From 5481242d4d5501d36ed0034628c0c6c8d85b2622 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 18 Oct 2024 21:33:45 +0000 Subject: [PATCH] Publish Advisories GHSA-34j4-xx25-wcxg GHSA-555v-hq3c-8hp4 GHSA-85cf-mfjv-5557 GHSA-9j6f-fvm4-55cm GHSA-fjpm-j8hw-f3cw GHSA-g4r7-cj36-63v3 GHSA-jj42-9w8m-9979 GHSA-qm34-9r78-66cq GHSA-rmf7-j7x8-47jw GHSA-xr59-q2m8-w439 --- .../GHSA-34j4-xx25-wcxg.json | 11 ++-- .../GHSA-555v-hq3c-8hp4.json | 43 ++++++++++++++ .../GHSA-85cf-mfjv-5557.json | 58 +++++++++++++++++++ .../GHSA-9j6f-fvm4-55cm.json | 54 +++++++++++++++++ .../GHSA-fjpm-j8hw-f3cw.json | 50 ++++++++++++++++ .../GHSA-g4r7-cj36-63v3.json | 11 ++-- .../GHSA-jj42-9w8m-9979.json | 11 ++-- .../GHSA-qm34-9r78-66cq.json | 8 ++- .../GHSA-rmf7-j7x8-47jw.json | 50 ++++++++++++++++ .../GHSA-xr59-q2m8-w439.json | 11 ++-- 10 files changed, 289 insertions(+), 18 deletions(-) create mode 100644 advisories/unreviewed/2024/10/GHSA-555v-hq3c-8hp4/GHSA-555v-hq3c-8hp4.json create mode 100644 advisories/unreviewed/2024/10/GHSA-85cf-mfjv-5557/GHSA-85cf-mfjv-5557.json create mode 100644 advisories/unreviewed/2024/10/GHSA-9j6f-fvm4-55cm/GHSA-9j6f-fvm4-55cm.json create mode 100644 advisories/unreviewed/2024/10/GHSA-fjpm-j8hw-f3cw/GHSA-fjpm-j8hw-f3cw.json create mode 100644 advisories/unreviewed/2024/10/GHSA-rmf7-j7x8-47jw/GHSA-rmf7-j7x8-47jw.json diff --git a/advisories/unreviewed/2024/10/GHSA-34j4-xx25-wcxg/GHSA-34j4-xx25-wcxg.json b/advisories/unreviewed/2024/10/GHSA-34j4-xx25-wcxg/GHSA-34j4-xx25-wcxg.json index 00e58a381cd..7cc9f479dc2 100644 --- a/advisories/unreviewed/2024/10/GHSA-34j4-xx25-wcxg/GHSA-34j4-xx25-wcxg.json +++ b/advisories/unreviewed/2024/10/GHSA-34j4-xx25-wcxg/GHSA-34j4-xx25-wcxg.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-34j4-xx25-wcxg", - "modified": "2024-10-18T00:31:16Z", + "modified": "2024-10-18T21:32:18Z", "published": "2024-10-18T00:31:16Z", "aliases": [ "CVE-2024-33453" ], "details": "Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-120" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-17T22:15:03Z" diff --git a/advisories/unreviewed/2024/10/GHSA-555v-hq3c-8hp4/GHSA-555v-hq3c-8hp4.json b/advisories/unreviewed/2024/10/GHSA-555v-hq3c-8hp4/GHSA-555v-hq3c-8hp4.json new file mode 100644 index 00000000000..fba4cbdf927 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-555v-hq3c-8hp4/GHSA-555v-hq3c-8hp4.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-555v-hq3c-8hp4", + "modified": "2024-10-18T21:32:18Z", + "published": "2024-10-18T21:32:18Z", + "aliases": [ + "CVE-2024-45944" + ], + "details": "In J2eeFAST <=2.7, the backend function has unsafe filtering, which allows an attacker to trigger certain sensitive functions resulting in arbitrary code execution.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45944" + }, + { + "type": "WEB", + "url": "https://gitee.com/dromara/J2EEFAST" + }, + { + "type": "WEB", + "url": "https://github.com/dromara/J2EEFAST" + }, + { + "type": "WEB", + "url": "https://github.com/lazy-forever/CVE-Reference/tree/main/2024/45944" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-18T19:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-85cf-mfjv-5557/GHSA-85cf-mfjv-5557.json b/advisories/unreviewed/2024/10/GHSA-85cf-mfjv-5557/GHSA-85cf-mfjv-5557.json new file mode 100644 index 00000000000..ede944ed472 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-85cf-mfjv-5557/GHSA-85cf-mfjv-5557.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-85cf-mfjv-5557", + "modified": "2024-10-18T21:32:18Z", + "published": "2024-10-18T21:32:18Z", + "aliases": [ + "CVE-2024-10123" + ], + "details": "A vulnerability was found in Tenda AC8 16.03.34.06. It has been declared as critical. Affected by this vulnerability is the function compare_parentcontrol_time of the file /goform/saveParentControlInfo. The manipulation of the argument time leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This is not the same issue like CVE-2023-33671. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10123" + }, + { + "type": "WEB", + "url": "https://github.com/JohenanLi/router_vuls/blob/main/ac8v4/compare_parentcontrol_time_vul.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.280915" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.280915" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.421340" + }, + { + "type": "WEB", + "url": "https://www.tenda.com.cn" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-121" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-18T20:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-9j6f-fvm4-55cm/GHSA-9j6f-fvm4-55cm.json b/advisories/unreviewed/2024/10/GHSA-9j6f-fvm4-55cm/GHSA-9j6f-fvm4-55cm.json new file mode 100644 index 00000000000..a508315120e --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-9j6f-fvm4-55cm/GHSA-9j6f-fvm4-55cm.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9j6f-fvm4-55cm", + "modified": "2024-10-18T21:32:18Z", + "published": "2024-10-18T21:32:18Z", + "aliases": [ + "CVE-2024-10121" + ], + "details": "A vulnerability was found in wfh45678 Radar up to 1.0.8 and classified as critical. This issue affects some unknown processing of the component Interface Handler. The manipulation with the input /../ leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This appears not to be a path traversal weakness. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10121" + }, + { + "type": "WEB", + "url": "https://github.com/weliveby/ForCVE/blob/main/radar%20Authentication%20bypass%20vulnerability.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.280913" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.280913" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.420960" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-639" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-18T19:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-fjpm-j8hw-f3cw/GHSA-fjpm-j8hw-f3cw.json b/advisories/unreviewed/2024/10/GHSA-fjpm-j8hw-f3cw/GHSA-fjpm-j8hw-f3cw.json new file mode 100644 index 00000000000..bc02f9a7426 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-fjpm-j8hw-f3cw/GHSA-fjpm-j8hw-f3cw.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fjpm-j8hw-f3cw", + "modified": "2024-10-18T21:32:18Z", + "published": "2024-10-18T21:32:18Z", + "aliases": [ + "CVE-2024-10122" + ], + "details": "A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been classified as problematic. Affected is an unknown function of the file /InnerRepPlus.html of the component Operator Details Form. The manipulation leads to missing password field masking. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10122" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.280914" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.280914" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.421292" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-549" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-18T19:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-g4r7-cj36-63v3/GHSA-g4r7-cj36-63v3.json b/advisories/unreviewed/2024/10/GHSA-g4r7-cj36-63v3/GHSA-g4r7-cj36-63v3.json index a3e2eda3bbe..adf37ce94a6 100644 --- a/advisories/unreviewed/2024/10/GHSA-g4r7-cj36-63v3/GHSA-g4r7-cj36-63v3.json +++ b/advisories/unreviewed/2024/10/GHSA-g4r7-cj36-63v3/GHSA-g4r7-cj36-63v3.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-g4r7-cj36-63v3", - "modified": "2024-10-18T00:31:16Z", + "modified": "2024-10-18T21:32:18Z", "published": "2024-10-18T00:31:16Z", "aliases": [ "CVE-2024-30875" ], "details": "Cross Site Scripting vulnerability in JavaScript Library jquery-ui v.1.13.1 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the window.addEventListener component.