diff --git a/advisories/github-reviewed/2018/10/GHSA-cmwx-9m2h-x7v4/GHSA-cmwx-9m2h-x7v4.json b/advisories/github-reviewed/2018/10/GHSA-cmwx-9m2h-x7v4/GHSA-cmwx-9m2h-x7v4.json index dd1d4a22ef9..11b9a3cebbf 100644 --- a/advisories/github-reviewed/2018/10/GHSA-cmwx-9m2h-x7v4/GHSA-cmwx-9m2h-x7v4.json +++ b/advisories/github-reviewed/2018/10/GHSA-cmwx-9m2h-x7v4/GHSA-cmwx-9m2h-x7v4.json @@ -1,17 +1,21 @@ { "schema_version": "1.4.0", "id": "GHSA-cmwx-9m2h-x7v4", - "modified": "2022-04-26T18:41:32Z", + "modified": "2024-09-03T21:31:19Z", "published": "2018-10-10T17:23:26Z", "aliases": [ "CVE-2016-8614" ], "summary": "Ansible apt_key module does not properly verify key fingerprint", - "details": "A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.", + "details": "A flaw was found in Ansible before version 2.2.0.0. The `apt_key` module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" } ], "affected": [ @@ -28,7 +32,7 @@ "introduced": "0" }, { - "fixed": "2.2.0" + "fixed": "2.2.0.0" } ] } @@ -40,9 +44,45 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8614" }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible-modules-core/issues/5237" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible-modules-core/pull/5353" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible-modules-core/pull/5357" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible-modules-core/commit/1182d1f0b76d56f3667e27987a10b9ec8f03357d" + }, + { + "type": "WEB", + "url": "https://github.com/ansible/ansible-modules-core/commit/66d47c8149d84e52f64b7c4d1f340d45dca94d9c" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8614" + }, { "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-cmwx-9m2h-x7v4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/ansible/ansible" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-37.yaml" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20200227214450/https://www.securityfocus.com/bid/94108" } ], "database_specific": { diff --git a/advisories/unreviewed/2023/11/GHSA-7mw5-v379-5f57/GHSA-7mw5-v379-5f57.json b/advisories/unreviewed/2023/11/GHSA-7mw5-v379-5f57/GHSA-7mw5-v379-5f57.json index 8846b654c0e..78f908dbb22 100644 --- a/advisories/unreviewed/2023/11/GHSA-7mw5-v379-5f57/GHSA-7mw5-v379-5f57.json +++ b/advisories/unreviewed/2023/11/GHSA-7mw5-v379-5f57/GHSA-7mw5-v379-5f57.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7mw5-v379-5f57", - "modified": "2023-11-14T21:30:54Z", + "modified": "2024-09-03T21:31:08Z", "published": "2023-11-08T09:30:25Z", "aliases": [ "CVE-2023-46483" diff --git a/advisories/unreviewed/2023/11/GHSA-f2gq-74f6-v2f7/GHSA-f2gq-74f6-v2f7.json b/advisories/unreviewed/2023/11/GHSA-f2gq-74f6-v2f7/GHSA-f2gq-74f6-v2f7.json index f6d54596ac5..19c6562cefe 100644 --- a/advisories/unreviewed/2023/11/GHSA-f2gq-74f6-v2f7/GHSA-f2gq-74f6-v2f7.json +++ b/advisories/unreviewed/2023/11/GHSA-f2gq-74f6-v2f7/GHSA-f2gq-74f6-v2f7.json @@ -36,7 +36,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-20" + "CWE-20", + "CWE-400" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/01/GHSA-5cg7-xxf6-84x2/GHSA-5cg7-xxf6-84x2.json b/advisories/unreviewed/2024/01/GHSA-5cg7-xxf6-84x2/GHSA-5cg7-xxf6-84x2.json index 815805451c7..1cd4e30ab73 100644 --- a/advisories/unreviewed/2024/01/GHSA-5cg7-xxf6-84x2/GHSA-5cg7-xxf6-84x2.json +++ b/advisories/unreviewed/2024/01/GHSA-5cg7-xxf6-84x2/GHSA-5cg7-xxf6-84x2.