diff --git a/advisories/unreviewed/2024/10/GHSA-447p-4w4j-j4w9/GHSA-447p-4w4j-j4w9.json b/advisories/unreviewed/2024/10/GHSA-447p-4w4j-j4w9/GHSA-447p-4w4j-j4w9.json new file mode 100644 index 00000000000..3ca4ba23b56 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-447p-4w4j-j4w9/GHSA-447p-4w4j-j4w9.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-447p-4w4j-j4w9", + "modified": "2024-10-26T09:30:43Z", + "published": "2024-10-26T09:30:43Z", + "aliases": [ + "CVE-2024-10092" + ], + "details": "The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handle_api_key_actions function in all versions up to, and including, 5.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to revoke existing API keys and generate new ones.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10092" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/download-monitor/tags/5.0.12/src/KeyGeneration/class-dlm-key-generation.php#L299" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3173614/download-monitor/trunk/src/KeyGeneration/class-dlm-key-generation.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f1e50d8c-e61c-4e94-b5e8-b24832dc24b6?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T08:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-4w46-qc42-6vpq/GHSA-4w46-qc42-6vpq.json b/advisories/unreviewed/2024/10/GHSA-4w46-qc42-6vpq/GHSA-4w46-qc42-6vpq.json new file mode 100644 index 00000000000..4f0517b7d75 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-4w46-qc42-6vpq/GHSA-4w46-qc42-6vpq.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4w46-qc42-6vpq", + "modified": "2024-10-26T09:30:42Z", + "published": "2024-10-26T09:30:42Z", + "aliases": [ + "CVE-2024-0117" + ], + "details": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0117" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5586" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T08:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-4x2g-6qf5-ww63/GHSA-4x2g-6qf5-ww63.json b/advisories/unreviewed/2024/10/GHSA-4x2g-6qf5-ww63/GHSA-4x2g-6qf5-ww63.json new file mode 100644 index 00000000000..3e071381dcf --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-4x2g-6qf5-ww63/GHSA-4x2g-6qf5-ww63.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4x2g-6qf5-ww63", + "modified": "2024-10-26T09:30:43Z", + "published": "2024-10-26T09:30:43Z", + "aliases": [ + "CVE-2024-9642" + ], + "details": "The Editor Custom Color Palette plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.3.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9642" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/editor-custom-color-palette/tags/3.3.6/asset/eccp-custom-back-office.php#L1685" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/editor-custom-color-palette/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9e7f858c-945c-4d12-a2a6-113449ad890a?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T09:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-74qg-qx9g-ggh2/GHSA-74qg-qx9g-ggh2.json b/advisories/unreviewed/2024/10/GHSA-74qg-qx9g-ggh2/GHSA-74qg-qx9g-ggh2.json new file mode 100644 index 00000000000..03da361c8b4 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-74qg-qx9g-ggh2/GHSA-74qg-qx9g-ggh2.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-74qg-qx9g-ggh2", + "modified": "2024-10-26T09:30:42Z", + "published": "2024-10-26T09:30:42Z", + "aliases": [ + "CVE-2024-0119" + ], + "details": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0119" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5586" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T08:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-77jx-pqh8-p2wh/GHSA-77jx-pqh8-p2wh.json b/advisories/unreviewed/2024/10/GHSA-77jx-pqh8-p2wh/GHSA-77jx-pqh8-p2wh.json new file mode 100644 index 00000000000..d440708a666 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-77jx-pqh8-p2wh/GHSA-77jx-pqh8-p2wh.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-77jx-pqh8-p2wh", + "modified": "2024-10-26T09:30:43Z", + "published": "2024-10-26T09:30:43Z", + "aliases": [ + "CVE-2024-0128" + ], + "details": "NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager that allows a user of the guest OS to access global resources. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and escalation of privileges.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0128" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5586" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-732" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T09:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-7hrj-hw8g-3gp3/GHSA-7hrj-hw8g-3gp3.json b/advisories/unreviewed/2024/10/GHSA-7hrj-hw8g-3gp3/GHSA-7hrj-hw8g-3gp3.json new file mode 100644 index 00000000000..af263417288 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-7hrj-hw8g-3gp3/GHSA-7hrj-hw8g-3gp3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7hrj-hw8g-3gp3", + "modified": "2024-10-26T09:30:43Z", + "published": "2024-10-26T09:30:43Z", + "aliases": [ + "CVE-2024-0121" + ], + "details": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0121" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5586" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T08:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-7v6v-vcfr-7g4f/GHSA-7v6v-vcfr-7g4f.json b/advisories/unreviewed/2024/10/GHSA-7v6v-vcfr-7g4f/GHSA-7v6v-vcfr-7g4f.json new file mode 100644 index 00000000000..138a80bdbde --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-7v6v-vcfr-7g4f/GHSA-7v6v-vcfr-7g4f.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7v6v-vcfr-7g4f", + "modified": "2024-10-26T09:30:43Z", + "published": "2024-10-26T09:30:43Z", + "aliases": [ + "CVE-2024-9967" + ], + "details": "The WP show more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_more shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9967" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-show-more/trunk/wp-show-more.php#L16" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-show-more/trunk/wp-show-more.php#L23" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-show-more/trunk/wp-show-more.php#L27" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-show-more/trunk/wp-show-more.php#L31" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/wp-show-more/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1de269b5-7262-45c8-8819-00982f196597?