From 7954c57247cce02bd392c83af583de80f0c27bc4 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 26 Jan 2024 19:59:54 +0000 Subject: [PATCH] Publish Advisories GHSA-2q8v-3gqq-4f8p GHSA-frxm-v7q3-v2wv GHSA-hfj8-63c8-rmfw GHSA-hv5g-q4h3-64q4 GHSA-wc6f-qjxc-622v --- .../2024/01/GHSA-2q8v-3gqq-4f8p/GHSA-2q8v-3gqq-4f8p.json | 3 ++- .../2024/01/GHSA-frxm-v7q3-v2wv/GHSA-frxm-v7q3-v2wv.json | 7 +++++-- .../2024/01/GHSA-hfj8-63c8-rmfw/GHSA-hfj8-63c8-rmfw.json | 7 +++++-- .../2024/01/GHSA-hv5g-q4h3-64q4/GHSA-hv5g-q4h3-64q4.json | 9 ++++++--- .../2024/01/GHSA-wc6f-qjxc-622v/GHSA-wc6f-qjxc-622v.json | 7 +++++-- 5 files changed, 23 insertions(+), 10 deletions(-) diff --git a/advisories/github-reviewed/2024/01/GHSA-2q8v-3gqq-4f8p/GHSA-2q8v-3gqq-4f8p.json b/advisories/github-reviewed/2024/01/GHSA-2q8v-3gqq-4f8p/GHSA-2q8v-3gqq-4f8p.json index c7deed46a78..a601d7be2fe 100644 --- a/advisories/github-reviewed/2024/01/GHSA-2q8v-3gqq-4f8p/GHSA-2q8v-3gqq-4f8p.json +++ b/advisories/github-reviewed/2024/01/GHSA-2q8v-3gqq-4f8p/GHSA-2q8v-3gqq-4f8p.json @@ -59,7 +59,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-120" + "CWE-120", + "CWE-787" ], "severity": "HIGH", "github_reviewed": true, diff --git a/advisories/github-reviewed/2024/01/GHSA-frxm-v7q3-v2wv/GHSA-frxm-v7q3-v2wv.json b/advisories/github-reviewed/2024/01/GHSA-frxm-v7q3-v2wv/GHSA-frxm-v7q3-v2wv.json index 81f58c90f88..1b753584ced 100644 --- a/advisories/github-reviewed/2024/01/GHSA-frxm-v7q3-v2wv/GHSA-frxm-v7q3-v2wv.json +++ b/advisories/github-reviewed/2024/01/GHSA-frxm-v7q3-v2wv/GHSA-frxm-v7q3-v2wv.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-frxm-v7q3-v2wv", - "modified": "2024-01-23T14:36:57Z", + "modified": "2024-01-26T19:58:42Z", "published": "2024-01-20T00:30:27Z", "aliases": [ "CVE-2024-23686" @@ -9,7 +9,10 @@ "summary": "Insertion of Sensitive Information into Log File in OWASP DependencyCheck", "details": "DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } ], "affected": [ { diff --git a/advisories/github-reviewed/2024/01/GHSA-hfj8-63c8-rmfw/GHSA-hfj8-63c8-rmfw.json b/advisories/github-reviewed/2024/01/GHSA-hfj8-63c8-rmfw/GHSA-hfj8-63c8-rmfw.json index 2ed8b5315eb..9e8b821b302 100644 --- a/advisories/github-reviewed/2024/01/GHSA-hfj8-63c8-rmfw/GHSA-hfj8-63c8-rmfw.json +++ b/advisories/github-reviewed/2024/01/GHSA-hfj8-63c8-rmfw/GHSA-hfj8-63c8-rmfw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hfj8-63c8-rmfw", - "modified": "2024-01-23T14:36:37Z", + "modified": "2024-01-26T19:58:40Z", "published": "2024-01-19T21:30:36Z", "aliases": [ "CVE-2024-23684" @@ -9,7 +9,10 @@ "summary": "Inefficient Algorithmic Complexity in com.upokecenter:cbor", "details": "Inefficient algorithmic complexity in DecodeFromBytes function in com.upokecenter.cbor Java implementation of Concise Binary Object Representation (CBOR) versions 4.0.0 to 4.5.1 allows an attacker to cause a denial of service by passing a maliciously crafted input. Depending on an application's use of this library, this may be a remote attacker.\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ { diff --git a/advisories/github-reviewed/2024/01/GHSA-hv5g-q4h3-64q4/GHSA-hv5g-q4h3-64q4.json b/advisories/github-reviewed/2024/01/GHSA-hv5g-q4h3-64q4/GHSA-hv5g-q4h3-64q4.json index ea802df53bc..00c5f165b98 100644 --- a/advisories/github-reviewed/2024/01/GHSA-hv5g-q4h3-64q4/GHSA-hv5g-q4h3-64q4.json +++ b/advisories/github-reviewed/2024/01/GHSA-hv5g-q4h3-64q4/GHSA-hv5g-q4h3-64q4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hv5g-q4h3-64q4", - "modified": "2024-01-23T14:35:53Z", + "modified": "2024-01-26T19:58:39Z", "published": "2024-01-19T21:30:37Z", "aliases": [ "CVE-2024-23685" @@ -9,7 +9,10 @@ "summary": "Hard-coded credentials in org.folio:mod-remote-storage", "details": "Hard-coded credentials in mod-remote-storage versions under 1.7.2 and from 2.0.0 to 2.0.3 allows unauthorized users to gain read access to mod-inventory-storage records including instances, holdings, items, contributor-types, and identifier-types.\n\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } ], "affected": [ { @@ -83,7 +86,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-798" ], "severity": "MODERATE", "github_reviewed": true, diff --git a/advisories/github-reviewed/2024/01/GHSA-wc6f-qjxc-622v/GHSA-wc6f-qjxc-622v.json b/advisories/github-reviewed/2024/01/GHSA-wc6f-qjxc-622v/GHSA-wc6f-qjxc-622v.json index dbfebcb9786..4b9da44dfa3 100644 --- a/advisories/github-reviewed/2024/01/GHSA-wc6f-qjxc-622v/GHSA-wc6f-qjxc-622v.json +++ b/advisories/github-reviewed/2024/01/GHSA-wc6f-qjxc-622v/GHSA-wc6f-qjxc-622v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wc6f-qjxc-622v", - "modified": "2024-01-23T14:35:11Z", + "modified": "2024-01-26T19:58:37Z", "published": "2024-01-19T21:30:36Z", "aliases": [ "CVE-2024-0758" @@ -9,7 +9,10 @@ "summary": "JavaScript execution via malicious molfiles (XSS)", "details": "MolecularFaces before 0.3.0 is vulnerable to cross site scripting. A remote attacker can execute arbitrary JavaScript in the context of a victim browser via crafted molfiles.\n\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ {