From 7f5ada463d19ff3bb817c5c00c771ee73a7c0bcd Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 30 Aug 2024 00:32:43 +0000 Subject: [PATCH] Publish Advisories GHSA-6wvf-f2vw-3425 GHSA-v5cr-hwcx-r95m GHSA-3fpg-5xv7-pq63 GHSA-vp32-xxhm-ppgv GHSA-624f-w3rg-939c GHSA-mh6q-v4mp-2cc7 GHSA-fpm3-hh7r-9cg9 GHSA-4g33-jqhr-f9vm GHSA-9chr-m38j-w26g GHSA-hfxc-wfwp-6pqv GHSA-jfp9-mpfm-8qc7 GHSA-jm68-j5fq-xhw2 GHSA-jp4g-q362-wf3h GHSA-p7fr-35j6-p64g GHSA-r2p2-28gr-xq93 GHSA-w782-gjg9-cjx6 GHSA-wcgc-xf7f-fwm5 GHSA-x4r5-v2mq-hx64 GHSA-x5hw-48mf-cq3m GHSA-xgcx-934j-84hv --- .../GHSA-6wvf-f2vw-3425.json | 32 +++++++------- .../GHSA-v5cr-hwcx-r95m.json | 2 +- .../GHSA-3fpg-5xv7-pq63.json | 9 ++-- .../GHSA-vp32-xxhm-ppgv.json | 11 +++-- .../GHSA-624f-w3rg-939c.json | 2 +- .../GHSA-mh6q-v4mp-2cc7.json | 11 +++-- .../GHSA-fpm3-hh7r-9cg9.json | 3 +- .../GHSA-4g33-jqhr-f9vm.json | 11 +++-- .../GHSA-9chr-m38j-w26g.json | 38 +++++++++++++++++ .../GHSA-hfxc-wfwp-6pqv.json | 42 +++++++++++++++++++ .../GHSA-jfp9-mpfm-8qc7.json | 6 ++- .../GHSA-jm68-j5fq-xhw2.json | 2 +- .../GHSA-jp4g-q362-wf3h.json | 42 +++++++++++++++++++ .../GHSA-p7fr-35j6-p64g.json | 38 +++++++++++++++++ .../GHSA-r2p2-28gr-xq93.json | 11 +++-- .../GHSA-w782-gjg9-cjx6.json | 38 +++++++++++++++++ .../GHSA-wcgc-xf7f-fwm5.json | 38 +++++++++++++++++ .../GHSA-x4r5-v2mq-hx64.json | 9 ++-- .../GHSA-x5hw-48mf-cq3m.json | 42 +++++++++++++++++++ .../GHSA-xgcx-934j-84hv.json | 11 +++-- 20 files changed, 353 insertions(+), 45 deletions(-) create mode 100644 advisories/unreviewed/2024/08/GHSA-9chr-m38j-w26g/GHSA-9chr-m38j-w26g.json create mode 100644 advisories/unreviewed/2024/08/GHSA-hfxc-wfwp-6pqv/GHSA-hfxc-wfwp-6pqv.json create mode 100644 advisories/unreviewed/2024/08/GHSA-jp4g-q362-wf3h/GHSA-jp4g-q362-wf3h.json create mode 100644 advisories/unreviewed/2024/08/GHSA-p7fr-35j6-p64g/GHSA-p7fr-35j6-p64g.json create mode 100644 advisories/unreviewed/2024/08/GHSA-w782-gjg9-cjx6/GHSA-w782-gjg9-cjx6.json create mode 100644 advisories/unreviewed/2024/08/GHSA-wcgc-xf7f-fwm5/GHSA-wcgc-xf7f-fwm5.json create mode 100644 advisories/unreviewed/2024/08/GHSA-x5hw-48mf-cq3m/GHSA-x5hw-48mf-cq3m.json diff --git a/advisories/github-reviewed/2024/05/GHSA-6wvf-f2vw-3425/GHSA-6wvf-f2vw-3425.json b/advisories/github-reviewed/2024/05/GHSA-6wvf-f2vw-3425/GHSA-6wvf-f2vw-3425.json index 6429e7e611f..9364d394bf9 100644 --- a/advisories/github-reviewed/2024/05/GHSA-6wvf-f2vw-3425/GHSA-6wvf-f2vw-3425.json +++ b/advisories/github-reviewed/2024/05/GHSA-6wvf-f2vw-3425/GHSA-6wvf-f2vw-3425.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6wvf-f2vw-3425", - "modified": "2024-08-29T21:31:02Z", + "modified": "2024-08-30T00:31:22Z", "published": "2024-05-14T18:30:52Z", "aliases": [ "CVE-2024-3727" @@ -78,13 +78,17 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3727" }, + { + "type": "WEB", + "url": "https://github.com/containers/image/commit/e8948046055060605bd68289d406ce149590c33a" + }, { "type": "WEB", "url": "https://github.com/containers/image/commit/132678b47bae29c710589012668cb85859d88385" }, { "type": "WEB", - "url": "https://github.com/containers/image/commit/e8948046055060605bd68289d406ce149590c33a" + "url": "https://access.redhat.com/errata/RHSA-2024:0045" }, { "type": "WEB", @@ -130,6 +134,14 @@ "type": "WEB", "url": "https://github.com/containers/image/releases/tag/v5.29.3" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:4159" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:4613" + }, { "type": "PACKAGE", "url": "https://github.com/containers/image" @@ -142,6 +154,10 @@ "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-3727" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:6054" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:5951" @@ -157,18 +173,6 @@ { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:4850" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:4613" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:4159" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2024:0045" } ], "database_specific": { diff --git a/advisories/unreviewed/2023/11/GHSA-v5cr-hwcx-r95m/GHSA-v5cr-hwcx-r95m.json b/advisories/unreviewed/2023/11/GHSA-v5cr-hwcx-r95m/GHSA-v5cr-hwcx-r95m.json index 92c3c37fe39..7832991588a 100644 --- a/advisories/unreviewed/2023/11/GHSA-v5cr-hwcx-r95m/GHSA-v5cr-hwcx-r95m.json +++ b/advisories/unreviewed/2023/11/GHSA-v5cr-hwcx-r95m/GHSA-v5cr-hwcx-r95m.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-693" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/04/GHSA-3fpg-5xv7-pq63/GHSA-3fpg-5xv7-pq63.json b/advisories/unreviewed/2024/04/GHSA-3fpg-5xv7-pq63/GHSA-3fpg-5xv7-pq63.json index 3c45caa5c1c..0a62077b0bb 100644 --- a/advisories/unreviewed/2024/04/GHSA-3fpg-5xv7-pq63/GHSA-3fpg-5xv7-pq63.json +++ b/advisories/unreviewed/2024/04/GHSA-3fpg-5xv7-pq63/GHSA-3fpg-5xv7-pq63.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-3fpg-5xv7-pq63", - "modified": "2024-04-04T09:30:34Z", + "modified": "2024-08-30T00:31:22Z", "published": "2024-04-04T09:30:34Z", "aliases": [ "CVE-2024-29008" ], "details": "A problem has been identified in the CloudStack additional VM configuration (extraconfig) feature which can be misused by anyone who has privilege to deploy a VM instance or configure settings of an already deployed VM instance, to configure additional VM configuration even when the feature is not explicitly enabled by the administrator. In a KVM based CloudStack environment, an attacker can exploit this issue to attach host devices such as storage disks, and PCI and USB devices such as network adapters and GPUs, in a regular VM instance that can be further exploited to gain access to the underlying network and storage infrastructure resources, and access any VM instance disks on the local storage.\n\nUsers are advised to upgrade to version 4.18.1.1 or 4.19.0.1, which fixes this issue.\n\n", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ "CWE-20" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-04T08:15:07Z" diff --git a/advisories/unreviewed/2024/05/GHSA-vp32-xxhm-ppgv/GHSA-vp32-xxhm-ppgv.json b/advisories/unreviewed/2024/05/GHSA-vp32-xxhm-ppgv/GHSA-vp32-xxhm-ppgv.json index 95b6867ce32..c79d30fd867 100644 --- a/advisories/unreviewed/2024/05/GHSA-vp32-xxhm-ppgv/GHSA-vp32-xxhm-ppgv.json +++ b/advisories/unreviewed/2024/05/GHSA-vp32-xxhm-ppgv/GHSA-vp32-xxhm-ppgv.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-vp32-xxhm-ppgv", - "modified": "2024-05-14T18:31:05Z", + "modified": "2024-08-30T00:31:22Z", "published": "2024-05-14T18:31:05Z", "aliases": [ "CVE-2024-4765" ], "details": "Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest. This could have been exploited to run arbitrary code in another application's context. \n*This issue only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 126.