netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-01-29 18:33:22 +00:00
parent 0844c5c2b3
commit 9868e2bb97
57 changed files with 852 additions and 125 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2023/11/GHSA-jvj3-gqjm-cg8p/GHSA-jvj3-gqjm-cg8p.json
+4
View File
@@ -37,6 +37,10 @@
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0451"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:0533"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-5981"
advisories/unreviewed/2024/01/GHSA-2572-4xw7-mcfc/GHSA-2572-4xw7-mcfc.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2572-4xw7-mcfc",
"modified": "2024-01-23T12:30:30Z",
"modified": "2024-01-29T18:31:47Z",
"published": "2024-01-23T12:30:30Z",
"aliases": [
"CVE-2024-22705"
],
"details": "An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2_get_data_area_len in fs/smb/server/smb2misc.c can cause an smb_strndup_from_utf16 out-of-bounds access because the relationship between Name data and CreateContexts data is mishandled.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-23T11:15:09Z"
advisories/unreviewed/2024/01/GHSA-25vp-v4qh-h9xj/GHSA-25vp-v4qh-h9xj.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-25vp-v4qh-h9xj",
"modified": "2024-01-23T15:30:58Z",
"modified": "2024-01-29T18:31:47Z",
"published": "2024-01-23T15:30:58Z",
"aliases": [
"CVE-2024-22662"
],
"details": "TOTOLINK A3700R_V9.1.2u.6165_20211012 has a stack overflow vulnerability via setParentalRules",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-787"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-23T15:15:11Z"
advisories/unreviewed/2024/01/GHSA-39gr-m4xp-77wp/GHSA-39gr-m4xp-77wp.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-39gr-m4xp-77wp",
"modified": "2024-01-29T18:31:50Z",
"published": "2024-01-29T18:31:50Z",
"aliases": [
"CVE-2023-1705"
],
"details": "Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escalation, Functionality Bypass.This issue affects F|One SmartEdge Agent: before 1.7.0.230330-554.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1705"
},
{
"type": "WEB",
"url": "https://support.forcepoint.com/s/article/000042333"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-29T17:15:08Z"
}
}
advisories/unreviewed/2024/01/GHSA-4425-3v92-m6q6/GHSA-4425-3v92-m6q6.json
+2 -1
View File
@@ -28,7 +28,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-20"
"CWE-20",
"CWE-798"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/01/GHSA-4gqf-q3p9-g947/GHSA-4gqf-q3p9-g947.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4gqf-q3p9-g947",
"modified": "2024-01-25T21:32:15Z",
"modified": "2024-01-29T18:31:48Z",
"published": "2024-01-25T21:32:15Z",
"aliases": [
"CVE-2024-22639"
],
"details": "iGalerie v3.0.22 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Titre (Title) field in the editing interface.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-25T21:15:09Z"
advisories/unreviewed/2024/01/GHSA-4hh7-5c39-pfhw/GHSA-4hh7-5c39-pfhw.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4hh7-5c39-pfhw",
"modified": "2024-01-22T21:31:07Z",
"modified": "2024-01-29T18:31:47Z",
"published": "2024-01-22T21:31:07Z",
"aliases": [
"CVE-2023-24135"
],
"details": "Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a command injection vulnerability in the function formWriteFacMac. This vulnerability allows attackers to execute arbitrary commands via manipulation of the mac parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-22T21:15:08Z"
advisories/unreviewed/2024/01/GHSA-4jhj-g9wr-f89q/GHSA-4jhj-g9wr-f89q.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4jhj-g9wr-f89q",
"modified": "2024-01-23T21:30:21Z",
"modified": "2024-01-29T18:31:48Z",
"published": "2024-01-23T21:30:21Z",
"aliases": [
"CVE-2023-52328"
],
"details": "Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.\n\nPlease note this vulnerability is similar, but not identical to CVE-2023-52329.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-23T21:15:09Z"
advisories/unreviewed/2024/01/GHSA-4wm4-8487-w6cr/GHSA-4wm4-8487-w6cr.json
+46
View File
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4wm4-8487-w6cr",
"modified": "2024-01-29T18:31:53Z",
"published": "2024-01-29T18:31:53Z",
"aliases": [
"CVE-2024-1016"
],
"details": "A vulnerability was found in Solar FTP Server 2.1.1/2.1.2. It has been declared as problematic. This vulnerability affects unknown code of the component PASV Command Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-252286 is the identifier assigned to this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1016"
},
{
"type": "WEB",
"url": "https://packetstormsecurity.com/files/176675/Solar-FTP-Server-2.1.2-Denial-Of-Service.html"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.252286"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.252286"
}
],
"database_specific": {
"cwe_ids": [
"CWE-404"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-29T18:15:07Z"
}
}
advisories/unreviewed/2024/01/GHSA-5prg-h6vm-wxcf/GHSA-5prg-h6vm-wxcf.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5prg-h6vm-wxcf",
"modified": "2024-01-23T21:30:20Z",
"modified": "2024-01-29T18:31:47Z",
