diff --git a/advisories/unreviewed/2023/12/GHSA-vpxw-7pqq-96gv/GHSA-vpxw-7pqq-96gv.json b/advisories/unreviewed/2023/12/GHSA-vpxw-7pqq-96gv/GHSA-vpxw-7pqq-96gv.json index 88c04e359bb..d1585408daf 100644 --- a/advisories/unreviewed/2023/12/GHSA-vpxw-7pqq-96gv/GHSA-vpxw-7pqq-96gv.json +++ b/advisories/unreviewed/2023/12/GHSA-vpxw-7pqq-96gv/GHSA-vpxw-7pqq-96gv.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/02/GHSA-5476-44cw-r459/GHSA-5476-44cw-r459.json b/advisories/unreviewed/2024/02/GHSA-5476-44cw-r459/GHSA-5476-44cw-r459.json index ba402938059..c105870d2d6 100644 --- a/advisories/unreviewed/2024/02/GHSA-5476-44cw-r459/GHSA-5476-44cw-r459.json +++ b/advisories/unreviewed/2024/02/GHSA-5476-44cw-r459/GHSA-5476-44cw-r459.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5476-44cw-r459", - "modified": "2024-02-21T09:31:01Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-02-21T09:31:01Z", "aliases": [ "CVE-2023-42873" ], "details": "The issue was addressed with improved bounds checks. This issue is fixed in macOS Sonoma 14.1, tvOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.1. An app may be able to execute arbitrary code with kernel privileges.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -47,7 +50,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-21T07:15:49Z" diff --git a/advisories/unreviewed/2024/02/GHSA-8xxh-r5gq-2wxg/GHSA-8xxh-r5gq-2wxg.json b/advisories/unreviewed/2024/02/GHSA-8xxh-r5gq-2wxg/GHSA-8xxh-r5gq-2wxg.json index 223ea115259..e431c31881c 100644 --- a/advisories/unreviewed/2024/02/GHSA-8xxh-r5gq-2wxg/GHSA-8xxh-r5gq-2wxg.json +++ b/advisories/unreviewed/2024/02/GHSA-8xxh-r5gq-2wxg/GHSA-8xxh-r5gq-2wxg.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-8xxh-r5gq-2wxg", - "modified": "2024-04-19T09:30:46Z", + "modified": "2024-08-28T21:31:25Z", "published": "2024-02-15T06:31:35Z", "aliases": [ "CVE-2022-23086" ], "details": "Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small.\n\nUsers with access to the mpr, mps or mpt device node may overwrite heap data, potentially resulting in privilege escalation. Note that the device node is only accessible to root and members of the operator group.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-122" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-15T05:15:09Z" diff --git a/advisories/unreviewed/2024/02/GHSA-94v8-mxjr-cfmp/GHSA-94v8-mxjr-cfmp.json b/advisories/unreviewed/2024/02/GHSA-94v8-mxjr-cfmp/GHSA-94v8-mxjr-cfmp.json index 4fea2dac423..30c8eb0a66d 100644 --- a/advisories/unreviewed/2024/02/GHSA-94v8-mxjr-cfmp/GHSA-94v8-mxjr-cfmp.json +++ b/advisories/unreviewed/2024/02/GHSA-94v8-mxjr-cfmp/GHSA-94v8-mxjr-cfmp.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-94v8-mxjr-cfmp", - "modified": "2024-02-21T21:30:25Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-02-21T21:30:25Z", "aliases": [ "CVE-2023-24333" ], "details": "A stack overflow vulnerability in Tenda AC21 with firmware version US_AC21V1.0re_V16.03.08.15_cn_TDC01 allows attackers to run arbitrary commands via crafted POST request to /goform/openSchedWifi.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-21T21:15:08Z" diff --git a/advisories/unreviewed/2024/02/GHSA-9vjq-fm4j-4r87/GHSA-9vjq-fm4j-4r87.json b/advisories/unreviewed/2024/02/GHSA-9vjq-fm4j-4r87/GHSA-9vjq-fm4j-4r87.json index d40c14e77b2..20df94563f0 100644 --- a/advisories/unreviewed/2024/02/GHSA-9vjq-fm4j-4r87/GHSA-9vjq-fm4j-4r87.json +++ b/advisories/unreviewed/2024/02/GHSA-9vjq-fm4j-4r87/GHSA-9vjq-fm4j-4r87.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9vjq-fm4j-4r87", - "modified": "2024-02-16T00:30:28Z", + "modified": "2024-08-28T21:31:25Z", "published": "2024-02-16T00:30:28Z", "aliases": [ "CVE-2023-40100" ], "details": "In discovery_thread of Dns64Configuration.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-15T23:15:07Z" diff --git a/advisories/unreviewed/2024/02/GHSA-cj4v-q99x-3m3c/GHSA-cj4v-q99x-3m3c.json b/advisories/unreviewed/2024/02/GHSA-cj4v-q99x-3m3c/GHSA-cj4v-q99x-3m3c.json index f8eab1dc671..4e1c5483af3 100644 --- a/advisories/unreviewed/2024/02/GHSA-cj4v-q99x-3m3c/GHSA-cj4v-q99x-3m3c.json +++ b/advisories/unreviewed/2024/02/GHSA-cj4v-q99x-3m3c/GHSA-cj4v-q99x-3m3c.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-cj4v-q99x-3m3c", - "modified": "2024-02-29T03:33:14Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-02-29T03:33:14Z", "aliases": [ "CVE-2023-51835" ], "details": "An issue in TRENDnet TEW-822DRE v.1.03B02 allows a local attacker to execute arbitrary code via the parameters ipv4_ping in the /boafrm/formSystemCheck.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-77" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-29T01:42:05Z" diff --git a/advisories/unreviewed/2024/02/GHSA-jfjj-5533-jmgq/GHSA-jfjj-5533-jmgq.json b/advisories/unreviewed/2024/02/GHSA-jfjj-5533-jmgq/GHSA-jfjj-5533-jmgq.json index efac5d86a86..d7de308c44f 100644 --- a/advisories/unreviewed/2024/02/GHSA-jfjj-5533-jmgq/GHSA-jfjj-5533-jmgq.json +++ b/advisories/unreviewed/2024/02/GHSA-jfjj-5533-jmgq/GHSA-jfjj-5533-jmgq.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-jfjj-5533-jmgq", - "modified": "2024-02-23T00:30:33Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-02-23T00:30:33Z", "aliases": [ "CVE-2024-25748" ], "details": "A Stack Based Buffer Overflow vulnerability in tenda AC9 AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via the fromSetIpMacBind function.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-22T23:15:07Z" diff --git a/advisories/unreviewed/2024/02/GHSA-jhq7-655w-xc9f/GHSA-jhq7-655w-xc9f.json b/advisories/unreviewed/2024/02/GHSA-jhq7-655w-xc9f/GHSA-jhq7-655w-xc9f.json index bacbeb7bb04..9177f400960 100644 --- a/advisories/unreviewed/2024/02/GHSA-jhq7-655w-xc9f/GHSA-jhq7-655w-xc9f.json +++ b/advisories/unreviewed/2024/02/GHSA-jhq7-655w-xc9f/GHSA-jhq7-655w-xc9f.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-jhq7-655w-xc9f", - "modified": "2024-02-23T00:30:33Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-02-23T00:30:33Z", "aliases": [ "CVE-2024-25746" ], "details": "Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute arbitrary code via the add_white_node function.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-22T22:15:47Z" diff --git a/advisories/unreviewed/2024/02/GHSA-mgcv-254m-jq3v/GHSA-mgcv-254m-jq3v.json b/advisories/unreviewed/2024/02/GHSA-mgcv-254m-jq3v/GHSA-mgcv-254m-jq3v.json index 852234f20df..1a3fbfeddfb 100644 --- a/advisories/unreviewed/2024/02/GHSA-mgcv-254m-jq3v/GHSA-mgcv-254m-jq3v.json +++ b/advisories/unreviewed/2024/02/GHSA-mgcv-254m-jq3v/GHSA-mgcv-254m-jq3v.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mgcv-254m-jq3v", - "modified": "2024-02-22T06:30:35Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-02-22T06:30:35Z", "aliases": [ "CVE-2024-26491" ], "details": "A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Media Gallery with description' module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Gallery name text field.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-22T06:15:57Z" diff --git a/advisories/unreviewed/2024/02/GHSA-pq2x-v8q9-52vx/GHSA-pq2x-v8q9-52vx.json b/advisories/unreviewed/2024/02/GHSA-pq2x-v8q9-52vx/GHSA-pq2x-v8q9-52vx.json index 2b9d948fe2d..0a9ad72383b 100644 --- a/advisories/unreviewed/2024/02/GHSA-pq2x-v8q9-52vx/GHSA-pq2x-v8q9-52vx.json +++ b/advisories/unreviewed/2024/02/GHSA-pq2x-v8q9-52vx/GHSA-pq2x-v8q9-52vx.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-pq2x-v8q9-52vx", - "modified": "2024-06-07T15:30:34Z", + "modified": "2024-08-28T21:31:25Z", "published": "2024-02-16T03:30:51Z", "aliases": [ "CVE-2024-25415" ], "details": "A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP code via injecting a crafted payload into the file english.php.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-16T02:15:51Z" diff --git a/advisories/unreviewed/2024/03/GHSA-2hcw-h762-x48r/GHSA-2hcw-h762-x48r.json b/advisories/unreviewed/2024/03/GHSA-2hcw-h762-x48r/GHSA-2hcw-h762-x48r.json index f04ccdcea03..97caa907a6e 100644 --- a/advisories/unreviewed/2024/03/GHSA-2hcw-h762-x48r/GHSA-2hcw-h762-x48r.json +++ b/advisories/unreviewed/2024/03/GHSA-2hcw-h762-x48r/GHSA-2hcw-h762-x48r.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-2hcw-h762-x48r", - "modified": "2024-03-11T21:31:26Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-03-11T21:31:26Z", "aliases": [ "CVE-2024-27212" ], "details": "In init_data of TBD, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-11T19:15:48Z" diff --git a/advisories/unreviewed/2024/03/GHSA-2v99-xjqr-gvw3/GHSA-2v99-xjqr-gvw3.json b/advisories/unreviewed/2024/03/GHSA-2v99-xjqr-gvw3/GHSA-2v99-xjqr-gvw3.json index 5b65a03fc35..59b59c2c838 100644 --- a/advisories/unreviewed/2024/03/GHSA-2v99-xjqr-gvw3/GHSA-2v99-xjqr-gvw3.json +++ b/advisories/unreviewed/2024/03/GHSA-2v99-xjqr-gvw3/GHSA-2v99-xjqr-gvw3.