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-327" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-05-14T18:15:13Z" diff --git a/advisories/unreviewed/2024/06/GHSA-624f-w3rg-939c/GHSA-624f-w3rg-939c.json b/advisories/unreviewed/2024/06/GHSA-624f-w3rg-939c/GHSA-624f-w3rg-939c.json index 72ddb3f1e19..2d95ff3566a 100644 --- a/advisories/unreviewed/2024/06/GHSA-624f-w3rg-939c/GHSA-624f-w3rg-939c.json +++ b/advisories/unreviewed/2024/06/GHSA-624f-w3rg-939c/GHSA-624f-w3rg-939c.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/06/GHSA-mh6q-v4mp-2cc7/GHSA-mh6q-v4mp-2cc7.json b/advisories/unreviewed/2024/06/GHSA-mh6q-v4mp-2cc7/GHSA-mh6q-v4mp-2cc7.json index fca152a5e2b..d5b85830e6b 100644 --- a/advisories/unreviewed/2024/06/GHSA-mh6q-v4mp-2cc7/GHSA-mh6q-v4mp-2cc7.json +++ b/advisories/unreviewed/2024/06/GHSA-mh6q-v4mp-2cc7/GHSA-mh6q-v4mp-2cc7.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mh6q-v4mp-2cc7", - "modified": "2024-07-28T15:31:28Z", + "modified": "2024-08-30T00:31:23Z", "published": "2024-06-17T15:30:54Z", "aliases": [ "CVE-2024-4032" ], "details": "The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.\n\nCPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ @@ -73,9 +76,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-697" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-06-17T15:15:52Z" diff --git a/advisories/unreviewed/2024/07/GHSA-fpm3-hh7r-9cg9/GHSA-fpm3-hh7r-9cg9.json b/advisories/unreviewed/2024/07/GHSA-fpm3-hh7r-9cg9/GHSA-fpm3-hh7r-9cg9.json index 1a7188cad19..7bb33e3e8d5 100644 --- a/advisories/unreviewed/2024/07/GHSA-fpm3-hh7r-9cg9/GHSA-fpm3-hh7r-9cg9.json +++ b/advisories/unreviewed/2024/07/GHSA-fpm3-hh7r-9cg9/GHSA-fpm3-hh7r-9cg9.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-288" + "CWE-288", + "CWE-306" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/08/GHSA-4g33-jqhr-f9vm/GHSA-4g33-jqhr-f9vm.json b/advisories/unreviewed/2024/08/GHSA-4g33-jqhr-f9vm/GHSA-4g33-jqhr-f9vm.json index 4ef6835be34..24be9491c82 100644 --- a/advisories/unreviewed/2024/08/GHSA-4g33-jqhr-f9vm/GHSA-4g33-jqhr-f9vm.json +++ b/advisories/unreviewed/2024/08/GHSA-4g33-jqhr-f9vm/GHSA-4g33-jqhr-f9vm.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-4g33-jqhr-f9vm", - "modified": "2024-08-29T21:31:03Z", + "modified": "2024-08-30T00:31:23Z", "published": "2024-08-29T21:31:03Z", "aliases": [ "CVE-2024-41350" ], "details": "bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/imageUp.php", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-29T20:15:08Z" diff --git a/advisories/unreviewed/2024/08/GHSA-9chr-m38j-w26g/GHSA-9chr-m38j-w26g.json b/advisories/unreviewed/2024/08/GHSA-9chr-m38j-w26g/GHSA-9chr-m38j-w26g.json new file mode 100644 index 00000000000..8d1b6d23063 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-9chr-m38j-w26g/GHSA-9chr-m38j-w26g.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9chr-m38j-w26g", + "modified": "2024-08-30T00:31:23Z", + "published": "2024-08-30T00:31:23Z", + "aliases": [ + "CVE-2024-1545" + ], + "details": "Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the RsaKey structure.