From 8f3aa691c28045f8651020f2713576d0d6c5cb06 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 12 Feb 2025 03:32:40 +0000 Subject: [PATCH] Publish Advisories GHSA-p535-33vp-92fr GHSA-j925-xw2g-p4c2 GHSA-wc9x-r2g7-vjwr GHSA-gww7-xg42-6356 GHSA-j7mf-5rmr-fgp9 GHSA-xh5q-pch5-g3xq GHSA-4hmh-pm5p-9j7j GHSA-cx98-f2vw-wvr8 GHSA-h2rf-rp8h-fq2p GHSA-j238-93mq-hf2r GHSA-j3fj-rfh9-7j99 GHSA-pvrm-pgp5-5hc5 GHSA-q9w6-cwj4-gf4p GHSA-v48x-7rw7-7r74 GHSA-vjvq-7vfq-g7j9 --- .../GHSA-p535-33vp-92fr.json | 15 ++- .../GHSA-j925-xw2g-p4c2.json | 4 +- .../GHSA-wc9x-r2g7-vjwr.json | 4 +- .../GHSA-gww7-xg42-6356.json | 4 +- .../GHSA-j7mf-5rmr-fgp9.json | 4 +- .../GHSA-xh5q-pch5-g3xq.json | 106 +++++++++--------- .../GHSA-4hmh-pm5p-9j7j.json | 36 ++++++ .../GHSA-cx98-f2vw-wvr8.json | 40 +++++++ .../GHSA-h2rf-rp8h-fq2p.json | 6 +- .../GHSA-j238-93mq-hf2r.json | 40 +++++++ .../GHSA-j3fj-rfh9-7j99.json | 36 ++++++ .../GHSA-pvrm-pgp5-5hc5.json | 40 +++++++ .../GHSA-q9w6-cwj4-gf4p.json | 40 +++++++ .../GHSA-v48x-7rw7-7r74.json | 36 ++++++ .../GHSA-vjvq-7vfq-g7j9.json | 36 ++++++ 15 files changed, 383 insertions(+), 64 deletions(-) create mode 100644 advisories/unreviewed/2025/02/GHSA-4hmh-pm5p-9j7j/GHSA-4hmh-pm5p-9j7j.json create mode 100644 advisories/unreviewed/2025/02/GHSA-cx98-f2vw-wvr8/GHSA-cx98-f2vw-wvr8.json create mode 100644 advisories/unreviewed/2025/02/GHSA-j238-93mq-hf2r/GHSA-j238-93mq-hf2r.json create mode 100644 advisories/unreviewed/2025/02/GHSA-j3fj-rfh9-7j99/GHSA-j3fj-rfh9-7j99.json create mode 100644 advisories/unreviewed/2025/02/GHSA-pvrm-pgp5-5hc5/GHSA-pvrm-pgp5-5hc5.json create mode 100644 advisories/unreviewed/2025/02/GHSA-q9w6-cwj4-gf4p/GHSA-q9w6-cwj4-gf4p.json create mode 100644 advisories/unreviewed/2025/02/GHSA-v48x-7rw7-7r74/GHSA-v48x-7rw7-7r74.json create mode 100644 advisories/unreviewed/2025/02/GHSA-vjvq-7vfq-g7j9/GHSA-vjvq-7vfq-g7j9.json diff --git a/advisories/unreviewed/2024/02/GHSA-p535-33vp-92fr/GHSA-p535-33vp-92fr.json b/advisories/unreviewed/2024/02/GHSA-p535-33vp-92fr/GHSA-p535-33vp-92fr.json index 6b98f2efff6..b20ffeca137 100644 --- a/advisories/unreviewed/2024/02/GHSA-p535-33vp-92fr/GHSA-p535-33vp-92fr.json +++ b/advisories/unreviewed/2024/02/GHSA-p535-33vp-92fr/GHSA-p535-33vp-92fr.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-p535-33vp-92fr", - "modified": "2024-02-21T18:31:02Z", + "modified": "2025-02-12T03:31:13Z", "published": "2024-02-21T18:31:02Z", "aliases": [ "CVE-2024-25898" ], "details": "A XSS vulnerability was found in the ChurchCRM v.5.5.0 functionality, edit your event, where malicious JS or HTML code can be inserted in the Event Sermon field in EventEditor.php.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-21T18:15:51Z" diff --git a/advisories/unreviewed/2024/03/GHSA-j925-xw2g-p4c2/GHSA-j925-xw2g-p4c2.json b/advisories/unreviewed/2024/03/GHSA-j925-xw2g-p4c2/GHSA-j925-xw2g-p4c2.json index 8b6fc838b12..a6a932ab392 100644 --- a/advisories/unreviewed/2024/03/GHSA-j925-xw2g-p4c2/GHSA-j925-xw2g-p4c2.json +++ b/advisories/unreviewed/2024/03/GHSA-j925-xw2g-p4c2/GHSA-j925-xw2g-p4c2.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-j925-xw2g-p4c2", - "modified": "2024-03-27T15:30:37Z", + "modified": "2025-02-12T03:31:13Z", "published": "2024-03-27T15:30:37Z", "aliases": [ "CVE-2024-29793" ], - "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch MailChimp Forms by MailMunch allows Stored XSS.This issue affects MailChimp Forms by MailMunch: from n/a through 3.2.2.\n\n", + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch MailChimp Forms by MailMunch allows Stored XSS.This issue affects MailChimp Forms by MailMunch: from n/a through 3.2.2.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/unreviewed/2024/04/GHSA-wc9x-r2g7-vjwr/GHSA-wc9x-r2g7-vjwr.json b/advisories/unreviewed/2024/04/GHSA-wc9x-r2g7-vjwr/GHSA-wc9x-r2g7-vjwr.json index c4e59369f19..c7ee999a230 100644 --- a/advisories/unreviewed/2024/04/GHSA-wc9x-r2g7-vjwr/GHSA-wc9x-r2g7-vjwr.json +++ b/advisories/unreviewed/2024/04/GHSA-wc9x-r2g7-vjwr/GHSA-wc9x-r2g7-vjwr.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-wc9x-r2g7-vjwr", - "modified": "2024-04-07T18:30:30Z", + "modified": "2025-02-12T03:31:14Z", "published": "2024-04-07T18:30:30Z", "aliases": [ "CVE-2024-31349" ], - "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch MailMunch – Grow your Email List allows Stored XSS.This issue affects MailMunch – Grow your Email List: from n/a through 3.1.6.\n\n", + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch MailMunch – Grow your Email List allows Stored XSS.This issue affects MailMunch – Grow your Email List: from n/a through 3.1.6.