diff --git a/advisories/unreviewed/2024/02/GHSA-qqr5-9j5g-m238/GHSA-qqr5-9j5g-m238.json b/advisories/unreviewed/2024/02/GHSA-qqr5-9j5g-m238/GHSA-qqr5-9j5g-m238.json index 501baf4bee1..acace3f2c64 100644 --- a/advisories/unreviewed/2024/02/GHSA-qqr5-9j5g-m238/GHSA-qqr5-9j5g-m238.json +++ b/advisories/unreviewed/2024/02/GHSA-qqr5-9j5g-m238/GHSA-qqr5-9j5g-m238.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,7 +26,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-922" ], "severity": "LOW", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/04/GHSA-hv8g-gp7c-5rcj/GHSA-hv8g-gp7c-5rcj.json b/advisories/unreviewed/2024/04/GHSA-hv8g-gp7c-5rcj/GHSA-hv8g-gp7c-5rcj.json index 1ee92aa313d..ab424690084 100644 --- a/advisories/unreviewed/2024/04/GHSA-hv8g-gp7c-5rcj/GHSA-hv8g-gp7c-5rcj.json +++ b/advisories/unreviewed/2024/04/GHSA-hv8g-gp7c-5rcj/GHSA-hv8g-gp7c-5rcj.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-hv8g-gp7c-5rcj", - "modified": "2024-04-15T06:30:34Z", + "modified": "2024-11-29T18:34:01Z", "published": "2024-04-15T06:30:34Z", "aliases": [ "CVE-2024-1754" ], "details": "The NPS computy WordPress plugin through 2.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,10 +25,8 @@ } ], "database_specific": { - "cwe_ids": [ - - ], - "severity": null, + "cwe_ids": [], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-15T05:15:15Z" diff --git a/advisories/unreviewed/2024/04/GHSA-w9xx-xhpg-c678/GHSA-w9xx-xhpg-c678.json b/advisories/unreviewed/2024/04/GHSA-w9xx-xhpg-c678/GHSA-w9xx-xhpg-c678.json index 4dbeb5c3531..b28da7dffd5 100644 --- a/advisories/unreviewed/2024/04/GHSA-w9xx-xhpg-c678/GHSA-w9xx-xhpg-c678.json +++ b/advisories/unreviewed/2024/04/GHSA-w9xx-xhpg-c678/GHSA-w9xx-xhpg-c678.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-w9xx-xhpg-c678", - "modified": "2024-04-09T00:30:41Z", + "modified": "2024-11-29T18:34:01Z", "published": "2024-04-05T21:32:44Z", "aliases": [ "CVE-2024-29748" @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,6 +22,10 @@ { "type": "WEB", "url": "https://source.android.com/security/bulletin/pixel/2024-04-01" + }, + { + "type": "WEB", + "url": "https://twitter.com/GrapheneOS/status/1775308208472813609" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/05/GHSA-5j2x-3vh5-xrw2/GHSA-5j2x-3vh5-xrw2.json b/advisories/unreviewed/2024/05/GHSA-5j2x-3vh5-xrw2/GHSA-5j2x-3vh5-xrw2.json index 55a3c519129..2eef4de6ad0 100644 --- a/advisories/unreviewed/2024/05/GHSA-5j2x-3vh5-xrw2/GHSA-5j2x-3vh5-xrw2.json +++ b/advisories/unreviewed/2024/05/GHSA-5j2x-3vh5-xrw2/GHSA-5j2x-3vh5-xrw2.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-5j2x-3vh5-xrw2", - "modified": "2024-05-03T06:30:36Z", + "modified": "2024-11-29T18:34:01Z", "published": "2024-05-03T06:30:36Z", "aliases": [ "CVE-2024-3703" ], "details": "The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in the page/post where the related Slide shortcode is embed, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,10 +25,8 @@ } ], "database_specific": { - "cwe_ids": [ - - ], - "severity": null, + "cwe_ids": [], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-05-03T06:15:14Z" diff --git a/advisories/unreviewed/2024/08/GHSA-4jq7-4qmf-m333/GHSA-4jq7-4qmf-m333.json b/advisories/unreviewed/2024/08/GHSA-4jq7-4qmf-m333/GHSA-4jq7-4qmf-m333.json index 8fc4fcdbe7d..158ffb0f29e 100644 --- a/advisories/unreviewed/2024/08/GHSA-4jq7-4qmf-m333/GHSA-4jq7-4qmf-m333.json +++ b/advisories/unreviewed/2024/08/GHSA-4jq7-4qmf-m333/GHSA-4jq7-4qmf-m333.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4jq7-4qmf-m333", - "modified": "2024-08-22T00:31:03Z", + "modified": "2024-11-29T18:34:01Z", "published": "2024-08-22T00:31:03Z", "aliases": [ "CVE-2024-28987" @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,6 +26,10 @@ { "type": "WEB", "url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987" + }, + { + "type": "WEB", + "url": "https://www.theregister.com/2024/08/22/hardcoded_credentials_bug_solarwinds_whd" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/11/GHSA-2jfw-8cwj-3579/GHSA-2jfw-8cwj-3579.json b/advisories/unreviewed/2024/11/GHSA-2jfw-8cwj-3579/GHSA-2jfw-8cwj-3579.json new file mode 100644 index 00000000000..70872b71234 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-2jfw-8cwj-3579/GHSA-2jfw-8cwj-3579.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2jfw-8cwj-3579", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-36622" + ], + "details": "In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitization of user input passed via the logfile parameter.