From 5a5a48d49e3f0f73808c86b97e34ec0db392fd3b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 11 Nov 2024 18:31:34 +0000 Subject: [PATCH] Publish Advisories GHSA-586p-749j-fhwp GHSA-fhqq-8f65-5xfc GHSA-wq2p-5pc6-wpgf GHSA-24w2-r4hx-q363 GHSA-48gc-vjjj-5rqw GHSA-492j-gvpg-m7v2 GHSA-8r46-fjj7-gr38 GHSA-hjgc-jxjc-8v9j GHSA-mj36-fqcq-5fcp GHSA-xq42-m8jp-gxh3 --- .../GHSA-586p-749j-fhwp.json | 102 ++++++++++-------- .../GHSA-fhqq-8f65-5xfc.json | 6 +- .../GHSA-wq2p-5pc6-wpgf.json | 10 +- .../GHSA-24w2-r4hx-q363.json | 38 +++++++ .../GHSA-48gc-vjjj-5rqw.json | 58 ++++++++++ .../GHSA-492j-gvpg-m7v2.json | 46 ++++++++ .../GHSA-8r46-fjj7-gr38.json | 62 +++++++++++ .../GHSA-hjgc-jxjc-8v9j.json | 42 ++++++++ .../GHSA-mj36-fqcq-5fcp.json | 58 ++++++++++ .../GHSA-xq42-m8jp-gxh3.json | 38 +++++++ 10 files changed, 411 insertions(+), 49 deletions(-) create mode 100644 advisories/unreviewed/2024/11/GHSA-24w2-r4hx-q363/GHSA-24w2-r4hx-q363.json create mode 100644 advisories/unreviewed/2024/11/GHSA-48gc-vjjj-5rqw/GHSA-48gc-vjjj-5rqw.json create mode 100644 advisories/unreviewed/2024/11/GHSA-492j-gvpg-m7v2/GHSA-492j-gvpg-m7v2.json create mode 100644 advisories/unreviewed/2024/11/GHSA-8r46-fjj7-gr38/GHSA-8r46-fjj7-gr38.json create mode 100644 advisories/unreviewed/2024/11/GHSA-hjgc-jxjc-8v9j/GHSA-hjgc-jxjc-8v9j.json create mode 100644 advisories/unreviewed/2024/11/GHSA-mj36-fqcq-5fcp/GHSA-mj36-fqcq-5fcp.json create mode 100644 advisories/unreviewed/2024/11/GHSA-xq42-m8jp-gxh3/GHSA-xq42-m8jp-gxh3.json diff --git a/advisories/github-reviewed/2024/10/GHSA-586p-749j-fhwp/GHSA-586p-749j-fhwp.json b/advisories/github-reviewed/2024/10/GHSA-586p-749j-fhwp/GHSA-586p-749j-fhwp.json index 91edb85665b..3831dc1079a 100644 --- a/advisories/github-reviewed/2024/10/GHSA-586p-749j-fhwp/GHSA-586p-749j-fhwp.json +++ b/advisories/github-reviewed/2024/10/GHSA-586p-749j-fhwp/GHSA-586p-749j-fhwp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-586p-749j-fhwp", - "modified": "2024-11-06T21:30:54Z", + "modified": "2024-11-11T18:30:28Z", "published": "2024-10-09T15:32:21Z", "aliases": [ "CVE-2024-9675" @@ -50,51 +50,7 @@ }, { "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8563" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8675" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8679" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8686" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8690" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8703" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8707" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8708" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8709" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:8846" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/security/cve/CVE-2024-9675" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317458" + "url": "https://pkg.go.dev/vuln/GO-2024-3186" }, { "type": "PACKAGE", @@ -102,7 +58,59 @@ }, { "type": "WEB", - "url": "https://pkg.go.dev/vuln/GO-2024-3186" + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317458" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-9675" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:9051" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8846" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8709" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8708" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8707" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8703" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8700" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8690" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8686" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8679" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8675" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8563" } ], "database_specific": { diff --git a/advisories/github-reviewed/2024/10/GHSA-fhqq-8f65-5xfc/GHSA-fhqq-8f65-5xfc.json b/advisories/github-reviewed/2024/10/GHSA-fhqq-8f65-5xfc/GHSA-fhqq-8f65-5xfc.json index 4d22063f3de..d2665e4987e 100644 --- a/advisories/github-reviewed/2024/10/GHSA-fhqq-8f65-5xfc/GHSA-fhqq-8f65-5xfc.json +++ b/advisories/github-reviewed/2024/10/GHSA-fhqq-8f65-5xfc/GHSA-fhqq-8f65-5xfc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-fhqq-8f65-5xfc", - "modified": "2024-11-05T09:30:37Z", + "modified": "2024-11-11T18:30:28Z", "published": "2024-10-01T21:31:35Z", "aliases": [ "CVE-2024-9407" @@ -165,6 +165,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:8846" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:9051" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-9407" diff --git a/advisories/unreviewed/2024/10/GHSA-wq2p-5pc6-wpgf/GHSA-wq2p-5pc6-wpgf.json b/advisories/unreviewed/2024/10/GHSA-wq2p-5pc6-wpgf/GHSA-wq2p-5pc6-wpgf.json index 49b7d80e46c..2714ce8dcf5 100644 --- a/advisories/unreviewed/2024/10/GHSA-wq2p-5pc6-wpgf/GHSA-wq2p-5pc6-wpgf.json +++ b/advisories/unreviewed/2024/10/GHSA-wq2p-5pc6-wpgf/GHSA-wq2p-5pc6-wpgf.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wq2p-5pc6-wpgf", - "modified": "2024-11-07T09:30:42Z", + "modified": "2024-11-11T18:30:28Z", "published": "2024-10-15T18:30:50Z", "aliases": [ "CVE-2024-9676" @@ -45,6 +45,14 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:8694" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8700" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:9051" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-9676" diff --git a/advisories/unreviewed/2024/11/GHSA-24w2-r4hx-q363/GHSA-24w2-r4hx-q363.json b/advisories/unreviewed/2024/11/GHSA-24w2-r4hx-q363/GHSA-24w2-r4hx-q363.json new file mode 100644 index 00000000000..04e70afffe5 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-24w2-r4hx-q363/GHSA-24w2-r4hx-q363.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-24w2-r4hx-q363", + "modified": "2024-11-11T18:30:28Z", + "published": "2024-11-11T18:30:28Z", + "aliases": [ + "CVE-2024-45088" + ], + "details": "IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45088" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7174818" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T16:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-48gc-vjjj-5rqw/GHSA-48gc-vjjj-5rqw.json b/advisories/unreviewed/2024/11/GHSA-48gc-vjjj-5rqw/GHSA-48gc-vjjj-5rqw.json new file mode 100644 index 00000000000..73ae564fe30 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-48gc-vjjj-5rqw/GHSA-48gc-vjjj-5rqw.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-48gc-vjjj-5rqw", + "modified": "2024-11-11T18:30:29Z", + "published": "2024-11-11T18:30:29Z", + "aliases": [ + "CVE-2024-11074" + ], + "details": "A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. This vulnerability affects unknown code of the file /incadd.php. The manipulation of the argument inccat/desc/date/amount leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter \"inccat\" to be affected. But it must be assumed \"desc\", \"date\", and \"amount\" are affected as well.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11074" + }, + { + "type": "WEB", + "url": "https://github.com/dimongshi/cve/issues/1" + }, + { + "type": "WEB", + "url": "https://itsourcecode.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283870" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283870" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.441174" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T18:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-492j-gvpg-m7v2/GHSA-492j-gvpg-m7v2.json b/advisories/unreviewed/2024/11/GHSA-492j-gvpg-m7v2/GHSA-492j-gvpg-m7v2.json new file mode 100644 index 00000000000..50ce8b561a6 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-492j-gvpg-m7v2/GHSA-492j-gvpg-m7v2.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-492j-gvpg-m7v2", + "modified": "2024-11-11T18:30:28Z", + "published": "2024-11-11T18:30:28Z", + "aliases": [ + "CVE-2024-10917" + ], + "details": "In Eclipse OpenJ9 versions up to 0.47, the JNI function GetStringUTFLength may return an incorrect value which has wrapped around. From 0.48 the value is correct but may be truncated to include a smaller number of characters.