Advisory Database Sync

advisories/github-reviewed/2024/12/GHSA-2m9h-r57g-45pj/GHSA-2m9h-r57g-45pj.json

@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2m9h-r57g-45pj",
+  "modified": "2024-12-04T15:32:45Z",
+  "published": "2024-12-04T15:32:45Z",
+  "aliases": [
+    "CVE-2024-54132"
+  ],
+  "summary": "Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability",
+  "details": "### Summary\n\nA security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through `gh run download`. \n\n### Details\n\nThis vulnerability stems from a GitHub Actions workflow artifact named `..` when downloaded using `gh run download`.  The artifact name and `--dir` flag are used to determine the artifact’s download path.  When the artifact is named `..`, the resulting files within the artifact are extracted exactly 1 directory higher than the specified `--dir` flag value.\n\nIn `2.63.1`, `gh run download` will not download artifacts named `..` and `.` and instead exit with the following error message:\n\n```\nerror downloading ..: would result in path traversal\n```\n\n### Impact\n\nSuccessful exploitation heightens the risk of local path traversal attack vectors exactly 1 directory higher than intended.\n\n### Remediation and Mitigation\n\n1. Upgrade `gh` to `2.63.1`\n2. Implement additional validation to ensure artifact filenames do not contain potentially dangerous patterns, such as `..`, to prevent path traversal risks.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Green"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/cli/cli/v2"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.63.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/cli/cli/security/advisories/GHSA-2m9h-r57g-45pj"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/cli/cli/commit/1136764c369aaf0cae4ec2ee09dc35d871076932"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/cli/cli"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-12-04T15:32:45Z",
+    "nvd_published_at": null
+  }
+}

advisories/unreviewed/2023/08/GHSA-354p-vf27-6xqv/GHSA-354p-vf27-6xqv.json

@@ -13,9 +13,7 @@
       "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
     }
   ],
-  "affected": [
-
-  ],
+  "affected": [],
   "references": [
     {
       "type": "ADVISORY",

advisories/unreviewed/2024/03/GHSA-546c-jgxm-3c33/GHSA-546c-jgxm-3c33.json

@@ -1,18 +1,19 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-546c-jgxm-3c33",
-  "modified": "2024-03-18T21:31:22Z",
+  "modified": "2024-12-04T15:31:49Z",
   "published": "2024-03-18T21:31:22Z",
   "aliases": [
     "CVE-2023-7236"
   ],
   "details": "The Backup Bolt WordPress plugin through 1.3.0 is vulnerable to Information Exposure via the unprotected access of debug logs. This makes it possible for unauthenticated attackers to retrieve the debug log which may contain information like system errors which could contain sensitive information.",
   "severity": [
-
-  ],
-  "affected": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N"
+    }
   ],
+  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
@@ -25,9 +26,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-79"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-03-18T19:15:06Z"

advisories/unreviewed/2024/04/GHSA-ch2c-p7pr-2rg8/GHSA-ch2c-p7pr-2rg8.json

@@ -26,7 +26,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-121"
+      "CWE-121",
+      "CWE-787"
     ],
     "severity": "HIGH",
     "github_reviewed": false,

advisories/unreviewed/2024/10/GHSA-q7mg-8rwj-gmwq/GHSA-q7mg-8rwj-gmwq.json

@@ -25,7 +25,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-922"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,

advisories/unreviewed/2024/11/GHSA-525j-qpc7-rrqj/GHSA-525j-qpc7-rrqj.json

@@ -26,7 +26,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-457"
+      "CWE-457",
+      "CWE-908"
     ],
     "severity": "HIGH",
     "github_reviewed": false,

advisories/unreviewed/2024/11/GHSA-fw35-5qfq-q9px/GHSA-fw35-5qfq-q9px.json

@@ -26,7 +26,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-119"
+      "CWE-119",
+      "CWE-787"
     ],
     "severity": "HIGH",
     "github_reviewed": false,

advisories/unreviewed/2024/11/GHSA-p3xf-gp9j-6r3v/GHSA-p3xf-gp9j-6r3v.json

@@ -13,9 +13,7 @@
       "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
     }
   ],
-  "affected": [
-
-  ],
+  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
@@ -32,6 +30,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
+      "CWE-190",
       "CWE-787"
     ],
     "severity": "HIGH",

advisories/unreviewed/2024/11/GHSA-wjq6-6xvc-xr82/GHSA-wjq6-6xvc-xr82.json

@@ -30,7 +30,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-276"
+      "CWE-276",
+      "CWE-522"
     ],
     "severity": "CRITICAL",
     "github_reviewed": false,

