From 6e74dc3d8f002c32c49e5e30682b81c7d8b5242e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 4 Jan 2024 21:31:38 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-27q9-h529-q4g3.json | 9 ++- .../GHSA-3r3w-gg47-w53h.json | 11 ++-- .../GHSA-4frw-j2v5-2xwf.json | 11 ++-- .../GHSA-69jv-m7h2-wvmf.json | 3 +- .../GHSA-6gj8-gj3v-ccw7.json | 11 ++-- .../GHSA-866h-q63m-66xm.json | 11 ++-- .../GHSA-8pxx-f34x-f793.json | 11 ++-- .../GHSA-997g-jcpq-8whg.json | 2 +- .../GHSA-9hr4-7jqw-c29q.json | 2 +- .../GHSA-9mrh-3627-mg6x.json | 2 +- .../GHSA-9vx6-546g-266v.json | 2 +- .../GHSA-cgf4-3952-w724.json | 2 +- .../GHSA-crwg-2xph-4rc6.json | 11 ++-- .../GHSA-gh6q-hg4q-mm5j.json | 11 ++-- .../GHSA-jf57-3c97-v2x5.json | 2 +- .../GHSA-jvgh-f9m8-mh2r.json | 2 +- .../GHSA-mfr4-4gq8-693m.json | 11 ++-- .../GHSA-qmhv-fq76-x3j5.json | 11 ++-- .../GHSA-rjjc-gg9m-vhv8.json | 9 ++- .../GHSA-v2pm-g2fx-6m9c.json | 2 +- .../GHSA-v624-cfg3-pgh9.json | 9 ++- .../GHSA-vpcq-h894-5962.json | 11 ++-- .../GHSA-xhgx-7974-c8v6.json | 11 ++-- .../GHSA-4553-hq82-8654.json | 47 +++++++++++++++ .../GHSA-4j3v-h4q8-j269.json | 35 +++++++++++ .../GHSA-4mvm-xh8j-fv27.json | 51 ++++++++++++++++ .../GHSA-59j2-44h9-8h98.json | 35 +++++++++++ .../GHSA-c2v4-chx5-vff6.json | 51 ++++++++++++++++ .../GHSA-g47j-3m2m-74qv.json | 51 ++++++++++++++++ .../GHSA-qwf7-rv77-fcr3.json | 47 +++++++++++++++ .../GHSA-v444-jggx-6v7f.json | 58 +++++++++++++++++++ 31 files changed, 480 insertions(+), 62 deletions(-) create mode 100644 advisories/unreviewed/2024/01/GHSA-4553-hq82-8654/GHSA-4553-hq82-8654.json create mode 100644 advisories/unreviewed/2024/01/GHSA-4j3v-h4q8-j269/GHSA-4j3v-h4q8-j269.json create mode 100644 advisories/unreviewed/2024/01/GHSA-4mvm-xh8j-fv27/GHSA-4mvm-xh8j-fv27.json create mode 100644 advisories/unreviewed/2024/01/GHSA-59j2-44h9-8h98/GHSA-59j2-44h9-8h98.json create mode 100644 advisories/unreviewed/2024/01/GHSA-c2v4-chx5-vff6/GHSA-c2v4-chx5-vff6.json create mode 100644 advisories/unreviewed/2024/01/GHSA-g47j-3m2m-74qv/GHSA-g47j-3m2m-74qv.json create mode 100644 advisories/unreviewed/2024/01/GHSA-qwf7-rv77-fcr3/GHSA-qwf7-rv77-fcr3.json create mode 100644 advisories/unreviewed/2024/01/GHSA-v444-jggx-6v7f/GHSA-v444-jggx-6v7f.json diff --git a/advisories/unreviewed/2023/12/GHSA-27q9-h529-q4g3/GHSA-27q9-h529-q4g3.json b/advisories/unreviewed/2023/12/GHSA-27q9-h529-q4g3/GHSA-27q9-h529-q4g3.json index 93e02366ffa..07985e6731c 100644 --- a/advisories/unreviewed/2023/12/GHSA-27q9-h529-q4g3/GHSA-27q9-h529-q4g3.json +++ b/advisories/unreviewed/2023/12/GHSA-27q9-h529-q4g3/GHSA-27q9-h529-q4g3.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-27q9-h529-q4g3", - "modified": "2023-12-24T09:30:19Z", + "modified": "2024-01-04T21:30:23Z", "published": "2023-12-24T09:30:19Z", "aliases": [ "CVE-2023-51767" ], "details": "OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -43,7 +46,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-24T07:15:07Z" diff --git a/advisories/unreviewed/2023/12/GHSA-3r3w-gg47-w53h/GHSA-3r3w-gg47-w53h.json b/advisories/unreviewed/2023/12/GHSA-3r3w-gg47-w53h/GHSA-3r3w-gg47-w53h.json index 55caff2d255..214d757f031 100644 --- a/advisories/unreviewed/2023/12/GHSA-3r3w-gg47-w53h/GHSA-3r3w-gg47-w53h.json +++ b/advisories/unreviewed/2023/12/GHSA-3r3w-gg47-w53h/GHSA-3r3w-gg47-w53h.