From 3ed0d048f03aee216fe5c66d77c600dd01844aae Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 2 Apr 2024 21:31:54 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-hx32-x2cq-h45v.json | 184 +++++++++++++----- .../GHSA-v727-f437-6cxx.json | 10 +- .../GHSA-4jrv-6m77-vrhq.json | 6 +- .../GHSA-qghg-5fph-q28c.json | 10 +- .../GHSA-25m7-rwwf-46f2.json | 42 ++++ .../GHSA-272m-xfq8-pqmq.json | 42 ++++ .../GHSA-357g-wmh8-vqvv.json | 42 ++++ .../GHSA-48jr-p93f-pwq8.json | 35 ++++ .../GHSA-556x-fmjg-v3w5.json | 42 ++++ .../GHSA-6pg9-cqrm-937h.json | 39 ++++ .../GHSA-6vhq-r37j-h8vq.json | 42 ++++ .../GHSA-7hrm-fgp3-422w.json | 42 ++++ .../GHSA-7mg2-6c6v-342r.json | 42 ++++ .../GHSA-7x27-mx8q-ff2c.json | 42 ++++ .../GHSA-888h-wmgg-wjc5.json | 35 ++++ .../GHSA-8h7g-w668-v55p.json | 42 ++++ .../GHSA-952x-7vq8-xv8p.json | 42 ++++ .../GHSA-fchq-4vh7-vrjv.json | 42 ++++ .../GHSA-g2q5-v9x5-g9xj.json | 38 ++++ .../GHSA-g34p-p57q-2rj4.json | 42 ++++ .../GHSA-g4vh-vmfc-jcrf.json | 38 ++++ .../GHSA-g7xx-957c-2xf3.json | 42 ++++ .../GHSA-gg72-cpmw-5835.json | 42 ++++ .../GHSA-j94r-gh6r-5xfh.json | 38 ++++ .../GHSA-jc8q-7c32-pq7p.json | 42 ++++ .../GHSA-m4gc-r3fg-3xcp.json | 42 ++++ .../GHSA-m9px-xr79-8fvc.json | 35 ++++ .../GHSA-m9rh-84vr-cw29.json | 42 ++++ .../GHSA-mg68-hr9f-wgq7.json | 42 ++++ .../GHSA-mhc9-45rj-25x8.json | 42 ++++ .../GHSA-mqf4-449h-q42w.json | 42 ++++ .../GHSA-p9w6-32hm-c263.json | 42 ++++ .../GHSA-pgff-89w5-rmm7.json | 42 ++++ .../GHSA-px4j-3w3f-839r.json | 42 ++++ .../GHSA-qw73-xxm8-76ph.json | 42 ++++ .../GHSA-r5cm-g5wm-hw93.json | 42 ++++ .../GHSA-r5f3-9447-rj7j.json | 42 ++++ .../GHSA-r8c5-hw8w-c4c3.json | 42 ++++ .../GHSA-v7xc-2fvf-cc6x.json | 35 ++++ .../GHSA-v8fq-cjhv-q7hf.json | 42 ++++ .../GHSA-vhfj-f6qg-h3c7.json | 42 ++++ .../GHSA-w74v-5f39-6xgq.json | 42 ++++ .../GHSA-w85v-5m8p-r9r4.json | 42 ++++ .../GHSA-wq8w-p3f3-v5fm.json | 42 ++++ .../GHSA-xj9r-hfwq-rpc7.json | 42 ++++ .../GHSA-xr94-3hc5-534p.json | 42 ++++ 46 files changed, 1880 insertions(+), 51 deletions(-) create mode 100644 advisories/unreviewed/2024/04/GHSA-25m7-rwwf-46f2/GHSA-25m7-rwwf-46f2.json create mode 100644 advisories/unreviewed/2024/04/GHSA-272m-xfq8-pqmq/GHSA-272m-xfq8-pqmq.json create mode 100644 advisories/unreviewed/2024/04/GHSA-357g-wmh8-vqvv/GHSA-357g-wmh8-vqvv.json create mode 100644 advisories/unreviewed/2024/04/GHSA-48jr-p93f-pwq8/GHSA-48jr-p93f-pwq8.json create mode 100644 advisories/unreviewed/2024/04/GHSA-556x-fmjg-v3w5/GHSA-556x-fmjg-v3w5.json create mode 100644 advisories/unreviewed/2024/04/GHSA-6pg9-cqrm-937h/GHSA-6pg9-cqrm-937h.json create mode 100644 advisories/unreviewed/2024/04/GHSA-6vhq-r37j-h8vq/GHSA-6vhq-r37j-h8vq.json create mode 100644 advisories/unreviewed/2024/04/GHSA-7hrm-fgp3-422w/GHSA-7hrm-fgp3-422w.json create mode 100644 advisories/unreviewed/2024/04/GHSA-7mg2-6c6v-342r/GHSA-7mg2-6c6v-342r.json create mode 100644 advisories/unreviewed/2024/04/GHSA-7x27-mx8q-ff2c/GHSA-7x27-mx8q-ff2c.json create mode 100644 advisories/unreviewed/2024/04/GHSA-888h-wmgg-wjc5/GHSA-888h-wmgg-wjc5.json create mode 100644 advisories/unreviewed/2024/04/GHSA-8h7g-w668-v55p/GHSA-8h7g-w668-v55p.json create mode 100644 advisories/unreviewed/2024/04/GHSA-952x-7vq8-xv8p/GHSA-952x-7vq8-xv8p.json create mode 100644 advisories/unreviewed/2024/04/GHSA-fchq-4vh7-vrjv/GHSA-fchq-4vh7-vrjv.json create mode 100644 advisories/unreviewed/2024/04/GHSA-g2q5-v9x5-g9xj/GHSA-g2q5-v9x5-g9xj.json create mode 100644 advisories/unreviewed/2024/04/GHSA-g34p-p57q-2rj4/GHSA-g34p-p57q-2rj4.json create mode 100644 advisories/unreviewed/2024/04/GHSA-g4vh-vmfc-jcrf/GHSA-g4vh-vmfc-jcrf.json create mode 100644 advisories/unreviewed/2024/04/GHSA-g7xx-957c-2xf3/GHSA-g7xx-957c-2xf3.json create mode 100644 advisories/unreviewed/2024/04/GHSA-gg72-cpmw-5835/GHSA-gg72-cpmw-5835.json create mode 100644 advisories/unreviewed/2024/04/GHSA-j94r-gh6r-5xfh/GHSA-j94r-gh6r-5xfh.json create mode 100644 advisories/unreviewed/2024/04/GHSA-jc8q-7c32-pq7p/GHSA-jc8q-7c32-pq7p.json create mode 100644 advisories/unreviewed/2024/04/GHSA-m4gc-r3fg-3xcp/GHSA-m4gc-r3fg-3xcp.json create mode 100644 advisories/unreviewed/2024/04/GHSA-m9px-xr79-8fvc/GHSA-m9px-xr79-8fvc.json create mode 100644 advisories/unreviewed/2024/04/GHSA-m9rh-84vr-cw29/GHSA-m9rh-84vr-cw29.json create mode 100644 advisories/unreviewed/2024/04/GHSA-mg68-hr9f-wgq7/GHSA-mg68-hr9f-wgq7.json create mode 100644 advisories/unreviewed/2024/04/GHSA-mhc9-45rj-25x8/GHSA-mhc9-45rj-25x8.json create mode 100644 advisories/unreviewed/2024/04/GHSA-mqf4-449h-q42w/GHSA-mqf4-449h-q42w.json create mode 100644 advisories/unreviewed/2024/04/GHSA-p9w6-32hm-c263/GHSA-p9w6-32hm-c263.json create mode 100644 advisories/unreviewed/2024/04/GHSA-pgff-89w5-rmm7/GHSA-pgff-89w5-rmm7.json create mode 100644 advisories/unreviewed/2024/04/GHSA-px4j-3w3f-839r/GHSA-px4j-3w3f-839r.json create mode 100644 advisories/unreviewed/2024/04/GHSA-qw73-xxm8-76ph/GHSA-qw73-xxm8-76ph.json create mode 100644 advisories/unreviewed/2024/04/GHSA-r5cm-g5wm-hw93/GHSA-r5cm-g5wm-hw93.json create mode 100644 advisories/unreviewed/2024/04/GHSA-r5f3-9447-rj7j/GHSA-r5f3-9447-rj7j.json create mode 100644 advisories/unreviewed/2024/04/GHSA-r8c5-hw8w-c4c3/GHSA-r8c5-hw8w-c4c3.json create mode 100644 advisories/unreviewed/2024/04/GHSA-v7xc-2fvf-cc6x/GHSA-v7xc-2fvf-cc6x.json create mode 100644 advisories/unreviewed/2024/04/GHSA-v8fq-cjhv-q7hf/GHSA-v8fq-cjhv-q7hf.json create mode 100644 advisories/unreviewed/2024/04/GHSA-vhfj-f6qg-h3c7/GHSA-vhfj-f6qg-h3c7.json create mode 100644 advisories/unreviewed/2024/04/GHSA-w74v-5f39-6xgq/GHSA-w74v-5f39-6xgq.json create mode 100644 advisories/unreviewed/2024/04/GHSA-w85v-5m8p-r9r4/GHSA-w85v-5m8p-r9r4.json create mode 100644 advisories/unreviewed/2024/04/GHSA-wq8w-p3f3-v5fm/GHSA-wq8w-p3f3-v5fm.json create mode 100644 advisories/unreviewed/2024/04/GHSA-xj9r-hfwq-rpc7/GHSA-xj9r-hfwq-rpc7.json