netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-01-30 15:31:46 +00:00
parent bb654b5549
commit 9071fc3e0e
33 changed files with 800 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2023/12/GHSA-j5jm-hg4x-w8rx/GHSA-j5jm-hg4x-w8rx.json
+4
View File
@@ -41,6 +41,10 @@
"type": "WEB",
"url": "https://github.com/eeenvik1/CVE-2023-51764"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00020.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JQ5WXFCW2N6G2PH3JXDTYW5PH5EBQEGO/"
advisories/unreviewed/2024/01/GHSA-33f3-88p6-j3f9/GHSA-33f3-88p6-j3f9.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-33f3-88p6-j3f9",
"modified": "2024-01-30T15:30:22Z",
"published": "2024-01-30T15:30:22Z",
"aliases": [
"CVE-2024-24324"
],
"details": "TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24324"
},
{
"type": "WEB",
"url": "https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A8000RU/TOTOlink%20A8000RU%20hard%20code.md"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-30T15:15:09Z"
}
}
advisories/unreviewed/2024/01/GHSA-3gqv-8h4q-fff4/GHSA-3gqv-8h4q-fff4.json
+2 -1
View File
@@ -28,7 +28,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-277"
"CWE-277",
"CWE-732"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2024/01/GHSA-3qmj-w5mh-5gv3/GHSA-3qmj-w5mh-5gv3.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3qmj-w5mh-5gv3",
"modified": "2024-01-30T15:30:23Z",
"published": "2024-01-30T15:30:23Z",
"aliases": [
"CVE-2024-24329"
],
"details": "TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules function.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24329"
},
{
"type": "WEB",
"url": "https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/10/TOTOlink%20A3300R%20setPortForwardRules.md"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-30T15:15:09Z"
}
}
advisories/unreviewed/2024/01/GHSA-4mwf-4888-4x35/GHSA-4mwf-4888-4x35.json
+8
View File
@@ -36,6 +36,14 @@
{
"type": "WEB",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1031"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/01/30/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/01/30/4"
}
],
"database_specific": {
advisories/unreviewed/2024/01/GHSA-4q7q-5p3p-5fcj/GHSA-4q7q-5p3p-5fcj.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4q7q-5p3p-5fcj",
"modified": "2024-01-30T15:30:23Z",
"published": "2024-01-30T15:30:23Z",
"aliases": [
"CVE-2024-24328"
],
"details": "TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFilterRules function.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24328"
},
{
"type": "WEB",
"url": "https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/12/TOTOlink%20A3300R%20setMacFilterRules.md"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-30T15:15:09Z"
}
}
advisories/unreviewed/2024/01/GHSA-4q9c-68c7-fxff/GHSA-4q9c-68c7-fxff.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4q9c-68c7-fxff",
"modified": "2024-01-30T15:30:23Z",
"published": "2024-01-30T15:30:23Z",
"aliases": [
"CVE-2024-24327"
],
"details": "TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pppoePass parameter in the setIpv6Cfg function.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24327"
},
{
"type": "WEB",
"url": "https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/7/TOTOlink%20A3300R%20setIpv6Cfg.md"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-30T15:15:09Z"
}
}
advisories/unreviewed/2024/01/GHSA-54p6-86fq-2pg8/GHSA-54p6-86fq-2pg8.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-54p6-86fq-2pg8",
"modified": "2024-01-30T15:30:22Z",
"published": "2024-01-30T15:30:22Z",
"aliases": [
"CVE-2024-0674"
],
"details": "Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local user to acquire root permissions by modifying the updatescript.js, inserting special code inside the script and creating the done.txt file. This would cause the watchdog process to run as root and execute the payload stored in the updatescript.js.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0674"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-lamassu-bitcoin-atm-douro-machines"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-30T13:15:08Z"
}
}
advisories/unreviewed/2024/01/GHSA-597m-g6ch-mrf9/GHSA-597m-g6ch-mrf9.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-597m-g6ch-mrf9",
"modified": "2024-01-30T15:30:22Z",
"published": "2024-01-30T15:30:22Z",
"aliases": [
"CVE-2024-0676"
],
"details": "Weak password requirement vulnerability \n\nin Lamassu Bitcoin ATM Douro machines, in its 7.1 version\n\n, which allows a local user to interact with the machine where the application is installed, retrieve stored hashes from the machine and crack long 4-character passwords using a dictionary attack.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0676"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-lamassu-bitcoin-atm-douro-machines"
}
],
"database_specific": {
"cwe_ids": [
"CWE-521"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-30T13:15:08Z"
}
}
advisories/unreviewed/2024/01/GHSA-5m9g-m2vj-47r4/GHSA-5m9g-m2vj-47r4.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5m9g-m2vj-47r4",
"modified": "2024-01-30T15:30:22Z",
"published": "2024-01-30T15:30:22Z",
"aliases": [
"CVE-2024-0564"
],
"details": "A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (KSM), added in Linux kernel version 4.4.0-96.119, can create a side channel. When the attacker and the victim share the same host and the default setting of KSM is \"max page sharing=256\", it is possible for the attacker to time the unmap to merge with the victim's page. The unmapping time depends on whether it merges with the victim's page and additional physical pages are created beyond the KSM's \"max page share\". Through these operations, the attacker can leak the victim's page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0564"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-0564"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1680513"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258514"
},
{
"type": "WEB",
"url": "https://link.springer.com/conference/wisa"
},
{
"type": "WEB",
"url": "https://wisa.or.kr/accepted"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-30T15:15:08Z"
