Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-09-20 18:33:48 +00:00
parent 5f6c1a9ba5
commit 47fe49f2b7
46 changed files with 649 additions and 86 deletions
@@ -32,6 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-291",
      "CWE-345",
      "CWE-348"
    ],
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-269"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-p4hf-76x7-9vqg",
-  "modified": "2024-04-04T08:01:32Z",
+  "modified": "2024-09-20T18:32:23Z",
  "published": "2023-10-03T00:30:26Z",
  "aliases": [
    "CVE-2023-28372"
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-284"
    ],
    "severity": "LOW",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-269h-hc79-qjpf",
-  "modified": "2023-12-06T21:30:57Z",
+  "modified": "2024-09-20T18:32:23Z",
  "published": "2023-12-01T00:31:01Z",
  "aliases": [
    "CVE-2023-46389"
@@ -21,6 +21,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46389"
    },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01"
+    },
    {
      "type": "WEB",
      "url": "https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3h9p-fmw3-6wpv",
-  "modified": "2023-12-06T21:30:57Z",
+  "modified": "2024-09-20T18:32:23Z",
  "published": "2023-12-01T00:31:00Z",
  "aliases": [
    "CVE-2023-46386"
@@ -21,6 +21,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46386"
    },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01"
+    },
    {
      "type": "WEB",
      "url": "https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-74f3-25qj-395v",
-  "modified": "2023-12-06T21:30:57Z",
+  "modified": "2024-09-20T18:32:23Z",
  "published": "2023-12-01T00:31:00Z",
  "aliases": [
    "CVE-2023-46387"
@@ -21,6 +21,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46387"
    },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01"
+    },
    {
      "type": "WEB",
      "url": "https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-85qr-ggvx-pgjx",
-  "modified": "2023-12-06T21:30:57Z",
+  "modified": "2024-09-20T18:32:23Z",
  "published": "2023-12-01T00:31:00Z",
  "aliases": [
    "CVE-2023-46383"
@@ -29,6 +29,10 @@
      "type": "WEB",
      "url": "https://seclists.org/fulldisclosure/2023/Nov/6"
    },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01"
+    },
    {
      "type": "WEB",
      "url": "https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9vjx-qhgp-wfvm",
-  "modified": "2023-12-06T21:30:57Z",
+  "modified": "2024-09-20T18:32:23Z",
  "published": "2023-12-01T00:31:00Z",
  "aliases": [
    "CVE-2023-46384"
@@ -29,6 +29,10 @@
      "type": "WEB",
      "url": "https://seclists.org/fulldisclosure/2023/Nov/6"
    },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01"
+    },
    {
      "type": "WEB",
      "url": "https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-w8fp-3787-pwgj",
-  "modified": "2023-12-06T21:30:57Z",
+  "modified": "2024-09-20T18:32:23Z",
  "published": "2023-12-01T00:31:00Z",
  "aliases": [
    "CVE-2023-46388"
@@ -21,6 +21,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46388"
    },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01"
+    },
    {
      "type": "WEB",
      "url": "https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-whp9-r49x-695c",
-  "modified": "2023-12-06T21:30:57Z",
+  "modified": "2024-09-20T18:32:23Z",
  "published": "2023-12-01T00:31:00Z",
  "aliases": [
    "CVE-2023-46385"
@@ -29,6 +29,10 @@
      "type": "WEB",
      "url": "https://seclists.org/fulldisclosure/2023/Nov/6"
    },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-247-01"
+    },
    {
      "type": "WEB",
      "url": "https://www.txone.com/blog/ten-unpatched-vulnerabilities-in-building-automation-products-identified-by-txone-networks"
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-312"
+      "CWE-312",
+      "CWE-327"
    ],
    "severity": "LOW",
    "github_reviewed": false,
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3qp4-gg3j-84xj",
+  "modified": "2024-09-20T18:32:26Z",
+  "published": "2024-09-20T18:32:26Z",
+  "aliases": [
+    "CVE-2024-9038"
+  ],
+  "details": "A vulnerability classified as problematic was found in Codezips Online Shopping Portal 1.0. Affected by this vulnerability is an unknown functionality of the file insert-product.php. The manipulation of the argument productimage1/productimage2/productimage3 leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9038"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/L1OudFd8cl09/CVE/blob/main/20_09_2024_b.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.278209"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.278209"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.411466"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-434"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-20T16:15:05Z"
