From 8cd6a2691c5a803e29c6c4eb8ee7457130fa0056 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 12 Nov 2024 03:32:16 +0000 Subject: [PATCH] Publish Advisories GHSA-24hh-m38m-8727 GHSA-29qg-j923-rv8r GHSA-5pj7-9h42-mfx3 GHSA-6g24-jp4w-4mmm GHSA-88hm-mv53-m5h7 GHSA-8hgp-ch85-7956 GHSA-8x5h-hfqw-552w GHSA-c7xq-233c-6w92 GHSA-c8g9-45jp-mg7h GHSA-cj5q-856p-33fg GHSA-fgfv-4h4q-wrvx GHSA-g2w3-6c6j-74qw GHSA-gf2c-phc6-4g3w GHSA-gh49-pqq6-x974 GHSA-gwgp-7jjg-774v GHSA-hchw-xwhf-3qvm GHSA-q998-8jff-x3rg GHSA-v4pq-9h29-fmjc GHSA-vc27-rq8h-9f48 GHSA-wr9r-499g-57gv --- .../GHSA-24hh-m38m-8727.json | 58 +++++++++++++++++++ .../GHSA-29qg-j923-rv8r.json | 42 ++++++++++++++ .../GHSA-5pj7-9h42-mfx3.json | 42 ++++++++++++++ .../GHSA-6g24-jp4w-4mmm.json | 38 ++++++++++++ .../GHSA-88hm-mv53-m5h7.json | 42 ++++++++++++++ .../GHSA-8hgp-ch85-7956.json | 58 +++++++++++++++++++ .../GHSA-8x5h-hfqw-552w.json | 11 ++-- .../GHSA-c7xq-233c-6w92.json | 42 ++++++++++++++ .../GHSA-c8g9-45jp-mg7h.json | 42 ++++++++++++++ .../GHSA-cj5q-856p-33fg.json | 11 ++-- .../GHSA-fgfv-4h4q-wrvx.json | 42 ++++++++++++++ .../GHSA-g2w3-6c6j-74qw.json | 42 ++++++++++++++ .../GHSA-gf2c-phc6-4g3w.json | 11 ++-- .../GHSA-gh49-pqq6-x974.json | 38 ++++++++++++ .../GHSA-gwgp-7jjg-774v.json | 42 ++++++++++++++ .../GHSA-hchw-xwhf-3qvm.json | 42 ++++++++++++++ .../GHSA-q998-8jff-x3rg.json | 42 ++++++++++++++ .../GHSA-v4pq-9h29-fmjc.json | 42 ++++++++++++++ .../GHSA-vc27-rq8h-9f48.json | 58 +++++++++++++++++++ .../GHSA-wr9r-499g-57gv.json | 11 ++-- 20 files changed, 740 insertions(+), 16 deletions(-) create mode 100644 advisories/unreviewed/2024/11/GHSA-24hh-m38m-8727/GHSA-24hh-m38m-8727.json create mode 100644 advisories/unreviewed/2024/11/GHSA-29qg-j923-rv8r/GHSA-29qg-j923-rv8r.json create mode 100644 advisories/unreviewed/2024/11/GHSA-5pj7-9h42-mfx3/GHSA-5pj7-9h42-mfx3.json create mode 100644 advisories/unreviewed/2024/11/GHSA-6g24-jp4w-4mmm/GHSA-6g24-jp4w-4mmm.json create mode 100644 advisories/unreviewed/2024/11/GHSA-88hm-mv53-m5h7/GHSA-88hm-mv53-m5h7.json create mode 100644 advisories/unreviewed/2024/11/GHSA-8hgp-ch85-7956/GHSA-8hgp-ch85-7956.json create mode 100644 advisories/unreviewed/2024/11/GHSA-c7xq-233c-6w92/GHSA-c7xq-233c-6w92.json create mode 100644 advisories/unreviewed/2024/11/GHSA-c8g9-45jp-mg7h/GHSA-c8g9-45jp-mg7h.json create mode 100644 advisories/unreviewed/2024/11/GHSA-fgfv-4h4q-wrvx/GHSA-fgfv-4h4q-wrvx.json create mode 100644 advisories/unreviewed/2024/11/GHSA-g2w3-6c6j-74qw/GHSA-g2w3-6c6j-74qw.json create mode 100644 advisories/unreviewed/2024/11/GHSA-gh49-pqq6-x974/GHSA-gh49-pqq6-x974.json create mode 100644 advisories/unreviewed/2024/11/GHSA-gwgp-7jjg-774v/GHSA-gwgp-7jjg-774v.json create mode 100644 advisories/unreviewed/2024/11/GHSA-hchw-xwhf-3qvm/GHSA-hchw-xwhf-3qvm.json create mode 100644 advisories/unreviewed/2024/11/GHSA-q998-8jff-x3rg/GHSA-q998-8jff-x3rg.json create mode 100644 advisories/unreviewed/2024/11/GHSA-v4pq-9h29-fmjc/GHSA-v4pq-9h29-fmjc.json create mode 100644 advisories/unreviewed/2024/11/GHSA-vc27-rq8h-9f48/GHSA-vc27-rq8h-9f48.json diff --git a/advisories/unreviewed/2024/11/GHSA-24hh-m38m-8727/GHSA-24hh-m38m-8727.json b/advisories/unreviewed/2024/11/GHSA-24hh-m38m-8727/GHSA-24hh-m38m-8727.json new file mode 100644 index 00000000000..25fa521f19a --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-24hh-m38m-8727/GHSA-24hh-m38m-8727.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-24hh-m38m-8727", + "modified": "2024-11-12T03:30:47Z", + "published": "2024-11-12T03:30:47Z", + "aliases": [ + "CVE-2024-11096" + ], + "details": "A vulnerability, which was classified as critical, was found in code-projects Task Manager 1.0. This affects an unknown part of the file /newProject.php. The manipulation of the argument projectName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11096" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/UnrealdDei/cve/blob/main/sql4.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283917" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283917" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.441186" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-12T01:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-29qg-j923-rv8r/GHSA-29qg-j923-rv8r.json b/advisories/unreviewed/2024/11/GHSA-29qg-j923-rv8r/GHSA-29qg-j923-rv8r.json new file mode 100644 index 00000000000..b863356b95c --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-29qg-j923-rv8r/GHSA-29qg-j923-rv8r.