From 7047dfe3dd2271995e7d65cef367482f4e0c848c Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 7 May 2024 00:32:00 +0000
Subject: [PATCH] Publish Advisories

GHSA-h4fj-pp9j-x2mj
GHSA-pf9m-g9g6-cphc
GHSA-wh7x-ww7q-h9hp
---
 .../GHSA-h4fj-pp9j-x2mj.json                  | 38 +++++++++++++++++++
 .../GHSA-pf9m-g9g6-cphc.json                  | 35 +++++++++++++++++
 .../GHSA-wh7x-ww7q-h9hp.json                  | 35 +++++++++++++++++
 3 files changed, 108 insertions(+)
 create mode 100644 advisories/unreviewed/2024/05/GHSA-h4fj-pp9j-x2mj/GHSA-h4fj-pp9j-x2mj.json
 create mode 100644 advisories/unreviewed/2024/05/GHSA-pf9m-g9g6-cphc/GHSA-pf9m-g9g6-cphc.json
 create mode 100644 advisories/unreviewed/2024/05/GHSA-wh7x-ww7q-h9hp/GHSA-wh7x-ww7q-h9hp.json

diff --git a/advisories/unreviewed/2024/05/GHSA-h4fj-pp9j-x2mj/GHSA-h4fj-pp9j-x2mj.json b/advisories/unreviewed/2024/05/GHSA-h4fj-pp9j-x2mj/GHSA-h4fj-pp9j-x2mj.json
new file mode 100644
index 00000000000..2786dc2f304
--- /dev/null
+++ b/advisories/unreviewed/2024/05/GHSA-h4fj-pp9j-x2mj/GHSA-h4fj-pp9j-x2mj.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-h4fj-pp9j-x2mj",
+  "modified": "2024-05-07T00:30:35Z",
+  "published": "2024-05-07T00:30:35Z",
+  "aliases": [
+    "CVE-2024-2913"
+  ],
+  "details": "A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowing the creation of multiple user accounts from a single invite link intended for only one user. This bypasses the intended security mechanism that restricts invite acceptance to a single user, leading to unauthorized user creation without detection in the invite tab. The issue is due to the lack of validation for concurrent requests in the backend.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2913"
+    },
+    {
+      "type": "WEB",
+      "url": "https://huntr.com/bounties/a3c69faf-cca0-4c10-8739-57e5bef7a95f"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-367"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-07T00:15:08Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/05/GHSA-pf9m-g9g6-cphc/GHSA-pf9m-g9g6-cphc.json b/advisories/unreviewed/2024/05/GHSA-pf9m-g9g6-cphc/GHSA-pf9m-g9g6-cphc.json
new file mode 100644
index 00000000000..8775190c18e
--- /dev/null
+++ b/advisories/unreviewed/2024/05/GHSA-pf9m-g9g6-cphc/GHSA-pf9m-g9g6-cphc.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-pf9m-g9g6-cphc",
+  "modified": "2024-05-07T00:30:34Z",
+  "published": "2024-05-07T00:30:34Z",
+  "aliases": [
+    "CVE-2024-30973"
+  ],
+  "details": "An issue in V-SOL G/EPON ONU HG323AC-B with firmware version V2.0.08-210715 allows an attacker to execute arbtirary code and obtain sensitive information via crafted POST request to /boaform/getASPdata/formFirewall, /boaform/getASPdata/formAcc.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30973"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Athos-Zago/CVE-2024-30973/tree/main"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-06T22:15:08Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/05/GHSA-wh7x-ww7q-h9hp/GHSA-wh7x-ww7q-h9hp.json b/advisories/unreviewed/2024/05/GHSA-wh7x-ww7q-h9hp/GHSA-wh7x-ww7q-h9hp.json
new file mode 100644
index 00000000000..7880faed4f8
--- /dev/null
+++ b/advisories/unreviewed/2024/05/GHSA-wh7x-ww7q-h9hp/GHSA-wh7x-ww7q-h9hp.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wh7x-ww7q-h9hp",
+  "modified": "2024-05-07T00:30:35Z",
+  "published": "2024-05-07T00:30:35Z",
+  "aliases": [
+    "CVE-2024-29941"
+  ],
+  "details": "Insecure storage of the ICT MIFARE and DESFire encryption keys in the firmware\nbinary allows malicious actors to create credentials for any site code and card number that is using the default\nICT encryption.\n\n",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29941"
+    },
+    {
+      "type": "WEB",
+      "url": "https://ict.co/media/1xdhaugi/credential-cloning.pdf"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-06T23:15:06Z"
+  }
+}
\ No newline at end of file