diff --git a/advisories/unreviewed/2024/04/GHSA-ccmh-gwpx-35xj/GHSA-ccmh-gwpx-35xj.json b/advisories/unreviewed/2024/04/GHSA-ccmh-gwpx-35xj/GHSA-ccmh-gwpx-35xj.json index 23f6f7fbb82..68574183eb2 100644 --- a/advisories/unreviewed/2024/04/GHSA-ccmh-gwpx-35xj/GHSA-ccmh-gwpx-35xj.json +++ b/advisories/unreviewed/2024/04/GHSA-ccmh-gwpx-35xj/GHSA-ccmh-gwpx-35xj.json @@ -36,7 +36,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-276" ], "severity": "LOW", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/05/GHSA-2wcp-6fq9-mcr6/GHSA-2wcp-6fq9-mcr6.json b/advisories/unreviewed/2024/05/GHSA-2wcp-6fq9-mcr6/GHSA-2wcp-6fq9-mcr6.json index 18d9d4d3407..cc34002f29d 100644 --- a/advisories/unreviewed/2024/05/GHSA-2wcp-6fq9-mcr6/GHSA-2wcp-6fq9-mcr6.json +++ b/advisories/unreviewed/2024/05/GHSA-2wcp-6fq9-mcr6/GHSA-2wcp-6fq9-mcr6.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-2wcp-6fq9-mcr6", - "modified": "2024-05-21T15:31:44Z", + "modified": "2024-11-13T21:30:31Z", "published": "2024-05-21T15:31:44Z", "aliases": [ "CVE-2021-47386" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field\n\nIf driver read val value sufficient for\n(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7))\nfrom device then Null pointer dereference occurs.\n(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)\nAlso lm75[] does not serve a purpose anymore after switching to\ndevm_i2c_new_dummy_device() in w83791d_detect_subclients().\n\nThe patch fixes possible NULL pointer dereference by removing lm75[].\n\nFound by Linux Driver Verification project (linuxtesting.org).\n\n[groeck: Dropped unnecessary continuation lines, fixed multi-line alignment]", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-05-21T15:15:24Z" diff --git a/advisories/unreviewed/2024/05/GHSA-fw47-mxv2-w4h2/GHSA-fw47-mxv2-w4h2.json b/advisories/unreviewed/2024/05/GHSA-fw47-mxv2-w4h2/GHSA-fw47-mxv2-w4h2.json index 3058cec5036..cb4aa788d71 100644 --- a/advisories/unreviewed/2024/05/GHSA-fw47-mxv2-w4h2/GHSA-fw47-mxv2-w4h2.json +++ b/advisories/unreviewed/2024/05/GHSA-fw47-mxv2-w4h2/GHSA-fw47-mxv2-w4h2.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-fw47-mxv2-w4h2", - "modified": "2024-06-26T00:31:43Z", + "modified": "2024-11-13T21:30:31Z", "published": "2024-05-19T09:34:46Z", "aliases": [ "CVE-2024-35884" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: do not accept non-tunnel GSO skbs landing in a tunnel\n\nWhen rx-udp-gro-forwarding is enabled UDP packets might be GROed when\nbeing forwarded. If such packets might land in a tunnel this can cause\nvarious issues and udp_gro_receive makes sure this isn't the case by\nlooking for a matching socket. This is performed in\nudp4/6_gro_lookup_skb but only in the current netns. This is an issue\nwith tunneled packets when the endpoint is in another netns. In such\ncases the packets will be GROed at the UDP level, which leads to various\nissues later on. The same thing can happen with rx-gro-list.\n\nWe saw this with geneve packets being GROed at the UDP level. In such\ncase gso_size is set; later the packet goes through the geneve rx path,\nthe geneve header is pulled, the offset are adjusted and frag_list skbs\nare not adjusted with regard to geneve. When those skbs hit\nskb_fragment, it will misbehave. Different outcomes are possible\ndepending on what the GROed skbs look like; from corrupted packets to\nkernel crashes.\n\nOne example is a BUG_ON[1] triggered in skb_segment while processing the\nfrag_list. Because gso_size is wrong (geneve header was pulled)\nskb_segment thinks there is \"geneve header size\" of data in frag_list,\nalthough it's in fact the next packet. The BUG_ON itself has nothing to\ndo with the issue. This is only one of the potential issues.\n\nLooking up for a matching socket in udp_gro_receive is fragile: the\nlookup could be extended to all netns (not speaking about performances)\nbut nothing prevents those packets from being modified in between and we\ncould still not find a matching socket. It's OK to keep the current\nlogic there as it should cover most cases but we also need to make sure\nwe handle tunnel packets being GROed too early.\n\nThis is done by extending the checks in udp_unexpected_gso: GSO packets\nlacking the SKB_GSO_UDP_TUNNEL/_CSUM bits and landing in a tunnel must\nbe segmented.\n\n[1] kernel BUG at net/core/skbuff.c:4408!\n RIP: 0010:skb_segment+0xd2a/0xf70\n __udp_gso_segment+0xaa/0x560", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -51,7 +54,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-05-19T09:15:09Z" diff --git a/advisories/unreviewed/2024/05/GHSA-hx2p-7j74-9v2g/GHSA-hx2p-7j74-9v2g.json b/advisories/unreviewed/2024/05/GHSA-hx2p-7j74-9v2g/GHSA-hx2p-7j74-9v2g.json index 3df886b49fb..d9f83ab59e7 100644 --- a/advisories/unreviewed/2024/05/GHSA-hx2p-7j74-9v2g/GHSA-hx2p-7j74-9v2g.json +++ b/advisories/unreviewed/2024/05/GHSA-hx2p-7j74-9v2g/GHSA-hx2p-7j74-9v2g.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-hx2p-7j74-9v2g", - "modified": "2024-05-06T18:30:35Z", + "modified": "2024-11-13T21:30:31Z", "published": "2024-05-06T18:30:35Z", "aliases": [ "CVE-2024-33403" ], "details": "A SQL injection vulnerability in /model/get_events.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the event_id parameter.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -18,6 +21,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33403" }, + { + "type": "WEB", + "url": "https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%2010.pdf" + }, { "type": "WEB", "url": "https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%202.pdf" @@ -25,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-05-06T18:15:07Z" diff --git a/advisories/unreviewed/2024/07/GHSA-qwjr-hp4h-rmwf/GHSA-qwjr-hp4h-rmwf.json b/advisories/unreviewed/2024/07/GHSA-qwjr-hp4h-rmwf/GHSA-qwjr-hp4h-rmwf.json index ffa6847cd98..334134f01b5 100644 --- a/advisories/unreviewed/2024/07/GHSA-qwjr-hp4h-rmwf/GHSA-qwjr-hp4h-rmwf.json +++ b/advisories/unreviewed/2024/07/GHSA-qwjr-hp4h-rmwf/GHSA-qwjr-hp4h-rmwf.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-qwjr-hp4h-rmwf", - "modified": "2024-07-05T18:34:18Z", + "modified": "2024-11-13T21:30:31Z", "published": "2024-07-05T18:34:18Z", "aliases": [ "CVE-2024-39150" ], "details": "vditor v.3.9.8 and before is vulnerable to Arbitrary file read via a crafted data packet.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-05T17:15:11Z" diff --git a/advisories/unreviewed/2024/10/GHSA-cjcf-6ch6-g3rx/GHSA-cjcf-6ch6-g3rx.json b/advisories/unreviewed/2024/10/GHSA-cjcf-6ch6-g3rx/GHSA-cjcf-6ch6-g3rx.json index a97df05e249..b1c7c3cbe17 100644 --- a/advisories/unreviewed/2024/10/GHSA-cjcf-6ch6-g3rx/GHSA-cjcf-6ch6-g3rx.json +++ b/advisories/unreviewed/2024/10/GHSA-cjcf-6ch6-g3rx/GHSA-cjcf-6ch6-g3rx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-cjcf-6ch6-g3rx", - "modified": "2024-11-05T00:31:27Z", + "modified": "2024-11-13T21:30:31Z", "published": "2024-10-30T09:30:48Z", "aliases": [ "CVE-2024-9632" @@ -25,6 +25,14 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:8798" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:9579" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:9601" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-9632" diff --git a/advisories/unreviewed/2024/10/GHSA-h7r9-ffqq-5r47/GHSA-h7r9-ffqq-5r47.json b/advisories/unreviewed/2024/10/GHSA-h7r9-ffqq-5r47/GHSA-h7r9-ffqq-5r47.json index fdc65791fdb..b41cfd31deb 100644 --- a/advisories/unreviewed/2024/10/GHSA-h7r9-ffqq-5r47/GHSA-h7r9-ffqq-5r47.json +++ b/advisories/unreviewed/2024/10/GHSA-h7r9-ffqq-5r47/GHSA-h7r9-ffqq-5r47.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-h7r9-ffqq-5r47", - "modified": "2024-10-21T18:30:58Z", + "modified": "2024-11-13T21:30:31Z", "published": "2024-10-21T18:30:58Z", "aliases": [ "CVE-2024-49925" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: efifb: Register sysfs groups through driver core\n\nThe driver core can register and cleanup sysfs groups already.\nMake use of that functionality to simplify the error handling and\ncleanup.\n\nAlso avoid a UAF race during unregistering where the sysctl attributes\nwere usable after the info struct was freed.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-21T18:15:14Z" diff --git a/advisories/unreviewed/2024/11/GHSA-266r-h4p4-f6fp/GHSA-266r-h4p4-f6fp.json b/advisories/unreviewed/2024/11/GHSA-266r-h4p4-f6fp/GHSA-266r-h4p4-f6fp.json new file mode 100644 index 00000000000..4c66c40f632 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-266r-h4p4-f6fp/GHSA-266r-h4p4-f6fp.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-266r-h4p4-f6fp", + "modified": "2024-11-13T21:30:34Z", + "published": "2024-11-13T21:30:34Z", + "aliases": [ + "CVE-2024-21783" + ], + "details": "Integer overflow for some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21783" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01131.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-2742-r3c2-2qgj/GHSA-2742-r3c2-2qgj.json b/advisories/unreviewed/2024/11/GHSA-2742-r3c2-2qgj/GHSA-2742-r3c2-2qgj.json index 65471cea8b8..c968c903d77 100644 --- a/advisories/unreviewed/2024/11/GHSA-2742-r3c2-2qgj/GHSA-2742-r3c2-2qgj.json +++ b/advisories/unreviewed/2024/11/GHSA-2742-r3c2-2qgj/GHSA-2742-r3c2-2qgj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-2742-r3c2-2qgj", - "modified": "2024-11-09T12:30:48Z", + "modified": "2024-11-13T21:30:32Z", "published": "2024-11-09T12:30:48Z", "aliases": [ "CVE-2024-50226" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/port: Fix use-after-free, permit out-of-order decoder shutdown\n\nIn support of investigating an initialization failure report [1],\ncxl_test was updated to register mock memory-devices after the mock\nroot-port/bus device had been registered. That led to cxl_test crashing\nwith a use-after-free bug with the following signature:\n\n cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem0:decoder7.0 @ 0 next: cxl_switch_uport.0 nr_eps: 1 nr_targets: 1\n cxl_port_attach_region: cxl region3: cxl_host_bridge.0:port3 decoder3.0 add: mem4:decoder14.0 @ 1 next: cxl_switch_uport.0 nr_eps: 2 nr_targets: 1\n cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[0] = cxl_switch_dport.0 for mem0:decoder7.0 @ 0\n1) cxl_port_setup_targets: cxl region3: cxl_switch_uport.0:port6 target[1] = cxl_switch_dport.4 for mem4:decoder14.0 @ 1\n [..]\n cxld_unregister: cxl decoder14.0:\n cxl_region_decode_reset: cxl_region region3:\n mock_decoder_reset: cxl_port port3: decoder3.0 reset\n2) mock_decoder_reset: cxl_port port3: decoder3.0: out of order reset, expected decoder3.1\n cxl_endpoint_decoder_release: cxl decoder14.0:\n [..]\n cxld_unregister: cxl decoder7.0:\n3) cxl_region_decode_reset: cxl_region region3:\n Oops: general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b6bc3: 0000 [#1] PREEMPT SMP PTI\n [..]\n RIP: 0010:to_cxl_port+0x8/0x60 [cxl_core]\n [..]\n Call Trace:\n \n cxl_region_decode_reset+0x69/0x190 [cxl_core]\n cxl_region_detach+0xe8/0x210 [cxl_core]\n cxl_decoder_kill_region+0x27/0x40 [cxl_core]\n cxld_unregister+0x5d/0x60 [cxl_core]\n\nAt 1) a region has been established with 2 endpoint decoders (7.0 and\n14.0). Those endpoints share a common switch-decoder in the topology\n(3.0). At teardown, 2), decoder14.0 is the first to be removed and hits\nthe \"out of order reset case\" in the switch decoder. The effect though\nis that region3 cleanup is aborted leaving it in-tact and\nreferencing decoder14.0. At 3) the second attempt to teardown region3\ntrips over the stale decoder14.0 object which has long since been\ndeleted.\n\nThe fix here is to recognize that the CXL specification places no\nmandate on in-order shutdown of switch-decoders, the driver enforces\nin-order allocation, and hardware enforces in-order commit. So, rather\nthan fail and leave objects dangling, always remove them.\n\nIn support of making cxl_region_decode_reset() always succeed,\ncxl_region_invalidate_memregion() failures are turned into warnings.\nCrashing the kernel is ok there since system integrity is at risk if\ncaches cannot be managed around physical address mutation events like\nCXL region destruction.\n\nA new device_for_each_child_reverse_from() is added to cleanup\nport->commit_end after all dependent decoders have been disabled. In\nother words if decoders are allocated 0->1->2 and disabled 1->2->0 then\nport->commit_end only decrements from 2 after 2 has been disabled, and\nit decrements all the way to zero since 1 was disabled previously.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-09T11:15:08Z" diff --git a/advisories/unreviewed/2024/11/GHSA-28gw-7mxx-5hjg/GHSA-28gw-7mxx-5hjg.json b/advisories/unreviewed/2024/11/GHSA-28gw-7mxx-5hjg/GHSA-28gw-7mxx-5hjg.json new file mode 100644 index 00000000000..d024f347750 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-28gw-7mxx-5hjg/GHSA-28gw-7mxx-5hjg.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-28gw-7mxx-5hjg", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-39766" + ], + "details": "Improper neutralization of special elements used in SQL command in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39766" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01219.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1336" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-2q4g-wvwx-8q3w/GHSA-2q4g-wvwx-8q3w.json b/advisories/unreviewed/2024/11/GHSA-2q4g-wvwx-8q3w/GHSA-2q4g-wvwx-8q3w.json new file mode 100644 index 00000000000..413c373b844 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-2q4g-wvwx-8q3w/GHSA-2q4g-wvwx-8q3w.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2q4g-wvwx-8q3w", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-29083" + ], + "details": "Incorrect default permissions in some Intel(R) Distribution for Python software before version 2024.2 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29083" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01165.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-276" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-2w8j-8xc6-4wcx/GHSA-2w8j-8xc6-4wcx.json b/advisories/unreviewed/2024/11/GHSA-2w8j-8xc6-4wcx/GHSA-2w8j-8xc6-4wcx.json new file mode 100644 index 00000000000..169019b28ab --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-2w8j-8xc6-4wcx/GHSA-2w8j-8xc6-4wcx.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2w8j-8xc6-4wcx", + "modified": "2024-11-13T21:30:34Z", + "published": "2024-11-13T21:30:34Z", + "aliases": [ + "CVE-2024-40443" + ], + "details": "SQL Injection vulnerability in Simple Laboratory Management System using PHP and MySQL v.1.0 allows a remote attacker to cause a denial of service via the delete_users function in the Useres.php", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40443" + }, + { + "type": "WEB", + "url": "https://gist.github.com/Yuma-Tsushima07/32bb887b791fec5c805557bedfec55c7" + }, + { + "type": "WEB", + "url": "https://github.com/Yuma-Tsushima07/CVE-2024-40443" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T20:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-2x4x-xw83-gw6x/GHSA-2x4x-xw83-gw6x.json b/advisories/unreviewed/2024/11/GHSA-2x4x-xw83-gw6x/GHSA-2x4x-xw83-gw6x.json new file mode 100644 index 00000000000..27deb92e72b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-2x4x-xw83-gw6x/GHSA-2x4x-xw83-gw6x.