diff --git a/advisories/github-reviewed/2024/02/GHSA-78xj-cgh5-2h22/GHSA-78xj-cgh5-2h22.json b/advisories/github-reviewed/2024/02/GHSA-78xj-cgh5-2h22/GHSA-78xj-cgh5-2h22.json index a8a2d581c16..520b8b29721 100644 --- a/advisories/github-reviewed/2024/02/GHSA-78xj-cgh5-2h22/GHSA-78xj-cgh5-2h22.json +++ b/advisories/github-reviewed/2024/02/GHSA-78xj-cgh5-2h22/GHSA-78xj-cgh5-2h22.json @@ -1,17 +1,39 @@ { "schema_version": "1.4.0", "id": "GHSA-78xj-cgh5-2h22", - "modified": "2024-02-12T20:17:03Z", + "modified": "2024-02-20T18:30:37Z", "published": "2024-02-08T18:30:39Z", "aliases": [ "CVE-2023-42282" ], - "summary": "NPM IP package vulnerable to Server-Side Request Forgery (SSRF) attacks", - "details": "An issue in all published versions of the NPM package `ip` allows an attacker to execute arbitrary code and obtain sensitive information via the `isPublic()` function. This can lead to potential Server-Side Request Forgery (SSRF) attacks. The core issue is the function's failure to accurately distinguish between public and private IP addresses.", + "summary": "NPM IP package incorrectly identifies some private IP addresses as public", + "details": "The `isPublic()` function in the NPM package `ip` doesn't correctly identify certain private IP addresses in uncommon formats such as `0x7F.1` as private. Instead, it reports them as public by returning `true`. This can lead to security issues such as Server-Side Request Forgery (SSRF) if `isPublic()` is used to protect sensitive code paths when passed user input. Versions 1.1.9 and 2.0.1 fix the issue.", "severity": [ ], "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "ip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.1" + } + ] + } + ], + "versions": [ + "2.0.0" + ] + }, { "package": { "ecosystem": "npm", @@ -25,7 +47,7 @@ "introduced": "0" }, { - "last_affected": "2.0.0" + "fixed": "1.1.9" } ] } @@ -45,6 +67,18 @@ "type": "WEB", "url": "https://github.com/github/advisory-database/pull/3504#issuecomment-1937179999" }, + { + "type": "WEB", + "url": "https://github.com/indutny/node-ip/pull/138" + }, + { + "type": "WEB", + "url": "https://github.com/indutny/node-ip/commit/32f468f1245574785ec080705737a579be1223aa" + }, + { + "type": "WEB", + "url": "https://github.com/indutny/node-ip/commit/6a3ada9b471b09d5f0f5be264911ab564bf67894" + }, { "type": "WEB", "url": "https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html" @@ -56,9 +90,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-918" ], - "severity": "HIGH", + "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-02-09T15:03:18Z", "nvd_published_at": "2024-02-08T17:15:10Z" diff --git a/advisories/unreviewed/2024/02/GHSA-23gm-fr88-2r8c/GHSA-23gm-fr88-2r8c.json b/advisories/unreviewed/2024/02/GHSA-23gm-fr88-2r8c/GHSA-23gm-fr88-2r8c.json new file mode 100644 index 00000000000..4e72838fa53 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-23gm-fr88-2r8c/GHSA-23gm-fr88-2r8c.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-23gm-fr88-2r8c", + "modified": "2024-02-20T18:30:34Z", + "published": "2024-02-20T18:30:34Z", + "aliases": [ + "CVE-2023-52434" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix potential OOBs in smb2_parse_contexts()\n\nValidate offsets and lengths before dereferencing create contexts in\nsmb2_parse_contexts().\n\nThis fixes following oops when accessing invalid create contexts from\nserver:\n\n BUG: unable to handle page fault for address: ffff8881178d8cc3\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 4a01067 P4D 4a01067 PUD 0\n Oops: 0000 [#1] PREEMPT SMP NOPTI\n CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\n rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\n RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs]\n Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00\n 00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7\n 7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00\n RSP: 0018:ffffc900007939e0 EFLAGS: 00010216\n RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90\n RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000\n RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000\n R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000\n R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22\n FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000)\n knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0\n PKRU: 55555554\n Call Trace:\n \n ? __die+0x23/0x70\n ? page_fault_oops+0x181/0x480\n ? search_module_extables+0x19/0x60\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? exc_page_fault+0x1b6/0x1c0\n ? asm_exc_page_fault+0x26/0x30\n ? smb2_parse_contexts+0xa0/0x3a0 [cifs]\n SMB2_open+0x38d/0x5f0 [cifs]\n ? smb2_is_path_accessible+0x138/0x260 [cifs]\n smb2_is_path_accessible+0x138/0x260 [cifs]\n cifs_is_path_remote+0x8d/0x230 [cifs]\n cifs_mount+0x7e/0x350 [cifs]\n cifs_smb3_do_mount+0x128/0x780 [cifs]\n smb3_get_tree+0xd9/0x290 [cifs]\n vfs_get_tree+0x2c/0x100\n ? capable+0x37/0x70\n path_mount+0x2d7/0xb80\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? _raw_spin_unlock_irqrestore+0x44/0x60\n __x64_sys_mount+0x11a/0x150\n do_syscall_64+0x47/0xf0\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\n RIP: 0033:0x7f8737657b1e", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52434" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/17a0f64cc02d4972e21c733d9f21d1c512963afa" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/af1689a9b7701d9907dfc84d2a4b57c4bc907144" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T18:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-2j57-prq3-h7v2/GHSA-2j57-prq3-h7v2.json b/advisories/unreviewed/2024/02/GHSA-2j57-prq3-h7v2/GHSA-2j57-prq3-h7v2.json new file mode 100644 index 00000000000..c63b90136d0 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-2j57-prq3-h7v2/GHSA-2j57-prq3-h7v2.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2j57-prq3-h7v2", + "modified": "2024-02-20T18:30:35Z", + "published": "2024-02-20T18:30:35Z", + "aliases": [ + "CVE-2024-22245" + ], + "details": "Arbitrary Authentication Relay and Session Hijack vulnerabilities in the deprecated VMware Enhanced Authentication Plug-in (EAP) could allow a malicious actor that could trick a target domain user with EAP installed in their web browser into requesting and relaying service tickets for arbitrary Active Directory Service Principal Names (SPNs).", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22245" + }, + { + "type": "WEB", + "url": "https://www.vmware.com/security/advisories/VMSA-2024-0003.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T18:15:51Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-4g72-g685-8cc9/GHSA-4g72-g685-8cc9.json b/advisories/unreviewed/2024/02/GHSA-4g72-g685-8cc9/GHSA-4g72-g685-8cc9.json new file mode 100644 index 00000000000..db5885a097a --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-4g72-g685-8cc9/GHSA-4g72-g685-8cc9.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4g72-g685-8cc9", + "modified": "2024-02-20T18:30:34Z", + "published": "2024-02-20T18:30:34Z", + "aliases": [ + "CVE-2024-25366" + ], + "details": "Buffer Overflow vulnerability in mz-automation.de libiec61859 v.1.4.0 allows a remote attacker to cause a denial of service via the mmsServer_handleGetNameListRequest function to the mms_getnamelist_service component.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25366" + }, + { + "type": "WEB", + "url": "https://github.com/mz-automation/libiec61850/issues/492" + }, + { + "type": "WEB", + "url": "https://github.com/mz-automation/libiec61850" + }, + { + "type": "WEB", + "url": "https://www.mz-automation.de" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T16:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-6rrc-h5ph-44m6/GHSA-6rrc-h5ph-44m6.json b/advisories/unreviewed/2024/02/GHSA-6rrc-h5ph-44m6/GHSA-6rrc-h5ph-44m6.json new file mode 100644 index 00000000000..0eee19226f0 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-6rrc-h5ph-44m6/GHSA-6rrc-h5ph-44m6.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6rrc-h5ph-44m6", + "modified": "2024-02-20T18:30:34Z", + "published": "2024-02-20T18:30:34Z", + "aliases": [ + "CVE-2024-21682" + ], + "details": "This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions). \n\nAssets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or Server. It detects hardware and software that is connected to your local network and extracts detailed information about each asset. This data can then be imported into Assets in Jira Service Management to help you manage all of the devices and configuration items within your local network.