netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-24hh-m38m-8727
GHSA-29qg-j923-rv8r
GHSA-5pj7-9h42-mfx3
GHSA-6g24-jp4w-4mmm
GHSA-88hm-mv53-m5h7
GHSA-8hgp-ch85-7956
GHSA-8x5h-hfqw-552w
GHSA-c7xq-233c-6w92
GHSA-c8g9-45jp-mg7h
GHSA-cj5q-856p-33fg
GHSA-fgfv-4h4q-wrvx
GHSA-g2w3-6c6j-74qw
GHSA-gf2c-phc6-4g3w
GHSA-gh49-pqq6-x974
GHSA-gwgp-7jjg-774v
GHSA-hchw-xwhf-3qvm
GHSA-q998-8jff-x3rg
GHSA-v4pq-9h29-fmjc
GHSA-vc27-rq8h-9f48
GHSA-wr9r-499g-57gv
This commit is contained in:
advisory-database[bot]
2024-11-12 03:32:16 +00:00
parent c11d3469dc
commit 8cd6a2691c
20 changed files with 740 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/11/GHSA-24hh-m38m-8727/GHSA-24hh-m38m-8727.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-24hh-m38m-8727",
"modified": "2024-11-12T03:30:47Z",
"published": "2024-11-12T03:30:47Z",
"aliases": [
"CVE-2024-11096"
],
"details": "A vulnerability, which was classified as critical, was found in code-projects Task Manager 1.0. This affects an unknown part of the file /newProject.php. The manipulation of the argument projectName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11096"
},
{
"type": "WEB",
"url": "https://code-projects.org"
},
{
"type": "WEB",
"url": "https://github.com/UnrealdDei/cve/blob/main/sql4.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.283917"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.283917"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.441186"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T01:15:03Z"
}
}
advisories/unreviewed/2024/11/GHSA-29qg-j923-rv8r/GHSA-29qg-j923-rv8r.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-29qg-j923-rv8r",
"modified": "2024-11-12T03:30:48Z",
"published": "2024-11-12T03:30:48Z",
"aliases": [
"CVE-2024-47595"
],
"details": "An attacker who gains local membership to sapsys group could replace local files usually protected by privileged access. On successful exploitation the attacker could cause high impact on confidentiality and integrity of the application.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47595"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3509619"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"database_specific": {
"cwe_ids": [
"CWE-266"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T01:15:05Z"
}
}
advisories/unreviewed/2024/11/GHSA-5pj7-9h42-mfx3/GHSA-5pj7-9h42-mfx3.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5pj7-9h42-mfx3",
"modified": "2024-11-12T03:30:48Z",
"published": "2024-11-12T03:30:48Z",
"aliases": [
"CVE-2024-47590"
],
"details": "An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim's browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47590"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3520281"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"database_specific": {
"cwe_ids": [
"CWE-791"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T01:15:04Z"
}
}
advisories/unreviewed/2024/11/GHSA-6g24-jp4w-4mmm/GHSA-6g24-jp4w-4mmm.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6g24-jp4w-4mmm",
"modified": "2024-11-12T03:30:48Z",
"published": "2024-11-12T03:30:48Z",
"aliases": [
"CVE-2024-8881"
],
"details": "A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an authenticated, LAN-based attacker with administrator privileges to execute some operating system (OS) commands on an affected device by sending a crafted HTTP request.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8881"
},
{
"type": "WEB",
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-buffer-overflow-vulnerabilities-in-gs1900-series-switches-11-12-2024"
}
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T02:15:18Z"
}
}
advisories/unreviewed/2024/11/GHSA-88hm-mv53-m5h7/GHSA-88hm-mv53-m5h7.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-88hm-mv53-m5h7",
"modified": "2024-11-12T03:30:48Z",
"published": "2024-11-12T03:30:48Z",
"aliases": [
"CVE-2024-49395"
],
"details": "In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49395"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-49395"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325332"
}
],
"database_specific": {
"cwe_ids": [
"CWE-1230"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T03:15:03Z"
}
}
advisories/unreviewed/2024/11/GHSA-8hgp-ch85-7956/GHSA-8hgp-ch85-7956.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8hgp-ch85-7956",
"modified": "2024-11-12T03:30:48Z",
"published": "2024-11-12T03:30:48Z",
"aliases": [
"CVE-2024-11099"
],
"details": "A vulnerability was found in code-projects Job Recruitment 1.0 and classified as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11099"
