diff --git a/advisories/unreviewed/2022/01/GHSA-3mm5-rh7g-ph5j/GHSA-3mm5-rh7g-ph5j.json b/advisories/unreviewed/2022/01/GHSA-3mm5-rh7g-ph5j/GHSA-3mm5-rh7g-ph5j.json index 8739e972579..2b354cb2fa5 100644 --- a/advisories/unreviewed/2022/01/GHSA-3mm5-rh7g-ph5j/GHSA-3mm5-rh7g-ph5j.json +++ b/advisories/unreviewed/2022/01/GHSA-3mm5-rh7g-ph5j/GHSA-3mm5-rh7g-ph5j.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-3mm5-rh7g-ph5j", - "modified": "2022-02-05T00:01:09Z", + "modified": "2023-07-11T21:30:56Z", "published": "2022-01-29T00:00:40Z", "aliases": [ "CVE-2022-22992" ], "details": "A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-116", "CWE-77" ], "severity": "CRITICAL", diff --git a/advisories/unreviewed/2022/01/GHSA-qqqv-wfvc-wrgw/GHSA-qqqv-wfvc-wrgw.json b/advisories/unreviewed/2022/01/GHSA-qqqv-wfvc-wrgw/GHSA-qqqv-wfvc-wrgw.json index fdd67c0d28f..c040d0d067d 100644 --- a/advisories/unreviewed/2022/01/GHSA-qqqv-wfvc-wrgw/GHSA-qqqv-wfvc-wrgw.json +++ b/advisories/unreviewed/2022/01/GHSA-qqqv-wfvc-wrgw/GHSA-qqqv-wfvc-wrgw.json @@ -36,7 +36,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-287" + "CWE-287", + "CWE-697" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2022/02/GHSA-v495-fr6m-f3x9/GHSA-v495-fr6m-f3x9.json b/advisories/unreviewed/2022/02/GHSA-v495-fr6m-f3x9/GHSA-v495-fr6m-f3x9.json index bf28de3ee5f..0be16e161cf 100644 --- a/advisories/unreviewed/2022/02/GHSA-v495-fr6m-f3x9/GHSA-v495-fr6m-f3x9.json +++ b/advisories/unreviewed/2022/02/GHSA-v495-fr6m-f3x9/GHSA-v495-fr6m-f3x9.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-v495-fr6m-f3x9", - "modified": "2022-02-19T00:01:46Z", + "modified": "2023-07-11T21:30:57Z", "published": "2022-02-12T00:00:40Z", "aliases": [ "CVE-2022-23432" ], "details": "An improper input validation in SMC_SRPMB_WSM handler of RPMB ldfw prior to SMR Feb-2022 Release 1 allows arbitrary memory write and code execution.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-787" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2022/07/GHSA-2hjm-r8h9-f78j/GHSA-2hjm-r8h9-f78j.json b/advisories/unreviewed/2022/07/GHSA-2hjm-r8h9-f78j/GHSA-2hjm-r8h9-f78j.json index ecb762a9695..13184afd5fa 100644 --- a/advisories/unreviewed/2022/07/GHSA-2hjm-r8h9-f78j/GHSA-2hjm-r8h9-f78j.json +++ b/advisories/unreviewed/2022/07/GHSA-2hjm-r8h9-f78j/GHSA-2hjm-r8h9-f78j.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-22" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2022/08/GHSA-23g5-cwwr-8xhw/GHSA-23g5-cwwr-8xhw.json b/advisories/unreviewed/2022/08/GHSA-23g5-cwwr-8xhw/GHSA-23g5-cwwr-8xhw.json index 344fda660d6..28be5433e3c 100644 --- a/advisories/unreviewed/2022/08/GHSA-23g5-cwwr-8xhw/GHSA-23g5-cwwr-8xhw.json +++ b/advisories/unreviewed/2022/08/GHSA-23g5-cwwr-8xhw/GHSA-23g5-cwwr-8xhw.json @@ -60,6 +60,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-287", "CWE-327" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2022/11/GHSA-jw59-9v6j-fpwh/GHSA-jw59-9v6j-fpwh.json b/advisories/unreviewed/2022/11/GHSA-jw59-9v6j-fpwh/GHSA-jw59-9v6j-fpwh.json index 9be846ac8a2..3c599a1603d 100644 --- a/advisories/unreviewed/2022/11/GHSA-jw59-9v6j-fpwh/GHSA-jw59-9v6j-fpwh.json +++ b/advisories/unreviewed/2022/11/GHSA-jw59-9v6j-fpwh/GHSA-jw59-9v6j-fpwh.