\n\nThis Injection vulnerability, with a CVSS Score of 7.2, allows an authenticated attacker to modify the actions taken by a system call which has high impact to confidentiality, high impact to integrity, high impact to availability, and requires no user interaction.\n\nAtlassian recommends that Assets Discovery customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions\n\nSee the release notes (https://confluence.atlassian.com/assetapps/assets-discovery-3-2-1-cloud-6-2-1-data_center-1333987182.html). You can download the latest version of Assets Discovery from the Atlassian Marketplace (https://marketplace.atlassian.com/apps/1214668/assets-discovery?hosting=datacenter&tab=installation).\n\nThis vulnerability was reported via our Penetration Testing program.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21682" + }, + { + "type": "WEB", + "url": "https://confluence.atlassian.com/assetapps/assets-discovery-3-2-1-cloud-6-2-1-data_center-1333987182.html" + }, + { + "type": "WEB", + "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1354501606" + }, + { + "type": "WEB", + "url": "https://jira.atlassian.com/browse/JSDSERVER-15067" + }, + { + "type": "WEB", + "url": "https://marketplace.atlassian.com/apps/1214668/assets-discovery?hosting=datacenter&tab=installation" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T18:15:51Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-78jh-rw4h-46r3/GHSA-78jh-rw4h-46r3.json b/advisories/unreviewed/2024/02/GHSA-78jh-rw4h-46r3/GHSA-78jh-rw4h-46r3.json new file mode 100644 index 00000000000..0856c1b9139 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-78jh-rw4h-46r3/GHSA-78jh-rw4h-46r3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-78jh-rw4h-46r3", + "modified": "2024-02-20T18:30:34Z", + "published": "2024-02-20T18:30:34Z", + "aliases": [ + "CVE-2024-23310" + ], + "details": "A use-after-free vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23310" + }, + { + "type": "WEB", + "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1923" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-825" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T16:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-7998-f982-7c9x/GHSA-7998-f982-7c9x.json b/advisories/unreviewed/2024/02/GHSA-7998-f982-7c9x/GHSA-7998-f982-7c9x.json new file mode 100644 index 00000000000..8ab65637634 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-7998-f982-7c9x/GHSA-7998-f982-7c9x.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7998-f982-7c9x", + "modified": "2024-02-20T18:30:34Z", + "published": "2024-02-20T18:30:34Z", + "aliases": [ + "CVE-2024-0794" + ], + "details": "Certain HP LaserJet Pro, HP Enterprise LaserJet, and HP LaserJet Managed Printers are potentially vulnerable to Remote Code Execution due to buffer overflow when rendering fonts embedded in a PDF file.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0794" + }, + { + "type": "WEB", + "url": "https://support.hp.com/us-en/document/ish_10174031-10174074-16" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T18:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-7xww-xh6h-rqhj/GHSA-7xww-xh6h-rqhj.json b/advisories/unreviewed/2024/02/GHSA-7xww-xh6h-rqhj/GHSA-7xww-xh6h-rqhj.json new file mode 100644 index 00000000000..e661aff22ff --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-7xww-xh6h-rqhj/GHSA-7xww-xh6h-rqhj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7xww-xh6h-rqhj", + "modified": "2024-02-20T18:30:34Z", + "published": "2024-02-20T18:30:34Z", + "aliases": [ + "CVE-2024-21795" + ], + "details": "A heap-based buffer overflow vulnerability exists in the .egi parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .egi file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21795" + }, + { + "type": "WEB", + "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1920" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-122" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T16:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-8459-gg55-8qjj/GHSA-8459-gg55-8qjj.json b/advisories/unreviewed/2024/02/GHSA-8459-gg55-8qjj/GHSA-8459-gg55-8qjj.json index 95cbf29bccf..f6b81a348c5 100644 --- a/advisories/unreviewed/2024/02/GHSA-8459-gg55-8qjj/GHSA-8459-gg55-8qjj.json +++ b/advisories/unreviewed/2024/02/GHSA-8459-gg55-8qjj/GHSA-8459-gg55-8qjj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-8459-gg55-8qjj", - "modified": "2024-02-19T03:30:24Z", + "modified": "2024-02-20T18:30:33Z", "published": "2024-02-14T18:30:25Z", "aliases": [ "CVE-2023-50387" ], "details": "Certain DNSSEC aspects of the DNS protocol (in RFC 4035 and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses when there is a zone with many DNSKEY and RRSIG records, aka the \"KeyTrap\" issue. The protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -105,9 +108,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-770" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-14T16:15:45Z" diff --git a/advisories/unreviewed/2024/02/GHSA-92f7-c7hw-58cr/GHSA-92f7-c7hw-58cr.json b/advisories/unreviewed/2024/02/GHSA-92f7-c7hw-58cr/GHSA-92f7-c7hw-58cr.json index 7b1e48d0672..be118538dcf 100644 --- a/advisories/unreviewed/2024/02/GHSA-92f7-c7hw-58cr/GHSA-92f7-c7hw-58cr.json +++ b/advisories/unreviewed/2024/02/GHSA-92f7-c7hw-58cr/GHSA-92f7-c7hw-58cr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-92f7-c7hw-58cr", - "modified": "2024-02-20T15:31:04Z", + "modified": "2024-02-20T18:30:34Z", "published": "2024-02-20T15:31:04Z", "aliases": [ "CVE-2024-26581" @@ -22,17 +22,33 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/1296c110c5a0" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1296c110c5a0b45a8fcf58e7d18bc5da61a565cb" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/60c0c230c6f0" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/60c0c230c6f046da536d3df8b39a20b9a9fd6af0" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/6eb14441f106" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6eb14441f10602fa1cf691da9d685718b68b78a9" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/b734f7a47aeb" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b734f7a47aeb32a5ba298e4ccc16bb0c52b6dbf7" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/02/GHSA-94q6-333x-cv3g/GHSA-94q6-333x-cv3g.json b/advisories/unreviewed/2024/02/GHSA-94q6-333x-cv3g/GHSA-94q6-333x-cv3g.json new file mode 100644 index 00000000000..92896136087 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-94q6-333x-cv3g/GHSA-94q6-333x-cv3g.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-94q6-333x-cv3g", + "modified": "2024-02-20T18:30:34Z", + "published": "2024-02-20T18:30:34Z", + "aliases": [ + "CVE-2024-23305" + ], + "details": "An out-of-bounds write vulnerability exists in the BrainVisionMarker Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .vmrk file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23305" + }, + { + "type": "WEB", + "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1918" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T16:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-9p2g-j2pw-qg9p/GHSA-9p2g-j2pw-qg9p.json b/advisories/unreviewed/2024/02/GHSA-9p2g-j2pw-qg9p/GHSA-9p2g-j2pw-qg9p.json new file mode 100644 index 00000000000..26b1173abe7 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-9p2g-j2pw-qg9p/GHSA-9p2g-j2pw-qg9p.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9p2g-j2pw-qg9p", + "modified": "2024-02-20T18:30:34Z", + "published": "2024-02-20T18:30:34Z", + "aliases": [ + "CVE-2024-25274" + ], + "details": "An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code via uploading a crafted file.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25274" + }, + { + "type": "WEB", + "url": "https://gist.github.com/capable-Hub/725c294f1aeac729fa314a32fef55d5a" + }, + { + "type": "WEB", + "url": "https://reference1.example.com/login" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T16:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-9qf5-3c29-69qj/GHSA-9qf5-3c29-69qj.json b/advisories/unreviewed/2024/02/GHSA-9qf5-3c29-69qj/GHSA-9qf5-3c29-69qj.json new file mode 100644 index 00000000000..f6b0e8bf33d --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-9qf5-3c29-69qj/GHSA-9qf5-3c29-69qj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9qf5-3c29-69qj", + "modified": "2024-02-20T18:30:34Z", + "published": "2024-02-20T18:30:34Z", + "aliases": [ + "CVE-2024-22097" + ], + "details": "A