From 7ba0bf25abae0e4ce682682dd9d16d8e6e19e7ba Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 14 Oct 2024 06:32:08 +0000 Subject: [PATCH] Publish Advisories GHSA-52cw-mfvg-73mg GHSA-2pwg-h86c-qrp2 GHSA-pf66-674w-hm6h GHSA-vppr-7254-jpr7 GHSA-xhqg-j6g5-rp58 GHSA-xvj2-9xh2-gvhq GHSA-5297-2xjq-2cfx GHSA-gh2c-3f8j-9ph4 GHSA-g7qw-4p9h-v9vx GHSA-wv9r-p2rc-jcrp GHSA-x6hq-v32r-w2qr GHSA-8jgf-8r3g-hxh8 GHSA-mr42-8xpc-qj99 GHSA-q75j-x536-63r5 --- .../GHSA-52cw-mfvg-73mg.json | 3 +- .../GHSA-2pwg-h86c-qrp2.json | 3 +- .../GHSA-pf66-674w-hm6h.json | 1 + .../GHSA-vppr-7254-jpr7.json | 3 +- .../GHSA-xhqg-j6g5-rp58.json | 5 +- .../GHSA-xvj2-9xh2-gvhq.json | 5 +- .../GHSA-5297-2xjq-2cfx.json | 3 +- .../GHSA-gh2c-3f8j-9ph4.json | 1 + .../GHSA-g7qw-4p9h-v9vx.json | 3 +- .../GHSA-wv9r-p2rc-jcrp.json | 3 +- .../GHSA-x6hq-v32r-w2qr.json | 1 + .../GHSA-8jgf-8r3g-hxh8.json | 62 +++++++++++++++++++ .../GHSA-mr42-8xpc-qj99.json | 42 +++++++++++++ .../GHSA-q75j-x536-63r5.json | 42 +++++++++++++ 14 files changed, 167 insertions(+), 10 deletions(-) create mode 100644 advisories/unreviewed/2024/10/GHSA-8jgf-8r3g-hxh8/GHSA-8jgf-8r3g-hxh8.json create mode 100644 advisories/unreviewed/2024/10/GHSA-mr42-8xpc-qj99/GHSA-mr42-8xpc-qj99.json create mode 100644 advisories/unreviewed/2024/10/GHSA-q75j-x536-63r5/GHSA-q75j-x536-63r5.json diff --git a/advisories/unreviewed/2023/06/GHSA-52cw-mfvg-73mg/GHSA-52cw-mfvg-73mg.json b/advisories/unreviewed/2023/06/GHSA-52cw-mfvg-73mg/GHSA-52cw-mfvg-73mg.json index 0d61a3fc44e..b8ec6f640cc 100644 --- a/advisories/unreviewed/2023/06/GHSA-52cw-mfvg-73mg/GHSA-52cw-mfvg-73mg.json +++ b/advisories/unreviewed/2023/06/GHSA-52cw-mfvg-73mg/GHSA-52cw-mfvg-73mg.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-77" + "CWE-77", + "CWE-78" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/07/GHSA-2pwg-h86c-qrp2/GHSA-2pwg-h86c-qrp2.json b/advisories/unreviewed/2023/07/GHSA-2pwg-h86c-qrp2/GHSA-2pwg-h86c-qrp2.json index 886445d6aa8..9096426f60d 100644 --- a/advisories/unreviewed/2023/07/GHSA-2pwg-h86c-qrp2/GHSA-2pwg-h86c-qrp2.json +++ b/advisories/unreviewed/2023/07/GHSA-2pwg-h86c-qrp2/GHSA-2pwg-h86c-qrp2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-2pwg-h86c-qrp2", - "modified": "2024-04-04T05:48:38Z", + "modified": "2024-10-14T06:30:42Z", "published": "2023-07-06T21:15:07Z", "aliases": [ "CVE-2023-28703" @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-121", "CWE-787" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2023/07/GHSA-pf66-674w-hm6h/GHSA-pf66-674w-hm6h.json b/advisories/unreviewed/2023/07/GHSA-pf66-674w-hm6h/GHSA-pf66-674w-hm6h.json index 6d8f0d44b40..5f4ae26cf8c 100644 --- a/advisories/unreviewed/2023/07/GHSA-pf66-674w-hm6h/GHSA-pf66-674w-hm6h.json +++ b/advisories/unreviewed/2023/07/GHSA-pf66-674w-hm6h/GHSA-pf66-674w-hm6h.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-321", "CWE-798" ], "severity": "CRITICAL", diff --git a/advisories/unreviewed/2023/07/GHSA-vppr-7254-jpr7/GHSA-vppr-7254-jpr7.json b/advisories/unreviewed/2023/07/GHSA-vppr-7254-jpr7/GHSA-vppr-7254-jpr7.json index a7c15140855..c4801e0cfb6 100644 --- a/advisories/unreviewed/2023/07/GHSA-vppr-7254-jpr7/GHSA-vppr-7254-jpr7.json +++ b/advisories/unreviewed/2023/07/GHSA-vppr-7254-jpr7/GHSA-vppr-7254-jpr7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vppr-7254-jpr7", - "modified": "2024-04-04T05:48:43Z", + "modified": "2024-10-14T06:30:42Z", "published": "2023-07-06T21:15:07Z", "aliases": [ "CVE-2023-30603" @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-1392", "CWE-287" ], "severity": "CRITICAL", diff --git a/advisories/unreviewed/2023/07/GHSA-xhqg-j6g5-rp58/GHSA-xhqg-j6g5-rp58.json b/advisories/unreviewed/2023/07/GHSA-xhqg-j6g5-rp58/GHSA-xhqg-j6g5-rp58.json index 9a12c7a07f9..0ad2d25b9de 100644 --- a/advisories/unreviewed/2023/07/GHSA-xhqg-j6g5-rp58/GHSA-xhqg-j6g5-rp58.json +++ b/advisories/unreviewed/2023/07/GHSA-xhqg-j6g5-rp58/GHSA-xhqg-j6g5-rp58.