diff --git a/advisories/unreviewed/2024/04/GHSA-53r8-h9fr-mwc7/GHSA-53r8-h9fr-mwc7.json b/advisories/unreviewed/2024/04/GHSA-53r8-h9fr-mwc7/GHSA-53r8-h9fr-mwc7.json index ff7d3bd8e04..9f97be74660 100644 --- a/advisories/unreviewed/2024/04/GHSA-53r8-h9fr-mwc7/GHSA-53r8-h9fr-mwc7.json +++ b/advisories/unreviewed/2024/04/GHSA-53r8-h9fr-mwc7/GHSA-53r8-h9fr-mwc7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-53r8-h9fr-mwc7", - "modified": "2024-05-16T21:31:56Z", + "modified": "2025-01-23T15:31:05Z", "published": "2024-04-12T15:37:21Z", "aliases": [ "CVE-2024-21590" @@ -11,6 +11,10 @@ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], "affected": [], diff --git a/advisories/unreviewed/2025/01/GHSA-2885-grqh-2673/GHSA-2885-grqh-2673.json b/advisories/unreviewed/2025/01/GHSA-2885-grqh-2673/GHSA-2885-grqh-2673.json new file mode 100644 index 00000000000..4969c9e13a0 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-2885-grqh-2673/GHSA-2885-grqh-2673.json @@ -0,0 +1,45 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2885-grqh-2673", + "modified": "2025-01-23T15:31:06Z", + "published": "2025-01-23T15:31:05Z", + "aliases": [ + "CVE-2024-57947" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_set_pipapo: fix initial map fill\n\nThe initial buffer has to be inited to all-ones, but it must restrict\nit to the size of the first field, not the total field size.\n\nAfter each round in the map search step, the result and the fill map\nare swapped, so if we have a set where f->bsize of the first element\nis smaller than m->bsize_max, those one-bits are leaked into future\nrounds result map.\n\nThis makes pipapo find an incorrect matching results for sets where\nfirst field size is not the largest.\n\nFollowup patch adds a test case to nft_concat_range.sh selftest script.\n\nThanks to Stefano Brivio for pointing out that we need to zero out\nthe remainder explicitly, only correcting memset() argument isn't enough.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57947" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/69b6a67f7052905e928d75a0c5871de50e686986" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/791a615b7ad2258c560f91852be54b0480837c93" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8058c88ac0df21239daee54b5934d5c80ca9685f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/957a4d1c4c5849e4515c9fb4db21bf85318103dc" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9625c46ce6fd4f922595a4b32b1de5066d70464f" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-23T14:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-349j-h89q-vvpp/GHSA-349j-h89q-vvpp.json b/advisories/unreviewed/2025/01/GHSA-349j-h89q-vvpp/GHSA-349j-h89q-vvpp.json index 0a3442ac5a9..1ae6e4c5676 100644 --- a/advisories/unreviewed/2025/01/GHSA-349j-h89q-vvpp/GHSA-349j-h89q-vvpp.json +++ b/advisories/unreviewed/2025/01/GHSA-349j-h89q-vvpp/GHSA-349j-h89q-vvpp.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-349j-h89q-vvpp", - "modified": "2025-01-22T00:33:38Z", + "modified": "2025-01-23T15:31:05Z", "published": "2025-01-22T00:33:38Z", "aliases": [ "CVE-2023-37039" ], "details": "A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allow network-adjacent attackers to crash the MME via an S1AP `Initial UE Message` packet missing an expected `RRC Establishment Clause` field.