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-2v99-xjqr-gvw3", - "modified": "2024-03-11T21:31:26Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-03-11T21:31:26Z", "aliases": [ "CVE-2024-27228" ], "details": "In TBD of TBD, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-11T19:15:48Z" diff --git a/advisories/unreviewed/2024/03/GHSA-3v5f-9v4j-m9m3/GHSA-3v5f-9v4j-m9m3.json b/advisories/unreviewed/2024/03/GHSA-3v5f-9v4j-m9m3/GHSA-3v5f-9v4j-m9m3.json index e65ee3ee81b..1e844a74924 100644 --- a/advisories/unreviewed/2024/03/GHSA-3v5f-9v4j-m9m3/GHSA-3v5f-9v4j-m9m3.json +++ b/advisories/unreviewed/2024/03/GHSA-3v5f-9v4j-m9m3/GHSA-3v5f-9v4j-m9m3.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-3v5f-9v4j-m9m3", - "modified": "2024-03-29T15:30:29Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-03-29T15:30:29Z", "aliases": [ "CVE-2024-30624" ], "details": "Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the urls parameter from saveParentControlInfo function.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-29T13:15:15Z" diff --git a/advisories/unreviewed/2024/03/GHSA-4rp7-pgv4-j9jj/GHSA-4rp7-pgv4-j9jj.json b/advisories/unreviewed/2024/03/GHSA-4rp7-pgv4-j9jj/GHSA-4rp7-pgv4-j9jj.json index 258e99ced9c..23943ec802d 100644 --- a/advisories/unreviewed/2024/03/GHSA-4rp7-pgv4-j9jj/GHSA-4rp7-pgv4-j9jj.json +++ b/advisories/unreviewed/2024/03/GHSA-4rp7-pgv4-j9jj/GHSA-4rp7-pgv4-j9jj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-4rp7-pgv4-j9jj", - "modified": "2024-03-02T00:31:31Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-03-02T00:31:31Z", "aliases": [ "CVE-2023-49543" ], "details": "Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute administrative functions without authenticating.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-01T22:15:47Z" diff --git a/advisories/unreviewed/2024/03/GHSA-57gw-fhj2-2v8c/GHSA-57gw-fhj2-2v8c.json b/advisories/unreviewed/2024/03/GHSA-57gw-fhj2-2v8c/GHSA-57gw-fhj2-2v8c.json index e8dd23e47cd..53b0c73c786 100644 --- a/advisories/unreviewed/2024/03/GHSA-57gw-fhj2-2v8c/GHSA-57gw-fhj2-2v8c.json +++ b/advisories/unreviewed/2024/03/GHSA-57gw-fhj2-2v8c/GHSA-57gw-fhj2-2v8c.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-57gw-fhj2-2v8c", - "modified": "2024-03-11T18:31:08Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-03-11T18:31:08Z", "aliases": [ "CVE-2024-0048" ], "details": "In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to incorrect handling of null responses. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-230" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-11T17:15:45Z" diff --git a/advisories/unreviewed/2024/03/GHSA-5w9r-vppc-4v26/GHSA-5w9r-vppc-4v26.json b/advisories/unreviewed/2024/03/GHSA-5w9r-vppc-4v26/GHSA-5w9r-vppc-4v26.json index 89a62c82810..a6430e8aeff 100644 --- a/advisories/unreviewed/2024/03/GHSA-5w9r-vppc-4v26/GHSA-5w9r-vppc-4v26.json +++ b/advisories/unreviewed/2024/03/GHSA-5w9r-vppc-4v26/GHSA-5w9r-vppc-4v26.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5w9r-vppc-4v26", - "modified": "2024-03-11T18:31:08Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-03-11T18:31:08Z", "aliases": [ "CVE-2024-0051" ], "details": "In onQueueFilled of SoftMPEG4.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-11T17:15:45Z" diff --git a/advisories/unreviewed/2024/03/GHSA-6m6j-6mf3-699f/GHSA-6m6j-6mf3-699f.json b/advisories/unreviewed/2024/03/GHSA-6m6j-6mf3-699f/GHSA-6m6j-6mf3-699f.json index 1c1850595e8..a61ed29811e 100644 --- a/advisories/unreviewed/2024/03/GHSA-6m6j-6mf3-699f/GHSA-6m6j-6mf3-699f.json +++ b/advisories/unreviewed/2024/03/GHSA-6m6j-6mf3-699f/GHSA-6m6j-6mf3-699f.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-6m6j-6mf3-699f", - "modified": "2024-03-13T09:31:21Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-03-13T09:31:21Z", "aliases": [ "CVE-2024-26529" ], "details": "An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) via the mmsServer_handleDeleteNamedVariableListRequest function of src/mms/iso_mms/server/mms_named_variable_list_service.c.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-13T08:15:43Z" diff --git a/advisories/unreviewed/2024/03/GHSA-796v-6v2x-jgjw/GHSA-796v-6v2x-jgjw.json b/advisories/unreviewed/2024/03/GHSA-796v-6v2x-jgjw/GHSA-796v-6v2x-jgjw.json index e74b42e5100..5ab0dff822b 100644 --- a/advisories/unreviewed/2024/03/GHSA-796v-6v2x-jgjw/GHSA-796v-6v2x-jgjw.json +++ b/advisories/unreviewed/2024/03/GHSA-796v-6v2x-jgjw/GHSA-796v-6v2x-jgjw.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-796v-6v2x-jgjw", - "modified": "2024-03-11T21:31:26Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-03-11T21:31:26Z", "aliases": [ "CVE-2024-25992" ], "details": "In tmu_tz_control of tmu.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-125" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-11T19:15:47Z" diff --git a/advisories/unreviewed/2024/03/GHSA-8qf9-7xmg-5frx/GHSA-8qf9-7xmg-5frx.json b/advisories/unreviewed/2024/03/GHSA-8qf9-7xmg-5frx/GHSA-8qf9-7xmg-5frx.json index 088672861eb..b9a9bdd798c 100644 --- a/advisories/unreviewed/2024/03/GHSA-8qf9-7xmg-5frx/GHSA-8qf9-7xmg-5frx.json +++ b/advisories/unreviewed/2024/03/GHSA-8qf9-7xmg-5frx/GHSA-8qf9-7xmg-5frx.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-8qf9-7xmg-5frx", - "modified": "2024-03-28T15:30:33Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-03-28T15:30:33Z", "aliases": [ "CVE-2024-30598" ], "details": "Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-28T15:15:46Z" diff --git a/advisories/unreviewed/2024/03/GHSA-f23h-7mrr-jj25/GHSA-f23h-7mrr-jj25.json b/advisories/unreviewed/2024/03/GHSA-f23h-7mrr-jj25/GHSA-f23h-7mrr-jj25.json index 4eb090bc382..9404037ae07 100644 --- a/advisories/unreviewed/2024/03/GHSA-f23h-7mrr-jj25/GHSA-f23h-7mrr-jj25.json +++ b/advisories/unreviewed/2024/03/GHSA-f23h-7mrr-jj25/GHSA-f23h-7mrr-jj25.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-f23h-7mrr-jj25", - "modified": "2024-03-01T15:31:38Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-03-01T15:31:38Z", "aliases": [ "CVE-2024-27568" ], "details": "LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the apn_name_3g parameter in the setupEC20Apn function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-01T14:15:54Z" diff --git a/advisories/unreviewed/2024/03/GHSA-f279-w6jr-7xxj/GHSA-f279-w6jr-7xxj.json b/advisories/unreviewed/2024/03/GHSA-f279-w6jr-7xxj/GHSA-f279-w6jr-7xxj.json index 418fbe77b86..70fe2239050 100644 --- a/advisories/unreviewed/2024/03/GHSA-f279-w6jr-7xxj/GHSA-f279-w6jr-7xxj.json +++ b/advisories/unreviewed/2024/03/GHSA-f279-w6jr-7xxj/GHSA-f279-w6jr-7xxj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-f279-w6jr-7xxj", - "modified": "2024-03-04T12:31:09Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-03-04T12:31:09Z", "aliases": [ "CVE-2023-6143" ], "details": "Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user to exploit a software race condition to perform improper memory processing operations. If the system’s memory is carefully prepared by the user and the system is under heavy load, then this in turn cause a use-after-free.This issue affects Midgard GPU Kernel Driver: from r13p0 through r32p0; Bifrost GPU Kernel Driver: from r1p0 through r18p0; Valhall GPU Kernel Driver: from r37p0 through r46p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r46p0.\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-04T10:15:08Z" diff --git a/advisories/unreviewed/2024/03/GHSA-fv5c-qfh5-jjpg/GHSA-fv5c-qfh5-jjpg.json b/advisories/unreviewed/2024/03/GHSA-fv5c-qfh5-jjpg/GHSA-fv5c-qfh5-jjpg.json index bd6dff24cca..565a5d24e23 100644 --- a/advisories/unreviewed/2024/03/GHSA-fv5c-qfh5-jjpg/GHSA-fv5c-qfh5-jjpg.json +++ b/advisories/unreviewed/2024/03/GHSA-fv5c-qfh5-jjpg/GHSA-fv5c-qfh5-jjpg.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-fv5c-qfh5-jjpg", - "modified": "2024-03-28T15:30:33Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-03-28T15:30:33Z", "aliases": [ "CVE-2024-30591" ], "details": "Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the time parameter of the saveParentControlInfo function.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-28T14:15:15Z" diff --git a/advisories/unreviewed/2024/03/GHSA-gq76-mjm5-q3g9/GHSA-gq76-mjm5-q3g9.json b/advisories/unreviewed/2024/03/GHSA-gq76-mjm5-q3g9/GHSA-gq76-mjm5-q3g9.json index 48ed0b314ee..7d6f8ed2ac3 100644 --- a/advisories/unreviewed/2024/03/GHSA-gq76-mjm5-q3g9/GHSA-gq76-mjm5-q3g9.json +++ b/advisories/unreviewed/2024/03/GHSA-gq76-mjm5-q3g9/GHSA-gq76-mjm5-q3g9.