From 8b4b614543922170106b13facbb757bc90b6ca64 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 5 Dec 2024 21:33:16 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-rc36-f2pm-xcjg.json | 9 +++- .../GHSA-3v2h-jhg6-jj7v.json | 11 +++-- .../GHSA-9rfw-9cwj-2c6f.json | 4 +- .../GHSA-g7c7-4h8w-p4x9.json | 15 +++++-- .../GHSA-76jf-phxv-6m5c.json | 13 +++--- .../GHSA-jv2q-4725-898c.json | 11 +++-- .../GHSA-v72q-pr3v-f552.json | 11 +++-- .../GHSA-w893-jhmx-r3gr.json | 15 +++++-- .../GHSA-xc4j-5g39-hrv5.json | 15 +++++-- .../GHSA-wvrv-rpq3-gjq6.json | 6 +-- .../GHSA-g95v-qwj3-qrc2.json | 15 +++++-- .../GHSA-27r4-945x-jq67.json | 4 +- .../GHSA-4w2f-m236-fggc.json | 4 +- .../GHSA-h9fh-gm4r-6cxh.json | 2 +- .../GHSA-35r4-377q-pc5v.json | 4 +- .../GHSA-4x6p-mgm4-pgfq.json | 15 +++++-- .../GHSA-63g3-m4j7-2vpw.json | 11 +++-- .../GHSA-6hcg-vqw2-35jw.json | 33 ++++++++++++++ .../GHSA-6pwm-f65f-3g86.json | 44 +++++++++++++++++++ .../GHSA-6xw3-v997-r9fc.json | 44 +++++++++++++++++++ .../GHSA-79r7-f3jp-52j9.json | 33 ++++++++++++++ .../GHSA-7qwr-5g4p-5495.json | 33 ++++++++++++++ .../GHSA-7vhq-gphw-vgj2.json | 11 +++-- .../GHSA-84hg-pv4v-g5m7.json | 33 ++++++++++++++ .../GHSA-j4cx-gm46-j4hg.json | 15 +++++-- .../GHSA-j4j6-mjqg-x2j7.json | 15 +++++-- .../GHSA-jq9m-23hf-jgfg.json | 15 +++++-- .../GHSA-m97p-7pjw-xw7r.json | 15 +++++-- .../GHSA-p353-cp93-hvp7.json | 11 +++-- .../GHSA-ph9m-4f8h-q2f7.json | 33 ++++++++++++++ .../GHSA-vjgw-3ffm-c33h.json | 15 +++++-- .../GHSA-wqvc-3mg4-x25w.json | 33 ++++++++++++++ .../GHSA-x8p8-5wfj-x896.json | 11 +++-- 33 files changed, 481 insertions(+), 78 deletions(-) create mode 100644 advisories/unreviewed/2024/12/GHSA-6hcg-vqw2-35jw/GHSA-6hcg-vqw2-35jw.json create mode 100644 advisories/unreviewed/2024/12/GHSA-6pwm-f65f-3g86/GHSA-6pwm-f65f-3g86.json create mode 100644 advisories/unreviewed/2024/12/GHSA-6xw3-v997-r9fc/GHSA-6xw3-v997-r9fc.json create mode 100644 advisories/unreviewed/2024/12/GHSA-79r7-f3jp-52j9/GHSA-79r7-f3jp-52j9.json create mode 100644 advisories/unreviewed/2024/12/GHSA-7qwr-5g4p-5495/GHSA-7qwr-5g4p-5495.json create mode 100644 advisories/unreviewed/2024/12/GHSA-84hg-pv4v-g5m7/GHSA-84hg-pv4v-g5m7.json create mode 100644 advisories/unreviewed/2024/12/GHSA-ph9m-4f8h-q2f7/GHSA-ph9m-4f8h-q2f7.json create mode 100644 advisories/unreviewed/2024/12/GHSA-wqvc-3mg4-x25w/GHSA-wqvc-3mg4-x25w.json diff --git a/advisories/unreviewed/2022/05/GHSA-rc36-f2pm-xcjg/GHSA-rc36-f2pm-xcjg.json b/advisories/unreviewed/2022/05/GHSA-rc36-f2pm-xcjg/GHSA-rc36-f2pm-xcjg.json index 76f720c437f..611468eb027 100644 --- a/advisories/unreviewed/2022/05/GHSA-rc36-f2pm-xcjg/GHSA-rc36-f2pm-xcjg.json +++ b/advisories/unreviewed/2022/05/GHSA-rc36-f2pm-xcjg/GHSA-rc36-f2pm-xcjg.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-rc36-f2pm-xcjg", - "modified": "2022-05-01T02:15:18Z", + "modified": "2024-12-05T21:31:50Z", "published": "2022-05-01T02:15:18Z", "aliases": [ "CVE-2005-3170" ], "details": "The LDAP client on Microsoft Windows 2000 before Update Rollup 1 for SP4 accepts certificates using LDAP Secure Sockets Layer (LDAPS) even when the Certificate Authority (CA) is not trusted, which could allow attackers to trick users into believing that they are accessing a trusted site.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L" + } + ], "affected": [], "references": [ { diff --git a/advisories/unreviewed/2024/02/GHSA-3v2h-jhg6-jj7v/GHSA-3v2h-jhg6-jj7v.json b/advisories/unreviewed/2024/02/GHSA-3v2h-jhg6-jj7v/GHSA-3v2h-jhg6-jj7v.json index 40f8b809f19..041c1980c0a 100644 --- a/advisories/unreviewed/2024/02/GHSA-3v2h-jhg6-jj7v/GHSA-3v2h-jhg6-jj7v.json +++ b/advisories/unreviewed/2024/02/GHSA-3v2h-jhg6-jj7v/GHSA-3v2h-jhg6-jj7v.