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-17T22:15:02Z" diff --git a/advisories/unreviewed/2024/10/GHSA-jj42-9w8m-9979/GHSA-jj42-9w8m-9979.json b/advisories/unreviewed/2024/10/GHSA-jj42-9w8m-9979/GHSA-jj42-9w8m-9979.json index 7823d208569..67ec68a99ce 100644 --- a/advisories/unreviewed/2024/10/GHSA-jj42-9w8m-9979/GHSA-jj42-9w8m-9979.json +++ b/advisories/unreviewed/2024/10/GHSA-jj42-9w8m-9979/GHSA-jj42-9w8m-9979.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-jj42-9w8m-9979", - "modified": "2024-10-18T00:31:15Z", + "modified": "2024-10-18T21:32:18Z", "published": "2024-10-18T00:31:15Z", "aliases": [ "CVE-2023-26785" ], "details": "MariaDB v10.5 was discovered to contain a remote code execution (RCE) vulnerability.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-17T22:15:02Z" diff --git a/advisories/unreviewed/2024/10/GHSA-qm34-9r78-66cq/GHSA-qm34-9r78-66cq.json b/advisories/unreviewed/2024/10/GHSA-qm34-9r78-66cq/GHSA-qm34-9r78-66cq.json index 1bb42c4fb56..b12d6efb5d9 100644 --- a/advisories/unreviewed/2024/10/GHSA-qm34-9r78-66cq/GHSA-qm34-9r78-66cq.json +++ b/advisories/unreviewed/2024/10/GHSA-qm34-9r78-66cq/GHSA-qm34-9r78-66cq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qm34-9r78-66cq", - "modified": "2024-10-18T15:31:20Z", + "modified": "2024-10-18T21:32:18Z", "published": "2024-10-18T15:31:20Z", "aliases": [ "CVE-2024-9537" @@ -29,6 +29,10 @@ "type": "WEB", "url": "https://arcticwolf.com/resources/blog/rackspace-breach-linked-to-zero-day-vulnerability-sciencelogic-sl1s-third-party-utility" }, + { + "type": "WEB", + "url": "https://community.sciencelogic.com/blog/latest-kb-articles-and-known-issues-blog-board/week-of-september-30-2024---latest-kb-articles-and-known-issues-part-1-of-2/1690" + }, { "type": "WEB", "url": "https://rackspace.service-now.com/system_status?id=detailed_status&service=4dafca5a87f41610568b206f8bbb35a6" @@ -56,7 +60,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-829" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/10/GHSA-rmf7-j7x8-47jw/GHSA-rmf7-j7x8-47jw.json b/advisories/unreviewed/2024/10/GHSA-rmf7-j7x8-47jw/GHSA-rmf7-j7x8-47jw.json new file mode 100644 index 00000000000..445292d0e1a --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-rmf7-j7x8-47jw/GHSA-rmf7-j7x8-47jw.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rmf7-j7x8-47jw", + "modified": "2024-10-18T21:32:18Z", + "published": "2024-10-18T21:32:18Z", + "aliases": [ + "CVE-2024-10128" + ], + "details": "A vulnerability was found in Topdata Inner Rep Plus WebServer 2.01. It has been rated as problematic. Affected by this issue is some unknown functionality of the file td.js.gz. The manipulation leads to risky cryptographic algorithm. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10128" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.280916" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.280916" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.422604" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-327" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-18T21:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-xr59-q2m8-w439/GHSA-xr59-q2m8-w439.json b/advisories/unreviewed/2024/10/GHSA-xr59-q2m8-w439/GHSA-xr59-q2m8-w439.json index 79421fb190b..541cd837437 100644 --- a/advisories/unreviewed/2024/10/GHSA-xr59-q2m8-w439/GHSA-xr59-q2m8-w439.json +++ b/advisories/unreviewed/2024/10/GHSA-xr59-q2m8-w439/GHSA-xr59-q2m8-w439.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-xr59-q2m8-w439", - "modified": "2024-10-18T00:31:15Z", + "modified": "2024-10-18T21:32:18Z", "published": "2024-10-18T00:31:15Z", "aliases": [ "CVE-2023-39593" ], "details": "Insecure permissions in the sys_exec function of Oracle MYSQL MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-17T22:15:02Z"