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-3r3w-gg47-w53h", - "modified": "2023-12-28T09:30:19Z", + "modified": "2024-01-04T21:30:23Z", "published": "2023-12-28T09:30:19Z", "aliases": [ "CVE-2023-50038" ], "details": "There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-434" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-28T07:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-4frw-j2v5-2xwf/GHSA-4frw-j2v5-2xwf.json b/advisories/unreviewed/2023/12/GHSA-4frw-j2v5-2xwf/GHSA-4frw-j2v5-2xwf.json index 3a870633df1..3c561176fe9 100644 --- a/advisories/unreviewed/2023/12/GHSA-4frw-j2v5-2xwf/GHSA-4frw-j2v5-2xwf.json +++ b/advisories/unreviewed/2023/12/GHSA-4frw-j2v5-2xwf/GHSA-4frw-j2v5-2xwf.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-4frw-j2v5-2xwf", - "modified": "2023-12-26T21:30:33Z", + "modified": "2024-01-04T21:30:23Z", "published": "2023-12-26T21:30:33Z", "aliases": [ "CVE-2023-5931" ], "details": "The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow attackers with a low-privilege account (e.g. subscribers) to upload arbitrary files such as PHP on the server", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-434" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-26T19:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-69jv-m7h2-wvmf/GHSA-69jv-m7h2-wvmf.json b/advisories/unreviewed/2023/12/GHSA-69jv-m7h2-wvmf/GHSA-69jv-m7h2-wvmf.json index d32a3e68735..515098ad8ea 100644 --- a/advisories/unreviewed/2023/12/GHSA-69jv-m7h2-wvmf/GHSA-69jv-m7h2-wvmf.json +++ b/advisories/unreviewed/2023/12/GHSA-69jv-m7h2-wvmf/GHSA-69jv-m7h2-wvmf.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-78" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/12/GHSA-6gj8-gj3v-ccw7/GHSA-6gj8-gj3v-ccw7.json b/advisories/unreviewed/2023/12/GHSA-6gj8-gj3v-ccw7/GHSA-6gj8-gj3v-ccw7.json index 1d9860b8a22..776a1454178 100644 --- a/advisories/unreviewed/2023/12/GHSA-6gj8-gj3v-ccw7/GHSA-6gj8-gj3v-ccw7.json +++ b/advisories/unreviewed/2023/12/GHSA-6gj8-gj3v-ccw7/GHSA-6gj8-gj3v-ccw7.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-6gj8-gj3v-ccw7", - "modified": "2023-12-21T15:30:32Z", + "modified": "2024-01-04T21:30:22Z", "published": "2023-12-21T15:30:32Z", "aliases": [ "CVE-2023-48116" ], "details": "SmarterTools SmarterMail 16.x 8495 through 8664 before 8747 allows stored XSS via a crafted description of a Calendar appointment.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-21T15:15:09Z" diff --git a/advisories/unreviewed/2023/12/GHSA-866h-q63m-66xm/GHSA-866h-q63m-66xm.json b/advisories/unreviewed/2023/12/GHSA-866h-q63m-66xm/GHSA-866h-q63m-66xm.json index 26e8018ac39..28f82ea519d 100644 --- a/advisories/unreviewed/2023/12/GHSA-866h-q63m-66xm/GHSA-866h-q63m-66xm.json +++ b/advisories/unreviewed/2023/12/GHSA-866h-q63m-66xm/GHSA-866h-q63m-66xm.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-866h-q63m-66xm", - "modified": "2023-12-28T00:30:20Z", + "modified": "2024-01-04T21:30:23Z", "published": "2023-12-28T00:30:20Z", "aliases": [ "CVE-2023-49000" ], "details": "An issue in ArtistScope ArtisBrowser v.34.1.5 and before allows an attacker to bypass intended access restrictions via interaction with the com.artis.browser.IntentReceiverActivity component.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-27T22:15:16Z" diff --git a/advisories/unreviewed/2023/12/GHSA-8pxx-f34x-f793/GHSA-8pxx-f34x-f793.json b/advisories/unreviewed/2023/12/GHSA-8pxx-f34x-f793/GHSA-8pxx-f34x-f793.json index 1474695d8f8..829037f41a2 100644 --- a/advisories/unreviewed/2023/12/GHSA-8pxx-f34x-f793/GHSA-8pxx-f34x-f793.json +++ b/advisories/unreviewed/2023/12/GHSA-8pxx-f34x-f793/GHSA-8pxx-f34x-f793.