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-22T00:15:15Z" diff --git a/advisories/unreviewed/2025/01/GHSA-3gcr-cppr-2cjh/GHSA-3gcr-cppr-2cjh.json b/advisories/unreviewed/2025/01/GHSA-3gcr-cppr-2cjh/GHSA-3gcr-cppr-2cjh.json index 88d9b225af6..3fb3af98b67 100644 --- a/advisories/unreviewed/2025/01/GHSA-3gcr-cppr-2cjh/GHSA-3gcr-cppr-2cjh.json +++ b/advisories/unreviewed/2025/01/GHSA-3gcr-cppr-2cjh/GHSA-3gcr-cppr-2cjh.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-3gcr-cppr-2cjh", - "modified": "2025-01-22T00:33:37Z", + "modified": "2025-01-23T15:31:05Z", "published": "2025-01-22T00:33:37Z", "aliases": [ "CVE-2023-37037" ], "details": "A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP `S1Setup Request` packet missing an expected `Supported TAs` field.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-21T23:15:11Z" diff --git a/advisories/unreviewed/2025/01/GHSA-4cxp-jj37-cmrx/GHSA-4cxp-jj37-cmrx.json b/advisories/unreviewed/2025/01/GHSA-4cxp-jj37-cmrx/GHSA-4cxp-jj37-cmrx.json index 45c28dddace..98913c804ca 100644 --- a/advisories/unreviewed/2025/01/GHSA-4cxp-jj37-cmrx/GHSA-4cxp-jj37-cmrx.json +++ b/advisories/unreviewed/2025/01/GHSA-4cxp-jj37-cmrx/GHSA-4cxp-jj37-cmrx.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-4cxp-jj37-cmrx", - "modified": "2025-01-22T00:33:37Z", + "modified": "2025-01-23T15:31:05Z", "published": "2025-01-22T00:33:37Z", "aliases": [ "CVE-2023-37033" ], "details": "A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP `Initial UE Message` packet missing an expected `EUTRAN_CGI` field.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-21T23:15:10Z" diff --git a/advisories/unreviewed/2025/01/GHSA-57r3-2prp-v2xh/GHSA-57r3-2prp-v2xh.json b/advisories/unreviewed/2025/01/GHSA-57r3-2prp-v2xh/GHSA-57r3-2prp-v2xh.json index ec951406cbc..1f17e3cf1d1 100644 --- a/advisories/unreviewed/2025/01/GHSA-57r3-2prp-v2xh/GHSA-57r3-2prp-v2xh.json +++ b/advisories/unreviewed/2025/01/GHSA-57r3-2prp-v2xh/GHSA-57r3-2prp-v2xh.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-57r3-2prp-v2xh", - "modified": "2025-01-23T12:32:36Z", + "modified": "2025-01-23T15:31:05Z", "published": "2025-01-23T12:32:36Z", "aliases": [ "CVE-2025-23006" ], "details": "Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-502" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-23T12:15:28Z" diff --git a/advisories/unreviewed/2025/01/GHSA-59g5-45q9-9v67/GHSA-59g5-45q9-9v67.json b/advisories/unreviewed/2025/01/GHSA-59g5-45q9-9v67/GHSA-59g5-45q9-9v67.json index 855074d51f4..2ef3d3797e3 100644 --- a/advisories/unreviewed/2025/01/GHSA-59g5-45q9-9v67/GHSA-59g5-45q9-9v67.json +++ b/advisories/unreviewed/2025/01/GHSA-59g5-45q9-9v67/GHSA-59g5-45q9-9v67.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-59g5-45q9-9v67", - "modified": "2025-01-22T00:33:37Z", + "modified": "2025-01-23T15:31:05Z", "published": "2025-01-22T00:33:37Z", "aliases": [ "CVE-2023-37036" ], "details": "A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP `Uplink NAS Transport` packet missing an expected `ENB_UE_S1AP_ID` field.