mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-78xj-cgh5-2h22 GHSA-23gm-fr88-2r8c GHSA-2j57-prq3-h7v2 GHSA-4g72-g685-8cc9 GHSA-6rrc-h5ph-44m6 GHSA-78jh-rw4h-46r3 GHSA-7998-f982-7c9x GHSA-7xww-xh6h-rqhj GHSA-8459-gg55-8qjj GHSA-92f7-c7hw-58cr GHSA-94q6-333x-cv3g GHSA-9p2g-j2pw-qg9p GHSA-9qf5-3c29-69qj GHSA-c5x5-p58w-fxgh GHSA-c8pj-3w86-3gqp GHSA-cmph-x6r4-4whr GHSA-f3gj-969x-5q5x GHSA-hvfx-qp2c-x42h GHSA-jwwf-c2fg-p2mq GHSA-q3rr-xqpw-vv2x GHSA-q55v-xrhh-mmwj GHSA-v4q2-79g6-j728 GHSA-v58q-q96x-jmrj GHSA-v8rx-gg8c-mc3c
This commit is contained in:
advisory-database[bot]
@@ -1,17 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-78xj-cgh5-2h22",
|
||||
"modified": "2024-02-12T20:17:03Z",
|
||||
"modified": "2024-02-20T18:30:37Z",
|
||||
"published": "2024-02-08T18:30:39Z",
|
||||
"aliases": [
|
||||
"CVE-2023-42282"
|
||||
],
|
||||
"summary": "NPM IP package vulnerable to Server-Side Request Forgery (SSRF) attacks",
|
||||
"details": "An issue in all published versions of the NPM package `ip` allows an attacker to execute arbitrary code and obtain sensitive information via the `isPublic()` function. This can lead to potential Server-Side Request Forgery (SSRF) attacks. The core issue is the function's failure to accurately distinguish between public and private IP addresses.",
|
||||
"summary": "NPM IP package incorrectly identifies some private IP addresses as public",
|
||||
"details": "The `isPublic()` function in the NPM package `ip` doesn't correctly identify certain private IP addresses in uncommon formats such as `0x7F.1` as private. Instead, it reports them as public by returning `true`. This can lead to security issues such as Server-Side Request Forgery (SSRF) if `isPublic()` is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "npm",
|
||||
"name": "ip"
|
||||
},
|
||||
"ranges": [
|
||||
{
|
||||
"type": "ECOSYSTEM",
|
||||
"events": [
|
||||
{
|
||||
"introduced": "2.0.0"
|
||||
},
|
||||
{
|
||||
"fixed": "2.0.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"versions": [
|
||||
"2.0.0"
|
||||
]
|
||||
},
|
||||
{
|
||||
"package": {
|
||||
"ecosystem": "npm",
|
||||
@@ -25,7 +47,7 @@
|
||||
"introduced": "0"
|
||||
},
|
||||
{
|
||||
"last_affected": "2.0.0"
|
||||
"fixed": "1.1.9"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -45,6 +67,18 @@
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/github/advisory-database/pull/3504#issuecomment-1937179999"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/indutny/node-ip/pull/138"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/indutny/node-ip/commit/32f468f1245574785ec080705737a579be1223aa"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html"
|
||||
@@ -56,9 +90,9 @@
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
"CWE-918"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": true,
|
||||
"github_reviewed_at": "2024-02-09T15:03:18Z",
|
||||
"nvd_published_at": "2024-02-08T17:15:10Z"
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,38 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2j57-prq3-h7v2",
|
||||
"modified": "2024-02-20T18:30:35Z",
|
||||
"published": "2024-02-20T18:30:35Z",
|
||||
"aliases": [
|
||||
"CVE-2024-22245"
|
||||
],
|
||||
"details": "Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor that could trick a target domain user with EAP installed in their web browser into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs).",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22245"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.vmware.com/security/advisories/VMSA-2024-0003.html"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-287"
|
||||
],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-02-20T18:15:51Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4g72-g685-8cc9",
|
||||
"modified": "2024-02-20T18:30:34Z",
|
||||
"published": "2024-02-20T18:30:34Z",
|
||||
"aliases": [
|
||||
"CVE-2024-25366"
|
||||
],
|
||||
"details": "Buffer Overflow vulnerability in mz-automation.de libiec61859 v.1.4.0 allows a remote attacker to cause a denial of service via the mmsServer_handleGetNameListRequest function to the mms_getnamelist_service component.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25366"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/mz-automation/libiec61850/issues/492"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/mz-automation/libiec61850"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.mz-automation.de"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-02-20T16:15:10Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,50 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-6rrc-h5ph-44m6",
|
||||
"modified": "2024-02-20T18:30:34Z",
|
||||
"published": "2024-02-20T18:30:34Z",
|
||||
"aliases": [
|
||||
"CVE-2024-21682"
|
||||
],
|
||||