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-3v2h-jhg6-jj7v", - "modified": "2024-02-21T09:31:01Z", + "modified": "2024-12-05T21:31:51Z", "published": "2024-02-21T09:31:01Z", "aliases": [ "CVE-2023-42952" ], "details": "The issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.3, macOS Sonoma 14.1, macOS Monterey 12.7.1. An app with root privileges may be able to access private information.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N" + } + ], "affected": [], "references": [ { @@ -33,7 +38,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-21T07:15:51Z" diff --git a/advisories/unreviewed/2024/02/GHSA-9rfw-9cwj-2c6f/GHSA-9rfw-9cwj-2c6f.json b/advisories/unreviewed/2024/02/GHSA-9rfw-9cwj-2c6f/GHSA-9rfw-9cwj-2c6f.json index a71f822aa3d..990802801c8 100644 --- a/advisories/unreviewed/2024/02/GHSA-9rfw-9cwj-2c6f/GHSA-9rfw-9cwj-2c6f.json +++ b/advisories/unreviewed/2024/02/GHSA-9rfw-9cwj-2c6f/GHSA-9rfw-9cwj-2c6f.json @@ -37,7 +37,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-276" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/02/GHSA-g7c7-4h8w-p4x9/GHSA-g7c7-4h8w-p4x9.json b/advisories/unreviewed/2024/02/GHSA-g7c7-4h8w-p4x9/GHSA-g7c7-4h8w-p4x9.json index d5a8ad1ee60..6a73b8de2f6 100644 --- a/advisories/unreviewed/2024/02/GHSA-g7c7-4h8w-p4x9/GHSA-g7c7-4h8w-p4x9.json +++ b/advisories/unreviewed/2024/02/GHSA-g7c7-4h8w-p4x9/GHSA-g7c7-4h8w-p4x9.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-g7c7-4h8w-p4x9", - "modified": "2024-02-18T03:30:24Z", + "modified": "2024-12-05T21:31:51Z", "published": "2024-02-18T03:30:24Z", "aliases": [ "CVE-2023-52357" ], "details": "Vulnerability of serialization/deserialization mismatch in the vibration framework.Successful exploitation of this vulnerability may affect availability.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-502" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-18T03:15:08Z" diff --git a/advisories/unreviewed/2024/03/GHSA-76jf-phxv-6m5c/GHSA-76jf-phxv-6m5c.json b/advisories/unreviewed/2024/03/GHSA-76jf-phxv-6m5c/GHSA-76jf-phxv-6m5c.json index 55d9fa119e6..10b8ff49ed4 100644 --- a/advisories/unreviewed/2024/03/GHSA-76jf-phxv-6m5c/GHSA-76jf-phxv-6m5c.json +++ b/advisories/unreviewed/2024/03/GHSA-76jf-phxv-6m5c/GHSA-76jf-phxv-6m5c.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-76jf-phxv-6m5c", - "modified": "2024-03-20T15:32:32Z", + "modified": "2024-12-05T21:31:51Z", "published": "2024-03-20T15:32:32Z", "aliases": [ "CVE-2024-22085" ], "details": "An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. The shadow file is world readable.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -27,7 +28,7 @@ "cwe_ids": [ "CWE-276" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-20T05:15:45Z" diff --git a/advisories/unreviewed/2024/03/GHSA-jv2q-4725-898c/GHSA-jv2q-4725-898c.json b/advisories/unreviewed/2024/03/GHSA-jv2q-4725-898c/GHSA-jv2q-4725-898c.json index 92368309cce..b426c9da581 100644 --- a/advisories/unreviewed/2024/03/GHSA-jv2q-4725-898c/GHSA-jv2q-4725-898c.json +++ b/advisories/unreviewed/2024/03/GHSA-jv2q-4725-898c/GHSA-jv2q-4725-898c.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-jv2q-4725-898c", - "modified": "2024-03-13T21:31:01Z", + "modified": "2024-12-05T21:31:51Z", "published": "2024-03-08T03:31:24Z", "aliases": [ "CVE-2024-23232" ], "details": "A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.4. An app may be able to capture a user's screen.