create mode 100644 advisories/unreviewed/2024/04/GHSA-xr94-3hc5-534p/GHSA-xr94-3hc5-534p.json diff --git a/advisories/unreviewed/2022/05/GHSA-hx32-x2cq-h45v/GHSA-hx32-x2cq-h45v.json b/advisories/unreviewed/2022/05/GHSA-hx32-x2cq-h45v/GHSA-hx32-x2cq-h45v.json index 8ad07fa6de6..5a70c5930e3 100644 --- a/advisories/unreviewed/2022/05/GHSA-hx32-x2cq-h45v/GHSA-hx32-x2cq-h45v.json +++ b/advisories/unreviewed/2022/05/GHSA-hx32-x2cq-h45v/GHSA-hx32-x2cq-h45v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hx32-x2cq-h45v", - "modified": "2022-05-13T01:09:53Z", + "modified": "2024-04-02T21:30:28Z", "published": "2022-05-13T01:09:53Z", "aliases": [ "CVE-2011-0419" @@ -20,43 +20,7 @@ }, { "type": "WEB", - "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14804" - }, - { - "type": "WEB", - "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14638" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75@%3Ccvs.httpd.apache.org%3E" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3Ccvs.httpd.apache.org%3E" - }, - { - "type": "WEB", - "url": "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3Ccvs.httpd.apache.org%3E" + "url": "https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E" }, { "type": "WEB", @@ -64,39 +28,83 @@ }, { "type": "WEB", - "url": "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d@%3Ccvs.httpd.apache.org%3E" + "url": "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E" }, { "type": "WEB", - "url": "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E" + "url": "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3Ccvs.httpd.apache.org%3E" }, { "type": "WEB", - "url": "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3Ccvs.httpd.apache.org%3E" + "url": "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E" }, { "type": "WEB", - "url": "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15@%3Ccvs.httpd.apache.org%3E" + "url": "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3Ccvs.httpd.apache.org%3E" }, { "type": "WEB", - "url": "https://lists.apache.org/thread.html/r064df0985779b7ee044d3120d71ba59750427cf53f57ba3384e3773f@%3Ccvs.httpd.apache.org%3E" + "url": "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E" }, { "type": "WEB", - "url": "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3Ccvs.httpd.apache.org%3E" + "url": "https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E" }, { "type": "WEB", - "url": "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E" + "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E" }, { "type": "WEB", - "url": "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E" + "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E" }, { "type": "WEB", - "url": "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3Ccvs.httpd.apache.org%3E" + "url": "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75%40%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/re2e23465bbdb17ffe109d21b4f192e6b58221cd7aa8797d530b4cd75@%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14638" + }, + { + "type": "WEB", + "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14804" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=703390" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E" }, { "type": "WEB", @@ -104,7 +112,75 @@ }, { "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=703390" + "url": "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/r064df0985779b7ee044d3120d71ba59750427cf53f57ba3384e3773f%40%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/r064df0985779b7ee044d3120d71ba59750427cf53f57ba3384e3773f@%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15%40%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/r1d201e3da31a2c8aa870c8314623caef7debd74a13d0f25205e26f15@%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d%40%3Ccvs.httpd.apache.org%3E" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread.html/r688df6f16f141e966a0a47f817e559312b3da27886f59116a94b273d@%3Ccvs.httpd.apache.org%3E" }, { "type": "WEB", @@ -206,6 +282,18 @@ "type": "WEB", "url": "http://www.debian.org/security/2011/dsa-2237" }, + { + "type": "WEB", + "url": "http://www.mail-archive.com/dev%40apr.apache.org/msg23960.html" + }, + { + "type": "WEB", + "url": "http://www.mail-archive.com/dev%40apr.apache.org/msg23961.html" + }, + { + "type": "WEB", + "url": "http://www.mail-archive.com/dev%40apr.apache.org/msg23976.html" + }, { "type": "WEB", "url": "http://www.mail-archive.com/dev@apr.apache.org/msg23960.html" diff --git a/advisories/unreviewed/2023/12/GHSA-v727-f437-6cxx/GHSA-v727-f437-6cxx.json b/advisories/unreviewed/2023/12/GHSA-v727-f437-6cxx/GHSA-v727-f437-6cxx.json index 7d01d55feb3..cf48f4b9da2 100644 --- a/advisories/unreviewed/2023/12/GHSA-v727-f437-6cxx/GHSA-v727-f437-6cxx.json +++ b/advisories/unreviewed/2023/12/GHSA-v727-f437-6cxx/GHSA-v727-f437-6cxx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-v727-f437-6cxx", - "modified": "2024-03-13T15:31:02Z", + "modified": "2024-04-02T21:30:27Z", "published": "2023-12-21T21:30:31Z", "aliases": [ "CVE-2023-6546" @@ -57,6 +57,14 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:1306" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1607" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1612" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2023-6546" diff --git a/advisories/unreviewed/2024/01/GHSA-4jrv-6m77-vrhq/GHSA-4jrv-6m77-vrhq.json b/advisories/unreviewed/2024/01/GHSA-4jrv-6m77-vrhq/GHSA-4jrv-6m77-vrhq.json index 03c97be5c99..fe403650558 100644 --- a/advisories/unreviewed/2024/01/GHSA-4jrv-6m77-vrhq/GHSA-4jrv-6m77-vrhq.json +++ b/advisories/unreviewed/2024/01/GHSA-4jrv-6m77-vrhq/GHSA-4jrv-6m77-vrhq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4jrv-6m77-vrhq", - "modified": "2024-03-27T06:30:31Z", + "modified": "2024-04-02T21:30:27Z", "published": "2024-01-15T21:30:24Z", "aliases": [ "CVE-2024-0565" @@ -37,6 +37,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:1533" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1607" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-0565" diff --git a/advisories/unreviewed/2024/01/GHSA-qghg-5fph-q28c/GHSA-qghg-5fph-q28c.json b/advisories/unreviewed/2024/01/GHSA-qghg-5fph-q28c/GHSA-qghg-5fph-q28c.json index ae6ff79f37d..95e8f553b48 100644 --- a/advisories/unreviewed/2024/01/GHSA-qghg-5fph-q28c/GHSA-qghg-5fph-q28c.json +++ b/advisories/unreviewed/2024/01/GHSA-qghg-5fph-q28c/GHSA-qghg-5fph-q28c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qghg-5fph-q28c", - "modified": "2024-03-08T06:30:31Z", + "modified": "2024-04-02T21:30:27Z", "published": "2024-01-31T06:30:17Z", "aliases": [ "CVE-2024-0914" @@ -25,6 +25,14 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:1239" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1411" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1608" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-0914" diff --git a/advisories/unreviewed/2024/04/GHSA-25m7-rwwf-46f2/GHSA-25m7-rwwf-46f2.json b/advisories/unreviewed/2024/04/GHSA-25m7-rwwf-46f2/GHSA-25m7-rwwf-46f2.json new file mode 100644 index 00000000000..640f3917a52 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-25m7-rwwf-46f2/GHSA-25m7-rwwf-46f2.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-25m7-rwwf-46f2", + "modified": "2024-04-02T21:30:27Z", + "published": "2024-04-02T21:30:27Z", + "aliases": [ + "CVE-2024-30340" + ], + "details": "Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Annotation objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22707.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30340" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-321" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T20:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-272m-xfq8-pqmq/GHSA-272m-xfq8-pqmq.json b/advisories/unreviewed/2024/04/GHSA-272m-xfq8-pqmq/GHSA-272m-xfq8-pqmq.json new file mode 100644 index 00000000000..f02c11ad9ab --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-272m-xfq8-pqmq/GHSA-272m-xfq8-pqmq.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-272m-xfq8-pqmq", + "modified": "2024-04-02T21:30:31Z", + "published": "2024-04-02T21:30:31Z", + "aliases": [ + "CVE-2024-30371" + ], + "details": "Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23355.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30371" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-346" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-357g-wmh8-vqvv/GHSA-357g-wmh8-vqvv.json b/advisories/unreviewed/2024/04/GHSA-357g-wmh8-vqvv/GHSA-357g-wmh8-vqvv.json new file mode 100644 index 00000000000..cf390928711 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-357g-wmh8-vqvv/GHSA-357g-wmh8-vqvv.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-357g-wmh8-vqvv", + "modified": "2024-04-02T21:30:29Z", + "published": "2024-04-02T21:30:29Z", + "aliases": [ + "CVE-2024-30344" + ], + "details": "Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Acroforms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22733.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30344" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-320" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-48jr-p93f-pwq8/GHSA-48jr-p93f-pwq8.json b/advisories/unreviewed/2024/04/GHSA-48jr-p93f-pwq8/GHSA-48jr-p93f-pwq8.json new file mode 100644 index 00000000000..663dbf10b86 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-48jr-p93f-pwq8/GHSA-48jr-p93f-pwq8.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-48jr-p93f-pwq8", + "modified": "2024-04-02T21:30:28Z", + "published": "2024-04-02T21:30:28Z", + "aliases": [ + "CVE-2024-27604" + ], + "details": "Alldata V0.4.6 is vulnerable to Command execution vulnerability. System commands can be deserialized.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27604" + }, + { + "type": "WEB", + "url": "https://gist.github.com/Raybye/b88847e9e9a94a1b1028dbdb7e38c12b" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-556x-fmjg-v3w5/GHSA-556x-fmjg-v3w5.json b/advisories/unreviewed/2024/04/GHSA-556x-fmjg-v3w5/GHSA-556x-fmjg-v3w5.json new file mode 100644 index 00000000000..5e38efdced6 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-556x-fmjg-v3w5/GHSA-556x-fmjg-v3w5.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-556x-fmjg-v3w5", + "modified": "2024-04-02T21:30:30Z", + "published": "2024-04-02T21:30:30Z", + "aliases": [ + "CVE-2024-30357" + ], + "details": "Foxit PDF Reader AcroForm Annotation Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Annotation objects in AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22818.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30357" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-331" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-843" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-6pg9-cqrm-937h/GHSA-6pg9-cqrm-937h.json b/advisories/unreviewed/2024/04/GHSA-6pg9-cqrm-937h/GHSA-6pg9-cqrm-937h.json new file mode 100644 index 00000000000..f294eff7bb9 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-6pg9-cqrm-937h/GHSA-6pg9-cqrm-937h.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6pg9-cqrm-937h", + "modified": "2024-04-02T21:30:29Z", + "published": "2024-04-02T21:30:29Z", + "aliases": [ + "CVE-2024-29432" + ], + "details": "Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29432" + }, + { + "type": "WEB", + "url": "https://gist.github.com/Raybye/4b377eb06b5f9c324f090d39a0d25c2b" + }, + { + "type": "WEB", + "url": "https://github.com/Raybye/alldata-bug/blob/main/alldata.md" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-6vhq-r37j-h8vq/GHSA-6vhq-r37j-h8vq.json b/advisories/unreviewed/2024/04/GHSA-6vhq-r37j-h8vq/GHSA-6vhq-r37j-h8vq.json new file mode 100644 index 00000000000..731abc6e514 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-6vhq-r37j-h8vq/GHSA-6vhq-r37j-h8vq.