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xhqg-j6g5-rp58", - "modified": "2024-04-04T05:48:41Z", + "modified": "2024-10-14T06:30:42Z", "published": "2023-07-06T21:15:07Z", "aliases": [ "CVE-2023-30602" @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-311" + "CWE-311", + "CWE-319" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/08/GHSA-xvj2-9xh2-gvhq/GHSA-xvj2-9xh2-gvhq.json b/advisories/unreviewed/2023/08/GHSA-xvj2-9xh2-gvhq/GHSA-xvj2-9xh2-gvhq.json index 752ea7028c3..5b479a222d6 100644 --- a/advisories/unreviewed/2023/08/GHSA-xvj2-9xh2-gvhq/GHSA-xvj2-9xh2-gvhq.json +++ b/advisories/unreviewed/2023/08/GHSA-xvj2-9xh2-gvhq/GHSA-xvj2-9xh2-gvhq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xvj2-9xh2-gvhq", - "modified": "2024-04-04T07:13:57Z", + "modified": "2024-10-14T06:30:43Z", "published": "2023-08-28T06:30:19Z", "aliases": [ "CVE-2023-38027" @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-77" + "CWE-77", + "CWE-78" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/11/GHSA-5297-2xjq-2cfx/GHSA-5297-2xjq-2cfx.json b/advisories/unreviewed/2023/11/GHSA-5297-2xjq-2cfx/GHSA-5297-2xjq-2cfx.json index 25864eaeada..f36c4f4dc87 100644 --- a/advisories/unreviewed/2023/11/GHSA-5297-2xjq-2cfx/GHSA-5297-2xjq-2cfx.json +++ b/advisories/unreviewed/2023/11/GHSA-5297-2xjq-2cfx/GHSA-5297-2xjq-2cfx.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-940" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/11/GHSA-gh2c-3f8j-9ph4/GHSA-gh2c-3f8j-9ph4.json b/advisories/unreviewed/2023/11/GHSA-gh2c-3f8j-9ph4/GHSA-gh2c-3f8j-9ph4.json index 8ac51c95dc4..9ec27ba5479 100644 --- a/advisories/unreviewed/2023/11/GHSA-gh2c-3f8j-9ph4/GHSA-gh2c-3f8j-9ph4.json +++ b/advisories/unreviewed/2023/11/GHSA-gh2c-3f8j-9ph4/GHSA-gh2c-3f8j-9ph4.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-22", "CWE-639" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2023/12/GHSA-g7qw-4p9h-v9vx/GHSA-g7qw-4p9h-v9vx.json b/advisories/unreviewed/2023/12/GHSA-g7qw-4p9h-v9vx/GHSA-g7qw-4p9h-v9vx.json index bf797158a40..53f67136627 100644 --- a/advisories/unreviewed/2023/12/GHSA-g7qw-4p9h-v9vx/GHSA-g7qw-4p9h-v9vx.json +++ b/advisories/unreviewed/2023/12/GHSA-g7qw-4p9h-v9vx/GHSA-g7qw-4p9h-v9vx.json @@ -29,7 +29,8 @@ "database_specific": { "cwe_ids": [ "CWE-20", - "CWE-79" + "CWE-79", + "CWE-940" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/12/GHSA-wv9r-p2rc-jcrp/GHSA-wv9r-p2rc-jcrp.json b/advisories/unreviewed/2023/12/GHSA-wv9r-p2rc-jcrp/GHSA-wv9r-p2rc-jcrp.json index 2002ea86105..b046f8312fd 100644 --- a/advisories/unreviewed/2023/12/GHSA-wv9r-p2rc-jcrp/GHSA-wv9r-p2rc-jcrp.json +++ b/advisories/unreviewed/2023/12/GHSA-wv9r-p2rc-jcrp/GHSA-wv9r-p2rc-jcrp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wv9r-p2rc-jcrp", - "modified": "2023-12-22T18:30:30Z", + "modified": "2024-10-14T06:30:43Z", "published": "2023-12-15T12:30:24Z", "aliases": [ "CVE-2023-48392" @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-321", "CWE-798" ], "severity": "CRITICAL", diff --git a/advisories/unreviewed/2024/01/GHSA-x6hq-v32r-w2qr/GHSA-x6hq-v32r-w2qr.json b/advisories/unreviewed/2024/01/GHSA-x6hq-v32r-w2qr/GHSA-x6hq-v32r-w2qr.json index eb943226a19..2b9d1d93fc8 100644 --- a/advisories/unreviewed/2024/01/GHSA-x6hq-v32r-w2qr/GHSA-x6hq-v32r-w2qr.json +++ b/advisories/unreviewed/2024/01/GHSA-x6hq-v32r-w2qr/GHSA-x6hq-v32r-w2qr.