diff --git a/advisories/unreviewed/2022/05/GHSA-j8vc-4phr-q4j2/GHSA-j8vc-4phr-q4j2.json b/advisories/unreviewed/2022/05/GHSA-j8vc-4phr-q4j2/GHSA-j8vc-4phr-q4j2.json index 7862765bcd5..2108365ef62 100644 --- a/advisories/unreviewed/2022/05/GHSA-j8vc-4phr-q4j2/GHSA-j8vc-4phr-q4j2.json +++ b/advisories/unreviewed/2022/05/GHSA-j8vc-4phr-q4j2/GHSA-j8vc-4phr-q4j2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j8vc-4phr-q4j2", - "modified": "2022-05-13T01:08:55Z", + "modified": "2024-06-24T18:31:36Z", "published": "2022-05-13T01:08:55Z", "aliases": [ "CVE-2010-2739" @@ -18,6 +18,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2739" }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/blog/2010/08/update-on-the-publicly-disclosed-win32k-sys-eop-vulnerability" + }, { "type": "WEB", "url": "http://blogs.technet.com/b/msrc/archive/2010/08/10/update-on-the-publicly-disclosed-win32k-sys-eop-vulnerability.aspx" diff --git a/advisories/unreviewed/2024/06/GHSA-9w72-8p6g-p73f/GHSA-9w72-8p6g-p73f.json b/advisories/unreviewed/2024/06/GHSA-9w72-8p6g-p73f/GHSA-9w72-8p6g-p73f.json new file mode 100644 index 00000000000..f258ab0c072 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-9w72-8p6g-p73f/GHSA-9w72-8p6g-p73f.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9w72-8p6g-p73f", + "modified": "2024-06-24T18:31:37Z", + "published": "2024-06-24T18:31:37Z", + "aliases": [ + "CVE-2024-33880" + ], + "details": "An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. It discloses full pathnames via Virto.SharePoint.FileDownloader/Api/Download.ashx?action=archive.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33880" + }, + { + "type": "WEB", + "url": "https://docs.virtosoftware.com/v/virto-security-frequently-asked-questions-faq>%3B" + }, + { + "type": "WEB", + "url": "https://download.virtosoftware.com/Manuals/nu_ncsc_virto_one_bulk_file_download_v5.4.4_pt_disclosure.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T17:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-fmh9-9qq4-cv6j/GHSA-fmh9-9qq4-cv6j.json b/advisories/unreviewed/2024/06/GHSA-fmh9-9qq4-cv6j/GHSA-fmh9-9qq4-cv6j.json new file mode 100644 index 00000000000..2689c3f5d04 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-fmh9-9qq4-cv6j/GHSA-fmh9-9qq4-cv6j.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fmh9-9qq4-cv6j", + "modified": "2024-06-24T18:31:36Z", + "published": "2024-06-24T18:31:36Z", + "aliases": [ + "CVE-2024-6285" + ], + "details": "Integer Underflow (Wrap or Wraparound) vulnerability in Renesas arm-trusted-firmware.\nAn integer underflow in image range check calculations could lead to bypassing address restrictions and loading of images to unallowed addresses.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6285" + }, + { + "type": "WEB", + "url": "https://github.com/renesas-rcar/arm-trusted-firmware/commit/b596f580637bae919b0ac3a5471422a1f756db3b" + }, + { + "type": "WEB", + "url": "https://asrg.io/security-advisories/cve-2024-6285" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-191" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T16:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-gwvv-gr8w-ggvq/GHSA-gwvv-gr8w-ggvq.json b/advisories/unreviewed/2024/06/GHSA-gwvv-gr8w-ggvq/GHSA-gwvv-gr8w-ggvq.json new file mode 100644 index 00000000000..4ffd470c1d2 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-gwvv-gr8w-ggvq/GHSA-gwvv-gr8w-ggvq.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gwvv-gr8w-ggvq", + "modified": "2024-06-24T18:31:36Z", + "published": "2024-06-24T18:31:36Z", + "aliases": [ + "CVE-2024-6287" + ], + "details": "Incorrect Calculation vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code.\n\n\nWhen checking whether a new image invades/overlaps with a previously loaded image the code neglects to consider a few cases. that could An attacker to bypass memory range restriction and overwrite an already loaded image partly or completely, which could result in code execution and bypass of secure boot.