advisories/unreviewed/2024/12/GHSA-2r3p-3799-v656/GHSA-2r3p-3799-v656.json

@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2r3p-3799-v656",
+  "modified": "2024-12-04T15:31:52Z",
+  "published": "2024-12-04T15:31:52Z",
+  "aliases": [
+    "CVE-2024-11935"
+  ],
+  "details": "The Email Address Obfuscation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11935"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/email-address-obfuscation/trunk/email-address-obfuscation.php#L38"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3201993"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wordpress.org/plugins/email-address-obfuscation/#developers"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8b777b19-ca0a-4082-80ee-e18a31ba6308?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-04T13:15:05Z"
+  }
+}

advisories/unreviewed/2024/12/GHSA-33rw-2cg2-2mpc/GHSA-33rw-2cg2-2mpc.json

@@ -0,0 +1,41 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-33rw-2cg2-2mpc",
+  "modified": "2024-12-04T15:31:53Z",
+  "published": "2024-12-04T15:31:52Z",
+  "aliases": [
+    "CVE-2024-53136"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: revert \"mm: shmem: fix data-race in shmem_getattr()\"\n\nRevert d949d1d14fa2 (\"mm: shmem: fix data-race in shmem_getattr()\") as\nsuggested by Chuck [1].  It is causing deadlocks when accessing tmpfs over\nNFS.\n\nAs Hugh commented, \"added just to silence a syzbot sanitizer splat: added\nwhere there has never been any practical problem\".",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53136"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/5874c1150e77296565ad6e495ef41fbf87570d14"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/64e67e8694252c1bf01b802ee911be3fee62c36b"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/901dc2ad7c3789fa87dc3956f6697c5d62d5cf7e"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/d1aa0c04294e29883d65eac6c2f72fe95cc7c049"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-04T15:15:13Z"
+  }
+}

advisories/unreviewed/2024/12/GHSA-3q5q-j6r6-cgv8/GHSA-3q5q-j6r6-cgv8.json

@@ -0,0 +1,33 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3q5q-j6r6-cgv8",
+  "modified": "2024-12-04T15:31:52Z",
+  "published": "2024-12-04T15:31:52Z",
+  "aliases": [
+    "CVE-2024-53133"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Handle dml allocation failure to avoid crash\n\n[Why]\nIn the case where a dml allocation fails for any reason, the\ncurrent state's dml contexts would no longer be valid. Then\nsubsequent calls dc_state_copy_internal would shallow copy\ninvalid memory and if the new state was released, a double\nfree would occur.\n\n[How]\nReset dml pointers in new_state to NULL and avoid invalid\npointer\n\n(cherry picked from commit bcafdc61529a48f6f06355d78eb41b3aeda5296c)",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53133"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/6825cb07b79ffeb1d90ffaa7a1227462cdca34ae"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/874ff59cde8fc525112dda26b501a1bac17dde9f"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-04T15:15:13Z"
+  }
+}

advisories/unreviewed/2024/12/GHSA-59r8-jcm7-vx66/GHSA-59r8-jcm7-vx66.json

@@ -0,0 +1,33 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-59r8-jcm7-vx66",
+  "modified": "2024-12-04T15:31:52Z",
+  "published": "2024-12-04T15:31:52Z",
+  "aliases": [
+    "CVE-2024-53137"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: fix cacheflush with PAN\n\nIt seems that the cacheflush syscall got broken when PAN for LPAE was\nimplemented. User access was not enabled around the cache maintenance\ninstructions, causing them to fault.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53137"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/ca29cfcc4a21083d671522ad384532e28a43f033"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/e6960a2ed49c9a25357817535f7cc50594a58604"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-04T15:15:13Z"
+  }
+}

advisories/unreviewed/2024/12/GHSA-5cwm-fg2p-g6pp/GHSA-5cwm-fg2p-g6pp.json

@@ -0,0 +1,41 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5cwm-fg2p-g6pp",
+  "modified": "2024-12-04T15:31:52Z",
+  "published": "2024-12-04T15:31:52Z",
+  "aliases": [
+    "CVE-2024-53127"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K\"\n\nThe commit 8396c793ffdf (\"mmc: dw_mmc: Fix IDMAC operation with pages\nbigger than 4K\") increased the max_req_size, even for 4K pages, causing\nvarious issues:\n- Panic booting the kernel/rootfs from an SD card on Rockchip RK3566\n- Panic booting the kernel/rootfs from an SD card on StarFive JH7100\n- \"swiotlb buffer is full\" and data corruption on StarFive JH7110\n\nAt this stage no fix have been found, so it's probably better to just\nrevert the change.\n\nThis reverts commit 8396c793ffdf28bb8aee7cfe0891080f8cab7890.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53127"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/1635e407a4a64d08a8517ac59ca14ad4fc785e75"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/56de724c58c07a7ca3aac027cfd2ccb184ed9e4e"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/8f9416147d7ed414109d3501f1cb3d7a1735b25a"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/a4685366f07448420badb710ff5c12aaaadf63ad"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-04T15:15:12Z"
+  }
+}