+  }
+}
@@ -0,0 +1,47 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4vcr-9h4j-55f8",
+  "modified": "2024-09-20T18:32:26Z",
+  "published": "2024-09-20T18:32:26Z",
+  "aliases": [
+    "CVE-2024-37879"
+  ],
+  "details": "Improper input validation in /admin/config/save in User-friendly SVN (USVN) before v1.0.12 and below allows administrators to execute arbitrary code via the fields \"siteTitle\", \"siteIco\" and \"siteLogo\".",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37879"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/usvn/usvn/commit/6b4678954fca9635154743b95ff9c8947cf5f46f"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/usvn/usvn/releases/tag/1.0.12"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.usvn.info/2024/06/09/usvn-1.0.12"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.usvn.info/news.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-20T17:15:14Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7486-6g6r-5cxf",
+  "modified": "2024-09-20T18:32:27Z",
+  "published": "2024-09-20T18:32:27Z",
+  "aliases": [
+    "CVE-2024-42697"
+  ],
+  "details": "Cross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary code via the q parameter of the product search function.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42697"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/JustDinooo/CVEs/blob/main/CVE-2024-42697/poc.txt"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-20T18:15:04Z"
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-786c-r55j-68wj",
-  "modified": "2024-09-18T09:30:38Z",
+  "modified": "2024-09-20T18:32:26Z",
  "published": "2024-09-18T09:30:38Z",
  "aliases": [
    "CVE-2024-46801"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibfs: fix get_stashed_dentry()\n\nget_stashed_dentry() tries to optimistically retrieve a stashed dentry\nfrom a provided location.  It needs to ensure to hold rcu lock before it\ndereference the stashed location to prevent UAF issues.  Use\nrcu_dereference() instead of READ_ONCE() it's effectively equivalent\nwith some lockdep bells and whistles and it communicates clearly that\nthis expects rcu protection.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -31,7 +34,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-18T08:15:06Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7ccw-f88q-2crh",
-  "modified": "2024-09-18T09:30:35Z",
+  "modified": "2024-09-20T18:32:25Z",
  "published": "2024-09-18T09:30:35Z",
  "aliases": [
    "CVE-2024-46719"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: typec: ucsi: Fix null pointer dereference in trace\n\nucsi_register_altmode checks IS_ERR for the alt pointer and treats\nNULL as valid. When CONFIG_TYPEC_DP_ALTMODE is not enabled,\nucsi_register_displayport returns NULL which causes a NULL pointer\ndereference in trace. Rather than return NULL, call\ntypec_port_register_altmode to register DisplayPort alternate mode\nas a non-controllable mode when CONFIG_TYPEC_DP_ALTMODE is not enabled.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -49,9 +52,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-476"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-18T07:15:03Z"
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-284"
+      "CWE-284",
+      "CWE-639"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -0,0 +1,43 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7xv2-675g-4wq2",
+  "modified": "2024-09-20T18:32:26Z",
+  "published": "2024-09-20T18:32:26Z",
+  "aliases": [
+    "CVE-2023-47480"
+  ],
+  "details": "An issue in Pure Data 0.54-0 and fixed in 0.54-1 allows a local attacker to escalate privileges via the set*id () function.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47480"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pure-data/pure-data/issues/2063"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pure-data/pure-data/commit/0b5e467b8728b3ed56e1a8ee5b367ce78e7e6e5d"
+    },
+    {
+      "type": "WEB",
+      "url": "https://puredata.info"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-20T17:15:14Z"
+  }
+}
--- a/Show More
+++ b/Show More