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-200" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/01/GHSA-mmx8-j2r4-x8r6/GHSA-mmx8-j2r4-x8r6.json b/advisories/unreviewed/2024/01/GHSA-mmx8-j2r4-x8r6/GHSA-mmx8-j2r4-x8r6.json index 883d12a9f4f..8c68b158d26 100644 --- a/advisories/unreviewed/2024/01/GHSA-mmx8-j2r4-x8r6/GHSA-mmx8-j2r4-x8r6.json +++ b/advisories/unreviewed/2024/01/GHSA-mmx8-j2r4-x8r6/GHSA-mmx8-j2r4-x8r6.json @@ -32,7 +32,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/01/GHSA-rvgj-6xhm-fmfh/GHSA-rvgj-6xhm-fmfh.json b/advisories/unreviewed/2024/01/GHSA-rvgj-6xhm-fmfh/GHSA-rvgj-6xhm-fmfh.json index 3b99be7f40f..c300e8bd862 100644 --- a/advisories/unreviewed/2024/01/GHSA-rvgj-6xhm-fmfh/GHSA-rvgj-6xhm-fmfh.json +++ b/advisories/unreviewed/2024/01/GHSA-rvgj-6xhm-fmfh/GHSA-rvgj-6xhm-fmfh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rvgj-6xhm-fmfh", - "modified": "2024-01-19T18:30:25Z", + "modified": "2024-09-03T21:31:11Z", "published": "2024-01-16T09:30:18Z", "aliases": [ "CVE-2023-44112" diff --git a/advisories/unreviewed/2024/01/GHSA-wj2p-g4wr-m64x/GHSA-wj2p-g4wr-m64x.json b/advisories/unreviewed/2024/01/GHSA-wj2p-g4wr-m64x/GHSA-wj2p-g4wr-m64x.json index 6b231ea3dca..08b0e972c43 100644 --- a/advisories/unreviewed/2024/01/GHSA-wj2p-g4wr-m64x/GHSA-wj2p-g4wr-m64x.json +++ b/advisories/unreviewed/2024/01/GHSA-wj2p-g4wr-m64x/GHSA-wj2p-g4wr-m64x.json @@ -32,7 +32,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-755" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/05/GHSA-m4gv-x9wg-r7pw/GHSA-m4gv-x9wg-r7pw.json b/advisories/unreviewed/2024/05/GHSA-m4gv-x9wg-r7pw/GHSA-m4gv-x9wg-r7pw.json index ac58b2196e7..de49c42fc7d 100644 --- a/advisories/unreviewed/2024/05/GHSA-m4gv-x9wg-r7pw/GHSA-m4gv-x9wg-r7pw.json +++ b/advisories/unreviewed/2024/05/GHSA-m4gv-x9wg-r7pw/GHSA-m4gv-x9wg-r7pw.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-m4gv-x9wg-r7pw", - "modified": "2024-05-14T18:30:49Z", + "modified": "2024-09-03T21:31:11Z", "published": "2024-05-14T18:30:49Z", "aliases": [ "CVE-2024-34224" ], "details": "Cross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject arbitrary web script or HTML via the firstname, middlename, lastname parameters.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-05-14T15:38:36Z" diff --git a/advisories/unreviewed/2024/05/GHSA-ppc9-9hjq-rfh7/GHSA-ppc9-9hjq-rfh7.json b/advisories/unreviewed/2024/05/GHSA-ppc9-9hjq-rfh7/GHSA-ppc9-9hjq-rfh7.json index e981e434e4b..abc7cab7de9 100644 --- a/advisories/unreviewed/2024/05/GHSA-ppc9-9hjq-rfh7/GHSA-ppc9-9hjq-rfh7.json +++ b/advisories/unreviewed/2024/05/GHSA-ppc9-9hjq-rfh7/GHSA-ppc9-9hjq-rfh7.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-ppc9-9hjq-rfh7", - "modified": "2024-05-14T18:30:48Z", + "modified": "2024-09-03T21:31:11Z", "published": "2024-05-14T18:30:48Z", "aliases": [ "CVE-2024-33773" ], "details": "A buffer overflow vulnerability in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 via formWlanGuestSetup allows remote authenticated users to trigger a denial of service (DoS) through the parameter \"webpage.\"", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-120" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-05-14T15:38:05Z" diff --git a/advisories/unreviewed/2024/07/GHSA-2hqg-m6wm-qjm5/GHSA-2hqg-m6wm-qjm5.json b/advisories/unreviewed/2024/07/GHSA-2hqg-m6wm-qjm5/GHSA-2hqg-m6wm-qjm5.json index 2bd6bbfda87..191b8fc0c51 100644 --- a/advisories/unreviewed/2024/07/GHSA-2hqg-m6wm-qjm5/GHSA-2hqg-m6wm-qjm5.json +++ b/advisories/unreviewed/2024/07/GHSA-2hqg-m6wm-qjm5/GHSA-2hqg-m6wm-qjm5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-2hqg-m6wm-qjm5", - "modified": "2024-07-25T18:32:36Z", + "modified": "2024-09-03T21:31:11Z", "published": "2024-07-24T18:31:16Z", "aliases": [ "CVE-2024-31970" @@ -28,6 +28,10 @@ { "type": "WEB", "url": "https://github.com/actuator/cve/blob/main/AdTran/SRG-834-5" + }, + { + "type": "WEB", + "url": "https://supportcommunity.adtran.com/t5/Security-Advisories/ADTSA-2024001-Multiple-vulnerabilities-in-Service-Delivery-Gateway-products/ta-p/39332" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/07/GHSA-4pmv-jg56-hh93/GHSA-4pmv-jg56-hh93.json b/advisories/unreviewed/2024/07/GHSA-4pmv-jg56-hh93/GHSA-4pmv-jg56-hh93.json index c3572938a9d..cd6e35a5e71 100644 --- a/advisories/unreviewed/2024/07/GHSA-4pmv-jg56-hh93/GHSA-4pmv-jg56-hh93.json +++ b/advisories/unreviewed/2024/07/GHSA-4pmv-jg56-hh93/GHSA-4pmv-jg56-hh93.