diff --git a/advisories/github-reviewed/2024/10/GHSA-586p-749j-fhwp/GHSA-586p-749j-fhwp.json b/advisories/github-reviewed/2024/10/GHSA-586p-749j-fhwp/GHSA-586p-749j-fhwp.json index 91edb85665b..3831dc1079a 100644 --- a/advisories/github-reviewed/2024/10/GHSA-586p-749j-fhwp/GHSA-586p-749j-fhwp.json +++ b/advisories/github-reviewed/2024/10/GHSA-586p-749j-fhwp/GHSA-586p-749j-fhwp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-586p-749j-fhwp", - "modified": "2024-11-06T21:30:54Z", + "modified": "2024-11-11T18:30:28Z", "published": "2024-10-09T15:32:21Z", "aliases": [ "CVE-2024-9675" @@ -50,51 +50,7 @@ }, { "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8563" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8675" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8679" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8686" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8690" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8703" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8707" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8708" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8709" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8846" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/security/cve/CVE-2024-9675" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317458" + "url": "https://pkg.go.dev/vuln/GO-2024-3186" }, { "type": "PACKAGE", @@ -102,7 +58,59 @@ }, { "type": "WEB", - "url": "https://pkg.go.dev/vuln/GO-2024-3186" + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317458" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-9675" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:9051" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8846" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8709" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8708" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8707" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8703" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8700" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8690" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8686" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8679" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8675" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8563" } ], "database_specific": { diff --git a/advisories/github-reviewed/2024/10/GHSA-fhqq-8f65-5xfc/GHSA-fhqq-8f65-5xfc.json b/advisories/github-reviewed/2024/10/GHSA-fhqq-8f65-5xfc/GHSA-fhqq-8f65-5xfc.json index 4d22063f3de..d2665e4987e 100644 --- a/advisories/github-reviewed/2024/10/GHSA-fhqq-8f65-5xfc/GHSA-fhqq-8f65-5xfc.json +++ b/advisories/github-reviewed/2024/10/GHSA-fhqq-8f65-5xfc/GHSA-fhqq-8f65-5xfc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-fhqq-8f65-5xfc", - "modified": "2024-11-05T09:30:37Z", + "modified": "2024-11-11T18:30:28Z", "published": "2024-10-01T21:31:35Z", "aliases": [ "CVE-2024-9407" @@ -165,6 +165,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:8846" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:9051" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-9407" diff --git a/advisories/unreviewed/2024/10/GHSA-wq2p-5pc6-wpgf/GHSA-wq2p-5pc6-wpgf.json b/advisories/unreviewed/2024/10/GHSA-wq2p-5pc6-wpgf/GHSA-wq2p-5pc6-wpgf.json index 49b7d80e46c..2714ce8dcf5 100644 --- a/advisories/unreviewed/2024/10/GHSA-wq2p-5pc6-wpgf/GHSA-wq2p-5pc6-wpgf.json +++ b/advisories/unreviewed/2024/10/GHSA-wq2p-5pc6-wpgf/GHSA-wq2p-5pc6-wpgf.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wq2p-5pc6-wpgf", - "modified": "2024-11-07T09:30:42Z", + "modified": "2024-11-11T18:30:28Z", "published": "2024-10-15T18:30:50Z", "aliases": [ "CVE-2024-9676" @@ -45,6 +45,14 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:8694" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8700" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:9051" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-9676" diff --git a/advisories/unreviewed/2024/11/GHSA-24w2-r4hx-q363/GHSA-24w2-r4hx-q363.json b/advisories/unreviewed/2024/11/GHSA-24w2-r4hx-q363/GHSA-24w2-r4hx-q363.json new file mode 100644 index 00000000000..04e70afffe5 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-24w2-r4hx-q363/GHSA-24w2-r4hx-q363.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-24w2-r4hx-q363", + "modified": "2024-11-11T18:30:28Z", + "published": "2024-11-11T18:30:28Z", + "aliases": [ + "CVE-2024-45088" + ], + "details": "IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45088" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7174818" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T16:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-48gc-vjjj-5rqw/GHSA-48gc-vjjj-5rqw.json b/advisories/unreviewed/2024/11/GHSA-48gc-vjjj-5rqw/GHSA-48gc-vjjj-5rqw.json new file mode 100644 index 00000000000..73ae564fe30 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-48gc-vjjj-5rqw/GHSA-48gc-vjjj-5rqw.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-48gc-vjjj-5rqw", + "modified": "2024-11-11T18:30:29Z", + "published": "2024-11-11T18:30:29Z", + "aliases": [ + "CVE-2024-11074" + ], + "details": "A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. This vulnerability affects unknown code of the file /incadd.php. The manipulation of the argument inccat/desc/date/amount leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter \"inccat\" to be affected. But it must be assumed \"desc\", \"date\", and \"amount\" are affected as well.