Publish Advisories

GHSA-5cpg-h4r2-65fc
GHSA-5hwf-735m-h24f
GHSA-gm82-j72q-3fqh
GHSA-jc9f-vvpx-r5r8
GHSA-p88h-866g-7w72

advisories/unreviewed/2024/01/GHSA-5cpg-h4r2-65fc/GHSA-5cpg-h4r2-65fc.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5cpg-h4r2-65fc",
+  "modified": "2024-01-04T09:30:33Z",
+  "published": "2024-01-04T09:30:33Z",
+  "aliases": [
+    "CVE-2023-50082"
+  ],
+  "details": "Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via session leakage allows a user to avoid logging into the backend management platform.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50082"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/juraorab/cve/issues/2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/juraorab/cve/blob/master/CVE/README.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-04T08:15:08Z"
+  }
+}

advisories/unreviewed/2024/01/GHSA-5hwf-735m-h24f/GHSA-5hwf-735m-h24f.json

@@ -0,0 +1,31 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5hwf-735m-h24f",
+  "modified": "2024-01-04T09:30:32Z",
+  "published": "2024-01-04T09:30:32Z",
+  "aliases": [
+    "CVE-2022-43375"
+  ],
+  "details": "Rejected reason: This CVE ID was unused by the CNA.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43375"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-04T07:15:08Z"
+  }
+}

advisories/unreviewed/2024/01/GHSA-gm82-j72q-3fqh/GHSA-gm82-j72q-3fqh.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-gm82-j72q-3fqh",
+  "modified": "2024-01-04T09:30:33Z",
+  "published": "2024-01-04T09:30:33Z",
+  "aliases": [
+    "CVE-2023-50630"
+  ],
+  "details": "Cross Site Scripting (XSS) vulnerability in xiweicheng TMS v.2.28.0 allows a remote attacker to execute arbitrary code via a crafted script to the click here function.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50630"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/xiweicheng/tms/issues/19"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-04T08:15:09Z"
+  }
+}

advisories/unreviewed/2024/01/GHSA-jc9f-vvpx-r5r8/GHSA-jc9f-vvpx-r5r8.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jc9f-vvpx-r5r8",
+  "modified": "2024-01-04T09:30:33Z",
+  "published": "2024-01-04T09:30:33Z",
+  "aliases": [
+    "CVE-2023-41784"
+  ],
+  "details": "\nPermissions and Access Control Vulnerability in ZTE Red Magic 8 Pro \n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41784"
+    },
+    {
+      "type": "WEB",
+      "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034444"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-269"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-04T08:15:08Z"
+  }
+}

advisories/unreviewed/2024/01/GHSA-p88h-866g-7w72/GHSA-p88h-866g-7w72.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-p88h-866g-7w72",
+  "modified": "2024-01-04T09:30:33Z",
+  "published": "2024-01-04T09:30:33Z",
+  "aliases": [
+    "CVE-2023-52322"
+  ],
+  "details": "ecrire/public/assembler.php in SPIP before 4.1.3 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as alphanumerics.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52322"
+    },
+    {
+      "type": "WEB",
+      "url": "https://blog.spip.net/Mise-a-jour-de-maintenance-et-securite-sortie-de-SPIP-4-2-7-SPIP-4-1-13.html?lang=fr"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.spip.net/spip/spip/commit/e90f5344b8c82711053053e778d38a35e42b7bcb"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-04T07:15:09Z"
+  }
+}