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4pmv-jg56-hh93", - "modified": "2024-07-21T09:30:32Z", + "modified": "2024-09-03T21:31:11Z", "published": "2024-07-21T09:30:32Z", "aliases": [ "CVE-2024-37550" diff --git a/advisories/unreviewed/2024/07/GHSA-4r38-rqh5-3fvr/GHSA-4r38-rqh5-3fvr.json b/advisories/unreviewed/2024/07/GHSA-4r38-rqh5-3fvr/GHSA-4r38-rqh5-3fvr.json index eb665db0a4c..84b82762062 100644 --- a/advisories/unreviewed/2024/07/GHSA-4r38-rqh5-3fvr/GHSA-4r38-rqh5-3fvr.json +++ b/advisories/unreviewed/2024/07/GHSA-4r38-rqh5-3fvr/GHSA-4r38-rqh5-3fvr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4r38-rqh5-3fvr", - "modified": "2024-07-26T15:31:50Z", + "modified": "2024-09-03T21:31:11Z", "published": "2024-07-24T15:31:28Z", "aliases": [ "CVE-2024-31977" @@ -32,6 +32,10 @@ { "type": "WEB", "url": "https://github.com/actuator/cve/tree/main/AdTran/834-5" + }, + { + "type": "WEB", + "url": "https://supportcommunity.adtran.com/t5/Security-Advisories/ADTSA-2024001-Multiple-vulnerabilities-in-Service-Delivery-Gateway-products/ta-p/39332" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/08/GHSA-2m5g-p4h5-r9jp/GHSA-2m5g-p4h5-r9jp.json b/advisories/unreviewed/2024/08/GHSA-2m5g-p4h5-r9jp/GHSA-2m5g-p4h5-r9jp.json index 87db09a6805..9f274d84881 100644 --- a/advisories/unreviewed/2024/08/GHSA-2m5g-p4h5-r9jp/GHSA-2m5g-p4h5-r9jp.json +++ b/advisories/unreviewed/2024/08/GHSA-2m5g-p4h5-r9jp/GHSA-2m5g-p4h5-r9jp.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-2m5g-p4h5-r9jp", - "modified": "2024-08-12T18:30:45Z", + "modified": "2024-09-03T21:31:11Z", "published": "2024-08-02T18:31:11Z", "aliases": [ "CVE-2024-33895" ], "details": "Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 use a unique key to encrypt the configuration parameters. This is fixed in version 21.2s10 and 22.1s3, the key is now unique per device.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-798" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-02T18:16:18Z" diff --git a/advisories/unreviewed/2024/08/GHSA-2q7v-x8xx-mpjx/GHSA-2q7v-x8xx-mpjx.json b/advisories/unreviewed/2024/08/GHSA-2q7v-x8xx-mpjx/GHSA-2q7v-x8xx-mpjx.json index 4a443d10cde..38285e276b4 100644 --- a/advisories/unreviewed/2024/08/GHSA-2q7v-x8xx-mpjx/GHSA-2q7v-x8xx-mpjx.json +++ b/advisories/unreviewed/2024/08/GHSA-2q7v-x8xx-mpjx/GHSA-2q7v-x8xx-mpjx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-2q7v-x8xx-mpjx", - "modified": "2024-08-20T12:30:28Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-08-20T12:30:28Z", "aliases": [ "CVE-2024-41699" diff --git a/advisories/unreviewed/2024/08/GHSA-4rf2-x7fh-vgpg/GHSA-4rf2-x7fh-vgpg.json b/advisories/unreviewed/2024/08/GHSA-4rf2-x7fh-vgpg/GHSA-4rf2-x7fh-vgpg.json index 92f2953407f..470993d3eb4 100644 --- a/advisories/unreviewed/2024/08/GHSA-4rf2-x7fh-vgpg/GHSA-4rf2-x7fh-vgpg.json +++ b/advisories/unreviewed/2024/08/GHSA-4rf2-x7fh-vgpg/GHSA-4rf2-x7fh-vgpg.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4rf2-x7fh-vgpg", - "modified": "2024-08-21T15:30:50Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-08-19T21:35:11Z", "aliases": [ "CVE-2024-42815" @@ -24,6 +24,10 @@ { "type": "WEB", "url": "https://gist.github.com/XiaoCurry/14d46e0becd79d9bb9907f2fbe147cfe" + }, + { + "type": "WEB", + "url": "https://securityonline.info/cve-2024-42815-cvss-9-8-buffer-overflow-flaw-in-tp-link-routers-opens-door-to-rce" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/08/GHSA-6q66-f3v9-mwr7/GHSA-6q66-f3v9-mwr7.json b/advisories/unreviewed/2024/08/GHSA-6q66-f3v9-mwr7/GHSA-6q66-f3v9-mwr7.json index 880feb8c497..6572e67842b 100644 --- a/advisories/unreviewed/2024/08/GHSA-6q66-f3v9-mwr7/GHSA-6q66-f3v9-mwr7.json +++ b/advisories/unreviewed/2024/08/GHSA-6q66-f3v9-mwr7/GHSA-6q66-f3v9-mwr7.