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6vhq-r37j-h8vq", + "modified": "2024-04-02T21:30:27Z", + "published": "2024-04-02T21:30:27Z", + "aliases": [ + "CVE-2024-30338" + ], + "details": "Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22705.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30338" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-319" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T20:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-7hrm-fgp3-422w/GHSA-7hrm-fgp3-422w.json b/advisories/unreviewed/2024/04/GHSA-7hrm-fgp3-422w/GHSA-7hrm-fgp3-422w.json new file mode 100644 index 00000000000..81c85c27f96 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-7hrm-fgp3-422w/GHSA-7hrm-fgp3-422w.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7hrm-fgp3-422w", + "modified": "2024-04-02T21:30:30Z", + "published": "2024-04-02T21:30:30Z", + "aliases": [ + "CVE-2024-30351" + ], + "details": "Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Doc objects in AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22799.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30351" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-328" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-7mg2-6c6v-342r/GHSA-7mg2-6c6v-342r.json b/advisories/unreviewed/2024/04/GHSA-7mg2-6c6v-342r/GHSA-7mg2-6c6v-342r.json new file mode 100644 index 00000000000..ff3e06810eb --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-7mg2-6c6v-342r/GHSA-7mg2-6c6v-342r.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7mg2-6c6v-342r", + "modified": "2024-04-02T21:30:27Z", + "published": "2024-04-02T21:30:27Z", + "aliases": [ + "CVE-2024-29834" + ], + "details": "This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. These management operations should be restricted to users with the tenant admin role or superuser role. An authenticated user with produce permission can create subscriptions and update subscription properties on partitioned topics, even though this should be limited to users with consume permissions. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be slightly different. Additionally, the vulnerability allows an authenticated user to read, create, modify, and delete namespace properties in any namespace in any tenant. In Pulsar, namespace properties are reserved for user provided metadata about the namespace.\n\nThis issue affects Apache Pulsar versions from 2.7.1 to 2.10.6, from 2.11.0 to 2.11.4, from 3.0.0 to 3.0.3, from 3.1.0 to 3.1.3, and from 3.2.0 to 3.2.1. \n\n3.0 Apache Pulsar users should upgrade to at least 3.0.4.\n3.1 and 3.2 Apache Pulsar users should upgrade to at least 3.2.2.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29834" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/v0ltl94k9lg28qfr1f54hpkvvsjc5bj5" + }, + { + "type": "WEB", + "url": "https://pulsar.apache.org/security/CVE-2024-29834" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T20:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-7x27-mx8q-ff2c/GHSA-7x27-mx8q-ff2c.json b/advisories/unreviewed/2024/04/GHSA-7x27-mx8q-ff2c/GHSA-7x27-mx8q-ff2c.json new file mode 100644 index 00000000000..76abdd2d989 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-7x27-mx8q-ff2c/GHSA-7x27-mx8q-ff2c.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7x27-mx8q-ff2c", + "modified": "2024-04-02T21:30:30Z", + "published": "2024-04-02T21:30:30Z", + "aliases": [ + "CVE-2024-30353" + ], + "details": "Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Doc objects in AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22807.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30353" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-334" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-888h-wmgg-wjc5/GHSA-888h-wmgg-wjc5.json b/advisories/unreviewed/2024/04/GHSA-888h-wmgg-wjc5/GHSA-888h-wmgg-wjc5.json new file mode 100644 index 00000000000..e9f9159eb86 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-888h-wmgg-wjc5/GHSA-888h-wmgg-wjc5.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-888h-wmgg-wjc5", + "modified": "2024-04-02T21:30:28Z", + "published": "2024-04-02T21:30:28Z", + "aliases": [ + "CVE-2024-27602" + ], + "details": "Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api/system/v2/api-docs module.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27602" + }, + { + "type": "WEB", + "url": "https://gist.github.com/Raybye/fee21f1a5b3a9ab54359818281478034" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-8h7g-w668-v55p/GHSA-8h7g-w668-v55p.json b/advisories/unreviewed/2024/04/GHSA-8h7g-w668-v55p/GHSA-8h7g-w668-v55p.json new file mode 100644 index 00000000000..415eb98aedc --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-8h7g-w668-v55p/GHSA-8h7g-w668-v55p.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8h7g-w668-v55p", + "modified": "2024-04-02T21:30:28Z", + "published": "2024-04-02T21:30:28Z", + "aliases": [ + "CVE-2024-30343" + ], + "details": "Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22721.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30343" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-316" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T20:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-952x-7vq8-xv8p/GHSA-952x-7vq8-xv8p.json b/advisories/unreviewed/2024/04/GHSA-952x-7vq8-xv8p/GHSA-952x-7vq8-xv8p.json new file mode 100644 index 00000000000..817c04e7c04 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-952x-7vq8-xv8p/GHSA-952x-7vq8-xv8p.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-952x-7vq8-xv8p", + "modified": "2024-04-02T21:30:30Z", + "published": "2024-04-02T21:30:30Z", + "aliases": [ + "CVE-2024-30354" + ], + "details": "Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Doc objects in AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22808.