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-306", "CWE-610" ], "severity": "CRITICAL", diff --git a/advisories/unreviewed/2024/10/GHSA-8jgf-8r3g-hxh8/GHSA-8jgf-8r3g-hxh8.json b/advisories/unreviewed/2024/10/GHSA-8jgf-8r3g-hxh8/GHSA-8jgf-8r3g-hxh8.json new file mode 100644 index 00000000000..27f2f59c711 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-8jgf-8r3g-hxh8/GHSA-8jgf-8r3g-hxh8.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8jgf-8r3g-hxh8", + "modified": "2024-10-14T06:30:43Z", + "published": "2024-10-14T06:30:43Z", + "aliases": [ + "CVE-2024-49214" + ], + "details": "QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. This can bypass the IP allow/block list functionality.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49214" + }, + { + "type": "WEB", + "url": "https://github.com/haproxy/haproxy/commit/f627b9272bd8ffca6f2f898bfafc6bf0b84b7d46" + }, + { + "type": "WEB", + "url": "https://www.haproxy.org/download/2.9/src/CHANGELOG" + }, + { + "type": "WEB", + "url": "https://www.haproxy.org/download/3.0/src/CHANGELOG" + }, + { + "type": "WEB", + "url": "https://www.haproxy.org/download/3.1/src/CHANGELOG" + }, + { + "type": "WEB", + "url": "https://www.mail-archive.com/haproxy%40formilux.org/msg45291.html" + }, + { + "type": "WEB", + "url": "https://www.mail-archive.com/haproxy%40formilux.org/msg45314.html" + }, + { + "type": "WEB", + "url": "https://www.mail-archive.com/haproxy%40formilux.org/msg45315.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-14T04:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-mr42-8xpc-qj99/GHSA-mr42-8xpc-qj99.json b/advisories/unreviewed/2024/10/GHSA-mr42-8xpc-qj99/GHSA-mr42-8xpc-qj99.json new file mode 100644 index 00000000000..36a8166678d --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-mr42-8xpc-qj99/GHSA-mr42-8xpc-qj99.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mr42-8xpc-qj99", + "modified": "2024-10-14T06:30:43Z", + "published": "2024-10-14T06:30:43Z", + "aliases": [ + "CVE-2024-9924" + ], + "details": "The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk. Unauthenticated remote attackers still can download arbitrary system files, which may be deleted subsequently .", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9924" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/en/cp-139-8131-0b5e1-2.html" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/tw/cp-132-8130-89bb1-1.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-36" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-14T04:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-q75j-x536-63r5/GHSA-q75j-x536-63r5.json b/advisories/unreviewed/2024/10/GHSA-q75j-x536-63r5/GHSA-q75j-x536-63r5.json new file mode 100644 index 00000000000..b25e436c2c8 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-q75j-x536-63r5/GHSA-q75j-x536-63r5.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q75j-x536-63r5", + "modified": "2024-10-14T06:30:43Z", + "published": "2024-10-14T06:30:43Z", + "aliases": [ + "CVE-2024-9923" + ], + "details": "The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with administrator privileges to move arbitrary system files to the website root directory and access them.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9923" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/en/cp-139-8129-00002-2.html" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/tw/cp-132-8128-772aa-1.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-23" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-14T04:15:06Z" + } +} \ No newline at end of file