},
{
"type": "WEB",
"url": "https://code-projects.org"
},
{
"type": "WEB",
"url": "https://github.com/Kenton868/CVE/blob/main/sqlInjection1.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.283919"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.283919"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.441259"
}
],
"database_specific": {
"cwe_ids": [
"CWE-74"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T02:15:18Z"
}
}
advisories/unreviewed/2024/11/GHSA-8x5h-hfqw-552w/GHSA-8x5h-hfqw-552w.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8x5h-hfqw-552w",
"modified": "2024-11-11T21:31:49Z",
"modified": "2024-11-12T03:30:47Z",
"published": "2024-11-11T21:31:49Z",
"aliases": [
"CVE-2024-51190"
],
"details": "TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the ptRule_ApplicationName_1.1.6.0.0 parameter on the /special_ap.htm page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-11T20:15:18Z"
advisories/unreviewed/2024/11/GHSA-c7xq-233c-6w92/GHSA-c7xq-233c-6w92.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c7xq-233c-6w92",
"modified": "2024-11-12T03:30:47Z",
"published": "2024-11-12T03:30:47Z",
"aliases": [
"CVE-2024-42372"
],
"details": "Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restricted global SLD configurations causing low impact on confidentiality and integrity of the application.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42372"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3335394"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T01:15:03Z"
}
}
advisories/unreviewed/2024/11/GHSA-c8g9-45jp-mg7h/GHSA-c8g9-45jp-mg7h.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c8g9-45jp-mg7h",
"modified": "2024-11-12T03:30:47Z",
"published": "2024-11-12T03:30:47Z",
"aliases": [
"CVE-2024-47587"
],
"details": "Cash Operations does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges causing low impact to confidentiality to the application.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47587"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3498470"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T01:15:04Z"
}
}
advisories/unreviewed/2024/11/GHSA-cj5q-856p-33fg/GHSA-cj5q-856p-33fg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cj5q-856p-33fg",
"modified": "2024-11-11T21:31:49Z",
"modified": "2024-11-12T03:30:47Z",
"published": "2024-11-11T21:31:49Z",
"aliases": [
"CVE-2024-51189"
],
"details": "TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the macList_Name_1.1.1.0.0 parameter on the /filters.htm page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-11T20:15:18Z"
advisories/unreviewed/2024/11/GHSA-fgfv-4h4q-wrvx/GHSA-fgfv-4h4q-wrvx.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fgfv-4h4q-wrvx",
"modified": "2024-11-12T03:30:47Z",
"published": "2024-11-12T03:30:47Z",
"aliases": [
"CVE-2024-47586"
],
"details": "SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel. This dereference will result in the system crashing and rebooting, causing the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47586"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3504390"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T01:15:04Z"
}
}
advisories/unreviewed/2024/11/GHSA-g2w3-6c6j-74qw/GHSA-g2w3-6c6j-74qw.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g2w3-6c6j-74qw",
"modified": "2024-11-12T03:30:48Z",
"published": "2024-11-12T03:30:48Z",
"aliases": [
"CVE-2024-47592"
],
"details": "SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs. This has an impact on confidentiality but not on integrity or availability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47592"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3393899"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"database_specific": {
"cwe_ids": [
"CWE-307"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T01:15:05Z"
}
}
advisories/unreviewed/2024/11/GHSA-gf2c-phc6-4g3w/GHSA-gf2c-phc6-4g3w.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gf2c-phc6-4g3w",
"modified": "2024-11-11T21:31:48Z",
"modified": "2024-11-12T03:30:47Z",
"published": "2024-11-11T21:31:48Z",
"aliases": [
"CVE-2024-51188"
],
"details": "TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the vsRule_VirtualServerName_1.1.10.0.0 parameter on the /virtual_server.htm page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-11T20:15:18Z"
advisories/unreviewed/2024/11/GHSA-gh49-pqq6-x974/GHSA-gh49-pqq6-x974.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gh49-pqq6-x974",
