Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-09-23 21:31:53 +00:00
parent 03a47e13b4
commit 71373c1c93
34 changed files with 525 additions and 52 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-ch7q-gpff-h9hp",
-  "modified": "2024-08-12T15:30:47Z",
+  "modified": "2024-09-23T21:30:46Z",
  "published": "2024-07-09T00:31:40Z",
  "aliases": [
    "CVE-2024-3653"
@@ -64,6 +64,10 @@
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:5147"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2024:6437"
+    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2024-3653"
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-284"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-284"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-284"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-284"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-306"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-284"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -36,7 +36,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-94"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -28,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-327",
      "CWE-532"
    ],
    "severity": "HIGH",
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-vqhw-2g88-5gvm",
-  "modified": "2024-05-01T18:30:35Z",
+  "modified": "2024-09-23T21:30:46Z",
  "published": "2024-01-16T15:30:28Z",
  "aliases": [
    "CVE-2024-0582"
@@ -28,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-119",
      "CWE-788"
    ],
    "severity": "HIGH",
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3q47-272x-vrfj",
-  "modified": "2024-09-17T00:31:03Z",
+  "modified": "2024-09-23T21:30:46Z",
  "published": "2024-09-17T00:31:03Z",
  "aliases": [
    "CVE-2024-27861"
  ],
  "details": "The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An application may be able to read restricted memory.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-17T00:15:47Z"
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4843-jw5m-c4mr",
+  "modified": "2024-09-23T21:30:47Z",
+  "published": "2024-09-23T21:30:47Z",
+  "aliases": [
+    "CVE-2024-39843"
+  ],
+  "details": "A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via create user form inputs.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39843"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/centreon/centreon/releases"
+    },
+    {
+      "type": "WEB",
+      "url": "https://thewatch.centreon.com/latest-security-bulletins-64/security-bulletin-for-centreon-web-3809"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-23T19:15:13Z"
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-496q-mjmq-q8ww",
-  "modified": "2024-09-17T00:31:04Z",
+  "modified": "2024-09-23T21:30:46Z",
  "published": "2024-09-17T00:31:04Z",
  "aliases": [
    "CVE-2024-40830"
  ],
  "details": "This issue was addressed with improved data protection. This issue is fixed in iOS 18 and iPadOS 18. An app may be able to enumerate a user's installed apps.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "LOW",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-17T00:15:48Z"
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6r2w-57p9-f5hh",
+  "modified": "2024-09-23T21:30:47Z",
+  "published": "2024-09-23T21:30:47Z",
+  "aliases": [
+    "CVE-2024-43201"
+  ],
+  "details": "The Planet Fitness Workouts iOS and Android mobile apps prior to version 9.8.12 (released on 2024-07-25) fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:L/U:Amber"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43201"
+    },
+    {
+      "type": "WEB",
+      "url": "https://apps.apple.com/us/app/planet-fitness-workouts/id399857015"
+    },
+    {
+      "type": "WEB",
+      "url": "https://dontvacuum.me/bugs/pf"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-295"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-23T20:15:04Z"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7pp5-7gq3-2q5p",
+  "modified": "2024-09-23T21:30:47Z",
+  "published": "2024-09-23T21:30:47Z",
+  "aliases": [
+    "CVE-2024-46639"
+  ],
+  "details": "A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46639"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gist.github.com/0xashfaq/45c3f300d125468161c3fa6e38576769"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/0xashfaq/-HelpDeskZ-v2.0.2---Stored-Cross-Site-Scripting-XSS-"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-94"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-23T20:15:05Z"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-85x9-4hm3-78m9",
+  "modified": "2024-09-23T21:30:47Z",
+  "published": "2024-09-23T21:30:47Z",
+  "aliases": [
+    "CVE-2024-37779"
+  ],
+  "details": "WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant script functionality.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37779"
+    },
+    {
+      "type": "WEB",
+      "url": "https://medium.com/%40daviddepaulasantos/our-brand-new-cve-authenticated-remote-code-execution-rce-on-elvis-dam-c544d879ef1e"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.woodwing.com"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-94"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-23T20:15:04Z"
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8x82-8rpw-g64h",
-  "modified": "2024-09-17T00:31:03Z",
+  "modified": "2024-09-23T21:30:46Z",
  "published": "2024-09-17T00:31:03Z",
  "aliases": [
    "CVE-2024-27860"
  ],
  "details": "The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An application may be able to read restricted memory.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-17T00:15:47Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c4jq-v98x-5qm2",
-  "modified": "2024-09-19T18:30:52Z",
+  "modified": "2024-09-23T21:30:47Z",
  "published": "2024-09-19T18:30:52Z",
  "aliases": [
    "CVE-2024-31570"
  ],
  "details": "libfreeimage in FreeImage 3.4.0 through 3.18.0 has a stack-based buffer overflow in the PluginXPM.cpp Load function via an XPM file.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-121"
    ],
-    "severity": null,
+    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-19T17:15:12Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hc48-m7gp-vcrj",
-  "modified": "2024-09-23T18:30:34Z",
+  "modified": "2024-09-23T21:30:47Z",
  "published": "2024-09-23T18:30:34Z",
  "aliases": [
    "CVE-2023-46948"
  ],
  "details": "A reflected Cross-Site Scripting (XSS) vulnerability was found on Temenos T24 Browser R19.40 that enables a remote attacker to execute arbitrary JavaScript code via the skin parameter in the about.jsp and genrequest.jsp components.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-23T18:15:03Z"
--- a/Show More
+++ b/Show More