netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-09-17 21:32:45 +00:00
parent eba205f42d
commit a10f4ae9b7
35 changed files with 1092 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/09/GHSA-5j94-f3mf-8685/GHSA-5j94-f3mf-8685.json
+66
View File
@@ -0,0 +1,66 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5j94-f3mf-8685",
"modified": "2024-09-17T21:31:28Z",
"published": "2024-09-17T21:31:28Z",
"aliases": [
"CVE-2024-46976"
],
"summary": "@backstage/plugin-techdocs-backend vulnerable to circumvention of cross site scripting protection",
"details": "### Impact\n\nAn attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing documentation or navigating to an attacker provided link.\n\n### Patches\n\nThis has been fixed in the 1.10.13 release of the `@backstage/plugin-techdocs-backend` package.\n\n### References\n\nIf you have any questions or comments about this advisory:\n\nOpen an issue in the [Backstage repository](https://github.com/backstage/backstage)\nVisit our Discord, linked to in [Backstage README](https://github.com/backstage/backstage)\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@backstage/plugin-techdocs-backend"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.10.13"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/backstage/backstage/security/advisories/GHSA-5j94-f3mf-8685"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46976"
},
{
"type": "PACKAGE",
"url": "https://github.com/backstage/backstage"
}
],
"database_specific": {
"cwe_ids": [
"CWE-693",
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-09-17T21:31:28Z",
"nvd_published_at": "2024-09-17T21:15:12Z"
}
}
advisories/github-reviewed/2024/09/GHSA-qjxf-mc72-wjr2/GHSA-qjxf-mc72-wjr2.json
+69
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2024/09/GHSA-w2r7-9579-27hf/GHSA-w2r7-9579-27hf.json → advisories/github-reviewed/2024/09/GHSA-w2r7-9579-27hf/GHSA-w2r7-9579-27hf.json
+35 -4
View File
@@ -1,20 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w2r7-9579-27hf",
"modified": "2024-09-17T18:33:26Z",
"modified": "2024-09-17T21:32:12Z",
"published": "2024-09-17T18:33:26Z",
"aliases": [
"CVE-2024-8768"
],
"summary": "vLLM denial of service vulnerability",
"details": "A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "vllm"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.5"
}
]
}
]
}
],
"references": [
{
@@ -29,6 +52,10 @@
"type": "WEB",
"url": "https://github.com/vllm-project/vllm/pull/7746"
},
{
"type": "WEB",
"url": "https://github.com/vllm-project/vllm/commit/e25fee57c2e69161bd261f5986dc5aeb198bbd42"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-8768"
@@ -36,6 +63,10 @@
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311895"
},
{
"type": "PACKAGE",
"url": "https://github.com/vllm-project/vllm"
}
],
"database_specific": {
@@ -43,8 +74,8 @@
"CWE-617"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-09-17T21:32:12Z",
"nvd_published_at": "2024-09-17T17:15:11Z"
}
}
advisories/unreviewed/2024/01/GHSA-9m9m-5xqh-55gx/GHSA-9m9m-5xqh-55gx.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9m9m-5xqh-55gx",
"modified": "2024-01-24T15:30:30Z",
"modified": "2024-09-17T21:30:30Z",
"published": "2024-01-16T18:31:09Z",
"aliases": [
"CVE-2023-0094"
advisories/unreviewed/2024/06/GHSA-7f54-5cf3-2h2x/GHSA-7f54-5cf3-2h2x.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7f54-5cf3-2h2x",
"modified": "2024-06-27T12:30:48Z",
"modified": "2024-09-17T21:30:30Z",
"published": "2024-06-27T12:30:48Z",
"aliases": [
"CVE-2024-6368"
@@ -11,6 +11,10 @@
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
advisories/unreviewed/2024/06/GHSA-852f-crfr-xw8c/GHSA-852f-crfr-xw8c.json
+10 -3
View File
@@ -1,14 +1,21 @@
{
"schema_version": "1.4.0",
"id": "GHSA-852f-crfr-xw8c",
"modified": "2024-06-27T18:31:32Z",
"modified": "2024-09-17T21:30:30Z",
"published": "2024-06-27T18:31:31Z",
"aliases": [
"CVE-2024-39374"
],
"details": "TELSAT marKoni FM Transmitters are vulnerable to an attacker exploiting a hidden admin account that can be accessed through the use of hard-coded credentials.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
@@ -27,7 +34,7 @@
"cwe_ids": [
"CWE-798"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-27T16:15:11Z"
advisories/unreviewed/2024/06/GHSA-m325-ccpm-cc67/GHSA-m325-ccpm-cc67.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m325-ccpm-cc67",
"modified": "2024-06-27T12:30:48Z",