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-6q66-f3v9-mwr7", - "modified": "2024-08-29T18:31:36Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-08-29T18:31:35Z", "aliases": [ "CVE-2024-44776" ], "details": "An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a crafted URL.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-601" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-29T18:15:14Z" diff --git a/advisories/unreviewed/2024/08/GHSA-765j-3jm5-8cf6/GHSA-765j-3jm5-8cf6.json b/advisories/unreviewed/2024/08/GHSA-765j-3jm5-8cf6/GHSA-765j-3jm5-8cf6.json index 26d6c61dd31..d174a33fad6 100644 --- a/advisories/unreviewed/2024/08/GHSA-765j-3jm5-8cf6/GHSA-765j-3jm5-8cf6.json +++ b/advisories/unreviewed/2024/08/GHSA-765j-3jm5-8cf6/GHSA-765j-3jm5-8cf6.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-121", "CWE-787" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2024/08/GHSA-7pp9-59r6-x3f6/GHSA-7pp9-59r6-x3f6.json b/advisories/unreviewed/2024/08/GHSA-7pp9-59r6-x3f6/GHSA-7pp9-59r6-x3f6.json index 3b724c35f29..51320bedfd7 100644 --- a/advisories/unreviewed/2024/08/GHSA-7pp9-59r6-x3f6/GHSA-7pp9-59r6-x3f6.json +++ b/advisories/unreviewed/2024/08/GHSA-7pp9-59r6-x3f6/GHSA-7pp9-59r6-x3f6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7pp9-59r6-x3f6", - "modified": "2024-08-07T18:30:41Z", + "modified": "2024-09-03T21:31:11Z", "published": "2024-08-02T18:31:10Z", "aliases": [ "CVE-2024-41518" @@ -29,9 +29,17 @@ "type": "WEB", "url": "http://feripro.com" }, + { + "type": "WEB", + "url": "http://feripro.de" + }, { "type": "WEB", "url": "http://mecodia.com" + }, + { + "type": "WEB", + "url": "http://mecodia.de" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/08/GHSA-8547-j8j2-79v8/GHSA-8547-j8j2-79v8.json b/advisories/unreviewed/2024/08/GHSA-8547-j8j2-79v8/GHSA-8547-j8j2-79v8.json index c26706081a2..04b26bdef34 100644 --- a/advisories/unreviewed/2024/08/GHSA-8547-j8j2-79v8/GHSA-8547-j8j2-79v8.json +++ b/advisories/unreviewed/2024/08/GHSA-8547-j8j2-79v8/GHSA-8547-j8j2-79v8.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-121", "CWE-787" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2024/08/GHSA-9q4j-4jmg-xr2j/GHSA-9q4j-4jmg-xr2j.json b/advisories/unreviewed/2024/08/GHSA-9q4j-4jmg-xr2j/GHSA-9q4j-4jmg-xr2j.json index cc01ccba048..c247e721601 100644 --- a/advisories/unreviewed/2024/08/GHSA-9q4j-4jmg-xr2j/GHSA-9q4j-4jmg-xr2j.json +++ b/advisories/unreviewed/2024/08/GHSA-9q4j-4jmg-xr2j/GHSA-9q4j-4jmg-xr2j.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9q4j-4jmg-xr2j", - "modified": "2024-08-12T18:30:45Z", + "modified": "2024-09-03T21:31:11Z", "published": "2024-08-02T18:31:10Z", "aliases": [ "CVE-2024-33893" ], "details": "Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to XSS when displaying the logs due to improper input sanitization. This is fixed in version 21.2s10 and 22.1s3.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-02T18:16:18Z" diff --git a/advisories/unreviewed/2024/08/GHSA-c3gm-32gm-crw9/GHSA-c3gm-32gm-crw9.json b/advisories/unreviewed/2024/08/GHSA-c3gm-32gm-crw9/GHSA-c3gm-32gm-crw9.json index 161a41d843b..fb8feae28d6 100644 --- a/advisories/unreviewed/2024/08/GHSA-c3gm-32gm-crw9/GHSA-c3gm-32gm-crw9.json +++ b/advisories/unreviewed/2024/08/GHSA-c3gm-32gm-crw9/GHSA-c3gm-32gm-crw9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-c3gm-32gm-crw9", - "modified": "2024-08-20T12:30:27Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-08-20T12:30:27Z", "aliases": [ "CVE-2024-41698" diff --git a/advisories/unreviewed/2024/08/GHSA-f8w7-phwr-8g55/GHSA-f8w7-phwr-8g55.json b/advisories/unreviewed/2024/08/GHSA-f8w7-phwr-8g55/GHSA-f8w7-phwr-8g55.json index b728c518d88..9c94c980c39 100644 --- a/advisories/unreviewed/2024/08/GHSA-f8w7-phwr-8g55/GHSA-f8w7-phwr-8g55.json +++ b/advisories/unreviewed/2024/08/GHSA-f8w7-phwr-8g55/GHSA-f8w7-phwr-8g55.