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2x4x-xw83-gw6x", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-35245" + ], + "details": "Uncontrolled search path element in some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35245" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01167.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-33mv-fjxj-2mx6/GHSA-33mv-fjxj-2mx6.json b/advisories/unreviewed/2024/11/GHSA-33mv-fjxj-2mx6/GHSA-33mv-fjxj-2mx6.json index c4fde532933..b7e32266997 100644 --- a/advisories/unreviewed/2024/11/GHSA-33mv-fjxj-2mx6/GHSA-33mv-fjxj-2mx6.json +++ b/advisories/unreviewed/2024/11/GHSA-33mv-fjxj-2mx6/GHSA-33mv-fjxj-2mx6.json @@ -1,13 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-33mv-fjxj-2mx6", - "modified": "2024-11-12T21:30:54Z", + "modified": "2024-11-13T21:30:33Z", "published": "2024-11-12T21:30:54Z", "aliases": [ "CVE-2024-8534" ], "details": "Memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway if the appliance must be configured as a Gateway (VPN Vserver) with RDP Feature enabled OR the appliance must be configured as a Gateway (VPN Vserver) and RDP Proxy Server Profile is created and set to Gateway (VPN Vserver) OR the appliance must be configured as a Auth Server (AAA Vserver) with RDP Feature enabled", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" diff --git a/advisories/unreviewed/2024/11/GHSA-349p-cc4x-9fv4/GHSA-349p-cc4x-9fv4.json b/advisories/unreviewed/2024/11/GHSA-349p-cc4x-9fv4/GHSA-349p-cc4x-9fv4.json new file mode 100644 index 00000000000..87e6bcdb33c --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-349p-cc4x-9fv4/GHSA-349p-cc4x-9fv4.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-349p-cc4x-9fv4", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-29079" + ], + "details": "Insufficient control flow management in some Intel(R) VROC software before version 8.6.0.3001 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29079" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01154.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-691" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-36f8-wm2q-w27h/GHSA-36f8-wm2q-w27h.json b/advisories/unreviewed/2024/11/GHSA-36f8-wm2q-w27h/GHSA-36f8-wm2q-w27h.json new file mode 100644 index 00000000000..5aacb7177d6 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-36f8-wm2q-w27h/GHSA-36f8-wm2q-w27h.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-36f8-wm2q-w27h", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-41167" + ], + "details": "Improper input validation in UEFI firmware in some Intel(R) Server Board M10JNP2SB Family may allow a privileged user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41167" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01175.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-39h6-pqr3-34cv/GHSA-39h6-pqr3-34cv.json b/advisories/unreviewed/2024/11/GHSA-39h6-pqr3-34cv/GHSA-39h6-pqr3-34cv.json new file mode 100644 index 00000000000..7d27f14269f --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-39h6-pqr3-34cv/GHSA-39h6-pqr3-34cv.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-39h6-pqr3-34cv", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-23918" + ], + "details": "Improper conditions check in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23918" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01079.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-39p9-vqpx-2vp6/GHSA-39p9-vqpx-2vp6.json b/advisories/unreviewed/2024/11/GHSA-39p9-vqpx-2vp6/GHSA-39p9-vqpx-2vp6.json new file mode 100644 index 00000000000..5457a921135 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-39p9-vqpx-2vp6/GHSA-39p9-vqpx-2vp6.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-39p9-vqpx-2vp6", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-22185" + ], + "details": "Time-of-check Time-of-use Race Condition in some Intel(R) processors with Intel(R) ACTM may allow a privileged user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22185" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01111.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-367" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-3mcq-hpvx-hp2v/GHSA-3mcq-hpvx-hp2v.json b/advisories/unreviewed/2024/11/GHSA-3mcq-hpvx-hp2v/GHSA-3mcq-hpvx-hp2v.json new file mode 100644 index 00000000000..5031312d7a2 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-3mcq-hpvx-hp2v/GHSA-3mcq-hpvx-hp2v.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3mcq-hpvx-hp2v", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-39285" + ], + "details": "Improper access control in UEFI firmware in some Intel(R) Server M20NTP Family may allow a privileged user to potentially enable information disclosure via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39285" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01175.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-3prf-xhv6-xgm8/GHSA-3prf-xhv6-xgm8.json b/advisories/unreviewed/2024/11/GHSA-3prf-xhv6-xgm8/GHSA-3prf-xhv6-xgm8.json new file mode 100644 index 00000000000..be3f152b644 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-3prf-xhv6-xgm8/GHSA-3prf-xhv6-xgm8.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3prf-xhv6-xgm8", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-28952" + ], + "details": "Uncontrolled search path for some Intel(R) IPP software for Windows before version 2021.12.0 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28952" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01140.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-3v6p-5g46-w432/GHSA-3v6p-5g46-w432.json b/advisories/unreviewed/2024/11/GHSA-3v6p-5g46-w432/GHSA-3v6p-5g46-w432.json new file mode 100644 index 00000000000..2c971ef1265 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-3v6p-5g46-w432/GHSA-3v6p-5g46-w432.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3v6p-5g46-w432", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-36284" + ], + "details": "Improper input validation in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to potentially enable escalation of privilege via adjacent access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36284" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01219.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-3wr4-4m2q-j8pw/GHSA-3wr4-4m2q-j8pw.json b/advisories/unreviewed/2024/11/GHSA-3wr4-4m2q-j8pw/GHSA-3wr4-4m2q-j8pw.json new file mode 100644 index 00000000000..1f6ff003283 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-3wr4-4m2q-j8pw/GHSA-3wr4-4m2q-j8pw.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3wr4-4m2q-j8pw", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-45878" + ], + "details": "The \"Stammdaten\" menu of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.291), in /Apps/TOPqw/qwStammdaten.aspx, is vulnerable to persistent Cross-Site Scripting (XSS).", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45878" + }, + { + "type": "WEB", + "url": "https://cyber.wtf/2024/11/11/topqw-webportal-cves" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-3x8x-wg7p-5gq4/GHSA-3x8x-wg7p-5gq4.json b/advisories/unreviewed/2024/11/GHSA-3x8x-wg7p-5gq4/GHSA-3x8x-wg7p-5gq4.json index f41b389234f..d286d6156f6 100644 --- a/advisories/unreviewed/2024/11/GHSA-3x8x-wg7p-5gq4/GHSA-3x8x-wg7p-5gq4.json +++ b/advisories/unreviewed/2024/11/GHSA-3x8x-wg7p-5gq4/GHSA-3x8x-wg7p-5gq4.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-122" + "CWE-122", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-45w9-p29f-hp8r/GHSA-45w9-p29f-hp8r.json b/advisories/unreviewed/2024/11/GHSA-45w9-p29f-hp8r/GHSA-45w9-p29f-hp8r.json new file mode 100644 index 00000000000..cc2d4261494 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-45w9-p29f-hp8r/GHSA-45w9-p29f-hp8r.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-45w9-p29f-hp8r", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-39811" + ], + "details": "Improper input validation in firmware for some Intel(R) Server M20NTP Family UEFI may allow a privileged user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39811" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01175.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-46pf-6w9r-96r9/GHSA-46pf-6w9r-96r9.json b/advisories/unreviewed/2024/11/GHSA-46pf-6w9r-96r9/GHSA-46pf-6w9r-96r9.json index 2cb9a7cb3df..6b4ac2ba298 100644 --- a/advisories/unreviewed/2024/11/GHSA-46pf-6w9r-96r9/GHSA-46pf-6w9r-96r9.json +++ b/advisories/unreviewed/2024/11/GHSA-46pf-6w9r-96r9/GHSA-46pf-6w9r-96r9.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-276" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-4jqw-mwqp-mhq2/GHSA-4jqw-mwqp-mhq2.json b/advisories/unreviewed/2024/11/GHSA-4jqw-mwqp-mhq2/GHSA-4jqw-mwqp-mhq2.json index c9ab40109ea..0d08d2142cf 100644 --- a/advisories/unreviewed/2024/11/GHSA-4jqw-mwqp-mhq2/GHSA-4jqw-mwqp-mhq2.json +++ b/advisories/unreviewed/2024/11/GHSA-4jqw-mwqp-mhq2/GHSA-4jqw-mwqp-mhq2.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-123" + "CWE-123", + "CWE-787" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-4qgx-w4q7-p46p/GHSA-4qgx-w4q7-p46p.json b/advisories/unreviewed/2024/11/GHSA-4qgx-w4q7-p46p/GHSA-4qgx-w4q7-p46p.json new file mode 100644 index 00000000000..e6f7997f8c8 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-4qgx-w4q7-p46p/GHSA-4qgx-w4q7-p46p.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4qgx-w4q7-p46p", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-45875" + ], + "details": "The create user function in baltic-it TOPqw Webportal 1.35.287.1 (fixed in version1.35.291), in /Apps/TOPqw/BenutzerManagement.aspx/SaveNewUser, is vulnerable to SQL injection. The JSON object username allows the manipulation of SQL queries.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45875" + }, + { + "type": "WEB", + "url": "https://cyber.wtf/2024/11/11/topqw-webportal-cves" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-4r2r-hjrw-mpq6/GHSA-4r2r-hjrw-mpq6.json b/advisories/unreviewed/2024/11/GHSA-4r2r-hjrw-mpq6/GHSA-4r2r-hjrw-mpq6.json index e221a5b181d..aab66861646 100644 --- a/advisories/unreviewed/2024/11/GHSA-4r2r-hjrw-mpq6/GHSA-4r2r-hjrw-mpq6.json +++ b/advisories/unreviewed/2024/11/GHSA-4r2r-hjrw-mpq6/GHSA-4r2r-hjrw-mpq6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4r2r-hjrw-mpq6", - "modified": "2024-11-08T12:31:12Z", + "modified": "2024-11-13T21:30:31Z", "published": "2024-11-08T12:31:12Z", "aliases": [ "CVE-2024-10839" diff --git a/advisories/unreviewed/2024/11/GHSA-4xfh-5wgj-8xj9/GHSA-4xfh-5wgj-8xj9.json b/advisories/unreviewed/2024/11/GHSA-4xfh-5wgj-8xj9/GHSA-4xfh-5wgj-8xj9.json new file mode 100644 index 00000000000..3977651f8d5 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-4xfh-5wgj-8xj9/GHSA-4xfh-5wgj-8xj9.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4xfh-5wgj-8xj9", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-28030" + ], + "details": "NULL pointer dereference in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable denial of service via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28030" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01131.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-395" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-5655-8v36-fhx6/GHSA-5655-8v36-fhx6.json b/advisories/unreviewed/2024/11/GHSA-5655-8v36-fhx6/GHSA-5655-8v36-fhx6.json new file mode 100644 index 00000000000..4dc5716d2a5 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-5655-8v36-fhx6/GHSA-5655-8v36-fhx6.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5655-8v36-fhx6", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-32048" + ], + "details": "Improper input validation in the Intel(R) Distribution of OpenVINO(TM) Model Server software before version 2024.0 may allow an unauthenticated user to potentially enable denial of service via adjacent access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32048" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01158.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-5684-4xfg-mxj4/GHSA-5684-4xfg-mxj4.json b/advisories/unreviewed/2024/11/GHSA-5684-4xfg-mxj4/GHSA-5684-4xfg-mxj4.json index b33408bef00..54ba448c443 100644 --- a/advisories/unreviewed/2024/11/GHSA-5684-4xfg-mxj4/GHSA-5684-4xfg-mxj4.json +++ b/advisories/unreviewed/2024/11/GHSA-5684-4xfg-mxj4/GHSA-5684-4xfg-mxj4.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5684-4xfg-mxj4", - "modified": "2024-11-12T15:30:34Z", + "modified": "2024-11-13T21:30:32Z", "published": "2024-11-09T12:30:47Z", "aliases": [ "CVE-2024-50217" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()\n\nMounting btrfs from two images (which have the same one fsid and two\ndifferent dev_uuids) in certain executing order may trigger an UAF for\nvariable 'device->bdev_file' in __btrfs_free_extra_devids(). And\nfollowing are the details:\n\n1. Attach image_1 to loop0, attach image_2 to loop1, and scan btrfs\n devices by ioctl(BTRFS_IOC_SCAN_DEV):\n\n / btrfs_device_1 → loop0\n fs_device\n \\ btrfs_device_2 → loop1\n2. mount /dev/loop0 /mnt\n btrfs_open_devices\n btrfs_device_1->bdev_file = btrfs_get_bdev_and_sb(loop0)\n btrfs_device_2->bdev_file = btrfs_get_bdev_and_sb(loop1)\n btrfs_fill_super\n open_ctree\n fail: btrfs_close_devices // -ENOMEM\n\t btrfs_close_bdev(btrfs_device_1)\n fput(btrfs_device_1->bdev_file)\n\t // btrfs_device_1->bdev_file is freed\n\t btrfs_close_bdev(btrfs_device_2)\n fput(btrfs_device_2->bdev_file)\n\n3. mount /dev/loop1 /mnt\n btrfs_open_devices\n btrfs_get_bdev_and_sb(&bdev_file)\n // EIO, btrfs_device_1->bdev_file is not assigned,\n // which points to a freed memory area\n btrfs_device_2->bdev_file = btrfs_get_bdev_and_sb(loop1)\n btrfs_fill_super\n open_ctree\n btrfs_free_extra_devids\n if (btrfs_device_1->bdev_file)\n fput(btrfs_device_1->bdev_file) // UAF !\n\nFix it by setting 'device->bdev_file' as 'NULL' after closing the\nbtrfs_device in btrfs_close_one_device().", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-09T11:15:07Z" diff --git a/advisories/unreviewed/2024/11/GHSA-5fxv-92q8-4499/GHSA-5fxv-92q8-4499.json b/advisories/unreviewed/2024/11/GHSA-5fxv-92q8-4499/GHSA-5fxv-92q8-4499.json new file mode 100644 index 00000000000..ad60a48cbbc --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-5fxv-92q8-4499/GHSA-5fxv-92q8-4499.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5fxv-92q8-4499", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-31074" + ], + "details": "Observable timing discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via network access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31074" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01177.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-208" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-5h2m-w4xr-fxpq/GHSA-5h2m-w4xr-fxpq.json b/advisories/unreviewed/2024/11/GHSA-5h2m-w4xr-fxpq/GHSA-5h2m-w4xr-fxpq.json new file mode 100644 index 00000000000..f78d2bbcca2 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-5h2m-w4xr-fxpq/GHSA-5h2m-w4xr-fxpq.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5h2m-w4xr-fxpq", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-34028" + ], + "details": "Uncontrolled search path in some Intel(R) Graphics Offline Compiler for OpenCL(TM) Code software for Windows before version 2024.1.0.142, graphics driver 31.0.101.5445 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34028" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01163.