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/unreviewed/2024/05/GHSA-gww7-xg42-6356/GHSA-gww7-xg42-6356.json b/advisories/unreviewed/2024/05/GHSA-gww7-xg42-6356/GHSA-gww7-xg42-6356.json index 665c17f4647..8ffc8058e73 100644 --- a/advisories/unreviewed/2024/05/GHSA-gww7-xg42-6356/GHSA-gww7-xg42-6356.json +++ b/advisories/unreviewed/2024/05/GHSA-gww7-xg42-6356/GHSA-gww7-xg42-6356.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-gww7-xg42-6356", - "modified": "2024-05-14T18:30:52Z", + "modified": "2025-02-12T03:31:14Z", "published": "2024-05-14T18:30:52Z", "aliases": [ "CVE-2024-3459" ], - "details": "KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF viewer. By using built-in functions of that viewer it is possible to launch a web browser, search through local files and, subsequently, launch any program with user privileges.\n\n", + "details": "KioWare for Windows (versions all through 8.34) allows to escape the environment by downloading PDF files, which then by default are opened in an external PDF viewer. By using built-in functions of that viewer it is possible to launch a web browser, search through local files and, subsequently, launch any program with user privileges.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/unreviewed/2024/05/GHSA-j7mf-5rmr-fgp9/GHSA-j7mf-5rmr-fgp9.json b/advisories/unreviewed/2024/05/GHSA-j7mf-5rmr-fgp9/GHSA-j7mf-5rmr-fgp9.json index fc6190ebfeb..2adad66d4d8 100644 --- a/advisories/unreviewed/2024/05/GHSA-j7mf-5rmr-fgp9/GHSA-j7mf-5rmr-fgp9.json +++ b/advisories/unreviewed/2024/05/GHSA-j7mf-5rmr-fgp9/GHSA-j7mf-5rmr-fgp9.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-j7mf-5rmr-fgp9", - "modified": "2024-05-08T12:30:33Z", + "modified": "2025-02-12T03:31:13Z", "published": "2024-05-08T12:30:33Z", "aliases": [ "CVE-2024-34566" ], - "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johan van der Wijk Content Blocks (Custom Post Widget) allows Stored XSS.This issue affects Content Blocks (Custom Post Widget): from n/a through 3.3.0.\n\n", + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johan van der Wijk Content Blocks (Custom Post Widget) allows Stored XSS.This issue affects Content Blocks (Custom Post Widget): from n/a through 3.3.0.", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/unreviewed/2025/01/GHSA-xh5q-pch5-g3xq/GHSA-xh5q-pch5-g3xq.json b/advisories/unreviewed/2025/01/GHSA-xh5q-pch5-g3xq/GHSA-xh5q-pch5-g3xq.json index a44d82d343d..ab55c9d9d64 100644 --- a/advisories/unreviewed/2025/01/GHSA-xh5q-pch5-g3xq/GHSA-xh5q-pch5-g3xq.json +++ b/advisories/unreviewed/2025/01/GHSA-xh5q-pch5-g3xq/GHSA-xh5q-pch5-g3xq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xh5q-pch5-g3xq", - "modified": "2025-02-11T12:30:53Z", + "modified": "2025-02-12T03:31:14Z", "published": "2025-01-14T18:32:00Z", "aliases": [ "CVE-2024-12085" @@ -21,55 +21,7 @@ }, { "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:0324" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:0325" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:0637" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:0688" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:0714" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:0774" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:0787" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:0790" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:0849" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:0884" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:0885" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/errata/RHSA-2025:1120" - }, - { - "type": "WEB", - "url": "https://access.redhat.com/security/cve/CVE-2024-12085" + "url": "https://kb.cert.org/vuls/id/952657" }, { "type": "WEB", @@ -77,7 +29,59 @@ }, { "type": "WEB", - "url": "https://kb.cert.org/vuls/id/952657" + "url": "https://access.redhat.com/security/cve/CVE-2024-12085" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:1123" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:1120" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0885" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0884" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0849" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0790" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0787" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0774" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0714" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0688" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0637" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0325" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0324" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/02/GHSA-4hmh-pm5p-9j7j/GHSA-4hmh-pm5p-9j7j.json b/advisories/unreviewed/2025/02/GHSA-4hmh-pm5p-9j7j/GHSA-4hmh-pm5p-9j7j.json new file mode 100644 index 00000000000..08c2ab49497 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-4hmh-pm5p-9j7j/GHSA-4hmh-pm5p-9j7j.