netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-34j4-xx25-wcxg
GHSA-555v-hq3c-8hp4
GHSA-85cf-mfjv-5557
GHSA-9j6f-fvm4-55cm
GHSA-fjpm-j8hw-f3cw
GHSA-g4r7-cj36-63v3
GHSA-jj42-9w8m-9979
GHSA-qm34-9r78-66cq
GHSA-rmf7-j7x8-47jw
GHSA-xr59-q2m8-w439
This commit is contained in:
advisory-database[bot]
2024-10-18 21:33:45 +00:00
parent 4da289333f
commit 5481242d4d
10 changed files with 289 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/10/GHSA-34j4-xx25-wcxg/GHSA-34j4-xx25-wcxg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-34j4-xx25-wcxg",
"modified": "2024-10-18T00:31:16Z",
"modified": "2024-10-18T21:32:18Z",
"published": "2024-10-18T00:31:16Z",
"aliases": [
"CVE-2024-33453"
],
"details": "Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-120"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-17T22:15:03Z"
advisories/unreviewed/2024/10/GHSA-555v-hq3c-8hp4/GHSA-555v-hq3c-8hp4.json
+43
View File
@@ -0,0 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-555v-hq3c-8hp4",
"modified": "2024-10-18T21:32:18Z",
"published": "2024-10-18T21:32:18Z",
"aliases": [
"CVE-2024-45944"
],
"details": "In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execution.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45944"
},
{
"type": "WEB",
"url": "https://gitee.com/dromara/J2EEFAST"
},
{
"type": "WEB",
"url": "https://github.com/dromara/J2EEFAST"
},
{
"type": "WEB",
"url": "https://github.com/lazy-forever/CVE-Reference/tree/main/2024/45944"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-18T19:15:14Z"
}
}
advisories/unreviewed/2024/10/GHSA-85cf-mfjv-5557/GHSA-85cf-mfjv-5557.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-85cf-mfjv-5557",
"modified": "2024-10-18T21:32:18Z",
"published": "2024-10-18T21:32:18Z",
"aliases": [
"CVE-2024-10123"
],
"details": "A vulnerability was found in Tenda AC8 16.03.34.06. It has been declared as critical. Affected by this vulnerability is the function compare_parentcontrol_time of the file /goform/saveParentControlInfo. The manipulation of the argument time leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This is not the same issue like CVE-2023-33671. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10123"
},
{
"type": "WEB",
"url": "https://github.com/JohenanLi/router_vuls/blob/main/ac8v4/compare_parentcontrol_time_vul.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.280915"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.280915"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.421340"
},
{
"type": "WEB",
"url": "https://www.tenda.com.cn"
}
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-18T20:15:02Z"
}
}
advisories/unreviewed/2024/10/GHSA-9j6f-fvm4-55cm/GHSA-9j6f-fvm4-55cm.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9j6f-fvm4-55cm",
"modified": "2024-10-18T21:32:18Z",
"published": "2024-10-18T21:32:18Z",
"aliases": [
"CVE-2024-10121"
],
"details": "A vulnerability was found in wfh45678 Radar up to 1.0.8 and classified as critical. This issue affects some unknown processing of the component Interface Handler. The manipulation with the input /../ leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This appears not to be a path traversal weakness. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10121"
},
{
"type": "WEB",
"url": "https://github.com/weliveby/ForCVE/blob/main/radar%20Authentication%20bypass%20vulnerability.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.280913"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.280913"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.420960"
}
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-18T19:15:13Z"
}
}
advisories/unreviewed/2024/10/GHSA-fjpm-j8hw-f3cw/GHSA-fjpm-j8hw-f3cw.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fjpm-j8hw-f3cw",
"modified": "2024-10-18T21:32:18Z",
"published": "2024-10-18T21:32:18Z",
"aliases": [
"CVE-2024-10122"
],
"details": "A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been classified as problematic. Affected is an unknown function of the file /InnerRepPlus.html of the component Operator Details Form. The manipulation leads to missing password field masking. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10122"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.280914"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.280914"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.421292"
}
],
"database_specific": {
"cwe_ids": [
"CWE-549"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-18T19:15:13Z"
}
}
advisories/unreviewed/2024/10/GHSA-g4r7-cj36-63v3/GHSA-g4r7-cj36-63v3.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g4r7-cj36-63v3",
"modified": "2024-10-18T00:31:16Z",
"modified": "2024-10-18T21:32:18Z",
"published": "2024-10-18T00:31:16Z",
"aliases": [
"CVE-2024-30875"
],
"details": "Cross Site Scripting vulnerability in JavaScript Library jquery-ui v.1.13.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the window.addEventListener component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-17T22:15:02Z"
advisories/unreviewed/2024/10/GHSA-jj42-9w8m-9979/GHSA-jj42-9w8m-9979.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jj42-9w8m-9979",
"modified": "2024-10-18T00:31:15Z",
"modified": "2024-10-18T21:32:18Z",
"published": "2024-10-18T00:31:15Z",
"aliases": [
"CVE-2023-26785"
],
"details": "MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-17T22:15:02Z"
advisories/unreviewed/2024/10/GHSA-qm34-9r78-66cq/GHSA-qm34-9r78-66cq.json
+6 -2
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qm34-9r78-66cq",
"modified": "2024-10-18T15:31:20Z",
"modified": "2024-10-18T21:32:18Z",
"published": "2024-10-18T15:31:20Z",
"aliases": [
"CVE-2024-9537"
@@ -29,6 +29,10 @@
"type": "WEB",
"url": "https://arcticwolf.com/resources/blog/rackspace-breach-linked-to-zero-day-vulnerability-sciencelogic-sl1s-third-party-utility"
},
{
"type": "WEB",
"url": "https://community.sciencelogic.com/blog/latest-kb-articles-and-known-issues-blog-board/week-of-september-30-2024---latest-kb-articles-and-known-issues-part-1-of-2/1690"
},
{
"type": "WEB",
"url": "https://rackspace.service-now.com/system_status?id=detailed_status&service=4dafca5a87f41610568b206f8bbb35a6"
@@ -56,7 +60,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-829"
],
"severity": "CRITICAL",
"github_reviewed": false,
advisories/unreviewed/2024/10/GHSA-rmf7-j7x8-47jw/GHSA-rmf7-j7x8-47jw.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rmf7-j7x8-47jw",
"modified": "2024-10-18T21:32:18Z",
"published": "2024-10-18T21:32:18Z",
"aliases": [
"CVE-2024-10128"
],
"details": "A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been rated as problematic. Affected by this issue is some unknown functionality of the file td.js.gz. The manipulation leads to risky cryptographic algorithm. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10128"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.280916"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.280916"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.422604"
}
],
"database_specific": {
"cwe_ids": [
"CWE-327"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-18T21:15:03Z"
}
}
advisories/unreviewed/2024/10/GHSA-xr59-q2m8-w439/GHSA-xr59-q2m8-w439.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xr59-q2m8-w439",
"modified": "2024-10-18T00:31:15Z",
"modified": "2024-10-18T21:32:18Z",
"published": "2024-10-18T00:31:15Z",
"aliases": [
"CVE-2023-39593"
],
"details": "Insecure permissions in the sys_exec function of Oracle MYSQL MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-17T22:15:02Z"