From 696cec7ef733eb268c40b77590bd986f97a70004 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 30 Jun 2023 21:31:32 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-f4vp-f6h9-8cx8.json | 11 ++++-- .../GHSA-2hh3-2vjw-vgr4.json | 1 + .../GHSA-54gg-3w9x-qwch.json | 1 + .../GHSA-5vqh-8cmq-gmwm.json | 1 + .../GHSA-cg79-xxvp-6224.json | 1 + .../GHSA-j559-h2hv-jgfj.json | 1 + .../GHSA-qfv3-jjpv-58qw.json | 1 + .../GHSA-w36j-gqrc-cqgg.json | 1 + .../GHSA-5ffq-g4qh-w8q3.json | 5 ++- .../GHSA-mxvv-v7w8-j88h.json | 3 +- .../GHSA-rp5c-jhh9-9f2j.json | 9 +++-- .../GHSA-3q29-6c6h-84hh.json | 4 +- .../GHSA-fv5r-cw7f-79jm.json | 3 +- .../GHSA-m6w2-qgm5-6xwg.json | 3 +- .../GHSA-prvj-qfjv-3x3f.json | 3 +- .../GHSA-c5c5-rwc6-67m5.json | 1 + .../GHSA-36c8-63rj-g7xv.json | 7 +++- .../GHSA-58jm-pcr7-qmp6.json | 9 +++-- .../GHSA-5cvj-vcv7-3q5c.json | 9 +++-- .../GHSA-822g-9c37-42c6.json | 7 +++- .../GHSA-98x7-84p7-vf7h.json | 7 +++- .../GHSA-ch4p-p6rc-ppx7.json | 7 +++- .../GHSA-ff2c-382x-2h25.json | 9 +++-- .../GHSA-hcg7-gqc4-qc5q.json | 10 +++-- .../GHSA-hj65-qvx8-7xvc.json | 7 +++- .../GHSA-hpc3-p8jp-xc4q.json | 9 +++-- .../GHSA-hv25-453p-q38f.json | 7 +++- .../GHSA-j53v-cx3p-9rmw.json | 9 +++-- .../GHSA-jx37-m37q-v7c2.json | 39 +++++++++++++++++++ .../GHSA-pmmp-296p-3p5g.json | 39 +++++++++++++++++++ .../GHSA-rr4p-m9j4-p7cx.json | 3 +- .../GHSA-rwh2-qmx3-w2p5.json | 9 +++-- .../GHSA-v2v7-46gc-c2gh.json | 9 +++-- .../GHSA-v4f4-23wc-99mh.json | 39 +++++++++++++++++++ .../GHSA-w728-jx3q-vwr2.json | 3 +- .../GHSA-x3q7-hmmp-xprv.json | 39 +++++++++++++++++++ .../GHSA-xwc8-rf6m-xr86.json | 35 +++++++++++++++++ 37 files changed, 310 insertions(+), 51 deletions(-) create mode 100644 advisories/unreviewed/2023/06/GHSA-jx37-m37q-v7c2/GHSA-jx37-m37q-v7c2.json create mode 100644 advisories/unreviewed/2023/06/GHSA-pmmp-296p-3p5g/GHSA-pmmp-296p-3p5g.json create mode 100644 advisories/unreviewed/2023/06/GHSA-v4f4-23wc-99mh/GHSA-v4f4-23wc-99mh.json create mode 100644 advisories/unreviewed/2023/06/GHSA-x3q7-hmmp-xprv/GHSA-x3q7-hmmp-xprv.json create mode 100644 advisories/unreviewed/2023/06/GHSA-xwc8-rf6m-xr86/GHSA-xwc8-rf6m-xr86.json diff --git a/advisories/unreviewed/2022/02/GHSA-f4vp-f6h9-8cx8/GHSA-f4vp-f6h9-8cx8.json b/advisories/unreviewed/2022/02/GHSA-f4vp-f6h9-8cx8/GHSA-f4vp-f6h9-8cx8.json index e6f33a8254c..ce29d32ee81 100644 --- a/advisories/unreviewed/2022/02/GHSA-f4vp-f6h9-8cx8/GHSA-f4vp-f6h9-8cx8.json +++ b/advisories/unreviewed/2022/02/GHSA-f4vp-f6h9-8cx8/GHSA-f4vp-f6h9-8cx8.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-f4vp-f6h9-8cx8", - "modified": "2022-02-25T00:01:24Z", + "modified": "2023-06-30T21:30:18Z", "published": "2022-02-17T00:00:33Z", "aliases": [ "CVE-2021-26726" ], "details": "A remote code execution vulnerability affecting a Valmet DNA service listening on TCP port 1517, allows an attacker to execute commands with SYSTEM privileges This issue affects: Valmet DNA versions from Collection 2012 until Collection 2021.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,7 +32,9 @@ ], "database_specific": { "cwe_ids": [ - "CWE-326" + "CWE-209", + "CWE-326", + "CWE-330" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2022/03/GHSA-2hh3-2vjw-vgr4/GHSA-2hh3-2vjw-vgr4.json b/advisories/unreviewed/2022/03/GHSA-2hh3-2vjw-vgr4/GHSA-2hh3-2vjw-vgr4.json index ac35c475b8e..d2ef8afaee1 100644 --- a/advisories/unreviewed/2022/03/GHSA-2hh3-2vjw-vgr4/GHSA-2hh3-2vjw-vgr4.json +++ b/advisories/unreviewed/2022/03/GHSA-2hh3-2vjw-vgr4/GHSA-2hh3-2vjw-vgr4.