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-gq76-mjm5-q3g9", - "modified": "2024-03-06T03:30:29Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-03-06T03:30:29Z", "aliases": [ "CVE-2023-33677" ], "details": "Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at \"?page=items/view&id=*\".", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-06T01:15:06Z" diff --git a/advisories/unreviewed/2024/03/GHSA-jpwr-2mxg-6vpf/GHSA-jpwr-2mxg-6vpf.json b/advisories/unreviewed/2024/03/GHSA-jpwr-2mxg-6vpf/GHSA-jpwr-2mxg-6vpf.json index a35f75a39cf..5f44baba034 100644 --- a/advisories/unreviewed/2024/03/GHSA-jpwr-2mxg-6vpf/GHSA-jpwr-2mxg-6vpf.json +++ b/advisories/unreviewed/2024/03/GHSA-jpwr-2mxg-6vpf/GHSA-jpwr-2mxg-6vpf.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-jpwr-2mxg-6vpf", - "modified": "2024-03-13T21:31:02Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-03-13T21:31:02Z", "aliases": [ "CVE-2023-41505" ], "details": "An arbitrary file upload vulnerability in the Add Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-13T21:15:53Z" diff --git a/advisories/unreviewed/2024/03/GHSA-mjv8-4hvw-795c/GHSA-mjv8-4hvw-795c.json b/advisories/unreviewed/2024/03/GHSA-mjv8-4hvw-795c/GHSA-mjv8-4hvw-795c.json index db9788e3e9f..05680a595df 100644 --- a/advisories/unreviewed/2024/03/GHSA-mjv8-4hvw-795c/GHSA-mjv8-4hvw-795c.json +++ b/advisories/unreviewed/2024/03/GHSA-mjv8-4hvw-795c/GHSA-mjv8-4hvw-795c.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mjv8-4hvw-795c", - "modified": "2024-03-13T18:31:34Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-03-13T18:31:34Z", "aliases": [ "CVE-2024-28677" ], "details": "DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/article_keywords_main.php.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-13T16:15:30Z" diff --git a/advisories/unreviewed/2024/03/GHSA-q87w-gwqw-qf29/GHSA-q87w-gwqw-qf29.json b/advisories/unreviewed/2024/03/GHSA-q87w-gwqw-qf29/GHSA-q87w-gwqw-qf29.json index af638fa67de..3fb2b93f5f5 100644 --- a/advisories/unreviewed/2024/03/GHSA-q87w-gwqw-qf29/GHSA-q87w-gwqw-qf29.json +++ b/advisories/unreviewed/2024/03/GHSA-q87w-gwqw-qf29/GHSA-q87w-gwqw-qf29.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-q87w-gwqw-qf29", - "modified": "2024-03-13T18:31:35Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-03-13T18:31:35Z", "aliases": [ "CVE-2024-28681" ], "details": "DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/plus_edit.php.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-13T16:15:30Z" diff --git a/advisories/unreviewed/2024/03/GHSA-rc7v-c4vr-3p5x/GHSA-rc7v-c4vr-3p5x.json b/advisories/unreviewed/2024/03/GHSA-rc7v-c4vr-3p5x/GHSA-rc7v-c4vr-3p5x.json index 2e994ecb45e..fe39ccea503 100644 --- a/advisories/unreviewed/2024/03/GHSA-rc7v-c4vr-3p5x/GHSA-rc7v-c4vr-3p5x.json +++ b/advisories/unreviewed/2024/03/GHSA-rc7v-c4vr-3p5x/GHSA-rc7v-c4vr-3p5x.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rc7v-c4vr-3p5x", - "modified": "2024-03-12T18:31:14Z", + "modified": "2024-08-28T21:31:26Z", "published": "2024-03-12T18:31:14Z", "aliases": [ "CVE-2024-28338" ], "details": "A login bypass in TOTOLINK A8000RU V7.1cu.643_B20200521 allows attackers to login to Administrator accounts via providing a crafted session cookie.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-12T17:15:59Z" diff --git a/advisories/unreviewed/2024/04/GHSA-3m9j-v59x-pvvm/GHSA-3m9j-v59x-pvvm.json b/advisories/unreviewed/2024/04/GHSA-3m9j-v59x-pvvm/GHSA-3m9j-v59x-pvvm.json index 85f2faf5d54..5ff75229b08 100644 --- a/advisories/unreviewed/2024/04/GHSA-3m9j-v59x-pvvm/GHSA-3m9j-v59x-pvvm.json +++ b/advisories/unreviewed/2024/04/GHSA-3m9j-v59x-pvvm/GHSA-3m9j-v59x-pvvm.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-3m9j-v59x-pvvm", - "modified": "2024-04-02T15:30:37Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-04-02T15:30:37Z", "aliases": [ "CVE-2024-29514" ], "details": "File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP file.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-434" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-02T13:15:51Z" diff --git a/advisories/unreviewed/2024/04/GHSA-89vc-qmfw-48wj/GHSA-89vc-qmfw-48wj.json b/advisories/unreviewed/2024/04/GHSA-89vc-qmfw-48wj/GHSA-89vc-qmfw-48wj.json index 46c55d85f3c..f1647e15b7a 100644 --- a/advisories/unreviewed/2024/04/GHSA-89vc-qmfw-48wj/GHSA-89vc-qmfw-48wj.json +++ b/advisories/unreviewed/2024/04/GHSA-89vc-qmfw-48wj/GHSA-89vc-qmfw-48wj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-89vc-qmfw-48wj", - "modified": "2024-04-01T21:30:47Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-04-01T21:30:47Z", "aliases": [ "CVE-2024-29435" ], "details": "An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-77" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-01T20:15:20Z" diff --git a/advisories/unreviewed/2024/04/GHSA-c4vq-6w73-6rm7/GHSA-c4vq-6w73-6rm7.json b/advisories/unreviewed/2024/04/GHSA-c4vq-6w73-6rm7/GHSA-c4vq-6w73-6rm7.json index 3cbc85a0ebc..22e90040fc0 100644 --- a/advisories/unreviewed/2024/04/GHSA-c4vq-6w73-6rm7/GHSA-c4vq-6w73-6rm7.json +++ b/advisories/unreviewed/2024/04/GHSA-c4vq-6w73-6rm7/GHSA-c4vq-6w73-6rm7.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-c4vq-6w73-6rm7", - "modified": "2024-04-04T00:33:10Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-04-04T00:33:10Z", "aliases": [ "CVE-2024-27705" ], "details": "Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted PDF file to the files/browse endpoint.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-03T22:15:06Z" diff --git a/advisories/unreviewed/2024/04/GHSA-mcfm-cxwv-vq32/GHSA-mcfm-cxwv-vq32.json b/advisories/unreviewed/2024/04/GHSA-mcfm-cxwv-vq32/GHSA-mcfm-cxwv-vq32.json index ed31c3b9f44..7f54624a151 100644 --- a/advisories/unreviewed/2024/04/GHSA-mcfm-cxwv-vq32/GHSA-mcfm-cxwv-vq32.json +++ b/advisories/unreviewed/2024/04/GHSA-mcfm-cxwv-vq32/GHSA-mcfm-cxwv-vq32.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mcfm-cxwv-vq32", - "modified": "2024-04-04T09:30:34Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-04-04T09:30:34Z", "aliases": [ "CVE-2024-30565" ], "details": "An issue was discovered in SeaCMS version 12.9, allows remote attackers to execute arbitrary code via admin notify.php.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-04T08:15:07Z" diff --git a/advisories/unreviewed/2024/04/GHSA-mv5w-wr5c-575p/GHSA-mv5w-wr5c-575p.json b/advisories/unreviewed/2024/04/GHSA-mv5w-wr5c-575p/GHSA-mv5w-wr5c-575p.json index d2e392fc54a..0d98d08c729 100644 --- a/advisories/unreviewed/2024/04/GHSA-mv5w-wr5c-575p/GHSA-mv5w-wr5c-575p.json +++ b/advisories/unreviewed/2024/04/GHSA-mv5w-wr5c-575p/GHSA-mv5w-wr5c-575p.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mv5w-wr5c-575p", - "modified": "2024-04-10T21:30:34Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-04-10T21:30:34Z", "aliases": [ "CVE-2024-31819" ], "details": "An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-10T20:15:08Z" diff --git a/advisories/unreviewed/2024/04/GHSA-pc56-3cp6-3733/GHSA-pc56-3cp6-3733.json b/advisories/unreviewed/2024/04/GHSA-pc56-3cp6-3733/GHSA-pc56-3cp6-3733.json index db66da5e8c4..1e0c09d4d5a 100644 --- a/advisories/unreviewed/2024/04/GHSA-pc56-3cp6-3733/GHSA-pc56-3cp6-3733.json +++ b/advisories/unreviewed/2024/04/GHSA-pc56-3cp6-3733/GHSA-pc56-3cp6-3733.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-pc56-3cp6-3733", - "modified": "2024-04-05T21:32:44Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-04-05T21:32:44Z", "aliases": [ "CVE-2024-29757" ], "details": "there is a possible permission bypass due to Debug certs being allowlisted. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-05T20:15:08Z" diff --git a/advisories/unreviewed/2024/04/GHSA-rhmf-g96x-3g22/GHSA-rhmf-g96x-3g22.json b/advisories/unreviewed/2024/04/GHSA-rhmf-g96x-3g22/GHSA-rhmf-g96x-3g22.json index b692332c61a..c1fe603dcee 100644 --- a/advisories/unreviewed/2024/04/GHSA-rhmf-g96x-3g22/GHSA-rhmf-g96x-3g22.json +++ b/advisories/unreviewed/2024/04/GHSA-rhmf-g96x-3g22/GHSA-rhmf-g96x-3g22.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rhmf-g96x-3g22", - "modified": "2024-04-11T06:30:35Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-04-11T06:30:35Z", "aliases": [ "CVE-2024-29399" ], "details": "An issue was discovered in GNU Savane v.3.13 and before, allows a remote attacker to execute arbitrary code and escalate privileges via a crafted file to the upload.php component.