Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-09-12 15:34:06 +00:00
parent d840c8068c
commit 83f2892039
104 changed files with 1750 additions and 196 deletions
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-77"
+      "CWE-77",
+      "CWE-78"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-77"
+      "CWE-77",
+      "CWE-78"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-77"
+      "CWE-77",
+      "CWE-78"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -28,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-121",
      "CWE-787"
    ],
    "severity": "CRITICAL",
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-204"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -28,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-121",
      "CWE-787"
    ],
    "severity": "CRITICAL",
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-269"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -28,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-121",
      "CWE-787"
    ],
    "severity": "CRITICAL",
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5m24-g5mr-69cj",
-  "modified": "2023-12-27T21:31:00Z",
+  "modified": "2024-09-12T15:32:58Z",
  "published": "2023-12-22T21:30:23Z",
  "aliases": [
    "CVE-2023-51014"
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-77"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9v85-6x2c-c4m4",
-  "modified": "2023-12-27T21:31:00Z",
+  "modified": "2024-09-12T15:32:58Z",
  "published": "2023-12-22T18:30:31Z",
  "aliases": [
    "CVE-2023-51025"
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-77"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c77m-wh63-vhch",
-  "modified": "2024-07-29T09:36:14Z",
+  "modified": "2024-09-12T15:32:58Z",
  "published": "2024-07-23T09:30:39Z",
  "aliases": [
    "CVE-2024-41012"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfilelock: Remove locks reliably when fcntl/close race is detected\n\nWhen fcntl_setlk() races with close(), it removes the created lock with\ndo_lock_file_wait().\nHowever, LSMs can allow the first do_lock_file_wait() that created the lock\nwhile denying the second do_lock_file_wait() that tries to remove the lock.\nSeparately, posix_lock_file() could also fail to\nremove a lock due to GFP_KERNEL allocation failure (when splitting a range\nin the middle).\n\nAfter the bug has been triggered, use-after-free reads will occur in\nlock_get_status() when userspace reads /proc/locks. This can likely be used\nto read arbitrary kernel memory, but can't corrupt kernel memory.\n\nFix it by calling locks_remove_posix() instead, which is designed to\nreliably get rid of POSIX locks associated with the given file and\nfiles_struct and is also used by filp_flush().",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H"
+    }
  ],
  "affected": [

@@ -53,9 +56,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-416"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-23T08:15:01Z"
@@ -1,13 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-26rc-mj52-pcf5",
-  "modified": "2024-09-06T15:32:56Z",
+  "modified": "2024-09-12T15:32:59Z",
  "published": "2024-08-28T12:30:33Z",
  "aliases": [
    "CVE-2024-6449"
  ],
  "details": "HyperView Geoportal Toolkit in versions though 8.2.4 does not restrict cross-domain requests when fetching remote content pointed by one of GET request parameters.\nAn unauthenticated remote attacker can prepare links, which upon opening will load scripts from a remote location controlled by the attacker and execute them in the user space.\nBy manipulating this parameter it is also possible to enumerate some of the devices in Local Area Network in which the server resides.",
  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+    },
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2fx8-5w8c-86ff",
-  "modified": "2024-08-27T09:30:44Z",
+  "modified": "2024-09-12T15:32:59Z",
  "published": "2024-08-27T09:30:44Z",
  "aliases": [
    "CVE-2024-41176"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3mqr-vvf3-23jj",
-  "modified": "2024-08-29T18:31:35Z",
+  "modified": "2024-09-12T15:32:59Z",
  "published": "2024-08-26T12:31:20Z",
  "aliases": [
    "CVE-2024-44940"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfou: remove warn in gue_gro_receive on unsupported protocol\n\nDrop the WARN_ON_ONCE inn gue_gro_receive if the encapsulated type is\nnot known or does not have a GRO handler.\n\nSuch a packet is easily constructed. Syzbot generates them and sets\noff this warning.\n\nRemove the warning as it is expected and not actionable.\n\nThe warning was previously reduced from WARN_ON to WARN_ON_ONCE in\ncommit 270136613bf7 (\"fou: Do WARN_ON_ONCE in gue_gro_receive for bad\nproto callbacks\").",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -39,7 +42,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-26T12:15:06Z"
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-20"
+      "CWE-20",
+      "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-482j-q2mw-67xq",
-  "modified": "2024-08-28T09:30:34Z",
+  "modified": "2024-09-12T15:32:59Z",
  "published": "2024-08-28T09:30:34Z",
  "aliases": [
    "CVE-2024-4555"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-57m4-x9jr-6j53",
-  "modified": "2024-08-21T09:31:32Z",
+  "modified": "2024-09-12T15:32:59Z",
  "published": "2024-08-21T09:31:32Z",
  "aliases": [
    "CVE-2023-52914"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nio_uring/poll: add hash if ready poll request can't complete inline\n\nIf we don't, then we may lose access to it completely, leading to a\nrequest leak. This will eventually stall the ring exit process as\nwell.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-401"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-21T07:15:07Z"
--- a/Show More
+++ b/Show More