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-29qg-j923-rv8r", + "modified": "2024-11-12T03:30:48Z", + "published": "2024-11-12T03:30:48Z", + "aliases": [ + "CVE-2024-47595" + ], + "details": "An attacker who gains local membership to sapsys group could replace local files usually protected by privileged access. On successful exploitation the attacker could cause high impact on confidentiality and integrity of the application.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47595" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3509619" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-12T01:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-5pj7-9h42-mfx3/GHSA-5pj7-9h42-mfx3.json b/advisories/unreviewed/2024/11/GHSA-5pj7-9h42-mfx3/GHSA-5pj7-9h42-mfx3.json new file mode 100644 index 00000000000..75f52cc8b74 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-5pj7-9h42-mfx3/GHSA-5pj7-9h42-mfx3.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5pj7-9h42-mfx3", + "modified": "2024-11-12T03:30:48Z", + "published": "2024-11-12T03:30:48Z", + "aliases": [ + "CVE-2024-47590" + ], + "details": "An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim's browser (XXS) or transmitted to another server (SSRF) gives the attacker the ability to execute arbitrary code on the server fully compromising confidentiality, integrity and availability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47590" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3520281" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-791" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-12T01:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-6g24-jp4w-4mmm/GHSA-6g24-jp4w-4mmm.json b/advisories/unreviewed/2024/11/GHSA-6g24-jp4w-4mmm/GHSA-6g24-jp4w-4mmm.json new file mode 100644 index 00000000000..c4733b9950e --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-6g24-jp4w-4mmm/GHSA-6g24-jp4w-4mmm.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6g24-jp4w-4mmm", + "modified": "2024-11-12T03:30:48Z", + "published": "2024-11-12T03:30:48Z", + "aliases": [ + "CVE-2024-8881" + ], + "details": "A post-authentication command injection vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an authenticated, LAN-based attacker with administrator privileges to execute some operating system (OS) commands on an affected device by sending a crafted HTTP request.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8881" + }, + { + "type": "WEB", + "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-buffer-overflow-vulnerabilities-in-gs1900-series-switches-11-12-2024" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-12T02:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-88hm-mv53-m5h7/GHSA-88hm-mv53-m5h7.json b/advisories/unreviewed/2024/11/GHSA-88hm-mv53-m5h7/GHSA-88hm-mv53-m5h7.json new file mode 100644 index 00000000000..bc04e0c741d --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-88hm-mv53-m5h7/GHSA-88hm-mv53-m5h7.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-88hm-mv53-m5h7", + "modified": "2024-11-12T03:30:48Z", + "published": "2024-11-12T03:30:48Z", + "aliases": [ + "CVE-2024-49395" + ], + "details": "In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49395" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-49395" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325332" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1230" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-12T03:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-8hgp-ch85-7956/GHSA-8hgp-ch85-7956.json b/advisories/unreviewed/2024/11/GHSA-8hgp-ch85-7956/GHSA-8hgp-ch85-7956.json new file mode 100644 index 00000000000..023597c6d8a --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-8hgp-ch85-7956/GHSA-8hgp-ch85-7956.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8hgp-ch85-7956", + "modified": "2024-11-12T03:30:48Z", + "published": "2024-11-12T03:30:48Z", + "aliases": [ + "CVE-2024-11099" + ], + "details": "A vulnerability was found in code-projects Job Recruitment 1.0 and classified as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11099" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/Kenton868/CVE/blob/main/sqlInjection1.