double-free vulnerability exists in the BrainVision Header Parsing functionality of The Biosig Project libbiosig Master Branch (ab0ee111) and 2.5.0. A specially crafted .vdhr file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22097" + }, + { + "type": "WEB", + "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1917" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-415" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T16:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-c5x5-p58w-fxgh/GHSA-c5x5-p58w-fxgh.json b/advisories/unreviewed/2024/02/GHSA-c5x5-p58w-fxgh/GHSA-c5x5-p58w-fxgh.json new file mode 100644 index 00000000000..7b52202fd0f --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-c5x5-p58w-fxgh/GHSA-c5x5-p58w-fxgh.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c5x5-p58w-fxgh", + "modified": "2024-02-20T18:30:35Z", + "published": "2024-02-20T18:30:35Z", + "aliases": [ + "CVE-2024-25260" + ], + "details": "elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25260" + }, + { + "type": "WEB", + "url": "https://github.com/schsiung/fuzzer_issues/issues/1" + }, + { + "type": "WEB", + "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=31058" + }, + { + "type": "WEB", + "url": "https://sourceware.org/elfutils" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T18:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-c8pj-3w86-3gqp/GHSA-c8pj-3w86-3gqp.json b/advisories/unreviewed/2024/02/GHSA-c8pj-3w86-3gqp/GHSA-c8pj-3w86-3gqp.json new file mode 100644 index 00000000000..df351e43b2e --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-c8pj-3w86-3gqp/GHSA-c8pj-3w86-3gqp.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c8pj-3w86-3gqp", + "modified": "2024-02-20T18:30:34Z", + "published": "2024-02-20T18:30:34Z", + "aliases": [ + "CVE-2024-23606" + ], + "details": "An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23606" + }, + { + "type": "WEB", + "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1925" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-131" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T16:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-cmph-x6r4-4whr/GHSA-cmph-x6r4-4whr.json b/advisories/unreviewed/2024/02/GHSA-cmph-x6r4-4whr/GHSA-cmph-x6r4-4whr.json index 0fe910ecb4b..e57b710c3c3 100644 --- a/advisories/unreviewed/2024/02/GHSA-cmph-x6r4-4whr/GHSA-cmph-x6r4-4whr.json +++ b/advisories/unreviewed/2024/02/GHSA-cmph-x6r4-4whr/GHSA-cmph-x6r4-4whr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-cmph-x6r4-4whr", - "modified": "2024-02-20T15:31:03Z", + "modified": "2024-02-20T18:30:34Z", "published": "2024-02-20T15:31:03Z", "aliases": [ "CVE-2023-52433" @@ -22,9 +22,17 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/2ee52ae94baa" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/e3213ff99a35" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e3213ff99a355cda811b41e8dbb3472d13167a3a" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/02/GHSA-f3gj-969x-5q5x/GHSA-f3gj-969x-5q5x.json b/advisories/unreviewed/2024/02/GHSA-f3gj-969x-5q5x/GHSA-f3gj-969x-5q5x.json new file mode 100644 index 00000000000..7b02420a6bf --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-f3gj-969x-5q5x/GHSA-f3gj-969x-5q5x.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f3gj-969x-5q5x", + "modified": "2024-02-20T18:30:35Z", + "published": "2024-02-20T18:30:35Z", + "aliases": [ + "CVE-2024-22054" + ], + "details": "A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery.\n\n \n\n \n\nAffected Products:\n\nUniFi Access Points\n\nUniFi Switches\n\nUniFi LTE Backup\n\nUniFi Express (Only Mesh Mode, Router mode is not affected)\n\n \n\nMitigation:\n\nUpdate UniFi Access Points to Version 6.6.65 or later.\n\nUpdate UniFi Switches to Version 6.6.61 or later.\n\nUpdate UniFi LTE Backup to Version 6.6.57 or later.\n\nUpdate UniFi Express to Version 3.2.5 or later.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22054" + }, + { + "type": "WEB", + "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-037-037/9aeeccef-ca4a-4f10-9f66-1eb400b3d027" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T18:15:51Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-hvfx-qp2c-x42h/GHSA-hvfx-qp2c-x42h.json b/advisories/unreviewed/2024/02/GHSA-hvfx-qp2c-x42h/GHSA-hvfx-qp2c-x42h.json new file mode 100644 index 00000000000..5b8852091e0 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-hvfx-qp2c-x42h/GHSA-hvfx-qp2c-x42h.