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" + } + ], "affected": [], "references": [ { @@ -25,7 +30,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-08T02:15:47Z" diff --git a/advisories/unreviewed/2024/03/GHSA-v72q-pr3v-f552/GHSA-v72q-pr3v-f552.json b/advisories/unreviewed/2024/03/GHSA-v72q-pr3v-f552/GHSA-v72q-pr3v-f552.json index a9326d1d494..d2210b66757 100644 --- a/advisories/unreviewed/2024/03/GHSA-v72q-pr3v-f552/GHSA-v72q-pr3v-f552.json +++ b/advisories/unreviewed/2024/03/GHSA-v72q-pr3v-f552/GHSA-v72q-pr3v-f552.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-v72q-pr3v-f552", - "modified": "2024-03-13T21:31:01Z", + "modified": "2024-12-05T21:31:51Z", "published": "2024-03-08T03:31:24Z", "aliases": [ "CVE-2024-23233" ], "details": "This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.4. Entitlements and privacy permissions granted to this app may be used by a malicious app.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -25,7 +30,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-08T02:15:47Z" diff --git a/advisories/unreviewed/2024/03/GHSA-w893-jhmx-r3gr/GHSA-w893-jhmx-r3gr.json b/advisories/unreviewed/2024/03/GHSA-w893-jhmx-r3gr/GHSA-w893-jhmx-r3gr.json index 56865375c44..819c305a340 100644 --- a/advisories/unreviewed/2024/03/GHSA-w893-jhmx-r3gr/GHSA-w893-jhmx-r3gr.json +++ b/advisories/unreviewed/2024/03/GHSA-w893-jhmx-r3gr/GHSA-w893-jhmx-r3gr.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-w893-jhmx-r3gr", - "modified": "2024-03-07T03:30:40Z", + "modified": "2024-12-05T21:31:51Z", "published": "2024-03-07T03:30:40Z", "aliases": [ "CVE-2023-49987" ], "details": "A cross-site scripting (XSS) vulnerability in the component /management/term of School Fees Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tname parameter.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-07T01:15:51Z" diff --git a/advisories/unreviewed/2024/04/GHSA-xc4j-5g39-hrv5/GHSA-xc4j-5g39-hrv5.json b/advisories/unreviewed/2024/04/GHSA-xc4j-5g39-hrv5/GHSA-xc4j-5g39-hrv5.json index 758a5298fac..45ca2769250 100644 --- a/advisories/unreviewed/2024/04/GHSA-xc4j-5g39-hrv5/GHSA-xc4j-5g39-hrv5.json +++ b/advisories/unreviewed/2024/04/GHSA-xc4j-5g39-hrv5/GHSA-xc4j-5g39-hrv5.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-xc4j-5g39-hrv5", - "modified": "2024-04-11T21:30:50Z", + "modified": "2024-12-05T21:31:51Z", "published": "2024-04-11T21:30:50Z", "aliases": [ "CVE-2024-22717" ], "details": "Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the First Name field in the application.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-11T20:15:33Z" diff --git a/advisories/unreviewed/2024/05/GHSA-wvrv-rpq3-gjq6/GHSA-wvrv-rpq3-gjq6.json b/advisories/unreviewed/2024/05/GHSA-wvrv-rpq3-gjq6/GHSA-wvrv-rpq3-gjq6.json index b446020e884..ba9c2d02eaf 100644 --- a/advisories/unreviewed/2024/05/GHSA-wvrv-rpq3-gjq6/GHSA-wvrv-rpq3-gjq6.json +++ b/advisories/unreviewed/2024/05/GHSA-wvrv-rpq3-gjq6/GHSA-wvrv-rpq3-gjq6.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -32,7 +30,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-565" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/07/GHSA-g95v-qwj3-qrc2/GHSA-g95v-qwj3-qrc2.json b/advisories/unreviewed/2024/07/GHSA-g95v-qwj3-qrc2/GHSA-g95v-qwj3-qrc2.json index d1bf2220056..a68940decdd 100644 --- a/advisories/unreviewed/2024/07/GHSA-g95v-qwj3-qrc2/GHSA-g95v-qwj3-qrc2.json +++ b/advisories/unreviewed/2024/07/GHSA-g95v-qwj3-qrc2/GHSA-g95v-qwj3-qrc2.