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-11T06:15:06Z" diff --git a/advisories/unreviewed/2024/04/GHSA-v3cc-gxvr-wp29/GHSA-v3cc-gxvr-wp29.json b/advisories/unreviewed/2024/04/GHSA-v3cc-gxvr-wp29/GHSA-v3cc-gxvr-wp29.json index cc4d91092ad..7ee865d6a96 100644 --- a/advisories/unreviewed/2024/04/GHSA-v3cc-gxvr-wp29/GHSA-v3cc-gxvr-wp29.json +++ b/advisories/unreviewed/2024/04/GHSA-v3cc-gxvr-wp29/GHSA-v3cc-gxvr-wp29.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-v3cc-gxvr-wp29", - "modified": "2024-04-11T06:30:34Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-04-08T21:31:16Z", "aliases": [ "CVE-2024-27631" ], "details": "Cross Site Request Forgery vulnerability in GNU Savane v.3.12 and before allows a remote attacker to escalate privileges via siteadmin/usergroup.php", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-08T21:15:10Z" diff --git a/advisories/unreviewed/2024/04/GHSA-v5f5-7fmg-8vmh/GHSA-v5f5-7fmg-8vmh.json b/advisories/unreviewed/2024/04/GHSA-v5f5-7fmg-8vmh/GHSA-v5f5-7fmg-8vmh.json index a51dd8bd65d..742fcfe4907 100644 --- a/advisories/unreviewed/2024/04/GHSA-v5f5-7fmg-8vmh/GHSA-v5f5-7fmg-8vmh.json +++ b/advisories/unreviewed/2024/04/GHSA-v5f5-7fmg-8vmh/GHSA-v5f5-7fmg-8vmh.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-v5f5-7fmg-8vmh", - "modified": "2024-04-02T06:30:31Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-04-02T06:30:31Z", "aliases": [ "CVE-2024-25187" ], "details": "Server Side Request Forgery (SSRF) vulnerability in 71cms v1.0.0, allows remote unauthenticated attackers to obtain sensitive information via getweather.html.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-918" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-02T04:15:12Z" diff --git a/advisories/unreviewed/2024/07/GHSA-53rx-4vfw-28rw/GHSA-53rx-4vfw-28rw.json b/advisories/unreviewed/2024/07/GHSA-53rx-4vfw-28rw/GHSA-53rx-4vfw-28rw.json index 3d6f5264158..41ff9141e36 100644 --- a/advisories/unreviewed/2024/07/GHSA-53rx-4vfw-28rw/GHSA-53rx-4vfw-28rw.json +++ b/advisories/unreviewed/2024/07/GHSA-53rx-4vfw-28rw/GHSA-53rx-4vfw-28rw.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-53rx-4vfw-28rw", - "modified": "2024-07-12T15:31:28Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-07-12T15:31:28Z", "aliases": [ "CVE-2024-40955" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists()\n\nWe can trigger a slab-out-of-bounds with the following commands:\n\n mkfs.ext4 -F /dev/$disk 10G\n mount /dev/$disk /tmp/test\n echo 2147483647 > /sys/fs/ext4/$disk/mb_group_prealloc\n echo test > /tmp/test/file && sync\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4]\nRead of size 8 at addr ffff888121b9d0f0 by task kworker/u2:0/11\nCPU: 0 PID: 11 Comm: kworker/u2:0 Tainted: GL 6.7.0-next-20240118 #521\nCall Trace:\n dump_stack_lvl+0x2c/0x50\n kasan_report+0xb6/0xf0\n ext4_mb_find_good_group_avg_frag_lists+0x8a/0x200 [ext4]\n ext4_mb_regular_allocator+0x19e9/0x2370 [ext4]\n ext4_mb_new_blocks+0x88a/0x1370 [ext4]\n ext4_ext_map_blocks+0x14f7/0x2390 [ext4]\n ext4_map_blocks+0x569/0xea0 [ext4]\n ext4_do_writepages+0x10f6/0x1bc0 [ext4]\n[...]\n==================================================================\n\nThe flow of issue triggering is as follows:\n\n// Set s_mb_group_prealloc to 2147483647 via sysfs\next4_mb_new_blocks\n ext4_mb_normalize_request\n ext4_mb_normalize_group_request\n ac->ac_g_ex.fe_len = EXT4_SB(sb)->s_mb_group_prealloc\n ext4_mb_regular_allocator\n ext4_mb_choose_next_group\n ext4_mb_choose_next_group_best_avail\n mb_avg_fragment_size_order\n order = fls(len) - 2 = 29\n ext4_mb_find_good_group_avg_frag_lists\n frag_list = &sbi->s_mb_avg_fragment_size[order]\n if (list_empty(frag_list)) // Trigger SOOB!\n\nAt 4k block size, the length of the s_mb_avg_fragment_size list is 14,\nbut an oversized s_mb_group_prealloc is set, causing slab-out-of-bounds\nto be triggered by an attempt to access an element at index 29.\n\nAdd a new attr_id attr_clusters_in_group with values in the range\n[0, sbi->s_clusters_per_group] and declare mb_group_prealloc as\nthat type to fix the issue. In addition avoid returning an order\nfrom mb_avg_fragment_size_order() greater than MB_NUM_ORDERS(sb)\nand reduce some useless loops.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-12T13:15:17Z" diff --git a/advisories/unreviewed/2024/07/GHSA-68p8-jjxw-w2v4/GHSA-68p8-jjxw-w2v4.json b/advisories/unreviewed/2024/07/GHSA-68p8-jjxw-w2v4/GHSA-68p8-jjxw-w2v4.json index e8e80bcae95..dc447d74bb3 100644 --- a/advisories/unreviewed/2024/07/GHSA-68p8-jjxw-w2v4/GHSA-68p8-jjxw-w2v4.json +++ b/advisories/unreviewed/2024/07/GHSA-68p8-jjxw-w2v4/GHSA-68p8-jjxw-w2v4.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-68p8-jjxw-w2v4", - "modified": "2024-07-12T15:31:28Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-07-12T15:31:28Z", "aliases": [ "CVE-2024-40954" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: do not leave a dangling sk pointer, when socket creation fails\n\nIt is possible to trigger a use-after-free by:\n * attaching an fentry probe to __sock_release() and the probe calling the\n bpf_get_socket_cookie() helper\n * running traceroute -I 1.1.1.1 on a freshly booted VM\n\nA KASAN enabled kernel will log something like below (decoded and stripped):\n==================================================================\nBUG: KASAN: slab-use-after-free in __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\nRead of size 8 at addr ffff888007110dd8 by task traceroute/299\n\nCPU: 2 PID: 299 Comm: traceroute Tainted: G E 6.10.0-rc2+ #2\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\nCall Trace:\n \ndump_stack_lvl (lib/dump_stack.c:117 (discriminator 1))\nprint_report (mm/kasan/report.c:378 mm/kasan/report.c:488)\n? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\nkasan_report (mm/kasan/report.c:603)\n? __sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\nkasan_check_range (mm/kasan/generic.c:183 mm/kasan/generic.c:189)\n__sock_gen_cookie (./arch/x86/include/asm/atomic64_64.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29)\nbpf_get_socket_ptr_cookie (./arch/x86/include/asm/preempt.h:94 ./include/linux/sock_diag.h:42 net/core/filter.c:5094 net/core/filter.c:5092)\nbpf_prog_875642cf11f1d139___sock_release+0x6e/0x8e\nbpf_trampoline_6442506592+0x47/0xaf\n__sock_release (net/socket.c:652)\n__sock_create (net/socket.c:1601)\n...\nAllocated by task 299 on cpu 2 at 78.328492s:\nkasan_save_stack (mm/kasan/common.c:48)\nkasan_save_track (mm/kasan/common.c:68)\n__kasan_slab_alloc (mm/kasan/common.c:312 mm/kasan/common.c:338)\nkmem_cache_alloc_noprof (mm/slub.c:3941 mm/slub.c:4000 mm/slub.c:4007)\nsk_prot_alloc (net/core/sock.c:2075)\nsk_alloc (net/core/sock.c:2134)\ninet_create (net/ipv4/af_inet.c:327 net/ipv4/af_inet.c:252)\n__sock_create (net/socket.c:1572)\n__sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706)\n__x64_sys_socket (net/socket.c:1718)\ndo_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nFreed by task 299 on cpu 2 at 78.328502s:\nkasan_save_stack (mm/kasan/common.c:48)\nkasan_save_track (mm/kasan/common.c:68)\nkasan_save_free_info (mm/kasan/generic.c:582)\npoison_slab_object (mm/kasan/common.c:242)\n__kasan_slab_free (mm/kasan/common.c:256)\nkmem_cache_free (mm/slub.c:4437 mm/slub.c:4511)\n__sk_destruct (net/core/sock.c:2117 net/core/sock.c:2208)\ninet_create (net/ipv4/af_inet.c:397 net/ipv4/af_inet.c:252)\n__sock_create (net/socket.c:1572)\n__sys_socket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706)\n__x64_sys_socket (net/socket.c:1718)\ndo_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\n\nFix this by clearing the struct socket reference in sk_common_release() to cover\nall protocol families create functions, which may already attached the\nreference to the sk object with sock_init_data().", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -41,9 +44,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-12T13:15:17Z" diff --git a/advisories/unreviewed/2024/07/GHSA-68wq-8vpf-v9v8/GHSA-68wq-8vpf-v9v8.json b/advisories/unreviewed/2024/07/GHSA-68wq-8vpf-v9v8/GHSA-68wq-8vpf-v9v8.json index 25e457b5be8..057d87e2471 100644 --- a/advisories/unreviewed/2024/07/GHSA-68wq-8vpf-v9v8/GHSA-68wq-8vpf-v9v8.json +++ b/advisories/unreviewed/2024/07/GHSA-68wq-8vpf-v9v8/GHSA-68wq-8vpf-v9v8.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-68wq-8vpf-v9v8", - "modified": "2024-07-12T15:31:28Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-07-12T15:31:28Z", "aliases": [ "CVE-2024-40959" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()\n\nip6_dst_idev() can return NULL, xfrm6_get_saddr() must act accordingly.