024-10-10T09:30:35Z", + "published": "2024-10-10T09:30:35Z", + "aliases": [ + "CVE-2024-9796" + ], + "details": "The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9796" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/2ddd6839-6bcb-4bb8-97e0-1516b8c2b99b" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-10T08:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-mxxc-9r58-2xrq/GHSA-mxxc-9r58-2xrq.json b/advisories/unreviewed/2024/10/GHSA-mxxc-9r58-2xrq/GHSA-mxxc-9r58-2xrq.json new file mode 100644 index 00000000000..c3e571fd322 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-mxxc-9r58-2xrq/GHSA-mxxc-9r58-2xrq.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mxxc-9r58-2xrq", + "modified": "2024-10-10T09:30:35Z", + "published": "2024-10-10T09:30:35Z", + "aliases": [ + "CVE-2024-22068" + ], + "details": "Improper Privilege Management vulnerability in ZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series on 64 bit allows Functionality Bypass.This issue affects ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series: V4.00.10 and earlier.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22068" + }, + { + "type": "WEB", + "url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/5359853646778130472" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-10T09:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-v9w7-jfhc-2mj9/GHSA-v9w7-jfhc-2mj9.json b/advisories/unreviewed/2024/10/GHSA-v9w7-jfhc-2mj9/GHSA-v9w7-jfhc-2mj9.json new file mode 100644 index 00000000000..e1140fa746a --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-v9w7-jfhc-2mj9/GHSA-v9w7-jfhc-2mj9.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v9w7-jfhc-2mj9", + "modified": "2024-10-10T09:30:35Z", + "published": "2024-10-10T09:30:35Z", + "aliases": [ + "CVE-2024-9802" + ], + "details": "The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The attacker could also check if a service is running.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9802" + }, + { + "type": "WEB", + "url": "https://github.com/zowe/api-layer" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-10T08:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-vvj9-jphf-5vfh/GHSA-vvj9-jphf-5vfh.json b/advisories/unreviewed/2024/10/GHSA-vvj9-jphf-5vfh/GHSA-vvj9-jphf-5vfh.json index e907cf10476..5cbc382bc76 100644 --- a/advisories/unreviewed/2024/10/GHSA-vvj9-jphf-5vfh/GHSA-vvj9-jphf-5vfh.json +++ b/advisories/unreviewed/2024/10/GHSA-vvj9-jphf-5vfh/GHSA-vvj9-jphf-5vfh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vvj9-jphf-5vfh", - "modified": "2024-10-09T21:31:08Z", + "modified": "2024-10-10T09:30:34Z", "published": "2024-10-09T21:31:08Z", "aliases": [ "CVE-2024-38817"