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-8pxx-f34x-f793", - "modified": "2023-12-28T00:30:20Z", + "modified": "2024-01-04T21:30:23Z", "published": "2023-12-28T00:30:20Z", "aliases": [ "CVE-2023-49003" ], "details": "An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simplemobiletools.dialer.activities.DialerActivity.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-862" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-27T22:15:16Z" diff --git a/advisories/unreviewed/2023/12/GHSA-997g-jcpq-8whg/GHSA-997g-jcpq-8whg.json b/advisories/unreviewed/2023/12/GHSA-997g-jcpq-8whg/GHSA-997g-jcpq-8whg.json index 0d6e57cd238..a96ffc4594b 100644 --- a/advisories/unreviewed/2023/12/GHSA-997g-jcpq-8whg/GHSA-997g-jcpq-8whg.json +++ b/advisories/unreviewed/2023/12/GHSA-997g-jcpq-8whg/GHSA-997g-jcpq-8whg.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-997g-jcpq-8whg", - "modified": "2023-12-28T12:30:17Z", + "modified": "2024-01-04T21:30:23Z", "published": "2023-12-28T12:30:17Z", "aliases": [ "CVE-2023-50874" diff --git a/advisories/unreviewed/2023/12/GHSA-9hr4-7jqw-c29q/GHSA-9hr4-7jqw-c29q.json b/advisories/unreviewed/2023/12/GHSA-9hr4-7jqw-c29q/GHSA-9hr4-7jqw-c29q.json index c8225977006..8b01c05c4bf 100644 --- a/advisories/unreviewed/2023/12/GHSA-9hr4-7jqw-c29q/GHSA-9hr4-7jqw-c29q.json +++ b/advisories/unreviewed/2023/12/GHSA-9hr4-7jqw-c29q/GHSA-9hr4-7jqw-c29q.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9hr4-7jqw-c29q", - "modified": "2023-12-29T15:30:31Z", + "modified": "2024-01-04T21:30:24Z", "published": "2023-12-29T09:30:26Z", "aliases": [ "CVE-2023-32095" diff --git a/advisories/unreviewed/2023/12/GHSA-9mrh-3627-mg6x/GHSA-9mrh-3627-mg6x.json b/advisories/unreviewed/2023/12/GHSA-9mrh-3627-mg6x/GHSA-9mrh-3627-mg6x.json index 17d56e5ca25..8e94976c8d6 100644 --- a/advisories/unreviewed/2023/12/GHSA-9mrh-3627-mg6x/GHSA-9mrh-3627-mg6x.json +++ b/advisories/unreviewed/2023/12/GHSA-9mrh-3627-mg6x/GHSA-9mrh-3627-mg6x.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9mrh-3627-mg6x", - "modified": "2023-12-28T12:30:19Z", + "modified": "2024-01-04T21:30:24Z", "published": "2023-12-28T12:30:19Z", "aliases": [ "CVE-2023-50860" diff --git a/advisories/unreviewed/2023/12/GHSA-9vx6-546g-266v/GHSA-9vx6-546g-266v.json b/advisories/unreviewed/2023/12/GHSA-9vx6-546g-266v/GHSA-9vx6-546g-266v.json index 537e16d8fa1..49ae60f54bb 100644 --- a/advisories/unreviewed/2023/12/GHSA-9vx6-546g-266v/GHSA-9vx6-546g-266v.json +++ b/advisories/unreviewed/2023/12/GHSA-9vx6-546g-266v/GHSA-9vx6-546g-266v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9vx6-546g-266v", - "modified": "2023-12-28T12:30:19Z", + "modified": "2024-01-04T21:30:24Z", "published": "2023-12-28T12:30:19Z", "aliases": [ "CVE-2023-50851" diff --git a/advisories/unreviewed/2023/12/GHSA-cgf4-3952-w724/GHSA-cgf4-3952-w724.json b/advisories/unreviewed/2023/12/GHSA-cgf4-3952-w724/GHSA-cgf4-3952-w724.json index 91a091cd17f..4707b0d96c2 100644 --- a/advisories/unreviewed/2023/12/GHSA-cgf4-3952-w724/GHSA-cgf4-3952-w724.json +++ b/advisories/unreviewed/2023/12/GHSA-cgf4-3952-w724/GHSA-cgf4-3952-w724.