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-668", "CWE-732" ], "severity": "CRITICAL", diff --git a/advisories/unreviewed/2022/03/GHSA-54gg-3w9x-qwch/GHSA-54gg-3w9x-qwch.json b/advisories/unreviewed/2022/03/GHSA-54gg-3w9x-qwch/GHSA-54gg-3w9x-qwch.json index 0585b25949b..d5232078ad6 100644 --- a/advisories/unreviewed/2022/03/GHSA-54gg-3w9x-qwch/GHSA-54gg-3w9x-qwch.json +++ b/advisories/unreviewed/2022/03/GHSA-54gg-3w9x-qwch/GHSA-54gg-3w9x-qwch.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-119", "CWE-20" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2022/03/GHSA-5vqh-8cmq-gmwm/GHSA-5vqh-8cmq-gmwm.json b/advisories/unreviewed/2022/03/GHSA-5vqh-8cmq-gmwm/GHSA-5vqh-8cmq-gmwm.json index beeedf05d7c..6d4af5071c5 100644 --- a/advisories/unreviewed/2022/03/GHSA-5vqh-8cmq-gmwm/GHSA-5vqh-8cmq-gmwm.json +++ b/advisories/unreviewed/2022/03/GHSA-5vqh-8cmq-gmwm/GHSA-5vqh-8cmq-gmwm.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-119", "CWE-20" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2022/03/GHSA-cg79-xxvp-6224/GHSA-cg79-xxvp-6224.json b/advisories/unreviewed/2022/03/GHSA-cg79-xxvp-6224/GHSA-cg79-xxvp-6224.json index f5bdd0cfbe8..8e5822cc5ed 100644 --- a/advisories/unreviewed/2022/03/GHSA-cg79-xxvp-6224/GHSA-cg79-xxvp-6224.json +++ b/advisories/unreviewed/2022/03/GHSA-cg79-xxvp-6224/GHSA-cg79-xxvp-6224.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-284", "CWE-668" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2022/03/GHSA-j559-h2hv-jgfj/GHSA-j559-h2hv-jgfj.json b/advisories/unreviewed/2022/03/GHSA-j559-h2hv-jgfj/GHSA-j559-h2hv-jgfj.json index dc3e170fdd2..1747e01694b 100644 --- a/advisories/unreviewed/2022/03/GHSA-j559-h2hv-jgfj/GHSA-j559-h2hv-jgfj.json +++ b/advisories/unreviewed/2022/03/GHSA-j559-h2hv-jgfj/GHSA-j559-h2hv-jgfj.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-119", "CWE-20" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2022/03/GHSA-qfv3-jjpv-58qw/GHSA-qfv3-jjpv-58qw.json b/advisories/unreviewed/2022/03/GHSA-qfv3-jjpv-58qw/GHSA-qfv3-jjpv-58qw.json index a57fcaf08f6..42850f77c98 100644 --- a/advisories/unreviewed/2022/03/GHSA-qfv3-jjpv-58qw/GHSA-qfv3-jjpv-58qw.json +++ b/advisories/unreviewed/2022/03/GHSA-qfv3-jjpv-58qw/GHSA-qfv3-jjpv-58qw.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-119", "CWE-20" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2022/03/GHSA-w36j-gqrc-cqgg/GHSA-w36j-gqrc-cqgg.json b/advisories/unreviewed/2022/03/GHSA-w36j-gqrc-cqgg/GHSA-w36j-gqrc-cqgg.json index bf96793bfe6..b7cbde9a569 100644 --- a/advisories/unreviewed/2022/03/GHSA-w36j-gqrc-cqgg/GHSA-w36j-gqrc-cqgg.json +++ b/advisories/unreviewed/2022/03/GHSA-w36j-gqrc-cqgg/GHSA-w36j-gqrc-cqgg.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-119", "CWE-20" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2022/05/GHSA-5ffq-g4qh-w8q3/GHSA-5ffq-g4qh-w8q3.json b/advisories/unreviewed/2022/05/GHSA-5ffq-g4qh-w8q3/GHSA-5ffq-g4qh-w8q3.json index 51740d64273..03b51caabc9 100644 --- a/advisories/unreviewed/2022/05/GHSA-5ffq-g4qh-w8q3/GHSA-5ffq-g4qh-w8q3.json +++ b/advisories/unreviewed/2022/05/GHSA-5ffq-g4qh-w8q3/GHSA-5ffq-g4qh-w8q3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-5ffq-g4qh-w8q3", - "modified": "2022-05-20T00:00:36Z", + "modified": "2023-06-30T21:30:19Z", "published": "2022-05-11T00:01:39Z", "aliases": [ "CVE-2022-24039" @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-75" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2022/05/GHSA-mxvv-v7w8-j88h/GHSA-mxvv-v7w8-j88h.json b/advisories/unreviewed/2022/05/GHSA-mxvv-v7w8-j88h/GHSA-mxvv-v7w8-j88h.json index 623e20eb645..ce0659810c5 100644 --- a/advisories/unreviewed/2022/05/GHSA-mxvv-v7w8-j88h/GHSA-mxvv-v7w8-j88h.json +++ b/advisories/unreviewed/2022/05/GHSA-mxvv-v7w8-j88h/GHSA-mxvv-v7w8-j88h.