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4hmh-pm5p-9j7j", + "modified": "2025-02-12T03:31:14Z", + "published": "2025-02-12T03:31:14Z", + "aliases": [ + "CVE-2025-23359" + ], + "details": "NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability when used with default configuration, where a crafted container image could gain access to the host file system. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23359" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5616" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-367" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-12T01:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-cx98-f2vw-wvr8/GHSA-cx98-f2vw-wvr8.json b/advisories/unreviewed/2025/02/GHSA-cx98-f2vw-wvr8/GHSA-cx98-f2vw-wvr8.json new file mode 100644 index 00000000000..2e1e059587a --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-cx98-f2vw-wvr8/GHSA-cx98-f2vw-wvr8.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cx98-f2vw-wvr8", + "modified": "2025-02-12T03:31:14Z", + "published": "2025-02-12T03:31:14Z", + "aliases": [ + "CVE-2024-0143" + ], + "details": "NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause an out-of-bounds write issue by means of a specially crafted JPEG2000 file. A successful exploit of this vulnerability might lead to code execution and data tampering.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0143" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5596" + }, + { + "type": "WEB", + "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2095" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-12T01:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-h2rf-rp8h-fq2p/GHSA-h2rf-rp8h-fq2p.json b/advisories/unreviewed/2025/02/GHSA-h2rf-rp8h-fq2p/GHSA-h2rf-rp8h-fq2p.json index 3ff79eeb6e4..566b7f67bac 100644 --- a/advisories/unreviewed/2025/02/GHSA-h2rf-rp8h-fq2p/GHSA-h2rf-rp8h-fq2p.json +++ b/advisories/unreviewed/2025/02/GHSA-h2rf-rp8h-fq2p/GHSA-h2rf-rp8h-fq2p.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-h2rf-rp8h-fq2p", - "modified": "2025-02-12T00:32:17Z", + "modified": "2025-02-12T03:31:14Z", "published": "2025-02-12T00:32:17Z", "aliases": [ "CVE-2024-0142" @@ -22,6 +22,10 @@ { "type": "WEB", "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5596" + }, + { + "type": "WEB", + "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2080" } ], "database_specific": { diff --git a/advisories/unreviewed/2025/02/GHSA-j238-93mq-hf2r/GHSA-j238-93mq-hf2r.json b/advisories/unreviewed/2025/02/GHSA-j238-93mq-hf2r/GHSA-j238-93mq-hf2r.json new file mode 100644 index 00000000000..dea6066357f --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-j238-93mq-hf2r/GHSA-j238-93mq-hf2r.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j238-93mq-hf2r", + "modified": "2025-02-12T03:31:14Z", + "published": "2025-02-12T03:31:14Z", + "aliases": [ + "CVE-2024-0145" + ], + "details": "NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause a heap-based buffer overflow issue by means of a specially crafted JPEG2000 file. A successful exploit of this vulnerability might lead to code execution and data tampering.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0145" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5596" + }, + { + "type": "WEB", + "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2108" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-122" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-12T01:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-j3fj-rfh9-7j99/GHSA-j3fj-rfh9-7j99.json b/advisories/unreviewed/2025/02/GHSA-j3fj-rfh9-7j99/GHSA-j3fj-rfh9-7j99.json new file mode 100644 index 00000000000..88873ea2f15 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-j3fj-rfh9-7j99/GHSA-j3fj-rfh9-7j99.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j3fj-rfh9-7j99", + "modified": "2025-02-12T03:31:14Z", + "published": "2025-02-12T03:31:14Z", + "aliases": [ + "CVE-2024-29172" + ], + "details": "Dell BSAFE SSL-J contains a deadlock vulnerability. A remote attacker could potentially exploit this vulnerability, leading to a Denial of Service.