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T09:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-9gx5-phw8-cmrj/GHSA-9gx5-phw8-cmrj.json b/advisories/unreviewed/2024/10/GHSA-9gx5-phw8-cmrj/GHSA-9gx5-phw8-cmrj.json new file mode 100644 index 00000000000..f196c86cb75 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-9gx5-phw8-cmrj/GHSA-9gx5-phw8-cmrj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9gx5-phw8-cmrj", + "modified": "2024-10-26T09:30:43Z", + "published": "2024-10-26T09:30:43Z", + "aliases": [ + "CVE-2024-0126" + ], + "details": "NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a privileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0126" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5586" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T08:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-9qw7-9xh2-7wfh/GHSA-9qw7-9xh2-7wfh.json b/advisories/unreviewed/2024/10/GHSA-9qw7-9xh2-7wfh/GHSA-9qw7-9xh2-7wfh.json new file mode 100644 index 00000000000..a99a7a6dd5b --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-9qw7-9xh2-7wfh/GHSA-9qw7-9xh2-7wfh.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9qw7-9xh2-7wfh", + "modified": "2024-10-26T09:30:43Z", + "published": "2024-10-26T09:30:43Z", + "aliases": [ + "CVE-2024-8392" + ], + "details": "The WordPress Post Grid Layouts with Pagination – Sogrid plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.5.2 via the 'tab' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This can also be exploited via CSRF techniques.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8392" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/sogrid/trunk/src/admin-panel/views/panel.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/62d81e01-9b6e-48e9-b9da-85444a3694e7?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-98" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T09:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-c5xf-93pm-69r9/GHSA-c5xf-93pm-69r9.json b/advisories/unreviewed/2024/10/GHSA-c5xf-93pm-69r9/GHSA-c5xf-93pm-69r9.json new file mode 100644 index 00000000000..2e7c219687b --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-c5xf-93pm-69r9/GHSA-c5xf-93pm-69r9.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c5xf-93pm-69r9", + "modified": "2024-10-26T09:30:43Z", + "published": "2024-10-26T09:30:43Z", + "aliases": [ + "CVE-2024-9853" + ], + "details": "The ID-SK Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9853" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/idsk-toolkit/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/001b452e-3f8a-4605-b77a-ba8fbd0d79d7?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T09:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-f2f3-h72c-p996/GHSA-f2f3-h72c-p996.json b/advisories/unreviewed/2024/10/GHSA-f2f3-h72c-p996/GHSA-f2f3-h72c-p996.json new file mode 100644 index 00000000000..5427c135775 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-f2f3-h72c-p996/GHSA-f2f3-h72c-p996.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f2f3-h72c-p996", + "modified": "2024-10-26T09:30:43Z", + "published": "2024-10-26T09:30:43Z", + "aliases": [ + "CVE-2024-0120" + ], + "details": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0120" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5586" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T08:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-j2cp-fx26-qq5c/GHSA-j2cp-fx26-qq5c.json b/advisories/unreviewed/2024/10/GHSA-j2cp-fx26-qq5c/GHSA-j2cp-fx26-qq5c.json new file mode 100644 index 00000000000..ebd2e13c96d --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-j2cp-fx26-qq5c/GHSA-j2cp-fx26-qq5c.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j2cp-fx26-qq5c", + "modified": "2024-10-26T09:30:43Z", + "published": "2024-10-26T09:30:43Z", + "aliases": [ + "CVE-2024-9637" + ], + "details": "The School Management System – WPSchoolPress plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.2.10. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with teacher-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9637" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wpschoolpress/tags/2.2.9/lib/wpsp-ajaxworks-teacher.php#L598" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/411693fc-9df3-44b1-9a6f-58a6e8ef23b8?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-639" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T09:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-w6jp-rff9-786g/GHSA-w6jp-rff9-786g.json b/advisories/unreviewed/2024/10/GHSA-w6jp-rff9-786g/GHSA-w6jp-rff9-786g.json new file mode 100644 index 00000000000..1a987a46d7a --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-w6jp-rff9-786g/GHSA-w6jp-rff9-786g.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w6jp-rff9-786g", + "modified": "2024-10-26T09:30:42Z", + "published": "2024-10-26T09:30:42Z", + "aliases": [ + "CVE-2024-0118" + ], + "details": "NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0118" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5586" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T08:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-wp3j-hrjf-2g38/GHSA-wp3j-hrjf-2g38.json b/advisories/unreviewed/2024/10/GHSA-wp3j-hrjf-2g38/GHSA-wp3j-hrjf-2g38.json new file mode 100644 index 00000000000..f9bdd95ef89 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-wp3j-hrjf-2g38/GHSA-wp3j-hrjf-2g38.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wp3j-hrjf-2g38", + "modified": "2024-10-26T09:30:43Z", + "published": "2024-10-26T09:30:43Z", + "aliases": [ + "CVE-2024-0127" + ], + "details": "NVIDIA vGPU software contains a vulnerability in the GPU kernel driver of the vGPU Manager for all supported hypervisors, where a user of the guest OS can cause an improper input validation by compromising the guest OS kernel. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0127" + }, + { + "type": "WEB", + "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5586" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-26T09:15:02Z" + } +} \ No newline at end of file