diff --git a/advisories/github-reviewed/2018/07/GHSA-2qx8-589j-gcpx/GHSA-2qx8-589j-gcpx.json b/advisories/github-reviewed/2018/07/GHSA-2qx8-589j-gcpx/GHSA-2qx8-589j-gcpx.json index e1a2b01760b..f20722b91c9 100644 --- a/advisories/github-reviewed/2018/07/GHSA-2qx8-589j-gcpx/GHSA-2qx8-589j-gcpx.json +++ b/advisories/github-reviewed/2018/07/GHSA-2qx8-589j-gcpx/GHSA-2qx8-589j-gcpx.json @@ -1,15 +1,22 @@ { "schema_version": "1.4.0", "id": "GHSA-2qx8-589j-gcpx", - "modified": "2020-06-16T20:52:51Z", + "modified": "2024-10-09T21:30:27Z", "published": "2018-07-23T20:26:45Z", "aliases": [ "CVE-2011-1950" ], - "summary": "Moderate severity vulnerability that affects Plone and plone.app.users", + "summary": "Plone and plone.app.users allow remote authenticated users to modify the properties of arbitrary accounts", "details": "plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:A" + } ], "affected": [ { @@ -68,6 +75,25 @@ ] } ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "Plone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.1.0" + }, + { + "fixed": "4.1.1" + } + ] + } + ] } ], "references": [ @@ -85,34 +111,18 @@ }, { "type": "WEB", - "url": "http://osvdb.org/72729" + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2011-16.yaml" }, { "type": "WEB", "url": "http://plone.org/products/plone/security/advisories/CVE-2011-1950" - }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/44775" - }, - { - "type": "WEB", - "url": "http://securityreason.com/securityalert/8269" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/archive/1/518155/100/0/threaded" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/48005" } ], "database_specific": { "cwe_ids": [ ], - "severity": "MODERATE", + "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-06-16T20:52:51Z", "nvd_published_at": null diff --git a/advisories/unreviewed/2023/03/GHSA-c2w4-xgq6-w9xw/GHSA-c2w4-xgq6-w9xw.json b/advisories/unreviewed/2023/03/GHSA-c2w4-xgq6-w9xw/GHSA-c2w4-xgq6-w9xw.json index 9f2244a999c..9ffd83d6a9a 100644 --- a/advisories/unreviewed/2023/03/GHSA-c2w4-xgq6-w9xw/GHSA-c2w4-xgq6-w9xw.json +++ b/advisories/unreviewed/2023/03/GHSA-c2w4-xgq6-w9xw/GHSA-c2w4-xgq6-w9xw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-c2w4-xgq6-w9xw", - "modified": "2023-03-23T18:30:19Z", + "modified": "2024-10-09T21:31:06Z", "published": "2023-03-21T21:30:18Z", "aliases": [ "CVE-2023-1528" diff --git a/advisories/unreviewed/2023/08/GHSA-4625-9rv5-g3gm/GHSA-4625-9rv5-g3gm.json b/advisories/unreviewed/2023/08/GHSA-4625-9rv5-g3gm/GHSA-4625-9rv5-g3gm.json index 3501d6e9095..f5015391000 100644 --- a/advisories/unreviewed/2023/08/GHSA-4625-9rv5-g3gm/GHSA-4625-9rv5-g3gm.json +++ b/advisories/unreviewed/2023/08/GHSA-4625-9rv5-g3gm/GHSA-4625-9rv5-g3gm.json @@ -32,6 +32,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-285", "CWE-358" ], "severity": "CRITICAL", diff --git a/advisories/unreviewed/2023/08/GHSA-75r5-62mf-f58x/GHSA-75r5-62mf-f58x.json b/advisories/unreviewed/2023/08/GHSA-75r5-62mf-f58x/GHSA-75r5-62mf-f58x.json index 21a137ef056..d35ee6fe757 100644 --- a/advisories/unreviewed/2023/08/GHSA-75r5-62mf-f58x/GHSA-75r5-62mf-f58x.json +++ b/advisories/unreviewed/2023/08/GHSA-75r5-62mf-f58x/GHSA-75r5-62mf-f58x.json @@ -32,7 +32,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-285" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/08/GHSA-9q93-crmr-j3fp/GHSA-9q93-crmr-j3fp.json b/advisories/unreviewed/2023/08/GHSA-9q93-crmr-j3fp/GHSA-9q93-crmr-j3fp.json index dc4821527af..de2a284740a 100644 --- a/advisories/unreviewed/2023/08/GHSA-9q93-crmr-j3fp/GHSA-9q93-crmr-j3fp.json +++ b/advisories/unreviewed/2023/08/GHSA-9q93-crmr-j3fp/GHSA-9q93-crmr-j3fp.json @@ -32,7 +32,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-285" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/08/GHSA-hq7g-6qmj-684h/GHSA-hq7g-6qmj-684h.json b/advisories/unreviewed/2023/08/GHSA-hq7g-6qmj-684h/GHSA-hq7g-6qmj-684h.json index f22ea711090..b94abb0ea86 100644 --- a/advisories/unreviewed/2023/08/GHSA-hq7g-6qmj-684h/GHSA-hq7g-6qmj-684h.json +++ b/advisories/unreviewed/2023/08/GHSA-hq7g-6qmj-684h/GHSA-hq7g-6qmj-684h.json @@ -32,7 +32,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-22" + "CWE-22", + "CWE-285" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/08/GHSA-hv3f-mjfx-h726/GHSA-hv3f-mjfx-h726.json b/advisories/unreviewed/2023/08/GHSA-hv3f-mjfx-h726/GHSA-hv3f-mjfx-h726.json index e58c0b59262..ffe7573ecf1 100644 --- a/advisories/unreviewed/2023/08/GHSA-hv3f-mjfx-h726/GHSA-hv3f-mjfx-h726.json +++ b/advisories/unreviewed/2023/08/GHSA-hv3f-mjfx-h726/GHSA-hv3f-mjfx-h726.json @@ -32,7 +32,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-22" + "CWE-22", + "CWE-285" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/08/GHSA-q37c-7pc6-25h7/GHSA-q37c-7pc6-25h7.json b/advisories/unreviewed/2023/08/GHSA-q37c-7pc6-25h7/GHSA-q37c-7pc6-25h7.json index 9b3687bf4e3..b88422ebe7b 100644 --- a/advisories/unreviewed/2023/08/GHSA-q37c-7pc6-25h7/GHSA-q37c-7pc6-25h7.json +++ b/advisories/unreviewed/2023/08/GHSA-q37c-7pc6-25h7/GHSA-q37c-7pc6-25h7.json @@ -32,7 +32,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-22" + "CWE-22", + "CWE-285" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/10/GHSA-33x7-98g2-hprp/GHSA-33x7-98g2-hprp.json b/advisories/unreviewed/2024/10/GHSA-33x7-98g2-hprp/GHSA-33x7-98g2-hprp.json new file mode 100644 index 00000000000..19d29debe3b --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-33x7-98g2-hprp/GHSA-33x7-98g2-hprp.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-33x7-98g2-hprp", + "modified": "2024-10-09T21:31:08Z", + "published": "2024-10-09T21:31:08Z", + "aliases": [ + "CVE-2024-38815" + ], + "details": "VMware NSX contains a content spoofing vulnerability. \n\nAn unauthenticated malicious actor may be able to craft a URL and redirect a victim to an attacker controlled domain leading to sensitive information disclosure.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38815" + }, + { + "type": "WEB", + "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25047" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-09T20:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-3hhh-46fw-chvg/GHSA-3hhh-46fw-chvg.json b/advisories/unreviewed/2024/10/GHSA-3hhh-46fw-chvg/GHSA-3hhh-46fw-chvg.json index f495cacd300..3dbe95fd0a3 100644 --- a/advisories/unreviewed/2024/10/GHSA-3hhh-46fw-chvg/GHSA-3hhh-46fw-chvg.json +++ b/advisories/unreviewed/2024/10/GHSA-3hhh-46fw-chvg/GHSA-3hhh-46fw-chvg.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-3hhh-46fw-chvg", - "modified": "2024-10-09T18:31:42Z", + "modified": "2024-10-09T21:31:08Z", "published": "2024-10-09T18:31:42Z", "aliases": [ "CVE-2024-46316" ], "details": "DrayTek Vigor3900 v1.5.1.6 was discovered to contain a command injection vulnerability via the sub_2C920 function at /cgi-bin/mainfunction.cgi. This vulnerability allows attackers to execute arbitrary commands via supplying a crafted HTTP message.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-78" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-09T16:15:04Z" diff --git a/advisories/unreviewed/2024/10/GHSA-54f4-v6v9-9q82/GHSA-54f4-v6v9-9q82.json b/advisories/unreviewed/2024/10/GHSA-54f4-v6v9-9q82/GHSA-54f4-v6v9-9q82.json new file mode 100644 index 00000000000..6f0f77cd615 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-54f4-v6v9-9q82/GHSA-54f4-v6v9-9q82.