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-5p69-3rp7-542w/GHSA-5p69-3rp7-542w.json b/advisories/unreviewed/2024/11/GHSA-5p69-3rp7-542w/GHSA-5p69-3rp7-542w.json new file mode 100644 index 00000000000..791d0ad21bd --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-5p69-3rp7-542w/GHSA-5p69-3rp7-542w.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5p69-3rp7-542w", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-33617" + ], + "details": "Insufficient control flow management in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via network access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33617" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01177.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-691" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-5q62-p8xf-7hfj/GHSA-5q62-p8xf-7hfj.json b/advisories/unreviewed/2024/11/GHSA-5q62-p8xf-7hfj/GHSA-5q62-p8xf-7hfj.json new file mode 100644 index 00000000000..1e534442e9b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-5q62-p8xf-7hfj/GHSA-5q62-p8xf-7hfj.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5q62-p8xf-7hfj", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-34776" + ], + "details": "Out-of-bounds write in some Intel(R) SGX SDK software may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34776" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01188.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-643q-8gx3-hf55/GHSA-643q-8gx3-hf55.json b/advisories/unreviewed/2024/11/GHSA-643q-8gx3-hf55/GHSA-643q-8gx3-hf55.json new file mode 100644 index 00000000000..21d0deba963 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-643q-8gx3-hf55/GHSA-643q-8gx3-hf55.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-643q-8gx3-hf55", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-21820" + ], + "details": "Incorrect default permissions in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21820" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01079.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-276" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-6f9r-4gpr-m3h8/GHSA-6f9r-4gpr-m3h8.json b/advisories/unreviewed/2024/11/GHSA-6f9r-4gpr-m3h8/GHSA-6f9r-4gpr-m3h8.json index 4e5f08cfb20..3ed9c1fac0b 100644 --- a/advisories/unreviewed/2024/11/GHSA-6f9r-4gpr-m3h8/GHSA-6f9r-4gpr-m3h8.json +++ b/advisories/unreviewed/2024/11/GHSA-6f9r-4gpr-m3h8/GHSA-6f9r-4gpr-m3h8.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-6f9r-4gpr-m3h8", - "modified": "2024-11-09T12:30:48Z", + "modified": "2024-11-13T21:30:32Z", "published": "2024-11-09T12:30:48Z", "aliases": [ "CVE-2024-50228" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: shmem: fix data-race in shmem_getattr()\n\nI got the following KCSAN report during syzbot testing:\n\n==================================================================\nBUG: KCSAN: data-race in generic_fillattr / inode_set_ctime_current\n\nwrite to 0xffff888102eb3260 of 4 bytes by task 6565 on cpu 1:\n inode_set_ctime_to_ts include/linux/fs.h:1638 [inline]\n inode_set_ctime_current+0x169/0x1d0 fs/inode.c:2626\n shmem_mknod+0x117/0x180 mm/shmem.c:3443\n shmem_create+0x34/0x40 mm/shmem.c:3497\n lookup_open fs/namei.c:3578 [inline]\n open_last_lookups fs/namei.c:3647 [inline]\n path_openat+0xdbc/0x1f00 fs/namei.c:3883\n do_filp_open+0xf7/0x200 fs/namei.c:3913\n do_sys_openat2+0xab/0x120 fs/open.c:1416\n do_sys_open fs/open.c:1431 [inline]\n __do_sys_openat fs/open.c:1447 [inline]\n __se_sys_openat fs/open.c:1442 [inline]\n __x64_sys_openat+0xf3/0x120 fs/open.c:1442\n x64_sys_call+0x1025/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:258\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x54/0x120 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nread to 0xffff888102eb3260 of 4 bytes by task 3498 on cpu 0:\n inode_get_ctime_nsec include/linux/fs.h:1623 [inline]\n inode_get_ctime include/linux/fs.h:1629 [inline]\n generic_fillattr+0x1dd/0x2f0 fs/stat.c:62\n shmem_getattr+0x17b/0x200 mm/shmem.c:1157\n vfs_getattr_nosec fs/stat.c:166 [inline]\n vfs_getattr+0x19b/0x1e0 fs/stat.c:207\n vfs_statx_path fs/stat.c:251 [inline]\n vfs_statx+0x134/0x2f0 fs/stat.c:315\n vfs_fstatat+0xec/0x110 fs/stat.c:341\n __do_sys_newfstatat fs/stat.c:505 [inline]\n __se_sys_newfstatat+0x58/0x260 fs/stat.c:499\n __x64_sys_newfstatat+0x55/0x70 fs/stat.c:499\n x64_sys_call+0x141f/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:263\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0x54/0x120 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nvalue changed: 0x2755ae53 -> 0x27ee44d3\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 0 UID: 0 PID: 3498 Comm: udevd Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a-dirty #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024\n==================================================================\n\nWhen calling generic_fillattr(), if you don't hold read lock, data-race\nwill occur in inode member variables, which can cause unexpected\nbehavior.\n\nSince there is no special protection when shmem_getattr() calls\ngeneric_fillattr(), data-race occurs by functions such as shmem_unlink()\nor shmem_mknod(). This can cause unexpected results, so commenting it out\nis not enough.\n\nTherefore, when calling generic_fillattr() from shmem_getattr(), it is\nappropriate to protect the inode using inode_lock_shared() and\ninode_unlock_shared() to prevent data-race.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -53,9 +56,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-362" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-09T11:15:08Z" diff --git a/advisories/unreviewed/2024/11/GHSA-6g43-mf5q-88rc/GHSA-6g43-mf5q-88rc.json b/advisories/unreviewed/2024/11/GHSA-6g43-mf5q-88rc/GHSA-6g43-mf5q-88rc.json new file mode 100644 index 00000000000..c574f8cb5f6 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-6g43-mf5q-88rc/GHSA-6g43-mf5q-88rc.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6g43-mf5q-88rc", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-38387" + ], + "details": "Uncontrolled search path in the Intel(R) Graphics Driver installers for versions 15.40 and 15.45 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38387" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01191.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-6j3m-gfx7-f9rp/GHSA-6j3m-gfx7-f9rp.json b/advisories/unreviewed/2024/11/GHSA-6j3m-gfx7-f9rp/GHSA-6j3m-gfx7-f9rp.json new file mode 100644 index 00000000000..0c25359501c --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-6j3m-gfx7-f9rp/GHSA-6j3m-gfx7-f9rp.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6j3m-gfx7-f9rp", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-23312" + ], + "details": "Uncontrolled search path for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23312" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01138.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-6w5w-j428-gfp7/GHSA-6w5w-j428-gfp7.json b/advisories/unreviewed/2024/11/GHSA-6w5w-j428-gfp7/GHSA-6w5w-j428-gfp7.json new file mode 100644 index 00000000000..98074c613e9 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-6w5w-j428-gfp7/GHSA-6w5w-j428-gfp7.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6w5w-j428-gfp7", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-36242" + ], + "details": "Protection mechanism failure in the SPP for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36242" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01196.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-693" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-6wf3-mrmw-6v2f/GHSA-6wf3-mrmw-6v2f.json b/advisories/unreviewed/2024/11/GHSA-6wf3-mrmw-6v2f/GHSA-6wf3-mrmw-6v2f.json new file mode 100644 index 00000000000..7960a2b6213 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-6wf3-mrmw-6v2f/GHSA-6wf3-mrmw-6v2f.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6wf3-mrmw-6v2f", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-36253" + ], + "details": "Uncontrolled search path in the Intel(R) SDP Tool for Windows software all version may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36253" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01179.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-7845-crfj-phc4/GHSA-7845-crfj-phc4.json b/advisories/unreviewed/2024/11/GHSA-7845-crfj-phc4/GHSA-7845-crfj-phc4.json new file mode 100644 index 00000000000..57dda069fe3 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-7845-crfj-phc4/GHSA-7845-crfj-phc4.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7845-crfj-phc4", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-52554" + ], + "details": "Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they're not executed in the Script Security sandbox, allowing attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox protection.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52554" + }, + { + "type": "WEB", + "url": "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3466" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-78hj-7cr6-hq8q/GHSA-78hj-7cr6-hq8q.json b/advisories/unreviewed/2024/11/GHSA-78hj-7cr6-hq8q/GHSA-78hj-7cr6-hq8q.json index 7811d353473..0554617fe13 100644 --- a/advisories/unreviewed/2024/11/GHSA-78hj-7cr6-hq8q/GHSA-78hj-7cr6-hq8q.json +++ b/advisories/unreviewed/2024/11/GHSA-78hj-7cr6-hq8q/GHSA-78hj-7cr6-hq8q.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-78hj-7cr6-hq8q", - "modified": "2024-11-09T12:30:48Z", + "modified": "2024-11-13T21:30:32Z", "published": "2024-11-09T12:30:48Z", "aliases": [ "CVE-2024-50222" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\niov_iter: fix copy_page_from_iter_atomic() if KMAP_LOCAL_FORCE_MAP\n\ngeneric/077 on x86_32 CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP=y with highmem,\non huge=always tmpfs, issues a warning and then hangs (interruptibly):\n\nWARNING: CPU: 5 PID: 3517 at mm/highmem.c:622 kunmap_local_indexed+0x62/0xc9\nCPU: 5 UID: 0 PID: 3517 Comm: cp Not tainted 6.12.0-rc4 #2\n...\ncopy_page_from_iter_atomic+0xa6/0x5ec\ngeneric_perform_write+0xf6/0x1b4\nshmem_file_write_iter+0x54/0x67\n\nFix copy_page_from_iter_atomic() by limiting it in that case\n(include/linux/skbuff.h skb_frag_must_loop() does similar).\n\nBut going forward, perhaps CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP is too\nsurprising, has outlived its usefulness, and should just be removed?", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -35,7 +38,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-09T11:15:07Z" diff --git a/advisories/unreviewed/2024/11/GHSA-7ch8-mh59-262m/GHSA-7ch8-mh59-262m.json b/advisories/unreviewed/2024/11/GHSA-7ch8-mh59-262m/GHSA-7ch8-mh59-262m.json new file mode 100644 index 00000000000..e545b464af1 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-7ch8-mh59-262m/GHSA-7ch8-mh59-262m.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7ch8-mh59-262m", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-33624" + ], + "details": "Improper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an unauthenticated user to potentially enable denial of service via network access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33624" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01167.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-7h5p-3h8w-5629/GHSA-7h5p-3h8w-5629.json b/advisories/unreviewed/2024/11/GHSA-7h5p-3h8w-5629/GHSA-7h5p-3h8w-5629.json index 487995fe81a..b58f498a7ed 100644 --- a/advisories/unreviewed/2024/11/GHSA-7h5p-3h8w-5629/GHSA-7h5p-3h8w-5629.json +++ b/advisories/unreviewed/2024/11/GHSA-7h5p-3h8w-5629/GHSA-7h5p-3h8w-5629.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-7h5p-3h8w-5629", - "modified": "2024-11-09T12:30:48Z", + "modified": "2024-11-13T21:30:32Z", "published": "2024-11-09T12:30:48Z", "aliases": [ "CVE-2024-50229" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential deadlock with newly created symlinks\n\nSyzbot reported that page_symlink(), called by nilfs_symlink(), triggers\nmemory reclamation involving the filesystem layer, which can result in\ncircular lock dependencies among the reader/writer semaphore\nnilfs->ns_segctor_sem, s_writers percpu_rwsem (intwrite) and the\nfs_reclaim pseudo lock.\n\nThis is because after commit 21fc61c73c39 (\"don't put symlink bodies in\npagecache into highmem\"), the gfp flags of the page cache for symbolic\nlinks are overwritten to GFP_KERNEL via inode_nohighmem().\n\nThis is not a problem for symlinks read from the backing device, because\nthe __GFP_FS flag is dropped after inode_nohighmem() is called. However,\nwhen a new symlink is created with nilfs_symlink(), the gfp flags remain\noverwritten to GFP_KERNEL. Then, memory allocation called from\npage_symlink() etc. triggers memory reclamation including the FS layer,\nwhich may call nilfs_evict_inode() or nilfs_dirty_inode(). And these can\ncause a deadlock if they are called while nilfs->ns_segctor_sem is held:\n\nFix this issue by dropping the __GFP_FS flag from the page cache GFP flags\nof newly created symlinks in the same way that nilfs_new_inode() and\n__nilfs_read_inode() do, as a workaround until we adopt nofs allocation\nscope consistently or improve the locking constraints.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -53,9 +56,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-667" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-09T11:15:08Z" diff --git a/advisories/unreviewed/2024/11/GHSA-7j4g-m9q4-562g/GHSA-7j4g-m9q4-562g.json b/advisories/unreviewed/2024/11/GHSA-7j4g-m9q4-562g/GHSA-7j4g-m9q4-562g.json new file mode 100644 index 00000000000..bc6ee81a8a2 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-7j4g-m9q4-562g/GHSA-7j4g-m9q4-562g.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7j4g-m9q4-562g", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-31154" + ], + "details": "Improper input validation in UEFI firmware for some Intel(R) Server S2600BPBR may allow a privileged user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31154" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01175.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-7r42-p46c-33g2/GHSA-7r42-p46c-33g2.json b/advisories/unreviewed/2024/11/GHSA-7r42-p46c-33g2/GHSA-7r42-p46c-33g2.json index 4427779c081..68a4d7f215d 100644 --- a/advisories/unreviewed/2024/11/GHSA-7r42-p46c-33g2/GHSA-7r42-p46c-33g2.json +++ b/advisories/unreviewed/2024/11/GHSA-7r42-p46c-33g2/GHSA-7r42-p46c-33g2.json @@ -1,13 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-7r42-p46c-33g2", - "modified": "2024-11-08T18:30:50Z", + "modified": "2024-11-13T21:30:32Z", "published": "2024-11-08T18:30:50Z", "aliases": [ "CVE-2024-9841" ], "details": "A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in OpenText ArcSight Management Center and ArcSight Platform. The vulnerability could be remotely exploited.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" diff --git a/advisories/unreviewed/2024/11/GHSA-84q2-584c-m4v4/GHSA-84q2-584c-m4v4.json b/advisories/unreviewed/2024/11/GHSA-84q2-584c-m4v4/GHSA-84q2-584c-m4v4.json new file mode 100644 index 00000000000..7bc8d7eb15e --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-84q2-584c-m4v4/GHSA-84q2-584c-m4v4.