From 448176b6d580d0c3670c498f56d1f9badeec0aa3 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 17 Jun 2024 21:24:17 +0000 Subject: [PATCH] Publish Advisories GHSA-544r-fc65-v832 GHSA-hvxg-77mg-vrvp GHSA-hw2c-8xgw-mf57 GHSA-xgqm-wp7w-mgg2 --- .../GHSA-544r-fc65-v832.json | 42 ++++++++++++++++--- .../GHSA-hvxg-77mg-vrvp.json | 35 ++++++++++++++-- .../GHSA-hw2c-8xgw-mf57.json | 37 +++++++++++++--- .../GHSA-xgqm-wp7w-mgg2.json | 31 ++++++++++++-- 4 files changed, 126 insertions(+), 19 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/06/GHSA-544r-fc65-v832/GHSA-544r-fc65-v832.json (53%) rename advisories/{unreviewed => github-reviewed}/2024/06/GHSA-hvxg-77mg-vrvp/GHSA-hvxg-77mg-vrvp.json (55%) rename advisories/{unreviewed => github-reviewed}/2024/06/GHSA-hw2c-8xgw-mf57/GHSA-hw2c-8xgw-mf57.json (57%) rename advisories/{unreviewed => github-reviewed}/2024/06/GHSA-xgqm-wp7w-mgg2/GHSA-xgqm-wp7w-mgg2.json (55%) diff --git a/advisories/unreviewed/2024/06/GHSA-544r-fc65-v832/GHSA-544r-fc65-v832.json b/advisories/github-reviewed/2024/06/GHSA-544r-fc65-v832/GHSA-544r-fc65-v832.json similarity index 53% rename from advisories/unreviewed/2024/06/GHSA-544r-fc65-v832/GHSA-544r-fc65-v832.json rename to advisories/github-reviewed/2024/06/GHSA-544r-fc65-v832/GHSA-544r-fc65-v832.json index 2b8444f4541..54ce98327e9 100644 --- a/advisories/unreviewed/2024/06/GHSA-544r-fc65-v832/GHSA-544r-fc65-v832.json +++ b/advisories/github-reviewed/2024/06/GHSA-544r-fc65-v832/GHSA-544r-fc65-v832.json @@ -1,17 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-544r-fc65-v832", - "modified": "2024-06-14T12:30:50Z", + "modified": "2024-06-17T21:23:04Z", "published": "2024-06-14T12:30:50Z", "aliases": [ "CVE-2024-5685" ], + "summary": "Snipe-IT allows users to promote or demote themselves or other users", "details": "Users with \"User:edit\" and \"Self:api\" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "snipe/snipe-it" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.4.2" + } + ] + } + ] + } ], "references": [ { @@ -26,6 +52,10 @@ "type": "WEB", "url": "https://github.com/snipe/snipe-it/commit/34f1ea1c0ecd403047cd1327569ee391a7201cc1" }, + { + "type": "PACKAGE", + "url": "https://github.com/snipe/snipe-it" + }, { "type": "WEB", "url": "https://github.com/snipe/snipe-it/releases/tag/v6.4.2" @@ -35,9 +65,9 @@ "cwe_ids": [ "CWE-862" ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-06-17T21:23:04Z", "nvd_published_at": "2024-06-14T10:15:10Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-hvxg-77mg-vrvp/GHSA-hvxg-77mg-vrvp.json b/advisories/github-reviewed/2024/06/GHSA-hvxg-77mg-vrvp/GHSA-hvxg-77mg-vrvp.json similarity index 55% rename from advisories/unreviewed/2024/06/GHSA-hvxg-77mg-vrvp/GHSA-hvxg-77mg-vrvp.json rename to advisories/github-reviewed/2024/06/GHSA-hvxg-77mg-vrvp/GHSA-hvxg-77mg-vrvp.json index 30894e944b5..9dfe73fcf34 100644 --- a/advisories/unreviewed/2024/06/GHSA-hvxg-77mg-vrvp/GHSA-hvxg-77mg-vrvp.json +++ b/advisories/github-reviewed/2024/06/GHSA-hvxg-77mg-vrvp/GHSA-hvxg-77mg-vrvp.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-hvxg-77mg-vrvp", - "modified": "2024-06-14T09:31:17Z", + "modified": "2024-06-17T21:23:17Z", "published": "2024-06-14T09:31:17Z", "aliases": [ "CVE-2024-37182" ], + "summary": "Mattermost Desktop App Remote Code Execution", "details": "Mattermost Desktop App versions <=5.7.0 fail to correctly prompt for permission when opening external URLs which allows a remote attacker to force a victim over the Internet to run arbitrary programs on the victim's system via custom URI schemes.", "severity": [ { @@ -14,13 +15,39 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "mattermost-desktop" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.8.