"details": "This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions). \n\nAssets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or Server. It detects hardware and software that is connected to your local network and extracts detailed information about each asset. This data can then be imported into Assets in Jira Service Management to help you manage all of the devices and configuration items within your local network.\n\nThis Injection vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to modify the actions taken by a system call which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.\n\nAtlassian recommends that Assets Discovery customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions\n\nSee the release notes (https://confluence.atlassian.com/assetapps/assets-discovery-3-2-1-cloud-6-2-1-data_center-1333987182.html). You can download the latest version of Assets Discovery from the Atlassian Marketplace (https://marketplace.atlassian.com/apps/1214668/assets-discovery?hosting=datacenter&tab=installation).\n\nThis vulnerability was reported via our Penetration Testing program.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21682"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://confluence.atlassian.com/assetapps/assets-discovery-3-2-1-cloud-6-2-1-data_center-1333987182.html"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1354501606"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://jira.atlassian.com/browse/JSDSERVER-15067"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://marketplace.atlassian.com/apps/1214668/assets-discovery?hosting=datacenter&tab=installation"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-02-20T18:15:51Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-78jh-rw4h-46r3",
|
||||
"modified": "2024-02-20T18:30:34Z",
|
||||
"published": "2024-02-20T18:30:34Z",
|
||||
"aliases": [
|
||||
"CVE-2024-23310"
|
||||
],
|
||||
"details": "A use-after-free vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23310"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1923"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-825"
|
||||
],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-02-20T16:15:09Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-7998-f982-7c9x",
|
||||
"modified": "2024-02-20T18:30:34Z",
|
||||
"published": "2024-02-20T18:30:34Z",
|
||||
"aliases": [
|
||||
"CVE-2024-0794"
|
||||
],
|
||||
"details": "Certain HP LaserJet Pro, HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to Remote Code Execution due to buffer overflow when rendering fonts embedded in a PDF file.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0794"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://support.hp.com/us-en/document/ish_10174031-10174074-16"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-02-20T18:15:50Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-7xww-xh6h-rqhj",
|
||||
"modified": "2024-02-20T18:30:34Z",
|
||||
"published": "2024-02-20T18:30:34Z",
|
||||
"aliases": [
|
||||
"CVE-2024-21795"
|
||||
],
|
||||
"details": "A heap-based buffer overflow vulnerability exists in the .egi parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .egi file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21795"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1920"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-122"
|
||||
],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-02-20T16:15:08Z"
|
||||
}
|
||||
}
|
||||
@@ -1,14 +1,17 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-8459-gg55-8qjj",
|
||||
"modified": "2024-02-19T03:30:24Z",
|
||||
"modified": "2024-02-20T18:30:33Z",
|
||||
"published": "2024-02-14T18:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2023-50387"
|
||||
],
|
||||
"details": "Certain DNSSEC aspects of the DNS protocol (in RFC 4035 and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses when there is a zone with many DNSKEY and RRSIG records, aka the \"KeyTrap\" issue. The protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.",
|
||||
"severity": [
|
||||
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
@@ -105,9 +108,9 @@
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
"CWE-770"
|
||||
],
|
||||
"severity": null,
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-02-14T16:15:45Z"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-92f7-c7hw-58cr",
|
||||
"modified": "2024-02-20T15:31:04Z",
|
||||
"modified": "2024-02-20T18:30:34Z",
|
||||
"published": "2024-02-20T15:31:04Z",
|
||||
"aliases": [
|
||||
"CVE-2024-26581"
|
||||
@@ -22,17 +22,33 @@
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/1296c110c5a0"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/1296c110c5a0b45a8fcf58e7d18bc5da61a565cb"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/60c0c230c6f0"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/60c0c230c6f046da536d3df8b39a20b9a9fd6af0"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/6eb14441f106"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/6eb14441f10602fa1cf691da9d685718b68b78a9"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/b734f7a47aeb"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
|
||||
@@ -0,0 +1,38 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-94q6-333x-cv3g",
|
||||
"modified": "2024-02-20T18:30:34Z",
|
||||
"published": "2024-02-20T18:30:34Z",
|
||||
"aliases": [
|
||||
"CVE-2024-23305"
|
||||
],
|
||||