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-cgf4-3952-w724", - "modified": "2023-12-28T12:30:19Z", + "modified": "2024-01-04T21:30:24Z", "published": "2023-12-28T12:30:19Z", "aliases": [ "CVE-2023-50856" diff --git a/advisories/unreviewed/2023/12/GHSA-crwg-2xph-4rc6/GHSA-crwg-2xph-4rc6.json b/advisories/unreviewed/2023/12/GHSA-crwg-2xph-4rc6/GHSA-crwg-2xph-4rc6.json index b6a6c1d6767..48434e9db1c 100644 --- a/advisories/unreviewed/2023/12/GHSA-crwg-2xph-4rc6/GHSA-crwg-2xph-4rc6.json +++ b/advisories/unreviewed/2023/12/GHSA-crwg-2xph-4rc6/GHSA-crwg-2xph-4rc6.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-crwg-2xph-4rc6", - "modified": "2023-12-28T00:30:20Z", + "modified": "2024-01-04T21:30:23Z", "published": "2023-12-28T00:30:20Z", "aliases": [ "CVE-2023-49001" ], "details": "An issue in Indi Browser (aka kvbrowser) v.12.11.23 allows an attacker to bypass intended access restrictions via interaction with the com.example.gurry.kvbrowswer.webview component.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-27T22:15:16Z" diff --git a/advisories/unreviewed/2023/12/GHSA-gh6q-hg4q-mm5j/GHSA-gh6q-hg4q-mm5j.json b/advisories/unreviewed/2023/12/GHSA-gh6q-hg4q-mm5j/GHSA-gh6q-hg4q-mm5j.json index 656b9d3635e..5400bd26ba1 100644 --- a/advisories/unreviewed/2023/12/GHSA-gh6q-hg4q-mm5j/GHSA-gh6q-hg4q-mm5j.json +++ b/advisories/unreviewed/2023/12/GHSA-gh6q-hg4q-mm5j/GHSA-gh6q-hg4q-mm5j.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-gh6q-hg4q-mm5j", - "modified": "2023-12-26T21:30:33Z", + "modified": "2024-01-04T21:30:23Z", "published": "2023-12-26T21:30:33Z", "aliases": [ "CVE-2023-5674" ], "details": "The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-26T19:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-jf57-3c97-v2x5/GHSA-jf57-3c97-v2x5.json b/advisories/unreviewed/2023/12/GHSA-jf57-3c97-v2x5/GHSA-jf57-3c97-v2x5.json index 6fb2e6bd91d..81f3b502981 100644 --- a/advisories/unreviewed/2023/12/GHSA-jf57-3c97-v2x5/GHSA-jf57-3c97-v2x5.json +++ b/advisories/unreviewed/2023/12/GHSA-jf57-3c97-v2x5/GHSA-jf57-3c97-v2x5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jf57-3c97-v2x5", - "modified": "2023-12-28T12:30:18Z", + "modified": "2024-01-04T21:30:24Z", "published": "2023-12-28T12:30:18Z", "aliases": [ "CVE-2023-27447" diff --git a/advisories/unreviewed/2023/12/GHSA-jvgh-f9m8-mh2r/GHSA-jvgh-f9m8-mh2r.json b/advisories/unreviewed/2023/12/GHSA-jvgh-f9m8-mh2r/GHSA-jvgh-f9m8-mh2r.json index 703006bf21f..97fb0ffb258 100644 --- a/advisories/unreviewed/2023/12/GHSA-jvgh-f9m8-mh2r/GHSA-jvgh-f9m8-mh2r.json +++ b/advisories/unreviewed/2023/12/GHSA-jvgh-f9m8-mh2r/GHSA-jvgh-f9m8-mh2r.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jvgh-f9m8-mh2r", - "modified": "2023-12-28T12:30:18Z", + "modified": "2024-01-04T21:30:24Z", "published": "2023-12-28T12:30:18Z", "aliases": [ "CVE-2023-32513" diff --git a/advisories/unreviewed/2023/12/GHSA-mfr4-4gq8-693m/GHSA-mfr4-4gq8-693m.json b/advisories/unreviewed/2023/12/GHSA-mfr4-4gq8-693m/GHSA-mfr4-4gq8-693m.json index 85313d7ec46..24c35a68be5 100644 --- a/advisories/unreviewed/2023/12/GHSA-mfr4-4gq8-693m/GHSA-mfr4-4gq8-693m.json +++ b/advisories/unreviewed/2023/12/GHSA-mfr4-4gq8-693m/GHSA-mfr4-4gq8-693m.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mfr4-4gq8-693m", - "modified": "2023-12-21T15:30:32Z", + "modified": "2024-01-04T21:30:22Z", "published": "2023-12-21T15:30:32Z", "aliases": [ "CVE-2023-48115" ], "details": "SmarterTools SmarterMail 16.x 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainText are set in the same request.