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-21T23:15:10Z" diff --git a/advisories/unreviewed/2025/01/GHSA-9wwx-4j35-8876/GHSA-9wwx-4j35-8876.json b/advisories/unreviewed/2025/01/GHSA-9wwx-4j35-8876/GHSA-9wwx-4j35-8876.json index 8fde571f586..d829c7790cd 100644 --- a/advisories/unreviewed/2025/01/GHSA-9wwx-4j35-8876/GHSA-9wwx-4j35-8876.json +++ b/advisories/unreviewed/2025/01/GHSA-9wwx-4j35-8876/GHSA-9wwx-4j35-8876.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-9wwx-4j35-8876", - "modified": "2025-01-22T00:33:37Z", + "modified": "2025-01-23T15:31:05Z", "published": "2025-01-22T00:33:37Z", "aliases": [ "CVE-2023-37038" ], "details": "A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP `Uplink NAS Transport` packet missing an expected `MME_UE_S1AP_ID` field.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-21T23:15:11Z" diff --git a/advisories/unreviewed/2025/01/GHSA-g2f8-6mgf-93j8/GHSA-g2f8-6mgf-93j8.json b/advisories/unreviewed/2025/01/GHSA-g2f8-6mgf-93j8/GHSA-g2f8-6mgf-93j8.json index 0b22700a7fb..5ddd95b609c 100644 --- a/advisories/unreviewed/2025/01/GHSA-g2f8-6mgf-93j8/GHSA-g2f8-6mgf-93j8.json +++ b/advisories/unreviewed/2025/01/GHSA-g2f8-6mgf-93j8/GHSA-g2f8-6mgf-93j8.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-g2f8-6mgf-93j8", - "modified": "2025-01-23T03:30:53Z", + "modified": "2025-01-23T15:31:05Z", "published": "2025-01-23T03:30:53Z", "aliases": [ "CVE-2024-57720" ], "details": "lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -25,7 +30,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-23T01:15:26Z" diff --git a/advisories/unreviewed/2025/01/GHSA-h996-qwxw-wv3x/GHSA-h996-qwxw-wv3x.json b/advisories/unreviewed/2025/01/GHSA-h996-qwxw-wv3x/GHSA-h996-qwxw-wv3x.json index d00126335a8..81a37a2fe4d 100644 --- a/advisories/unreviewed/2025/01/GHSA-h996-qwxw-wv3x/GHSA-h996-qwxw-wv3x.json +++ b/advisories/unreviewed/2025/01/GHSA-h996-qwxw-wv3x/GHSA-h996-qwxw-wv3x.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-h996-qwxw-wv3x", - "modified": "2025-01-23T03:30:53Z", + "modified": "2025-01-23T15:31:05Z", "published": "2025-01-23T03:30:53Z", "aliases": [ "CVE-2024-57722" ], "details": "lunasvg v3.0.0 was discovered to contain a allocation-size-too-big bug via the component plutovg_surface_create.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -25,7 +30,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-23T01:15:27Z" diff --git a/advisories/unreviewed/2025/01/GHSA-j4xx-w4mr-c7vc/GHSA-j4xx-w4mr-c7vc.json b/advisories/unreviewed/2025/01/GHSA-j4xx-w4mr-c7vc/GHSA-j4xx-w4mr-c7vc.json index b07bbe3bfd7..6dec2bd5f03 100644 --- a/advisories/unreviewed/2025/01/GHSA-j4xx-w4mr-c7vc/GHSA-j4xx-w4mr-c7vc.json +++ b/advisories/unreviewed/2025/01/GHSA-j4xx-w4mr-c7vc/GHSA-j4xx-w4mr-c7vc.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-j4xx-w4mr-c7vc", - "modified": "2025-01-22T00:33:37Z", + "modified": "2025-01-23T15:31:05Z", "published": "2025-01-22T00:33:37Z", "aliases": [ "CVE-2023-37034" ], "details": "A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP `Initial UE Message` packet missing an expected `TAI` field.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-21T23:15:10Z" diff --git a/advisories/unreviewed/2025/01/GHSA-mx53-8x3c-jgqv/GHSA-mx53-8x3c-jgqv.json b/advisories/unreviewed/2025/01/GHSA-mx53-8x3c-jgqv/GHSA-mx53-8x3c-jgqv.json index 397ba120097..f4e7d4ff930 100644 --- a/advisories/unreviewed/2025/01/GHSA-mx53-8x3c-jgqv/GHSA-mx53-8x3c-jgqv.json +++ b/advisories/unreviewed/2025/01/GHSA-mx53-8x3c-jgqv/GHSA-mx53-8x3c-jgqv.