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-285", "CWE-863" ], "severity": "CRITICAL", diff --git a/advisories/unreviewed/2022/11/GHSA-wvhv-cj6c-94gv/GHSA-wvhv-cj6c-94gv.json b/advisories/unreviewed/2022/11/GHSA-wvhv-cj6c-94gv/GHSA-wvhv-cj6c-94gv.json index 7106d4108ea..fb274f29ab1 100644 --- a/advisories/unreviewed/2022/11/GHSA-wvhv-cj6c-94gv/GHSA-wvhv-cj6c-94gv.json +++ b/advisories/unreviewed/2022/11/GHSA-wvhv-cj6c-94gv/GHSA-wvhv-cj6c-94gv.json @@ -36,7 +36,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-119" + "CWE-119", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/06/GHSA-cqgm-m7h3-xgwm/GHSA-cqgm-m7h3-xgwm.json b/advisories/unreviewed/2023/06/GHSA-cqgm-m7h3-xgwm/GHSA-cqgm-m7h3-xgwm.json index 9aa10d2aae5..a9a5f6a1963 100644 --- a/advisories/unreviewed/2023/06/GHSA-cqgm-m7h3-xgwm/GHSA-cqgm-m7h3-xgwm.json +++ b/advisories/unreviewed/2023/06/GHSA-cqgm-m7h3-xgwm/GHSA-cqgm-m7h3-xgwm.json @@ -28,6 +28,10 @@ { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00000.html" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00013.html" } ], "database_specific": { diff --git a/advisories/unreviewed/2023/06/GHSA-xcf7-g637-p7f5/GHSA-xcf7-g637-p7f5.json b/advisories/unreviewed/2023/06/GHSA-xcf7-g637-p7f5/GHSA-xcf7-g637-p7f5.json index 184e1e8ca91..2b228c75b39 100644 --- a/advisories/unreviewed/2023/06/GHSA-xcf7-g637-p7f5/GHSA-xcf7-g637-p7f5.json +++ b/advisories/unreviewed/2023/06/GHSA-xcf7-g637-p7f5/GHSA-xcf7-g637-p7f5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-xcf7-g637-p7f5", - "modified": "2023-06-29T18:30:57Z", + "modified": "2023-07-11T21:30:57Z", "published": "2023-06-29T18:30:57Z", "aliases": [ "CVE-2023-35830" ], "details": "STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage_v3.03r0-Impala and DeploymentPackage_v3.04r2-Jellyfish and TCG-4lite Connectivity Module DeploymentPackage_v3.04r2-Jellyfish allow an attacker to gain full remote access with root privileges without the need for authentication, giving an attacker arbitrary remote code execution over LTE / 4G network via SMS.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ diff --git a/advisories/unreviewed/2023/07/GHSA-3q5m-9r3g-pqfj/GHSA-3q5m-9r3g-pqfj.json b/advisories/unreviewed/2023/07/GHSA-3q5m-9r3g-pqfj/GHSA-3q5m-9r3g-pqfj.json new file mode 100644 index 00000000000..cfbc280f289 --- /dev/null +++ b/advisories/unreviewed/2023/07/GHSA-3q5m-9r3g-pqfj/GHSA-3q5m-9r3g-pqfj.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3q5m-9r3g-pqfj", + "modified": "2023-07-11T21:30:58Z", + "published": "2023-07-11T21:30:58Z", + "aliases": [ + "CVE-2022-48521" + ], + "details": "An issue was discovered in OpenDKIM through 2.10.3, and 2.11.x through 2.11.0-Beta2. It fails to keep track of ordinal numbers when removing fake Authentication-Results header fields, which allows a remote attacker to craft an e-mail message with a fake sender address such that programs that rely on Authentication-Results from OpenDKIM will treat the message as having a valid DKIM signature when in fact it has none.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48521" + }, + { + "type": "WEB", + "url": "https://github.com/trusteddomainproject/OpenDKIM/issues/148" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/07/GHSA-52rm-ch56-6jhr/GHSA-52rm-ch56-6jhr.json b/advisories/unreviewed/2023/07/GHSA-52rm-ch56-6jhr/GHSA-52rm-ch56-6jhr.json index 5ec4f712fd1..6d97bbef342 100644 --- a/advisories/unreviewed/2023/07/GHSA-52rm-ch56-6jhr/GHSA-52rm-ch56-6jhr.json +++ b/advisories/unreviewed/2023/07/GHSA-52rm-ch56-6jhr/GHSA-52rm-ch56-6jhr.