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30354" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-332" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-fchq-4vh7-vrjv/GHSA-fchq-4vh7-vrjv.json b/advisories/unreviewed/2024/04/GHSA-fchq-4vh7-vrjv/GHSA-fchq-4vh7-vrjv.json new file mode 100644 index 00000000000..8c79be6619a --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-fchq-4vh7-vrjv/GHSA-fchq-4vh7-vrjv.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fchq-4vh7-vrjv", + "modified": "2024-04-02T21:30:30Z", + "published": "2024-04-02T21:30:30Z", + "aliases": [ + "CVE-2024-30358" + ], + "details": "Foxit PDF Reader AcroForm User-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22821.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30358" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-330" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-g2q5-v9x5-g9xj/GHSA-g2q5-v9x5-g9xj.json b/advisories/unreviewed/2024/04/GHSA-g2q5-v9x5-g9xj/GHSA-g2q5-v9x5-g9xj.json new file mode 100644 index 00000000000..e8fdf4aa3df --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-g2q5-v9x5-g9xj/GHSA-g2q5-v9x5-g9xj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g2q5-v9x5-g9xj", + "modified": "2024-04-02T21:30:27Z", + "published": "2024-04-02T21:30:27Z", + "aliases": [ + "CVE-2024-30531" + ], + "details": "Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content.This issue affects Nelio Content: from n/a through 3.2.0.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30531" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/nelio-content/wordpress-nelio-content-best-editorial-calendar-social-media-scheduling-plugin-3-2-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T19:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-g34p-p57q-2rj4/GHSA-g34p-p57q-2rj4.json b/advisories/unreviewed/2024/04/GHSA-g34p-p57q-2rj4/GHSA-g34p-p57q-2rj4.json new file mode 100644 index 00000000000..cbbbf93c792 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-g34p-p57q-2rj4/GHSA-g34p-p57q-2rj4.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g34p-p57q-2rj4", + "modified": "2024-04-02T21:30:30Z", + "published": "2024-04-02T21:30:30Z", + "aliases": [ + "CVE-2024-30360" + ], + "details": "Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22797.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30360" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-340" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-g4vh-vmfc-jcrf/GHSA-g4vh-vmfc-jcrf.json b/advisories/unreviewed/2024/04/GHSA-g4vh-vmfc-jcrf/GHSA-g4vh-vmfc-jcrf.json new file mode 100644 index 00000000000..43478e0fb65 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-g4vh-vmfc-jcrf/GHSA-g4vh-vmfc-jcrf.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g4vh-vmfc-jcrf", + "modified": "2024-04-02T21:30:27Z", + "published": "2024-04-02T21:30:27Z", + "aliases": [ + "CVE-2024-24888" + ], + "details": "Server-Side Request Forgery (SSRF) vulnerability in Kadence WP Gutenberg Blocks by Kadence Blocks.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.2.25.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24888" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/kadence-blocks/wordpress-gutenberg-blocks-by-kadence-blocks-plugin-3-2-25-server-side-request-forgery-ssrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T19:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-g7xx-957c-2xf3/GHSA-g7xx-957c-2xf3.json b/advisories/unreviewed/2024/04/GHSA-g7xx-957c-2xf3/GHSA-g7xx-957c-2xf3.json new file mode 100644 index 00000000000..a0145b3d444 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-g7xx-957c-2xf3/GHSA-g7xx-957c-2xf3.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g7xx-957c-2xf3", + "modified": "2024-04-02T21:30:27Z", + "published": "2024-04-02T21:30:27Z", + "aliases": [ + "CVE-2024-30339" + ], + "details": "Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Acroforms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22706.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30339" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-317" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T20:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-gg72-cpmw-5835/GHSA-gg72-cpmw-5835.json b/advisories/unreviewed/2024/04/GHSA-gg72-cpmw-5835/GHSA-gg72-cpmw-5835.json new file mode 100644 index 00000000000..13407b8fca9 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-gg72-cpmw-5835/GHSA-gg72-cpmw-5835.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gg72-cpmw-5835", + "modified": "2024-04-02T21:30:28Z", + "published": "2024-04-02T21:30:28Z", + "aliases": [ + "CVE-2024-30342" + ], + "details": "Foxit PDF Reader Annotation Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22720.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30342" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-322" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T20:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-j94r-gh6r-5xfh/GHSA-j94r-gh6r-5xfh.json b/advisories/unreviewed/2024/04/GHSA-j94r-gh6r-5xfh/GHSA-j94r-gh6r-5xfh.json new file mode 100644 index 00000000000..83bcf9b5318 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-j94r-gh6r-5xfh/GHSA-j94r-gh6r-5xfh.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j94r-gh6r-5xfh", + "modified": "2024-04-02T21:30:27Z", + "published": "2024-04-02T21:30:27Z", + "aliases": [ + "CVE-2024-30532" + ], + "details": "Server-Side Request Forgery (SSRF) vulnerability in Builderall Team Builderall Builder for WordPress.This issue affects Builderall Builder for WordPress: from n/a through 2.0.1.