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hvfx-qp2c-x42h", + "modified": "2024-02-20T18:30:34Z", + "published": "2024-02-20T18:30:34Z", + "aliases": [ + "CVE-2024-21678" + ], + "details": "This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center.\n\nThis Stored XSS vulnerability, with a CVSS Score of 8.5, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to confidentiality, low impact to integrity, no impact to availability, and requires no user interaction.\nData Center\n\nAtlassian recommends that Confluence Data Center customers upgrade to the latest version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n||Affected versions||Fixed versions||\n|from 8.7.0 to 8.7.1|8.8.0 recommended or 8.7.2|\n|from 8.6.0 to 8.6.1|8.8.0 recommended|\n|from 8.5.0 to 8.5.4 LTS|8.8.0 recommended or 8.5.5 LTS or 8.5.6 LTS|\n|from 8.4.0 to 8.4.5|8.8.0 recommended or 8.5.6 LTS|\n|from 8.3.0 to 8.3.4|8.8.0 recommended or 8.5.6 LTS|\n|from 8.2.0 to 8.2.3|8.8.0 recommended or 8.5.6 LTS|\n|from 8.1.0 to 8.1.4|8.8.0 recommended or 8.5.6 LTS|\n|from 8.0.0 to 8.0.4|8.8.0 recommended or 8.5.6 LTS|\n|from 7.20.0 to 7.20.3|8.8.0 recommended or 8.5.6 LTS|\n|from 7.19.0 to 7.19.17 LTS|8.8.0 recommended or 8.5.6 LTS or 7.19.18 LTS or 7.19.19 LTS|\n|from 7.18.0 to 7.18.3|8.8.0 recommended or 8.5.6 LTS or 7.19.19 LTS|\n|from 7.17.0 to 7.17.5|8.8.0 recommended or 8.5.6 LTS or 7.19.19 LTS|\n|Any earlier versions|8.8.0 recommended or 8.5.6 LTS or 7.19.19 LTS|\nServer\n\nAtlassian recommends that Confluence Server customers upgrade to the latest 8.5.x LTS version. If you are unable to do so, upgrade your instance to one of the specified supported fixed versions:\n\n \n||Affected versions||Fixed versions||\n|from 8.5.0 to 8.5.4 LTS|8.5.5 LTS or 8.5.6 LTS recommended |\n|from 8.4.0 to 8.4.5|8.5.6 LTS recommended|\n|from 8.3.0 to 8.3.4|8.5.6 LTS recommended|\n|from 8.2.0 to 8.2.3|8.5.6 LTS recommended|\n|from 8.1.0 to 8.1.4|8.5.6 LTS recommended|\n|from 8.0.0 to 8.0.4|8.5.6 LTS recommended|\n|from 7.20.0 to 7.20.3|8.5.6 LTS recommended|\n|from 7.19.0 to 7.19.17 LTS|8.5.6 LTS recommended or 7.19.18 LTS or 7.19.19 LTS|\n|from 7.18.0 to 7.18.3|8.5.6 LTS recommended or 7.19.19 LTS|\n|from 7.17.0 to 7.17.5|8.5.6 LTS recommended or 7.19.19 LTS|\n|Any earlier versions|8.5.6 LTS recommended or 7.19.19 LTS|\n\nSee the release notes ([https://confluence.atlassian.com/doc/confluence-release-notes-327.html]). You can download the latest version of Confluence Data Center from the download center ([https://www.atlassian.com/software/confluence/download-archives]).\n\nThis vulnerability was reported via our Bug Bounty program.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21678" + }, + { + "type": "WEB", + "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1354501606" + }, + { + "type": "WEB", + "url": "https://jira.atlassian.com/browse/CONFSERVER-94513" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T18:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-jwwf-c2fg-p2mq/GHSA-jwwf-c2fg-p2mq.json b/advisories/unreviewed/2024/02/GHSA-jwwf-c2fg-p2mq/GHSA-jwwf-c2fg-p2mq.json index 36845410e04..ab3e0ccd817 100644 --- a/advisories/unreviewed/2024/02/GHSA-jwwf-c2fg-p2mq/GHSA-jwwf-c2fg-p2mq.json +++ b/advisories/unreviewed/2024/02/GHSA-jwwf-c2fg-p2mq/GHSA-jwwf-c2fg-p2mq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jwwf-c2fg-p2mq", - "modified": "2024-02-15T21:31:27Z", + "modified": "2024-02-20T18:30:33Z", "published": "2024-02-15T21:31:27Z", "aliases": [ "CVE-2024-0622" diff --git a/advisories/unreviewed/2024/02/GHSA-q3rr-xqpw-vv2x/GHSA-q3rr-xqpw-vv2x.json b/advisories/unreviewed/2024/02/GHSA-q3rr-xqpw-vv2x/GHSA-q3rr-xqpw-vv2x.json new file mode 100644 index 00000000000..f7f2eab130b --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-q3rr-xqpw-vv2x/GHSA-q3rr-xqpw-vv2x.