"modified": "2024-09-17T21:30:30Z",
"published": "2024-06-27T12:30:48Z",
"aliases": [
"CVE-2024-6367"
@@ -11,6 +11,10 @@
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
advisories/unreviewed/2024/06/GHSA-rx9g-4r6p-jpgq/GHSA-rx9g-4r6p-jpgq.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rx9g-4r6p-jpgq",
"modified": "2024-06-27T12:30:49Z",
"modified": "2024-09-17T21:30:30Z",
"published": "2024-06-27T12:30:49Z",
"aliases": [
"CVE-2024-6370"
@@ -11,6 +11,10 @@
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
advisories/unreviewed/2024/06/GHSA-xrmw-792x-crvf/GHSA-xrmw-792x-crvf.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xrmw-792x-crvf",
"modified": "2024-06-27T12:30:49Z",
"modified": "2024-09-17T21:30:30Z",
"published": "2024-06-27T12:30:49Z",
"aliases": [
"CVE-2024-6369"
@@ -11,6 +11,10 @@
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
advisories/unreviewed/2024/09/GHSA-473p-xqgv-xxw3/GHSA-473p-xqgv-xxw3.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-473p-xqgv-xxw3",
"modified": "2024-09-17T21:30:33Z",
"published": "2024-09-17T21:30:33Z",
"aliases": [
"CVE-2024-8909"
],
"details": "Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8909"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/341353783"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T21:15:13Z"
}
}
advisories/unreviewed/2024/09/GHSA-56gf-j26c-43xh/GHSA-56gf-j26c-43xh.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-56gf-j26c-43xh",
"modified": "2024-09-17T00:31:05Z",
"modified": "2024-09-17T21:30:31Z",
"published": "2024-09-17T00:31:05Z",
"aliases": [
"CVE-2024-44132"
],
"details": "This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-61"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T00:15:50Z"
advisories/unreviewed/2024/09/GHSA-58rw-8pf6-2mgq/GHSA-58rw-8pf6-2mgq.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-58rw-8pf6-2mgq",
"modified": "2024-09-17T21:30:33Z",
"published": "2024-09-17T21:30:33Z",
"aliases": [
"CVE-2024-8956"
],
"details": "PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an insufficient authentication issue. The camera does not properly enforce authentication to /cgi-bin/param.cgi when requests are sent without an HTTP Authorization header. The result is a remote and unauthenticated attacker can leak sensitive data such as usernames, password hashes, and configurations details. Additionally, the attacker can update individual configuration values or overwrite the whole file.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8956"
},
{
"type": "WEB",
"url": "https://ptzoptics.com/firmware-changelog"
},
{
"type": "WEB",
"url": "https://vulncheck.com/advisories/ptzoptics-insufficient-auth"
}
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T20:15:07Z"
}
}
advisories/unreviewed/2024/09/GHSA-67qp-fprc-rhx4/GHSA-67qp-fprc-rhx4.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-67qp-fprc-rhx4",
"modified": "2024-09-17T15:31:23Z",
"modified": "2024-09-17T21:30:32Z",
"published": "2024-09-17T15:31:23Z",
"aliases": [
"CVE-2024-46362"
],
"details": "FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/?/plugin/file_manager/create_directory",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T13:15:03Z"
advisories/unreviewed/2024/09/GHSA-74qm-4v7r-jw2f/GHSA-74qm-4v7r-jw2f.json
+62
View File
@@ -0,0 +1,62 @@
{
"schema_version": "1.4.0",
"id": "GHSA-74qm-4v7r-jw2f",
"modified": "2024-09-17T21:30:33Z",
"published": "2024-09-17T21:30:33Z",
"aliases": [
"CVE-2024-8946"
],
"details": "A vulnerability was found in MicroPython 1.23.0. It has been classified as critical. Affected is the function mp_vfs_umount of the file extmod/vfs.c of the component VFS Unmount Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 29943546343c92334e8518695a11fc0e2ceea68b. It is recommended to apply a patch to fix this issue. In the VFS unmount process, the comparison between the mounted path string and the unmount requested string is based solely on the length of the unmount string, which can lead to a heap buffer overflow read.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8946"
},
{
"type": "WEB",
"url": "https://github.com/micropython/micropython/issues/13006"
},
{
"type": "WEB",
"url": "https://github.com/micropython/micropython/issues/13006#issuecomment-1820309455"
},
{
"type": "WEB",