"details": "An out-of-bounds write vulnerability exists in the BrainVisionMarker Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .vmrk file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23305"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1918"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-787"
|
||||
],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-02-20T16:15:08Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,39 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-9p2g-j2pw-qg9p",
|
||||
"modified": "2024-02-20T18:30:34Z",
|
||||
"published": "2024-02-20T18:30:34Z",
|
||||
"aliases": [
|
||||
"CVE-2024-25274"
|
||||
],
|
||||
"details": "An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25274"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://gist.github.com/capable-Hub/725c294f1aeac729fa314a32fef55d5a"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://reference1.example.com/login"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-02-20T16:15:10Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-9qf5-3c29-69qj",
|
||||
"modified": "2024-02-20T18:30:34Z",
|
||||
"published": "2024-02-20T18:30:34Z",
|
||||
"aliases": [
|
||||
"CVE-2024-22097"
|
||||
],
|
||||
"details": "A double-free vulnerability exists in the BrainVision Header Parsing functionality of The Biosig Project libbiosig Master Branch (ab0ee111) and 2.5.0. A specially crafted .vdhr file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22097"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1917"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-415"
|
||||
],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-02-20T16:15:08Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,43 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-c5x5-p58w-fxgh",
|
||||
"modified": "2024-02-20T18:30:35Z",
|
||||
"published": "2024-02-20T18:30:35Z",
|
||||
"aliases": [
|
||||
"CVE-2024-25260"
|
||||
],
|
||||
"details": "elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25260"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/schsiung/fuzzer_issues/issues/1"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=31058"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://sourceware.org/elfutils"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-02-20T18:15:52Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-c8pj-3w86-3gqp",
|
||||
"modified": "2024-02-20T18:30:34Z",
|
||||
"published": "2024-02-20T18:30:34Z",
|
||||
"aliases": [
|
||||
"CVE-2024-23606"
|
||||
],
|
||||
"details": "An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23606"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1925"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-131"
|
||||
],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-02-20T16:15:09Z"
|
||||
}
|
||||
}
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-cmph-x6r4-4whr",
|
||||
"modified": "2024-02-20T15:31:03Z",
|
||||
"modified": "2024-02-20T18:30:34Z",
|
||||
"published": "2024-02-20T15:31:03Z",
|
||||
"aliases": [
|
||||
"CVE-2023-52433"
|
||||
@@ -22,9 +22,17 @@
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/2ee52ae94baa"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/e3213ff99a35"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://git.kernel.org/stable/c/e3213ff99a355cda811b41e8dbb3472d13167a3a"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
|
||||
@@ -0,0 +1,38 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-f3gj-969x-5q5x",
|
||||
"modified": "2024-02-20T18:30:35Z",
|
||||
"published": "2024-02-20T18:30:35Z",
|
||||
"aliases": [
|
||||
"CVE-2024-22054"
|
||||
],
|
||||
"details": "A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery.\n\n \n\n \n\nAffected Products:\n\nUniFi Access Points\n\nUniFi Switches\n\nUniFi LTE Backup\n\nUniFi Express (Only Mesh Mode, Router mode is not affected)\n\n \n\nMitigation:\n\nUpdate UniFi Access Points to Version 6.6.65 or later.\n\nUpdate UniFi Switches to Version 6.6.61 or later.\n\nUpdate UniFi LTE Backup to Version 6.6.57 or later.\n\nUpdate UniFi Express to Version 3.2.5 or later.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22054"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-037-037/9aeeccef-ca4a-4f10-9f66-1eb400b3d027"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-02-20T18:15:51Z"
|
||||
}
|
||||
}
|
||||
File diff suppressed because one or more lines are too long
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-jwwf-c2fg-p2mq",
|
||||
"modified": "2024-02-15T21:31:27Z",
|
||||
"modified": "2024-02-20T18:30:33Z",
|
||||
"published": "2024-02-15T21:31:27Z",
|
||||
"aliases": [
|
||||
"CVE-2024-0622"
|
||||
|
||||
@@ -0,0 +1,38 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-q3rr-xqpw-vv2x",
|
||||
"modified": "2024-02-20T18:30:34Z",
|
||||
"published": "2024-02-20T18:30:34Z",
|
||||
"aliases": [
|
||||
"CVE-2024-23313"
|
||||
],
|
||||
"details": "An integer underflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to an out-of-bounds write which in turn can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23313"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1922"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-191"
|
||||
],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-02-20T16:15:09Z"
|
||||
}
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user