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11074" + }, + { + "type": "WEB", + "url": "https://github.com/dimongshi/cve/issues/1" + }, + { + "type": "WEB", + "url": "https://itsourcecode.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283870" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283870" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.441174" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T18:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-492j-gvpg-m7v2/GHSA-492j-gvpg-m7v2.json b/advisories/unreviewed/2024/11/GHSA-492j-gvpg-m7v2/GHSA-492j-gvpg-m7v2.json new file mode 100644 index 00000000000..50ce8b561a6 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-492j-gvpg-m7v2/GHSA-492j-gvpg-m7v2.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-492j-gvpg-m7v2", + "modified": "2024-11-11T18:30:28Z", + "published": "2024-11-11T18:30:28Z", + "aliases": [ + "CVE-2024-10917" + ], + "details": "In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10917" + }, + { + "type": "WEB", + "url": "https://github.com/eclipse-openj9/openj9/pull/20362" + }, + { + "type": "WEB", + "url": "https://github.com/eclipse-openj9/openj9/releases/tag/openj9-0.48.0" + }, + { + "type": "WEB", + "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/47" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T17:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-8r46-fjj7-gr38/GHSA-8r46-fjj7-gr38.json b/advisories/unreviewed/2024/11/GHSA-8r46-fjj7-gr38/GHSA-8r46-fjj7-gr38.json new file mode 100644 index 00000000000..25737c1c2f2 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-8r46-fjj7-gr38/GHSA-8r46-fjj7-gr38.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8r46-fjj7-gr38", + "modified": "2024-11-11T18:30:29Z", + "published": "2024-11-11T18:30:28Z", + "aliases": [ + "CVE-2024-11073" + ], + "details": "A vulnerability classified as problematic has been found in SourceCodester Hospital Management System 1.0. This affects an unknown part of the file /vm/patient/delete-account.php. The manipulation of the argument id leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11073" + }, + { + "type": "WEB", + "url": "https://drive.google.com/file/d/1yFo0re8taTry7oR4-EDg3UHwO2lkqO9N/view?usp=sharing" + }, + { + "type": "WEB", + "url": "https://github.com/Salah-Tayeh/CVEs-and-Vulnerabilities/blob/main/Hospital%20Management%20System%20-%20IDOR%20Causing%20Deletion%20of%20any%20patient%20account.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283869" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283869" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.440799" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T17:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hjgc-jxjc-8v9j/GHSA-hjgc-jxjc-8v9j.json b/advisories/unreviewed/2024/11/GHSA-hjgc-jxjc-8v9j/GHSA-hjgc-jxjc-8v9j.json new file mode 100644 index 00000000000..9253ea1b764 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-hjgc-jxjc-8v9j/GHSA-hjgc-jxjc-8v9j.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hjgc-jxjc-8v9j", + "modified": "2024-11-11T18:30:28Z", + "published": "2024-11-11T18:30:28Z", + "aliases": [ + "CVE-2024-43439" + ], + "details": "A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43439" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304268" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=461209" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T16:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-mj36-fqcq-5fcp/GHSA-mj36-fqcq-5fcp.json b/advisories/unreviewed/2024/11/GHSA-mj36-fqcq-5fcp/GHSA-mj36-fqcq-5fcp.json new file mode 100644 index 00000000000..83b8884a53f --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-mj36-fqcq-5fcp/GHSA-mj36-fqcq-5fcp.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mj36-fqcq-5fcp", + "modified": "2024-11-11T18:30:29Z", + "published": "2024-11-11T18:30:29Z", + "aliases": [ + "CVE-2024-11076" + ], + "details": "A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown processing of the file /activation.php. The manipulation of the argument e_hash leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11076" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/UnrealdDei/cve/blob/main/sql2-rce.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283871" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283871" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.441182" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T18:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-xq42-m8jp-gxh3/GHSA-xq42-m8jp-gxh3.json b/advisories/unreviewed/2024/11/GHSA-xq42-m8jp-gxh3/GHSA-xq42-m8jp-gxh3.json new file mode 100644 index 00000000000..cccc89755d2 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-xq42-m8jp-gxh3/GHSA-xq42-m8jp-gxh3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xq42-m8jp-gxh3", + "modified": "2024-11-11T18:30:28Z", + "published": "2024-11-11T18:30:28Z", + "aliases": [ + "CVE-2024-45087" + ], + "details": "IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45087" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7175393" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T17:15:04Z" + } +} \ No newline at end of file