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mxvv-v7w8-j88h", - "modified": "2022-05-25T00:00:23Z", + "modified": "2023-06-30T21:30:19Z", "published": "2022-05-13T00:00:21Z", "aliases": [ "CVE-2021-27770" @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-472", "CWE-668" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2022/05/GHSA-rp5c-jhh9-9f2j/GHSA-rp5c-jhh9-9f2j.json b/advisories/unreviewed/2022/05/GHSA-rp5c-jhh9-9f2j/GHSA-rp5c-jhh9-9f2j.json index 9e86f1d72ab..1107550d457 100644 --- a/advisories/unreviewed/2022/05/GHSA-rp5c-jhh9-9f2j/GHSA-rp5c-jhh9-9f2j.json +++ b/advisories/unreviewed/2022/05/GHSA-rp5c-jhh9-9f2j/GHSA-rp5c-jhh9-9f2j.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rp5c-jhh9-9f2j", - "modified": "2022-05-24T19:14:02Z", + "modified": "2023-06-30T21:30:18Z", "published": "2022-05-24T19:14:02Z", "aliases": [ "CVE-2021-28498" ], "details": "In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user enable passwords set in clear text could result in unprivileged users getting complete access to the systems. This issue affects: Arista Metamako Operating System MOS-0.13 and post releases in the MOS-0.1x train MOS-0.26.6 and prior releases in the MOS-0.2x train MOS-0.31.1 and prior releases in the MOS-0.3x train", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-522" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2022/07/GHSA-3q29-6c6h-84hh/GHSA-3q29-6c6h-84hh.json b/advisories/unreviewed/2022/07/GHSA-3q29-6c6h-84hh/GHSA-3q29-6c6h-84hh.json index 81be48ac605..f1e9dc29ed2 100644 --- a/advisories/unreviewed/2022/07/GHSA-3q29-6c6h-84hh/GHSA-3q29-6c6h-84hh.json +++ b/advisories/unreviewed/2022/07/GHSA-3q29-6c6h-84hh/GHSA-3q29-6c6h-84hh.json @@ -28,7 +28,9 @@ ], "database_specific": { "cwe_ids": [ - "CWE-668" + "CWE-200", + "CWE-668", + "CWE-863" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2022/07/GHSA-fv5r-cw7f-79jm/GHSA-fv5r-cw7f-79jm.json b/advisories/unreviewed/2022/07/GHSA-fv5r-cw7f-79jm/GHSA-fv5r-cw7f-79jm.json index 54673bf8f2d..b4e56832631 100644 --- a/advisories/unreviewed/2022/07/GHSA-fv5r-cw7f-79jm/GHSA-fv5r-cw7f-79jm.json +++ b/advisories/unreviewed/2022/07/GHSA-fv5r-cw7f-79jm/GHSA-fv5r-cw7f-79jm.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-400" + "CWE-400", + "CWE-770" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2022/07/GHSA-m6w2-qgm5-6xwg/GHSA-m6w2-qgm5-6xwg.json b/advisories/unreviewed/2022/07/GHSA-m6w2-qgm5-6xwg/GHSA-m6w2-qgm5-6xwg.json index c2c140f0e09..04578cb5f0d 100644 --- a/advisories/unreviewed/2022/07/GHSA-m6w2-qgm5-6xwg/GHSA-m6w2-qgm5-6xwg.json +++ b/advisories/unreviewed/2022/07/GHSA-m6w2-qgm5-6xwg/GHSA-m6w2-qgm5-6xwg.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-125" + "CWE-125", + "CWE-306" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2022/07/GHSA-prvj-qfjv-3x3f/GHSA-prvj-qfjv-3x3f.json b/advisories/unreviewed/2022/07/GHSA-prvj-qfjv-3x3f/GHSA-prvj-qfjv-3x3f.json index ba50f3c0192..de0b0affcb7 100644 --- a/advisories/unreviewed/2022/07/GHSA-prvj-qfjv-3x3f/GHSA-prvj-qfjv-3x3f.json +++ b/advisories/unreviewed/2022/07/GHSA-prvj-qfjv-3x3f/GHSA-prvj-qfjv-3x3f.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-200" + "CWE-200", + "CWE-532" ], "severity": "LOW", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/01/GHSA-c5c5-rwc6-67m5/GHSA-c5c5-rwc6-67m5.json b/advisories/unreviewed/2023/01/GHSA-c5c5-rwc6-67m5/GHSA-c5c5-rwc6-67m5.json index 8ba11a4275b..e059002bcb3 100644 --- a/advisories/unreviewed/2023/01/GHSA-c5c5-rwc6-67m5/GHSA-c5c5-rwc6-67m5.json +++ b/advisories/unreviewed/2023/01/GHSA-c5c5-rwc6-67m5/GHSA-c5c5-rwc6-67m5.