Publish Advisories

GHSA-6p4r-rcv8-5x44
GHSA-cmwc-rx53-qx3h
GHSA-h496-35px-76wp
GHSA-hg56-xvvv-cj4c
GHSA-qm4j-mqq4-36gx
GHSA-r8j4-h2xg-f955
GHSA-v46p-p3v7-38cg
GHSA-734x-qgf3-3vh7
GHSA-vr8r-7c53-rwq4

advisories/unreviewed/2024/09/GHSA-6p4r-rcv8-5x44/GHSA-6p4r-rcv8-5x44.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6p4r-rcv8-5x44",
-  "modified": "2024-09-30T21:31:06Z",
+  "modified": "2024-10-01T00:33:41Z",
   "published": "2024-09-30T21:31:06Z",
   "aliases": [
     "CVE-2024-28807"
   ],
   "details": "An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive information in the memory of the @CT desktop management application allows guest OS administrators to obtain various users' passwords by accessing memory dumps of the desktop application.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-312"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-09-30T21:15:03Z"

advisories/unreviewed/2024/09/GHSA-cmwc-rx53-qx3h/GHSA-cmwc-rx53-qx3h.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-cmwc-rx53-qx3h",
-  "modified": "2024-09-30T21:02:13Z",
+  "modified": "2024-10-01T00:33:40Z",
   "published": "2024-09-30T21:02:13Z",
   "aliases": [
     "CVE-2024-28810"
   ],
   "details": "An issue was discovered in Infinera hiT 7300 5.60.50. Sensitive information inside diagnostic files (exported by the @CT application) allows an attacker to achieve loss of confidentiality by analyzing these files.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-312"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-09-30T19:15:03Z"

advisories/unreviewed/2024/09/GHSA-h496-35px-76wp/GHSA-h496-35px-76wp.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-h496-35px-76wp",
-  "modified": "2024-09-30T18:31:36Z",
+  "modified": "2024-10-01T00:33:40Z",
   "published": "2024-09-30T18:31:36Z",
   "aliases": [
     "CVE-2024-46549"
   ],
   "details": "An issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connections by impersonating devices owned by other users.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-269"
     ],
-    "severity": null,
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-09-30T17:15:04Z"

advisories/unreviewed/2024/09/GHSA-hg56-xvvv-cj4c/GHSA-hg56-xvvv-cj4c.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hg56-xvvv-cj4c",
-  "modified": "2024-09-30T18:31:36Z",
+  "modified": "2024-10-01T00:33:39Z",
   "published": "2024-09-30T18:31:36Z",
   "aliases": [
     "CVE-2024-46548"
   ],
   "details": "TP-Link Tapo P125M and Kasa KP125M v1.0.3 was discovered to improperly validate certificates, allowing attackers to eavesdrop on communications and access sensitive information via a man-in-the-middle attack.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-200"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-09-30T17:15:04Z"

advisories/unreviewed/2024/09/GHSA-qm4j-mqq4-36gx/GHSA-qm4j-mqq4-36gx.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-qm4j-mqq4-36gx",
-  "modified": "2024-09-30T18:31:36Z",
+  "modified": "2024-10-01T00:33:40Z",
   "published": "2024-09-30T18:31:36Z",
   "aliases": [
     "CVE-2024-28809"
   ],
   "details": "An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive password in firmware update packages allows attackers to access various appliance services via hardcoded credentials.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-312"
     ],
-    "severity": null,
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-09-30T18:15:05Z"

advisories/unreviewed/2024/09/GHSA-r8j4-h2xg-f955/GHSA-r8j4-h2xg-f955.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-r8j4-h2xg-f955",
-  "modified": "2024-09-30T18:31:36Z",
+  "modified": "2024-10-01T00:33:39Z",
   "published": "2024-09-30T18:31:36Z",
   "aliases": [
     "CVE-2024-46510"
   ],
   "details": "ESAFENET CDG v5 was discovered to contain a SQL injection vulnerability via the id parameter in the NavigationAjax interface",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-89"
     ],
-    "severity": null,
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-09-30T16:15:09Z"

advisories/unreviewed/2024/09/GHSA-v46p-p3v7-38cg/GHSA-v46p-p3v7-38cg.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-v46p-p3v7-38cg",
-  "modified": "2024-09-30T06:33:37Z",
+  "modified": "2024-10-01T00:33:39Z",
   "published": "2024-09-30T06:33:36Z",
   "aliases": [
     "CVE-2024-3635"
   ],
   "details": "The Post Grid  WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
+    }
   ],
   "affected": [
 
@@ -27,7 +30,7 @@
     "cwe_ids": [
 
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-09-30T06:15:13Z"

advisories/unreviewed/2024/10/GHSA-734x-qgf3-3vh7/GHSA-734x-qgf3-3vh7.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-734x-qgf3-3vh7",
+  "modified": "2024-10-01T00:33:41Z",
+  "published": "2024-10-01T00:33:41Z",
+  "aliases": [
+    "CVE-2024-9194"
+  ],
+  "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Linux and Microsoft Windows Octopus Server on Windows, Linux allows SQL Injection.This issue affects Octopus Server: from 2024.1.0 before 2024.1.13038, from 2024.2.0 before 2024.2.9482, from 2024.3.0 before 2024.3.12766.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9194"
+    },
+    {
+      "type": "WEB",
+      "url": "https://advisories.octopus.com/post/2024/sa2024-09"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-30T23:15:02Z"
+  }
+}

advisories/unreviewed/2024/10/GHSA-vr8r-7c53-rwq4/GHSA-vr8r-7c53-rwq4.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vr8r-7c53-rwq4",
+  "modified": "2024-10-01T00:33:41Z",
+  "published": "2024-10-01T00:33:41Z",
+  "aliases": [
+    "CVE-2024-45073"
+  ],
+  "details": "IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45073"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.ibm.com/support/pages/node/7171755"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-30T22:15:02Z"
+  }
+}