Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-11-13 18:33:18 +00:00
parent 351a94c6b0
commit 5d94c0f40e
105 changed files with 1663 additions and 197 deletions
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5g9m-4pr5-x8v5",
-  "modified": "2022-05-17T04:07:32Z",
+  "modified": "2024-11-13T18:31:51Z",
  "published": "2022-05-17T04:07:32Z",
  "aliases": [
    "CVE-2014-2120"
  ],
  "details": "Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun19025.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-26rx-wm6q-f3g4",
-  "modified": "2024-04-04T08:46:52Z",
+  "modified": "2024-11-13T18:31:51Z",
  "published": "2023-10-19T00:30:19Z",
  "aliases": [
    "CVE-2023-34437"
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-200"
+      "CWE-200",
+      "CWE-732"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-wmcg-jxc8-7m7p",
-  "modified": "2024-01-30T09:30:34Z",
+  "modified": "2024-11-13T18:31:51Z",
  "published": "2024-01-30T09:30:34Z",
  "aliases": [
    "CVE-2023-7225"
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-404"
    ],
    "severity": "LOW",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9q37-6mpp-rv7v",
-  "modified": "2024-03-13T21:31:03Z",
+  "modified": "2024-11-13T18:31:51Z",
  "published": "2024-03-13T21:31:03Z",
  "aliases": [
    "CVE-2024-28662"
  ],
  "details": "A Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing sanitization in create_tag in admin/include/functions.php.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -33,9 +36,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-13T21:16:01Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-vxf3-94jj-jhmp",
-  "modified": "2024-06-24T00:34:02Z",
+  "modified": "2024-11-13T18:31:52Z",
  "published": "2024-06-24T00:34:02Z",
  "aliases": [
    "CVE-2024-39334"
  ],
  "details": "MENDELSON AS4 before 2024 B376 has a client-side vulnerability when a trading partner provides prepared XML data. When a victim opens the details of this transaction in the client, files can be written to the computer on which the client process is running. (The server process is not affected.)",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-502"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-23T23:15:09Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-ccf5-hqv5-p85q",
-  "modified": "2024-07-19T18:31:21Z",
+  "modified": "2024-11-13T18:31:52Z",
  "published": "2024-07-19T18:31:21Z",
  "aliases": [
    "CVE-2024-29080"
  ],
  "details": "Potential vulnerabilities have been identified in the HP Display Control software component within the HP Application Enabling Software Driver which might allow escalation of privilege.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-281"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-19T17:15:03Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-64qp-9xf4-2pch",
-  "modified": "2024-10-21T18:30:58Z",
+  "modified": "2024-11-13T18:31:52Z",
  "published": "2024-10-21T18:30:58Z",
  "aliases": [
    "CVE-2024-49937"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: Set correct chandef when starting CAC\n\nWhen starting CAC in a mode other than AP mode, it return a\n\"WARNING: CPU: 0 PID: 63 at cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]\"\ncaused by the chandef.chan being null at the end of CAC.\n\nSolution: Ensure the channel definition is set for the different modes\nwhen starting CAC to avoid getting a NULL 'chan' at the end of CAC.\n\n Call Trace:\n  ? show_regs.part.0+0x14/0x16\n  ? __warn+0x67/0xc0\n  ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]\n  ? report_bug+0xa7/0x130\n  ? exc_overflow+0x30/0x30\n  ? handle_bug+0x27/0x50\n  ? exc_invalid_op+0x18/0x60\n  ? handle_exception+0xf6/0xf6\n  ? exc_overflow+0x30/0x30\n  ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]\n  ? exc_overflow+0x30/0x30\n  ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]\n  ? regulatory_propagate_dfs_state.cold+0x1b/0x4c [cfg80211]\n  ? cfg80211_propagate_cac_done_wk+0x1a/0x30 [cfg80211]\n  ? process_one_work+0x165/0x280\n  ? worker_thread+0x120/0x3f0\n  ? kthread+0xc2/0xf0\n  ? process_one_work+0x280/0x280\n  ? kthread_complete_and_exit+0x20/0x20\n  ? ret_from_fork+0x19/0x24\n\n[shorten subject, remove OCB, reorder cases to match previous list]",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -43,7 +46,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-21T18:15:15Z"
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-400"
+      "CWE-400",
+      "CWE-770"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-225p-gh6f-c6xc",