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-1284", "CWE-400" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2023/06/GHSA-36c8-63rj-g7xv/GHSA-36c8-63rj-g7xv.json b/advisories/unreviewed/2023/06/GHSA-36c8-63rj-g7xv/GHSA-36c8-63rj-g7xv.json index 65866bab68d..90856bdfb45 100644 --- a/advisories/unreviewed/2023/06/GHSA-36c8-63rj-g7xv/GHSA-36c8-63rj-g7xv.json +++ b/advisories/unreviewed/2023/06/GHSA-36c8-63rj-g7xv/GHSA-36c8-63rj-g7xv.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-36c8-63rj-g7xv", - "modified": "2023-06-22T21:30:49Z", + "modified": "2023-06-30T21:30:24Z", "published": "2023-06-22T21:30:49Z", "aliases": [ "CVE-2023-2991" ], "details": "Fortra Globalscape EFT's administration server suffers from an information disclosure vulnerability where the serial number of the harddrive that Globalscape is installed on can be remotely determined via a \"trial extension request\" message\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } ], "affected": [ diff --git a/advisories/unreviewed/2023/06/GHSA-58jm-pcr7-qmp6/GHSA-58jm-pcr7-qmp6.json b/advisories/unreviewed/2023/06/GHSA-58jm-pcr7-qmp6/GHSA-58jm-pcr7-qmp6.json index 6c880755284..3fde2d46ff2 100644 --- a/advisories/unreviewed/2023/06/GHSA-58jm-pcr7-qmp6/GHSA-58jm-pcr7-qmp6.json +++ b/advisories/unreviewed/2023/06/GHSA-58jm-pcr7-qmp6/GHSA-58jm-pcr7-qmp6.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-58jm-pcr7-qmp6", - "modified": "2023-06-28T18:30:26Z", + "modified": "2023-06-30T21:30:26Z", "published": "2023-06-28T18:30:26Z", "aliases": [ "CVE-2023-21178" ], "details": "In installKey of KeyUtil.cpp, there is a possible failure of file encryption due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-140762419", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ @@ -25,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-362" ], "severity": null, "github_reviewed": false, diff --git a/advisories/unreviewed/2023/06/GHSA-5cvj-vcv7-3q5c/GHSA-5cvj-vcv7-3q5c.json b/advisories/unreviewed/2023/06/GHSA-5cvj-vcv7-3q5c/GHSA-5cvj-vcv7-3q5c.json index 52a35207924..90f2ad1d87d 100644 --- a/advisories/unreviewed/2023/06/GHSA-5cvj-vcv7-3q5c/GHSA-5cvj-vcv7-3q5c.json +++ b/advisories/unreviewed/2023/06/GHSA-5cvj-vcv7-3q5c/GHSA-5cvj-vcv7-3q5c.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5cvj-vcv7-3q5c", - "modified": "2023-06-28T18:30:25Z", + "modified": "2023-06-30T21:30:26Z", "published": "2023-06-28T18:30:25Z", "aliases": [ "CVE-2023-21173" ], "details": "In multiple methods of DataUsageList.java, there is a possible way to learn about admin user's network activities due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-262741858", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ @@ -25,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-862" ], "severity": null, "github_reviewed": false, diff --git a/advisories/unreviewed/2023/06/GHSA-822g-9c37-42c6/GHSA-822g-9c37-42c6.json b/advisories/unreviewed/2023/06/GHSA-822g-9c37-42c6/GHSA-822g-9c37-42c6.json index a7efa61e54d..ee2e7bc7987 100644 --- a/advisories/unreviewed/2023/06/GHSA-822g-9c37-42c6/GHSA-822g-9c37-42c6.json +++ b/advisories/unreviewed/2023/06/GHSA-822g-9c37-42c6/GHSA-822g-9c37-42c6.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-822g-9c37-42c6", - "modified": "2023-06-14T21:30:40Z", + "modified": "2023-06-30T21:30:26Z", "published": "2023-06-14T21:30:40Z", "aliases": [ "CVE-2023-1329" ], "details": "A potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability may lead to Buffer Overflow and/or Remote Code Execution when running HP Workpath solutions on potentially affected products.