From 3d1cf2f8c694a511aa57d0072b6e87a2b99910bc Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 10 Oct 2024 09:32:27 +0000 Subject: [PATCH] Publish Advisories GHSA-4rf2-7phj-4vwq GHSA-53m6-g2mp-6mj7 GHSA-6qm6-gg4q-cvm5 GHSA-752v-9q7h-jp65 GHSA-947m-jhcv-94rp GHSA-hxx7-vhm6-3427 GHSA-mxxc-9r58-2xrq GHSA-v9w7-jfhc-2mj9 GHSA-vvj9-jphf-5vfh --- .../GHSA-4rf2-7phj-4vwq.json | 42 +++++++++++++++++++ .../GHSA-53m6-g2mp-6mj7.json | 38 +++++++++++++++++ .../GHSA-6qm6-gg4q-cvm5.json | 38 +++++++++++++++++ .../GHSA-752v-9q7h-jp65.json | 42 +++++++++++++++++++ .../GHSA-947m-jhcv-94rp.json | 38 +++++++++++++++++ .../GHSA-hxx7-vhm6-3427.json | 35 ++++++++++++++++ .../GHSA-mxxc-9r58-2xrq.json | 38 +++++++++++++++++ .../GHSA-v9w7-jfhc-2mj9.json | 38 +++++++++++++++++ .../GHSA-vvj9-jphf-5vfh.json | 2 +- 9 files changed, 310 insertions(+), 1 deletion(-) create mode 100644 advisories/unreviewed/2024/10/GHSA-4rf2-7phj-4vwq/GHSA-4rf2-7phj-4vwq.json create mode 100644 advisories/unreviewed/2024/10/GHSA-53m6-g2mp-6mj7/GHSA-53m6-g2mp-6mj7.json create mode 100644 advisories/unreviewed/2024/10/GHSA-6qm6-gg4q-cvm5/GHSA-6qm6-gg4q-cvm5.json create mode 100644 advisories/unreviewed/2024/10/GHSA-752v-9q7h-jp65/GHSA-752v-9q7h-jp65.json create mode 100644 advisories/unreviewed/2024/10/GHSA-947m-jhcv-94rp/GHSA-947m-jhcv-94rp.json create mode 100644 advisories/unreviewed/2024/10/GHSA-hxx7-vhm6-3427/GHSA-hxx7-vhm6-3427.json create mode 100644 advisories/unreviewed/2024/10/GHSA-mxxc-9r58-2xrq/GHSA-mxxc-9r58-2xrq.json create mode 100644 advisories/unreviewed/2024/10/GHSA-v9w7-jfhc-2mj9/GHSA-v9w7-jfhc-2mj9.json diff --git a/advisories/unreviewed/2024/10/GHSA-4rf2-7phj-4vwq/GHSA-4rf2-7phj-4vwq.json b/advisories/unreviewed/2024/10/GHSA-4rf2-7phj-4vwq/GHSA-4rf2-7phj-4vwq.json new file mode 100644 index 00000000000..b6ed51b1df2 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-4rf2-7phj-4vwq/GHSA-4rf2-7phj-4vwq.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4rf2-7phj-4vwq", + "modified": "2024-10-10T09:30:35Z", + "published": "2024-10-10T09:30:35Z", + "aliases": [ + "CVE-2024-9780" + ], + "details": "ITS dissector crash in Wireshark 4.4.0 allows denial of service via packet injection or crafted capture file", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9780" + }, + { + "type": "WEB", + "url": "https://gitlab.com/wireshark/wireshark/-/issues/20026" + }, + { + "type": "WEB", + "url": "https://www.wireshark.org/security/wnpa-sec-2024-12.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-456" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-10T07:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-53m6-g2mp-6mj7/GHSA-53m6-g2mp-6mj7.json b/advisories/unreviewed/2024/10/GHSA-53m6-g2mp-6mj7/GHSA-53m6-g2mp-6mj7.json new file mode 100644 index 00000000000..4afa3ba34aa --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-53m6-g2mp-6mj7/GHSA-53m6-g2mp-6mj7.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-53m6-g2mp-6mj7", + "modified": "2024-10-10T09:30:35Z", + "published": "2024-10-10T09:30:35Z", + "aliases": [ + "CVE-2024-6747" + ], + "details": "Information leakage in mknotifyd in Checkmk before 2.3.0p18, 2.2.0p36, 2.1.0p49 and in 2.0.0p39 (EOL) allows attacker to get potentially sensitive data", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6747" + }, + { + "type": "WEB", + "url": "https://checkmk.com/werk/17145" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-201" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-10T08:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-6qm6-gg4q-cvm5/GHSA-6qm6-gg4q-cvm5.json b/advisories/unreviewed/2024/10/GHSA-6qm6-gg4q-cvm5/GHSA-6qm6-gg4q-cvm5.json new file mode 100644 index 00000000000..4b12375a7f9 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-6qm6-gg4q-cvm5/GHSA-6qm6-gg4q-cvm5.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6qm6-gg4q-cvm5", + "modified": "2024-10-10T09:30:35Z", + "published": "2024-10-10T09:30:35Z", + "aliases": [ + "CVE-2024-9798" + ], + "details": "The health endpoint is public so everybody can see a list of all services. It is potentially valuable information for attackers.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9798" + }, + { + "type": "WEB", + "url": "https://github.com/zowe/api-layer" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-10T08:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-752v-9q7h-jp65/GHSA-752v-9q7h-jp65.json b/advisories/unreviewed/2024/10/GHSA-752v-9q7h-jp65/GHSA-752v-9q7h-jp65.json new file mode 100644 index 00000000000..5ddeb5a2948 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-752v-9q7h-jp65/GHSA-752v-9q7h-jp65.