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36622" + }, + { + "type": "WEB", + "url": "https://github.com/raspap/raspap-webgui/commit/c98d2b0c15942b4829d31dec615b9b40cc6faa14#diff-939ee414d82245c3b3dd7d36b57f10706e06e8f0871b24bdcf9de6e0d181c4c9" + }, + { + "type": "WEB", + "url": "https://gist.github.com/1047524396/ab997b902ec892e592a0df93f38e6941" + }, + { + "type": "WEB", + "url": "https://github.com/RaspAP/raspap-webgui/blob/3.0.9/ajax/logging/clearlog.php" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T18:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-2mj3-vfvx-fc43/GHSA-2mj3-vfvx-fc43.json b/advisories/unreviewed/2024/11/GHSA-2mj3-vfvx-fc43/GHSA-2mj3-vfvx-fc43.json new file mode 100644 index 00000000000..406a85cd8d4 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-2mj3-vfvx-fc43/GHSA-2mj3-vfvx-fc43.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2mj3-vfvx-fc43", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-36621" + ], + "details": "moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36621" + }, + { + "type": "WEB", + "url": "https://github.com/moby/moby/commit/37545cc644344dcb576cba67eb7b6f51a463d31e" + }, + { + "type": "WEB", + "url": "https://gist.github.com/1047524396/5d44459edab5fafcdf86b43909b81135" + }, + { + "type": "WEB", + "url": "https://github.com/moby/moby/blob/v25.0.5/builder/builder-next/adapters/snapshot/layer.go#L24" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T18:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-42vv-qrvv-www9/GHSA-42vv-qrvv-www9.json b/advisories/unreviewed/2024/11/GHSA-42vv-qrvv-www9/GHSA-42vv-qrvv-www9.json index 26ef75fa21d..fffe1bdf979 100644 --- a/advisories/unreviewed/2024/11/GHSA-42vv-qrvv-www9/GHSA-42vv-qrvv-www9.json +++ b/advisories/unreviewed/2024/11/GHSA-42vv-qrvv-www9/GHSA-42vv-qrvv-www9.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-44gv-75g5-gcm5/GHSA-44gv-75g5-gcm5.json b/advisories/unreviewed/2024/11/GHSA-44gv-75g5-gcm5/GHSA-44gv-75g5-gcm5.json new file mode 100644 index 00000000000..9a68fdddcdb --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-44gv-75g5-gcm5/GHSA-44gv-75g5-gcm5.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-44gv-75g5-gcm5", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-36617" + ], + "details": "FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36617" + }, + { + "type": "WEB", + "url": "https://github.com/ffmpeg/ffmpeg/commit/d973fcbcc2f944752ff10e6a76b0b2d9329937a7" + }, + { + "type": "WEB", + "url": "https://gist.github.com/1047524396/f20749f8addc8f86de9cfacf17ba29df" + }, + { + "type": "WEB", + "url": "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/cafdec.c#L274" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T18:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-49pw-2xfg-hw49/GHSA-49pw-2xfg-hw49.json b/advisories/unreviewed/2024/11/GHSA-49pw-2xfg-hw49/GHSA-49pw-2xfg-hw49.json new file mode 100644 index 00000000000..b67fd0eb79a --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-49pw-2xfg-hw49/GHSA-49pw-2xfg-hw49.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-49pw-2xfg-hw49", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-36624" + ], + "details": "Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the construct_copy_div function in copy_and_paste.js.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36624" + }, + { + "type": "WEB", + "url": "https://github.com/zulip/zulip/commit/e1029b59ede0c4f314c367ffa1ba2904ffaf6768" + }, + { + "type": "WEB", + "url": "https://gist.github.com/1047524396/64720d2aa5afd943eb7e5a1ed4808ad6" + }, + { + "type": "WEB", + "url": "https://github.com/zulip/zulip/blob/8.3/web/src/copy_and_paste.js#L90" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T18:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-4f8j-4r9h-5jxr/GHSA-4f8j-4r9h-5jxr.json b/advisories/unreviewed/2024/11/GHSA-4f8j-4r9h-5jxr/GHSA-4f8j-4r9h-5jxr.json new file mode 100644 index 00000000000..d5bb07ffeba --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-4f8j-4r9h-5jxr/GHSA-4f8j-4r9h-5jxr.json @@ -0,0 +1,34 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4f8j-4r9h-5jxr", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-52779" + ], + "details": "DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstatistics/mon_stat_top10.php.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52779" + }, + { + "type": "WEB", + "url": "https://ba1100n.tech/%E6%BC%8F%E6%B4%9E%E6%8A%A5%E5%91%8A/dcme-all-series-rcessix-one" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T16:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-4pv5-72jr-q9hw/GHSA-4pv5-72jr-q9hw.json b/advisories/unreviewed/2024/11/GHSA-4pv5-72jr-q9hw/GHSA-4pv5-72jr-q9hw.json new file mode 100644 index 00000000000..5dd28c90506 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-4pv5-72jr-q9hw/GHSA-4pv5-72jr-q9hw.json @@ -0,0 +1,34 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4pv5-72jr-q9hw", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-47193" + ], + "details": "WithSecure Elements Agent for Mac before 24.3, MDR before 24.3, and Elements Client Security for Mac before 16.10 allow a remote Denial of Service.