}
}
advisories/unreviewed/2024/01/GHSA-5mh9-hrrq-46qr/GHSA-5mh9-hrrq-46qr.json
+46
View File
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5mh9-hrrq-46qr",
"modified": "2024-01-30T15:30:22Z",
"published": "2024-01-30T15:30:22Z",
"aliases": [
"CVE-2024-1032"
],
"details": "A vulnerability classified as critical was found in openBI up to 1.0.8. Affected by this vulnerability is the function testConnection of the file /application/index/controller/Databasesource.php of the component Test Connection Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252307.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1032"
},
{
"type": "WEB",
"url": "https://note.zhaoj.in/share/6ISYe2urjlkI"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.252307"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.252307"
}
],
"database_specific": {
"cwe_ids": [
"CWE-502"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-30T14:15:47Z"
}
}
advisories/unreviewed/2024/01/GHSA-7j85-cwr3-f2w3/GHSA-7j85-cwr3-f2w3.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7j85-cwr3-f2w3",
"modified": "2024-01-30T15:30:23Z",
"published": "2024-01-30T15:30:23Z",
"aliases": [
"CVE-2024-24332"
],
"details": "TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilterRules function.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24332"
},
{
"type": "WEB",
"url": "https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/9/TOTOlink%20A3300R%20setUrlFilterRules.md"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-30T15:15:09Z"
}
}
advisories/unreviewed/2024/01/GHSA-93px-8x98-j7p2/GHSA-93px-8x98-j7p2.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-93px-8x98-j7p2",
"modified": "2024-01-23T03:31:08Z",
"modified": "2024-01-30T15:30:22Z",
"published": "2024-01-23T03:31:08Z",
"aliases": [
"CVE-2024-23222"
],
"details": "A type confusion issue was addressed with improved checks. This issue is fixed in tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, Safari 17.3, macOS Ventura 13.6.4, macOS Monterey 12.7.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -77,9 +80,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-843"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-23T01:15:11Z"
advisories/unreviewed/2024/01/GHSA-9mw7-8x3h-gcqc/GHSA-9mw7-8x3h-gcqc.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9mw7-8x3h-gcqc",
"modified": "2024-01-16T18:31:09Z",
"modified": "2024-01-30T15:30:20Z",
"published": "2024-01-16T18:31:09Z",
"aliases": [
"CVE-2023-3771"
],
"details": "The T1 WordPress theme through 19.0 is vulnerable to unauthenticated open redirect with which any attacker and redirect users to arbitrary websites.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-16T16:15:11Z"
advisories/unreviewed/2024/01/GHSA-c6mw-5fmv-25qx/GHSA-c6mw-5fmv-25qx.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c6mw-5fmv-25qx",
"modified": "2024-01-23T03:31:08Z",
"modified": "2024-01-30T15:30:21Z",
"published": "2024-01-23T03:31:08Z",
"aliases": [
"CVE-2024-23219"
],
"details": "The issue was addressed with improved authentication. This issue is fixed in iOS 17.3 and iPadOS 17.3. Stolen Device Protection may be unexpectedly disabled.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-23T01:15:11Z"
advisories/unreviewed/2024/01/GHSA-c978-j9mm-m34q/GHSA-c978-j9mm-m34q.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c978-j9mm-m34q",
"modified": "2024-01-16T21:31:21Z",
"modified": "2024-01-30T15:30:20Z",
"published": "2024-01-16T21:31:21Z",
"aliases": [
"CVE-2023-49351"
],
"details": "A stack-based buffer overflow vulnerability in /bin/webs binary in Edimax BR6478AC V2 firmware veraion v1.23 allows attackers to overwrite other values located on the stack due to an incorrect use of the strcpy() function.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-16T19:15:08Z"
advisories/unreviewed/2024/01/GHSA-f63q-6c68-mrcx/GHSA-f63q-6c68-mrcx.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f63q-6c68-mrcx",
"modified": "2024-01-16T18:31:11Z",
"modified": "2024-01-30T15:30:20Z",
"published": "2024-01-16T18:31:11Z",
"aliases": [
"CVE-2024-23347"
],
"details": "Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of that project. Those scripts would have the ability to execute arbitrary code on the system as the application.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-16T18:15:11Z"
advisories/unreviewed/2024/01/GHSA-ff22-5jp8-224r/GHSA-ff22-5jp8-224r.json
+8
View File
@@ -56,6 +56,14 @@
{
"type": "WEB",
"url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1035"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/01/30/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/01/30/4"
}
],
"database_specific": {
advisories/unreviewed/2024/01/GHSA-fgx5-x337-5fv2/GHSA-fgx5-x337-5fv2.json
+46
View File
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fgx5-x337-5fv2",
"modified": "2024-01-30T15:30:22Z",
"published": "2024-01-30T15:30:22Z",
"aliases": [
"CVE-2024-1034"
],
"details": "A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadFile of the file /application/index/controller/File.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252309 was assigned to this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1034"
},
{
"type": "WEB",
"url": "https://note.zhaoj.in/share/ABYkFE4wRPW5"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.252309"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.252309"
}
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-30T15:15:08Z"
}
}
advisories/unreviewed/2024/01/GHSA-g2f8-pfg4-3w3q/GHSA-g2f8-pfg4-3w3q.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g2f8-pfg4-3w3q",
"modified": "2024-01-30T15:30:23Z",
"published": "2024-01-30T15:30:23Z",
"aliases": [
"CVE-2024-24331"
],
"details": "TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setWiFiScheduleCfg function.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24331"
},
{
"type": "WEB",
"url": "https://github.com/funny-mud-peee/IoT-vuls/blob/main/TOTOLINK%20A3300R/13/TOTOlink%20A3300R%20setWiFiScheduleCfg.md"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-30T15:15:09Z"
}
}

Some files were not shown because too many files have changed in this diff Show More