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30532" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/builderall-cheetah-for-wp/wordpress-builderall-builder-for-wordpress-plugin-2-0-1-server-side-request-forgery-ssrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T19:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-jc8q-7c32-pq7p/GHSA-jc8q-7c32-pq7p.json b/advisories/unreviewed/2024/04/GHSA-jc8q-7c32-pq7p/GHSA-jc8q-7c32-pq7p.json new file mode 100644 index 00000000000..5aae9effe04 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-jc8q-7c32-pq7p/GHSA-jc8q-7c32-pq7p.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jc8q-7c32-pq7p", + "modified": "2024-04-02T21:30:28Z", + "published": "2024-04-02T21:30:27Z", + "aliases": [ + "CVE-2024-30341" + ], + "details": "Foxit PDF Reader Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Doc objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22709.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30341" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-315" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T20:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-m4gc-r3fg-3xcp/GHSA-m4gc-r3fg-3xcp.json b/advisories/unreviewed/2024/04/GHSA-m4gc-r3fg-3xcp/GHSA-m4gc-r3fg-3xcp.json new file mode 100644 index 00000000000..dd4d80127e9 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-m4gc-r3fg-3xcp/GHSA-m4gc-r3fg-3xcp.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m4gc-r3fg-3xcp", + "modified": "2024-04-02T21:30:29Z", + "published": "2024-04-02T21:30:29Z", + "aliases": [ + "CVE-2024-30347" + ], + "details": "Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22910.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30347" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-327" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-m9px-xr79-8fvc/GHSA-m9px-xr79-8fvc.json b/advisories/unreviewed/2024/04/GHSA-m9px-xr79-8fvc/GHSA-m9px-xr79-8fvc.json new file mode 100644 index 00000000000..ec958c27c28 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-m9px-xr79-8fvc/GHSA-m9px-xr79-8fvc.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m9px-xr79-8fvc", + "modified": "2024-04-02T21:30:29Z", + "published": "2024-04-02T21:30:29Z", + "aliases": [ + "CVE-2024-27605" + ], + "details": "Alldata V0.4.6 is vulnerable to Insecure Permissions. Using users (test) can query information about the users in the system.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27605" + }, + { + "type": "WEB", + "url": "https://gist.github.com/Raybye/f365c89115f80e81d209f2fca9490339" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-m9rh-84vr-cw29/GHSA-m9rh-84vr-cw29.json b/advisories/unreviewed/2024/04/GHSA-m9rh-84vr-cw29/GHSA-m9rh-84vr-cw29.json new file mode 100644 index 00000000000..d1eb073186e --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-m9rh-84vr-cw29/GHSA-m9rh-84vr-cw29.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m9rh-84vr-cw29", + "modified": "2024-04-02T21:30:30Z", + "published": "2024-04-02T21:30:30Z", + "aliases": [ + "CVE-2024-30363" + ], + "details": "Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-23008.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30363" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-342" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-mg68-hr9f-wgq7/GHSA-mg68-hr9f-wgq7.json b/advisories/unreviewed/2024/04/GHSA-mg68-hr9f-wgq7/GHSA-mg68-hr9f-wgq7.json new file mode 100644 index 00000000000..18bfe53aa61 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-mg68-hr9f-wgq7/GHSA-mg68-hr9f-wgq7.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mg68-hr9f-wgq7", + "modified": "2024-04-02T21:30:30Z", + "published": "2024-04-02T21:30:30Z", + "aliases": [ + "CVE-2024-30364" + ], + "details": "Foxit PDF Reader U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-23009.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30364" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-341" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-mhc9-45rj-25x8/GHSA-mhc9-45rj-25x8.json b/advisories/unreviewed/2024/04/GHSA-mhc9-45rj-25x8/GHSA-mhc9-45rj-25x8.json new file mode 100644 index 00000000000..6695797c960 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-mhc9-45rj-25x8/GHSA-mhc9-45rj-25x8.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mhc9-45rj-25x8", + "modified": "2024-04-02T21:30:30Z", + "published": "2024-04-02T21:30:30Z", + "aliases": [ + "CVE-2024-30359" + ], + "details": "Foxit PDF Reader AcroForm 3D Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of 3D objects in AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22888.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30359" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-329" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-mqf4-449h-q42w/GHSA-mqf4-449h-q42w.json b/advisories/unreviewed/2024/04/GHSA-mqf4-449h-q42w/GHSA-mqf4-449h-q42w.json new file mode 100644 index 00000000000..2212ddd1f0d --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-mqf4-449h-q42w/GHSA-mqf4-449h-q42w.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mqf4-449h-q42w", + "modified": "2024-04-02T21:30:29Z", + "published": "2024-04-02T21:30:29Z", + "aliases": [ + "CVE-2024-30350" + ], + "details": "Foxit PDF Reader Annotation Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Annotation objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22708.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30350" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-333" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-p9w6-32hm-c263/GHSA-p9w6-32hm-c263.json b/advisories/unreviewed/2024/04/GHSA-p9w6-32hm-c263/GHSA-p9w6-32hm-c263.json new file mode 100644 index 00000000000..f6897ec1fbe --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-p9w6-32hm-c263/GHSA-p9w6-32hm-c263.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p9w6-32hm-c263", + "modified": "2024-04-02T21:30:30Z", + "published": "2024-04-02T21:30:30Z", + "aliases": [ + "CVE-2024-30361" + ], + "details": "Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22877.