From 6438c9d78bbcef985074c17e96325497287fd2a5 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sat, 27 Apr 2024 21:31:54 +0000
Subject: [PATCH] Publish Advisories

GHSA-f8q2-j8xf-7xhh
GHSA-rqgg-vgvc-434g
---
 .../GHSA-f8q2-j8xf-7xhh.json                  | 50 +++++++++++++++++
 .../GHSA-rqgg-vgvc-434g.json                  | 54 +++++++++++++++++++
 2 files changed, 104 insertions(+)
 create mode 100644 advisories/unreviewed/2024/04/GHSA-f8q2-j8xf-7xhh/GHSA-f8q2-j8xf-7xhh.json
 create mode 100644 advisories/unreviewed/2024/04/GHSA-rqgg-vgvc-434g/GHSA-rqgg-vgvc-434g.json

diff --git a/advisories/unreviewed/2024/04/GHSA-f8q2-j8xf-7xhh/GHSA-f8q2-j8xf-7xhh.json b/advisories/unreviewed/2024/04/GHSA-f8q2-j8xf-7xhh/GHSA-f8q2-j8xf-7xhh.json
new file mode 100644
index 00000000000..25e11eacc79
--- /dev/null
+++ b/advisories/unreviewed/2024/04/GHSA-f8q2-j8xf-7xhh/GHSA-f8q2-j8xf-7xhh.json
@@ -0,0 +1,50 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f8q2-j8xf-7xhh",
+  "modified": "2024-04-27T21:30:30Z",
+  "published": "2024-04-27T21:30:30Z",
+  "aliases": [
+    "CVE-2024-4291"
+  ],
+  "details": "A vulnerability was found in Tenda A301 15.13.08.12_multi_TDE01. It has been rated as critical. This issue affects the function formAddMacfilterRule of the file /goform/setBlackRule. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-262223. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4291"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/L1ziang/Vulnerability/blob/main/formAddMacfilterRule.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.262223"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.262223"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.320672"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-121"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-27T20:15:07Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/04/GHSA-rqgg-vgvc-434g/GHSA-rqgg-vgvc-434g.json b/advisories/unreviewed/2024/04/GHSA-rqgg-vgvc-434g/GHSA-rqgg-vgvc-434g.json
new file mode 100644
index 00000000000..104704f2843
--- /dev/null
+++ b/advisories/unreviewed/2024/04/GHSA-rqgg-vgvc-434g/GHSA-rqgg-vgvc-434g.json
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rqgg-vgvc-434g",
+  "modified": "2024-04-27T21:30:30Z",
+  "published": "2024-04-27T21:30:30Z",
+  "aliases": [
+    "CVE-2024-4292"
+  ],
+  "details": "A vulnerability classified as critical has been found in Contemporary Controls BASrouter BACnet BASRT-B 2.7.2. Affected is an unknown function of the component Device-Communication-Control Service. The manipulation with the input 55ff0500370015f30104025506110afb7519035d0841e4bece257b6acfc71f leads to denial of service. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262224. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4292"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASER-B_backdoor.pcapng"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/isZzzz/BASRT-B_BACnet_Router_Document/blob/main/BASRT_CVE_apply.pdf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.262224"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.262224"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.320749"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-404"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-27T21:15:47Z"
+  }
+}
\ No newline at end of file