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-g95v-qwj3-qrc2", - "modified": "2024-07-29T18:30:39Z", + "modified": "2024-12-05T21:31:51Z", "published": "2024-07-29T18:30:38Z", "aliases": [ "CVE-2024-41624" ], "details": "Incorrect access control in Himalaya Xiaoya nano smart speaker rom_version 1.6.96 allows a remote attacker to have an unspecified impact.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-29T16:15:04Z" diff --git a/advisories/unreviewed/2024/11/GHSA-27r4-945x-jq67/GHSA-27r4-945x-jq67.json b/advisories/unreviewed/2024/11/GHSA-27r4-945x-jq67/GHSA-27r4-945x-jq67.json index 8d280b827af..0c0e3ed2d2d 100644 --- a/advisories/unreviewed/2024/11/GHSA-27r4-945x-jq67/GHSA-27r4-945x-jq67.json +++ b/advisories/unreviewed/2024/11/GHSA-27r4-945x-jq67/GHSA-27r4-945x-jq67.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-770" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/11/GHSA-4w2f-m236-fggc/GHSA-4w2f-m236-fggc.json b/advisories/unreviewed/2024/11/GHSA-4w2f-m236-fggc/GHSA-4w2f-m236-fggc.json index 78776291ddf..9f86f1c4511 100644 --- a/advisories/unreviewed/2024/11/GHSA-4w2f-m236-fggc/GHSA-4w2f-m236-fggc.json +++ b/advisories/unreviewed/2024/11/GHSA-4w2f-m236-fggc/GHSA-4w2f-m236-fggc.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/11/GHSA-h9fh-gm4r-6cxh/GHSA-h9fh-gm4r-6cxh.json b/advisories/unreviewed/2024/11/GHSA-h9fh-gm4r-6cxh/GHSA-h9fh-gm4r-6cxh.json index 7f173c78e30..66f1c0872c8 100644 --- a/advisories/unreviewed/2024/11/GHSA-h9fh-gm4r-6cxh/GHSA-h9fh-gm4r-6cxh.json +++ b/advisories/unreviewed/2024/11/GHSA-h9fh-gm4r-6cxh/GHSA-h9fh-gm4r-6cxh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-h9fh-gm4r-6cxh", - "modified": "2024-11-28T06:32:41Z", + "modified": "2024-12-05T21:31:51Z", "published": "2024-11-27T12:31:53Z", "aliases": [ "CVE-2024-11667" diff --git a/advisories/unreviewed/2024/12/GHSA-35r4-377q-pc5v/GHSA-35r4-377q-pc5v.json b/advisories/unreviewed/2024/12/GHSA-35r4-377q-pc5v/GHSA-35r4-377q-pc5v.json index 044809db502..e93300563cb 100644 --- a/advisories/unreviewed/2024/12/GHSA-35r4-377q-pc5v/GHSA-35r4-377q-pc5v.json +++ b/advisories/unreviewed/2024/12/GHSA-35r4-377q-pc5v/GHSA-35r4-377q-pc5v.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-862" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/12/GHSA-4x6p-mgm4-pgfq/GHSA-4x6p-mgm4-pgfq.json b/advisories/unreviewed/2024/12/GHSA-4x6p-mgm4-pgfq/GHSA-4x6p-mgm4-pgfq.json index d2404d7bd4c..fe7f566efee 100644 --- a/advisories/unreviewed/2024/12/GHSA-4x6p-mgm4-pgfq/GHSA-4x6p-mgm4-pgfq.json +++ b/advisories/unreviewed/2024/12/GHSA-4x6p-mgm4-pgfq/GHSA-4x6p-mgm4-pgfq.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-4x6p-mgm4-pgfq", - "modified": "2024-12-04T21:30:52Z", + "modified": "2024-12-05T21:31:52Z", "published": "2024-12-04T21:30:52Z", "aliases": [ "CVE-2024-54674" ], "details": "app/View/GalaxyClusters/cluster_export_misp_galaxy.ctp in MISP through 2.5.2 has stored XSS when exporting custom clusters into the misp-galaxy format.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-04T21:15:25Z" diff --git a/advisories/unreviewed/2024/12/GHSA-63g3-m4j7-2vpw/GHSA-63g3-m4j7-2vpw.json b/advisories/unreviewed/2024/12/GHSA-63g3-m4j7-2vpw/GHSA-63g3-m4j7-2vpw.json index 340e17ae785..85ce09b0d59 100644 --- a/advisories/unreviewed/2024/12/GHSA-63g3-m4j7-2vpw/GHSA-63g3-m4j7-2vpw.json +++ b/advisories/unreviewed/2024/12/GHSA-63g3-m4j7-2vpw/GHSA-63g3-m4j7-2vpw.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-63g3-m4j7-2vpw", - "modified": "2024-12-04T21:30:52Z", + "modified": "2024-12-05T21:31:52Z", "published": "2024-12-04T21:30:52Z", "aliases": [ "CVE-2024-50947" ], "details": "An issue in kmqtt v0.2.7 allows attackers to cause a Denial of Service (DoS) via a crafted request.