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-84q2-584c-m4v4", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-34165" + ], + "details": "Uncontrolled search path in some Intel(R) oneAPI DPC++/C++ Compiler before version 2024.2 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34165" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01217.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-8755-h2rp-p3rr/GHSA-8755-h2rp-p3rr.json b/advisories/unreviewed/2024/11/GHSA-8755-h2rp-p3rr/GHSA-8755-h2rp-p3rr.json new file mode 100644 index 00000000000..d5f56615eef --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-8755-h2rp-p3rr/GHSA-8755-h2rp-p3rr.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8755-h2rp-p3rr", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-40885" + ], + "details": "Use after free in the UEFI firmware of some Intel(R) Server M20NTP BIOS may allow a privileged user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40885" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01175.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-877x-7xf2-qfc6/GHSA-877x-7xf2-qfc6.json b/advisories/unreviewed/2024/11/GHSA-877x-7xf2-qfc6/GHSA-877x-7xf2-qfc6.json index 6e4776f2389..77c28ce2e62 100644 --- a/advisories/unreviewed/2024/11/GHSA-877x-7xf2-qfc6/GHSA-877x-7xf2-qfc6.json +++ b/advisories/unreviewed/2024/11/GHSA-877x-7xf2-qfc6/GHSA-877x-7xf2-qfc6.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-877x-7xf2-qfc6", - "modified": "2024-11-08T18:30:50Z", + "modified": "2024-11-13T21:30:31Z", "published": "2024-11-08T18:30:50Z", "aliases": [ "CVE-2024-51031" ], "details": "A Cross-site Scripting (XSS) vulnerability in manage_account.php in Sourcecodester Cab Management System 1.0 allows remote authenticated users to inject arbitrary web scripts via the \"First Name,\" \"Middle Name,\" and \"Last Name\" fields.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-08T18:15:17Z" diff --git a/advisories/unreviewed/2024/11/GHSA-87c6-34x6-8wvx/GHSA-87c6-34x6-8wvx.json b/advisories/unreviewed/2024/11/GHSA-87c6-34x6-8wvx/GHSA-87c6-34x6-8wvx.json new file mode 100644 index 00000000000..666878c2241 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-87c6-34x6-8wvx/GHSA-87c6-34x6-8wvx.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-87c6-34x6-8wvx", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-35201" + ], + "details": "Incorrect default permissions in the Intel(R) SDP Tool for Windows software all versions may allow an authenticated user to enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35201" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01179.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-276" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-8886-8v27-85j8/GHSA-8886-8v27-85j8.json b/advisories/unreviewed/2024/11/GHSA-8886-8v27-85j8/GHSA-8886-8v27-85j8.json new file mode 100644 index 00000000000..d90fafaa0bf --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-8886-8v27-85j8/GHSA-8886-8v27-85j8.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8886-8v27-85j8", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-52552" + ], + "details": "Jenkins Authorize Project Plugin 1.7.2 and earlier evaluates a string containing the job name with JavaScript on the Authorization view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52552" + }, + { + "type": "WEB", + "url": "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3010" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-88g2-9h8q-q752/GHSA-88g2-9h8q-q752.json b/advisories/unreviewed/2024/11/GHSA-88g2-9h8q-q752/GHSA-88g2-9h8q-q752.json index 705839b3a93..cbd731f2de7 100644 --- a/advisories/unreviewed/2024/11/GHSA-88g2-9h8q-q752/GHSA-88g2-9h8q-q752.json +++ b/advisories/unreviewed/2024/11/GHSA-88g2-9h8q-q752/GHSA-88g2-9h8q-q752.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-88g2-9h8q-q752", - "modified": "2024-11-08T18:30:50Z", + "modified": "2024-11-13T21:30:32Z", "published": "2024-11-08T18:30:50Z", "aliases": [ "CVE-2024-51032" ], "details": "A Cross-site Scripting (XSS) vulnerability in manage_recipient.php of Sourcecodester Toll Tax Management System 1.0 allows remote authenticated users to inject arbitrary web scripts via the \"owner\" input field.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-08T18:15:17Z" diff --git a/advisories/unreviewed/2024/11/GHSA-8fc3-6g2g-rgc3/GHSA-8fc3-6g2g-rgc3.json b/advisories/unreviewed/2024/11/GHSA-8fc3-6g2g-rgc3/GHSA-8fc3-6g2g-rgc3.json index 8bb3b096b72..b4b6b3862ae 100644 --- a/advisories/unreviewed/2024/11/GHSA-8fc3-6g2g-rgc3/GHSA-8fc3-6g2g-rgc3.json +++ b/advisories/unreviewed/2024/11/GHSA-8fc3-6g2g-rgc3/GHSA-8fc3-6g2g-rgc3.json @@ -32,7 +32,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-77" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-8gv7-mmch-w6h8/GHSA-8gv7-mmch-w6h8.json b/advisories/unreviewed/2024/11/GHSA-8gv7-mmch-w6h8/GHSA-8gv7-mmch-w6h8.json new file mode 100644 index 00000000000..4e151cd7fae --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-8gv7-mmch-w6h8/GHSA-8gv7-mmch-w6h8.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8gv7-mmch-w6h8", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-29076" + ], + "details": "Uncaught exception for some Intel(R) CST software before version 8.7.10803 may allow an authenticated user to potentially enable denial of service via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29076" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01024.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-248" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-8rrm-crhv-qpmv/GHSA-8rrm-crhv-qpmv.json b/advisories/unreviewed/2024/11/GHSA-8rrm-crhv-qpmv/GHSA-8rrm-crhv-qpmv.json new file mode 100644 index 00000000000..e0e2cda72bf --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-8rrm-crhv-qpmv/GHSA-8rrm-crhv-qpmv.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8rrm-crhv-qpmv", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-45879" + ], + "details": "The file upload function in the \"QWKalkulation\" tool of baltic-it TOPqw Webportal v1.35.287.1 (fixed in version 1.35.291), in /Apps/TOPqw/QWKalkulation/QWKalkulation.aspx, is vulnerable to Cross-Site Scripting (XSS). To exploit the persistent XSS vulnerability, an attacker has to be authenticated to the application that uses the \"TOPqw Webportal\" as a software. When authenticated, the attacker can persistently place the malicious JavaScript code in the \"QWKalkulation\" menu.'", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45879" + }, + { + "type": "WEB", + "url": "https://cyber.wtf/2024/11/11/topqw-webportal-cves" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-943v-4mfm-9hjg/GHSA-943v-4mfm-9hjg.json b/advisories/unreviewed/2024/11/GHSA-943v-4mfm-9hjg/GHSA-943v-4mfm-9hjg.json index 808109cf6d8..4b3bb2e6d3a 100644 --- a/advisories/unreviewed/2024/11/GHSA-943v-4mfm-9hjg/GHSA-943v-4mfm-9hjg.json +++ b/advisories/unreviewed/2024/11/GHSA-943v-4mfm-9hjg/GHSA-943v-4mfm-9hjg.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-943v-4mfm-9hjg", - "modified": "2024-11-08T12:31:12Z", + "modified": "2024-11-13T21:30:31Z", "published": "2024-11-08T12:31:12Z", "aliases": [ "CVE-2024-10187" diff --git a/advisories/unreviewed/2024/11/GHSA-98p8-4mpf-g28q/GHSA-98p8-4mpf-g28q.json b/advisories/unreviewed/2024/11/GHSA-98p8-4mpf-g28q/GHSA-98p8-4mpf-g28q.json new file mode 100644 index 00000000000..0a607b04375 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-98p8-4mpf-g28q/GHSA-98p8-4mpf-g28q.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-98p8-4mpf-g28q", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-28885" + ], + "details": "Observable discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via network access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28885" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01177.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-203" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-9fm7-prpc-h7x8/GHSA-9fm7-prpc-h7x8.json b/advisories/unreviewed/2024/11/GHSA-9fm7-prpc-h7x8/GHSA-9fm7-prpc-h7x8.json index e71d42ade64..e2ffd48cd98 100644 --- a/advisories/unreviewed/2024/11/GHSA-9fm7-prpc-h7x8/GHSA-9fm7-prpc-h7x8.json +++ b/advisories/unreviewed/2024/11/GHSA-9fm7-prpc-h7x8/GHSA-9fm7-prpc-h7x8.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9fm7-prpc-h7x8", - "modified": "2024-11-09T12:30:48Z", + "modified": "2024-11-13T21:30:32Z", "published": "2024-11-09T12:30:48Z", "aliases": [ "CVE-2024-50221" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: Vangogh: Fix kernel memory out of bounds write\n\nKASAN reports that the GPU metrics table allocated in\nvangogh_tables_init() is not large enough for the memset done in\nsmu_cmn_init_soft_gpu_metrics(). Condensed report follows:\n\n[ 33.861314] BUG: KASAN: slab-out-of-bounds in smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu]\n[ 33.861799] Write of size 168 at addr ffff888129f59500 by task mangoapp/1067\n...\n[ 33.861808] CPU: 6 UID: 1000 PID: 1067 Comm: mangoapp Tainted: G W 6.12.0-rc4 #356 1a56f59a8b5182eeaf67eb7cb8b13594dd23b544\n[ 33.861816] Tainted: [W]=WARN\n[ 33.861818] Hardware name: Valve Galileo/Galileo, BIOS F7G0107 12/01/2023\n[ 33.861822] Call Trace:\n[ 33.861826] \n[ 33.861829] dump_stack_lvl+0x66/0x90\n[ 33.861838] print_report+0xce/0x620\n[ 33.861853] kasan_report+0xda/0x110\n[ 33.862794] kasan_check_range+0xfd/0x1a0\n[ 33.862799] __asan_memset+0x23/0x40\n[ 33.862803] smu_cmn_init_soft_gpu_metrics+0x73/0x200 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[ 33.863306] vangogh_get_gpu_metrics_v2_4+0x123/0xad0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[ 33.864257] vangogh_common_get_gpu_metrics+0xb0c/0xbc0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[ 33.865682] amdgpu_dpm_get_gpu_metrics+0xcc/0x110 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[ 33.866160] amdgpu_get_gpu_metrics+0x154/0x2d0 [amdgpu 13b1bc364ec578808f676eba412c20eaab792779]\n[ 33.867135] dev_attr_show+0x43/0xc0\n[ 33.867147] sysfs_kf_seq_show+0x1f1/0x3b0\n[ 33.867155] seq_read_iter+0x3f8/0x1140\n[ 33.867173] vfs_read+0x76c/0xc50\n[ 33.867198] ksys_read+0xfb/0x1d0\n[ 33.867214] do_syscall_64+0x90/0x160\n...\n[ 33.867353] Allocated by task 378 on cpu 7 at 22.794876s:\n[ 33.867358] kasan_save_stack+0x33/0x50\n[ 33.867364] kasan_save_track+0x17/0x60\n[ 33.867367] __kasan_kmalloc+0x87/0x90\n[ 33.867371] vangogh_init_smc_tables+0x3f9/0x840 [amdgpu]\n[ 33.867835] smu_sw_init+0xa32/0x1850 [amdgpu]\n[ 33.868299] amdgpu_device_init+0x467b/0x8d90 [amdgpu]\n[ 33.868733] amdgpu_driver_load_kms+0x19/0xf0 [amdgpu]\n[ 33.869167] amdgpu_pci_probe+0x2d6/0xcd0 [amdgpu]\n[ 33.869608] local_pci_probe+0xda/0x180\n[ 33.869614] pci_device_probe+0x43f/0x6b0\n\nEmpirically we can confirm that the former allocates 152 bytes for the\ntable, while the latter memsets the 168 large block.\n\nRoot cause appears that when GPU metrics tables for v2_4 parts were added\nit was not considered to enlarge the table to fit.\n\nThe fix in this patch is rather \"brute force\" and perhaps later should be\ndone in a smarter way, by extracting and consolidating the part version to\nsize logic to a common helper, instead of brute forcing the largest\npossible allocation. Nevertheless, for now this works and fixes the out of\nbounds write.\n\nv2:\n * Drop impossible v3_0 case. (Mario)\n\n(cherry picked from commit 0880f58f9609f0200483a49429af0f050d281703)", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-09T11:15:07Z" diff --git a/advisories/unreviewed/2024/11/GHSA-9g9p-59w9-vqqc/GHSA-9g9p-59w9-vqqc.json b/advisories/unreviewed/2024/11/GHSA-9g9p-59w9-vqqc/GHSA-9g9p-59w9-vqqc.json index aead845545d..57a13f43044 100644 --- a/advisories/unreviewed/2024/11/GHSA-9g9p-59w9-vqqc/GHSA-9g9p-59w9-vqqc.json +++ b/advisories/unreviewed/2024/11/GHSA-9g9p-59w9-vqqc/GHSA-9g9p-59w9-vqqc.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9g9p-59w9-vqqc", - "modified": "2024-11-13T18:32:05Z", + "modified": "2024-11-13T21:30:34Z", "published": "2024-11-13T18:32:05Z", "aliases": [ "CVE-2024-43093" ], "details": "In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-13T18:15:21Z" diff --git a/advisories/unreviewed/2024/11/GHSA-9hqp-3p4c-742r/GHSA-9hqp-3p4c-742r.json b/advisories/unreviewed/2024/11/GHSA-9hqp-3p4c-742r/GHSA-9hqp-3p4c-742r.json new file mode 100644 index 00000000000..cd661e52427 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-9hqp-3p4c-742r/GHSA-9hqp-3p4c-742r.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9hqp-3p4c-742r", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-25563" + ], + "details": "Improper initialization in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi before version 23.40 may allow a privileged user to potentially enable information disclosure via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25563" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01108.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-665" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-9r4q-j4q6-fv33/GHSA-9r4q-j4q6-fv33.json b/advisories/unreviewed/2024/11/GHSA-9r4q-j4q6-fv33/GHSA-9r4q-j4q6-fv33.json new file mode 100644 index 00000000000..981ac081f5e --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-9r4q-j4q6-fv33/GHSA-9r4q-j4q6-fv33.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9r4q-j4q6-fv33", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-38668" + ], + "details": "Uncontrolled search path for some Intel(R) Quartus(R) Prime Standard Edition software for Windows before version 23.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38668" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01193.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-c2rv-8j84-953p/GHSA-c2rv-8j84-953p.json b/advisories/unreviewed/2024/11/GHSA-c2rv-8j84-953p/GHSA-c2rv-8j84-953p.json index d5b5ebb6c3f..7a879f51eb7 100644 --- a/advisories/unreviewed/2024/11/GHSA-c2rv-8j84-953p/GHSA-c2rv-8j84-953p.json +++ b/advisories/unreviewed/2024/11/GHSA-c2rv-8j84-953p/GHSA-c2rv-8j84-953p.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-c2rv-8j84-953p", - "modified": "2024-11-08T18:30:49Z", + "modified": "2024-11-13T21:30:31Z", "published": "2024-11-07T12:30:35Z", "aliases": [ "CVE-2024-50171" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: systemport: fix potential memory leak in bcm_sysport_xmit()\n\nThe bcm_sysport_xmit() returns NETDEV_TX_OK without freeing skb\nin case of dma_map_single() fails, add dev_kfree_skb() to fix it.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -53,9 +56,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-401" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-07T10:15:08Z" diff --git a/advisories/unreviewed/2024/11/GHSA-c62c-xc8v-3q5x/GHSA-c62c-xc8v-3q5x.json b/advisories/unreviewed/2024/11/GHSA-c62c-xc8v-3q5x/GHSA-c62c-xc8v-3q5x.json new file mode 100644 index 00000000000..69a00a5cc6f --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-c62c-xc8v-3q5x/GHSA-c62c-xc8v-3q5x.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c62c-xc8v-3q5x", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-37025" + ], + "details": "Incorrect execution-assigned permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installer before version 23.