"modified": "2024-11-12T03:30:48Z",
"published": "2024-11-12T03:30:48Z",
"aliases": [
"CVE-2024-8882"
],
"details": "A buffer overflow vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an authenticated, LAN-based attacker with administrator privileges to cause denial of service (DoS) conditions via a crafted URL.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8882"
},
{
"type": "WEB",
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-buffer-overflow-vulnerabilities-in-gs1900-series-switches-11-12-2024"
}
],
"database_specific": {
"cwe_ids": [
"CWE-120"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T02:15:19Z"
}
}
advisories/unreviewed/2024/11/GHSA-gwgp-7jjg-774v/GHSA-gwgp-7jjg-774v.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gwgp-7jjg-774v",
"modified": "2024-11-12T03:30:48Z",
"published": "2024-11-12T03:30:48Z",
"aliases": [
"CVE-2024-47593"
],
"details": "SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted.This attack is possible only if a Web Dispatcher or some sort of Proxy Server is in use and the file in question was previously opened or downloaded in an application based on SAP GUI for HTML Technology. This will not compromise the application's integrity or availability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47593"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3508947"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T01:15:05Z"
}
}
advisories/unreviewed/2024/11/GHSA-hchw-xwhf-3qvm/GHSA-hchw-xwhf-3qvm.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hchw-xwhf-3qvm",
"modified": "2024-11-12T03:30:48Z",
"published": "2024-11-12T03:30:48Z",
"aliases": [
"CVE-2024-49393"
],
"details": "In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49393"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-49393"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325317"
}
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T02:15:18Z"
}
}
advisories/unreviewed/2024/11/GHSA-q998-8jff-x3rg/GHSA-q998-8jff-x3rg.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q998-8jff-x3rg",
"modified": "2024-11-12T03:30:48Z",
"published": "2024-11-12T03:30:48Z",
"aliases": [
"CVE-2024-49394"
],
"details": "In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49394"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-49394"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325330"
}
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T03:15:03Z"
}
}
advisories/unreviewed/2024/11/GHSA-v4pq-9h29-fmjc/GHSA-v4pq-9h29-fmjc.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v4pq-9h29-fmjc",
"modified": "2024-11-12T03:30:47Z",
"published": "2024-11-12T03:30:47Z",
"aliases": [
"CVE-2024-47588"
],
"details": "In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext to a log file. An attacker with local access to the server, authenticated as a non-administrative user, can acquire the credentials from the logs. This leads to a high impact on confidentiality, with no impact on integrity or availability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47588"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3522953"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T01:15:04Z"
}
}
advisories/unreviewed/2024/11/GHSA-vc27-rq8h-9f48/GHSA-vc27-rq8h-9f48.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vc27-rq8h-9f48",
"modified": "2024-11-12T03:30:48Z",
"published": "2024-11-12T03:30:48Z",
"aliases": [
"CVE-2024-11097"
],
"details": "A vulnerability has been found in SourceCodester Student Record Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the component Main Menu. The manipulation leads to infinite loop. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11097"
},
{
"type": "WEB",
"url": "https://github.com/Hacker0xone/CVE/issues/5"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.283918"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.283918"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.441237"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-404"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T02:15:17Z"
}
}
advisories/unreviewed/2024/11/GHSA-wr9r-499g-57gv/GHSA-wr9r-499g-57gv.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wr9r-499g-57gv",
"modified": "2024-11-11T21:31:48Z",
"modified": "2024-11-12T03:30:47Z",
"published": "2024-11-11T21:31:48Z",
"aliases": [
"CVE-2024-51187"
],
"details": "TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the firewallRule_Name_1.1.1.0.0 parameter on the /firewall_setting.htm page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-11T20:15:17Z"