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ diff --git a/advisories/unreviewed/2023/06/GHSA-98x7-84p7-vf7h/GHSA-98x7-84p7-vf7h.json b/advisories/unreviewed/2023/06/GHSA-98x7-84p7-vf7h/GHSA-98x7-84p7-vf7h.json index a56623b3601..91b7826fe5f 100644 --- a/advisories/unreviewed/2023/06/GHSA-98x7-84p7-vf7h/GHSA-98x7-84p7-vf7h.json +++ b/advisories/unreviewed/2023/06/GHSA-98x7-84p7-vf7h/GHSA-98x7-84p7-vf7h.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-98x7-84p7-vf7h", - "modified": "2023-06-28T18:30:26Z", + "modified": "2023-06-30T21:30:26Z", "published": "2023-06-28T18:30:26Z", "aliases": [ "CVE-2023-21179" ], "details": "In parseSecurityParamsFromXml of XmlUtil.java, there is a possible bypass of user specified wifi encryption protocol due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-272755865", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ diff --git a/advisories/unreviewed/2023/06/GHSA-ch4p-p6rc-ppx7/GHSA-ch4p-p6rc-ppx7.json b/advisories/unreviewed/2023/06/GHSA-ch4p-p6rc-ppx7/GHSA-ch4p-p6rc-ppx7.json index 639e65d9357..9a55ebb36e0 100644 --- a/advisories/unreviewed/2023/06/GHSA-ch4p-p6rc-ppx7/GHSA-ch4p-p6rc-ppx7.json +++ b/advisories/unreviewed/2023/06/GHSA-ch4p-p6rc-ppx7/GHSA-ch4p-p6rc-ppx7.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-ch4p-p6rc-ppx7", - "modified": "2023-06-22T21:30:49Z", + "modified": "2023-06-30T21:30:23Z", "published": "2023-06-22T21:30:49Z", "aliases": [ "CVE-2023-2989" ], "details": "Fortra Globalscape EFT versions before 8.1.0.16 suffer from an out of bounds memory read in their administration server, which can allow an attacker to crash the service or bypass authentication if successfully exploited\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" + } ], "affected": [ diff --git a/advisories/unreviewed/2023/06/GHSA-ff2c-382x-2h25/GHSA-ff2c-382x-2h25.json b/advisories/unreviewed/2023/06/GHSA-ff2c-382x-2h25/GHSA-ff2c-382x-2h25.json index 246a74da5d5..dd5efb01327 100644 --- a/advisories/unreviewed/2023/06/GHSA-ff2c-382x-2h25/GHSA-ff2c-382x-2h25.json +++ b/advisories/unreviewed/2023/06/GHSA-ff2c-382x-2h25/GHSA-ff2c-382x-2h25.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-ff2c-382x-2h25", - "modified": "2023-06-14T21:30:40Z", + "modified": "2023-06-30T21:30:20Z", "published": "2023-06-14T21:30:40Z", "aliases": [ "CVE-2023-34367" ], "details": "Windows 7 is vulnerable to a full blind TCP/IP hijacking attack. The vulnerability exists in Windows 7 (any Windows until Windows 8) and in any implementation of TCP/IP, which is vulnerable to the Idle scan attack (including many IoT devices). NOTE: The vendor considers this a low severity issue.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + } ], "affected": [ @@ -33,7 +36,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-287" ], "severity": null, "github_reviewed": false, diff --git a/advisories/unreviewed/2023/06/GHSA-hcg7-gqc4-qc5q/GHSA-hcg7-gqc4-qc5q.json b/advisories/unreviewed/2023/06/GHSA-hcg7-gqc4-qc5q/GHSA-hcg7-gqc4-qc5q.json index a02a721ff81..c6ee3516457 100644 --- a/advisories/unreviewed/2023/06/GHSA-hcg7-gqc4-qc5q/GHSA-hcg7-gqc4-qc5q.json +++ b/advisories/unreviewed/2023/06/GHSA-hcg7-gqc4-qc5q/GHSA-hcg7-gqc4-qc5q.