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37182" }, + { + "type": "WEB", + "url": "https://github.com/mattermost/desktop/commit/1c9fc719dc2b74495a05f7ebc90e92e7daa03e6d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/desktop" + }, { "type": "WEB", "url": "https://mattermost.com/security-updates" @@ -31,8 +58,8 @@ "CWE-693" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-06-17T21:23:17Z", "nvd_published_at": "2024-06-14T09:15:10Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-hw2c-8xgw-mf57/GHSA-hw2c-8xgw-mf57.json b/advisories/github-reviewed/2024/06/GHSA-hw2c-8xgw-mf57/GHSA-hw2c-8xgw-mf57.json similarity index 57% rename from advisories/unreviewed/2024/06/GHSA-hw2c-8xgw-mf57/GHSA-hw2c-8xgw-mf57.json rename to advisories/github-reviewed/2024/06/GHSA-hw2c-8xgw-mf57/GHSA-hw2c-8xgw-mf57.json index 1b3896b02de..f1ae3166af0 100644 --- a/advisories/unreviewed/2024/06/GHSA-hw2c-8xgw-mf57/GHSA-hw2c-8xgw-mf57.json +++ b/advisories/github-reviewed/2024/06/GHSA-hw2c-8xgw-mf57/GHSA-hw2c-8xgw-mf57.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-hw2c-8xgw-mf57", - "modified": "2024-06-16T15:30:44Z", + "modified": "2024-06-17T21:22:07Z", "published": "2024-06-16T15:30:44Z", "aliases": [ "CVE-2024-38460" ], + "summary": "SonarQube logs sensitive information", "details": "In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs, etc).", "severity": [ { @@ -14,17 +15,43 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "org.sonarsource.sonarqube:sonar-web" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "9.9.4" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38460" }, + { + "type": "WEB", + "url": "https://github.com/SonarSource/sonarqube/commit/48f43d6a3bf9bbd7c9b58eb5cde635572184ad01" + }, { "type": "WEB", "url": "https://community.sonarsource.com/t/sonarqube-ce-10-3-0-leaking-encrypted-values-in-web-server-logs/108187" }, + { + "type": "PACKAGE", + "url": "https://github.com/SonarSource/sonarqube" + }, { "type": "WEB", "url": "https://sonarsource.atlassian.net/browse/SONAR-21559" @@ -32,11 +59,11 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-532" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-06-17T21:22:06Z", "nvd_published_at": "2024-06-16T15:15:51Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-xgqm-wp7w-mgg2/GHSA-xgqm-wp7w-mgg2.json b/advisories/github-reviewed/2024/06/GHSA-xgqm-wp7w-mgg2/GHSA-xgqm-wp7w-mgg2.json similarity index 55% rename from advisories/unreviewed/2024/06/GHSA-xgqm-wp7w-mgg2/GHSA-xgqm-wp7w-mgg2.json rename to advisories/github-reviewed/2024/06/GHSA-xgqm-wp7w-mgg2/GHSA-xgqm-wp7w-mgg2.json index bd9dd071e44..56728944c92 100644 --- a/advisories/unreviewed/2024/06/GHSA-xgqm-wp7w-mgg2/GHSA-xgqm-wp7w-mgg2.json +++ b/advisories/github-reviewed/2024/06/GHSA-xgqm-wp7w-mgg2/GHSA-xgqm-wp7w-mgg2.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-xgqm-wp7w-mgg2", - "modified": "2024-06-14T09:31:17Z", + "modified": "2024-06-17T21:23:49Z", "published": "2024-06-14T09:31:17Z", "aliases": [ "CVE-2024-36287" ], + "summary": "Mattermost Desktop App allows for bypassing TCC restrictions on macOS", "details": "Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.", "severity": [ { @@ -14,13 +15,35 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "npm", + "name": "mattermost-desktop" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.8.0" + } + ] + } + ] + } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36287" }, + { + "type": "PACKAGE", + "url": "https://github.com/mattermost/desktop" + }, { "type": "WEB", "url": "https://mattermost.com/security-updates" @@ -31,8 +54,8 @@ "CWE-693" ], "severity": "LOW", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-06-17T21:23:49Z", "nvd_published_at": "2024-06-14T09:15:09Z" } } \ No newline at end of file