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37025" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01197.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-279" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-c665-gh2m-5vg4/GHSA-c665-gh2m-5vg4.json b/advisories/unreviewed/2024/11/GHSA-c665-gh2m-5vg4/GHSA-c665-gh2m-5vg4.json new file mode 100644 index 00000000000..31df557b71d --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-c665-gh2m-5vg4/GHSA-c665-gh2m-5vg4.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c665-gh2m-5vg4", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-37027" + ], + "details": "Improper Input validation in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to potentially enable denial of service via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37027" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01187.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-c7c7-8vw9-wpp6/GHSA-c7c7-8vw9-wpp6.json b/advisories/unreviewed/2024/11/GHSA-c7c7-8vw9-wpp6/GHSA-c7c7-8vw9-wpp6.json new file mode 100644 index 00000000000..8a8a5c6e4bb --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-c7c7-8vw9-wpp6/GHSA-c7c7-8vw9-wpp6.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c7c7-8vw9-wpp6", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-26017" + ], + "details": "Uncontrolled search path in some Intel(R) Rendering Toolkit software before version 2024.1.0 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26017" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01142.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-chgm-fm3p-h36c/GHSA-chgm-fm3p-h36c.json b/advisories/unreviewed/2024/11/GHSA-chgm-fm3p-h36c/GHSA-chgm-fm3p-h36c.json new file mode 100644 index 00000000000..adf50789a86 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-chgm-fm3p-h36c/GHSA-chgm-fm3p-h36c.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-chgm-fm3p-h36c", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-31407" + ], + "details": "Uncontrolled search path in some Intel(R) High Level Synthesis Compiler software for Intel(R) Quartus(R) Prime Pro Edition Software before version 24.1 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31407" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01148.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-cpmw-ff7x-cg2w/GHSA-cpmw-ff7x-cg2w.json b/advisories/unreviewed/2024/11/GHSA-cpmw-ff7x-cg2w/GHSA-cpmw-ff7x-cg2w.json new file mode 100644 index 00000000000..fad99862b10 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-cpmw-ff7x-cg2w/GHSA-cpmw-ff7x-cg2w.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cpmw-ff7x-cg2w", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-34164" + ], + "details": "Uncontrolled search path element in some Intel(R) MAS software before version 2.5 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34164" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01161.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-cpmx-w293-837f/GHSA-cpmx-w293-837f.json b/advisories/unreviewed/2024/11/GHSA-cpmx-w293-837f/GHSA-cpmx-w293-837f.json new file mode 100644 index 00000000000..4f50dc5e1a6 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-cpmx-w293-837f/GHSA-cpmx-w293-837f.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cpmx-w293-837f", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-32485" + ], + "details": "Improper Input Validation in some Intel(R) VROC software before version 8.6.0.2003 may allow an authenticated user to potentially enable denial of service via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32485" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01154.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-f58g-ghv3-pqv3/GHSA-f58g-ghv3-pqv3.json b/advisories/unreviewed/2024/11/GHSA-f58g-ghv3-pqv3/GHSA-f58g-ghv3-pqv3.json new file mode 100644 index 00000000000..0b5391aa609 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-f58g-ghv3-pqv3/GHSA-f58g-ghv3-pqv3.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f58g-ghv3-pqv3", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-21853" + ], + "details": "Improper finite state machines (FSMs) in the hardware logic in some 4th and 5th Generation Intel(R) Xeon(R) Processors may allow an authorized user to potentially enable denial of service via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21853" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01101.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1245" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-f97j-93hw-h78h/GHSA-f97j-93hw-h78h.json b/advisories/unreviewed/2024/11/GHSA-f97j-93hw-h78h/GHSA-f97j-93hw-h78h.json index 9715672857e..fe3d5552022 100644 --- a/advisories/unreviewed/2024/11/GHSA-f97j-93hw-h78h/GHSA-f97j-93hw-h78h.json +++ b/advisories/unreviewed/2024/11/GHSA-f97j-93hw-h78h/GHSA-f97j-93hw-h78h.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-g35q-cm9f-rp9h/GHSA-g35q-cm9f-rp9h.json b/advisories/unreviewed/2024/11/GHSA-g35q-cm9f-rp9h/GHSA-g35q-cm9f-rp9h.json new file mode 100644 index 00000000000..85be8284805 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-g35q-cm9f-rp9h/GHSA-g35q-cm9f-rp9h.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g35q-cm9f-rp9h", + "modified": "2024-11-13T21:30:34Z", + "published": "2024-11-13T21:30:34Z", + "aliases": [ + "CVE-2024-11193" + ], + "details": "An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintext within application logs. This flaw results in the unintentional exposure of sensitive information in Yugabyte Anywhere logs, potentially allowing unauthorized users with access to these logs to view the LDAP bind password. An attacker with log access could exploit this vulnerability to gain unauthorized access to the LDAP server, leading to potential exposure or compromise of LDAP-managed resources\nThis issue affects YugabyteDB Anywhere: from 2.20.0.0 before 2.20.7.0, from 2.23.0.0 before 2.23.1.0, from 2024.1.0.0 before 2024.1.3.0.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11193" + }, + { + "type": "WEB", + "url": "https://github.com/yugabyte/yugabyte-db/commit/0bf6e5a3e9c0718a28e654483596615d0798b208" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-g8j9-jfgw-6pqf/GHSA-g8j9-jfgw-6pqf.json b/advisories/unreviewed/2024/11/GHSA-g8j9-jfgw-6pqf/GHSA-g8j9-jfgw-6pqf.json new file mode 100644 index 00000000000..63b7f4bc093 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-g8j9-jfgw-6pqf/GHSA-g8j9-jfgw-6pqf.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g8j9-jfgw-6pqf", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-34023" + ], + "details": "Untrusted pointer dereference in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34023" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01132.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-822" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-g9v3-rgcc-7jqh/GHSA-g9v3-rgcc-7jqh.json b/advisories/unreviewed/2024/11/GHSA-g9v3-rgcc-7jqh/GHSA-g9v3-rgcc-7jqh.json new file mode 100644 index 00000000000..6f193acfc99 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-g9v3-rgcc-7jqh/GHSA-g9v3-rgcc-7jqh.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g9v3-rgcc-7jqh", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-36275" + ], + "details": "NULL pointer dereference in some Intel(R) Optane(TM) PMem Management software versions before CR_MGMT_02.00.00.4040, CR_MGMT_03.00.00.0499 may allow a authenticated user to potentially enable denial of service via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36275" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01189.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-395" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-gcv7-3w7r-7v38/GHSA-gcv7-3w7r-7v38.json b/advisories/unreviewed/2024/11/GHSA-gcv7-3w7r-7v38/GHSA-gcv7-3w7r-7v38.json new file mode 100644 index 00000000000..53f4a772b73 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-gcv7-3w7r-7v38/GHSA-gcv7-3w7r-7v38.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gcv7-3w7r-7v38", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-36245" + ], + "details": "Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36245" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01187.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-gvvw-6jh9-63h5/GHSA-gvvw-6jh9-63h5.json b/advisories/unreviewed/2024/11/GHSA-gvvw-6jh9-63h5/GHSA-gvvw-6jh9-63h5.json index 7115bc451c5..0cdf1555ba1 100644 --- a/advisories/unreviewed/2024/11/GHSA-gvvw-6jh9-63h5/GHSA-gvvw-6jh9-63h5.json +++ b/advisories/unreviewed/2024/11/GHSA-gvvw-6jh9-63h5/GHSA-gvvw-6jh9-63h5.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-88" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-gw8m-ww5h-rf9w/GHSA-gw8m-ww5h-rf9w.json b/advisories/unreviewed/2024/11/GHSA-gw8m-ww5h-rf9w/GHSA-gw8m-ww5h-rf9w.json index 0e9d3c13f65..321f6e64cf6 100644 --- a/advisories/unreviewed/2024/11/GHSA-gw8m-ww5h-rf9w/GHSA-gw8m-ww5h-rf9w.json +++ b/advisories/unreviewed/2024/11/GHSA-gw8m-ww5h-rf9w/GHSA-gw8m-ww5h-rf9w.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-gw8m-ww5h-rf9w", - "modified": "2024-11-13T00:30:48Z", + "modified": "2024-11-13T21:30:33Z", "published": "2024-11-13T00:30:48Z", "aliases": [ "CVE-2024-51179" ], "details": "An issue in Open 5GS v.2.7.1 allows a remote attacker to cause a denial of service via the Network Function Virtualizations (NFVs) such as the User Plane Function (UPF) and the Session Management Function (SMF), The Packet Data Unit (PDU) session establishment process.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-404" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-12T22:15:15Z" diff --git a/advisories/unreviewed/2024/11/GHSA-h23j-73ww-7594/GHSA-h23j-73ww-7594.json b/advisories/unreviewed/2024/11/GHSA-h23j-73ww-7594/GHSA-h23j-73ww-7594.json new file mode 100644 index 00000000000..fa37a2208d7 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-h23j-73ww-7594/GHSA-h23j-73ww-7594.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h23j-73ww-7594", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-52553" + ], + "details": "Jenkins OpenId Connect Authentication Plugin 4.418.vccc7061f5b_6d and earlier does not invalidate the previous session on login.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52553" + }, + { + "type": "WEB", + "url": "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3473" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-h3rc-229h-wgjg/GHSA-h3rc-229h-wgjg.json b/advisories/unreviewed/2024/11/GHSA-h3rc-229h-wgjg/GHSA-h3rc-229h-wgjg.json new file mode 100644 index 00000000000..e11522b0161 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-h3rc-229h-wgjg/GHSA-h3rc-229h-wgjg.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h3rc-229h-wgjg", + "modified": "2024-11-13T21:30:34Z", + "published": "2024-11-13T21:30:34Z", + "aliases": [ + "CVE-2024-21808" + ], + "details": "Improper buffer restrictions in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21808" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01131.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hpg3-hj89-68jh/GHSA-hpg3-hj89-68jh.json b/advisories/unreviewed/2024/11/GHSA-hpg3-hj89-68jh/GHSA-hpg3-hj89-68jh.json new file mode 100644 index 00000000000..1a69936abb6 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-hpg3-hj89-68jh/GHSA-hpg3-hj89-68jh.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hpg3-hj89-68jh", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-25647" + ], + "details": "Incorrect default permissions for some Intel(R) Binary Configuration Tool software for Windows before version 3.4.5 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25647" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01138.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-276" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-j4rg-rp32-grwp/GHSA-j4rg-rp32-grwp.json b/advisories/unreviewed/2024/11/GHSA-j4rg-rp32-grwp/GHSA-j4rg-rp32-grwp.json new file mode 100644 index 00000000000..15abb91b774 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-j4rg-rp32-grwp/GHSA-j4rg-rp32-grwp.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j4rg-rp32-grwp", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-32483" + ], + "details": "Improper access control for some Intel(R) EMA software before version 1.13.1.0 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32483" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01201.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-jv82-75fh-23r7/GHSA-jv82-75fh-23r7.json b/advisories/unreviewed/2024/11/GHSA-jv82-75fh-23r7/GHSA-jv82-75fh-23r7.json new file mode 100644 index 00000000000..9073dbb8848 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-jv82-75fh-23r7/GHSA-jv82-75fh-23r7.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jv82-75fh-23r7", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-52549" + ], + "details": "Jenkins Script Security Plugin 1367.vdf2fc45f229c and earlier, except 1365.1367.va_3b_b_89f8a_95b_ and 1362.1364.v4cf2dc5d8776, does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of files on the controller file system.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52549" + }, + { + "type": "WEB", + "url": "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3447" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-m4m9-v4mx-256j/GHSA-m4m9-v4mx-256j.json b/advisories/unreviewed/2024/11/GHSA-m4m9-v4mx-256j/GHSA-m4m9-v4mx-256j.json index 7a65978bb32..d2d9eac72d8 100644 --- a/advisories/unreviewed/2024/11/GHSA-m4m9-v4mx-256j/GHSA-m4m9-v4mx-256j.json +++ b/advisories/unreviewed/2024/11/GHSA-m4m9-v4mx-256j/GHSA-m4m9-v4mx-256j.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-m4m9-v4mx-256j", - "modified": "2024-11-09T12:30:49Z", + "modified": "2024-11-13T21:30:32Z", "published": "2024-11-09T12:30:49Z", "aliases": [ "CVE-2024-50262" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix out-of-bounds write in trie_get_next_key()\n\ntrie_get_next_key() allocates a node stack with size trie->max_prefixlen,\nwhile it writes (trie->max_prefixlen + 1) nodes to the stack when it has\nfull paths from the root to leaves. For example, consider a trie with\nmax_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ...\n0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with\n.prefixlen = 8 make 9 nodes be written on the node stack with size 8.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -53,9 +56,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-09T11:15:11Z" diff --git a/advisories/unreviewed/2024/11/GHSA-m5hv-r49v-rq3w/GHSA-m5hv-r49v-rq3w.json b/advisories/unreviewed/2024/11/GHSA-m5hv-r49v-rq3w/GHSA-m5hv-r49v-rq3w.json new file mode 100644 index 00000000000..dd47598bc9b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-m5hv-r49v-rq3w/GHSA-m5hv-r49v-rq3w.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m5hv-r49v-rq3w", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-39368" + ], + "details": "Improper neutralization of special elements used in an SQL command ('SQL Injection') in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to potentially enable escalation of privilege via adjacent access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39368" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01219.