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-mx53-8x3c-jgqv", - "modified": "2025-01-22T15:32:35Z", + "modified": "2025-01-23T15:31:05Z", "published": "2025-01-22T15:32:35Z", "aliases": [ "CVE-2023-37022" ], "details": "Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `UE Context Release Request` packet handler. A packet containing an invalid `MME_UE_S1AP_ID` field causes Open5gs to crash; an attacker may repeatedly send such packets to cause denial of service.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-770" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-22T15:15:11Z" diff --git a/advisories/unreviewed/2025/01/GHSA-pqj9-qcr7-74fh/GHSA-pqj9-qcr7-74fh.json b/advisories/unreviewed/2025/01/GHSA-pqj9-qcr7-74fh/GHSA-pqj9-qcr7-74fh.json index ecdc45cadcc..f92487b526e 100644 --- a/advisories/unreviewed/2025/01/GHSA-pqj9-qcr7-74fh/GHSA-pqj9-qcr7-74fh.json +++ b/advisories/unreviewed/2025/01/GHSA-pqj9-qcr7-74fh/GHSA-pqj9-qcr7-74fh.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-pqj9-qcr7-74fh", - "modified": "2025-01-22T15:32:35Z", + "modified": "2025-01-23T15:31:05Z", "published": "2025-01-22T15:32:35Z", "aliases": [ "CVE-2023-37014" ], "details": "Open5GS MME versions <= 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a `UE Context Release Request` message missing a required `MME_UE_S1AP_ID` field to repeatedly crash the MME, resulting in denial of service.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-770" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-22T15:15:10Z" diff --git a/advisories/unreviewed/2025/01/GHSA-q7x4-x9mc-mw9f/GHSA-q7x4-x9mc-mw9f.json b/advisories/unreviewed/2025/01/GHSA-q7x4-x9mc-mw9f/GHSA-q7x4-x9mc-mw9f.json index ea1dc01a668..0202593c5ee 100644 --- a/advisories/unreviewed/2025/01/GHSA-q7x4-x9mc-mw9f/GHSA-q7x4-x9mc-mw9f.json +++ b/advisories/unreviewed/2025/01/GHSA-q7x4-x9mc-mw9f/GHSA-q7x4-x9mc-mw9f.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-q7x4-x9mc-mw9f", - "modified": "2025-01-23T03:30:53Z", + "modified": "2025-01-23T15:31:05Z", "published": "2025-01-23T03:30:53Z", "aliases": [ "CVE-2024-57721" ], "details": "lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -25,7 +30,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-23T01:15:26Z" diff --git a/advisories/unreviewed/2025/01/GHSA-r8vg-fpvm-r7hh/GHSA-r8vg-fpvm-r7hh.json b/advisories/unreviewed/2025/01/GHSA-r8vg-fpvm-r7hh/GHSA-r8vg-fpvm-r7hh.json index 32a917e229c..724aeb9aa1d 100644 --- a/advisories/unreviewed/2025/01/GHSA-r8vg-fpvm-r7hh/GHSA-r8vg-fpvm-r7hh.json +++ b/advisories/unreviewed/2025/01/GHSA-r8vg-fpvm-r7hh/GHSA-r8vg-fpvm-r7hh.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-r8vg-fpvm-r7hh", - "modified": "2025-01-23T03:30:53Z", + "modified": "2025-01-23T15:31:05Z", "published": "2025-01-23T03:30:53Z", "aliases": [ "CVE-2024-57719" ], "details": "lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_argb.isra.0.