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-f8w7-phwr-8g55", - "modified": "2024-08-20T12:30:27Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-08-20T12:30:27Z", "aliases": [ "CVE-2024-41697" @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-79", "CWE-80" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2024/08/GHSA-fgqq-q43f-65jf/GHSA-fgqq-q43f-65jf.json b/advisories/unreviewed/2024/08/GHSA-fgqq-q43f-65jf/GHSA-fgqq-q43f-65jf.json index 38738300680..38664984771 100644 --- a/advisories/unreviewed/2024/08/GHSA-fgqq-q43f-65jf/GHSA-fgqq-q43f-65jf.json +++ b/advisories/unreviewed/2024/08/GHSA-fgqq-q43f-65jf/GHSA-fgqq-q43f-65jf.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-fgqq-q43f-65jf", - "modified": "2024-08-12T18:30:45Z", + "modified": "2024-09-03T21:31:11Z", "published": "2024-08-02T18:31:12Z", "aliases": [ "CVE-2024-33896" ], "details": "Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection due to improper parameter blacklisting. This is fixed in version 21.2s10 and 22.1s3.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-78" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-02T18:16:19Z" diff --git a/advisories/unreviewed/2024/08/GHSA-g5wr-xh7j-3w9v/GHSA-g5wr-xh7j-3w9v.json b/advisories/unreviewed/2024/08/GHSA-g5wr-xh7j-3w9v/GHSA-g5wr-xh7j-3w9v.json index f5d386e4ab6..734eb5718c1 100644 --- a/advisories/unreviewed/2024/08/GHSA-g5wr-xh7j-3w9v/GHSA-g5wr-xh7j-3w9v.json +++ b/advisories/unreviewed/2024/08/GHSA-g5wr-xh7j-3w9v/GHSA-g5wr-xh7j-3w9v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-g5wr-xh7j-3w9v", - "modified": "2024-08-30T18:30:37Z", + "modified": "2024-09-03T21:31:11Z", "published": "2024-08-02T18:31:10Z", "aliases": [ "CVE-2024-41519" @@ -29,9 +29,17 @@ "type": "WEB", "url": "http://feripro.com" }, + { + "type": "WEB", + "url": "http://feripro.de" + }, { "type": "WEB", "url": "http://mecodia.com" + }, + { + "type": "WEB", + "url": "http://mecodia.de" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/08/GHSA-g9q9-268w-xmvw/GHSA-g9q9-268w-xmvw.json b/advisories/unreviewed/2024/08/GHSA-g9q9-268w-xmvw/GHSA-g9q9-268w-xmvw.json index f6777acaea7..5aba4fba057 100644 --- a/advisories/unreviewed/2024/08/GHSA-g9q9-268w-xmvw/GHSA-g9q9-268w-xmvw.json +++ b/advisories/unreviewed/2024/08/GHSA-g9q9-268w-xmvw/GHSA-g9q9-268w-xmvw.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-g9q9-268w-xmvw", - "modified": "2024-08-29T18:31:36Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-08-29T18:31:35Z", "aliases": [ "CVE-2024-44717" ], "details": "A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-29T18:15:14Z" diff --git a/advisories/unreviewed/2024/08/GHSA-jpqh-p3f6-x53r/GHSA-jpqh-p3f6-x53r.json b/advisories/unreviewed/2024/08/GHSA-jpqh-p3f6-x53r/GHSA-jpqh-p3f6-x53r.json index f3daaae9e5d..f11edddfd59 100644 --- a/advisories/unreviewed/2024/08/GHSA-jpqh-p3f6-x53r/GHSA-jpqh-p3f6-x53r.json +++ b/advisories/unreviewed/2024/08/GHSA-jpqh-p3f6-x53r/GHSA-jpqh-p3f6-x53r.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-jpqh-p3f6-x53r", - "modified": "2024-08-29T18:31:36Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-08-29T18:31:36Z", "aliases": [ "CVE-2024-44716" ], "details": "A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-29T18:15:14Z" diff --git a/advisories/unreviewed/2024/08/GHSA-mr7q-fp6v-4rc6/GHSA-mr7q-fp6v-4rc6.json b/advisories/unreviewed/2024/08/GHSA-mr7q-fp6v-4rc6/GHSA-mr7q-fp6v-4rc6.json index 041837daf13..a5f5c823e9d 100644 --- a/advisories/unreviewed/2024/08/GHSA-mr7q-fp6v-4rc6/GHSA-mr7q-fp6v-4rc6.json +++ b/advisories/unreviewed/2024/08/GHSA-mr7q-fp6v-4rc6/GHSA-mr7q-fp6v-4rc6.