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q3rr-xqpw-vv2x", + "modified": "2024-02-20T18:30:34Z", + "published": "2024-02-20T18:30:34Z", + "aliases": [ + "CVE-2024-23313" + ], + "details": "An integer underflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to an out-of-bounds write which in turn can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23313" + }, + { + "type": "WEB", + "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1922" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-191" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T16:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-q55v-xrhh-mmwj/GHSA-q55v-xrhh-mmwj.json b/advisories/unreviewed/2024/02/GHSA-q55v-xrhh-mmwj/GHSA-q55v-xrhh-mmwj.json new file mode 100644 index 00000000000..cc2dd130e73 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-q55v-xrhh-mmwj/GHSA-q55v-xrhh-mmwj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q55v-xrhh-mmwj", + "modified": "2024-02-20T18:30:35Z", + "published": "2024-02-20T18:30:35Z", + "aliases": [ + "CVE-2024-22250" + ], + "details": "Session Hijack vulnerability in Deprecated VMware Enhanced Authentication Plug-in could allow a malicious actor with unprivileged local access to a windows operating system can hijack a privileged EAP session when initiated by a privileged domain user on the same system.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22250" + }, + { + "type": "WEB", + "url": "https://www.vmware.com/security/advisories/VMSA-2024-0003.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-384" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T18:15:51Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-v4q2-79g6-j728/GHSA-v4q2-79g6-j728.json b/advisories/unreviewed/2024/02/GHSA-v4q2-79g6-j728/GHSA-v4q2-79g6-j728.json new file mode 100644 index 00000000000..9b2797a0473 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-v4q2-79g6-j728/GHSA-v4q2-79g6-j728.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v4q2-79g6-j728", + "modified": "2024-02-20T18:30:35Z", + "published": "2024-02-20T18:30:35Z", + "aliases": [ + "CVE-2024-24474" + ], + "details": "Buffer Overflow vulnerability in Qemu before v.8.2.0 allows a remote attacker to execute arbitrary code via the async_len variable to the FIFO buffer component.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24474" + }, + { + "type": "WEB", + "url": "https://github.com/qemu/qemu/commit/77668e4b9bca03a856c27ba899a2513ddf52bb52" + }, + { + "type": "WEB", + "url": "https://gist.github.com/1047524396/5ce07b9d387095c276b1cd234ae5615e" + }, + { + "type": "WEB", + "url": "https://gitlab.com/qemu-project/qemu/-/issues/1810" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T18:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-v58q-q96x-jmrj/GHSA-v58q-q96x-jmrj.json b/advisories/unreviewed/2024/02/GHSA-v58q-q96x-jmrj/GHSA-v58q-q96x-jmrj.json new file mode 100644 index 00000000000..39585a66ce8 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-v58q-q96x-jmrj/GHSA-v58q-q96x-jmrj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v58q-q96x-jmrj", + "modified": "2024-02-20T18:30:34Z", + "published": "2024-02-20T18:30:34Z", + "aliases": [ + "CVE-2024-21812" + ], + "details": "An integer overflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .famos file can lead to an out-of-bounds write which in turn can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21812" + }, + { + "type": "WEB", + "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1921" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T16:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-v8rx-gg8c-mc3c/GHSA-v8rx-gg8c-mc3c.json b/advisories/unreviewed/2024/02/GHSA-v8rx-gg8c-mc3c/GHSA-v8rx-gg8c-mc3c.json new file mode 100644 index 00000000000..34868562658 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-v8rx-gg8c-mc3c/GHSA-v8rx-gg8c-mc3c.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v8rx-gg8c-mc3c", + "modified": "2024-02-20T18:30:34Z", + "published": "2024-02-20T18:30:34Z", + "aliases": [ + "CVE-2024-23809" + ], + "details": "A double-free vulnerability exists in the BrainVision ASCII Header Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee111). A specially crafted .vdhr file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23809" + }, + { + "type": "WEB", + "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1919" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-415" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-20T16:15:10Z" + } +} \ No newline at end of file