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283919" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283919" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.441259" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-12T02:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-8x5h-hfqw-552w/GHSA-8x5h-hfqw-552w.json b/advisories/unreviewed/2024/11/GHSA-8x5h-hfqw-552w/GHSA-8x5h-hfqw-552w.json index caf52849c02..f743105a217 100644 --- a/advisories/unreviewed/2024/11/GHSA-8x5h-hfqw-552w/GHSA-8x5h-hfqw-552w.json +++ b/advisories/unreviewed/2024/11/GHSA-8x5h-hfqw-552w/GHSA-8x5h-hfqw-552w.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-8x5h-hfqw-552w", - "modified": "2024-11-11T21:31:49Z", + "modified": "2024-11-12T03:30:47Z", "published": "2024-11-11T21:31:49Z", "aliases": [ "CVE-2024-51190" ], "details": "TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the ptRule_ApplicationName_1.1.6.0.0 parameter on the /special_ap.htm page.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-11T20:15:18Z" diff --git a/advisories/unreviewed/2024/11/GHSA-c7xq-233c-6w92/GHSA-c7xq-233c-6w92.json b/advisories/unreviewed/2024/11/GHSA-c7xq-233c-6w92/GHSA-c7xq-233c-6w92.json new file mode 100644 index 00000000000..235a1eeef3e --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-c7xq-233c-6w92/GHSA-c7xq-233c-6w92.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c7xq-233c-6w92", + "modified": "2024-11-12T03:30:47Z", + "published": "2024-11-12T03:30:47Z", + "aliases": [ + "CVE-2024-42372" + ], + "details": "Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restricted global SLD configurations causing low impact on confidentiality and integrity of the application.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42372" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3335394" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-12T01:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-c8g9-45jp-mg7h/GHSA-c8g9-45jp-mg7h.json b/advisories/unreviewed/2024/11/GHSA-c8g9-45jp-mg7h/GHSA-c8g9-45jp-mg7h.json new file mode 100644 index 00000000000..addfad0da57 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-c8g9-45jp-mg7h/GHSA-c8g9-45jp-mg7h.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c8g9-45jp-mg7h", + "modified": "2024-11-12T03:30:47Z", + "published": "2024-11-12T03:30:47Z", + "aliases": [ + "CVE-2024-47587" + ], + "details": "Cash Operations does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges causing low impact to confidentiality to the application.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47587" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3498470" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-12T01:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-cj5q-856p-33fg/GHSA-cj5q-856p-33fg.json b/advisories/unreviewed/2024/11/GHSA-cj5q-856p-33fg/GHSA-cj5q-856p-33fg.json index a483d94e1ce..a86c07587e5 100644 --- a/advisories/unreviewed/2024/11/GHSA-cj5q-856p-33fg/GHSA-cj5q-856p-33fg.json +++ b/advisories/unreviewed/2024/11/GHSA-cj5q-856p-33fg/GHSA-cj5q-856p-33fg.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-cj5q-856p-33fg", - "modified": "2024-11-11T21:31:49Z", + "modified": "2024-11-12T03:30:47Z", "published": "2024-11-11T21:31:49Z", "aliases": [ "CVE-2024-51189" ], "details": "TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the macList_Name_1.1.1.0.0 parameter on the /filters.htm page.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-11T20:15:18Z" diff --git a/advisories/unreviewed/2024/11/GHSA-fgfv-4h4q-wrvx/GHSA-fgfv-4h4q-wrvx.json b/advisories/unreviewed/2024/11/GHSA-fgfv-4h4q-wrvx/GHSA-fgfv-4h4q-wrvx.json new file mode 100644 index 00000000000..b1ef9a5cb26 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-fgfv-4h4q-wrvx/GHSA-fgfv-4h4q-wrvx.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fgfv-4h4q-wrvx", + "modified": "2024-11-12T03:30:47Z", + "published": "2024-11-12T03:30:47Z", + "aliases": [ + "CVE-2024-47586" + ], + "details": "SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated attacker to send a maliciously crafted http request which could cause a null pointer dereference in the kernel. This dereference will result in the system crashing and rebooting, causing the system to be temporarily unavailable. There is no impact on Confidentiality or Integrity.