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mr7q-fp6v-4rc6", - "modified": "2024-08-15T21:31:19Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-08-15T21:31:19Z", "aliases": [ "CVE-2024-27729" ], "details": "Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the location parameter of the calendar event feature.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-15T19:15:18Z" diff --git a/advisories/unreviewed/2024/08/GHSA-p64m-r26f-95x6/GHSA-p64m-r26f-95x6.json b/advisories/unreviewed/2024/08/GHSA-p64m-r26f-95x6/GHSA-p64m-r26f-95x6.json index b7e1b481b41..cbeb33e9a01 100644 --- a/advisories/unreviewed/2024/08/GHSA-p64m-r26f-95x6/GHSA-p64m-r26f-95x6.json +++ b/advisories/unreviewed/2024/08/GHSA-p64m-r26f-95x6/GHSA-p64m-r26f-95x6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-p64m-r26f-95x6", - "modified": "2024-08-30T18:30:37Z", + "modified": "2024-09-03T21:31:11Z", "published": "2024-08-02T18:31:10Z", "aliases": [ "CVE-2024-41517" @@ -29,9 +29,17 @@ "type": "WEB", "url": "http://feripro.com" }, + { + "type": "WEB", + "url": "http://feripro.de" + }, { "type": "WEB", "url": "http://mecodia.com" + }, + { + "type": "WEB", + "url": "http://mecodia.de" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/08/GHSA-r733-m3p8-hrxv/GHSA-r733-m3p8-hrxv.json b/advisories/unreviewed/2024/08/GHSA-r733-m3p8-hrxv/GHSA-r733-m3p8-hrxv.json index 3735f494dcd..6766357724e 100644 --- a/advisories/unreviewed/2024/08/GHSA-r733-m3p8-hrxv/GHSA-r733-m3p8-hrxv.json +++ b/advisories/unreviewed/2024/08/GHSA-r733-m3p8-hrxv/GHSA-r733-m3p8-hrxv.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-r733-m3p8-hrxv", - "modified": "2024-08-20T06:31:37Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-08-20T06:31:37Z", "aliases": [ "CVE-2024-6864" diff --git a/advisories/unreviewed/2024/08/GHSA-v6mw-6v3j-4h68/GHSA-v6mw-6v3j-4h68.json b/advisories/unreviewed/2024/08/GHSA-v6mw-6v3j-4h68/GHSA-v6mw-6v3j-4h68.json index 266252750d1..23f928f0761 100644 --- a/advisories/unreviewed/2024/08/GHSA-v6mw-6v3j-4h68/GHSA-v6mw-6v3j-4h68.json +++ b/advisories/unreviewed/2024/08/GHSA-v6mw-6v3j-4h68/GHSA-v6mw-6v3j-4h68.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-v6mw-6v3j-4h68", - "modified": "2024-08-20T06:31:36Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-08-20T06:31:36Z", "aliases": [ "CVE-2024-5763" diff --git a/advisories/unreviewed/2024/08/GHSA-w82p-4ch4-2pv5/GHSA-w82p-4ch4-2pv5.json b/advisories/unreviewed/2024/08/GHSA-w82p-4ch4-2pv5/GHSA-w82p-4ch4-2pv5.json index 37fe6147ab6..db8f13dbc23 100644 --- a/advisories/unreviewed/2024/08/GHSA-w82p-4ch4-2pv5/GHSA-w82p-4ch4-2pv5.json +++ b/advisories/unreviewed/2024/08/GHSA-w82p-4ch4-2pv5/GHSA-w82p-4ch4-2pv5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-w82p-4ch4-2pv5", - "modified": "2024-08-20T06:31:37Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-08-20T06:31:36Z", "aliases": [ "CVE-2024-6575" diff --git a/advisories/unreviewed/2024/08/GHSA-x973-f6rm-j4v5/GHSA-x973-f6rm-j4v5.json b/advisories/unreviewed/2024/08/GHSA-x973-f6rm-j4v5/GHSA-x973-f6rm-j4v5.json index ccd0c97997f..74c2f4095fa 100644 --- a/advisories/unreviewed/2024/08/GHSA-x973-f6rm-j4v5/GHSA-x973-f6rm-j4v5.json +++ b/advisories/unreviewed/2024/08/GHSA-x973-f6rm-j4v5/GHSA-x973-f6rm-j4v5.json @@ -40,7 +40,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-281" + "CWE-281", + "CWE-312" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/08/GHSA-xmf5-8jhr-2q75/GHSA-xmf5-8jhr-2q75.json b/advisories/unreviewed/2024/08/GHSA-xmf5-8jhr-2q75/GHSA-xmf5-8jhr-2q75.json index 72bbfb302bd..bfabf645107 100644 --- a/advisories/unreviewed/2024/08/GHSA-xmf5-8jhr-2q75/GHSA-xmf5-8jhr-2q75.json +++ b/advisories/unreviewed/2024/08/GHSA-xmf5-8jhr-2q75/GHSA-xmf5-8jhr-2q75.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-59", "CWE-61" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2024/09/GHSA-2qqq-gmvr-p2rw/GHSA-2qqq-gmvr-p2rw.json b/advisories/unreviewed/2024/09/GHSA-2qqq-gmvr-p2rw/GHSA-2qqq-gmvr-p2rw.json new file mode 100644 index 00000000000..882ca705424 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-2qqq-gmvr-p2rw/GHSA-2qqq-gmvr-p2rw.