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47193" + }, + { + "type": "WEB", + "url": "https://www.withsecure.com/en/support/security-advisories/cve-2024-47193" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T17:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-4rvq-m8mp-jcx2/GHSA-4rvq-m8mp-jcx2.json b/advisories/unreviewed/2024/11/GHSA-4rvq-m8mp-jcx2/GHSA-4rvq-m8mp-jcx2.json index e6a9d7ccac9..604cad2e5a9 100644 --- a/advisories/unreviewed/2024/11/GHSA-4rvq-m8mp-jcx2/GHSA-4rvq-m8mp-jcx2.json +++ b/advisories/unreviewed/2024/11/GHSA-4rvq-m8mp-jcx2/GHSA-4rvq-m8mp-jcx2.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-57p8-mp3h-7xm4/GHSA-57p8-mp3h-7xm4.json b/advisories/unreviewed/2024/11/GHSA-57p8-mp3h-7xm4/GHSA-57p8-mp3h-7xm4.json index d8eb3cc3276..2797364006d 100644 --- a/advisories/unreviewed/2024/11/GHSA-57p8-mp3h-7xm4/GHSA-57p8-mp3h-7xm4.json +++ b/advisories/unreviewed/2024/11/GHSA-57p8-mp3h-7xm4/GHSA-57p8-mp3h-7xm4.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-5rf6-c453-hr4g/GHSA-5rf6-c453-hr4g.json b/advisories/unreviewed/2024/11/GHSA-5rf6-c453-hr4g/GHSA-5rf6-c453-hr4g.json new file mode 100644 index 00000000000..d210373dffc --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-5rf6-c453-hr4g/GHSA-5rf6-c453-hr4g.json @@ -0,0 +1,34 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5rf6-c453-hr4g", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-52780" + ], + "details": "DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/system/basic/mgmt_edit.php.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52780" + }, + { + "type": "WEB", + "url": "https://ba1100n.tech/%E6%BC%8F%E6%B4%9E%E6%8A%A5%E5%91%8A/dcme-all-series-rcessix-one" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T16:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-5xvj-wwgx-xf7x/GHSA-5xvj-wwgx-xf7x.json b/advisories/unreviewed/2024/11/GHSA-5xvj-wwgx-xf7x/GHSA-5xvj-wwgx-xf7x.json index 8d1aae646e5..3b68b4788f4 100644 --- a/advisories/unreviewed/2024/11/GHSA-5xvj-wwgx-xf7x/GHSA-5xvj-wwgx-xf7x.json +++ b/advisories/unreviewed/2024/11/GHSA-5xvj-wwgx-xf7x/GHSA-5xvj-wwgx-xf7x.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-5xvj-wwgx-xf7x", - "modified": "2024-11-28T06:32:42Z", + "modified": "2024-11-29T18:34:03Z", "published": "2024-11-28T06:32:42Z", "aliases": [ "CVE-2024-10473" ], "details": "The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo Settings when outputing them in pages where the Logo Slider shortcode is embed, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-28T06:15:07Z" diff --git a/advisories/unreviewed/2024/11/GHSA-6cpp-mpjx-cx8v/GHSA-6cpp-mpjx-cx8v.json b/advisories/unreviewed/2024/11/GHSA-6cpp-mpjx-cx8v/GHSA-6cpp-mpjx-cx8v.json index 739683457fd..6ce79263fe3 100644 --- a/advisories/unreviewed/2024/11/GHSA-6cpp-mpjx-cx8v/GHSA-6cpp-mpjx-cx8v.json +++ b/advisories/unreviewed/2024/11/GHSA-6cpp-mpjx-cx8v/GHSA-6cpp-mpjx-cx8v.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-7vhx-c246-8ghc/GHSA-7vhx-c246-8ghc.json b/advisories/unreviewed/2024/11/GHSA-7vhx-c246-8ghc/GHSA-7vhx-c246-8ghc.json index c173c0556e1..efbcc043e5b 100644 --- a/advisories/unreviewed/2024/11/GHSA-7vhx-c246-8ghc/GHSA-7vhx-c246-8ghc.json +++ b/advisories/unreviewed/2024/11/GHSA-7vhx-c246-8ghc/GHSA-7vhx-c246-8ghc.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-7w34-8gpx-5fr8/GHSA-7w34-8gpx-5fr8.json b/advisories/unreviewed/2024/11/GHSA-7w34-8gpx-5fr8/GHSA-7w34-8gpx-5fr8.json new file mode 100644 index 00000000000..6770a50b0e1 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-7w34-8gpx-5fr8/GHSA-7w34-8gpx-5fr8.json @@ -0,0 +1,34 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7w34-8gpx-5fr8", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-52777" + ], + "details": "DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L, <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/system/basic/license_update.php.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52777" + }, + { + "type": "WEB", + "url": "https://ba1100n.tech/%E6%BC%8F%E6%B4%9E%E6%8A%A5%E5%91%8A/dcme-all-series-rcessix-one" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T16:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-7w7j-q678-9jm4/GHSA-7w7j-q678-9jm4.json b/advisories/unreviewed/2024/11/GHSA-7w7j-q678-9jm4/GHSA-7w7j-q678-9jm4.json index 90ad4abb39f..bc0e0fe7365 100644 --- a/advisories/unreviewed/2024/11/GHSA-7w7j-q678-9jm4/GHSA-7w7j-q678-9jm4.json +++ b/advisories/unreviewed/2024/11/GHSA-7w7j-q678-9jm4/GHSA-7w7j-q678-9jm4.