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -25,7 +30,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-04T21:15:24Z" diff --git a/advisories/unreviewed/2024/12/GHSA-6hcg-vqw2-35jw/GHSA-6hcg-vqw2-35jw.json b/advisories/unreviewed/2024/12/GHSA-6hcg-vqw2-35jw/GHSA-6hcg-vqw2-35jw.json new file mode 100644 index 00000000000..bb53070456b --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-6hcg-vqw2-35jw/GHSA-6hcg-vqw2-35jw.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6hcg-vqw2-35jw", + "modified": "2024-12-05T21:31:52Z", + "published": "2024-12-05T21:31:52Z", + "aliases": [ + "CVE-2024-53589" + ], + "details": "GNU objdump 2.43 is vulnerable to Buffer Overflow in the BFD (Binary File Descriptor) library's handling of tekhex format files.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53589" + }, + { + "type": "WEB", + "url": "https://bushido-sec.com/index.php/2024/12/05/binutils-objdump-tekhex-buffer-overflow" + }, + { + "type": "WEB", + "url": "https://www.gnu.org/software/binutils" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-05T20:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-6pwm-f65f-3g86/GHSA-6pwm-f65f-3g86.json b/advisories/unreviewed/2024/12/GHSA-6pwm-f65f-3g86/GHSA-6pwm-f65f-3g86.json new file mode 100644 index 00000000000..5469b9b4967 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-6pwm-f65f-3g86/GHSA-6pwm-f65f-3g86.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6pwm-f65f-3g86", + "modified": "2024-12-05T21:31:52Z", + "published": "2024-12-05T21:31:52Z", + "aliases": [ + "CVE-2024-10933" + ], + "details": "In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any '/' in readdir name validation to avoid unexpected directory traversal on untrusted file systems.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10933" + }, + { + "type": "WEB", + "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/022_readdir.patch.sig" + }, + { + "type": "WEB", + "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/009_readdir.patch.sig" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-05T20:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-6xw3-v997-r9fc/GHSA-6xw3-v997-r9fc.json b/advisories/unreviewed/2024/12/GHSA-6xw3-v997-r9fc/GHSA-6xw3-v997-r9fc.json new file mode 100644 index 00000000000..6185c64bd36 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-6xw3-v997-r9fc/GHSA-6xw3-v997-r9fc.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6xw3-v997-r9fc", + "modified": "2024-12-05T21:31:52Z", + "published": "2024-12-05T21:31:52Z", + "aliases": [ + "CVE-2024-11148" + ], + "details": "In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fastcgi request.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11148" + }, + { + "type": "WEB", + "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/020_httpd.patch.sig" + }, + { + "type": "WEB", + "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/006_httpd.patch.sig" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-476" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-05T20:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-79r7-f3jp-52j9/GHSA-79r7-f3jp-52j9.json b/advisories/unreviewed/2024/12/GHSA-79r7-f3jp-52j9/GHSA-79r7-f3jp-52j9.json new file mode 100644 index 00000000000..e3a7efbb24d --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-79r7-f3jp-52j9/GHSA-79r7-f3jp-52j9.