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1545" + }, + { + "type": "WEB", + "url": "https://github.com/wolfSSL/wolfssl/releases/tag/v5.7.0-stable" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1256" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-29T23:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-hfxc-wfwp-6pqv/GHSA-hfxc-wfwp-6pqv.json b/advisories/unreviewed/2024/08/GHSA-hfxc-wfwp-6pqv/GHSA-hfxc-wfwp-6pqv.json new file mode 100644 index 00000000000..0235d5f5a39 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-hfxc-wfwp-6pqv/GHSA-hfxc-wfwp-6pqv.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hfxc-wfwp-6pqv", + "modified": "2024-08-30T00:31:23Z", + "published": "2024-08-30T00:31:23Z", + "aliases": [ + "CVE-2024-6671" + ], + "details": "In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6671" + }, + { + "type": "WEB", + "url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024" + }, + { + "type": "WEB", + "url": "https://www.progress.com/network-monitoring" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-29T22:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-jfp9-mpfm-8qc7/GHSA-jfp9-mpfm-8qc7.json b/advisories/unreviewed/2024/08/GHSA-jfp9-mpfm-8qc7/GHSA-jfp9-mpfm-8qc7.json index 2a21ed9653e..e7b19db0a3c 100644 --- a/advisories/unreviewed/2024/08/GHSA-jfp9-mpfm-8qc7/GHSA-jfp9-mpfm-8qc7.json +++ b/advisories/unreviewed/2024/08/GHSA-jfp9-mpfm-8qc7/GHSA-jfp9-mpfm-8qc7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jfp9-mpfm-8qc7", - "modified": "2024-08-29T21:31:03Z", + "modified": "2024-08-30T00:31:23Z", "published": "2024-08-29T03:30:49Z", "aliases": [ "CVE-2024-41918" @@ -25,6 +25,10 @@ "type": "WEB", "url": "https://apps.apple.com/jp/app/%E6%A5%BD%E5%A4%A9%E5%B8%82%E5%A0%B4-%E3%81%8A%E8%B2%B7%E3%81%84%E7%89%A9%E3%81%A7%E6%A5%BD%E5%A4%A9%E3%83%9D%E3%82%A4%E3%83%B3%E3%83%88%E3%81%8C%E8%B2%AF%E3%81%BE%E3%82%8B%E4%BE%BF%E5%88%A9%E3%81%AA%E9%80%9A%E8%B2%A9%E3%82%A2%E3%83%97%E3%83%AA/id419267350" }, + { + "type": "WEB", + "url": "https://apps.apple.com/jp/app/id419267350" + }, { "type": "WEB", "url": "https://jvn.jp/en/jp/JVN56648919" diff --git a/advisories/unreviewed/2024/08/GHSA-jm68-j5fq-xhw2/GHSA-jm68-j5fq-xhw2.json b/advisories/unreviewed/2024/08/GHSA-jm68-j5fq-xhw2/GHSA-jm68-j5fq-xhw2.json index 80026644263..de6b2659657 100644 --- a/advisories/unreviewed/2024/08/GHSA-jm68-j5fq-xhw2/GHSA-jm68-j5fq-xhw2.json +++ b/advisories/unreviewed/2024/08/GHSA-jm68-j5fq-xhw2/GHSA-jm68-j5fq-xhw2.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/08/GHSA-jp4g-q362-wf3h/GHSA-jp4g-q362-wf3h.json b/advisories/unreviewed/2024/08/GHSA-jp4g-q362-wf3h/GHSA-jp4g-q362-wf3h.json new file mode 100644 index 00000000000..6b35e4217bc --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-jp4g-q362-wf3h/GHSA-jp4g-q362-wf3h.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jp4g-q362-wf3h", + "modified": "2024-08-30T00:31:23Z", + "published": "2024-08-30T00:31:23Z", + "aliases": [ + "CVE-2024-6672" + ], + "details": "In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an authenticated low-privileged attacker to achieve privilege escalation by modifying a privileged user's password.