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29172" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-us/000226620/dsa-2024-221-security-update-for-dell-bsafe-ssl-j-multiple-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-833" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-12T02:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-pvrm-pgp5-5hc5/GHSA-pvrm-pgp5-5hc5.json b/advisories/unreviewed/2025/02/GHSA-pvrm-pgp5-5hc5/GHSA-pvrm-pgp5-5hc5.json new file mode 100644 index 00000000000..4facf8aa70d --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-pvrm-pgp5-5hc5/GHSA-pvrm-pgp5-5hc5.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pvrm-pgp5-5hc5", + "modified": "2025-02-12T03:31:14Z", + "published": "2025-02-12T03:31:14Z", + "aliases": [ + "CVE-2024-0144" + ], + "details": "NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause a buffer overflow issue by means of a specially crafted JPEG2000 file. A successful exploit of this vulnerability might lead to data tampering.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0144" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5596" + }, + { + "type": "WEB", + "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2113" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-120" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-12T01:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-q9w6-cwj4-gf4p/GHSA-q9w6-cwj4-gf4p.json b/advisories/unreviewed/2025/02/GHSA-q9w6-cwj4-gf4p/GHSA-q9w6-cwj4-gf4p.json new file mode 100644 index 00000000000..784cdb55a71 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-q9w6-cwj4-gf4p/GHSA-q9w6-cwj4-gf4p.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q9w6-cwj4-gf4p", + "modified": "2025-02-12T03:31:14Z", + "published": "2025-02-12T03:31:14Z", + "aliases": [ + "CVE-2025-1243" + ], + "details": "The Temporal api-go library prior to version 1.44.1 did not send `update response` information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the `update response` field not having Data Converter transformations (e.g. encryption) applied. This is an issue only when using the UpdateWorkflowExecution APIs (released on 13th January 2025) with a proxy leveraging the api-go library before version 1.44.1.\n\nOther data fields were correctly sent to Data Converter. This issue does not impact the Data Converter server. Data was encrypted in transit. Temporal Cloud services are not impacted.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1243" + }, + { + "type": "WEB", + "url": "https://github.com/temporalio/api-go/releases/tag/v1.44.1" + }, + { + "type": "WEB", + "url": "https://temporal.io/blog/announcing-a-new-operation-workflow-update" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-311" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-12T01:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-v48x-7rw7-7r74/GHSA-v48x-7rw7-7r74.json b/advisories/unreviewed/2025/02/GHSA-v48x-7rw7-7r74/GHSA-v48x-7rw7-7r74.json new file mode 100644 index 00000000000..214998a51d9 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-v48x-7rw7-7r74/GHSA-v48x-7rw7-7r74.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v48x-7rw7-7r74", + "modified": "2025-02-12T03:31:14Z", + "published": "2025-02-12T03:31:14Z", + "aliases": [ + "CVE-2024-53880" + ], + "details": "NVIDIA Triton Inference Server contains a vulnerability in the model loading API, where a user could cause an integer overflow or wraparound error by loading a model with an extra-large file size that overflows an internal variable. A successful exploit of this vulnerability might lead to denial of service.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53880" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5612" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-12T01:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-vjvq-7vfq-g7j9/GHSA-vjvq-7vfq-g7j9.json b/advisories/unreviewed/2025/02/GHSA-vjvq-7vfq-g7j9/GHSA-vjvq-7vfq-g7j9.json new file mode 100644 index 00000000000..1257d213b95 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-vjvq-7vfq-g7j9/GHSA-vjvq-7vfq-g7j9.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vjvq-7vfq-g7j9", + "modified": "2025-02-12T03:31:14Z", + "published": "2025-02-12T03:31:14Z", + "aliases": [ + "CVE-2024-29171" + ], + "details": "Dell BSAFE SSL-J contains an Improper certificate verification vulnerability. A remote attacker could potentially exploit this vulnerability, leading to information disclosure.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29171" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-us/000226620/dsa-2024-221-security-update-for-dell-bsafe-ssl-j-multiple-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-295" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-12T02:15:10Z" + } +} \ No newline at end of file