mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Advisory Database Sync
This commit is contained in:
advisory-database[bot]
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-6f9g-cxwr-q5jr",
|
||||
"modified": "2024-08-20T18:00:42Z",
|
||||
"modified": "2024-12-20T18:32:22Z",
|
||||
"published": "2024-01-24T18:31:02Z",
|
||||
"aliases": [
|
||||
"CVE-2024-23897"
|
||||
@@ -108,6 +108,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.vicarius.io/vsociety/posts/the-anatomy-of-a-jenkins-vulnerability-cve-2024-23897-revealed-1"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://packetstormsecurity.com/files/176839/Jenkins-2.441-LTS-2.426.3-CVE-2024-23897-Scanner.html"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-87j2-5g9j-7jmv",
|
||||
"modified": "2024-07-03T18:33:10Z",
|
||||
"modified": "2024-12-20T18:31:28Z",
|
||||
"published": "2023-10-25T18:32:21Z",
|
||||
"aliases": [
|
||||
"CVE-2023-34048"
|
||||
@@ -19,6 +19,10 @@
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34048"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.vicarius.io/vsociety/posts/understanding-cve-2023-34048-a-zero-day-out-of-bound-write-in-vcenter-server"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.vmware.com/security/advisories/VMSA-2023-0023.html"
|
||||
|
||||
@@ -1,13 +1,18 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2252-87pv-34g4",
|
||||
"modified": "2024-06-27T15:30:38Z",
|
||||
"modified": "2024-12-20T18:31:29Z",
|
||||
"published": "2024-04-04T09:30:36Z",
|
||||
"aliases": [
|
||||
"CVE-2024-26801"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: Avoid potential use-after-free in hci_error_reset\n\nWhile handling the HCI_EV_HARDWARE_ERROR event, if the underlying\nBT controller is not responding, the GPIO reset mechanism would\nfree the hci_dev and lead to a use-after-free in hci_error_reset.\n\nHere's the call trace observed on a ChromeOS device with Intel AX201:\n queue_work_on+0x3e/0x6c\n __hci_cmd_sync_sk+0x2ee/0x4c0 [bluetooth <HASH:3b4a6>]\n ? init_wait_entry+0x31/0x31\n __hci_cmd_sync+0x16/0x20 [bluetooth <HASH:3b4a 6>]\n hci_error_reset+0x4f/0xa4 [bluetooth <HASH:3b4a 6>]\n process_one_work+0x1d8/0x33f\n worker_thread+0x21b/0x373\n kthread+0x13a/0x152\n ? pr_cont_work+0x54/0x54\n ? kthread_blkcg+0x31/0x31\n ret_from_fork+0x1f/0x30\n\nThis patch holds the reference count on the hci_dev while processing\na HCI_EV_HARDWARE_ERROR event to avoid potential crash.",
|
||||
"severity": [],
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
@@ -56,8 +61,10 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"cwe_ids": [
|
||||
"CWE-416"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-04-04T09:15:09Z"
|
||||
|
||||
File diff suppressed because one or more lines are too long
File diff suppressed because one or more lines are too long
@@ -1,13 +1,18 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-q4hp-86wf-hj44",
|
||||
"modified": "2024-04-04T15:30:34Z",
|
||||
"modified": "2024-12-20T18:31:29Z",
|
||||
"published": "2024-04-04T09:30:36Z",
|
||||
"aliases": [
|
||||
"CVE-2024-26800"
|
||||
],
|
||||
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix use-after-free on failed backlog decryption\n\nWhen the decrypt request goes to the backlog and crypto_aead_decrypt\nreturns -EBUSY, tls_do_decryption will wait until all async\ndecryptions have completed. If one of them fails, tls_do_decryption\nwill return -EBADMSG and tls_decrypt_sg jumps to the error path,\nreleasing all the pages. But the pages have been passed to the async\ncallback, and have already been released by tls_decrypt_done.\n\nThe only true async case is when crypto_aead_decrypt returns\n -EINPROGRESS. With -EBUSY, we already waited so we can tell\ntls_sw_recvmsg that the data is available for immediate copy, but we\nneed to notify tls_decrypt_sg (via the new ->async_done flag) that the\nmemory has already been released.",
|
||||
"severity": [],
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
@@ -32,8 +37,10 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"cwe_ids": [
|
||||
"CWE-416"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-04-04T09:15:09Z"
|
||||
|
||||
@@ -49,7 +49,9 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"cwe_ids": [
|
||||
"CWE-416"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
|
||||
@@ -38,7 +38,8 @@
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-122"
|
||||
"CWE-122",
|
||||
"CWE-787"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-gp2r-34c8-48xq",
|
||||
"modified": "2024-08-06T15:30:50Z",
|
||||
"modified": "2024-12-20T18:31:30Z",
|
||||
"published": "2024-08-05T09:30:26Z",
|
||||
"aliases": [
|
||||
"CVE-2024-38856"
|
||||
@@ -34,6 +34,10 @@
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://ofbiz.apache.org/security.html"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2024/08/04/1"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-c76v-gjqc-j462",
|
||||
"modified": "2024-09-07T18:30:24Z",
|
||||
"modified": "2024-12-20T18:31:30Z",
|
||||
"published": "2024-09-07T18:30:24Z",
|
||||
"aliases": [
|
||||
"CVE-2024-40711"
|
||||
@@ -19,6 +19,10 @@
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40711"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.veeam.com/kb4649"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-fr4c-ch83-r968",
|
||||
"modified": "2024-10-22T21:30:36Z",
|
||||
"modified": "2024-12-20T18:31:30Z",
|
||||
"published": "2024-10-03T00:30:41Z",
|
||||
"aliases": [
|
||||
"CVE-2024-45519"
|
||||
@@ -19,6 +19,10 @@
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45519"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://blog.projectdiscovery.io/zimbra-remote-code-execution"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://wiki.zimbra.com/wiki/Security_Center"
|
||||
|
||||
@@ -30,7 +30,8 @@
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-122"
|
||||
"CWE-122",
|
||||
"CWE-787"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
|
||||
@@ -30,7 +30,8 @@
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-122"