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-54f4-v6v9-9q82", + "modified": "2024-10-09T21:31:08Z", + "published": "2024-10-09T21:31:08Z", + "aliases": [ + "CVE-2024-7037" + ], + "details": "In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHE_DIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote code execution.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7037" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/8508db68-9c99-4b1c-828c-e1bfcacfb847" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-09T20:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-5556-ppcw-ghh5/GHSA-5556-ppcw-ghh5.json b/advisories/unreviewed/2024/10/GHSA-5556-ppcw-ghh5/GHSA-5556-ppcw-ghh5.json new file mode 100644 index 00000000000..004ce2f0fd4 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-5556-ppcw-ghh5/GHSA-5556-ppcw-ghh5.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5556-ppcw-ghh5", + "modified": "2024-10-09T21:31:08Z", + "published": "2024-10-09T21:31:08Z", + "aliases": [ + "CVE-2024-39515" + ], + "details": "An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.\n\nIn some cases, rpd fails to restart requiring a manual restart via the 'restart routing' CLI command.\n\nThis issue only affects systems with BGP traceoptions enabled and \n\nrequires a BGP session to be already established. Systems without BGP traceoptions enabled are not affected by this issue.\n\nThis issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.\n\nThis issue affects:\n\nJunos OS: \n\n * All versions before 21.4R3-S8, \n * 22.2 before 22.2R3-S5, \n * 22.3 before 22.3R3-S4, \n * 22.4 before 22.4R3-S3, \n * 23.2 before 23.2R2-S2, \n * 23.4 before 23.4R2; \n\n\nJunos OS Evolved: \n\n * All versions before 21.4R3-S8-EVO, \n * 22.2-EVO before 22.2R3-S5-EVO, \n * 22.3-EVO before 22.3R3-S4-EVO, \n * 22.4-EVO before 22.4R3-S3-EVO, \n * 23.2-EVO before 23.2R2-S2-EVO, \n * 23.4-EVO before 23.4R2-EVO.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39515" + }, + { + "type": "WEB", + "url": "https://supportportal.juniper.net/JSA88099" + }, + { + "type": "WEB", + "url": "https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/traceoptions-edit-protocols-bgp.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1288" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-09T20:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-gq89-59qv-xpr2/GHSA-gq89-59qv-xpr2.json b/advisories/unreviewed/2024/10/GHSA-gq89-59qv-xpr2/GHSA-gq89-59qv-xpr2.json new file mode 100644 index 00000000000..22296961677 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-gq89-59qv-xpr2/GHSA-gq89-59qv-xpr2.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gq89-59qv-xpr2", + "modified": "2024-10-09T21:31:08Z", + "published": "2024-10-09T21:31:08Z", + "aliases": [ + "CVE-2024-38818" + ], + "details": "VMware NSX contains a local privilege escalation vulnerability. \n\nAn authenticated malicious actor may exploit this vulnerability to obtain permissions from a separate group role than previously assigned.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38818" + }, + { + "type": "WEB", + "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25047" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-09T20:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-mq92-jr35-ffpc/GHSA-mq92-jr35-ffpc.json b/advisories/unreviewed/2024/10/GHSA-mq92-jr35-ffpc/GHSA-mq92-jr35-ffpc.json new file mode 100644 index 00000000000..87258bacbe4 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-mq92-jr35-ffpc/GHSA-mq92-jr35-ffpc.