advisories/unreviewed/2024/12/GHSA-623v-cr64-76w9/GHSA-623v-cr64-76w9.json

@@ -0,0 +1,37 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-623v-cr64-76w9",
+  "modified": "2024-12-04T15:31:52Z",
+  "published": "2024-12-04T15:31:52Z",
+  "aliases": [
+    "CVE-2024-53126"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa: solidrun: Fix UB bug with devres\n\nIn psnet_open_pf_bar() and snet_open_vf_bar() a string later passed to\npcim_iomap_regions() is placed on the stack. Neither\npcim_iomap_regions() nor the functions it calls copy that string.\n\nShould the string later ever be used, this, consequently, causes\nundefined behavior since the stack frame will by then have disappeared.\n\nFix the bug by allocating the strings on the heap through\ndevm_kasprintf().",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53126"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/0b364cf53b20204e92bac7c6ebd1ee7d3ec62931"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/5bb287da2d2d5bb8f7376e223b02edb16998982e"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/d372dd09cfbf1324f54cbffd81fcaf6cdf3e608e"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-04T15:15:12Z"
+  }
+}

advisories/unreviewed/2024/12/GHSA-78w4-wf5r-hgxq/GHSA-78w4-wf5r-hgxq.json

@@ -25,7 +25,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-862"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,

advisories/unreviewed/2024/12/GHSA-7gvv-gph6-2hpj/GHSA-7gvv-gph6-2hpj.json

@@ -0,0 +1,41 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7gvv-gph6-2hpj",
+  "modified": "2024-12-04T15:31:52Z",
+  "published": "2024-12-04T15:31:52Z",
+  "aliases": [
+    "CVE-2024-53135"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN\n\nHide KVM's pt_mode module param behind CONFIG_BROKEN, i.e. disable support\nfor virtualizing Intel PT via guest/host mode unless BROKEN=y.  There are\nmyriad bugs in the implementation, some of which are fatal to the guest,\nand others which put the stability and health of the host at risk.\n\nFor guest fatalities, the most glaring issue is that KVM fails to ensure\ntracing is disabled, and *stays* disabled prior to VM-Enter, which is\nnecessary as hardware disallows loading (the guest's) RTIT_CTL if tracing\nis enabled (enforced via a VMX consistency check).  Per the SDM:\n\n  If the logical processor is operating with Intel PT enabled (if\n  IA32_RTIT_CTL.TraceEn = 1) at the time of VM entry, the \"load\n  IA32_RTIT_CTL\" VM-entry control must be 0.\n\nOn the host side, KVM doesn't validate the guest CPUID configuration\nprovided by userspace, and even worse, uses the guest configuration to\ndecide what MSRs to save/load at VM-Enter and VM-Exit.  E.g. configuring\nguest CPUID to enumerate more address ranges than are supported in hardware\nwill result in KVM trying to passthrough, save, and load non-existent MSRs,\nwhich generates a variety of WARNs, ToPA ERRORs in the host, a potential\ndeadlock, etc.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53135"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/aa0d42cacf093a6fcca872edc954f6f812926a17"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/b91bb0ce5cd7005b376eac690ec664c1b56372ec"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/d28b059ee4779b5102c5da6e929762520510e406"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/e6716f4230a8784957273ddd27326264b27b9313"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-04T15:15:13Z"
+  }
+}

advisories/unreviewed/2024/12/GHSA-8fcw-x22m-3qx7/GHSA-8fcw-x22m-3qx7.json

@@ -0,0 +1,31 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8fcw-x22m-3qx7",
+  "modified": "2024-12-04T15:31:52Z",
+  "published": "2024-12-04T15:31:52Z",
+  "aliases": [
+    "CVE-2024-40744"
+  ],
+  "details": "Unrestricted file upload via security bypass in Convert Forms component for Joomla in versions before 4.4.6.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40744"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.tassos.gr/joomla-extensions/convert-forms"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-434"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-04T15:15:11Z"
+  }
+}

advisories/unreviewed/2024/12/GHSA-8j4v-284w-97cc/GHSA-8j4v-284w-97cc.json

@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8j4v-284w-97cc",
+  "modified": "2024-12-04T15:31:52Z",
+  "published": "2024-12-04T15:31:52Z",
+  "aliases": [
+    "CVE-2024-12138"
+  ],
+  "details": "A vulnerability classified as critical was found in horilla up to 1.2.1. This vulnerability affects the function request_new/get_employee_shift/create_reimbursement/key_result_current_value_update/create_meetings/create_skills. The manipulation leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12138"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Sp1d3rL1/horilla-RCE"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.286858"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.286858"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.451515"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-04T14:15:19Z"
+  }
+}