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2qqq-gmvr-p2rw", + "modified": "2024-09-03T21:31:12Z", + "published": "2024-09-03T21:31:12Z", + "aliases": [ + "CVE-2024-41435" + ], + "details": "YugabyteDB v2.21.1.0 was discovered to contain a buffer overflow via the \"insert into\" parameter.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41435" + }, + { + "type": "WEB", + "url": "https://github.com/yugabyte/yugabyte-db/issues/22967" + }, + { + "type": "WEB", + "url": "https://gist.github.com/ycybfhb/1427881e7db911786837d32b0669e06b" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-03T19:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-5h7r-mv43-gm2c/GHSA-5h7r-mv43-gm2c.json b/advisories/unreviewed/2024/09/GHSA-5h7r-mv43-gm2c/GHSA-5h7r-mv43-gm2c.json new file mode 100644 index 00000000000..6af9ccbdeee --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-5h7r-mv43-gm2c/GHSA-5h7r-mv43-gm2c.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5h7r-mv43-gm2c", + "modified": "2024-09-03T21:31:12Z", + "published": "2024-09-03T21:31:12Z", + "aliases": [ + "CVE-2024-8399" + ], + "details": "Websites could utilize Javascript links to spoof URL addresses in the Focus navigation bar This vulnerability affects Focus for iOS < 130.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8399" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1863838" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-42" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-03T20:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-66rc-q43x-8675/GHSA-66rc-q43x-8675.json b/advisories/unreviewed/2024/09/GHSA-66rc-q43x-8675/GHSA-66rc-q43x-8675.json new file mode 100644 index 00000000000..1a6bbb4a27a --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-66rc-q43x-8675/GHSA-66rc-q43x-8675.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-66rc-q43x-8675", + "modified": "2024-09-03T21:31:12Z", + "published": "2024-09-03T21:31:12Z", + "aliases": [ + "CVE-2024-41434" + ], + "details": "PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component (*Column).GetDecimal. This allows attackers to cause a Denial of Service (DoS) via a crafted input to the 'RemoveUnnecessaryFirstRow', it will check the expression between 'Agg' and 'GroupBy', but does not check the return type.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41434" + }, + { + "type": "WEB", + "url": "https://github.com/pingcap/tidb/issues/53733" + }, + { + "type": "WEB", + "url": "https://gist.github.com/ycybfhb/4aa6809695b9e8a1cd1429e597c17517" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-03T20:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-6f6m-whqx-gc66/GHSA-6f6m-whqx-gc66.json b/advisories/unreviewed/2024/09/GHSA-6f6m-whqx-gc66/GHSA-6f6m-whqx-gc66.json index eb6c29e7580..b7bb7a5f1f0 100644 --- a/advisories/unreviewed/2024/09/GHSA-6f6m-whqx-gc66/GHSA-6f6m-whqx-gc66.json +++ b/advisories/unreviewed/2024/09/GHSA-6f6m-whqx-gc66/GHSA-6f6m-whqx-gc66.json @@ -1,13 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-6f6m-whqx-gc66", - "modified": "2024-09-03T12:30:32Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-09-03T12:30:32Z", "aliases": [ "CVE-2024-45587" ], "details": "This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Transaction module of vulnerable application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to compromise of other user accounts.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" diff --git a/advisories/unreviewed/2024/09/GHSA-89wc-q5f7-75f4/GHSA-89wc-q5f7-75f4.json b/advisories/unreviewed/2024/09/GHSA-89wc-q5f7-75f4/GHSA-89wc-q5f7-75f4.json new file mode 100644 index 00000000000..e3d26395c28 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-89wc-q5f7-75f4/GHSA-89wc-q5f7-75f4.