"published": "2024-01-23T21:30:20Z",
"aliases": [
"CVE-2023-38626"
],
"details": "A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly.\n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThis is a similar, but not identical vulnerability as CVE-2023-38625.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-918"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-23T21:15:08Z"
advisories/unreviewed/2024/01/GHSA-5rh9-65g2-hc9h/GHSA-5rh9-65g2-hc9h.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5rh9-65g2-hc9h",
"modified": "2024-01-23T15:30:58Z",
"modified": "2024-01-29T18:31:47Z",
"published": "2024-01-23T15:30:58Z",
"aliases": [
"CVE-2024-22663"
],
"details": "TOTOLINK_A3700R_V9.1.2u.6165_20211012has a command Injection vulnerability via setOpModeCfg",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-23T15:15:11Z"
advisories/unreviewed/2024/01/GHSA-627f-4vcr-fmq4/GHSA-627f-4vcr-fmq4.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-627f-4vcr-fmq4",
"modified": "2024-01-22T00:30:19Z",
"modified": "2024-01-29T18:31:46Z",
"published": "2024-01-22T00:30:19Z",
"aliases": [
"CVE-2024-23744"
],
"details": "An issue was discovered in Mbed TLS 3.5.1. There is persistent handshake denial if a client sends a TLS 1.3 ClientHello without extensions.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-21T23:15:44Z"
advisories/unreviewed/2024/01/GHSA-6g54-284w-pj4p/GHSA-6g54-284w-pj4p.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6g54-284w-pj4p",
"modified": "2024-01-24T21:30:33Z",
"modified": "2024-01-29T18:31:47Z",
"published": "2024-01-22T21:31:07Z",
"aliases": [
"CVE-2024-23676"
advisories/unreviewed/2024/01/GHSA-6j62-7qgg-9gww/GHSA-6j62-7qgg-9gww.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6j62-7qgg-9gww",
"modified": "2024-01-29T18:31:53Z",
"published": "2024-01-29T18:31:53Z",
"aliases": [
"CVE-2023-40551"
],
"details": "A flaw was found in the MZ binary format in Shim. An out-of-bounds read may occur, leading to a crash or possible exposure of sensitive data during the system's boot phase.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40551"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-40551"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259918"
}
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-29T17:15:08Z"
}
}
advisories/unreviewed/2024/01/GHSA-6m93-gmrj-jf29/GHSA-6m93-gmrj-jf29.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6m93-gmrj-jf29",
"modified": "2024-01-25T21:32:15Z",
"modified": "2024-01-29T18:31:48Z",
"published": "2024-01-25T21:32:15Z",
"aliases": [
"CVE-2024-24399"
],
"details": "An arbitrary file upload vulnerability in LeptonCMS v7.0.0 allows authenticated attackers to execute arbitrary code via uploading a crafted PHP file.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-25T21:15:09Z"
advisories/unreviewed/2024/01/GHSA-7695-f938-c2jf/GHSA-7695-f938-c2jf.json
+2 -1
View File
@@ -28,7 +28,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-20"
"CWE-20",
"CWE-798"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/01/GHSA-78cp-c4p5-694f/GHSA-78cp-c4p5-694f.json
+2 -1
View File
@@ -28,7 +28,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-20"
"CWE-20",
"CWE-798"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/01/GHSA-78m6-vgh2-9c4v/GHSA-78m6-vgh2-9c4v.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-78m6-vgh2-9c4v",
"modified": "2024-01-23T21:30:20Z",
"modified": "2024-01-29T18:31:47Z",
"published": "2024-01-23T21:30:20Z",
"aliases": [
"CVE-2023-41177"
],
"details": "Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker.\n\nPlease note, this vulnerability is similar to, but not identical to, CVE-2023-41178.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-23T21:15:08Z"
advisories/unreviewed/2024/01/GHSA-79x7-r2x4-xpj2/GHSA-79x7-r2x4-xpj2.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-79x7-r2x4-xpj2",
"modified": "2024-01-23T21:30:20Z",
"modified": "2024-01-29T18:31:47Z",
"published": "2024-01-23T21:30:20Z",
"aliases": [
"CVE-2023-41176"
],
"details": "Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker.\n\nPlease note, this vulnerability is similar to, but not identical to, CVE-2023-41177.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-23T21:15:08Z"
advisories/unreviewed/2024/01/GHSA-7jm4-gcxp-f8vv/GHSA-7jm4-gcxp-f8vv.json
+46
View File
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7jm4-gcxp-f8vv",
"modified": "2024-01-29T18:31:53Z",
"published": "2024-01-29T18:31:53Z",
"aliases": [
"CVE-2024-1009"
],
"details": "A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Admin/login.php. The manipulation of the argument txtusername leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252278 is the identifier assigned to this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1009"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.252278"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.252278"
},
{
"type": "WEB",
"url": "https://youtu.be/oL98TSjy89Q?si=_T6YkJZlbn7SJ4Gn"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-29T17:15:09Z"
}
}

Some files were not shown because too many files have changed in this diff Show More