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-21T15:15:09Z" diff --git a/advisories/unreviewed/2023/12/GHSA-qmhv-fq76-x3j5/GHSA-qmhv-fq76-x3j5.json b/advisories/unreviewed/2023/12/GHSA-qmhv-fq76-x3j5/GHSA-qmhv-fq76-x3j5.json index 38f2272dc92..06550f7f1e0 100644 --- a/advisories/unreviewed/2023/12/GHSA-qmhv-fq76-x3j5/GHSA-qmhv-fq76-x3j5.json +++ b/advisories/unreviewed/2023/12/GHSA-qmhv-fq76-x3j5/GHSA-qmhv-fq76-x3j5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-qmhv-fq76-x3j5", - "modified": "2023-12-21T15:30:32Z", + "modified": "2024-01-04T21:30:22Z", "published": "2023-12-21T15:30:32Z", "aliases": [ "CVE-2023-48114" ], "details": "SmarterTools SmarterMail 16.x 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. This occurs because the application tries to allow youtube.com URLs, but actually allows youtube.com followed by an @ character and an attacker-controlled domain name.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-21T15:15:09Z" diff --git a/advisories/unreviewed/2023/12/GHSA-rjjc-gg9m-vhv8/GHSA-rjjc-gg9m-vhv8.json b/advisories/unreviewed/2023/12/GHSA-rjjc-gg9m-vhv8/GHSA-rjjc-gg9m-vhv8.json index e10e1f2580b..50826b68fb1 100644 --- a/advisories/unreviewed/2023/12/GHSA-rjjc-gg9m-vhv8/GHSA-rjjc-gg9m-vhv8.json +++ b/advisories/unreviewed/2023/12/GHSA-rjjc-gg9m-vhv8/GHSA-rjjc-gg9m-vhv8.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rjjc-gg9m-vhv8", - "modified": "2023-12-21T15:30:33Z", + "modified": "2024-01-04T21:30:22Z", "published": "2023-12-21T15:30:33Z", "aliases": [ "CVE-2023-7047" ], "details": "\nInadequate validation of permissions when employing remote tools and \nmacros via the context menu within Devolutions Remote Desktop Manager versions 2023.3.31 and \nearlier permits a user to initiate a connection without proper execution\n rights via the remote tools feature. This affects only SQL data sources.\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-21T15:15:14Z" diff --git a/advisories/unreviewed/2023/12/GHSA-v2pm-g2fx-6m9c/GHSA-v2pm-g2fx-6m9c.json b/advisories/unreviewed/2023/12/GHSA-v2pm-g2fx-6m9c/GHSA-v2pm-g2fx-6m9c.json index 0854f1b1d53..5ded4206a5d 100644 --- a/advisories/unreviewed/2023/12/GHSA-v2pm-g2fx-6m9c/GHSA-v2pm-g2fx-6m9c.json +++ b/advisories/unreviewed/2023/12/GHSA-v2pm-g2fx-6m9c/GHSA-v2pm-g2fx-6m9c.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-209" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/12/GHSA-v624-cfg3-pgh9/GHSA-v624-cfg3-pgh9.json b/advisories/unreviewed/2023/12/GHSA-v624-cfg3-pgh9/GHSA-v624-cfg3-pgh9.json index 96f7670ca77..ea4987b88c3 100644 --- a/advisories/unreviewed/2023/12/GHSA-v624-cfg3-pgh9/GHSA-v624-cfg3-pgh9.json +++ b/advisories/unreviewed/2023/12/GHSA-v624-cfg3-pgh9/GHSA-v624-cfg3-pgh9.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-v624-cfg3-pgh9", - "modified": "2023-12-26T21:30:33Z", + "modified": "2024-01-04T21:30:23Z", "published": "2023-12-26T21:30:33Z", "aliases": [ "CVE-2023-5939" ], "details": "The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, leading to remote code execution by privileged users.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-26T19:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-vpcq-h894-5962/GHSA-vpcq-h894-5962.json b/advisories/unreviewed/2023/12/GHSA-vpcq-h894-5962/GHSA-vpcq-h894-5962.json index 3f1b6e625a6..e46c9a92219 100644 --- a/advisories/unreviewed/2023/12/GHSA-vpcq-h894-5962/GHSA-vpcq-h894-5962.json +++ b/advisories/unreviewed/2023/12/GHSA-vpcq-h894-5962/GHSA-vpcq-h894-5962.