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30361" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-338" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-pgff-89w5-rmm7/GHSA-pgff-89w5-rmm7.json b/advisories/unreviewed/2024/04/GHSA-pgff-89w5-rmm7/GHSA-pgff-89w5-rmm7.json new file mode 100644 index 00000000000..98ae3a2e13b --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-pgff-89w5-rmm7/GHSA-pgff-89w5-rmm7.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pgff-89w5-rmm7", + "modified": "2024-04-02T21:30:29Z", + "published": "2024-04-02T21:30:29Z", + "aliases": [ + "CVE-2024-30346" + ], + "details": "Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Doc objects in AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22745.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30346" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-324" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-px4j-3w3f-839r/GHSA-px4j-3w3f-839r.json b/advisories/unreviewed/2024/04/GHSA-px4j-3w3f-839r/GHSA-px4j-3w3f-839r.json new file mode 100644 index 00000000000..4c9b327cd5f --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-px4j-3w3f-839r/GHSA-px4j-3w3f-839r.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-px4j-3w3f-839r", + "modified": "2024-04-02T21:30:30Z", + "published": "2024-04-02T21:30:30Z", + "aliases": [ + "CVE-2024-30362" + ], + "details": "Foxit PDF Reader PDF File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of PDF files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22798.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30362" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-339" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-qw73-xxm8-76ph/GHSA-qw73-xxm8-76ph.json b/advisories/unreviewed/2024/04/GHSA-qw73-xxm8-76ph/GHSA-qw73-xxm8-76ph.json new file mode 100644 index 00000000000..1a8c918cf0a --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-qw73-xxm8-76ph/GHSA-qw73-xxm8-76ph.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qw73-xxm8-76ph", + "modified": "2024-04-02T21:30:29Z", + "published": "2024-04-02T21:30:29Z", + "aliases": [ + "CVE-2024-30348" + ], + "details": "Foxit PDF Reader U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22911.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30348" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-326" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-r5cm-g5wm-hw93/GHSA-r5cm-g5wm-hw93.json b/advisories/unreviewed/2024/04/GHSA-r5cm-g5wm-hw93/GHSA-r5cm-g5wm-hw93.json new file mode 100644 index 00000000000..83465338e0c --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-r5cm-g5wm-hw93/GHSA-r5cm-g5wm-hw93.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r5cm-g5wm-hw93", + "modified": "2024-04-02T21:30:30Z", + "published": "2024-04-02T21:30:30Z", + "aliases": [ + "CVE-2024-30356" + ], + "details": "Foxit PDF Reader AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Doc objects in AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-22811.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30356" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-336" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-r5f3-9447-rj7j/GHSA-r5f3-9447-rj7j.json b/advisories/unreviewed/2024/04/GHSA-r5f3-9447-rj7j/GHSA-r5f3-9447-rj7j.json new file mode 100644 index 00000000000..b1d9d22e1d3 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-r5f3-9447-rj7j/GHSA-r5f3-9447-rj7j.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r5f3-9447-rj7j", + "modified": "2024-04-02T21:30:30Z", + "published": "2024-04-02T21:30:30Z", + "aliases": [ + "CVE-2024-30355" + ], + "details": "Foxit PDF Reader AcroForm Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Doc objects in AcroForms. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22809.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30355" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-337" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-r8c5-hw8w-c4c3/GHSA-r8c5-hw8w-c4c3.json b/advisories/unreviewed/2024/04/GHSA-r8c5-hw8w-c4c3/GHSA-r8c5-hw8w-c4c3.json new file mode 100644 index 00000000000..c83cca17a77 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-r8c5-hw8w-c4c3/GHSA-r8c5-hw8w-c4c3.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r8c5-hw8w-c4c3", + "modified": "2024-04-02T21:30:29Z", + "published": "2024-04-02T21:30:29Z", + "aliases": [ + "CVE-2024-30349" + ], + "details": "Foxit PDF Reader U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of U3D files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22912.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30349" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-325" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-v7xc-2fvf-cc6x/GHSA-v7xc-2fvf-cc6x.json b/advisories/unreviewed/2024/04/GHSA-v7xc-2fvf-cc6x/GHSA-v7xc-2fvf-cc6x.json new file mode 100644 index 00000000000..1afa74cf221 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-v7xc-2fvf-cc6x/GHSA-v7xc-2fvf-cc6x.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v7xc-2fvf-cc6x", + "modified": "2024-04-02T21:30:28Z", + "published": "2024-04-02T21:30:28Z", + "aliases": [ + "CVE-2024-25075" + ], + "details": "An issue was discovered in Softing uaToolkit Embedded before 1.41.1. When a subscription with a very low MaxNotificationPerPublish parameter is created, a publish response is mishandled, leading to memory consumption. When that happens often enough, the device will be out of memory, i.e., a denial of service.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25075" + }, + { + "type": "WEB", + "url": "https://industrial.softing.com/fileadmin/psirt/downloads/2024/syt-2024-2.