From a197b4e4ccf1f8ea7ea6a3ace494a6316028ab97 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 4 Jan 2024 09:31:54 +0000 Subject: [PATCH] Publish Advisories GHSA-5cpg-h4r2-65fc GHSA-5hwf-735m-h24f GHSA-gm82-j72q-3fqh GHSA-jc9f-vvpx-r5r8 GHSA-p88h-866g-7w72 --- .../GHSA-5cpg-h4r2-65fc.json | 39 +++++++++++++++++++ .../GHSA-5hwf-735m-h24f.json | 31 +++++++++++++++ .../GHSA-gm82-j72q-3fqh.json | 35 +++++++++++++++++ .../GHSA-jc9f-vvpx-r5r8.json | 38 ++++++++++++++++++ .../GHSA-p88h-866g-7w72.json | 39 +++++++++++++++++++ 5 files changed, 182 insertions(+) create mode 100644 advisories/unreviewed/2024/01/GHSA-5cpg-h4r2-65fc/GHSA-5cpg-h4r2-65fc.json create mode 100644 advisories/unreviewed/2024/01/GHSA-5hwf-735m-h24f/GHSA-5hwf-735m-h24f.json create mode 100644 advisories/unreviewed/2024/01/GHSA-gm82-j72q-3fqh/GHSA-gm82-j72q-3fqh.json create mode 100644 advisories/unreviewed/2024/01/GHSA-jc9f-vvpx-r5r8/GHSA-jc9f-vvpx-r5r8.json create mode 100644 advisories/unreviewed/2024/01/GHSA-p88h-866g-7w72/GHSA-p88h-866g-7w72.json diff --git a/advisories/unreviewed/2024/01/GHSA-5cpg-h4r2-65fc/GHSA-5cpg-h4r2-65fc.json b/advisories/unreviewed/2024/01/GHSA-5cpg-h4r2-65fc/GHSA-5cpg-h4r2-65fc.json new file mode 100644 index 00000000000..c8d580f9d4e --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-5cpg-h4r2-65fc/GHSA-5cpg-h4r2-65fc.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5cpg-h4r2-65fc", + "modified": "2024-01-04T09:30:33Z", + "published": "2024-01-04T09:30:33Z", + "aliases": [ + "CVE-2023-50082" + ], + "details": "Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via session leakage allows a user to avoid logging into the backend management platform.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50082" + }, + { + "type": "WEB", + "url": "https://github.com/juraorab/cve/issues/2" + }, + { + "type": "WEB", + "url": "https://github.com/juraorab/cve/blob/master/CVE/README.md" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-04T08:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-5hwf-735m-h24f/GHSA-5hwf-735m-h24f.json b/advisories/unreviewed/2024/01/GHSA-5hwf-735m-h24f/GHSA-5hwf-735m-h24f.json new file mode 100644 index 00000000000..29fa1cfab7b --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-5hwf-735m-h24f/GHSA-5hwf-735m-h24f.json @@ -0,0 +1,31 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5hwf-735m-h24f", + "modified": "2024-01-04T09:30:32Z", + "published": "2024-01-04T09:30:32Z", + "aliases": [ + "CVE-2022-43375" + ], + "details": "Rejected reason: This CVE ID was unused by the CNA.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43375" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-04T07:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-gm82-j72q-3fqh/GHSA-gm82-j72q-3fqh.json b/advisories/unreviewed/2024/01/GHSA-gm82-j72q-3fqh/GHSA-gm82-j72q-3fqh.json new file mode 100644 index 00000000000..79ba89c72e6 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-gm82-j72q-3fqh/GHSA-gm82-j72q-3fqh.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gm82-j72q-3fqh", + "modified": "2024-01-04T09:30:33Z", + "published": "2024-01-04T09:30:33Z", + "aliases": [ + "CVE-2023-50630" + ], + "details": "Cross Site Scripting (XSS) vulnerability in xiweicheng TMS v.2.28.0 allows a remote attacker to execute arbitrary code via a crafted script to the click here function.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50630" + }, + { + "type": "WEB", + "url": "https://github.com/xiweicheng/tms/issues/19" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-04T08:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-jc9f-vvpx-r5r8/GHSA-jc9f-vvpx-r5r8.json b/advisories/unreviewed/2024/01/GHSA-jc9f-vvpx-r5r8/GHSA-jc9f-vvpx-r5r8.json new file mode 100644 index 00000000000..9eea122e4bb --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-jc9f-vvpx-r5r8/GHSA-jc9f-vvpx-r5r8.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jc9f-vvpx-r5r8", + "modified": "2024-01-04T09:30:33Z", + "published": "2024-01-04T09:30:33Z", + "aliases": [ + "CVE-2023-41784" + ], + "details": "\nPermissions and Access Control Vulnerability in ZTE Red Magic 8 Pro \n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41784" + }, + { + "type": "WEB", + "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1034444" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-04T08:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-p88h-866g-7w72/GHSA-p88h-866g-7w72.json b/advisories/unreviewed/2024/01/GHSA-p88h-866g-7w72/GHSA-p88h-866g-7w72.json new file mode 100644 index 00000000000..268528f9f6a --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-p88h-866g-7w72/GHSA-p88h-866g-7w72.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p88h-866g-7w72", + "modified": "2024-01-04T09:30:33Z", + "published": "2024-01-04T09:30:33Z", + "aliases": [ + "CVE-2023-52322" + ], + "details": "ecrire/public/assembler.php in SPIP before 4.1.3 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe characters such as alphanumerics.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52322" + }, + { + "type": "WEB", + "url": "https://blog.spip.net/Mise-a-jour-de-maintenance-et-securite-sortie-de-SPIP-4-2-7-SPIP-4-1-13.html?lang=fr" + }, + { + "type": "WEB", + "url": "https://git.spip.net/spip/spip/commit/e90f5344b8c82711053053e778d38a35e42b7bcb" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-04T07:15:09Z" + } +} \ No newline at end of file