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10917" + }, + { + "type": "WEB", + "url": "https://github.com/eclipse-openj9/openj9/pull/20362" + }, + { + "type": "WEB", + "url": "https://github.com/eclipse-openj9/openj9/releases/tag/openj9-0.48.0" + }, + { + "type": "WEB", + "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/47" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T17:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-8r46-fjj7-gr38/GHSA-8r46-fjj7-gr38.json b/advisories/unreviewed/2024/11/GHSA-8r46-fjj7-gr38/GHSA-8r46-fjj7-gr38.json new file mode 100644 index 00000000000..25737c1c2f2 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-8r46-fjj7-gr38/GHSA-8r46-fjj7-gr38.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8r46-fjj7-gr38", + "modified": "2024-11-11T18:30:29Z", + "published": "2024-11-11T18:30:28Z", + "aliases": [ + "CVE-2024-11073" + ], + "details": "A vulnerability classified as problematic has been found in SourceCodester Hospital Management System 1.0. This affects an unknown part of the file /vm/patient/delete-account.php. The manipulation of the argument id leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11073" + }, + { + "type": "WEB", + "url": "https://drive.google.com/file/d/1yFo0re8taTry7oR4-EDg3UHwO2lkqO9N/view?usp=sharing" + }, + { + "type": "WEB", + "url": "https://github.com/Salah-Tayeh/CVEs-and-Vulnerabilities/blob/main/Hospital%20Management%20System%20-%20IDOR%20Causing%20Deletion%20of%20any%20patient%20account.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283869" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283869" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.440799" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T17:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hjgc-jxjc-8v9j/GHSA-hjgc-jxjc-8v9j.json b/advisories/unreviewed/2024/11/GHSA-hjgc-jxjc-8v9j/GHSA-hjgc-jxjc-8v9j.json new file mode 100644 index 00000000000..9253ea1b764 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-hjgc-jxjc-8v9j/GHSA-hjgc-jxjc-8v9j.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hjgc-jxjc-8v9j", + "modified": "2024-11-11T18:30:28Z", + "published": "2024-11-11T18:30:28Z", + "aliases": [ + "CVE-2024-43439" + ], + "details": "A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43439" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304268" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=461209" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T16:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-mj36-fqcq-5fcp/GHSA-mj36-fqcq-5fcp.json b/advisories/unreviewed/2024/11/GHSA-mj36-fqcq-5fcp/GHSA-mj36-fqcq-5fcp.json new file mode 100644 index 00000000000..83b8884a53f --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-mj36-fqcq-5fcp/GHSA-mj36-fqcq-5fcp.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mj36-fqcq-5fcp", + "modified": "2024-11-11T18:30:29Z", + "published": "2024-11-11T18:30:29Z", + "aliases": [ + "CVE-2024-11076" + ], + "details": "A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown processing of the file /activation.php. The manipulation of the argument e_hash leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11076" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/UnrealdDei/cve/blob/main/sql2-rce.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283871" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283871" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.441182" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T18:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-xq42-m8jp-gxh3/GHSA-xq42-m8jp-gxh3.json b/advisories/unreviewed/2024/11/GHSA-xq42-m8jp-gxh3/GHSA-xq42-m8jp-gxh3.json new file mode 100644 index 00000000000..cccc89755d2 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-xq42-m8jp-gxh3/GHSA-xq42-m8jp-gxh3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xq42-m8jp-gxh3", + "modified": "2024-11-11T18:30:28Z", + "published": "2024-11-11T18:30:28Z", + "aliases": [ + "CVE-2024-45087" + ], + "details": "IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45087" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7175393" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-11T17:15:04Z" + } +} \ No newline at end of file