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-v8fq-cjhv-q7hf/GHSA-v8fq-cjhv-q7hf.json b/advisories/unreviewed/2024/04/GHSA-v8fq-cjhv-q7hf/GHSA-v8fq-cjhv-q7hf.json new file mode 100644 index 00000000000..bce6deae76f --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-v8fq-cjhv-q7hf/GHSA-v8fq-cjhv-q7hf.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v8fq-cjhv-q7hf", + "modified": "2024-04-02T21:30:31Z", + "published": "2024-04-02T21:30:31Z", + "aliases": [ + "CVE-2024-30367" + ], + "details": "Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-23013.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30367" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-345" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-vhfj-f6qg-h3c7/GHSA-vhfj-f6qg-h3c7.json b/advisories/unreviewed/2024/04/GHSA-vhfj-f6qg-h3c7/GHSA-vhfj-f6qg-h3c7.json new file mode 100644 index 00000000000..a2ed6994d72 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-vhfj-f6qg-h3c7/GHSA-vhfj-f6qg-h3c7.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vhfj-f6qg-h3c7", + "modified": "2024-04-02T21:30:29Z", + "published": "2024-04-02T21:30:29Z", + "aliases": [ + "CVE-2024-30345" + ], + "details": "Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Doc objects in AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22742.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30345" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-323" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-w74v-5f39-6xgq/GHSA-w74v-5f39-6xgq.json b/advisories/unreviewed/2024/04/GHSA-w74v-5f39-6xgq/GHSA-w74v-5f39-6xgq.json new file mode 100644 index 00000000000..55c1101da41 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-w74v-5f39-6xgq/GHSA-w74v-5f39-6xgq.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w74v-5f39-6xgq", + "modified": "2024-04-02T21:30:31Z", + "published": "2024-04-02T21:30:31Z", + "aliases": [ + "CVE-2024-30370" + ], + "details": "RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-Of-The-Web protection mechanism on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must perform a specific action on a malicious page.\n\nThe specific flaw exists within the archive extraction functionality. A crafted archive entry can cause the creation of an arbitrary file without the Mark-Of-The-Web. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current user. Was ZDI-CAN-23156.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30370" + }, + { + "type": "WEB", + "url": "https://www.rarlab.com/rarnew.htm#27.%20Busgs%20fixed" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-357" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-693" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-w85v-5m8p-r9r4/GHSA-w85v-5m8p-r9r4.json b/advisories/unreviewed/2024/04/GHSA-w85v-5m8p-r9r4/GHSA-w85v-5m8p-r9r4.json new file mode 100644 index 00000000000..4577d16cd78 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-w85v-5m8p-r9r4/GHSA-w85v-5m8p-r9r4.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w85v-5m8p-r9r4", + "modified": "2024-04-02T21:30:27Z", + "published": "2024-04-02T21:30:27Z", + "aliases": [ + "CVE-2024-30336" + ], + "details": "Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Doc objects in AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22642.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30336" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-303" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T20:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-wq8w-p3f3-v5fm/GHSA-wq8w-p3f3-v5fm.json b/advisories/unreviewed/2024/04/GHSA-wq8w-p3f3-v5fm/GHSA-wq8w-p3f3-v5fm.json new file mode 100644 index 00000000000..512c017a4cc --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-wq8w-p3f3-v5fm/GHSA-wq8w-p3f3-v5fm.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wq8w-p3f3-v5fm", + "modified": "2024-04-02T21:30:31Z", + "published": "2024-04-02T21:30:31Z", + "aliases": [ + "CVE-2024-30365" + ], + "details": "Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22947.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30365" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-343" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-xj9r-hfwq-rpc7/GHSA-xj9r-hfwq-rpc7.json b/advisories/unreviewed/2024/04/GHSA-xj9r-hfwq-rpc7/GHSA-xj9r-hfwq-rpc7.json new file mode 100644 index 00000000000..09742d4b687 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-xj9r-hfwq-rpc7/GHSA-xj9r-hfwq-rpc7.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xj9r-hfwq-rpc7", + "modified": "2024-04-02T21:30:27Z", + "published": "2024-04-02T21:30:27Z", + "aliases": [ + "CVE-2024-30337" + ], + "details": "Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Acroforms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22704.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30337" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-318" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T20:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-xr94-3hc5-534p/GHSA-xr94-3hc5-534p.json b/advisories/unreviewed/2024/04/GHSA-xr94-3hc5-534p/GHSA-xr94-3hc5-534p.json new file mode 100644 index 00000000000..d689b299c24 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-xr94-3hc5-534p/GHSA-xr94-3hc5-534p.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xr94-3hc5-534p", + "modified": "2024-04-02T21:30:30Z", + "published": "2024-04-02T21:30:30Z", + "aliases": [ + "CVE-2024-30352" + ], + "details": "Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of Doc objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22800.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30352" + }, + { + "type": "WEB", + "url": "https://www.foxit.com/support/security-bulletins.html" + }, + { + "type": "WEB", + "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-335" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T21:15:47Z" + } +} \ No newline at end of file