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-866w-jmq2-r5wh/GHSA-866w-jmq2-r5wh.json b/advisories/unreviewed/2024/11/GHSA-866w-jmq2-r5wh/GHSA-866w-jmq2-r5wh.json new file mode 100644 index 00000000000..aa95327ae86 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-866w-jmq2-r5wh/GHSA-866w-jmq2-r5wh.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-866w-jmq2-r5wh", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-36626" + ], + "details": "In prestashop 8.1.4, a NULL pointer dereference was identified in the math_round function within Tools.php.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36626" + }, + { + "type": "WEB", + "url": "https://github.com/prestashop/prestashop/commit/20fa542294da2cfa034a48041e292acaed0c2a7f" + }, + { + "type": "WEB", + "url": "https://gist.github.com/1047524396/25c45b61a6374e0fdaf720c9863c6bcd" + }, + { + "type": "WEB", + "url": "https://github.com/PrestaShop/PrestaShop/blob/8.1.4/classes/Tools.php#L1774" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T17:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-8jxr-wrhj-f7f8/GHSA-8jxr-wrhj-f7f8.json b/advisories/unreviewed/2024/11/GHSA-8jxr-wrhj-f7f8/GHSA-8jxr-wrhj-f7f8.json new file mode 100644 index 00000000000..bc53f5130c5 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-8jxr-wrhj-f7f8/GHSA-8jxr-wrhj-f7f8.json @@ -0,0 +1,34 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8jxr-wrhj-f7f8", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-52778" + ], + "details": "DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstatistics/mon_stat_hist.php.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52778" + }, + { + "type": "WEB", + "url": "https://ba1100n.tech/%E6%BC%8F%E6%B4%9E%E6%8A%A5%E5%91%8A/dcme-all-series-rcessix-one" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T16:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-98cc-8c6r-7g5h/GHSA-98cc-8c6r-7g5h.json b/advisories/unreviewed/2024/11/GHSA-98cc-8c6r-7g5h/GHSA-98cc-8c6r-7g5h.json new file mode 100644 index 00000000000..3b851e4f6a9 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-98cc-8c6r-7g5h/GHSA-98cc-8c6r-7g5h.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-98cc-8c6r-7g5h", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-49805" + ], + "details": "IBM Security Verify Access Appliance 10.0.0 through 10.0.8 \n\ncontains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49805" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7177447" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-798" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T17:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-9vx5-qvf7-p8xq/GHSA-9vx5-qvf7-p8xq.json b/advisories/unreviewed/2024/11/GHSA-9vx5-qvf7-p8xq/GHSA-9vx5-qvf7-p8xq.json index da6d92ce0b0..6a3c9cec60c 100644 --- a/advisories/unreviewed/2024/11/GHSA-9vx5-qvf7-p8xq/GHSA-9vx5-qvf7-p8xq.json +++ b/advisories/unreviewed/2024/11/GHSA-9vx5-qvf7-p8xq/GHSA-9vx5-qvf7-p8xq.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-c2q4-8p6c-4c38/GHSA-c2q4-8p6c-4c38.json b/advisories/unreviewed/2024/11/GHSA-c2q4-8p6c-4c38/GHSA-c2q4-8p6c-4c38.json index 03986235e3b..c4d540aef1c 100644 --- a/advisories/unreviewed/2024/11/GHSA-c2q4-8p6c-4c38/GHSA-c2q4-8p6c-4c38.json +++ b/advisories/unreviewed/2024/11/GHSA-c2q4-8p6c-4c38/GHSA-c2q4-8p6c-4c38.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-c655-qv2v-73rm/GHSA-c655-qv2v-73rm.json b/advisories/unreviewed/2024/11/GHSA-c655-qv2v-73rm/GHSA-c655-qv2v-73rm.json new file mode 100644 index 00000000000..561641cb781 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-c655-qv2v-73rm/GHSA-c655-qv2v-73rm.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c655-qv2v-73rm", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-35369" + ], + "details": "In FFmpeg version n6.1.1, specifically within the avcodec/speexdec.c module, a potential security vulnerability exists due to insufficient validation of certain parameters when parsing Speex codec extradata. This vulnerability could lead to integer overflow conditions, potentially resulting in undefined behavior or crashes during the decoding process.