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-52rm-ch56-6jhr", - "modified": "2023-07-05T21:30:17Z", + "modified": "2023-07-11T21:30:58Z", "published": "2023-07-05T21:30:17Z", "aliases": [ "CVE-2023-36622" ], "details": "The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject arbitrary OS commands via the timezone parameter.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,7 +32,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-78" ], "severity": null, "github_reviewed": false, diff --git a/advisories/unreviewed/2023/07/GHSA-cf4r-5p5m-jqq2/GHSA-cf4r-5p5m-jqq2.json b/advisories/unreviewed/2023/07/GHSA-cf4r-5p5m-jqq2/GHSA-cf4r-5p5m-jqq2.json new file mode 100644 index 00000000000..db44878c28c --- /dev/null +++ b/advisories/unreviewed/2023/07/GHSA-cf4r-5p5m-jqq2/GHSA-cf4r-5p5m-jqq2.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cf4r-5p5m-jqq2", + "modified": "2023-07-11T21:30:58Z", + "published": "2023-07-11T21:30:58Z", + "aliases": [ + "CVE-2023-29984" + ], + "details": "Null pointer dereference vulnerability exists in multiple vendors MFPs and printers which implement Debut web server 1.2 or 1.3. Processing a specially crafted request may lead an affected product to a denial-of-service (DoS) condition. As for the affected products/models/versions, see the detailed information provided by each vendor.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29984" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/vu/JVNVU93767756/index.html" + }, + { + "type": "WEB", + "url": "https://www.fujifilm.com/fbglobal/eng/company/news/notice/2023/browser_announce.html" + }, + { + "type": "WEB", + "url": "http://brother.com" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/07/GHSA-f8f7-69v5-w4vx/GHSA-f8f7-69v5-w4vx.json b/advisories/unreviewed/2023/07/GHSA-f8f7-69v5-w4vx/GHSA-f8f7-69v5-w4vx.json new file mode 100644 index 00000000000..07f97e95e7b --- /dev/null +++ b/advisories/unreviewed/2023/07/GHSA-f8f7-69v5-w4vx/GHSA-f8f7-69v5-w4vx.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f8f7-69v5-w4vx", + "modified": "2023-07-11T21:30:58Z", + "published": "2023-07-11T21:30:58Z", + "aliases": [ + "CVE-2023-29406" + ], + "details": "The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29406" + }, + { + "type": "WEB", + "url": "https://go.dev/cl/506996" + }, + { + "type": "WEB", + "url": "https://go.dev/issue/60374" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/golang-announce/c/2q13H6LEEx0" + }, + { + "type": "WEB", + "url": "https://pkg.go.dev/vuln/GO-2023-1878" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-113" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/07/GHSA-g45c-4xf2-8f43/GHSA-g45c-4xf2-8f43.json b/advisories/unreviewed/2023/07/GHSA-g45c-4xf2-8f43/GHSA-g45c-4xf2-8f43.json index ebf644bfb0e..a862f3fe666 100644 --- a/advisories/unreviewed/2023/07/GHSA-g45c-4xf2-8f43/GHSA-g45c-4xf2-8f43.json +++ b/advisories/unreviewed/2023/07/GHSA-g45c-4xf2-8f43/GHSA-g45c-4xf2-8f43.