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -25,7 +30,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-23T01:15:26Z" diff --git a/advisories/unreviewed/2025/01/GHSA-v5qf-vx9f-h34f/GHSA-v5qf-vx9f-h34f.json b/advisories/unreviewed/2025/01/GHSA-v5qf-vx9f-h34f/GHSA-v5qf-vx9f-h34f.json index 86f6e3c462f..99bc861e5d5 100644 --- a/advisories/unreviewed/2025/01/GHSA-v5qf-vx9f-h34f/GHSA-v5qf-vx9f-h34f.json +++ b/advisories/unreviewed/2025/01/GHSA-v5qf-vx9f-h34f/GHSA-v5qf-vx9f-h34f.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-v5qf-vx9f-h34f", - "modified": "2025-01-23T03:30:54Z", + "modified": "2025-01-23T15:31:05Z", "published": "2025-01-23T03:30:54Z", "aliases": [ "CVE-2024-57723" ], "details": "lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -25,7 +30,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-23T01:15:27Z" diff --git a/advisories/unreviewed/2025/01/GHSA-w57r-3v9h-hq4v/GHSA-w57r-3v9h-hq4v.json b/advisories/unreviewed/2025/01/GHSA-w57r-3v9h-hq4v/GHSA-w57r-3v9h-hq4v.json index 01d66a17f58..32480dcc47f 100644 --- a/advisories/unreviewed/2025/01/GHSA-w57r-3v9h-hq4v/GHSA-w57r-3v9h-hq4v.json +++ b/advisories/unreviewed/2025/01/GHSA-w57r-3v9h-hq4v/GHSA-w57r-3v9h-hq4v.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-w57r-3v9h-hq4v", - "modified": "2025-01-23T03:30:54Z", + "modified": "2025-01-23T15:31:05Z", "published": "2025-01-23T03:30:54Z", "aliases": [ "CVE-2024-57724" ], "details": "lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -25,7 +30,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-23T01:15:27Z" diff --git a/advisories/unreviewed/2025/01/GHSA-wx4c-v69w-275w/GHSA-wx4c-v69w-275w.json b/advisories/unreviewed/2025/01/GHSA-wx4c-v69w-275w/GHSA-wx4c-v69w-275w.json new file mode 100644 index 00000000000..4e1e6d797ef --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-wx4c-v69w-275w/GHSA-wx4c-v69w-275w.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wx4c-v69w-275w", + "modified": "2025-01-23T15:31:05Z", + "published": "2025-01-23T15:31:05Z", + "aliases": [ + "CVE-2024-10539" + ], + "details": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uyumsoft Informatin Systems Uyumsoft ERP allows XSS Using Invalid Characters, Reflected XSS.This issue affects Uyumsoft ERP: before Erp4.2109.166p45.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10539" + }, + { + "type": "WEB", + "url": "https://www.usom.gov.tr/bildirim/tr-25-0017" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-23T14:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-xr87-g5hr-3m8h/GHSA-xr87-g5hr-3m8h.json b/advisories/unreviewed/2025/01/GHSA-xr87-g5hr-3m8h/GHSA-xr87-g5hr-3m8h.json index b6d5eb72491..4ca6ac1dcf8 100644 --- a/advisories/unreviewed/2025/01/GHSA-xr87-g5hr-3m8h/GHSA-xr87-g5hr-3m8h.json +++ b/advisories/unreviewed/2025/01/GHSA-xr87-g5hr-3m8h/GHSA-xr87-g5hr-3m8h.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-xr87-g5hr-3m8h", - "modified": "2025-01-22T18:31:56Z", + "modified": "2025-01-23T15:31:05Z", "published": "2025-01-22T18:31:56Z", "aliases": [ "CVE-2024-55957" ], "details": "In Thermo Fisher Scientific Xcalibur before 4.7 SP1 and Thermo Foundation Instrument Control Software (ICSW) before 3.1 SP10, the driver packages have a local privilege escalation vulnerability due to improper access control permissions on Windows systems.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-863" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-22T18:15:20Z"