\n\nsyzbot reported:\n\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 1 PID: 12 Comm: kworker/u8:1 Not tainted 6.10.0-rc2-syzkaller-00383-gb8481381d4e2 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024\nWorkqueue: wg-kex-wg1 wg_packet_handshake_send_worker\n RIP: 0010:xfrm6_get_saddr+0x93/0x130 net/ipv6/xfrm6_policy.c:64\nCode: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 97 00 00 00 4c 8b ab d8 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 ea 48 c1 ea 03 <80> 3c 02 00 0f 85 86 00 00 00 4d 8b 6d 00 e8 ca 13 47 01 48 b8 00\nRSP: 0018:ffffc90000117378 EFLAGS: 00010246\nRAX: dffffc0000000000 RBX: ffff88807b079dc0 RCX: ffffffff89a0d6d7\nRDX: 0000000000000000 RSI: ffffffff89a0d6e9 RDI: ffff88807b079e98\nRBP: ffff88807ad73248 R08: 0000000000000007 R09: fffffffffffff000\nR10: ffff88807b079dc0 R11: 0000000000000007 R12: ffffc90000117480\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\nFS: 0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f4586d00440 CR3: 0000000079042000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \n xfrm_get_saddr net/xfrm/xfrm_policy.c:2452 [inline]\n xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2481 [inline]\n xfrm_tmpl_resolve+0xa26/0xf10 net/xfrm/xfrm_policy.c:2541\n xfrm_resolve_and_create_bundle+0x140/0x2570 net/xfrm/xfrm_policy.c:2835\n xfrm_bundle_lookup net/xfrm/xfrm_policy.c:3070 [inline]\n xfrm_lookup_with_ifid+0x4d1/0x1e60 net/xfrm/xfrm_policy.c:3201\n xfrm_lookup net/xfrm/xfrm_policy.c:3298 [inline]\n xfrm_lookup_route+0x3b/0x200 net/xfrm/xfrm_policy.c:3309\n ip6_dst_lookup_flow+0x15c/0x1d0 net/ipv6/ip6_output.c:1256\n send6+0x611/0xd20 drivers/net/wireguard/socket.c:139\n wg_socket_send_skb_to_peer+0xf9/0x220 drivers/net/wireguard/socket.c:178\n wg_socket_send_buffer_to_peer+0x12b/0x190 drivers/net/wireguard/socket.c:200\n wg_packet_send_handshake_initiation+0x227/0x360 drivers/net/wireguard/send.c:40\n wg_packet_handshake_send_worker+0x1c/0x30 drivers/net/wireguard/send.c:51\n process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231\n process_scheduled_works kernel/workqueue.c:3312 [inline]\n worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393\n kthread+0x2c1/0x3a0 kernel/kthread.c:389\n ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -53,9 +56,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-12T13:15:17Z" diff --git a/advisories/unreviewed/2024/07/GHSA-77p5-68v4-943h/GHSA-77p5-68v4-943h.json b/advisories/unreviewed/2024/07/GHSA-77p5-68v4-943h/GHSA-77p5-68v4-943h.json index 1e0f0dde4b2..41ce9ca99d8 100644 --- a/advisories/unreviewed/2024/07/GHSA-77p5-68v4-943h/GHSA-77p5-68v4-943h.json +++ b/advisories/unreviewed/2024/07/GHSA-77p5-68v4-943h/GHSA-77p5-68v4-943h.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-77p5-68v4-943h", - "modified": "2024-07-12T15:31:26Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-07-12T15:31:26Z", "aliases": [ "CVE-2024-39510" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read()\n\nWe got the following issue in a fuzz test of randomly issuing the restore\ncommand:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0xb41/0xb60\nRead of size 8 at addr ffff888122e84088 by task ondemand-04-dae/963\n\nCPU: 13 PID: 963 Comm: ondemand-04-dae Not tainted 6.8.0-dirty #564\nCall Trace:\n kasan_report+0x93/0xc0\n cachefiles_ondemand_daemon_read+0xb41/0xb60\n vfs_read+0x169/0xb50\n ksys_read+0xf5/0x1e0\n\nAllocated by task 116:\n kmem_cache_alloc+0x140/0x3a0\n cachefiles_lookup_cookie+0x140/0xcd0\n fscache_cookie_state_machine+0x43c/0x1230\n [...]\n\nFreed by task 792:\n kmem_cache_free+0xfe/0x390\n cachefiles_put_object+0x241/0x480\n fscache_cookie_state_machine+0x5c8/0x1230\n [...]\n==================================================================\n\nFollowing is the process that triggers the issue:\n\n mount | daemon_thread1 | daemon_thread2\n------------------------------------------------------------\ncachefiles_withdraw_cookie\n cachefiles_ondemand_clean_object(object)\n cachefiles_ondemand_send_req\n REQ_A = kzalloc(sizeof(*req) + data_len)\n wait_for_completion(&REQ_A->done)\n\n cachefiles_daemon_read\n cachefiles_ondemand_daemon_read\n REQ_A = cachefiles_ondemand_select_req\n msg->object_id = req->object->ondemand->ondemand_id\n ------ restore ------\n cachefiles_ondemand_restore\n xas_for_each(&xas, req, ULONG_MAX)\n xas_set_mark(&xas, CACHEFILES_REQ_NEW)\n\n cachefiles_daemon_read\n cachefiles_ondemand_daemon_read\n REQ_A = cachefiles_ondemand_select_req\n copy_to_user(_buffer, msg, n)\n xa_erase(&cache->reqs, id)\n complete(&REQ_A->done)\n ------ close(fd) ------\n cachefiles_ondemand_fd_release\n cachefiles_put_object\n cachefiles_put_object\n kmem_cache_free(cachefiles_object_jar, object)\n REQ_A->object->ondemand->ondemand_id\n // object UAF !!!\n\nWhen we see the request within xa_lock, req->object must not have been\nfreed yet, so grab the reference count of object before xa_unlock to\navoid the above issue.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-12T13:15:13Z" diff --git a/advisories/unreviewed/2024/07/GHSA-8jvx-wqf8-m6ph/GHSA-8jvx-wqf8-m6ph.json b/advisories/unreviewed/2024/07/GHSA-8jvx-wqf8-m6ph/GHSA-8jvx-wqf8-m6ph.json index 4d24a293d45..7924648db39 100644 --- a/advisories/unreviewed/2024/07/GHSA-8jvx-wqf8-m6ph/GHSA-8jvx-wqf8-m6ph.json +++ b/advisories/unreviewed/2024/07/GHSA-8jvx-wqf8-m6ph/GHSA-8jvx-wqf8-m6ph.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-8jvx-wqf8-m6ph", - "modified": "2024-07-12T15:31:26Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-07-12T15:31:26Z", "aliases": [ "CVE-2024-40899" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: fix slab-use-after-free in cachefiles_ondemand_get_fd()\n\nWe got the following issue in a fuzz test of randomly issuing the restore\ncommand:\n\n==================================================================\nBUG: KASAN: slab-use-after-free in cachefiles_ondemand_daemon_read+0x609/0xab0\nWrite of size 4 at addr ffff888109164a80 by task ondemand-04-dae/4962\n\nCPU: 11 PID: 4962 Comm: ondemand-04-dae Not tainted 6.8.0-rc7-dirty #542\nCall Trace:\n kasan_report+0x94/0xc0\n cachefiles_ondemand_daemon_read+0x609/0xab0\n vfs_read+0x169/0xb50\n ksys_read+0xf5/0x1e0\n\nAllocated by task 626:\n __kmalloc+0x1df/0x4b0\n cachefiles_ondemand_send_req+0x24d/0x690\n cachefiles_create_tmpfile+0x249/0xb30\n cachefiles_create_file+0x6f/0x140\n cachefiles_look_up_object+0x29c/0xa60\n cachefiles_lookup_cookie+0x37d/0xca0\n fscache_cookie_state_machine+0x43c/0x1230\n [...]\n\nFreed by task 626:\n kfree+0xf1/0x2c0\n cachefiles_ondemand_send_req+0x568/0x690\n cachefiles_create_tmpfile+0x249/0xb30\n cachefiles_create_file+0x6f/0x140\n cachefiles_look_up_object+0x29c/0xa60\n cachefiles_lookup_cookie+0x37d/0xca0\n fscache_cookie_state_machine+0x43c/0x1230\n [...]\n==================================================================\n\nFollowing is the process that triggers the issue:\n\n mount | daemon_thread1 | daemon_thread2\n------------------------------------------------------------\n cachefiles_ondemand_init_object\n cachefiles_ondemand_send_req\n REQ_A = kzalloc(sizeof(*req) + data_len)\n wait_for_completion(&REQ_A->done)\n\n cachefiles_daemon_read\n cachefiles_ondemand_daemon_read\n REQ_A = cachefiles_ondemand_select_req\n cachefiles_ondemand_get_fd\n copy_to_user(_buffer, msg, n)\n process_open_req(REQ_A)\n ------ restore ------\n cachefiles_ondemand_restore\n xas_for_each(&xas, req, ULONG_MAX)\n xas_set_mark(&xas, CACHEFILES_REQ_NEW);\n\n cachefiles_daemon_read\n cachefiles_ondemand_daemon_read\n REQ_A = cachefiles_ondemand_select_req\n\n write(devfd, (\"copen %u,%llu\", msg->msg_id, size));\n cachefiles_ondemand_copen\n xa_erase(&cache->reqs, id)\n complete(&REQ_A->done)\n kfree(REQ_A)\n cachefiles_ondemand_get_fd(REQ_A)\n fd = get_unused_fd_flags\n file = anon_inode_getfile\n fd_install(fd, file)\n load = (void *)REQ_A->msg.data;\n load->fd = fd;\n // load UAF !!!\n\nThis issue is caused by issuing a restore command when the daemon is still\nalive, which results in a request being processed multiple times thus\ntriggering a UAF. So to avoid this problem, add an additional reference\ncount to cachefiles_req, which is held while waiting and reading, and then\nreleased when the waiting and reading is over.\n\nNote that since there is only one reference count for waiting, we need to\navoid the same request being completed multiple times, so we can only\ncomplete the request if it is successfully removed from the xarray.