"url": "https://github.com/micropython/micropython/commit/29943546343c92334e8518695a11fc0e2ceea68b"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.277764"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.277764"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.409312"
}
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T19:15:29Z"
}
}
advisories/unreviewed/2024/09/GHSA-76f7-g9hr-v32c/GHSA-76f7-g9hr-v32c.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-76f7-g9hr-v32c",
"modified": "2024-09-17T21:30:33Z",
"published": "2024-09-17T21:30:33Z",
"aliases": [
"CVE-2024-8907"
],
"details": "Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (XSS) via a crafted set of UI gestures. (Chromium security severity: Medium)",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8907"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/360642942"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T21:15:13Z"
}
}
advisories/unreviewed/2024/09/GHSA-79c6-5cw9-rpwc/GHSA-79c6-5cw9-rpwc.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-79c6-5cw9-rpwc",
"modified": "2024-09-17T00:31:04Z",
"modified": "2024-09-17T21:30:31Z",
"published": "2024-09-17T00:31:04Z",
"aliases": [
"CVE-2024-40825"
],
"details": "The issue was addressed with improved checks. This issue is fixed in visionOS 2, macOS Sequoia 15. A malicious app with root privileges may be able to modify the contents of system files.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T00:15:48Z"
advisories/unreviewed/2024/09/GHSA-86wc-gr98-6p59/GHSA-86wc-gr98-6p59.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-86wc-gr98-6p59",
"modified": "2024-09-17T21:30:33Z",
"published": "2024-09-17T21:30:33Z",
"aliases": [
"CVE-2024-8908"
],
"details": "Inappropriate implementation in Autofill in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8908"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop_17.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/337222641"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T21:15:13Z"
}
}
advisories/unreviewed/2024/09/GHSA-976w-rfcm-5cfg/GHSA-976w-rfcm-5cfg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-976w-rfcm-5cfg",
"modified": "2024-09-17T00:31:03Z",
"modified": "2024-09-17T21:30:31Z",
"published": "2024-09-17T00:31:03Z",
"aliases": [
"CVE-2024-27876"
],
"details": "A race condition was addressed with improved locking. This issue is fixed in macOS Ventura 13.7, iOS 17.7 and iPadOS 17.7, visionOS 2, iOS 18 and iPadOS 18, macOS Sonoma 14.7, macOS Sequoia 15. Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
}
],
"affected": [
@@ -45,9 +48,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T00:15:48Z"
advisories/unreviewed/2024/09/GHSA-97x9-7h6v-3jx9/GHSA-97x9-7h6v-3jx9.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-97x9-7h6v-3jx9",
"modified": "2024-09-17T21:30:32Z",
"published": "2024-09-17T21:30:32Z",
"aliases": [
"CVE-2024-8900"
],
"details": "An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vulnerability affects Firefox < 129.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8900"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1872841"
},
{
"type": "WEB",
"url": "https://www.mozilla.org/security/advisories/mfsa2024-33"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T19:15:29Z"
}
}
advisories/unreviewed/2024/09/GHSA-998c-q8hh-h8gv/GHSA-998c-q8hh-h8gv.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-998c-q8hh-h8gv",
"modified": "2024-09-17T21:30:32Z",
"published": "2024-09-17T21:30:32Z",
"aliases": [
"CVE-2024-8660"
],
"details": "Concrete CMS versions 9.0.0 through 9.3.3 are affected by a\nstored XSS vulnerability in the \"Top Navigator Bar\" block.\nSince the \"Top Navigator Bar\" output was not sufficiently sanitized, a rogue administrator could add a malicious payload that could be executed when targeted users visited the home page.The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 4.6\nwith vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N . This\ndoes not affect versions below 9.0.0 since they do not have the Top\nNavigator Bar Block. Thanks, Chu Quoc Khanh for reporting.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8660"
},
{
"type": "WEB",
"url": "https://github.com/concretecms/concretecms/pull/12128"
},
{
"type": "WEB",
"url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/934-release-notes"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T19:15:28Z"
}
}

Some files were not shown because too many files have changed in this diff Show More