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47586" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3504390" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-12T01:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-g2w3-6c6j-74qw/GHSA-g2w3-6c6j-74qw.json b/advisories/unreviewed/2024/11/GHSA-g2w3-6c6j-74qw/GHSA-g2w3-6c6j-74qw.json new file mode 100644 index 00000000000..023449cfc5e --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-g2w3-6c6j-74qw/GHSA-g2w3-6c6j-74qw.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g2w3-6c6j-74qw", + "modified": "2024-11-12T03:30:48Z", + "published": "2024-11-12T03:30:48Z", + "aliases": [ + "CVE-2024-47592" + ], + "details": "SAP NetWeaver AS Java allows an unauthenticated attacker to brute force the login functionality in order to identify the legitimate user IDs. This has an impact on confidentiality but not on integrity or availability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47592" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3393899" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-307" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-12T01:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-gf2c-phc6-4g3w/GHSA-gf2c-phc6-4g3w.json b/advisories/unreviewed/2024/11/GHSA-gf2c-phc6-4g3w/GHSA-gf2c-phc6-4g3w.json index 2906d754c5d..19228ea5ecf 100644 --- a/advisories/unreviewed/2024/11/GHSA-gf2c-phc6-4g3w/GHSA-gf2c-phc6-4g3w.json +++ b/advisories/unreviewed/2024/11/GHSA-gf2c-phc6-4g3w/GHSA-gf2c-phc6-4g3w.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-gf2c-phc6-4g3w", - "modified": "2024-11-11T21:31:48Z", + "modified": "2024-11-12T03:30:47Z", "published": "2024-11-11T21:31:48Z", "aliases": [ "CVE-2024-51188" ], "details": "TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the vsRule_VirtualServerName_1.1.10.0.0 parameter on the /virtual_server.htm page.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-11T20:15:18Z" diff --git a/advisories/unreviewed/2024/11/GHSA-gh49-pqq6-x974/GHSA-gh49-pqq6-x974.json b/advisories/unreviewed/2024/11/GHSA-gh49-pqq6-x974/GHSA-gh49-pqq6-x974.json new file mode 100644 index 00000000000..a7ba2bb6a03 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-gh49-pqq6-x974/GHSA-gh49-pqq6-x974.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gh49-pqq6-x974", + "modified": "2024-11-12T03:30:48Z", + "published": "2024-11-12T03:30:48Z", + "aliases": [ + "CVE-2024-8882" + ], + "details": "A buffer overflow vulnerability in the CGI program in the Zyxel GS1900-48 switch firmware version V2.80(AAHN.1)C0 and earlier could allow an authenticated, LAN-based attacker with administrator privileges to cause denial of service (DoS) conditions via a crafted URL.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8882" + }, + { + "type": "WEB", + "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-post-authentication-command-injection-and-buffer-overflow-vulnerabilities-in-gs1900-series-switches-11-12-2024" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-120" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-12T02:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-gwgp-7jjg-774v/GHSA-gwgp-7jjg-774v.json b/advisories/unreviewed/2024/11/GHSA-gwgp-7jjg-774v/GHSA-gwgp-7jjg-774v.json new file mode 100644 index 00000000000..e7101749a40 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-gwgp-7jjg-774v/GHSA-gwgp-7jjg-774v.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gwgp-7jjg-774v", + "modified": "2024-11-12T03:30:48Z", + "published": "2024-11-12T03:30:48Z", + "aliases": [ + "CVE-2024-47593" + ], + "details": "SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted.This attack is possible only if a Web Dispatcher or some sort of Proxy Server is in use and the file in question was previously opened or downloaded in an application based on SAP GUI for HTML Technology. This will not compromise the application's integrity or availability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47593" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3508947" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-12T01:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hchw-xwhf-3qvm/GHSA-hchw-xwhf-3qvm.json b/advisories/unreviewed/2024/11/GHSA-hchw-xwhf-3qvm/GHSA-hchw-xwhf-3qvm.json new file mode 100644 index 00000000000..1ff66c66af5 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-hchw-xwhf-3qvm/GHSA-hchw-xwhf-3qvm.