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-mh62-5j9h-2c77/GHSA-mh62-5j9h-2c77.json b/advisories/unreviewed/2024/11/GHSA-mh62-5j9h-2c77/GHSA-mh62-5j9h-2c77.json new file mode 100644 index 00000000000..8aed96b36df --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-mh62-5j9h-2c77/GHSA-mh62-5j9h-2c77.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mh62-5j9h-2c77", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-38383" + ], + "details": "Uncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition software for Windows before version 24.2 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38383" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01195.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-mp6w-qw2g-78wx/GHSA-mp6w-qw2g-78wx.json b/advisories/unreviewed/2024/11/GHSA-mp6w-qw2g-78wx/GHSA-mp6w-qw2g-78wx.json new file mode 100644 index 00000000000..d72e417bea3 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-mp6w-qw2g-78wx/GHSA-mp6w-qw2g-78wx.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mp6w-qw2g-78wx", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-28881" + ], + "details": "Uncontrolled search path for some Intel(R) Fortran Compiler Classic software before version 2021.13 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28881" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01173.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-mrh2-c3xg-pf82/GHSA-mrh2-c3xg-pf82.json b/advisories/unreviewed/2024/11/GHSA-mrh2-c3xg-pf82/GHSA-mrh2-c3xg-pf82.json index f4800e9e927..c32e4a45d14 100644 --- a/advisories/unreviewed/2024/11/GHSA-mrh2-c3xg-pf82/GHSA-mrh2-c3xg-pf82.json +++ b/advisories/unreviewed/2024/11/GHSA-mrh2-c3xg-pf82/GHSA-mrh2-c3xg-pf82.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mrh2-c3xg-pf82", - "modified": "2024-11-11T03:30:45Z", + "modified": "2024-11-13T21:30:32Z", "published": "2024-11-11T03:30:45Z", "aliases": [ "CVE-2024-48939" @@ -18,6 +18,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48939" }, + { + "type": "WEB", + "url": "https://github.com/gitaware/CVE/blob/main/CVE-2024-48939/20241020_vuln_discl_paxton_API_license.pdf" + }, { "type": "WEB", "url": "https://paxton-access.co.uk" diff --git a/advisories/unreviewed/2024/11/GHSA-mrpr-vr82-x88r/GHSA-mrpr-vr82-x88r.json b/advisories/unreviewed/2024/11/GHSA-mrpr-vr82-x88r/GHSA-mrpr-vr82-x88r.json new file mode 100644 index 00000000000..492960098c1 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-mrpr-vr82-x88r/GHSA-mrpr-vr82-x88r.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mrpr-vr82-x88r", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-52550" + ], + "details": "Jenkins Pipeline: Groovy Plugin 3990.vd281dd77a_388 and earlier, except 3975.3977.v478dd9e956c3 does not check whether the main (Jenkinsfile) script for a rebuilt build is approved, allowing attackers with Item/Build permission to rebuild a previous build whose (Jenkinsfile) script is no longer approved.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52550" + }, + { + "type": "WEB", + "url": "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3362" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-mvj5-x7rr-vvqv/GHSA-mvj5-x7rr-vvqv.json b/advisories/unreviewed/2024/11/GHSA-mvj5-x7rr-vvqv/GHSA-mvj5-x7rr-vvqv.json new file mode 100644 index 00000000000..3b0564d73a9 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-mvj5-x7rr-vvqv/GHSA-mvj5-x7rr-vvqv.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mvj5-x7rr-vvqv", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-25565" + ], + "details": "Insufficient control flow management in UEFI firmware for some Intel(R) Xeon(R) Processors may allow an authenticated user to enable denial of service via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25565" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01085.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-691" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-p2qq-c693-q53w/GHSA-p2qq-c693-q53w.json b/advisories/unreviewed/2024/11/GHSA-p2qq-c693-q53w/GHSA-p2qq-c693-q53w.json new file mode 100644 index 00000000000..48fb25cfced --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-p2qq-c693-q53w/GHSA-p2qq-c693-q53w.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p2qq-c693-q53w", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-52551" + ], + "details": "Jenkins Pipeline: Declarative Plugin 2.2214.vb_b_34b_2ea_9b_83 and earlier does not check whether the main (Jenkinsfile) script used to restart a build from a specific stage is approved, allowing attackers with Item/Build permission to restart a previous build whose (Jenkinsfile) script is no longer approved.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52551" + }, + { + "type": "WEB", + "url": "https://www.jenkins.io/security/advisory/2024-11-13/#SECURITY-3361" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:29Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-p972-2fg6-pw4j/GHSA-p972-2fg6-pw4j.json b/advisories/unreviewed/2024/11/GHSA-p972-2fg6-pw4j/GHSA-p972-2fg6-pw4j.json new file mode 100644 index 00000000000..e089895dcc6 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-p972-2fg6-pw4j/GHSA-p972-2fg6-pw4j.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p972-2fg6-pw4j", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-45877" + ], + "details": "baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /Apps/TOPqw/BenutzerManagement.aspx. This allows a low privileged user to access all modules in the web portal, view and manipulate information and permissions of other users, lock other user or unlock the own account, change the password of other users, create new users or delete existing users and view, manipulate and delete reference data.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45877" + }, + { + "type": "WEB", + "url": "https://cyber.wtf/2024/11/11/topqw-webportal-cves" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-q6jg-9xmc-jq9w/GHSA-q6jg-9xmc-jq9w.json b/advisories/unreviewed/2024/11/GHSA-q6jg-9xmc-jq9w/GHSA-q6jg-9xmc-jq9w.json index f8998c8b0a3..2e09e4806d1 100644 --- a/advisories/unreviewed/2024/11/GHSA-q6jg-9xmc-jq9w/GHSA-q6jg-9xmc-jq9w.json +++ b/advisories/unreviewed/2024/11/GHSA-q6jg-9xmc-jq9w/GHSA-q6jg-9xmc-jq9w.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-732" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-q9h5-v87h-3hhr/GHSA-q9h5-v87h-3hhr.json b/advisories/unreviewed/2024/11/GHSA-q9h5-v87h-3hhr/GHSA-q9h5-v87h-3hhr.json index 2cf07a65cb0..efa21f794f8 100644 --- a/advisories/unreviewed/2024/11/GHSA-q9h5-v87h-3hhr/GHSA-q9h5-v87h-3hhr.json +++ b/advisories/unreviewed/2024/11/GHSA-q9h5-v87h-3hhr/GHSA-q9h5-v87h-3hhr.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-122" + "CWE-122", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-qc3r-qr6p-cwr5/GHSA-qc3r-qr6p-cwr5.json b/advisories/unreviewed/2024/11/GHSA-qc3r-qr6p-cwr5/GHSA-qc3r-qr6p-cwr5.json index 83ef04d2c47..3b27ecbd17e 100644 --- a/advisories/unreviewed/2024/11/GHSA-qc3r-qr6p-cwr5/GHSA-qc3r-qr6p-cwr5.json +++ b/advisories/unreviewed/2024/11/GHSA-qc3r-qr6p-cwr5/GHSA-qc3r-qr6p-cwr5.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-122" + "CWE-122", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-qj97-9rrv-6887/GHSA-qj97-9rrv-6887.json b/advisories/unreviewed/2024/11/GHSA-qj97-9rrv-6887/GHSA-qj97-9rrv-6887.json new file mode 100644 index 00000000000..eb2c147ad71 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-qj97-9rrv-6887/GHSA-qj97-9rrv-6887.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qj97-9rrv-6887", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-29085" + ], + "details": "Improper access control for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticated user to potentially enable escalation of privilege via adjacent access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29085" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01146.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-qjjg-xwf5-ccw7/GHSA-qjjg-xwf5-ccw7.json b/advisories/unreviewed/2024/11/GHSA-qjjg-xwf5-ccw7/GHSA-qjjg-xwf5-ccw7.json new file mode 100644 index 00000000000..15533e4db09 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-qjjg-xwf5-ccw7/GHSA-qjjg-xwf5-ccw7.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qjjg-xwf5-ccw7", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-29077" + ], + "details": "Improper access control in some JAM STAPL Player software before version 2.6.1 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29077" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01151.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-qm24-fmqw-f5v5/GHSA-qm24-fmqw-f5v5.json b/advisories/unreviewed/2024/11/GHSA-qm24-fmqw-f5v5/GHSA-qm24-fmqw-f5v5.json index 446cfe715bd..62f956149f8 100644 --- a/advisories/unreviewed/2024/11/GHSA-qm24-fmqw-f5v5/GHSA-qm24-fmqw-f5v5.json +++ b/advisories/unreviewed/2024/11/GHSA-qm24-fmqw-f5v5/GHSA-qm24-fmqw-f5v5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-qm24-fmqw-f5v5", - "modified": "2024-11-09T12:30:48Z", + "modified": "2024-11-13T21:30:32Z", "published": "2024-11-09T12:30:48Z", "aliases": [ "CVE-2024-50227" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Fix KASAN reported stack out-of-bounds read in tb_retimer_scan()\n\nKASAN reported following issue:\n\n BUG: KASAN: stack-out-of-bounds in tb_retimer_scan+0xffe/0x1550 [thunderbolt]\n Read of size 4 at addr ffff88810111fc1c by task kworker/u56:0/11\n CPU: 0 UID: 0 PID: 11 Comm: kworker/u56:0 Tainted: G U 6.11.0+ #1387\n Tainted: [U]=USER\n Workqueue: thunderbolt0 tb_handle_hotplug [thunderbolt]\n Call Trace:\n \n dump_stack_lvl+0x6c/0x90\n print_report+0xd1/0x630\n kasan_report+0xdb/0x110\n __asan_report_load4_noabort+0x14/0x20\n tb_retimer_scan+0xffe/0x1550 [thunderbolt]\n tb_scan_port+0xa6f/0x2060 [thunderbolt]\n tb_handle_hotplug+0x17b1/0x3080 [thunderbolt]\n process_one_work+0x626/0x1100\n worker_thread+0x6c8/0xfa0\n kthread+0x2c8/0x3a0\n ret_from_fork+0x3a/0x80\n ret_from_fork_asm+0x1a/0x30\n\nThis happens because the loop variable still gets incremented by one so\nmax becomes 3 instead of 2, and this makes the second loop read past the\nthe array declared on the stack.\n\nFix this by assigning to max directly in the loop body.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-125" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-09T11:15:08Z" diff --git a/advisories/unreviewed/2024/11/GHSA-qppc-w6vv-vxmr/GHSA-qppc-w6vv-vxmr.json b/advisories/unreviewed/2024/11/GHSA-qppc-w6vv-vxmr/GHSA-qppc-w6vv-vxmr.json new file mode 100644 index 00000000000..0f0759c886b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-qppc-w6vv-vxmr/GHSA-qppc-w6vv-vxmr.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qppc-w6vv-vxmr", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-31158" + ], + "details": "Improper input validation in UEFI firmware in some Intel(R) Server Board S2600BP Family may allow a privileged user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31158" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01175.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-qqm7-v4mx-rj2v/GHSA-qqm7-v4mx-rj2v.json b/advisories/unreviewed/2024/11/GHSA-qqm7-v4mx-rj2v/GHSA-qqm7-v4mx-rj2v.json new file mode 100644 index 00000000000..ac56f73f2bb --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-qqm7-v4mx-rj2v/GHSA-qqm7-v4mx-rj2v.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qqm7-v4mx-rj2v", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-38660" + ], + "details": "Protection mechanism failure in the SPP for some Intel(R) Xeon(R) processor family (E-Core) may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38660" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01196.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-693" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-r74p-fwjf-cpr8/GHSA-r74p-fwjf-cpr8.json b/advisories/unreviewed/2024/11/GHSA-r74p-fwjf-cpr8/GHSA-r74p-fwjf-cpr8.json new file mode 100644 index 00000000000..472fc7ebdd0 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-r74p-fwjf-cpr8/GHSA-r74p-fwjf-cpr8.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r74p-fwjf-cpr8", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-37024" + ], + "details": "Uncontrolled search path for some ACAT software maintained by Intel(R) for Windows before version 3.11.0 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37024" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01176.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-r962-v37q-hrg6/GHSA-r962-v37q-hrg6.json b/advisories/unreviewed/2024/11/GHSA-r962-v37q-hrg6/GHSA-r962-v37q-hrg6.json new file mode 100644 index 00000000000..fcca4ca0f82 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-r962-v37q-hrg6/GHSA-r962-v37q-hrg6.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r962-v37q-hrg6", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-23198" + ], + "details": "Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi products before version 23.40 may allow an unauthenticated user to enable denial of service via adjacent access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23198" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01108.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-rhhp-94ch-9rf5/GHSA-rhhp-94ch-9rf5.json b/advisories/unreviewed/2024/11/GHSA-rhhp-94ch-9rf5/GHSA-rhhp-94ch-9rf5.json index 926a36947d4..e1d184ee5af 100644 --- a/advisories/unreviewed/2024/11/GHSA-rhhp-94ch-9rf5/GHSA-rhhp-94ch-9rf5.json +++ b/advisories/unreviewed/2024/11/GHSA-rhhp-94ch-9rf5/GHSA-rhhp-94ch-9rf5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rhhp-94ch-9rf5", - "modified": "2024-11-09T12:30:49Z", + "modified": "2024-11-13T21:30:32Z", "published": "2024-11-09T12:30:49Z", "aliases": [ "CVE-2024-50260" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsock_map: fix a NULL pointer dereference in sock_map_link_update_prog()\n\nThe following race condition could trigger a NULL pointer dereference:\n\nsock_map_link_detach():\t\tsock_map_link_update_prog():\n mutex_lock(&sockmap_mutex);\n ...\n sockmap_link->map = NULL;\n mutex_unlock(&sockmap_mutex);\n \t\t\t\t mutex_lock(&sockmap_mutex);\n\t\t\t\t ...\n\t\t\t\t sock_map_prog_link_lookup(sockmap_link->map);\n\t\t\t\t mutex_unlock(&sockmap_mutex);\n \n\nFix it by adding a NULL pointer check. In this specific case, it makes\nno sense to update a link which is being released.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-09T11:15:11Z" diff --git a/advisories/unreviewed/2024/11/GHSA-rhwx-656q-5r7x/GHSA-rhwx-656q-5r7x.json b/advisories/unreviewed/2024/11/GHSA-rhwx-656q-5r7x/GHSA-rhwx-656q-5r7x.json new file mode 100644 index 00000000000..2a6329c5e88 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-rhwx-656q-5r7x/GHSA-rhwx-656q-5r7x.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rhwx-656q-5r7x", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-21850" + ], + "details": "Sensitive information in resource not removed before reuse in some Intel(R) TDX Seamldr module software before version 1.5.02.00 may allow a privileged user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21850" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01076.