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-hcg7-gqc4-qc5q", - "modified": "2023-06-22T21:30:49Z", + "modified": "2023-06-30T21:30:24Z", "published": "2023-06-22T21:30:49Z", "aliases": [ "CVE-2023-2990" ], "details": "Fortra Globalscape EFT versions before 8.1.0.16 suffer from a denial of service vulnerability, where a compressed message that decompresses to itself can cause infinite recursion and crash the service\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,7 +32,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-400" + "CWE-400", + "CWE-674" ], "severity": null, "github_reviewed": false, diff --git a/advisories/unreviewed/2023/06/GHSA-hj65-qvx8-7xvc/GHSA-hj65-qvx8-7xvc.json b/advisories/unreviewed/2023/06/GHSA-hj65-qvx8-7xvc/GHSA-hj65-qvx8-7xvc.json index 2d2e744414a..52b3162bad9 100644 --- a/advisories/unreviewed/2023/06/GHSA-hj65-qvx8-7xvc/GHSA-hj65-qvx8-7xvc.json +++ b/advisories/unreviewed/2023/06/GHSA-hj65-qvx8-7xvc/GHSA-hj65-qvx8-7xvc.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-hj65-qvx8-7xvc", - "modified": "2023-06-28T18:30:25Z", + "modified": "2023-06-30T21:30:26Z", "published": "2023-06-28T18:30:25Z", "aliases": [ "CVE-2023-21175" ], "details": "In onCreate of DataUsageSummary.java, there is a possible method for a guest user to enable or disable mobile data due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-262243574", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ diff --git a/advisories/unreviewed/2023/06/GHSA-hpc3-p8jp-xc4q/GHSA-hpc3-p8jp-xc4q.json b/advisories/unreviewed/2023/06/GHSA-hpc3-p8jp-xc4q/GHSA-hpc3-p8jp-xc4q.json index 8cc18c6426c..ae9efa46cb1 100644 --- a/advisories/unreviewed/2023/06/GHSA-hpc3-p8jp-xc4q/GHSA-hpc3-p8jp-xc4q.json +++ b/advisories/unreviewed/2023/06/GHSA-hpc3-p8jp-xc4q/GHSA-hpc3-p8jp-xc4q.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-hpc3-p8jp-xc4q", - "modified": "2023-06-28T18:30:25Z", + "modified": "2023-06-30T21:30:26Z", "published": "2023-06-28T18:30:25Z", "aliases": [ "CVE-2023-21157" ], "details": "In encode of wlandata.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-263783137References: N/A", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], "severity": null, "github_reviewed": false, diff --git a/advisories/unreviewed/2023/06/GHSA-hv25-453p-q38f/GHSA-hv25-453p-q38f.json b/advisories/unreviewed/2023/06/GHSA-hv25-453p-q38f/GHSA-hv25-453p-q38f.json index 0b3f84194e4..cce6422a118 100644 --- a/advisories/unreviewed/2023/06/GHSA-hv25-453p-q38f/GHSA-hv25-453p-q38f.json +++ b/advisories/unreviewed/2023/06/GHSA-hv25-453p-q38f/GHSA-hv25-453p-q38f.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-hv25-453p-q38f", - "modified": "2023-06-28T18:30:25Z", + "modified": "2023-06-30T21:30:26Z", "published": "2023-06-28T18:30:25Z", "aliases": [ "CVE-2023-21174" ], "details": "In isPageSearchEnabled of BillingCycleSettings.java, there is a possible way for the guest user to change data limits due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-235822222", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ diff --git a/advisories/unreviewed/2023/06/GHSA-j53v-cx3p-9rmw/GHSA-j53v-cx3p-9rmw.json b/advisories/unreviewed/2023/06/GHSA-j53v-cx3p-9rmw/GHSA-j53v-cx3p-9rmw.json index 280ac4b2d53..f63751bf59b 100644 --- a/advisories/unreviewed/2023/06/GHSA-j53v-cx3p-9rmw/GHSA-j53v-cx3p-9rmw.json +++ b/advisories/unreviewed/2023/06/GHSA-j53v-cx3p-9rmw/GHSA-j53v-cx3p-9rmw.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-j53v-cx3p-9rmw", - "modified": "2023-06-28T18:30:25Z", + "modified": "2023-06-30T21:30:26Z", "published": "2023-06-28T18:30:25Z", "aliases": [ "CVE-2023-21168" ], "details": "In convertCbYCrY of ColorConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-253270285", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ @@ -25,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-125" ], "severity": null, "github_reviewed": false, diff --git a/advisories/unreviewed/2023/06/GHSA-jx37-m37q-v7c2/GHSA-jx37-m37q-v7c2.json b/advisories/unreviewed/2023/06/GHSA-jx37-m37q-v7c2/GHSA-jx37-m37q-v7c2.json new file mode 100644 index 00000000000..37bae0ca108 --- /dev/null +++ b/advisories/unreviewed/2023/06/GHSA-jx37-m37q-v7c2/GHSA-jx37-m37q-v7c2.