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-12T13:15:13Z" diff --git a/advisories/unreviewed/2024/07/GHSA-8rq2-2hq7-cqr5/GHSA-8rq2-2hq7-cqr5.json b/advisories/unreviewed/2024/07/GHSA-8rq2-2hq7-cqr5/GHSA-8rq2-2hq7-cqr5.json index 3d18adfe5de..5f832cc4457 100644 --- a/advisories/unreviewed/2024/07/GHSA-8rq2-2hq7-cqr5/GHSA-8rq2-2hq7-cqr5.json +++ b/advisories/unreviewed/2024/07/GHSA-8rq2-2hq7-cqr5/GHSA-8rq2-2hq7-cqr5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-8rq2-2hq7-cqr5", - "modified": "2024-07-12T15:31:28Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-07-12T15:31:28Z", "aliases": [ "CVE-2024-40958" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetns: Make get_net_ns() handle zero refcount net\n\nSyzkaller hit a warning:\nrefcount_t: addition on 0; use-after-free.\nWARNING: CPU: 3 PID: 7890 at lib/refcount.c:25 refcount_warn_saturate+0xdf/0x1d0\nModules linked in:\nCPU: 3 PID: 7890 Comm: tun Not tainted 6.10.0-rc3-00100-gcaa4f9578aba-dirty #310\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nRIP: 0010:refcount_warn_saturate+0xdf/0x1d0\nCode: 41 49 04 31 ff 89 de e8 9f 1e cd fe 84 db 75 9c e8 76 26 cd fe c6 05 b6 41 49 04 01 90 48 c7 c7 b8 8e 25 86 e8 d2 05 b5 fe 90 <0f> 0b 90 90 e9 79 ff ff ff e8 53 26 cd fe 0f b6 1\nRSP: 0018:ffff8881067b7da0 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff811c72ac\nRDX: ffff8881026a2140 RSI: ffffffff811c72b5 RDI: 0000000000000001\nRBP: ffff8881067b7db0 R08: 0000000000000000 R09: 205b5d3730353139\nR10: 0000000000000000 R11: 205d303938375420 R12: ffff8881086500c4\nR13: ffff8881086500c4 R14: ffff8881086500b0 R15: ffff888108650040\nFS: 00007f5b2961a4c0(0000) GS:ffff88823bd00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000055d7ed36fd18 CR3: 00000001482f6000 CR4: 00000000000006f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \n ? show_regs+0xa3/0xc0\n ? __warn+0xa5/0x1c0\n ? refcount_warn_saturate+0xdf/0x1d0\n ? report_bug+0x1fc/0x2d0\n ? refcount_warn_saturate+0xdf/0x1d0\n ? handle_bug+0xa1/0x110\n ? exc_invalid_op+0x3c/0xb0\n ? asm_exc_invalid_op+0x1f/0x30\n ? __warn_printk+0xcc/0x140\n ? __warn_printk+0xd5/0x140\n ? refcount_warn_saturate+0xdf/0x1d0\n get_net_ns+0xa4/0xc0\n ? __pfx_get_net_ns+0x10/0x10\n open_related_ns+0x5a/0x130\n __tun_chr_ioctl+0x1616/0x2370\n ? __sanitizer_cov_trace_switch+0x58/0xa0\n ? __sanitizer_cov_trace_const_cmp2+0x1c/0x30\n ? __pfx_tun_chr_ioctl+0x10/0x10\n tun_chr_ioctl+0x2f/0x40\n __x64_sys_ioctl+0x11b/0x160\n x64_sys_call+0x1211/0x20d0\n do_syscall_64+0x9e/0x1d0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f5b28f165d7\nCode: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 8\nRSP: 002b:00007ffc2b59c5e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5b28f165d7\nRDX: 0000000000000000 RSI: 00000000000054e3 RDI: 0000000000000003\nRBP: 00007ffc2b59c650 R08: 00007f5b291ed8c0 R09: 00007f5b2961a4c0\nR10: 0000000029690010 R11: 0000000000000246 R12: 0000000000400730\nR13: 00007ffc2b59cf40 R14: 0000000000000000 R15: 0000000000000000\n \nKernel panic - not syncing: kernel: panic_on_warn set ...\n\nThis is trigger as below:\n ns0 ns1\ntun_set_iff() //dev is tun0\n tun->dev = dev\n//ip link set tun0 netns ns1\n put_net() //ref is 0\n__tun_chr_ioctl() //TUNGETDEVNETNS\n net = dev_net(tun->dev);\n open_related_ns(&net->ns, get_net_ns); //ns1\n get_net_ns()\n get_net() //addition on 0\n\nUse maybe_get_net() in get_net_ns in case net's ref is zero to fix this", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-12T13:15:17Z" diff --git a/advisories/unreviewed/2024/07/GHSA-968h-6229-65gg/GHSA-968h-6229-65gg.json b/advisories/unreviewed/2024/07/GHSA-968h-6229-65gg/GHSA-968h-6229-65gg.json index 52bd95d8d3b..02c3bc6e5dd 100644 --- a/advisories/unreviewed/2024/07/GHSA-968h-6229-65gg/GHSA-968h-6229-65gg.json +++ b/advisories/unreviewed/2024/07/GHSA-968h-6229-65gg/GHSA-968h-6229-65gg.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-968h-6229-65gg", - "modified": "2024-07-12T15:31:28Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-07-12T15:31:28Z", "aliases": [ "CVE-2024-40957" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nseg6: fix parameter passing when calling NF_HOOK() in End.DX4 and End.DX6 behaviors\n\ninput_action_end_dx4() and input_action_end_dx6() are called NF_HOOK() for\nPREROUTING hook, in PREROUTING hook, we should passing a valid indev,\nand a NULL outdev to NF_HOOK(), otherwise may trigger a NULL pointer\ndereference, as below:\n\n [74830.647293] BUG: kernel NULL pointer dereference, address: 0000000000000090\n [74830.655633] #PF: supervisor read access in kernel mode\n [74830.657888] #PF: error_code(0x0000) - not-present page\n [74830.659500] PGD 0 P4D 0\n [74830.660450] Oops: 0000 [#1] PREEMPT SMP PTI\n ...\n [74830.664953] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011\n [74830.666569] RIP: 0010:rpfilter_mt+0x44/0x15e [ipt_rpfilter]\n ...\n [74830.689725] Call Trace:\n [74830.690402] \n [74830.690953] ? show_trace_log_lvl+0x1c4/0x2df\n [74830.692020] ? show_trace_log_lvl+0x1c4/0x2df\n [74830.693095] ? ipt_do_table+0x286/0x710 [ip_tables]\n [74830.694275] ? __die_body.cold+0x8/0xd\n [74830.695205] ? page_fault_oops+0xac/0x140\n [74830.696244] ? exc_page_fault+0x62/0x150\n [74830.697225] ? asm_exc_page_fault+0x22/0x30\n [74830.698344] ? rpfilter_mt+0x44/0x15e [ipt_rpfilter]\n [74830.699540] ipt_do_table+0x286/0x710 [ip_tables]\n [74830.700758] ? ip6_route_input+0x19d/0x240\n [74830.701752] nf_hook_slow+0x3f/0xb0\n [74830.702678] input_action_end_dx4+0x19b/0x1e0\n [74830.703735] ? input_action_end_t+0xe0/0xe0\n [74830.704734] seg6_local_input_core+0x2d/0x60\n [74830.705782] lwtunnel_input+0x5b/0xb0\n [74830.706690] __netif_receive_skb_one_core+0x63/0xa0\n [74830.707825] process_backlog+0x99/0x140\n [74830.709538] __napi_poll+0x2c/0x160\n [74830.710673] net_rx_action+0x296/0x350\n [74830.711860] __do_softirq+0xcb/0x2ac\n [74830.713049] do_softirq+0x63/0x90\n\ninput_action_end_dx4() passing a NULL indev to NF_HOOK(), and finally\ntrigger a NULL dereference in rpfilter_mt()->rpfilter_is_loopback():\n\n static bool\n rpfilter_is_loopback(const struct sk_buff *skb,\n \t const struct net_device *in)\n {\n // in is NULL\n return skb->pkt_type == PACKET_LOOPBACK ||\n \t in->flags & IFF_LOOPBACK;\n }", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -41,9 +44,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-12T13:15:17Z" diff --git a/advisories/unreviewed/2024/07/GHSA-cf4c-955g-mjxm/GHSA-cf4c-955g-mjxm.json b/advisories/unreviewed/2024/07/GHSA-cf4c-955g-mjxm/GHSA-cf4c-955g-mjxm.json index 23be4f11b94..63218aa0541 100644 --- a/advisories/unreviewed/2024/07/GHSA-cf4c-955g-mjxm/GHSA-cf4c-955g-mjxm.json +++ b/advisories/unreviewed/2024/07/GHSA-cf4c-955g-mjxm/GHSA-cf4c-955g-mjxm.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-cf4c-955g-mjxm", - "modified": "2024-07-12T15:31:26Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-07-12T15:31:26Z", "aliases": [ "CVE-2024-39504" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_inner: validate mandatory meta and payload\n\nCheck for mandatory netlink attributes in payload and meta expression\nwhen used embedded from the inner expression, otherwise NULL pointer\ndereference is possible from userspace.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-12T13:15:12Z" diff --git a/advisories/unreviewed/2024/07/GHSA-g9fw-749r-g6j2/GHSA-g9fw-749r-g6j2.json b/advisories/unreviewed/2024/07/GHSA-g9fw-749r-g6j2/GHSA-g9fw-749r-g6j2.json index 1bb545821ac..84d41d6dc97 100644 --- a/advisories/unreviewed/2024/07/GHSA-g9fw-749r-g6j2/GHSA-g9fw-749r-g6j2.json +++ b/advisories/unreviewed/2024/07/GHSA-g9fw-749r-g6j2/GHSA-g9fw-749r-g6j2.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-g9fw-749r-g6j2", - "modified": "2024-07-12T15:31:28Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-07-12T15:31:28Z", "aliases": [ "CVE-2024-40934" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: logitech-dj: Fix memory leak in logi_dj_recv_switch_to_dj_mode()\n\nFix a memory leak on logi_dj_recv_send_report() error path.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -49,9 +52,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-401" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-12T13:15:15Z" diff --git a/advisories/unreviewed/2024/07/GHSA-m9m2-8mh5-2h2v/GHSA-m9m2-8mh5-2h2v.json b/advisories/unreviewed/2024/07/GHSA-m9m2-8mh5-2h2v/GHSA-m9m2-8mh5-2h2v.json index f63a4f91596..6b6984cacf0 100644 --- a/advisories/unreviewed/2024/07/GHSA-m9m2-8mh5-2h2v/GHSA-m9m2-8mh5-2h2v.json +++ b/advisories/unreviewed/2024/07/GHSA-m9m2-8mh5-2h2v/GHSA-m9m2-8mh5-2h2v.