diff --git a/advisories/unreviewed/2022/05/GHSA-3c6v-c67v-hx4q/GHSA-3c6v-c67v-hx4q.json b/advisories/unreviewed/2022/05/GHSA-3c6v-c67v-hx4q/GHSA-3c6v-c67v-hx4q.json index 8013bc942ef..db589c9fec2 100644 --- a/advisories/unreviewed/2022/05/GHSA-3c6v-c67v-hx4q/GHSA-3c6v-c67v-hx4q.json +++ b/advisories/unreviewed/2022/05/GHSA-3c6v-c67v-hx4q/GHSA-3c6v-c67v-hx4q.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-3c6v-c67v-hx4q", - "modified": "2022-05-24T17:12:54Z", + "modified": "2024-05-06T12:30:25Z", "published": "2022-05-24T17:12:54Z", "aliases": [ "CVE-2020-3920" ], "details": "UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + } ], "affected": [ @@ -25,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-287" + "CWE-287", + "CWE-306" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2022/05/GHSA-chfh-m75v-856c/GHSA-chfh-m75v-856c.json b/advisories/unreviewed/2022/05/GHSA-chfh-m75v-856c/GHSA-chfh-m75v-856c.json index 01b1921bebe..4947ce92a0c 100644 --- a/advisories/unreviewed/2022/05/GHSA-chfh-m75v-856c/GHSA-chfh-m75v-856c.json +++ b/advisories/unreviewed/2022/05/GHSA-chfh-m75v-856c/GHSA-chfh-m75v-856c.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-chfh-m75v-856c", - "modified": "2022-05-24T17:12:55Z", + "modified": "2024-05-06T12:30:25Z", "published": "2022-05-24T17:12:55Z", "aliases": [ "CVE-2020-3936" ], "details": "UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject arbitrary SQL command.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2022/05/GHSA-rj8p-c8g2-ppv6/GHSA-rj8p-c8g2-ppv6.json b/advisories/unreviewed/2022/05/GHSA-rj8p-c8g2-ppv6/GHSA-rj8p-c8g2-ppv6.json index 66f1fbed74c..47dfa23104c 100644 --- a/advisories/unreviewed/2022/05/GHSA-rj8p-c8g2-ppv6/GHSA-rj8p-c8g2-ppv6.json +++ b/advisories/unreviewed/2022/05/GHSA-rj8p-c8g2-ppv6/GHSA-rj8p-c8g2-ppv6.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rj8p-c8g2-ppv6", - "modified": "2022-05-24T22:28:57Z", + "modified": "2024-05-06T12:30:25Z", "published": "2022-05-24T22:28:57Z", "aliases": [ "CVE-2020-3921" ], "details": "UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ @@ -25,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-200" + "CWE-200", + "CWE-312" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/05/GHSA-5w6g-chqx-w668/GHSA-5w6g-chqx-w668.json b/advisories/unreviewed/2024/05/GHSA-5w6g-chqx-w668/GHSA-5w6g-chqx-w668.json new file mode 100644 index 00000000000..0363f7b471b --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-5w6g-chqx-w668/GHSA-5w6g-chqx-w668.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5w6g-chqx-w668", + "modified": "2024-05-06T12:30:26Z", + "published": "2024-05-06T12:30:25Z", + "aliases": [ + "CVE-2023-6854" + ], + "details": "The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom postmeta output in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping on user supplied post meta fields. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6854" + }, + { + "type": "WEB", + "url": "https://breakdance.com/breakdance-1-7-1-now-available-security-update" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e92a0387-bd09-46d3-9f6c-09f701b9e550?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-06T11:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-8hfj-v3g5-5mpj/GHSA-8hfj-v3g5-5mpj.json b/advisories/unreviewed/2024/05/GHSA-8hfj-v3g5-5mpj/GHSA-8hfj-v3g5-5mpj.json new file mode 100644 index 00000000000..46d9915f2b7 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-8hfj-v3g5-5mpj/GHSA-8hfj-v3g5-5mpj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8hfj-v3g5-5mpj", + "modified": "2024-05-06T12:30:26Z", + "published": "2024-05-06T12:30:26Z", + "aliases": [ + "CVE-2024-3576" + ], + "details": "The NPort 5100A Series prior to version 1.6 is affected by web server XSS vulnerability. The vulnerability is caused by not correctly neutralizing user-controllable input before placing it in output. Malicious users may use the vulnerability to get sensitive information and escalate privileges. ", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3576" + }, + { + "type": "WEB", + "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-246328-nport-5100a-series-store-xss-vulnerability" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-06T12:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-c6h3-4727-9w7w/GHSA-c6h3-4727-9w7w.json b/advisories/unreviewed/2024/05/GHSA-c6h3-4727-9w7w/GHSA-c6h3-4727-9w7w.json index 65ececa03a1..ca662f55c84 100644 --- a/advisories/unreviewed/2024/05/GHSA-c6h3-4727-9w7w/GHSA-c6h3-4727-9w7w.json +++ b/advisories/unreviewed/2024/05/GHSA-c6h3-4727-9w7w/GHSA-c6h3-4727-9w7w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-c6h3-4727-9w7w", - "modified": "2024-05-03T03:30:47Z", + "modified": "2024-05-06T12:30:25Z", "published": "2024-05-03T03:30:47Z", "aliases": [ "CVE-2024-34403" @@ -25,6 +25,14 @@ { "type": "WEB", "url": "https://github.com/uriparser/uriparser/pull/186" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/05/06/1" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/05/06/3" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/05/GHSA-hwpw-xpj3-c397/GHSA-hwpw-xpj3-c397.json b/advisories/unreviewed/2024/05/GHSA-hwpw-xpj3-c397/GHSA-hwpw-xpj3-c397.json index b23b87333f5..33d858a6b46 100644 --- a/advisories/unreviewed/2024/05/GHSA-hwpw-xpj3-c397/GHSA-hwpw-xpj3-c397.json +++ b/advisories/unreviewed/2024/05/GHSA-hwpw-xpj3-c397/GHSA-hwpw-xpj3-c397.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hwpw-xpj3-c397", - "modified": "2024-05-03T03:30:47Z", + "modified": "2024-05-06T12:30:25Z", "published": "2024-05-03T03:30:47Z", "aliases": [ "CVE-2024-34402" @@ -25,6 +25,14 @@ { "type": "WEB", "url": "https://github.com/uriparser/uriparser/pull/185" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/05/06/1" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/05/06/3" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/05/GHSA-j5x9-c5fm-gqwf/GHSA-j5x9-c5fm-gqwf.json b/advisories/unreviewed/2024/05/GHSA-j5x9-c5fm-gqwf/GHSA-j5x9-c5fm-gqwf.json new file mode 100644 index 00000000000..f7f2372fb20 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-j5x9-c5fm-gqwf/GHSA-j5x9-c5fm-gqwf.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j5x9-c5fm-gqwf", + "modified": "2024-05-06T12:30:26Z", + "published": "2024-05-06T12:30:26Z", + "aliases": [ + "CVE-2023-49675" + ], + "details": "An unauthenticated local attacker may trick a user to open corrupted project files to execute arbitrary code or crash the system due to an out-of-bounds write vulnerability.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49675" + }, + { + "type": "WEB", + "url": "https://cert.vde.com/en/advisories/VDE-2024-024" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-06T12:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-m6xf-rg25-42wc/GHSA-m6xf-rg25-42wc.json b/advisories/unreviewed/2024/05/GHSA-m6xf-rg25-42wc/GHSA-m6xf-rg25-42wc.json index e2f31ace78a..b3fb941d19c 100644 --- a/advisories/unreviewed/2024/05/GHSA-m6xf-rg25-42wc/GHSA-m6xf-rg25-42wc.json +++ b/advisories/unreviewed/2024/05/GHSA-m6xf-rg25-42wc/GHSA-m6xf-rg25-42wc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-m6xf-rg25-42wc", - "modified": "2024-05-03T21:30:30Z", + "modified": "2024-05-06T12:30:25Z", "published": "2024-05-03T21:30:30Z", "aliases": [ "CVE-2024-34455" @@ -25,6 +25,10 @@ { "type": "WEB", "url": "https://www.openwall.com/lists/oss-security/2024/04/11/13" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/05/06/2" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/05/GHSA-m854-6wh4-fmg2/GHSA-m854-6wh4-fmg2.json b/advisories/unreviewed/2024/05/GHSA-m854-6wh4-fmg2/GHSA-m854-6wh4-fmg2.json new file mode 100644 index 00000000000..0f49e316922 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-m854-6wh4-fmg2/GHSA-m854-6wh4-fmg2.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m854-6wh4-fmg2", + "modified": "2024-05-06T12:30:26Z", + "published": "2024-05-06T12:30:26Z", + "aliases": [ + "CVE-2024-33753" + ], + "details": "Section Camera V2.5.5.3116-S50-SMA-B20160811 and earlier versions allow the accounts and passwords of administrators and users to be changed without authorization.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33753" + }, + { + "type": "WEB", + "url": "https://github.com/kklzzcun/Camera/blob/main/Camera/%E8%B6%8A%E6%9D%83%E4%BF%AE%E6%94%B9%E7%AE%A1%E7%90%86%E5%91%98%E6%88%96%E7%94%A8%E6%88%B7%E4%BF%A1%E6%81%AF.md" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-06T12:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-q4h3-rm8f-c8qr/GHSA-q4h3-rm8f-c8qr.json b/advisories/unreviewed/2024/05/GHSA-q4h3-rm8f-c8qr/GHSA-q4h3-rm8f-c8qr.json new file mode 100644 index 00000000000..de46e36b6ce --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-q4h3-rm8f-c8qr/GHSA-q4h3-rm8f-c8qr.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q4h3-rm8f-c8qr", + "modified": "2024-05-06T12:30:26Z", + "published": "2024-05-06T12:30:26Z", + "aliases": [ + "CVE-2023-49676" + ], + "details": "An unauthenticated local attacker may trick a user to open corrupted project files to crash the system due to use after free vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49676" + }, + { + "type": "WEB", + "url": "https://cert.vde.com/en/advisories/VDE-2024-024" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-06T12:15:08Z" + } +} \ No newline at end of file