Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2025-02-12 21:33:23 +00:00
parent aaf2857f3d
commit 4bc15ba5ff
42 changed files with 736 additions and 45 deletions
@@ -1,19 +1,28 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4v96-m8xv-x83v",
-  "modified": "2022-05-24T22:28:12Z",
+  "modified": "2025-02-12T21:31:46Z",
  "published": "2022-05-24T22:28:12Z",
  "aliases": [
    "CVE-2021-26073"
  ],
  "details": "Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Express versions between 3.0.2 - 6.5.0 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26073"
    },
+    {
+      "type": "WEB",
+      "url": "https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-a%5B%E2%80%A6%5Dypass-of-app-qsh-verification-via-context-jwts/47072"
+    },
    {
      "type": "WEB",
      "url": "https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-a[…]ypass-of-app-qsh-verification-via-context-jwts/47072"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7w3v-7x22-4g8v",
-  "modified": "2025-02-07T18:31:03Z",
+  "modified": "2025-02-12T21:31:46Z",
  "published": "2022-05-24T22:28:24Z",
  "aliases": [
    "CVE-2021-36741"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-j3xh-c39x-qghw",
-  "modified": "2022-05-24T19:14:55Z",
+  "modified": "2025-02-12T21:31:46Z",
  "published": "2022-05-24T19:14:55Z",
  "aliases": [
    "CVE-2021-38406"
  ],
  "details": "Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-94"
+    ],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-jw8g-rg5r-2x5j",
-  "modified": "2023-04-13T18:30:30Z",
+  "modified": "2025-02-12T21:31:46Z",
  "published": "2023-04-07T03:30:18Z",
  "aliases": [
    "CVE-2023-25218"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-qc2w-qcmx-m375",
-  "modified": "2023-04-13T18:30:30Z",
+  "modified": "2025-02-12T21:31:46Z",
  "published": "2023-04-07T03:30:18Z",
  "aliases": [
    "CVE-2023-25220"
@@ -30,6 +30,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-121",
      "CWE-787"
    ],
    "severity": "HIGH",
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2q9p-5gw5-gr76",
-  "modified": "2024-02-21T09:31:00Z",
+  "modified": "2025-02-12T21:31:47Z",
  "published": "2024-02-20T09:30:32Z",
  "aliases": [
    "CVE-2024-25973"
  ],
-  "details": "The Frentix GmbH OpenOlat LMS is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities. An attacker with rights to create or edit groups can create a course with a name that contains an XSS payload. Furthermore, attackers with the permissions to create or rename a catalog (sub-category) can enter unfiltered input in the name field. In addition, attackers who are allowed to create curriculums can also enter unfiltered input in the name field. This allows an attacker to execute stored JavaScript code with the permissions of the victim in the context of the user's browser.\n\n",
-  "severity": [],
+  "details": "The Frentix GmbH OpenOlat LMS is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities. An attacker with rights to create or edit groups can create a course with a name that contains an XSS payload. Furthermore, attackers with the permissions to create or rename a catalog (sub-category) can enter unfiltered input in the name field. In addition, attackers who are allowed to create curriculums can also enter unfiltered input in the name field. This allows an attacker to execute stored JavaScript code with the permissions of the victim in the context of the user's browser.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -25,9 +30,10 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-20"
+      "CWE-20",
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-20T08:15:07Z"
@@ -1,12 +1,12 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3hwp-p2jw-j4xh",
-  "modified": "2024-02-20T15:31:06Z",
+  "modified": "2025-02-12T21:31:48Z",
  "published": "2024-02-20T15:31:06Z",
  "aliases": [
    "CVE-2024-1155"
  ],
-  "details": "Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access. \n",
+  "details": "Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access.",
  "severity": [
    {
      "type": "CVSS_V3",
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-276"
+      "CWE-276",
+      "CWE-863"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-42c4-hvg2-mp96",
-  "modified": "2024-02-26T18:30:31Z",
+  "modified": "2025-02-12T21:31:49Z",
  "published": "2024-02-26T18:30:31Z",
  "aliases": [
    "CVE-2024-24402"
  ],
  "details": "An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -21,7 +26,7 @@
  ],
  "database_specific": {
    "cwe_ids": [],
-    "severity": null,
+    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-26T17:15:10Z"
@@ -30,6 +30,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-125",
      "CWE-126"
    ],
    "severity": "MODERATE",
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-190"
+      "CWE-190",
+      "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -30,6 +30,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-125",
      "CWE-126"
    ],
    "severity": "MODERATE",
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-190"
+      "CWE-190",
+      "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-276"
+      "CWE-276",
+      "CWE-863"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-190"
+      "CWE-190",
+      "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-122"
+      "CWE-122",
+      "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -30,7 +30,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-122"
+      "CWE-122",
+      "CWE-787"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-mc8m-4r3w-q2hw",
-  "modified": "2024-02-20T06:30:29Z",
+  "modified": "2025-02-12T21:31:47Z",
  "published": "2024-02-20T06:30:29Z",
  "aliases": [
    "CVE-2022-45320"
  ],
  "details": "Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become the owner of a wiki page by editing the wiki page.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -21,7 +26,7 @@
  ],
  "database_specific": {
    "cwe_ids": [],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-20T05:15:07Z"
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-190"
+      "CWE-190",
+      "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
--- a/Show More
+++ b/Show More