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-m9m2-8mh5-2h2v", - "modified": "2024-07-12T15:31:26Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-07-12T15:31:26Z", "aliases": [ "CVE-2024-39506" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nliquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet\n\nIn lio_vf_rep_copy_packet() pg_info->page is compared to a NULL value,\nbut then it is unconditionally passed to skb_add_rx_frag() which looks\nstrange and could lead to null pointer dereference.\n\nlio_vf_rep_copy_packet() call trace looks like:\n\tocteon_droq_process_packets\n\t octeon_droq_fast_process_packets\n\t octeon_droq_dispatch_pkt\n\t octeon_create_recv_info\n\t ...search in the dispatch_list...\n\t ->disp_fn(rdisp->rinfo, ...)\n\t lio_vf_rep_pkt_recv(struct octeon_recv_info *recv_info, ...)\nIn this path there is no code which sets pg_info->page to NULL.\nSo this check looks unneeded and doesn't solve potential problem.\nBut I guess the author had reason to add a check and I have no such card\nand can't do real test.\nIn addition, the code in the function liquidio_push_packet() in\nliquidio/lio_core.c does exactly the same.\n\nBased on this, I consider the most acceptable compromise solution to\nadjust this issue by moving skb_add_rx_frag() into conditional scope.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -53,9 +56,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-12T13:15:12Z" diff --git a/advisories/unreviewed/2024/07/GHSA-wm27-9pvg-gq5h/GHSA-wm27-9pvg-gq5h.json b/advisories/unreviewed/2024/07/GHSA-wm27-9pvg-gq5h/GHSA-wm27-9pvg-gq5h.json index 25168ace86d..ee14dbf8266 100644 --- a/advisories/unreviewed/2024/07/GHSA-wm27-9pvg-gq5h/GHSA-wm27-9pvg-gq5h.json +++ b/advisories/unreviewed/2024/07/GHSA-wm27-9pvg-gq5h/GHSA-wm27-9pvg-gq5h.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-wm27-9pvg-gq5h", - "modified": "2024-07-12T15:31:28Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-07-12T15:31:28Z", "aliases": [ "CVE-2024-40932" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/exynos/vidi: fix memory leak in .get_modes()\n\nThe duplicated EDID is never freed. Fix it.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -53,9 +56,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-401" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-12T13:15:15Z" diff --git a/advisories/unreviewed/2024/07/GHSA-xqjr-37f7-78rr/GHSA-xqjr-37f7-78rr.json b/advisories/unreviewed/2024/07/GHSA-xqjr-37f7-78rr/GHSA-xqjr-37f7-78rr.json index 55cd3eefb1e..339a04b5be6 100644 --- a/advisories/unreviewed/2024/07/GHSA-xqjr-37f7-78rr/GHSA-xqjr-37f7-78rr.json +++ b/advisories/unreviewed/2024/07/GHSA-xqjr-37f7-78rr/GHSA-xqjr-37f7-78rr.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-xqjr-37f7-78rr", - "modified": "2024-07-12T15:31:28Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-07-12T15:31:28Z", "aliases": [ "CVE-2024-40956" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list\n\nUse list_for_each_entry_safe() to allow iterating through the list and\ndeleting the entry in the iteration process. The descriptor is freed via\nidxd_desc_complete() and there's a slight chance may cause issue for\nthe list iterator when the descriptor is reused by another thread\nwithout it being deleted from the list.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -41,9 +44,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-12T13:15:17Z" diff --git a/advisories/unreviewed/2024/08/GHSA-52g6-2pfv-hfcq/GHSA-52g6-2pfv-hfcq.json b/advisories/unreviewed/2024/08/GHSA-52g6-2pfv-hfcq/GHSA-52g6-2pfv-hfcq.json index 264284deb0e..d17a0d5a4e3 100644 --- a/advisories/unreviewed/2024/08/GHSA-52g6-2pfv-hfcq/GHSA-52g6-2pfv-hfcq.json +++ b/advisories/unreviewed/2024/08/GHSA-52g6-2pfv-hfcq/GHSA-52g6-2pfv-hfcq.json @@ -1,13 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-52g6-2pfv-hfcq", - "modified": "2024-08-16T15:31:41Z", + "modified": "2024-08-28T21:31:28Z", "published": "2024-08-16T15:31:41Z", "aliases": [ "CVE-2024-42465" ], "details": "Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" diff --git a/advisories/unreviewed/2024/08/GHSA-5fjm-vv45-vv2w/GHSA-5fjm-vv45-vv2w.json b/advisories/unreviewed/2024/08/GHSA-5fjm-vv45-vv2w/GHSA-5fjm-vv45-vv2w.json index 9950019048c..fd36c74e67f 100644 --- a/advisories/unreviewed/2024/08/GHSA-5fjm-vv45-vv2w/GHSA-5fjm-vv45-vv2w.json +++ b/advisories/unreviewed/2024/08/GHSA-5fjm-vv45-vv2w/GHSA-5fjm-vv45-vv2w.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5fjm-vv45-vv2w", - "modified": "2024-08-28T18:31:55Z", + "modified": "2024-08-28T21:31:28Z", "published": "2024-08-28T18:31:55Z", "aliases": [ "CVE-2024-44913" ], "details": "An issue in the component EXR!ReadEXR+0x40ef1 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability can lead to a Denial of Service (DoS).", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-28T18:15:09Z" diff --git a/advisories/unreviewed/2024/08/GHSA-75q5-8jhm-6829/GHSA-75q5-8jhm-6829.json b/advisories/unreviewed/2024/08/GHSA-75q5-8jhm-6829/GHSA-75q5-8jhm-6829.json index d6b2b70582b..d8c47214873 100644 --- a/advisories/unreviewed/2024/08/GHSA-75q5-8jhm-6829/GHSA-75q5-8jhm-6829.json +++ b/advisories/unreviewed/2024/08/GHSA-75q5-8jhm-6829/GHSA-75q5-8jhm-6829.json @@ -1,13 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-75q5-8jhm-6829", - "modified": "2024-08-16T15:31:41Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-08-16T15:31:41Z", "aliases": [ "CVE-2024-42464" ], "details": "Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" diff --git a/advisories/unreviewed/2024/08/GHSA-fhxh-jfcp-fmv9/GHSA-fhxh-jfcp-fmv9.json b/advisories/unreviewed/2024/08/GHSA-fhxh-jfcp-fmv9/GHSA-fhxh-jfcp-fmv9.json index f1e080e8587..6e51d8a41ca 100644 --- a/advisories/unreviewed/2024/08/GHSA-fhxh-jfcp-fmv9/GHSA-fhxh-jfcp-fmv9.json +++ b/advisories/unreviewed/2024/08/GHSA-fhxh-jfcp-fmv9/GHSA-fhxh-jfcp-fmv9.json @@ -1,13 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-fhxh-jfcp-fmv9", - "modified": "2024-08-16T15:31:41Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-08-16T15:31:41Z", "aliases": [ "CVE-2024-42463" ], "details": "Authorization Bypass Through User-Controlled Key vulnerability in upKeeper Solutions product upKeeper Manager allows Utilizing REST's Trust in the System Resource to Obtain Sensitive Data.This issue affects upKeeper Manager: through 5.1.9.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" diff --git a/advisories/unreviewed/2024/08/GHSA-hvw3-j8wv-xpg5/GHSA-hvw3-j8wv-xpg5.json b/advisories/unreviewed/2024/08/GHSA-hvw3-j8wv-xpg5/GHSA-hvw3-j8wv-xpg5.json index a115a299739..b985ac5780b 100644 --- a/advisories/unreviewed/2024/08/GHSA-hvw3-j8wv-xpg5/GHSA-hvw3-j8wv-xpg5.json +++ b/advisories/unreviewed/2024/08/GHSA-hvw3-j8wv-xpg5/GHSA-hvw3-j8wv-xpg5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-hvw3-j8wv-xpg5", - "modified": "2024-08-28T18:31:55Z", + "modified": "2024-08-28T21:31:28Z", "published": "2024-08-28T18:31:55Z", "aliases": [ "CVE-2024-42905" ], "details": "Beijing Digital China Cloud Technology Co., Ltd. DCME-320 v.7.4.12.60 has a command execution vulnerability, which can be exploited to obtain device administrator privileges via the getVar function in the code/function/system/tool/ping.php file.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-77" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-28T18:15:09Z" diff --git a/advisories/unreviewed/2024/08/GHSA-jg65-m2mw-qhx7/GHSA-jg65-m2mw-qhx7.json b/advisories/unreviewed/2024/08/GHSA-jg65-m2mw-qhx7/GHSA-jg65-m2mw-qhx7.json new file mode 100644 index 00000000000..85034c2bcbd --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-jg65-m2mw-qhx7/GHSA-jg65-m2mw-qhx7.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jg65-m2mw-qhx7", + "modified": "2024-08-28T21:31:28Z", + "published": "2024-08-28T21:31:28Z", + "aliases": [ + "CVE-2024-44760" + ], + "details": "Incorrect access control in the component /servlet/SnoopServlet of Shenzhou News Union Enterprise Management System v5.0 through v18.8 allows attackers to access sensitive information regarding the server.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44760" + }, + { + "type": "WEB", + "url": "https://github.com/WarmBrew/web_vul/blob/main/SunmoEMS/SunmoEMS-info.md" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-28T20:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-mqj4-jxhw-766g/GHSA-mqj4-jxhw-766g.json b/advisories/unreviewed/2024/08/GHSA-mqj4-jxhw-766g/GHSA-mqj4-jxhw-766g.json index 7f3f7149998..9b3c9121ca2 100644 --- a/advisories/unreviewed/2024/08/GHSA-mqj4-jxhw-766g/GHSA-mqj4-jxhw-766g.json +++ b/advisories/unreviewed/2024/08/GHSA-mqj4-jxhw-766g/GHSA-mqj4-jxhw-766g.json @@ -1,13 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mqj4-jxhw-766g", - "modified": "2024-08-16T15:31:41Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-08-16T15:31:41Z", "aliases": [ "CVE-2024-42462" ], "details": "Improper Authentication vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Bypass.This issue affects upKeeper Manager: through 5.1.9.