+  "modified": "2024-11-13T18:32:04Z",
+  "published": "2024-11-13T18:32:04Z",
+  "aliases": [
+    "CVE-2023-35686"
+  ],
+  "details": "In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35686"
+    },
+    {
+      "type": "WEB",
+      "url": "https://source.android.com/security/bulletin/2024-11-01"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-13T18:15:19Z"
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2m7j-4ff8-h52q",
-  "modified": "2024-11-08T18:30:50Z",
+  "modified": "2024-11-13T18:31:53Z",
  "published": "2024-11-08T18:30:50Z",
  "aliases": [
    "CVE-2024-46948"
  ],
  "details": "Northern.tech Mender before 3.6.5 and 3.7.x before 3.7.5 has Incorrect Access Control.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-08T16:15:24Z"
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2p4v-cp2q-5hx3",
+  "modified": "2024-11-13T18:32:05Z",
+  "published": "2024-11-13T18:32:05Z",
+  "aliases": [
+    "CVE-2024-43089"
+  ],
+  "details": "In updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43089"
+    },
+    {
+      "type": "WEB",
+      "url": "https://android.googlesource.com/platform/packages/providers/MediaProvider/+/33ff6a663eea1fcdd2b422b98722c1dee48a7f6a"
+    },
+    {
+      "type": "WEB",
+      "url": "https://source.android.com/security/bulletin/2024-11-01"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-13T18:15:21Z"
+  }
+}
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-88"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-89"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2rff-9j4g-r9gc",
+  "modified": "2024-11-13T18:32:02Z",
+  "published": "2024-11-13T18:32:02Z",
+  "aliases": [
+    "CVE-2024-50972"
+  ],
+  "details": "A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the borrow_id parameter.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50972"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Akhlak2511/CVE-2024-50972"
+    },
+    {
+      "type": "WEB",
+      "url": "https://itsourcecode.com/free-projects/php-project/construction-management-system-project-in-php-with-source-code"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-13T16:15:19Z"
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-34p7-67p6-m2pf",
-  "modified": "2024-11-12T15:30:43Z",
+  "modified": "2024-11-13T18:31:54Z",
  "published": "2024-11-12T15:30:43Z",
  "aliases": [
    "CVE-2024-45289"
  ],
  "details": "The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname.  The environment variable name used by fetch(1) to pass the filename to the library was incorrect, in effect ignoring the option.\n\nFetch would still connect to a host presenting a certificate included in the revocation file passed to the --crl option.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [
      "CWE-665"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-12T15:15:10Z"
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3qg5-qhw5-vc9x",
+  "modified": "2024-11-13T18:32:05Z",
+  "published": "2024-11-13T18:32:04Z",
+  "aliases": [
+    "CVE-2024-40661"
+  ],
+  "details": "In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40661"
+    },
+    {
+      "type": "WEB",
+      "url": "https://android.googlesource.com/platform/packages/modules/Permission/+/ffd81f212b5594b498f0ba07645c7a181540e494"
+    },
+    {
+      "type": "WEB",
+      "url": "https://source.android.com/security/bulletin/2024-11-01"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-13T18:15:20Z"
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3x82-hxvx-2rv2",
-  "modified": "2024-11-07T12:30:35Z",
+  "modified": "2024-11-13T18:31:53Z",
  "published": "2024-11-07T12:30:35Z",
  "aliases": [
    "CVE-2024-50170"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmasp: fix potential memory leak in bcmasp_xmit()\n\nThe bcmasp_xmit() returns NETDEV_TX_OK without freeing skb\nin case of mapping fails, add dev_kfree_skb() to fix it.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -33,9 +36,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-401"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-07T10:15:08Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4225-4fvr-rghw",
-  "modified": "2024-11-12T21:30:55Z",
+  "modified": "2024-11-13T18:31:59Z",
  "published": "2024-11-12T21:30:55Z",
  "aliases": [
    "CVE-2024-11111"
  ],
  "details": "Inappropriate implementation in Autofill in Google Chrome prior to 131.0.6778.69 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-12T21:15:11Z"
--- a/Show More
+++ b/Show More