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-226" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-rpgw-8x6f-7c3f/GHSA-rpgw-8x6f-7c3f.json b/advisories/unreviewed/2024/11/GHSA-rpgw-8x6f-7c3f/GHSA-rpgw-8x6f-7c3f.json new file mode 100644 index 00000000000..9498755ec93 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-rpgw-8x6f-7c3f/GHSA-rpgw-8x6f-7c3f.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rpgw-8x6f-7c3f", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-33611" + ], + "details": "Improper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow a privileged user to potentially enable denial of service via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33611" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01167.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-v3h8-6499-8h5p/GHSA-v3h8-6499-8h5p.json b/advisories/unreviewed/2024/11/GHSA-v3h8-6499-8h5p/GHSA-v3h8-6499-8h5p.json new file mode 100644 index 00000000000..90d04cb56b7 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-v3h8-6499-8h5p/GHSA-v3h8-6499-8h5p.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v3h8-6499-8h5p", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-45876" + ], + "details": "The login form of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.283.4) at /Apps/TOPqw/Login.aspx is vulnerable to SQL injection. The vulnerability exists in the POST parameter txtUsername, which allows for manipulation of SQL queries.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45876" + }, + { + "type": "WEB", + "url": "https://cyber.wtf/2024/11/11/topqw-webportal-cves" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:28Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-v7xc-84pr-6g9h/GHSA-v7xc-84pr-6g9h.json b/advisories/unreviewed/2024/11/GHSA-v7xc-84pr-6g9h/GHSA-v7xc-84pr-6g9h.json new file mode 100644 index 00000000000..03050ca5048 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-v7xc-84pr-6g9h/GHSA-v7xc-84pr-6g9h.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v7xc-84pr-6g9h", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-38665" + ], + "details": "Out-of-bounds write in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38665" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01132.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vcp3-gcj3-f3h6/GHSA-vcp3-gcj3-f3h6.json b/advisories/unreviewed/2024/11/GHSA-vcp3-gcj3-f3h6/GHSA-vcp3-gcj3-f3h6.json new file mode 100644 index 00000000000..3bc601233e9 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-vcp3-gcj3-f3h6/GHSA-vcp3-gcj3-f3h6.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vcp3-gcj3-f3h6", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-28169" + ], + "details": "Cleartext transmission of sensitive information for some BigDL software maintained by Intel(R) before version 2.5.0 may allow an authenticated user to potentially enable denial of service via adjacent access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28169" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01146.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-319" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vjhv-x2xp-g8gh/GHSA-vjhv-x2xp-g8gh.json b/advisories/unreviewed/2024/11/GHSA-vjhv-x2xp-g8gh/GHSA-vjhv-x2xp-g8gh.json new file mode 100644 index 00000000000..644b5b469a7 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-vjhv-x2xp-g8gh/GHSA-vjhv-x2xp-g8gh.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vjhv-x2xp-g8gh", + "modified": "2024-11-13T21:30:34Z", + "published": "2024-11-13T21:30:34Z", + "aliases": [ + "CVE-2024-42834" + ], + "details": "A stored cross-site scripting (XSS) vulnerability in the Create Customer API in Incognito Service Activation Center (SAC) UI v14.11 allows authenticated attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the lastName parameter.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42834" + }, + { + "type": "WEB", + "url": "https://github.com/CyberSec-Supra/CVE-2024-42834" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T20:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vpvv-6p83-mmw2/GHSA-vpvv-6p83-mmw2.json b/advisories/unreviewed/2024/11/GHSA-vpvv-6p83-mmw2/GHSA-vpvv-6p83-mmw2.json new file mode 100644 index 00000000000..1fc7a1f14fe --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-vpvv-6p83-mmw2/GHSA-vpvv-6p83-mmw2.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vpvv-6p83-mmw2", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-24984" + ], + "details": "Improper input validation for some Intel(R) Wireless Bluetooth(R) products for Windows before version 23.40 may allow an unauthenticated user to potentially enable denial of service via adjacent access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24984" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01108.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vrg8-9w2w-pvxg/GHSA-vrg8-9w2w-pvxg.json b/advisories/unreviewed/2024/11/GHSA-vrg8-9w2w-pvxg/GHSA-vrg8-9w2w-pvxg.json new file mode 100644 index 00000000000..e40a51df1ca --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-vrg8-9w2w-pvxg/GHSA-vrg8-9w2w-pvxg.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vrg8-9w2w-pvxg", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-28051" + ], + "details": "Out-of-bounds read in some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable information disclosure via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28051" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01131.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vrw9-92xm-fch7/GHSA-vrw9-92xm-fch7.json b/advisories/unreviewed/2024/11/GHSA-vrw9-92xm-fch7/GHSA-vrw9-92xm-fch7.json new file mode 100644 index 00000000000..4d5795107db --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-vrw9-92xm-fch7/GHSA-vrw9-92xm-fch7.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vrw9-92xm-fch7", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-34167" + ], + "details": "Uncontrolled search path for the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34167" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01183.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w436-2x44-fv33/GHSA-w436-2x44-fv33.json b/advisories/unreviewed/2024/11/GHSA-w436-2x44-fv33/GHSA-w436-2x44-fv33.json new file mode 100644 index 00000000000..7bfcb282510 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w436-2x44-fv33/GHSA-w436-2x44-fv33.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w436-2x44-fv33", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-39609" + ], + "details": "Improper Access Control in UEFI firmware for some Intel(R) Server Board M70KLP may allow a privileged user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39609" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01175.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:27Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w46m-w25c-wx2r/GHSA-w46m-w25c-wx2r.json b/advisories/unreviewed/2024/11/GHSA-w46m-w25c-wx2r/GHSA-w46m-w25c-wx2r.json index ce439d0ef09..fe01ba2e07b 100644 --- a/advisories/unreviewed/2024/11/GHSA-w46m-w25c-wx2r/GHSA-w46m-w25c-wx2r.json +++ b/advisories/unreviewed/2024/11/GHSA-w46m-w25c-wx2r/GHSA-w46m-w25c-wx2r.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-88" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-w73v-97q9-6vfp/GHSA-w73v-97q9-6vfp.json b/advisories/unreviewed/2024/11/GHSA-w73v-97q9-6vfp/GHSA-w73v-97q9-6vfp.json new file mode 100644 index 00000000000..0c34be73a41 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w73v-97q9-6vfp/GHSA-w73v-97q9-6vfp.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w73v-97q9-6vfp", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-36282" + ], + "details": "Improper input validation in the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions may allow a privileged user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36282" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01183.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w8mp-53m7-xcpv/GHSA-w8mp-53m7-xcpv.json b/advisories/unreviewed/2024/11/GHSA-w8mp-53m7-xcpv/GHSA-w8mp-53m7-xcpv.json new file mode 100644 index 00000000000..1e6be7e6766 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w8mp-53m7-xcpv/GHSA-w8mp-53m7-xcpv.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w8mp-53m7-xcpv", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-36482" + ], + "details": "Improper input validation in some Intel(R) CIP software before version 2.4.10852 may allow a privileged user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36482" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01182.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w962-c32f-386m/GHSA-w962-c32f-386m.json b/advisories/unreviewed/2024/11/GHSA-w962-c32f-386m/GHSA-w962-c32f-386m.json new file mode 100644 index 00000000000..bc30a7527a6 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w962-c32f-386m/GHSA-w962-c32f-386m.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w962-c32f-386m", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-28028" + ], + "details": "Improper input validation in some Intel(R) Neural Compressor software before version v3.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28028" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01219.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-wfrh-gq5h-5225/GHSA-wfrh-gq5h-5225.json b/advisories/unreviewed/2024/11/GHSA-wfrh-gq5h-5225/GHSA-wfrh-gq5h-5225.json index 8155a1da3c6..bd2a7ef0e72 100644 --- a/advisories/unreviewed/2024/11/GHSA-wfrh-gq5h-5225/GHSA-wfrh-gq5h-5225.json +++ b/advisories/unreviewed/2024/11/GHSA-wfrh-gq5h-5225/GHSA-wfrh-gq5h-5225.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-88" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-wpcc-2qm5-qrcg/GHSA-wpcc-2qm5-qrcg.json b/advisories/unreviewed/2024/11/GHSA-wpcc-2qm5-qrcg/GHSA-wpcc-2qm5-qrcg.json new file mode 100644 index 00000000000..7009eee313c --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-wpcc-2qm5-qrcg/GHSA-wpcc-2qm5-qrcg.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wpcc-2qm5-qrcg", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-28049" + ], + "details": "Improper input validation in firmware for some Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi wireless products before version 23.40 may allow an unauthenticated user to enable denial of service via adjacent access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28049" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01108.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-wr5g-3v8j-6j7j/GHSA-wr5g-3v8j-6j7j.json b/advisories/unreviewed/2024/11/GHSA-wr5g-3v8j-6j7j/GHSA-wr5g-3v8j-6j7j.json new file mode 100644 index 00000000000..5bd6c665fd5 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-wr5g-3v8j-6j7j/GHSA-wr5g-3v8j-6j7j.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wr5g-3v8j-6j7j", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-24985" + ], + "details": "Exposure of resource to wrong sphere in some Intel(R) processors with Intel(R) ACTM may allow a privileged user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24985" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01111.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-668" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-wv8j-c43j-422r/GHSA-wv8j-c43j-422r.json b/advisories/unreviewed/2024/11/GHSA-wv8j-c43j-422r/GHSA-wv8j-c43j-422r.json new file mode 100644 index 00000000000..f45fb1e4ce7 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-wv8j-c43j-422r/GHSA-wv8j-c43j-422r.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wv8j-c43j-422r", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-32667" + ], + "details": "Out-of-bounds read for some OpenCL(TM) software may allow an authenticated user to potentially enable denial of service via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32667" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01163.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-wv8w-2qgf-xxfj/GHSA-wv8w-2qgf-xxfj.json b/advisories/unreviewed/2024/11/GHSA-wv8w-2qgf-xxfj/GHSA-wv8w-2qgf-xxfj.json index 4918b65bdd7..59dd54eb19d 100644 --- a/advisories/unreviewed/2024/11/GHSA-wv8w-2qgf-xxfj/GHSA-wv8w-2qgf-xxfj.json +++ b/advisories/unreviewed/2024/11/GHSA-wv8w-2qgf-xxfj/GHSA-wv8w-2qgf-xxfj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-wv8w-2qgf-xxfj", - "modified": "2024-11-09T12:30:48Z", + "modified": "2024-11-13T21:30:32Z", "published": "2024-11-09T12:30:48Z", "aliases": [ "CVE-2024-50225" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix error propagation of split bios\n\nThe purpose of btrfs_bbio_propagate_error() shall be propagating an error\nof split bio to its original btrfs_bio, and tell the error to the upper\nlayer. However, it's not working well on some cases.\n\n* Case 1. Immediate (or quick) end_bio with an error\n\nWhen btrfs sends btrfs_bio to mirrored devices, btrfs calls\nbtrfs_bio_end_io() when all the mirroring bios are completed. If that\nbtrfs_bio was split, it is from btrfs_clone_bioset and its end_io function\nis btrfs_orig_write_end_io. For this case, btrfs_bbio_propagate_error()\naccesses the orig_bbio's bio context to increase the error count.\n\nThat works well in most cases. However, if the end_io is called enough\nfast, orig_bbio's (remaining part after split) bio context may not be\nproperly set at that time. Since the bio context is set when the orig_bbio\n(the last btrfs_bio) is sent to devices, that might be too late for earlier\nsplit btrfs_bio's completion. That will result in NULL pointer\ndereference.\n\nThat bug is easily reproducible by running btrfs/146 on zoned devices [1]\nand it shows the following trace.\n\n[1] You need raid-stripe-tree feature as it create \"-d raid0 -m raid1\" FS.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000020\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] PREEMPT SMP PTI\n CPU: 1 UID: 0 PID: 13 Comm: kworker/u32:1 Not tainted 6.11.0-rc7-BTRFS-ZNS+ #474\n Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n Workqueue: writeback wb_workfn (flush-btrfs-5)\n RIP: 0010:btrfs_bio_end_io+0xae/0xc0 [btrfs]\n BTRFS error (device dm-0): bdev /dev/mapper/error-test errs: wr 2, rd 0, flush 0, corrupt 0, gen 0\n RSP: 0018:ffffc9000006f248 EFLAGS: 00010246\n RAX: 0000000000000000 RBX: ffff888005a7f080 RCX: ffffc9000006f1dc\n RDX: 0000000000000000 RSI: 000000000000000a RDI: ffff888005a7f080\n RBP: ffff888011dfc540 R08: 0000000000000000 R09: 0000000000000001\n R10: ffffffff82e508e0 R11: 0000000000000005 R12: ffff88800ddfbe58\n R13: ffff888005a7f080 R14: ffff888005a7f158 R15: ffff888005a7f158\n FS: 0000000000000000(0000) GS:ffff88803ea80000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000000000020 CR3: 0000000002e22006 CR4: 0000000000370ef0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n \n ? __die_body.cold+0x19/0x26\n ? page_fault_oops+0x13e/0x2b0\n ? _printk+0x58/0x73\n ? do_user_addr_fault+0x5f/0x750\n ? exc_page_fault+0x76/0x240\n ? asm_exc_page_fault+0x22/0x30\n ? btrfs_bio_end_io+0xae/0xc0 [btrfs]\n ? btrfs_log_dev_io_error+0x7f/0x90 [btrfs]\n btrfs_orig_write_end_io+0x51/0x90 [btrfs]\n dm_submit_bio+0x5c2/0xa50 [dm_mod]\n ? find_held_lock+0x2b/0x80\n ? blk_try_enter_queue+0x90/0x1e0\n __submit_bio+0xe0/0x130\n ? ktime_get+0x10a/0x160\n ? lockdep_hardirqs_on+0x74/0x100\n submit_bio_noacct_nocheck+0x199/0x410\n btrfs_submit_bio+0x7d/0x150 [btrfs]\n btrfs_submit_chunk+0x1a1/0x6d0 [btrfs]\n ? lockdep_hardirqs_on+0x74/0x100\n ? __folio_start_writeback+0x10/0x2c0\n btrfs_submit_bbio+0x1c/0x40 [btrfs]\n submit_one_bio+0x44/0x60 [btrfs]\n submit_extent_folio+0x13f/0x330 [btrfs]\n ? btrfs_set_range_writeback+0xa3/0xd0 [btrfs]\n extent_writepage_io+0x18b/0x360 [btrfs]\n extent_write_locked_range+0x17c/0x340 [btrfs]\n ? __pfx_end_bbio_data_write+0x10/0x10 [btrfs]\n run_delalloc_cow+0x71/0xd0 [btrfs]\n btrfs_run_delalloc_range+0x176/0x500 [btrfs]\n ? find_lock_delalloc_range+0x119/0x260 [btrfs]\n writepage_delalloc+0x2ab/0x480 [btrfs]\n extent_write_cache_pages+0x236/0x7d0 [btrfs]\n btrfs_writepages+0x72/0x130 [btrfs]\n do_writepages+0xd4/0x240\n ? find_held_lock+0x2b/0x80\n ? wbc_attach_and_unlock_inode+0x12c/0x290\n ? wbc_attach_and_unlock_inode+0x12c/0x29\n---truncated---", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-09T11:15:07Z" diff --git a/advisories/unreviewed/2024/11/GHSA-wvr7-6c53-gjjg/GHSA-wvr7-6c53-gjjg.json b/advisories/unreviewed/2024/11/GHSA-wvr7-6c53-gjjg/GHSA-wvr7-6c53-gjjg.json new file mode 100644 index 00000000000..c1eb0cb03e9 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-wvr7-6c53-gjjg/GHSA-wvr7-6c53-gjjg.