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jx37-m37q-v7c2", + "modified": "2023-06-30T21:30:26Z", + "published": "2023-06-30T21:30:26Z", + "aliases": [ + "CVE-2023-29147" + ], + "details": "In Malwarebytes EDR 1.0.11 for Linux, it is possible to bypass the detection layers that depend on inode identifiers, because an identifier may be reused when a file is replaced, and because two files on different filesystems can have the same identifier.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29147" + }, + { + "type": "WEB", + "url": "https://malwarebytes.com" + }, + { + "type": "WEB", + "url": "https://www.malwarebytes.com/secure/cves/cve-2023-29147" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/06/GHSA-pmmp-296p-3p5g/GHSA-pmmp-296p-3p5g.json b/advisories/unreviewed/2023/06/GHSA-pmmp-296p-3p5g/GHSA-pmmp-296p-3p5g.json new file mode 100644 index 00000000000..8b4441a1d55 --- /dev/null +++ b/advisories/unreviewed/2023/06/GHSA-pmmp-296p-3p5g/GHSA-pmmp-296p-3p5g.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pmmp-296p-3p5g", + "modified": "2023-06-30T21:30:26Z", + "published": "2023-06-30T21:30:26Z", + "aliases": [ + "CVE-2023-29145" + ], + "details": "The Malwarebytes EDR 1.0.11 for Linux driver doesn't properly ensure whitelisting of executable libraries loaded by executable files, allowing arbitrary code execution. The attacker can set LD_LIBRARY_PATH, set LD_PRELOAD, or run an executable file in a debugger.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29145" + }, + { + "type": "WEB", + "url": "https://malwarebytes.com" + }, + { + "type": "WEB", + "url": "https://www.malwarebytes.com/secure/cves/cve-2023-29145" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/06/GHSA-rr4p-m9j4-p7cx/GHSA-rr4p-m9j4-p7cx.json b/advisories/unreviewed/2023/06/GHSA-rr4p-m9j4-p7cx/GHSA-rr4p-m9j4-p7cx.json index 66c6a0cafe7..6ea482ff51d 100644 --- a/advisories/unreviewed/2023/06/GHSA-rr4p-m9j4-p7cx/GHSA-rr4p-m9j4-p7cx.json +++ b/advisories/unreviewed/2023/06/GHSA-rr4p-m9j4-p7cx/GHSA-rr4p-m9j4-p7cx.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-1386" + "CWE-1386", + "CWE-59" ], "severity": null, "github_reviewed": false, diff --git a/advisories/unreviewed/2023/06/GHSA-rwh2-qmx3-w2p5/GHSA-rwh2-qmx3-w2p5.json b/advisories/unreviewed/2023/06/GHSA-rwh2-qmx3-w2p5/GHSA-rwh2-qmx3-w2p5.json index b63d8033fb1..4a515518f77 100644 --- a/advisories/unreviewed/2023/06/GHSA-rwh2-qmx3-w2p5/GHSA-rwh2-qmx3-w2p5.json +++ b/advisories/unreviewed/2023/06/GHSA-rwh2-qmx3-w2p5/GHSA-rwh2-qmx3-w2p5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rwh2-qmx3-w2p5", - "modified": "2023-06-28T18:30:25Z", + "modified": "2023-06-30T21:30:26Z", "published": "2023-06-28T18:30:25Z", "aliases": [ "CVE-2023-21176" ], "details": "In list_key_entries of utils.rs, there is a possible way to disable user credentials due to resource exhaustion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-222287335", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-400" ], "severity": null, "github_reviewed": false, diff --git a/advisories/unreviewed/2023/06/GHSA-v2v7-46gc-c2gh/GHSA-v2v7-46gc-c2gh.json b/advisories/unreviewed/2023/06/GHSA-v2v7-46gc-c2gh/GHSA-v2v7-46gc-c2gh.json index 25884915dfe..f042e1b2d00 100644 --- a/advisories/unreviewed/2023/06/GHSA-v2v7-46gc-c2gh/GHSA-v2v7-46gc-c2gh.json +++ b/advisories/unreviewed/2023/06/GHSA-v2v7-46gc-c2gh/GHSA-v2v7-46gc-c2gh.