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" diff --git a/advisories/unreviewed/2024/08/GHSA-p8f2-24c3-9gc6/GHSA-p8f2-24c3-9gc6.json b/advisories/unreviewed/2024/08/GHSA-p8f2-24c3-9gc6/GHSA-p8f2-24c3-9gc6.json index c0a2f77fe02..f8171c6b4e8 100644 --- a/advisories/unreviewed/2024/08/GHSA-p8f2-24c3-9gc6/GHSA-p8f2-24c3-9gc6.json +++ b/advisories/unreviewed/2024/08/GHSA-p8f2-24c3-9gc6/GHSA-p8f2-24c3-9gc6.json @@ -1,13 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-p8f2-24c3-9gc6", - "modified": "2024-08-16T15:31:41Z", + "modified": "2024-08-28T21:31:27Z", "published": "2024-08-16T15:31:41Z", "aliases": [ "CVE-2024-42466" ], "details": "Improper Restriction of Excessive Authentication Attempts vulnerability in upKeeper Solutions product upKeeper Manager allows Authentication Abuse.This issue affects upKeeper Manager: through 5.1.9.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" diff --git a/advisories/unreviewed/2024/08/GHSA-prfv-75r3-hrjc/GHSA-prfv-75r3-hrjc.json b/advisories/unreviewed/2024/08/GHSA-prfv-75r3-hrjc/GHSA-prfv-75r3-hrjc.json index 9a92b6f5ea6..4c852f22c39 100644 --- a/advisories/unreviewed/2024/08/GHSA-prfv-75r3-hrjc/GHSA-prfv-75r3-hrjc.json +++ b/advisories/unreviewed/2024/08/GHSA-prfv-75r3-hrjc/GHSA-prfv-75r3-hrjc.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-prfv-75r3-hrjc", - "modified": "2024-08-28T18:31:55Z", + "modified": "2024-08-28T21:31:28Z", "published": "2024-08-28T18:31:55Z", "aliases": [ "CVE-2024-44915" ], "details": "An issue in the component EXR!ReadEXR+0x4eef0 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability can lead to a Denial of Service (DoS).", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-28T18:15:09Z" diff --git a/advisories/unreviewed/2024/08/GHSA-q3f9-5g39-v5vh/GHSA-q3f9-5g39-v5vh.json b/advisories/unreviewed/2024/08/GHSA-q3f9-5g39-v5vh/GHSA-q3f9-5g39-v5vh.json index a173f3ed581..9afa0adc5d9 100644 --- a/advisories/unreviewed/2024/08/GHSA-q3f9-5g39-v5vh/GHSA-q3f9-5g39-v5vh.json +++ b/advisories/unreviewed/2024/08/GHSA-q3f9-5g39-v5vh/GHSA-q3f9-5g39-v5vh.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-q3f9-5g39-v5vh", - "modified": "2024-08-28T18:31:55Z", + "modified": "2024-08-28T21:31:28Z", "published": "2024-08-28T18:31:55Z", "aliases": [ "CVE-2024-41236" ], "details": "A SQL injection vulnerability in /smsa/admin_login.php in Kashipara Responsive School Management System v3.2.0 allows an attacker to execute arbitrary SQL commands via the \"username\" parameter of the Admin Login Page", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-28T18:15:09Z" diff --git a/advisories/unreviewed/2024/08/GHSA-v537-7wch-wgcq/GHSA-v537-7wch-wgcq.json b/advisories/unreviewed/2024/08/GHSA-v537-7wch-wgcq/GHSA-v537-7wch-wgcq.json new file mode 100644 index 00000000000..d5d0bb7c535 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-v537-7wch-wgcq/GHSA-v537-7wch-wgcq.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v537-7wch-wgcq", + "modified": "2024-08-28T21:31:28Z", + "published": "2024-08-28T21:31:28Z", + "aliases": [ + "CVE-2024-42793" + ], + "details": "A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via a crafted request to the /music/ajax.php?action=save_user page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42793" + }, + { + "type": "WEB", + "url": "https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/CSRF%20-%20Edit%20User.pdf" + }, + { + "type": "WEB", + "url": "https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-28T20:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-v587-qwh9-6xx3/GHSA-v587-qwh9-6xx3.json b/advisories/unreviewed/2024/08/GHSA-v587-qwh9-6xx3/GHSA-v587-qwh9-6xx3.json new file mode 100644 index 00000000000..2421b47c379 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-v587-qwh9-6xx3/GHSA-v587-qwh9-6xx3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v587-qwh9-6xx3", + "modified": "2024-08-28T21:31:28Z", + "published": "2024-08-28T21:31:28Z", + "aliases": [ + "CVE-2024-44761" + ], + "details": "An issue in EQ Enterprise Management System before v2.0.0 allows attackers to execute a directory traversal via crafted requests.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44761" + }, + { + "type": "WEB", + "url": "https://github.com/WarmBrew/web_vul/blob/main/EQ/EQEMS.md" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-28T19:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-vcvh-63gv-345g/GHSA-vcvh-63gv-345g.json b/advisories/unreviewed/2024/08/GHSA-vcvh-63gv-345g/GHSA-vcvh-63gv-345g.json index 9631f0ade73..821f34d0dbe 100644 --- a/advisories/unreviewed/2024/08/GHSA-vcvh-63gv-345g/GHSA-vcvh-63gv-345g.json +++ b/advisories/unreviewed/2024/08/GHSA-vcvh-63gv-345g/GHSA-vcvh-63gv-345g.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-vcvh-63gv-345g", - "modified": "2024-08-28T18:31:55Z", + "modified": "2024-08-28T21:31:28Z", "published": "2024-08-28T18:31:55Z", "aliases": [ "CVE-2024-44914" ], "details": "An issue in the component EXR!ReadEXR+0x3df50 of Irfanview v4.67.1.0 allows attackers to cause an access violation via a crafted EXR file. This vulnerability can lead to a Denial of Service (DoS).", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-28T18:15:09Z" diff --git a/advisories/unreviewed/2024/08/GHSA-vhvg-rmxw-qrqr/GHSA-vhvg-rmxw-qrqr.json b/advisories/unreviewed/2024/08/GHSA-vhvg-rmxw-qrqr/GHSA-vhvg-rmxw-qrqr.json index 2fded0138f4..a503ab9135c 100644 --- a/advisories/unreviewed/2024/08/GHSA-vhvg-rmxw-qrqr/GHSA-vhvg-rmxw-qrqr.json +++ b/advisories/unreviewed/2024/08/GHSA-vhvg-rmxw-qrqr/GHSA-vhvg-rmxw-qrqr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vhvg-rmxw-qrqr", - "modified": "2024-08-26T18:33:34Z", + "modified": "2024-08-28T21:31:28Z", "published": "2024-08-26T18:33:34Z", "aliases": [ "CVE-2024-42913" @@ -18,6 +18,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42913" }, + { + "type": "WEB", + "url": "https://github.com/kkll5875" + }, { "type": "WEB", "url": "https://github.com/yangzongzhuan/RuoYi" diff --git a/advisories/unreviewed/2024/08/GHSA-wm63-qmcq-5w39/GHSA-wm63-qmcq-5w39.json b/advisories/unreviewed/2024/08/GHSA-wm63-qmcq-5w39/GHSA-wm63-qmcq-5w39.json new file mode 100644 index 00000000000..77c38a278b1 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-wm63-qmcq-5w39/GHSA-wm63-qmcq-5w39.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wm63-qmcq-5w39", + "modified": "2024-08-28T21:31:28Z", + "published": "2024-08-28T21:31:28Z", + "aliases": [ + "CVE-2024-34195" + ], + "details": "TOTOLINK AC1200 Wireless Router A3002R Firmware V1.1.1-B20200824 is vulnerable to Buffer Overflow. In the boa server program's CGI handling function formWlEncrypt, there is a lack of length restriction on the wlan_ssid field. This oversight leads to potential buffer overflow under specific circumstances. For instance, by invoking the formWlanRedirect function with specific parameters to alter wlan_idx's value and subsequently invoking the formWlEncrypt function, an attacker can trigger buffer overflow, enabling arbitrary command execution or denial of service attacks.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34195" + }, + { + "type": "WEB", + "url": "https://gist.github.com/Swind1er/84161b607d06d060fba5adcdd92bceb4" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-121" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-28T20:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-x72g-3j3q-w4wf/GHSA-x72g-3j3q-w4wf.json b/advisories/unreviewed/2024/08/GHSA-x72g-3j3q-w4wf/GHSA-x72g-3j3q-w4wf.json index 29527f01612..a445ce5aa45 100644 --- a/advisories/unreviewed/2024/08/GHSA-x72g-3j3q-w4wf/GHSA-x72g-3j3q-w4wf.json +++ b/advisories/unreviewed/2024/08/GHSA-x72g-3j3q-w4wf/GHSA-x72g-3j3q-w4wf.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-x72g-3j3q-w4wf", - "modified": "2024-08-27T21:31:13Z", + "modified": "2024-08-28T21:31:28Z", "published": "2024-08-27T18:31:38Z", "aliases": [ "CVE-2024-42851" @@ -24,6 +24,10 @@ { "type": "WEB", "url": "https://github.com/T1anyang/fuzzing/blob/main/exiftags/crash.md" + }, + { + "type": "WEB", + "url": "https://github.com/T1anyang/fuzzing/tree/main/exiftags" } ], "database_specific": {