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mq92-jr35-ffpc", + "modified": "2024-10-09T21:31:08Z", + "published": "2024-10-09T21:31:08Z", + "aliases": [ + "CVE-2024-7038" + ], + "details": "An information disclosure vulnerability exists in open-webui version 0.3.8. The vulnerability is related to the embedding model update feature under admin settings. When a user updates the model path, the system checks if the file exists and provides different error messages based on the existence and configuration of the file. This behavior allows an attacker to enumerate file names and traverse directories by observing the error messages, leading to potential exposure of sensitive information.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7038" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/f42cf72a-8015-44a6-81a9-c6332ef05afc" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-09T19:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-qr97-x53q-9m8f/GHSA-qr97-x53q-9m8f.json b/advisories/unreviewed/2024/10/GHSA-qr97-x53q-9m8f/GHSA-qr97-x53q-9m8f.json new file mode 100644 index 00000000000..53ea04fe791 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-qr97-x53q-9m8f/GHSA-qr97-x53q-9m8f.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qr97-x53q-9m8f", + "modified": "2024-10-09T21:31:08Z", + "published": "2024-10-09T21:31:08Z", + "aliases": [ + "CVE-2024-39516" + ], + "details": "An Out-of-Bounds Read vulnerability in\n\nthe routing protocol daemon (rpd) of \n\n Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specifically malformed BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.\n\n\n\nThis issue only affects systems with BGP traceoptions enabled. Systems without BGP traceoptions enabled are not affected by this issue.\n\n\n\n\n\nThis issue affects iBGP and eBGP with \n\nany address family\n\n configured.\n\nThis issue affects:\n\nJunos OS: \n\n\n\n * All versions before 21.4R3-S8,\n * 22.2 before 22.2R3-S5, \n * 22.3 before 22.3R3-S4, \n * 22.4 before 22.4R3-S3, \n * 23.2 before 23.2R2-S2, \n * 23.4 before 23.4R2; \n\n\n\n\nJunos OS Evolved: \n\n\n\n * All versions before 21.4R3-S8-EVO, \n * 22.2-EVO before 22.2R3-S5-EVO, \n * 22.3-EVO before 22.3R3-S4-EVO, \n * 22.4-EVO before 22.4R3-S3-EVO, \n * 23.2-EVO before 23.2R2-S2-EVO, \n * 23.4-EVO before 23.4R2-EVO.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39516" + }, + { + "type": "WEB", + "url": "https://supportportal.juniper.net/JSA88100" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-09T20:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-vvj9-jphf-5vfh/GHSA-vvj9-jphf-5vfh.json b/advisories/unreviewed/2024/10/GHSA-vvj9-jphf-5vfh/GHSA-vvj9-jphf-5vfh.json new file mode 100644 index 00000000000..e907cf10476 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-vvj9-jphf-5vfh/GHSA-vvj9-jphf-5vfh.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vvj9-jphf-5vfh", + "modified": "2024-10-09T21:31:08Z", + "published": "2024-10-09T21:31:08Z", + "aliases": [ + "CVE-2024-38817" + ], + "details": "Mware NSX contains a command injection vulnerability. \n\nA malicious actor with access to the NSX Edge CLI terminal may be able to craft malicious payloads to execute arbitrary commands on the operating system as root.