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-vpcq-h894-5962", - "modified": "2023-12-28T06:30:24Z", + "modified": "2024-01-04T21:30:23Z", "published": "2023-12-28T06:30:24Z", "aliases": [ "CVE-2023-50692" ], "details": "File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parameter in the app/admin/exts/ directory.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-434" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-28T06:15:44Z" diff --git a/advisories/unreviewed/2023/12/GHSA-xhgx-7974-c8v6/GHSA-xhgx-7974-c8v6.json b/advisories/unreviewed/2023/12/GHSA-xhgx-7974-c8v6/GHSA-xhgx-7974-c8v6.json index 736b8d4af69..70c7b1dbe58 100644 --- a/advisories/unreviewed/2023/12/GHSA-xhgx-7974-c8v6/GHSA-xhgx-7974-c8v6.json +++ b/advisories/unreviewed/2023/12/GHSA-xhgx-7974-c8v6/GHSA-xhgx-7974-c8v6.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-xhgx-7974-c8v6", - "modified": "2023-12-27T21:31:01Z", + "modified": "2024-01-04T21:30:23Z", "published": "2023-12-27T21:31:01Z", "aliases": [ "CVE-2023-51084" ], "details": "hyavijava v6.0.07.1 was discovered to contain a stack overflow via the ResultConverter.convert2Xml method.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-27T21:15:08Z" diff --git a/advisories/unreviewed/2024/01/GHSA-4553-hq82-8654/GHSA-4553-hq82-8654.json b/advisories/unreviewed/2024/01/GHSA-4553-hq82-8654/GHSA-4553-hq82-8654.json new file mode 100644 index 00000000000..fd3f63bf0f7 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-4553-hq82-8654/GHSA-4553-hq82-8654.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4553-hq82-8654", + "modified": "2024-01-04T21:30:24Z", + "published": "2024-01-04T21:30:24Z", + "aliases": [ + "CVE-2024-0241" + ], + "details": "encoded_id-rails versions before 1.0.0.beta2 are affected by an uncontrolled resource consumption vulnerability. A remote and unauthenticated attacker might cause a denial of service condition by sending an HTTP request with an extremely long \"id\" parameter.\n\n", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/stevegeek/encoded_id-rails/security/advisories/GHSA-3px7-jm2p-6h2c" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0241" + }, + { + "type": "WEB", + "url": "https://github.com/stevegeek/encoded_id-rails/commit/afa495a77b8a21ad582611f9cdc2081dc4018b91" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-3px7-jm2p-6h2c" + }, + { + "type": "WEB", + "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-3px7-jm2p-6h2c" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-04T21:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-4j3v-h4q8-j269/GHSA-4j3v-h4q8-j269.json b/advisories/unreviewed/2024/01/GHSA-4j3v-h4q8-j269/GHSA-4j3v-h4q8-j269.json new file mode 100644 index 00000000000..9fa7f55e2b6 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-4j3v-h4q8-j269/GHSA-4j3v-h4q8-j269.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4j3v-h4q8-j269", + "modified": "2024-01-04T21:30:24Z", + "published": "2024-01-04T21:30:24Z", + "aliases": [ + "CVE-2023-51812" + ], + "details": "Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution (RCE) vulnerability via the list parameter at /goform/SetNetControlList.