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6672" + }, + { + "type": "WEB", + "url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024" + }, + { + "type": "WEB", + "url": "https://www.progress.com/network-monitoring" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-29T22:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-p7fr-35j6-p64g/GHSA-p7fr-35j6-p64g.json b/advisories/unreviewed/2024/08/GHSA-p7fr-35j6-p64g/GHSA-p7fr-35j6-p64g.json new file mode 100644 index 00000000000..b3f2cef9923 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-p7fr-35j6-p64g/GHSA-p7fr-35j6-p64g.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p7fr-35j6-p64g", + "modified": "2024-08-30T00:31:23Z", + "published": "2024-08-30T00:31:23Z", + "aliases": [ + "CVE-2024-2881" + ], + "details": "Fault Injection vulnerability in wc_ed25519_sign_msg function in wolfssl/wolfcrypt/src/ed25519.c in WolfSSL wolfssl5.6.6 on Linux/Windows allows remote attacker co-resides in the same system with a victim process to disclose information and escalate privileges via Rowhammer fault injection to the ed25519_key structure.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2881" + }, + { + "type": "WEB", + "url": "https://github.com/wolfSSL/wolfssl/releases/tag/v5.7.0-stable" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1256" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-30T00:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-r2p2-28gr-xq93/GHSA-r2p2-28gr-xq93.json b/advisories/unreviewed/2024/08/GHSA-r2p2-28gr-xq93/GHSA-r2p2-28gr-xq93.json index f70ed0d5777..05ed243597f 100644 --- a/advisories/unreviewed/2024/08/GHSA-r2p2-28gr-xq93/GHSA-r2p2-28gr-xq93.json +++ b/advisories/unreviewed/2024/08/GHSA-r2p2-28gr-xq93/GHSA-r2p2-28gr-xq93.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-r2p2-28gr-xq93", - "modified": "2024-08-29T21:31:03Z", + "modified": "2024-08-30T00:31:23Z", "published": "2024-08-29T21:31:03Z", "aliases": [ "CVE-2024-41351" ], "details": "bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/getContent.php", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-29T20:15:08Z" diff --git a/advisories/unreviewed/2024/08/GHSA-w782-gjg9-cjx6/GHSA-w782-gjg9-cjx6.json b/advisories/unreviewed/2024/08/GHSA-w782-gjg9-cjx6/GHSA-w782-gjg9-cjx6.json new file mode 100644 index 00000000000..280bd787d04 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-w782-gjg9-cjx6/GHSA-w782-gjg9-cjx6.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w782-gjg9-cjx6", + "modified": "2024-08-30T00:31:23Z", + "published": "2024-08-30T00:31:23Z", + "aliases": [ + "CVE-2024-1543" + ], + "details": "The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a side-channel attacker with cache-line resolution. In a controlled environment such as Intel SGX, an attacker can gain a per instruction sub-cache-line resolution allowing them to break the cache-line-level protection. For details on the attack refer to: https://doi.org/10.46586/tches.v2024.i1.457-500", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1543" + }, + { + "type": "WEB", + "url": "https://github.com/wolfSSL/wolfssl/blob/master/ChangeLog.md#wolfssl-release-566-dec-19-2023" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-208" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-29T23:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-wcgc-xf7f-fwm5/GHSA-wcgc-xf7f-fwm5.json b/advisories/unreviewed/2024/08/GHSA-wcgc-xf7f-fwm5/GHSA-wcgc-xf7f-fwm5.json new file mode 100644 index 00000000000..b0615e03aa2 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-wcgc-xf7f-fwm5/GHSA-wcgc-xf7f-fwm5.