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35369" + }, + { + "type": "WEB", + "url": "https://github.com/ffmpeg/ffmpeg/commit/0895ef0d6d6406ee6cd158fc4d47d80f201b8e9c" + }, + { + "type": "WEB", + "url": "https://gist.github.com/1047524396/455093807666f2e351d674750c8cd0b8" + }, + { + "type": "WEB", + "url": "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/speexdec.c#L1423" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T17:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-cgvw-jh5j-mgq3/GHSA-cgvw-jh5j-mgq3.json b/advisories/unreviewed/2024/11/GHSA-cgvw-jh5j-mgq3/GHSA-cgvw-jh5j-mgq3.json index 614b9af54fa..c10adc2793d 100644 --- a/advisories/unreviewed/2024/11/GHSA-cgvw-jh5j-mgq3/GHSA-cgvw-jh5j-mgq3.json +++ b/advisories/unreviewed/2024/11/GHSA-cgvw-jh5j-mgq3/GHSA-cgvw-jh5j-mgq3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-cgvw-jh5j-mgq3", - "modified": "2024-11-24T15:31:38Z", + "modified": "2024-11-29T18:34:01Z", "published": "2024-11-18T18:30:58Z", "aliases": [ "CVE-2024-9474" @@ -17,14 +17,20 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Red" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9474" }, + { + "type": "WEB", + "url": "https://github.com/k4nfr3/CVE-2024-9474" + }, + { + "type": "WEB", + "url": "https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474" + }, { "type": "WEB", "url": "https://security.paloaltonetworks.com/CVE-2024-9474" diff --git a/advisories/unreviewed/2024/11/GHSA-cqjf-fc5p-6c38/GHSA-cqjf-fc5p-6c38.json b/advisories/unreviewed/2024/11/GHSA-cqjf-fc5p-6c38/GHSA-cqjf-fc5p-6c38.json new file mode 100644 index 00000000000..e1bc63e254f --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-cqjf-fc5p-6c38/GHSA-cqjf-fc5p-6c38.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cqjf-fc5p-6c38", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-49804" + ], + "details": "IBM Security Verify Access Appliance 10.0.0 through 10.0.8 \n\ncould allow a locally authenticated non-administrative user to escalate their privileges due to unnecessary permissions used to perform certain tasks.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49804" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7177447" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-250" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T17:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-f4pc-p4v6-gfw6/GHSA-f4pc-p4v6-gfw6.json b/advisories/unreviewed/2024/11/GHSA-f4pc-p4v6-gfw6/GHSA-f4pc-p4v6-gfw6.json index 5507ed0a552..d83e66e9e9a 100644 --- a/advisories/unreviewed/2024/11/GHSA-f4pc-p4v6-gfw6/GHSA-f4pc-p4v6-gfw6.json +++ b/advisories/unreviewed/2024/11/GHSA-f4pc-p4v6-gfw6/GHSA-f4pc-p4v6-gfw6.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-f9m5-926v-fxw4/GHSA-f9m5-926v-fxw4.json b/advisories/unreviewed/2024/11/GHSA-f9m5-926v-fxw4/GHSA-f9m5-926v-fxw4.json new file mode 100644 index 00000000000..75021151cdf --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-f9m5-926v-fxw4/GHSA-f9m5-926v-fxw4.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f9m5-926v-fxw4", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-36618" + ], + "details": "FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36618" + }, + { + "type": "WEB", + "url": "https://github.com/ffmpeg/ffmpeg/commit/7a089ed8e049e3bfcb22de1250b86f2106060857" + }, + { + "type": "WEB", + "url": "https://gist.github.com/1047524396/a148f3679415a6da53ca112eb2ba1523" + }, + { + "type": "WEB", + "url": "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavformat/avidec.c#L1699" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T18:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-f9vj-p9hp-2j78/GHSA-f9vj-p9hp-2j78.json b/advisories/unreviewed/2024/11/GHSA-f9vj-p9hp-2j78/GHSA-f9vj-p9hp-2j78.json index 1dbc8e6bd84..57d81334b41 100644 --- a/advisories/unreviewed/2024/11/GHSA-f9vj-p9hp-2j78/GHSA-f9vj-p9hp-2j78.json +++ b/advisories/unreviewed/2024/11/GHSA-f9vj-p9hp-2j78/GHSA-f9vj-p9hp-2j78.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-fcvx-wgg9-6545/GHSA-fcvx-wgg9-6545.json b/advisories/unreviewed/2024/11/GHSA-fcvx-wgg9-6545/GHSA-fcvx-wgg9-6545.json new file mode 100644 index 00000000000..620113d9262 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-fcvx-wgg9-6545/GHSA-fcvx-wgg9-6545.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fcvx-wgg9-6545", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-49806" + ], + "details": "IBM Security Verify Access Appliance 10.0.0 through 10.0.8 \n\ncontains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49806" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7177447" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-798" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T17:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-frf2-9wh6-r8xw/GHSA-frf2-9wh6-r8xw.json b/advisories/unreviewed/2024/11/GHSA-frf2-9wh6-r8xw/GHSA-frf2-9wh6-r8xw.json index 4b6d0ab956c..91f831506b5 100644 --- a/advisories/unreviewed/2024/11/GHSA-frf2-9wh6-r8xw/GHSA-frf2-9wh6-r8xw.json +++ b/advisories/unreviewed/2024/11/GHSA-frf2-9wh6-r8xw/GHSA-frf2-9wh6-r8xw.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-gh5c-3h97-2f3q/GHSA-gh5c-3h97-2f3q.json b/advisories/unreviewed/2024/11/GHSA-gh5c-3h97-2f3q/GHSA-gh5c-3h97-2f3q.json new file mode 100644 index 00000000000..69e57ecedd9 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-gh5c-3h97-2f3q/GHSA-gh5c-3h97-2f3q.