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51812" + }, + { + "type": "WEB", + "url": "https://gitee.com/blue_ty/cms/issues/I8PG2A" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-04T19:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-4mvm-xh8j-fv27/GHSA-4mvm-xh8j-fv27.json b/advisories/unreviewed/2024/01/GHSA-4mvm-xh8j-fv27/GHSA-4mvm-xh8j-fv27.json new file mode 100644 index 00000000000..69f886afd0c --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-4mvm-xh8j-fv27/GHSA-4mvm-xh8j-fv27.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4mvm-xh8j-fv27", + "modified": "2024-01-04T21:30:24Z", + "published": "2024-01-04T21:30:24Z", + "aliases": [ + "CVE-2024-22048" + ], + "details": "govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.\n\n", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22048" + }, + { + "type": "WEB", + "url": "https://github.com/alphagov/tech-docs-gem/pull/323" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-x2xw-hw8g-6773" + }, + { + "type": "WEB", + "url": "https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1" + }, + { + "type": "WEB", + "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-04T21:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-59j2-44h9-8h98/GHSA-59j2-44h9-8h98.json b/advisories/unreviewed/2024/01/GHSA-59j2-44h9-8h98/GHSA-59j2-44h9-8h98.json new file mode 100644 index 00000000000..be1ba5587c1 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-59j2-44h9-8h98/GHSA-59j2-44h9-8h98.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-59j2-44h9-8h98", + "modified": "2024-01-04T21:30:24Z", + "published": "2024-01-04T21:30:24Z", + "aliases": [ + "CVE-2023-51154" + ], + "details": "Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51154" + }, + { + "type": "WEB", + "url": "https://gitee.com/blue_ty/cms/issues/I8O7IV" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-04T19:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-c2v4-chx5-vff6/GHSA-c2v4-chx5-vff6.json b/advisories/unreviewed/2024/01/GHSA-c2v4-chx5-vff6/GHSA-c2v4-chx5-vff6.json new file mode 100644 index 00000000000..cbde99da9fa --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-c2v4-chx5-vff6/GHSA-c2v4-chx5-vff6.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c2v4-chx5-vff6", + "modified": "2024-01-04T21:30:24Z", + "published": "2024-01-04T21:30:24Z", + "aliases": [ + "CVE-2024-22051" + ], + "details": "CommonMarker versions prior to 0.23.4 are at risk of an integer overflow vulnerability. This vulnerability can result in possibly unauthenticated remote attackers to cause heap memory corruption, potentially leading to an information leak or remote code execution, via parsing tables with marker rows that contain more than UINT16_MAX columns.\n\n", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x" + }, + { + "type": "WEB", + "url": "https://github.com/gjtorikian/commonmarker/security/advisories/GHSA-fmx4-26r3-wxpf" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22051" + }, + { + "type": "WEB", + "url": "https://github.com/gjtorikian/commonmarker/commit/ab4504fd17460627a6ab255bc3c63e8e5fc6aed3" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-fmx4-26r3-wxpf" + }, + { + "type": "WEB", + "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-fmx4-26r3-wxpf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-04T21:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-g47j-3m2m-74qv/GHSA-g47j-3m2m-74qv.json b/advisories/unreviewed/2024/01/GHSA-g47j-3m2m-74qv/GHSA-g47j-3m2m-74qv.json new file mode 100644 index 00000000000..4627b948a47 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-g47j-3m2m-74qv/GHSA-g47j-3m2m-74qv.