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-752v-9q7h-jp65", + "modified": "2024-10-10T09:30:35Z", + "published": "2024-10-10T09:30:35Z", + "aliases": [ + "CVE-2024-9781" + ], + "details": "AppleTalk and RELOAD Framing dissector crash in Wireshark 4.4.0 and 4.2.0 to 4.2.7 allows denial of service via packet injection or crafted capture file", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9781" + }, + { + "type": "WEB", + "url": "https://gitlab.com/wireshark/wireshark/-/issues/20114" + }, + { + "type": "WEB", + "url": "https://www.wireshark.org/security/wnpa-sec-2024-13.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-230" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-10T07:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-947m-jhcv-94rp/GHSA-947m-jhcv-94rp.json b/advisories/unreviewed/2024/10/GHSA-947m-jhcv-94rp/GHSA-947m-jhcv-94rp.json new file mode 100644 index 00000000000..052f32a60f9 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-947m-jhcv-94rp/GHSA-947m-jhcv-94rp.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-947m-jhcv-94rp", + "modified": "2024-10-10T09:30:35Z", + "published": "2024-10-10T09:30:35Z", + "aliases": [ + "CVE-2024-7049" + ], + "details": "In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7049" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/ee9e3532-8ef1-4599-bb59-b8e2ba43a1fc" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-488" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-10T08:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-hxx7-vhm6-3427/GHSA-hxx7-vhm6-3427.json b/advisories/unreviewed/2024/10/GHSA-hxx7-vhm6-3427/GHSA-hxx7-vhm6-3427.json new file mode 100644 index 00000000000..7c9f25b7676 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-hxx7-vhm6-3427/GHSA-hxx7-vhm6-3427.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hxx7-vhm6-3427", + "modified": "2024-10-10T09:30:35Z", + "published": "2024-10-10T09:30:35Z", + "aliases": [ + "CVE-2024-9796" + ], + "details": "The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9796" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/2ddd6839-6bcb-4bb8-97e0-1516b8c2b99b" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-10T08:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-mxxc-9r58-2xrq/GHSA-mxxc-9r58-2xrq.json b/advisories/unreviewed/2024/10/GHSA-mxxc-9r58-2xrq/GHSA-mxxc-9r58-2xrq.json new file mode 100644 index 00000000000..c3e571fd322 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-mxxc-9r58-2xrq/GHSA-mxxc-9r58-2xrq.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mxxc-9r58-2xrq", + "modified": "2024-10-10T09:30:35Z", + "published": "2024-10-10T09:30:35Z", + "aliases": [ + "CVE-2024-22068" + ], + "details": "Improper Privilege Management vulnerability in ZTE ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series on 64 bit allows Functionality Bypass.This issue affects ZXR10 1800-2S series ,ZXR10 2800-4,ZXR10 3800-8,ZXR10 160 series: V4.00.10 and earlier.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22068" + }, + { + "type": "WEB", + "url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/5359853646778130472" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-10T09:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-v9w7-jfhc-2mj9/GHSA-v9w7-jfhc-2mj9.json b/advisories/unreviewed/2024/10/GHSA-v9w7-jfhc-2mj9/GHSA-v9w7-jfhc-2mj9.json new file mode 100644 index 00000000000..e1140fa746a --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-v9w7-jfhc-2mj9/GHSA-v9w7-jfhc-2mj9.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v9w7-jfhc-2mj9", + "modified": "2024-10-10T09:30:35Z", + "published": "2024-10-10T09:30:35Z", + "aliases": [ + "CVE-2024-9802" + ], + "details": "The conformance validation endpoint is public so everybody can verify the conformance of onboarded services. The response could contain specific information about the service, including available endpoints, and swagger. It could advise about the running version of a service to an attacker. The attacker could also check if a service is running.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9802" + }, + { + "type": "WEB", + "url": "https://github.com/zowe/api-layer" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-10T08:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-vvj9-jphf-5vfh/GHSA-vvj9-jphf-5vfh.json b/advisories/unreviewed/2024/10/GHSA-vvj9-jphf-5vfh/GHSA-vvj9-jphf-5vfh.json index e907cf10476..5cbc382bc76 100644 --- a/advisories/unreviewed/2024/10/GHSA-vvj9-jphf-5vfh/GHSA-vvj9-jphf-5vfh.json +++ b/advisories/unreviewed/2024/10/GHSA-vvj9-jphf-5vfh/GHSA-vvj9-jphf-5vfh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vvj9-jphf-5vfh", - "modified": "2024-10-09T21:31:08Z", + "modified": "2024-10-10T09:30:34Z", "published": "2024-10-09T21:31:08Z", "aliases": [ "CVE-2024-38817"