netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-07-03 18:38:41 +00:00
parent d40ba6ac90
commit 8249bca0f5
198 changed files with 1179 additions and 674 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/04/GHSA-259m-56qf-8wc5/GHSA-259m-56qf-8wc5.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-259m-56qf-8wc5",
"modified": "2024-04-30T21:30:32Z",
"modified": "2024-07-03T18:37:55Z",
"published": "2024-04-30T21:30:32Z",
"aliases": [
"CVE-2024-33383"
],
"details": "Arbitrary File Read vulnerability in novel-plus 4.3.0 and before allows a remote attacker to obtain sensitive information via a crafted GET request using the filePath parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-30T20:15:08Z"
advisories/unreviewed/2024/04/GHSA-25mp-9vjg-j5g4/GHSA-25mp-9vjg-j5g4.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-25mp-9vjg-j5g4",
"modified": "2024-04-30T18:30:33Z",
"modified": "2024-07-03T18:37:46Z",
"published": "2024-04-30T18:30:33Z",
"aliases": [
"CVE-2023-36268"
],
"details": "An issue in The Document Foundation Libreoffice v.7.4.7 allows a remote attacker to cause a denial of service via a crafted .ppt file.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
"CWE-405"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-30T18:15:19Z"
advisories/unreviewed/2024/04/GHSA-2c9q-jgx6-2qx7/GHSA-2c9q-jgx6-2qx7.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2c9q-jgx6-2qx7",
"modified": "2024-04-23T09:30:46Z",
"modified": "2024-07-03T18:36:36Z",
"published": "2024-04-23T09:30:46Z",
"aliases": [
"CVE-2023-48183"
],
"details": "QuickJS before c4cdd61 has a build_for_in_iterator NULL pointer dereference because of an erroneous lexical scope of \"this\" with eval.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-23T07:15:42Z"
advisories/unreviewed/2024/04/GHSA-2g9g-cq6x-p79q/GHSA-2g9g-cq6x-p79q.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2g9g-cq6x-p79q",
"modified": "2024-04-22T12:30:33Z",
"modified": "2024-07-03T18:36:20Z",
"published": "2024-04-22T12:30:33Z",
"aliases": [
"CVE-2024-22808"
],
"details": "An issue in Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) by disrupting the communication between the PathPilot controller and the CNC router via overwriting the card's name in the device memory.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-22T12:15:07Z"
advisories/unreviewed/2024/04/GHSA-2gvx-5frj-6px5/GHSA-2gvx-5frj-6px5.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2gvx-5frj-6px5",
"modified": "2024-04-23T15:30:36Z",
"modified": "2024-07-03T18:36:43Z",
"published": "2024-04-23T15:30:36Z",
"aliases": [
"CVE-2024-33215"
],
"details": "Tenda FH1206 V1.2.0.8(8155)_EN was discovered to contain a stack-based buffer overflow vulnerability via the mitInterface parameter in ip/goform/addressNat.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-23T15:15:50Z"
advisories/unreviewed/2024/04/GHSA-2pvq-77pm-76c4/GHSA-2pvq-77pm-76c4.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2pvq-77pm-76c4",
"modified": "2024-04-22T03:30:29Z",
"modified": "2024-07-03T18:36:19Z",
"published": "2024-04-22T03:30:29Z",
"aliases": [
"CVE-2024-32418"
],
"details": "An issue in flusity CMS v2.33 allows a remote attacker to execute arbitrary code via the add_addon.php component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-22T01:15:47Z"
advisories/unreviewed/2024/04/GHSA-2x55-cxhq-4m7q/GHSA-2x55-cxhq-4m7q.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2x55-cxhq-4m7q",
"modified": "2024-04-30T15:30:37Z",
"modified": "2024-07-03T18:37:41Z",
"published": "2024-04-30T15:30:37Z",
"aliases": [
"CVE-2024-33275"
],
"details": "SQL injection vulnerability in Webbax supernewsletter v.1.4.21 and before allows a remote attacker to escalate privileges via the Super Newsletter module in the product_search.php components.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-30T15:15:53Z"
advisories/unreviewed/2024/04/GHSA-2xmv-6p85-fvhf/GHSA-2xmv-6p85-fvhf.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2xmv-6p85-fvhf",
"modified": "2024-04-29T21:30:35Z",
"modified": "2024-07-03T18:37:30Z",
"published": "2024-04-29T21:30:35Z",
"aliases": [
"CVE-2024-33435"
],
"details": "Insecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co. Ncast Yingshi high-definition intelligent recording and playback system 2007-2017 allows a remote attacker to execute arbitrary code via the /manage/IPSetup.php backend function",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-732"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-29T20:15:08Z"
advisories/unreviewed/2024/04/GHSA-33pj-qv5w-c27r/GHSA-33pj-qv5w-c27r.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-33pj-qv5w-c27r",
"modified": "2024-04-22T21:31:01Z",
"modified": "2024-07-03T18:36:32Z",
"published": "2024-04-22T21:31:01Z",
"aliases": [
"CVE-2024-32399"
],
"details": "Directory Traversal vulnerability in RaidenMAILD Mail Server v.4.9.4 and before allows a remote attacker to obtain sensitive information via the /webeditor/ component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-22T20:15:07Z"
advisories/unreviewed/2024/04/GHSA-3428-vpwf-2w42/GHSA-3428-vpwf-2w42.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3428-vpwf-2w42",
"modified": "2024-04-26T15:30:33Z",
"modified": "2024-07-03T18:37:02Z",
"published": "2024-04-26T15:30:33Z",
"aliases": [
"CVE-2024-28328"
],
"details": "CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client name parameter which can be triggered and executed in a different user session upon exporting to CSV format.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-26T15:15:48Z"
advisories/unreviewed/2024/04/GHSA-36f2-xg2m-gcm5/GHSA-36f2-xg2m-gcm5.json
+1 -1
View File
@@ -28,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/04/GHSA-3jgv-pfqj-v626/GHSA-3jgv-pfqj-v626.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3jgv-pfqj-v626",
"modified": "2024-04-26T06:30:34Z",
"modified": "2024-07-03T18:36:57Z",
"published": "2024-04-26T06:30:34Z",
"aliases": [
"CVE-2024-32406"
],
"details": "Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Batch-Issue Exam Tickets function.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-26T04:15:09Z"
advisories/unreviewed/2024/04/GHSA-3w7p-3w6w-7fpg/GHSA-3w7p-3w6w-7fpg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3w7p-3w6w-7fpg",
"modified": "2024-04-22T12:30:33Z",
"modified": "2024-07-03T18:36:23Z",
"published": "2024-04-22T12:30:33Z",
"aliases": [
"CVE-2024-22815"
],
"details": "An issue in the communication protocol of Tormach xsTECH CNC Router, PathPilot Controller v2.9.6 allows attackers to cause a Denial of Service (DoS) via crafted commands.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-228"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-22T12:15:07Z"
advisories/unreviewed/2024/04/GHSA-46rv-4m8w-q275/GHSA-46rv-4m8w-q275.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-46rv-4m8w-q275",
"modified": "2024-04-22T15:30:42Z",
"modified": "2024-07-03T18:36:30Z",
"published": "2024-04-22T15:30:42Z",
"aliases": [
"CVE-2024-28699"
],
"details": "A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev::ImgOutputDev function.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-22T15:15:47Z"
advisories/unreviewed/2024/04/GHSA-4c2g-28qx-6qjr/GHSA-4c2g-28qx-6qjr.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4c2g-28qx-6qjr",
"modified": "2024-04-24T18:30:33Z",
"modified": "2024-07-03T18:36:46Z",
"published": "2024-04-24T18:30:33Z",
"aliases": [
"CVE-2024-23228"
],
"details": "This issue was addressed through improved state management. This issue is fixed in iOS 17.3 and iPadOS 17.3. Locked Notes content may have been unexpectedly unlocked.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-24T17:15:47Z"
advisories/unreviewed/2024/04/GHSA-4c3m-w6wv-6mg8/GHSA-4c3m-w6wv-6mg8.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4c3m-w6wv-6mg8",
"modified": "2024-04-30T21:30:32Z",
"modified": "2024-07-03T18:37:49Z",
"published": "2024-04-30T21:30:32Z",
"aliases": [
"CVE-2024-22546"
],
"details": "TRENDnet TEW-815DAP 1.0.2.0 is vulnerable to Command Injection via the do_setNTP function. An authenticated attacker with administrator privileges can leverage this vulnerability over the network via a malicious POST request.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-30T19:15:23Z"
advisories/unreviewed/2024/04/GHSA-4gp6-hcg2-gfh6/GHSA-4gp6-hcg2-gfh6.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4gp6-hcg2-gfh6",
"modified": "2024-04-25T21:30:31Z",
"modified": "2024-07-03T18:36:49Z",
"published": "2024-04-25T21:30:31Z",
"aliases": [
"CVE-2024-31615"
],
"details": "ThinkCMF 6.0.9 is vulnerable to File upload via UeditorController.php.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-25T20:15:07Z"
advisories/unreviewed/2024/04/GHSA-4pq6-8mv5-6q6p/GHSA-4pq6-8mv5-6q6p.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4pq6-8mv5-6q6p",
"modified": "2024-04-25T18:30:39Z",
"modified": "2024-07-03T18:36:49Z",
"published": "2024-04-25T18:30:39Z",
"aliases": [
"CVE-2024-29660"
],
"details": "Cross Site Scripting vulnerability in DedeCMS v.5.7 allows a local attacker to execute arbitrary code via a crafted payload to the stepselect_main.php component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-25T17:15:49Z"
advisories/unreviewed/2024/04/GHSA-4qmm-8p43-6vrx/GHSA-4qmm-8p43-6vrx.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4qmm-8p43-6vrx",
"modified": "2024-04-29T18:30:46Z",
"modified": "2024-07-03T18:37:26Z",
"published": "2024-04-29T18:30:46Z",
"aliases": [
"CVE-2024-33345"
],
"details": "D-Link DIR-823G A1V1.0.2B05 was found to contain a Null-pointer dereference in the main function of upload_firmware.cgi, which allows remote attackers to cause a Denial of Service (DoS) via a crafted input.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-29T18:15:07Z"
advisories/unreviewed/2024/04/GHSA-4rv2-fpjm-34hr/GHSA-4rv2-fpjm-34hr.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4rv2-fpjm-34hr",
"modified": "2024-04-26T03:30:28Z",
"modified": "2024-07-03T18:36:53Z",
"published": "2024-04-26T03:30:28Z",
"aliases": [
"CVE-2024-33666"
],
"details": "An issue was discovered in Zammad before 6.3.0. Users with customer access to a ticket could have accessed time accounting details of this ticket via the API. This data should be available only to agents.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-26T01:15:46Z"

Some files were not shown because too many files have changed in this diff Show More