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-v2v7-46gc-c2gh", - "modified": "2023-06-28T18:30:26Z", + "modified": "2023-06-30T21:30:26Z", "published": "2023-06-28T18:30:26Z", "aliases": [ "CVE-2023-21177" ], "details": "In requestAppKeyboardShortcuts of WindowManagerService.java, there is a possible way to infer the app a user is interacting with due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-273906410", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ @@ -25,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-862" ], "severity": null, "github_reviewed": false, diff --git a/advisories/unreviewed/2023/06/GHSA-v4f4-23wc-99mh/GHSA-v4f4-23wc-99mh.json b/advisories/unreviewed/2023/06/GHSA-v4f4-23wc-99mh/GHSA-v4f4-23wc-99mh.json new file mode 100644 index 00000000000..b24459e39af --- /dev/null +++ b/advisories/unreviewed/2023/06/GHSA-v4f4-23wc-99mh/GHSA-v4f4-23wc-99mh.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v4f4-23wc-99mh", + "modified": "2023-06-30T21:30:26Z", + "published": "2023-06-30T21:30:26Z", + "aliases": [ + "CVE-2023-31543" + ], + "details": "A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31543" + }, + { + "type": "WEB", + "url": "https://github.com/bndr/pipreqs/pull/364" + }, + { + "type": "WEB", + "url": "https://gist.github.com/adeadfed/ccc834440af354a5638f889bee34bafe" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/06/GHSA-w728-jx3q-vwr2/GHSA-w728-jx3q-vwr2.json b/advisories/unreviewed/2023/06/GHSA-w728-jx3q-vwr2/GHSA-w728-jx3q-vwr2.json index 27b7282f16d..2b2d8cd3216 100644 --- a/advisories/unreviewed/2023/06/GHSA-w728-jx3q-vwr2/GHSA-w728-jx3q-vwr2.json +++ b/advisories/unreviewed/2023/06/GHSA-w728-jx3q-vwr2/GHSA-w728-jx3q-vwr2.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-1386" + "CWE-1386", + "CWE-59" ], "severity": null, "github_reviewed": false, diff --git a/advisories/unreviewed/2023/06/GHSA-x3q7-hmmp-xprv/GHSA-x3q7-hmmp-xprv.json b/advisories/unreviewed/2023/06/GHSA-x3q7-hmmp-xprv/GHSA-x3q7-hmmp-xprv.json new file mode 100644 index 00000000000..571ffbbd8f3 --- /dev/null +++ b/advisories/unreviewed/2023/06/GHSA-x3q7-hmmp-xprv/GHSA-x3q7-hmmp-xprv.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x3q7-hmmp-xprv", + "modified": "2023-06-30T21:30:26Z", + "published": "2023-06-30T21:30:26Z", + "aliases": [ + "CVE-2023-27469" + ], + "details": "Malwarebytes Anti-Exploit 4.4.0.220 is vulnerable to arbitrary file deletion and denial of service via an ALPC message in which FullFileNamePath lacks a '\\0' character.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27469" + }, + { + "type": "WEB", + "url": "https://malwarebytes.com" + }, + { + "type": "WEB", + "url": "https://www.malwarebytes.com/secure/cves/cve-2023-27469" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/06/GHSA-xwc8-rf6m-xr86/GHSA-xwc8-rf6m-xr86.json b/advisories/unreviewed/2023/06/GHSA-xwc8-rf6m-xr86/GHSA-xwc8-rf6m-xr86.json new file mode 100644 index 00000000000..2a5c3814f19 --- /dev/null +++ b/advisories/unreviewed/2023/06/GHSA-xwc8-rf6m-xr86/GHSA-xwc8-rf6m-xr86.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xwc8-rf6m-xr86", + "modified": "2023-06-30T21:30:26Z", + "published": "2023-06-30T21:30:26Z", + "aliases": [ + "CVE-2023-37365" + ], + "details": "Hnswlib 0.7.0 has a double free in init_index when the M argument is a large integer.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37365" + }, + { + "type": "WEB", + "url": "https://github.com/nmslib/hnswlib/issues/467" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file