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-79r7-f3jp-52j9", + "modified": "2024-12-05T21:31:52Z", + "published": "2024-12-05T21:31:52Z", + "aliases": [ + "CVE-2023-50913" + ], + "details": "Oxide control plane software before 5 allows SSRF.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50913" + }, + { + "type": "WEB", + "url": "https://docs.oxide.computer/security/advisories/20231215-1" + }, + { + "type": "WEB", + "url": "https://oxide.computer" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-05T20:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-7qwr-5g4p-5495/GHSA-7qwr-5g4p-5495.json b/advisories/unreviewed/2024/12/GHSA-7qwr-5g4p-5495/GHSA-7qwr-5g4p-5495.json new file mode 100644 index 00000000000..05c3f7b5735 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-7qwr-5g4p-5495/GHSA-7qwr-5g4p-5495.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7qwr-5g4p-5495", + "modified": "2024-12-05T21:31:52Z", + "published": "2024-12-05T21:31:52Z", + "aliases": [ + "CVE-2024-53523" + ], + "details": "JSFinder commit d70ab9bc5221e016c08cffaf0d9ac79646c90645 is vulnerable to Directory Traversal in the find_by_file function.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53523" + }, + { + "type": "WEB", + "url": "https://github.com/Threezh1/JSFinder/issues/33" + }, + { + "type": "WEB", + "url": "https://github.com/Threezh1/JSFinder" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-05T21:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-7vhq-gphw-vgj2/GHSA-7vhq-gphw-vgj2.json b/advisories/unreviewed/2024/12/GHSA-7vhq-gphw-vgj2/GHSA-7vhq-gphw-vgj2.json index 0da99854670..4eb5d507673 100644 --- a/advisories/unreviewed/2024/12/GHSA-7vhq-gphw-vgj2/GHSA-7vhq-gphw-vgj2.json +++ b/advisories/unreviewed/2024/12/GHSA-7vhq-gphw-vgj2/GHSA-7vhq-gphw-vgj2.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-7vhq-gphw-vgj2", - "modified": "2024-12-04T18:32:36Z", + "modified": "2024-12-05T21:31:52Z", "published": "2024-12-04T18:32:36Z", "aliases": [ "CVE-2024-12149" ], "details": "Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenticated user that request temporary permissions on an entry to obtain more privileges than requested.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-732" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-04T18:15:12Z" diff --git a/advisories/unreviewed/2024/12/GHSA-84hg-pv4v-g5m7/GHSA-84hg-pv4v-g5m7.json b/advisories/unreviewed/2024/12/GHSA-84hg-pv4v-g5m7/GHSA-84hg-pv4v-g5m7.json new file mode 100644 index 00000000000..8b60ea3e642 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-84hg-pv4v-g5m7/GHSA-84hg-pv4v-g5m7.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-84hg-pv4v-g5m7", + "modified": "2024-12-05T21:31:52Z", + "published": "2024-12-05T21:31:52Z", + "aliases": [ + "CVE-2023-48010" + ], + "details": "STMicroelectronics SPC58 is vulnerable to Missing Protection Mechanism for Alternate Hardware Interface. Code running as Supervisor on the SPC58 PowerPC microcontrollers may disable the System Memory Protection Unit and gain unabridged read/write access to protected assets.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48010" + }, + { + "type": "WEB", + "url": "https://plaxidityx.com/blog/blog-post/is-your-memory-protecteduncovering-hidden-vulnerabilities-in-automotive-mpu-mechanisms" + }, + { + "type": "WEB", + "url": "https://www.st.com/resource/en/reference_manual/rm0452-spc58-h-line--32-bit-power-architecture-automotive-mcu-triple-z4-cores-200-mhz-10-mbytes-flash-hsm-asild-stmicroelectronics.pdf" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-05T20:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-j4cx-gm46-j4hg/GHSA-j4cx-gm46-j4hg.json b/advisories/unreviewed/2024/12/GHSA-j4cx-gm46-j4hg/GHSA-j4cx-gm46-j4hg.json index ee94871bd4b..53e33950637 100644 --- a/advisories/unreviewed/2024/12/GHSA-j4cx-gm46-j4hg/GHSA-j4cx-gm46-j4hg.json +++ b/advisories/unreviewed/2024/12/GHSA-j4cx-gm46-j4hg/GHSA-j4cx-gm46-j4hg.