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-g45c-4xf2-8f43", - "modified": "2023-07-05T15:30:25Z", + "modified": "2023-07-11T21:30:57Z", "published": "2023-07-05T15:30:25Z", "aliases": [ "CVE-2023-35975" @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-22" ], "severity": null, "github_reviewed": false, diff --git a/advisories/unreviewed/2023/07/GHSA-gwrc-vqcf-v9v4/GHSA-gwrc-vqcf-v9v4.json b/advisories/unreviewed/2023/07/GHSA-gwrc-vqcf-v9v4/GHSA-gwrc-vqcf-v9v4.json new file mode 100644 index 00000000000..132101ff997 --- /dev/null +++ b/advisories/unreviewed/2023/07/GHSA-gwrc-vqcf-v9v4/GHSA-gwrc-vqcf-v9v4.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gwrc-vqcf-v9v4", + "modified": "2023-07-11T21:30:58Z", + "published": "2023-07-11T21:30:58Z", + "aliases": [ + "CVE-2023-36884" + ], + "details": "Microsoft is investigating reports of a series of remote code execution vulnerabilities impacting Windows and Office products. Microsoft is aware of targeted attacks that attempt to exploit these vulnerabilities by using specially-crafted Microsoft Office documents.\n\nAn attacker could create a specially crafted Microsoft Office document that enables them to perform remote code execution in the context of the victim. However, an attacker would have to convince the victim to open the malicious file.\n\nUpon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This might include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.\n\nPlease see the Microsoft Threat Intelligence Blog https://aka.ms/Storm-0978  Entry for important information about steps you can take to protect your system from this vulnerability.\n\nThis CVE will be updated with new information and links to security updates when they become available.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36884" + }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/07/GHSA-mg79-3wxp-f4x4/GHSA-mg79-3wxp-f4x4.json b/advisories/unreviewed/2023/07/GHSA-mg79-3wxp-f4x4/GHSA-mg79-3wxp-f4x4.json new file mode 100644 index 00000000000..65727452569 --- /dev/null +++ b/advisories/unreviewed/2023/07/GHSA-mg79-3wxp-f4x4/GHSA-mg79-3wxp-f4x4.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mg79-3wxp-f4x4", + "modified": "2023-07-11T21:30:58Z", + "published": "2023-07-11T21:30:58Z", + "aliases": [ + "CVE-2023-20575" + ], + "details": "\nA potential power side-channel vulnerability in some AMD processors may allow an authenticated attacker to use the power reporting functionality to monitor a program’s execution inside an AMD SEV VM potentially resulting in a leak of sensitive information.\n\n\n\n\n\n\n\n\n\n", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20575" + }, + { + "type": "WEB", + "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3004" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/07/GHSA-p5fh-fh5q-gpgf/GHSA-p5fh-fh5q-gpgf.json b/advisories/unreviewed/2023/07/GHSA-p5fh-fh5q-gpgf/GHSA-p5fh-fh5q-gpgf.json new file mode 100644 index 00000000000..57d5043b7e0 --- /dev/null +++ b/advisories/unreviewed/2023/07/GHSA-p5fh-fh5q-gpgf/GHSA-p5fh-fh5q-gpgf.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p5fh-fh5q-gpgf", + "modified": "2023-07-11T21:30:58Z", + "published": "2023-07-11T21:30:58Z", + "aliases": [ + "CVE-2023-23756" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in advcomsys.com oneVote component for Joomla. It allows XSS Targeting Non-Script Elements.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23756" + }, + { + "type": "WEB", + "url": "https://extensions.joomla.org/vulnerable-extensions/vulnerable/one-vote-1-7-xss-cross-site-scripting/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file