|
||||
"CWE-122",
|
||||
"CWE-787"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-27hp-xhwr-wr2m",
|
||||
"modified": "2024-12-20T18:31:32Z",
|
||||
"published": "2024-12-20T18:31:32Z",
|
||||
"aliases": [
|
||||
"CVE-2024-56337"
|
||||
],
|
||||
"details": "Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.\n\nThe mitigation for CVE-2024-50379 was incomplete.\n\nUsers running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation \nparameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat:\n- running on Java 8 or Java 11: the system property sun.io.useCanonCaches must be explicitly set to false (it defaults to true)\n- running on Java 17: the system property sun.io.useCanonCaches, if set, must be set to false (it defaults to false)\n- running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed)\n\nTomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that sun.io.useCanonCaches is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set sun.io.useCanonCaches to false by default where it can.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56337"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.cve.org/CVERecord?id=CVE-2024-50379"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-367"
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-12-20T16:15:24Z"
|
||||
}
|
||||
}
|
||||
@@ -1,13 +1,17 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2fgh-jjh6-cvr4",
|
||||
"modified": "2024-12-20T15:30:48Z",
|
||||
"modified": "2024-12-20T18:31:32Z",
|
||||
"published": "2024-12-20T15:30:48Z",
|
||||
"aliases": [
|
||||
"CVE-2024-12014"
|
||||
],
|
||||
"details": "Path Traversal and Insecure Direct Object Reference (IDOR) vulnerabilities in the eSignaViewer component in eSigna product versions 1.0 to 1.5 on all platforms allow an unauthenticated attacker to access arbitrary files in the document system via manipulation of file paths and object identifiers.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
|
||||
},
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
|
||||
@@ -26,7 +30,8 @@
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-20"
|
||||
"CWE-20",
|
||||
"CWE-639"
|
||||
],
|
||||
"severity": "LOW",
|
||||
"github_reviewed": false,
|
||||
|
||||
@@ -0,0 +1,33 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2hr5-cvwp-jr5w",
|
||||
"modified": "2024-12-20T18:31:32Z",
|
||||
"published": "2024-12-20T18:31:32Z",
|
||||
"aliases": [
|
||||
"CVE-2024-55186"
|
||||
],
|
||||
"details": "An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messages of other users by manipulating the notification ID in the request URL. By changing the notification ID, an attacker can view sensitive mail details belonging to other users.",
|
||||
"severity": [],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55186"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/oqtane/oqtane.framework/pull/4876/files"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://gist.github.com/SmitShah1518/00de9ecc46c1a8e2b189185c9d92afb0"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-12-20T16:15:23Z"
|
||||
}
|
||||
}
|
||||
@@ -1,13 +1,18 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-32vr-62m9-gj5v",
|
||||
"modified": "2024-12-20T06:30:45Z",
|
||||
"modified": "2024-12-20T18:31:31Z",
|
||||
"published": "2024-12-20T06:30:45Z",
|
||||
"aliases": [
|
||||
"CVE-2024-44195"
|
||||
],
|
||||
"details": "A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to read arbitrary files.",
|
||||
"severity": [],
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
@@ -20,8 +25,10 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"cwe_ids": [
|
||||
"CWE-22"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-12-20T04:15:05Z"
|
||||
|
||||
@@ -0,0 +1,44 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-334g-hq35-7fwx",
|
||||
"modified": "2024-12-20T18:31:32Z",
|
||||
"published": "2024-12-20T18:31:32Z",
|
||||
"aliases": [
|
||||
"CVE-2024-12677"
|
||||
],
|
||||
"details": "Delta Electronics DTM Soft deserializes objects, which could allow an attacker to execute arbitrary code.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
|
||||
},
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12677"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://downloadcenter.deltaww.com/en-US/DownloadCenter?v=1&q=dtm&sort_expr=cdate&sort_dir=DESC"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-03"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-502"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-12-20T17:15:07Z"
|
||||
}
|
||||
}
|
||||
@@ -1,13 +1,18 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3vx3-2qpf-jvhh",
|
||||
"modified": "2024-12-20T06:30:46Z",
|
||||
"modified": "2024-12-20T18:31:31Z",
|
||||
"published": "2024-12-20T06:30:45Z",
|
||||
"aliases": [
|
||||
"CVE-2024-11108"
|
||||
],
|
||||
"details": "The Serious Slider WordPress plugin before 1.2.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.",
|
||||
"severity": [],
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
@@ -20,8 +25,10 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"cwe_ids": [
|
||||
"CWE-79"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-12-20T06:15:22Z"
|
||||
|
||||
@@ -1,13 +1,18 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-55mr-49mr-xcvc",
|
||||
"modified": "2024-12-19T18:31:37Z",
|
||||
"modified": "2024-12-20T18:31:31Z",
|
||||
"published": "2024-12-19T18:31:37Z",
|
||||
"aliases": [
|
||||
"CVE-2023-7005"
|
||||
],
|
||||
"details": "A specially crafted message can be sent to the TTLock App that downgrades the encryption protocol used for communication, and can be utilized to compromise the lock, such as through revealing the unlockKey field.",
|
||||
"severity": [],
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
@@ -21,7 +26,7 @@
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [],
|
||||
"severity": null,
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-12-19T18:15:06Z"
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user