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-j4cx-gm46-j4hg", - "modified": "2024-12-04T18:32:36Z", + "modified": "2024-12-05T21:31:52Z", "published": "2024-12-04T18:32:36Z", "aliases": [ "CVE-2018-9392" ], "details": "In get_binary of vendor/mediatek/proprietary/hardware/connectivity/gps/gps_hal/src/data_coder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-04T18:15:08Z" diff --git a/advisories/unreviewed/2024/12/GHSA-j4j6-mjqg-x2j7/GHSA-j4j6-mjqg-x2j7.json b/advisories/unreviewed/2024/12/GHSA-j4j6-mjqg-x2j7/GHSA-j4j6-mjqg-x2j7.json index 69b9685d194..893ebeb2eb6 100644 --- a/advisories/unreviewed/2024/12/GHSA-j4j6-mjqg-x2j7/GHSA-j4j6-mjqg-x2j7.json +++ b/advisories/unreviewed/2024/12/GHSA-j4j6-mjqg-x2j7/GHSA-j4j6-mjqg-x2j7.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-j4j6-mjqg-x2j7", - "modified": "2024-12-04T21:30:52Z", + "modified": "2024-12-05T21:31:52Z", "published": "2024-12-04T21:30:52Z", "aliases": [ "CVE-2024-54675" ], "details": "app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-04T21:15:25Z" diff --git a/advisories/unreviewed/2024/12/GHSA-jq9m-23hf-jgfg/GHSA-jq9m-23hf-jgfg.json b/advisories/unreviewed/2024/12/GHSA-jq9m-23hf-jgfg/GHSA-jq9m-23hf-jgfg.json index 18cd1b03144..6b95af6bb20 100644 --- a/advisories/unreviewed/2024/12/GHSA-jq9m-23hf-jgfg/GHSA-jq9m-23hf-jgfg.json +++ b/advisories/unreviewed/2024/12/GHSA-jq9m-23hf-jgfg/GHSA-jq9m-23hf-jgfg.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-jq9m-23hf-jgfg", - "modified": "2024-12-04T18:32:36Z", + "modified": "2024-12-05T21:31:52Z", "published": "2024-12-04T18:32:36Z", "aliases": [ "CVE-2018-9393" ], "details": "In procfile_write of drivers/misc/mediatek/connectivity/wlan/gen2/os/linux/gl_proc.c, there is a possible OOB write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-04T18:15:09Z" diff --git a/advisories/unreviewed/2024/12/GHSA-m97p-7pjw-xw7r/GHSA-m97p-7pjw-xw7r.json b/advisories/unreviewed/2024/12/GHSA-m97p-7pjw-xw7r/GHSA-m97p-7pjw-xw7r.json index 05c3173f1ac..4e6802979ef 100644 --- a/advisories/unreviewed/2024/12/GHSA-m97p-7pjw-xw7r/GHSA-m97p-7pjw-xw7r.json +++ b/advisories/unreviewed/2024/12/GHSA-m97p-7pjw-xw7r/GHSA-m97p-7pjw-xw7r.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-m97p-7pjw-xw7r", - "modified": "2024-12-04T18:32:36Z", + "modified": "2024-12-05T21:31:52Z", "published": "2024-12-04T18:32:35Z", "aliases": [ "CVE-2024-52676" ], "details": "Itsourcecode Online Discussion Forum Project v.1.0.0 is vulnerable to Cross Site Scripting (XSS) via /bcc_forum/members/home.php.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-04T17:15:15Z" diff --git a/advisories/unreviewed/2024/12/GHSA-p353-cp93-hvp7/GHSA-p353-cp93-hvp7.json b/advisories/unreviewed/2024/12/GHSA-p353-cp93-hvp7/GHSA-p353-cp93-hvp7.json index ef4c40d2e59..2dae7abda2a 100644 --- a/advisories/unreviewed/2024/12/GHSA-p353-cp93-hvp7/GHSA-p353-cp93-hvp7.json +++ b/advisories/unreviewed/2024/12/GHSA-p353-cp93-hvp7/GHSA-p353-cp93-hvp7.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-p353-cp93-hvp7", - "modified": "2024-12-04T18:32:36Z", + "modified": "2024-12-05T21:31:52Z", "published": "2024-12-04T18:32:36Z", "aliases": [ "CVE-2024-12148" ], "details": "Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting endpoints.