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gh5c-3h97-2f3q", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-36623" + ], + "details": "moby v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36623" + }, + { + "type": "WEB", + "url": "https://github.com/moby/moby/commit/5689dabfb357b673abdb4391eef426f297d7d1bb" + }, + { + "type": "WEB", + "url": "https://gist.github.com/1047524396/c192c0159a19bf58a4373b696467dc29" + }, + { + "type": "WEB", + "url": "https://github.com/moby/moby/blob/v25.0.3/pkg/streamformatter/streamformatter.go#L115" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T18:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hqpm-rxgj-829q/GHSA-hqpm-rxgj-829q.json b/advisories/unreviewed/2024/11/GHSA-hqpm-rxgj-829q/GHSA-hqpm-rxgj-829q.json index 467057ac867..2c90fc8597a 100644 --- a/advisories/unreviewed/2024/11/GHSA-hqpm-rxgj-829q/GHSA-hqpm-rxgj-829q.json +++ b/advisories/unreviewed/2024/11/GHSA-hqpm-rxgj-829q/GHSA-hqpm-rxgj-829q.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-hwfx-3gvr-3fcv/GHSA-hwfx-3gvr-3fcv.json b/advisories/unreviewed/2024/11/GHSA-hwfx-3gvr-3fcv/GHSA-hwfx-3gvr-3fcv.json index a4a313925d9..70075233c88 100644 --- a/advisories/unreviewed/2024/11/GHSA-hwfx-3gvr-3fcv/GHSA-hwfx-3gvr-3fcv.json +++ b/advisories/unreviewed/2024/11/GHSA-hwfx-3gvr-3fcv/GHSA-hwfx-3gvr-3fcv.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-hxwv-g46m-hj5c/GHSA-hxwv-g46m-hj5c.json b/advisories/unreviewed/2024/11/GHSA-hxwv-g46m-hj5c/GHSA-hxwv-g46m-hj5c.json index 01a2bdbbbfd..8e939080ab3 100644 --- a/advisories/unreviewed/2024/11/GHSA-hxwv-g46m-hj5c/GHSA-hxwv-g46m-hj5c.json +++ b/advisories/unreviewed/2024/11/GHSA-hxwv-g46m-hj5c/GHSA-hxwv-g46m-hj5c.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-j5ch-jjpm-qq89/GHSA-j5ch-jjpm-qq89.json b/advisories/unreviewed/2024/11/GHSA-j5ch-jjpm-qq89/GHSA-j5ch-jjpm-qq89.json index 156a3d25e3d..83289e231ad 100644 --- a/advisories/unreviewed/2024/11/GHSA-j5ch-jjpm-qq89/GHSA-j5ch-jjpm-qq89.json +++ b/advisories/unreviewed/2024/11/GHSA-j5ch-jjpm-qq89/GHSA-j5ch-jjpm-qq89.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-j5jf-wf2j-j88q/GHSA-j5jf-wf2j-j88q.json b/advisories/unreviewed/2024/11/GHSA-j5jf-wf2j-j88q/GHSA-j5jf-wf2j-j88q.json index dcfa2deb019..f176326c2bf 100644 --- a/advisories/unreviewed/2024/11/GHSA-j5jf-wf2j-j88q/GHSA-j5jf-wf2j-j88q.json +++ b/advisories/unreviewed/2024/11/GHSA-j5jf-wf2j-j88q/GHSA-j5jf-wf2j-j88q.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-m2hm-7hww-7mr3/GHSA-m2hm-7hww-7mr3.json b/advisories/unreviewed/2024/11/GHSA-m2hm-7hww-7mr3/GHSA-m2hm-7hww-7mr3.json index 5d9314f5e06..991196dad8c 100644 --- a/advisories/unreviewed/2024/11/GHSA-m2hm-7hww-7mr3/GHSA-m2hm-7hww-7mr3.json +++ b/advisories/unreviewed/2024/11/GHSA-m2hm-7hww-7mr3/GHSA-m2hm-7hww-7mr3.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -28,7 +26,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-122" + "CWE-122", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-m3h6-48g4-34gf/GHSA-m3h6-48g4-34gf.json b/advisories/unreviewed/2024/11/GHSA-m3h6-48g4-34gf/GHSA-m3h6-48g4-34gf.json new file mode 100644 index 00000000000..26904dfffa3 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-m3h6-48g4-34gf/GHSA-m3h6-48g4-34gf.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m3h6-48g4-34gf", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-36619" + ], + "details": "FFmpeg n6.1.1 has a vulnerability in the WAVARC decoder of the libavcodec library which allows for an integer overflow when handling certain block types, leading to a denial-of-service (DoS) condition.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36619" + }, + { + "type": "WEB", + "url": "https://github.com/ffmpeg/ffmpeg/commit/28c7094b25b689185155a6833caf2747b94774a4" + }, + { + "type": "WEB", + "url": "https://gist.github.com/1047524396/fad68e8251f4e34a1bb838de697d5119" + }, + { + "type": "WEB", + "url": "https://github.com/FFmpeg/FFmpeg/blob/n6.1.1/libavcodec/wavarc.c#L651" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T17:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-mw9x-2qwv-599p/GHSA-mw9x-2qwv-599p.json b/advisories/unreviewed/2024/11/GHSA-mw9x-2qwv-599p/GHSA-mw9x-2qwv-599p.json index 442126b1519..a213313b99f 100644 --- a/advisories/unreviewed/2024/11/GHSA-mw9x-2qwv-599p/GHSA-mw9x-2qwv-599p.json +++ b/advisories/unreviewed/2024/11/GHSA-mw9x-2qwv-599p/GHSA-mw9x-2qwv-599p.