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wcgc-xf7f-fwm5", + "modified": "2024-08-30T00:31:23Z", + "published": "2024-08-30T00:31:23Z", + "aliases": [ + "CVE-2024-2502" + ], + "details": "An application can be configured to block boot attempts after consecutive tamper resets are detected, which may not occur as expected.\n\nThis is possible because the TAMPERRSTCAUSE register may not be properly updated when a level 4 tamper event (a tamper reset) occurs. This impacts Series 2 HSE-SVH devices, including xG23B, xG24B, xG25B, and xG28B, but does not impact xG21B. To mitigate this issue, upgrade to SE Firmware version 2.2.6 or later.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2502" + }, + { + "type": "WEB", + "url": "https://community.silabs.com/sfc/servlet.shepherd/document/download/069Vm00000BYb5HIAT?operationContext=S1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-754" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-29T22:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-x4r5-v2mq-hx64/GHSA-x4r5-v2mq-hx64.json b/advisories/unreviewed/2024/08/GHSA-x4r5-v2mq-hx64/GHSA-x4r5-v2mq-hx64.json index 022a3b6a93c..fd7ed44f091 100644 --- a/advisories/unreviewed/2024/08/GHSA-x4r5-v2mq-hx64/GHSA-x4r5-v2mq-hx64.json +++ b/advisories/unreviewed/2024/08/GHSA-x4r5-v2mq-hx64/GHSA-x4r5-v2mq-hx64.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-x4r5-v2mq-hx64", - "modified": "2024-08-16T06:30:46Z", + "modified": "2024-08-30T00:31:22Z", "published": "2024-08-16T06:30:46Z", "aliases": [ "CVE-2024-6460" ], "details": "The Grow by Tradedoubler WordPress plugin through 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-16T06:15:04Z" diff --git a/advisories/unreviewed/2024/08/GHSA-x5hw-48mf-cq3m/GHSA-x5hw-48mf-cq3m.json b/advisories/unreviewed/2024/08/GHSA-x5hw-48mf-cq3m/GHSA-x5hw-48mf-cq3m.json new file mode 100644 index 00000000000..c0a23518668 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-x5hw-48mf-cq3m/GHSA-x5hw-48mf-cq3m.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x5hw-48mf-cq3m", + "modified": "2024-08-30T00:31:23Z", + "published": "2024-08-30T00:31:23Z", + "aliases": [ + "CVE-2024-6670" + ], + "details": "In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6670" + }, + { + "type": "WEB", + "url": "https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024" + }, + { + "type": "WEB", + "url": "https://www.progress.com/network-monitoring" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-29T22:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-xgcx-934j-84hv/GHSA-xgcx-934j-84hv.json b/advisories/unreviewed/2024/08/GHSA-xgcx-934j-84hv/GHSA-xgcx-934j-84hv.json index a73ffed39c0..11a5f7a078e 100644 --- a/advisories/unreviewed/2024/08/GHSA-xgcx-934j-84hv/GHSA-xgcx-934j-84hv.json +++ b/advisories/unreviewed/2024/08/GHSA-xgcx-934j-84hv/GHSA-xgcx-934j-84hv.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-xgcx-934j-84hv", - "modified": "2024-08-29T21:31:03Z", + "modified": "2024-08-30T00:31:23Z", "published": "2024-08-29T21:31:03Z", "aliases": [ "CVE-2024-41345" ], "details": "openflights commit 5234b5b is vulnerable to Cross-Site Scripting (XSS) via php/trip.php", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-29T20:15:08Z"