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-863" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-04T18:15:12Z" diff --git a/advisories/unreviewed/2024/12/GHSA-ph9m-4f8h-q2f7/GHSA-ph9m-4f8h-q2f7.json b/advisories/unreviewed/2024/12/GHSA-ph9m-4f8h-q2f7/GHSA-ph9m-4f8h-q2f7.json new file mode 100644 index 00000000000..a46d08da768 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-ph9m-4f8h-q2f7/GHSA-ph9m-4f8h-q2f7.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ph9m-4f8h-q2f7", + "modified": "2024-12-05T21:31:52Z", + "published": "2024-12-05T21:31:52Z", + "aliases": [ + "CVE-2024-53442" + ], + "details": "whapa v1.59 is vulnerable to Command Injection via a crafted filename to the HTML reports component.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53442" + }, + { + "type": "WEB", + "url": "https://1d8.github.io/cves/cve_2024_53442" + }, + { + "type": "WEB", + "url": "https://github.com/B16f00t/whapa" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-05T20:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-vjgw-3ffm-c33h/GHSA-vjgw-3ffm-c33h.json b/advisories/unreviewed/2024/12/GHSA-vjgw-3ffm-c33h/GHSA-vjgw-3ffm-c33h.json index 5161c3b5142..12d86e31261 100644 --- a/advisories/unreviewed/2024/12/GHSA-vjgw-3ffm-c33h/GHSA-vjgw-3ffm-c33h.json +++ b/advisories/unreviewed/2024/12/GHSA-vjgw-3ffm-c33h/GHSA-vjgw-3ffm-c33h.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-vjgw-3ffm-c33h", - "modified": "2024-12-03T21:31:22Z", + "modified": "2024-12-05T21:31:52Z", "published": "2024-12-03T21:31:22Z", "aliases": [ "CVE-2024-51114" ], "details": "An issue in Beijing Digital China Yunke Information Technology Co.Ltd v.7.2.6.120 allows a remote attacker to execute arbitrary code via the code/function/dpi/web_auth/customizable.php file", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-77" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-03T20:15:15Z" diff --git a/advisories/unreviewed/2024/12/GHSA-wqvc-3mg4-x25w/GHSA-wqvc-3mg4-x25w.json b/advisories/unreviewed/2024/12/GHSA-wqvc-3mg4-x25w/GHSA-wqvc-3mg4-x25w.json new file mode 100644 index 00000000000..bc9a98925ef --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-wqvc-3mg4-x25w/GHSA-wqvc-3mg4-x25w.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wqvc-3mg4-x25w", + "modified": "2024-12-05T21:31:52Z", + "published": "2024-12-05T21:31:52Z", + "aliases": [ + "CVE-2024-41579" + ], + "details": "DTStack Taier 1.4.0 allows remote attackers to specify the jobName parameter in the console listNames function to cause a SQL injection vulnerability", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41579" + }, + { + "type": "WEB", + "url": "https://github.com/DTStack/Taier/issues/1184" + }, + { + "type": "WEB", + "url": "https://gist.github.com/nerowander/380707503cfb078cbd6bed9fc9b12ad9" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-05T20:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-x8p8-5wfj-x896/GHSA-x8p8-5wfj-x896.json b/advisories/unreviewed/2024/12/GHSA-x8p8-5wfj-x896/GHSA-x8p8-5wfj-x896.json index 0467e67fa51..1378d152b0e 100644 --- a/advisories/unreviewed/2024/12/GHSA-x8p8-5wfj-x896/GHSA-x8p8-5wfj-x896.json +++ b/advisories/unreviewed/2024/12/GHSA-x8p8-5wfj-x896/GHSA-x8p8-5wfj-x896.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-x8p8-5wfj-x896", - "modified": "2024-12-04T18:32:36Z", + "modified": "2024-12-05T21:31:52Z", "published": "2024-12-04T18:32:36Z", "aliases": [ "CVE-2024-12151" ], "details": "Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-732" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-04T18:15:12Z"