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mw9x-2qwv-599p", - "modified": "2024-11-24T15:31:38Z", + "modified": "2024-11-29T18:34:01Z", "published": "2024-11-18T18:30:58Z", "aliases": [ "CVE-2024-0012" @@ -17,14 +17,16 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:H/U:Red" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0012" }, + { + "type": "WEB", + "url": "https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474" + }, { "type": "WEB", "url": "https://security.paloaltonetworks.com/CVE-2024-0012" diff --git a/advisories/unreviewed/2024/11/GHSA-q4pq-w3xm-6vp6/GHSA-q4pq-w3xm-6vp6.json b/advisories/unreviewed/2024/11/GHSA-q4pq-w3xm-6vp6/GHSA-q4pq-w3xm-6vp6.json index 11b72572794..8ae4d61e5b6 100644 --- a/advisories/unreviewed/2024/11/GHSA-q4pq-w3xm-6vp6/GHSA-q4pq-w3xm-6vp6.json +++ b/advisories/unreviewed/2024/11/GHSA-q4pq-w3xm-6vp6/GHSA-q4pq-w3xm-6vp6.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-q59j-vv4j-v33c/GHSA-q59j-vv4j-v33c.json b/advisories/unreviewed/2024/11/GHSA-q59j-vv4j-v33c/GHSA-q59j-vv4j-v33c.json new file mode 100644 index 00000000000..b850a3e98a5 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-q59j-vv4j-v33c/GHSA-q59j-vv4j-v33c.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q59j-vv4j-v33c", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-36620" + ], + "details": "moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36620" + }, + { + "type": "WEB", + "url": "https://github.com/moby/moby/commit/ab570ab3d62038b3d26f96a9bb585d0b6095b9b4" + }, + { + "type": "WEB", + "url": "https://gist.github.com/1047524396/f08816669701ab478a265a811d2c89b2" + }, + { + "type": "WEB", + "url": "https://github.com/moby/moby/blob/v26.0.2/daemon/images/image_history.go#L48" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T18:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-qgx5-5h35-jw4r/GHSA-qgx5-5h35-jw4r.json b/advisories/unreviewed/2024/11/GHSA-qgx5-5h35-jw4r/GHSA-qgx5-5h35-jw4r.json index a7a09668f76..9f3a4f0e0ed 100644 --- a/advisories/unreviewed/2024/11/GHSA-qgx5-5h35-jw4r/GHSA-qgx5-5h35-jw4r.json +++ b/advisories/unreviewed/2024/11/GHSA-qgx5-5h35-jw4r/GHSA-qgx5-5h35-jw4r.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-rg9j-w3wr-2gc5/GHSA-rg9j-w3wr-2gc5.json b/advisories/unreviewed/2024/11/GHSA-rg9j-w3wr-2gc5/GHSA-rg9j-w3wr-2gc5.json index 908f068aed4..b8f91a59d1a 100644 --- a/advisories/unreviewed/2024/11/GHSA-rg9j-w3wr-2gc5/GHSA-rg9j-w3wr-2gc5.json +++ b/advisories/unreviewed/2024/11/GHSA-rg9j-w3wr-2gc5/GHSA-rg9j-w3wr-2gc5.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-rg9j-w3wr-2gc5", - "modified": "2024-11-28T06:32:43Z", + "modified": "2024-11-29T18:34:03Z", "published": "2024-11-28T06:32:43Z", "aliases": [ "CVE-2024-10510" ], "details": "The adBuddy+ (AdBlocker Detection) by NetfunkDesign WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-28T06:15:08Z" diff --git a/advisories/unreviewed/2024/11/GHSA-rmmv-vvpx-42cw/GHSA-rmmv-vvpx-42cw.json b/advisories/unreviewed/2024/11/GHSA-rmmv-vvpx-42cw/GHSA-rmmv-vvpx-42cw.json index bee355dbe77..a6699b8881b 100644 --- a/advisories/unreviewed/2024/11/GHSA-rmmv-vvpx-42cw/GHSA-rmmv-vvpx-42cw.json +++ b/advisories/unreviewed/2024/11/GHSA-rmmv-vvpx-42cw/GHSA-rmmv-vvpx-42cw.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-v855-95x4-c338/GHSA-v855-95x4-c338.json b/advisories/unreviewed/2024/11/GHSA-v855-95x4-c338/GHSA-v855-95x4-c338.json index 9eab436d106..4bf60cfe8f9 100644 --- a/advisories/unreviewed/2024/11/GHSA-v855-95x4-c338/GHSA-v855-95x4-c338.json +++ b/advisories/unreviewed/2024/11/GHSA-v855-95x4-c338/GHSA-v855-95x4-c338.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-vjmj-84v8-m369/GHSA-vjmj-84v8-m369.json b/advisories/unreviewed/2024/11/GHSA-vjmj-84v8-m369/GHSA-vjmj-84v8-m369.json index 15dc2fb3adf..e00afb1a83a 100644 --- a/advisories/unreviewed/2024/11/GHSA-vjmj-84v8-m369/GHSA-vjmj-84v8-m369.json +++ b/advisories/unreviewed/2024/11/GHSA-vjmj-84v8-m369/GHSA-vjmj-84v8-m369.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-vrr2-f84w-m7p3/GHSA-vrr2-f84w-m7p3.json b/advisories/unreviewed/2024/11/GHSA-vrr2-f84w-m7p3/GHSA-vrr2-f84w-m7p3.json new file mode 100644 index 00000000000..320c67ba2f1 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-vrr2-f84w-m7p3/GHSA-vrr2-f84w-m7p3.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vrr2-f84w-m7p3", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-49803" + ], + "details": "IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49803" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7177447" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T17:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-wq8w-6frx-m255/GHSA-wq8w-6frx-m255.json b/advisories/unreviewed/2024/11/GHSA-wq8w-6frx-m255/GHSA-wq8w-6frx-m255.json new file mode 100644 index 00000000000..b72fb4ba34b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-wq8w-6frx-m255/GHSA-wq8w-6frx-m255.json @@ -0,0 +1,34 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wq8w-6frx-m255", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-52781" + ], + "details": "DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/system/tool/traceroute.php.