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38817" + }, + { + "type": "WEB", + "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25047" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-77" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-09T20:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-x5q9-723f-3q57/GHSA-x5q9-723f-3q57.json b/advisories/unreviewed/2024/10/GHSA-x5q9-723f-3q57/GHSA-x5q9-723f-3q57.json new file mode 100644 index 00000000000..8b5bcb6c55b --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-x5q9-723f-3q57/GHSA-x5q9-723f-3q57.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x5q9-723f-3q57", + "modified": "2024-10-09T21:31:08Z", + "published": "2024-10-09T21:31:08Z", + "aliases": [ + "CVE-2024-30118" + ], + "details": "HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to because of improperly handling the request data.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30118" + }, + { + "type": "WEB", + "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0114302" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-09T20:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-xcvc-5hgv-phqg/GHSA-xcvc-5hgv-phqg.json b/advisories/unreviewed/2024/10/GHSA-xcvc-5hgv-phqg/GHSA-xcvc-5hgv-phqg.json new file mode 100644 index 00000000000..3b02b516d8b --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-xcvc-5hgv-phqg/GHSA-xcvc-5hgv-phqg.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xcvc-5hgv-phqg", + "modified": "2024-10-09T21:31:08Z", + "published": "2024-10-09T21:31:08Z", + "aliases": [ + "CVE-2024-7041" + ], + "details": "An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7041" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/6855227f-1237-47b8-8d37-29aad7ddec3a" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-250" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-09T20:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-xjj4-8mx7-wf4q/GHSA-xjj4-8mx7-wf4q.json b/advisories/unreviewed/2024/10/GHSA-xjj4-8mx7-wf4q/GHSA-xjj4-8mx7-wf4q.json new file mode 100644 index 00000000000..0171d417620 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-xjj4-8mx7-wf4q/GHSA-xjj4-8mx7-wf4q.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xjj4-8mx7-wf4q", + "modified": "2024-10-09T21:31:08Z", + "published": "2024-10-09T21:31:08Z", + "aliases": [ + "CVE-2024-39525" + ], + "details": "An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker sending a specific BGP packet to cause rpd to crash and restart, resulting in a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.\n\nThis issue only affects systems with BGP traceoptions enabled and \n\nrequires a BGP session to be already established.  Systems without BGP traceoptions enabled are not affected by this issue.\n\nThis issue affects iBGP and eBGP, and both IPv4 and IPv6 are affected by this vulnerability.\n\nThis issue affects:\n\nJunos OS: \n\n\n\n * All versions before 21.2R3-S8, \n * from 21.4 before 21.4R3-S8, \n * from 22.2 before 22.2R3-S4, \n * from 22.3 before 22.3R3-S4,\n * from 22.4 before 22.4R3-S3, \n * from 23.2 before 23.2R2-S1, \n * from 23.4 before 23.4R2; \n\n\n\n\nJunos OS Evolved: \n\n\n\n * All versions before 21.2R3-S8-EVO, \n * from 21.4-EVO before 21.4R3-S8-EVO, \n * from 22.2-EVO before 22.2R3-S4-EVO, \n * from 22.3-EVO before 22.3R3-S4-EVO,\n * from 22.4-EVO before 22.4R3-S3-EVO, \n * from 23.2-EVO before 23.2R2-S1-EVO, \n * from 23.4-EVO before 23.4R2-EVO.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39525" + }, + { + "type": "WEB", + "url": "https://supportportal.juniper.net/JSA88102" + }, + { + "type": "WEB", + "url": "https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/traceoptions-edit-protocols-bgp.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-755" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-09T20:15:08Z" + } +} \ No newline at end of file