From 9922fba48a0095df5a4da02c466c42596720daa1 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 24 Jun 2024 18:32:59 +0000 Subject: [PATCH] Publish Advisories GHSA-j8vc-4phr-q4j2 GHSA-9w72-8p6g-p73f GHSA-fmh9-9qq4-cv6j GHSA-gwvv-gr8w-ggvq GHSA-qh69-9h65-cjx9 GHSA-r24r-m7ff-ghq2 GHSA-rvm7-rc5g-c98q GHSA-v6v8-xj6m-xwqh --- .../GHSA-j8vc-4phr-q4j2.json | 6 ++- .../GHSA-9w72-8p6g-p73f.json | 39 +++++++++++++++++ .../GHSA-fmh9-9qq4-cv6j.json | 42 +++++++++++++++++++ .../GHSA-gwvv-gr8w-ggvq.json | 42 +++++++++++++++++++ .../GHSA-qh69-9h65-cjx9.json | 39 +++++++++++++++++ .../GHSA-r24r-m7ff-ghq2.json | 39 +++++++++++++++++ .../GHSA-rvm7-rc5g-c98q.json | 6 ++- .../GHSA-v6v8-xj6m-xwqh.json | 38 +++++++++++++++++ 8 files changed, 249 insertions(+), 2 deletions(-) create mode 100644 advisories/unreviewed/2024/06/GHSA-9w72-8p6g-p73f/GHSA-9w72-8p6g-p73f.json create mode 100644 advisories/unreviewed/2024/06/GHSA-fmh9-9qq4-cv6j/GHSA-fmh9-9qq4-cv6j.json create mode 100644 advisories/unreviewed/2024/06/GHSA-gwvv-gr8w-ggvq/GHSA-gwvv-gr8w-ggvq.json create mode 100644 advisories/unreviewed/2024/06/GHSA-qh69-9h65-cjx9/GHSA-qh69-9h65-cjx9.json create mode 100644 advisories/unreviewed/2024/06/GHSA-r24r-m7ff-ghq2/GHSA-r24r-m7ff-ghq2.json create mode 100644 advisories/unreviewed/2024/06/GHSA-v6v8-xj6m-xwqh/GHSA-v6v8-xj6m-xwqh.json diff --git a/advisories/unreviewed/2022/05/GHSA-j8vc-4phr-q4j2/GHSA-j8vc-4phr-q4j2.json b/advisories/unreviewed/2022/05/GHSA-j8vc-4phr-q4j2/GHSA-j8vc-4phr-q4j2.json index 7862765bcd5..2108365ef62 100644 --- a/advisories/unreviewed/2022/05/GHSA-j8vc-4phr-q4j2/GHSA-j8vc-4phr-q4j2.json +++ b/advisories/unreviewed/2022/05/GHSA-j8vc-4phr-q4j2/GHSA-j8vc-4phr-q4j2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j8vc-4phr-q4j2", - "modified": "2022-05-13T01:08:55Z", + "modified": "2024-06-24T18:31:36Z", "published": "2022-05-13T01:08:55Z", "aliases": [ "CVE-2010-2739" @@ -18,6 +18,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2739" }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/blog/2010/08/update-on-the-publicly-disclosed-win32k-sys-eop-vulnerability" + }, { "type": "WEB", "url": "http://blogs.technet.com/b/msrc/archive/2010/08/10/update-on-the-publicly-disclosed-win32k-sys-eop-vulnerability.aspx" diff --git a/advisories/unreviewed/2024/06/GHSA-9w72-8p6g-p73f/GHSA-9w72-8p6g-p73f.json b/advisories/unreviewed/2024/06/GHSA-9w72-8p6g-p73f/GHSA-9w72-8p6g-p73f.json new file mode 100644 index 00000000000..f258ab0c072 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-9w72-8p6g-p73f/GHSA-9w72-8p6g-p73f.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9w72-8p6g-p73f", + "modified": "2024-06-24T18:31:37Z", + "published": "2024-06-24T18:31:37Z", + "aliases": [ + "CVE-2024-33880" + ], + "details": "An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. It discloses full pathnames via Virto.SharePoint.FileDownloader/Api/Download.ashx?action=archive.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33880" + }, + { + "type": "WEB", + "url": "https://docs.virtosoftware.com/v/virto-security-frequently-asked-questions-faq>%3B" + }, + { + "type": "WEB", + "url": "https://download.virtosoftware.com/Manuals/nu_ncsc_virto_one_bulk_file_download_v5.4.4_pt_disclosure.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T17:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-fmh9-9qq4-cv6j/GHSA-fmh9-9qq4-cv6j.json b/advisories/unreviewed/2024/06/GHSA-fmh9-9qq4-cv6j/GHSA-fmh9-9qq4-cv6j.json new file mode 100644 index 00000000000..2689c3f5d04 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-fmh9-9qq4-cv6j/GHSA-fmh9-9qq4-cv6j.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fmh9-9qq4-cv6j", + "modified": "2024-06-24T18:31:36Z", + "published": "2024-06-24T18:31:36Z", + "aliases": [ + "CVE-2024-6285" + ], + "details": "Integer Underflow (Wrap or Wraparound) vulnerability in Renesas arm-trusted-firmware.\nAn integer underflow in image range check calculations could lead to bypassing address restrictions and loading of images to unallowed addresses.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6285" + }, + { + "type": "WEB", + "url": "https://github.com/renesas-rcar/arm-trusted-firmware/commit/b596f580637bae919b0ac3a5471422a1f756db3b" + }, + { + "type": "WEB", + "url": "https://asrg.io/security-advisories/cve-2024-6285" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-191" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T16:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-gwvv-gr8w-ggvq/GHSA-gwvv-gr8w-ggvq.json b/advisories/unreviewed/2024/06/GHSA-gwvv-gr8w-ggvq/GHSA-gwvv-gr8w-ggvq.json new file mode 100644 index 00000000000..4ffd470c1d2 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-gwvv-gr8w-ggvq/GHSA-gwvv-gr8w-ggvq.