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6287" + }, + { + "type": "WEB", + "url": "https://github.com/renesas-rcar/arm-trusted-firmware/commit/954d488a9798f8fda675c6b57c571b469b298f04" + }, + { + "type": "WEB", + "url": "https://asrg.io/security-advisories/cve-2024-6287" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-682" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T16:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-qh69-9h65-cjx9/GHSA-qh69-9h65-cjx9.json b/advisories/unreviewed/2024/06/GHSA-qh69-9h65-cjx9/GHSA-qh69-9h65-cjx9.json new file mode 100644 index 00000000000..63a0f6dccf5 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-qh69-9h65-cjx9/GHSA-qh69-9h65-cjx9.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qh69-9h65-cjx9", + "modified": "2024-06-24T18:31:36Z", + "published": "2024-06-24T18:31:36Z", + "aliases": [ + "CVE-2024-33879" + ], + "details": "An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows arbitrary file download and deletion via absolute path traversal in the path parameter.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33879" + }, + { + "type": "WEB", + "url": "https://docs.virtosoftware.com/v/virto-security-frequently-asked-questions-faq" + }, + { + "type": "WEB", + "url": "https://download.virtosoftware.com/Manuals/nu_ncsc_virto_one_bulk_file_download_v5.4.4_pt_disclosure.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T17:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-r24r-m7ff-ghq2/GHSA-r24r-m7ff-ghq2.json b/advisories/unreviewed/2024/06/GHSA-r24r-m7ff-ghq2/GHSA-r24r-m7ff-ghq2.json new file mode 100644 index 00000000000..7e55e685586 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-r24r-m7ff-ghq2/GHSA-r24r-m7ff-ghq2.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r24r-m7ff-ghq2", + "modified": "2024-06-24T18:31:37Z", + "published": "2024-06-24T18:31:37Z", + "aliases": [ + "CVE-2024-33881" + ], + "details": "An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows an NTLMv2 hash leak via a UNC share pathname in the path parameter.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33881" + }, + { + "type": "WEB", + "url": "https://docs.virtosoftware.com/v/virto-security-frequently-asked-questions-faq" + }, + { + "type": "WEB", + "url": "https://download.virtosoftware.com/Manuals/nu_ncsc_virto_one_bulk_file_download_v5.4.4_pt_disclosure.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T17:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-rvm7-rc5g-c98q/GHSA-rvm7-rc5g-c98q.json b/advisories/unreviewed/2024/06/GHSA-rvm7-rc5g-c98q/GHSA-rvm7-rc5g-c98q.json index cd049c2b8a4..cd4fda4ce78 100644 --- a/advisories/unreviewed/2024/06/GHSA-rvm7-rc5g-c98q/GHSA-rvm7-rc5g-c98q.json +++ b/advisories/unreviewed/2024/06/GHSA-rvm7-rc5g-c98q/GHSA-rvm7-rc5g-c98q.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rvm7-rc5g-c98q", - "modified": "2024-06-24T06:30:54Z", + "modified": "2024-06-24T18:31:36Z", "published": "2024-06-11T21:32:17Z", "aliases": [ "CVE-2023-4727" @@ -25,6 +25,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:4051" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:4070" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2023-4727" diff --git a/advisories/unreviewed/2024/06/GHSA-v6v8-xj6m-xwqh/GHSA-v6v8-xj6m-xwqh.json b/advisories/unreviewed/2024/06/GHSA-v6v8-xj6m-xwqh/GHSA-v6v8-xj6m-xwqh.json new file mode 100644 index 00000000000..e8c27915381 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-v6v8-xj6m-xwqh/GHSA-v6v8-xj6m-xwqh.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v6v8-xj6m-xwqh", + "modified": "2024-06-24T18:31:37Z", + "published": "2024-06-24T18:31:37Z", + "aliases": [ + "CVE-2024-6104" + ], + "details": "go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6104" + }, + { + "type": "WEB", + "url": "https://discuss.hashicorp.com/c/security" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T17:15:11Z" + } +} \ No newline at end of file