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52781" + }, + { + "type": "WEB", + "url": "https://ba1100n.tech/%E6%BC%8F%E6%B4%9E%E6%8A%A5%E5%91%8A/dcme-all-series-rcessix-one" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T16:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-x2hc-pc6q-48fm/GHSA-x2hc-pc6q-48fm.json b/advisories/unreviewed/2024/11/GHSA-x2hc-pc6q-48fm/GHSA-x2hc-pc6q-48fm.json index fb9127aaf62..7ed79566514 100644 --- a/advisories/unreviewed/2024/11/GHSA-x2hc-pc6q-48fm/GHSA-x2hc-pc6q-48fm.json +++ b/advisories/unreviewed/2024/11/GHSA-x2hc-pc6q-48fm/GHSA-x2hc-pc6q-48fm.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-x36p-pf6h-mvhv/GHSA-x36p-pf6h-mvhv.json b/advisories/unreviewed/2024/11/GHSA-x36p-pf6h-mvhv/GHSA-x36p-pf6h-mvhv.json new file mode 100644 index 00000000000..bbc478bfa50 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-x36p-pf6h-mvhv/GHSA-x36p-pf6h-mvhv.json @@ -0,0 +1,34 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x36p-pf6h-mvhv", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-52782" + ], + "details": "DCME-320 <=7.4.12.90, DCME-520 <=9.25.5.11, DCME-320-L <=9.3.5.26, and DCME-720 <=9.1.5.11 are vulnerable to Remote Code Execution via /function/audit/newstatistics/mon_stat_hist_new.php.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52782" + }, + { + "type": "WEB", + "url": "https://ba1100n.tech/%E6%BC%8F%E6%B4%9E%E6%8A%A5%E5%91%8A/dcme-all-series-rcessix-one" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T16:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-x8c4-4qx3-cf7m/GHSA-x8c4-4qx3-cf7m.json b/advisories/unreviewed/2024/11/GHSA-x8c4-4qx3-cf7m/GHSA-x8c4-4qx3-cf7m.json index afa3593a4ed..84916787362 100644 --- a/advisories/unreviewed/2024/11/GHSA-x8c4-4qx3-cf7m/GHSA-x8c4-4qx3-cf7m.json +++ b/advisories/unreviewed/2024/11/GHSA-x8c4-4qx3-cf7m/GHSA-x8c4-4qx3-cf7m.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-x8c4-4qx3-cf7m", - "modified": "2024-11-28T06:32:43Z", + "modified": "2024-11-29T18:34:03Z", "published": "2024-11-28T06:32:43Z", "aliases": [ "CVE-2024-10896" ], "details": "The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo and Slider settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-78" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-28T06:15:08Z" diff --git a/advisories/unreviewed/2024/11/GHSA-x944-3w5c-5hcg/GHSA-x944-3w5c-5hcg.json b/advisories/unreviewed/2024/11/GHSA-x944-3w5c-5hcg/GHSA-x944-3w5c-5hcg.json index bbe47fd8cfb..a597c75b1b0 100644 --- a/advisories/unreviewed/2024/11/GHSA-x944-3w5c-5hcg/GHSA-x944-3w5c-5hcg.json +++ b/advisories/unreviewed/2024/11/GHSA-x944-3w5c-5hcg/GHSA-x944-3w5c-5hcg.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-x944-3w5c-5hcg", - "modified": "2024-11-28T06:32:42Z", + "modified": "2024-11-29T18:34:03Z", "published": "2024-11-28T06:32:42Z", "aliases": [ "CVE-2024-10493" ], "details": "The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) WordPress plugin before 5.10.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-28T06:15:08Z" diff --git a/advisories/unreviewed/2024/11/GHSA-xm38-wpcw-48cj/GHSA-xm38-wpcw-48cj.json b/advisories/unreviewed/2024/11/GHSA-xm38-wpcw-48cj/GHSA-xm38-wpcw-48cj.json index 7da4d830c73..16c57eb8dc0 100644 --- a/advisories/unreviewed/2024/11/GHSA-xm38-wpcw-48cj/GHSA-xm38-wpcw-48cj.json +++ b/advisories/unreviewed/2024/11/GHSA-xm38-wpcw-48cj/GHSA-xm38-wpcw-48cj.json @@ -13,9 +13,7 @@ "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-xxvh-8h9p-mpwj/GHSA-xxvh-8h9p-mpwj.json b/advisories/unreviewed/2024/11/GHSA-xxvh-8h9p-mpwj/GHSA-xxvh-8h9p-mpwj.json new file mode 100644 index 00000000000..8fa15cbfeff --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-xxvh-8h9p-mpwj/GHSA-xxvh-8h9p-mpwj.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xxvh-8h9p-mpwj", + "modified": "2024-11-29T18:34:03Z", + "published": "2024-11-29T18:34:03Z", + "aliases": [ + "CVE-2024-36625" + ], + "details": "Zulip 8.3 is vulnerable to Cross Site Scripting (XSS) via the replace_emoji_with_text function in ui_util.ts.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36625" + }, + { + "type": "WEB", + "url": "https://github.com/zulip/zulip/commit/191345f9d61f5b15762fe3ce19bf635bf885176a" + }, + { + "type": "WEB", + "url": "https://gist.github.com/1047524396/f7ada389ed2686481efef9e1f8307c51" + }, + { + "type": "WEB", + "url": "https://github.com/zulip/zulip/blob/8.3/web/src/ui_util.ts#L24" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-29T17:15:07Z" + } +} \ No newline at end of file