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gwvv-gr8w-ggvq", + "modified": "2024-06-24T18:31:36Z", + "published": "2024-06-24T18:31:36Z", + "aliases": [ + "CVE-2024-6287" + ], + "details": "Incorrect Calculation vulnerability in Renesas arm-trusted-firmware allows Local Execution of Code.\n\n\nWhen checking whether a new image invades/overlaps with a previously loaded image the code neglects to consider a few cases. that could An attacker to bypass memory range restriction and overwrite an already loaded image partly or completely, which could result in code execution and bypass of secure boot.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6287" + }, + { + "type": "WEB", + "url": "https://github.com/renesas-rcar/arm-trusted-firmware/commit/954d488a9798f8fda675c6b57c571b469b298f04" + }, + { + "type": "WEB", + "url": "https://asrg.io/security-advisories/cve-2024-6287" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-682" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T16:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-qh69-9h65-cjx9/GHSA-qh69-9h65-cjx9.json b/advisories/unreviewed/2024/06/GHSA-qh69-9h65-cjx9/GHSA-qh69-9h65-cjx9.json new file mode 100644 index 00000000000..63a0f6dccf5 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-qh69-9h65-cjx9/GHSA-qh69-9h65-cjx9.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qh69-9h65-cjx9", + "modified": "2024-06-24T18:31:36Z", + "published": "2024-06-24T18:31:36Z", + "aliases": [ + "CVE-2024-33879" + ], + "details": "An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows arbitrary file download and deletion via absolute path traversal in the path parameter.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33879" + }, + { + "type": "WEB", + "url": "https://docs.virtosoftware.com/v/virto-security-frequently-asked-questions-faq" + }, + { + "type": "WEB", + "url": "https://download.virtosoftware.com/Manuals/nu_ncsc_virto_one_bulk_file_download_v5.4.4_pt_disclosure.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T17:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-r24r-m7ff-ghq2/GHSA-r24r-m7ff-ghq2.json b/advisories/unreviewed/2024/06/GHSA-r24r-m7ff-ghq2/GHSA-r24r-m7ff-ghq2.json new file mode 100644 index 00000000000..7e55e685586 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-r24r-m7ff-ghq2/GHSA-r24r-m7ff-ghq2.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r24r-m7ff-ghq2", + "modified": "2024-06-24T18:31:37Z", + "published": "2024-06-24T18:31:37Z", + "aliases": [ + "CVE-2024-33881" + ], + "details": "An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows an NTLMv2 hash leak via a UNC share pathname in the path parameter.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33881" + }, + { + "type": "WEB", + "url": "https://docs.virtosoftware.com/v/virto-security-frequently-asked-questions-faq" + }, + { + "type": "WEB", + "url": "https://download.virtosoftware.com/Manuals/nu_ncsc_virto_one_bulk_file_download_v5.4.4_pt_disclosure.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T17:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-rvm7-rc5g-c98q/GHSA-rvm7-rc5g-c98q.json b/advisories/unreviewed/2024/06/GHSA-rvm7-rc5g-c98q/GHSA-rvm7-rc5g-c98q.json index cd049c2b8a4..cd4fda4ce78 100644 --- a/advisories/unreviewed/2024/06/GHSA-rvm7-rc5g-c98q/GHSA-rvm7-rc5g-c98q.json +++ b/advisories/unreviewed/2024/06/GHSA-rvm7-rc5g-c98q/GHSA-rvm7-rc5g-c98q.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rvm7-rc5g-c98q", - "modified": "2024-06-24T06:30:54Z", + "modified": "2024-06-24T18:31:36Z", "published": "2024-06-11T21:32:17Z", "aliases": [ "CVE-2023-4727" @@ -25,6 +25,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:4051" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:4070" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2023-4727" diff --git a/advisories/unreviewed/2024/06/GHSA-v6v8-xj6m-xwqh/GHSA-v6v8-xj6m-xwqh.json b/advisories/unreviewed/2024/06/GHSA-v6v8-xj6m-xwqh/GHSA-v6v8-xj6m-xwqh.json new file mode 100644 index 00000000000..e8c27915381 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-v6v8-xj6m-xwqh/GHSA-v6v8-xj6m-xwqh.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v6v8-xj6m-xwqh", + "modified": "2024-06-24T18:31:37Z", + "published": "2024-06-24T18:31:37Z", + "aliases": [ + "CVE-2024-6104" + ], + "details": "go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6104" + }, + { + "type": "WEB", + "url": "https://discuss.hashicorp.com/c/security" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T17:15:11Z" + } +} \ No newline at end of file