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wvr7-6c53-gjjg", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-23919" + ], + "details": "Improper buffer restrictions in some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23919" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01132.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-ww8x-g5fj-6wpj/GHSA-ww8x-g5fj-6wpj.json b/advisories/unreviewed/2024/11/GHSA-ww8x-g5fj-6wpj/GHSA-ww8x-g5fj-6wpj.json new file mode 100644 index 00000000000..930f695842d --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-ww8x-g5fj-6wpj/GHSA-ww8x-g5fj-6wpj.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ww8x-g5fj-6wpj", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-36294" + ], + "details": "Insecure inherited permissions for some Intel(R) DSA software before version 24.3.26.8 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36294" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01200.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-277" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-x3rw-xr73-fq7h/GHSA-x3rw-xr73-fq7h.json b/advisories/unreviewed/2024/11/GHSA-x3rw-xr73-fq7h/GHSA-x3rw-xr73-fq7h.json new file mode 100644 index 00000000000..15abc82c241 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-x3rw-xr73-fq7h/GHSA-x3rw-xr73-fq7h.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x3rw-xr73-fq7h", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-36276" + ], + "details": "Insecure inherited permissions for some Intel(R) CIP software before version 2.4.10852 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36276" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01182.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-277" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-x4h3-pqgr-cw5f/GHSA-x4h3-pqgr-cw5f.json b/advisories/unreviewed/2024/11/GHSA-x4h3-pqgr-cw5f/GHSA-x4h3-pqgr-cw5f.json index 50c3ae7af25..6d0973b97b8 100644 --- a/advisories/unreviewed/2024/11/GHSA-x4h3-pqgr-cw5f/GHSA-x4h3-pqgr-cw5f.json +++ b/advisories/unreviewed/2024/11/GHSA-x4h3-pqgr-cw5f/GHSA-x4h3-pqgr-cw5f.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-x4h3-pqgr-cw5f", - "modified": "2024-11-09T12:30:48Z", + "modified": "2024-11-13T21:30:32Z", "published": "2024-11-09T12:30:48Z", "aliases": [ "CVE-2024-50223" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsched/numa: Fix the potential null pointer dereference in task_numa_work()\n\nWhen running stress-ng-vm-segv test, we found a null pointer dereference\nerror in task_numa_work(). Here is the backtrace:\n\n [323676.066985] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020\n ......\n [323676.067108] CPU: 35 PID: 2694524 Comm: stress-ng-vm-se\n ......\n [323676.067113] pstate: 23401009 (nzCv daif +PAN -UAO +TCO +DIT +SSBS BTYPE=--)\n [323676.067115] pc : vma_migratable+0x1c/0xd0\n [323676.067122] lr : task_numa_work+0x1ec/0x4e0\n [323676.067127] sp : ffff8000ada73d20\n [323676.067128] x29: ffff8000ada73d20 x28: 0000000000000000 x27: 000000003e89f010\n [323676.067130] x26: 0000000000080000 x25: ffff800081b5c0d8 x24: ffff800081b27000\n [323676.067133] x23: 0000000000010000 x22: 0000000104d18cc0 x21: ffff0009f7158000\n [323676.067135] x20: 0000000000000000 x19: 0000000000000000 x18: ffff8000ada73db8\n [323676.067138] x17: 0001400000000000 x16: ffff800080df40b0 x15: 0000000000000035\n [323676.067140] x14: ffff8000ada73cc8 x13: 1fffe0017cc72001 x12: ffff8000ada73cc8\n [323676.067142] x11: ffff80008001160c x10: ffff000be639000c x9 : ffff8000800f4ba4\n [323676.067145] x8 : ffff000810375000 x7 : ffff8000ada73974 x6 : 0000000000000001\n [323676.067147] x5 : 0068000b33e26707 x4 : 0000000000000001 x3 : ffff0009f7158000\n [323676.067149] x2 : 0000000000000041 x1 : 0000000000004400 x0 : 0000000000000000\n [323676.067152] Call trace:\n [323676.067153] vma_migratable+0x1c/0xd0\n [323676.067155] task_numa_work+0x1ec/0x4e0\n [323676.067157] task_work_run+0x78/0xd8\n [323676.067161] do_notify_resume+0x1ec/0x290\n [323676.067163] el0_svc+0x150/0x160\n [323676.067167] el0t_64_sync_handler+0xf8/0x128\n [323676.067170] el0t_64_sync+0x17c/0x180\n [323676.067173] Code: d2888001 910003fd f9000bf3 aa0003f3 (f9401000)\n [323676.067177] SMP: stopping secondary CPUs\n [323676.070184] Starting crashdump kernel...\n\nstress-ng-vm-segv in stress-ng is used to stress test the SIGSEGV error\nhandling function of the system, which tries to cause a SIGSEGV error on\nreturn from unmapping the whole address space of the child process.\n\nNormally this program will not cause kernel crashes. But before the\nmunmap system call returns to user mode, a potential task_numa_work()\nfor numa balancing could be added and executed. In this scenario, since the\nchild process has no vma after munmap, the vma_next() in task_numa_work()\nwill return a null pointer even if the vma iterator restarts from 0.\n\nRecheck the vma pointer before dereferencing it in task_numa_work().", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-09T11:15:07Z" diff --git a/advisories/unreviewed/2024/11/GHSA-x5gx-hgg2-539h/GHSA-x5gx-hgg2-539h.json b/advisories/unreviewed/2024/11/GHSA-x5gx-hgg2-539h/GHSA-x5gx-hgg2-539h.json new file mode 100644 index 00000000000..e42b7867521 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-x5gx-hgg2-539h/GHSA-x5gx-hgg2-539h.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x5gx-hgg2-539h", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-28950" + ], + "details": "Uncontrolled search path for some Intel(R) oneAPI Math Kernel Library software for Windows before version 2024.2 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28950" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01155.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-x769-q69g-2jw4/GHSA-x769-q69g-2jw4.json b/advisories/unreviewed/2024/11/GHSA-x769-q69g-2jw4/GHSA-x769-q69g-2jw4.json new file mode 100644 index 00000000000..31368b80b39 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-x769-q69g-2jw4/GHSA-x769-q69g-2jw4.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x769-q69g-2jw4", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-34170" + ], + "details": "Improper buffer restrictions in some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34170" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01132.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-xf5m-j333-gw96/GHSA-xf5m-j333-gw96.json b/advisories/unreviewed/2024/11/GHSA-xf5m-j333-gw96/GHSA-xf5m-j333-gw96.json new file mode 100644 index 00000000000..3cbbfe3adee --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-xf5m-j333-gw96/GHSA-xf5m-j333-gw96.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xf5m-j333-gw96", + "modified": "2024-11-13T21:30:38Z", + "published": "2024-11-13T21:30:38Z", + "aliases": [ + "CVE-2024-36488" + ], + "details": "Improper Access Control in some Intel(R) DSA before version 24.3.26.8 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36488" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01200.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-xgmg-hrgx-6gqq/GHSA-xgmg-hrgx-6gqq.json b/advisories/unreviewed/2024/11/GHSA-xgmg-hrgx-6gqq/GHSA-xgmg-hrgx-6gqq.json index caa137313e0..736f96c9548 100644 --- a/advisories/unreviewed/2024/11/GHSA-xgmg-hrgx-6gqq/GHSA-xgmg-hrgx-6gqq.json +++ b/advisories/unreviewed/2024/11/GHSA-xgmg-hrgx-6gqq/GHSA-xgmg-hrgx-6gqq.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-xgmg-hrgx-6gqq", - "modified": "2024-11-09T12:30:48Z", + "modified": "2024-11-13T21:30:32Z", "published": "2024-11-09T12:30:48Z", "aliases": [ "CVE-2024-50224" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-fsl-dspi: Fix crash when not using GPIO chip select\n\nAdd check for the return value of spi_get_csgpiod() to avoid passing a NULL\npointer to gpiod_direction_output(), preventing a crash when GPIO chip\nselect is not used.\n\nFix below crash:\n[ 4.251960] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[ 4.260762] Mem abort info:\n[ 4.263556] ESR = 0x0000000096000004\n[ 4.267308] EC = 0x25: DABT (current EL), IL = 32 bits\n[ 4.272624] SET = 0, FnV = 0\n[ 4.275681] EA = 0, S1PTW = 0\n[ 4.278822] FSC = 0x04: level 0 translation fault\n[ 4.283704] Data abort info:\n[ 4.286583] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000\n[ 4.292074] CM = 0, WnR = 0, TnD = 0, TagAccess = 0\n[ 4.297130] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0\n[ 4.302445] [0000000000000000] user address but active_mm is swapper\n[ 4.308805] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP\n[ 4.315072] Modules linked in:\n[ 4.318124] CPU: 2 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-rc4-next-20241023-00008-ga20ec42c5fc1 #359\n[ 4.328130] Hardware name: LS1046A QDS Board (DT)\n[ 4.332832] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ 4.339794] pc : gpiod_direction_output+0x34/0x5c\n[ 4.344505] lr : gpiod_direction_output+0x18/0x5c\n[ 4.349208] sp : ffff80008003b8f0\n[ 4.352517] x29: ffff80008003b8f0 x28: 0000000000000000 x27: ffffc96bcc7e9068\n[ 4.359659] x26: ffffc96bcc6e00b0 x25: ffffc96bcc598398 x24: ffff447400132810\n[ 4.366800] x23: 0000000000000000 x22: 0000000011e1a300 x21: 0000000000020002\n[ 4.373940] x20: 0000000000000000 x19: 0000000000000000 x18: ffffffffffffffff\n[ 4.381081] x17: ffff44740016e600 x16: 0000000500000003 x15: 0000000000000007\n[ 4.388221] x14: 0000000000989680 x13: 0000000000020000 x12: 000000000000001e\n[ 4.395362] x11: 0044b82fa09b5a53 x10: 0000000000000019 x9 : 0000000000000008\n[ 4.402502] x8 : 0000000000000002 x7 : 0000000000000007 x6 : 0000000000000000\n[ 4.409641] x5 : 0000000000000200 x4 : 0000000002000000 x3 : 0000000000000000\n[ 4.416781] x2 : 0000000000022202 x1 : 0000000000000000 x0 : 0000000000000000\n[ 4.423921] Call trace:\n[ 4.426362] gpiod_direction_output+0x34/0x5c (P)\n[ 4.431067] gpiod_direction_output+0x18/0x5c (L)\n[ 4.435771] dspi_setup+0x220/0x334", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-09T11:15:07Z" diff --git a/advisories/unreviewed/2024/11/GHSA-xhgh-m73w-g9xm/GHSA-xhgh-m73w-g9xm.json b/advisories/unreviewed/2024/11/GHSA-xhgh-m73w-g9xm/GHSA-xhgh-m73w-g9xm.json new file mode 100644 index 00000000000..3dca7600671 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-xhgh-m73w-g9xm/GHSA-xhgh-m73w-g9xm.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xhgh-m73w-g9xm", + "modified": "2024-11-13T21:30:36Z", + "published": "2024-11-13T21:30:36Z", + "aliases": [ + "CVE-2024-32044" + ], + "details": "Improper access control for some Intel(R) Arc(TM) Pro Graphics for Windows drivers before version 31.0.101.5319 may allow an authenticated user to potentially enable escalation of privilege via adjacent access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32044" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01163.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-xp95-8cxx-xfmw/GHSA-xp95-8cxx-xfmw.json b/advisories/unreviewed/2024/11/GHSA-xp95-8cxx-xfmw/GHSA-xp95-8cxx-xfmw.json new file mode 100644 index 00000000000..8218f465ceb --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-xp95-8cxx-xfmw/GHSA-xp95-8cxx-xfmw.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xp95-8cxx-xfmw", + "modified": "2024-11-13T21:30:34Z", + "published": "2024-11-13T21:30:34Z", + "aliases": [ + "CVE-2024-21799" + ], + "details": "Path traversal for some Intel(R) Extension for Transformers software before version 1.5 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21799" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01190.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-xpp8-xxjx-cr2h/GHSA-xpp8-xxjx-cr2h.json b/advisories/unreviewed/2024/11/GHSA-xpp8-xxjx-cr2h/GHSA-xpp8-xxjx-cr2h.json new file mode 100644 index 00000000000..83c425f68ae --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-xpp8-xxjx-cr2h/GHSA-xpp8-xxjx-cr2h.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xpp8-xxjx-cr2h", + "modified": "2024-11-13T21:30:37Z", + "published": "2024-11-13T21:30:37Z", + "aliases": [ + "CVE-2024-34022" + ], + "details": "Improper Access Control in some Thunderbolt(TM) Share software before version 1.0.49.9 may allow an authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34022" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01204.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-xr2f-69jg-7g6f/GHSA-xr2f-69jg-7g6f.json b/advisories/unreviewed/2024/11/GHSA-xr2f-69jg-7g6f/GHSA-xr2f-69jg-7g6f.json new file mode 100644 index 00000000000..9b8d29fbaee --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-xr2f-69jg-7g6f/GHSA-xr2f-69jg-7g6f.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xr2f-69jg-7g6f", + "modified": "2024-11-13T21:30:35Z", + "published": "2024-11-13T21:30:35Z", + "aliases": [ + "CVE-2024-27200" + ], + "details": "Improper access control in some Intel(R) Granulate(TM) software before version 4.30.1 may allow a authenticated user to potentially enable escalation of privilege via local access.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27200" + }, + { + "type": "WEB", + "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01145.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T21:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-xx28-hqvc-mm7j/GHSA-xx28-hqvc-mm7j.json b/advisories/unreviewed/2024/11/GHSA-xx28-hqvc-mm7j/GHSA-xx28-hqvc-mm7j.json new file mode 100644 index 00000000000..a5d45a3b7e7 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-xx28-hqvc-mm7j/GHSA-xx28-hqvc-mm7j.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xx28-hqvc-mm7j", + "modified": "2024-11-13T21:30:34Z", + "published": "2024-11-13T21:30:34Z", + "aliases": [ + "CVE-2023-38920" + ], + "details": "Cross Site Scripting vulnerability in Cyber Cafe Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted script to the adminname parameter.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38920" + }, + { + "type": "WEB", + "url": "https://github.com/amanahmed000/Cyber-Cafe-Management-System-XSS-Advisory/blob/main/CVE-2023-38920.md" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-13T20:15:16Z" + } +} \ No newline at end of file