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hchw-xwhf-3qvm", + "modified": "2024-11-12T03:30:48Z", + "published": "2024-11-12T03:30:48Z", + "aliases": [ + "CVE-2024-49393" + ], + "details": "In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49393" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-49393" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325317" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-347" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-12T02:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-q998-8jff-x3rg/GHSA-q998-8jff-x3rg.json b/advisories/unreviewed/2024/11/GHSA-q998-8jff-x3rg/GHSA-q998-8jff-x3rg.json new file mode 100644 index 00000000000..5c83687e300 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-q998-8jff-x3rg/GHSA-q998-8jff-x3rg.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q998-8jff-x3rg", + "modified": "2024-11-12T03:30:48Z", + "published": "2024-11-12T03:30:48Z", + "aliases": [ + "CVE-2024-49394" + ], + "details": "In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49394" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-49394" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325330" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-347" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-12T03:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-v4pq-9h29-fmjc/GHSA-v4pq-9h29-fmjc.json b/advisories/unreviewed/2024/11/GHSA-v4pq-9h29-fmjc/GHSA-v4pq-9h29-fmjc.json new file mode 100644 index 00000000000..c0672a2f100 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-v4pq-9h29-fmjc/GHSA-v4pq-9h29-fmjc.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v4pq-9h29-fmjc", + "modified": "2024-11-12T03:30:47Z", + "published": "2024-11-12T03:30:47Z", + "aliases": [ + "CVE-2024-47588" + ], + "details": "In SAP NetWeaver Java (Software Update Manager 1.1), under certain conditions when a software upgrade encounters errors, credentials are written in plaintext to a log file. An attacker with local access to the server, authenticated as a non-administrative user, can acquire the credentials from the logs. This leads to a high impact on confidentiality, with no impact on integrity or availability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47588" + }, + { + "type": "WEB", + "url": "https://me.sap.com/notes/3522953" + }, + { + "type": "WEB", + "url": "https://url.sap/sapsecuritypatchday" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-522" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-12T01:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vc27-rq8h-9f48/GHSA-vc27-rq8h-9f48.json b/advisories/unreviewed/2024/11/GHSA-vc27-rq8h-9f48/GHSA-vc27-rq8h-9f48.json new file mode 100644 index 00000000000..461abca5b9d --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-vc27-rq8h-9f48/GHSA-vc27-rq8h-9f48.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vc27-rq8h-9f48", + "modified": "2024-11-12T03:30:48Z", + "published": "2024-11-12T03:30:48Z", + "aliases": [ + "CVE-2024-11097" + ], + "details": "A vulnerability has been found in SourceCodester Student Record Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the component Main Menu. The manipulation leads to infinite loop. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11097" + }, + { + "type": "WEB", + "url": "https://github.com/Hacker0xone/CVE/issues/5" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283918" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283918" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.441237" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-404" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-12T02:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-wr9r-499g-57gv/GHSA-wr9r-499g-57gv.json b/advisories/unreviewed/2024/11/GHSA-wr9r-499g-57gv/GHSA-wr9r-499g-57gv.json index fe96642d154..67696941ca0 100644 --- a/advisories/unreviewed/2024/11/GHSA-wr9r-499g-57gv/GHSA-wr9r-499g-57gv.json +++ b/advisories/unreviewed/2024/11/GHSA-wr9r-499g-57gv/GHSA-wr9r-499g-57gv.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-wr9r-499g-57gv", - "modified": "2024-11-11T21:31:48Z", + "modified": "2024-11-12T03:30:47Z", "published": "2024-11-11T21:31:48Z", "aliases": [ "CVE-2024-51187" ], "details": "TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices contain a Store Cross-site scripting (XSS) vulnerability via the firewallRule_Name_1.1.1.0.0 parameter on the /firewall_setting.htm page.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-11-11T20:15:17Z"