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g47j-3m2m-74qv", + "modified": "2024-01-04T21:30:24Z", + "published": "2024-01-04T21:30:24Z", + "aliases": [ + "CVE-2024-22049" + ], + "details": "httparty before 0.21.0 is vulnerable to an assumed-immutable web parameter vulnerability. A remote and unauthenticated attacker can provide a crafted filename parameter during multipart/form-data uploads which could result in attacker controlled filenames being written.\n\n", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/jnunemaker/httparty/security/advisories/GHSA-5pq7-52mg-hr42" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22049" + }, + { + "type": "WEB", + "url": "https://github.com/jnunemaker/httparty/commit/cdb45a678c43e44570b4e73f84b1abeb5ec22b8e" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-5pq7-52mg-hr42" + }, + { + "type": "WEB", + "url": "https://github.com/jnunemaker/httparty/blob/4416141d37fd71bdba4f37589ec265f55aa446ce/lib/httparty/request/body.rb#L43" + }, + { + "type": "WEB", + "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-5pq7-52mg-hr42" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-472" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-04T21:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-qwf7-rv77-fcr3/GHSA-qwf7-rv77-fcr3.json b/advisories/unreviewed/2024/01/GHSA-qwf7-rv77-fcr3/GHSA-qwf7-rv77-fcr3.json new file mode 100644 index 00000000000..957142285bb --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-qwf7-rv77-fcr3/GHSA-qwf7-rv77-fcr3.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qwf7-rv77-fcr3", + "modified": "2024-01-04T21:30:24Z", + "published": "2024-01-04T21:30:24Z", + "aliases": [ + "CVE-2024-22050" + ], + "details": "Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.\n\n", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22050" + }, + { + "type": "WEB", + "url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-85rf-xh54-whp3" + }, + { + "type": "WEB", + "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-04T21:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-v444-jggx-6v7f/GHSA-v444-jggx-6v7f.json b/advisories/unreviewed/2024/01/GHSA-v444-jggx-6v7f/GHSA-v444-jggx-6v7f.json new file mode 100644 index 00000000000..5fe246e99bc --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-v444-jggx-6v7f/GHSA-v444-jggx-6v7f.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v444-jggx-6v7f", + "modified": "2024-01-04T21:30:24Z", + "published": "2024-01-04T21:30:24Z", + "aliases": [ + "CVE-2024-22047" + ], + "details": "A race condition exists in Audited 4.0.0 to 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/collectiveidea/audited/security/advisories/GHSA-hjp3-5g2q-7jww" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22047" + }, + { + "type": "WEB", + "url": "https://github.com/collectiveidea/audited/issues/601" + }, + { + "type": "WEB", + "url": "https://github.com/collectiveidea/audited/pull/669" + }, + { + "type": "WEB", + "url": "https://github.com/collectiveidea/audited/pull/671" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-hjp3-5g2q-7jww" + }, + { + "type": "WEB", + "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-hjp3-5g2q-7jww" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-362" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-04T21:15:09Z" + } +} \ No newline at end of file