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-89wc-q5f7-75f4", + "modified": "2024-09-03T21:31:12Z", + "published": "2024-09-03T21:31:12Z", + "aliases": [ + "CVE-2024-41433" + ], + "details": "PingCAP TiDB v8.1.0 was discovered to contain a buffer overflow via the component expression.ExplainExpressionList. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41433" + }, + { + "type": "WEB", + "url": "https://github.com/pingcap/tidb/issues/53796" + }, + { + "type": "WEB", + "url": "https://gist.github.com/ycybfhb/eec3a1eefe4c85eb22f1bca6114359a1" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-03T21:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-8wm9-24qg-m5qj/GHSA-8wm9-24qg-m5qj.json b/advisories/unreviewed/2024/09/GHSA-8wm9-24qg-m5qj/GHSA-8wm9-24qg-m5qj.json new file mode 100644 index 00000000000..4e1a3b335d8 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-8wm9-24qg-m5qj/GHSA-8wm9-24qg-m5qj.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8wm9-24qg-m5qj", + "modified": "2024-09-03T21:31:12Z", + "published": "2024-09-03T21:31:12Z", + "aliases": [ + "CVE-2024-4629" + ], + "details": "A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4629" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-4629" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2276761" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-837" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-03T20:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-962q-94q9-2gc5/GHSA-962q-94q9-2gc5.json b/advisories/unreviewed/2024/09/GHSA-962q-94q9-2gc5/GHSA-962q-94q9-2gc5.json new file mode 100644 index 00000000000..638fee5681b --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-962q-94q9-2gc5/GHSA-962q-94q9-2gc5.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-962q-94q9-2gc5", + "modified": "2024-09-03T21:31:12Z", + "published": "2024-09-03T21:31:12Z", + "aliases": [ + "CVE-2024-41436" + ], + "details": "ClickHouse v24.3.3.102 was discovered to contain a buffer overflow via the component DB::evaluateConstantExpressionImpl.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41436" + }, + { + "type": "WEB", + "url": "https://github.com/ClickHouse/ClickHouse/issues/65520" + }, + { + "type": "WEB", + "url": "https://gist.github.com/ycybfhb/db127ae9d105a4d20edc9f010a959016" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-120" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-03T19:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-cf4q-v7mm-g53q/GHSA-cf4q-v7mm-g53q.json b/advisories/unreviewed/2024/09/GHSA-cf4q-v7mm-g53q/GHSA-cf4q-v7mm-g53q.json new file mode 100644 index 00000000000..a9bbdf29962 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-cf4q-v7mm-g53q/GHSA-cf4q-v7mm-g53q.json @@ -0,0 +1,55 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cf4q-v7mm-g53q", + "modified": "2024-09-03T21:31:12Z", + "published": "2024-09-03T21:31:12Z", + "aliases": [ + "CVE-2024-45678" + ], + "details": "Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45678" + }, + { + "type": "WEB", + "url": "https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel" + }, + { + "type": "WEB", + "url": "https://news.ycombinator.com/item?id=41434500" + }, + { + "type": "WEB", + "url": "https://ninjalab.io/eucleak" + }, + { + "type": "WEB", + "url": "https://ninjalab.io/wp-content/uploads/2024/09/20240903_eucleak.pdf" + }, + { + "type": "WEB", + "url": "https://support.yubico.com/hc/en-us/articles/15705749884444" + }, + { + "type": "WEB", + "url": "https://www.yubico.com/support/security-advisories/ysa-2024-03" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-03T20:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-crm8-393f-r7jh/GHSA-crm8-393f-r7jh.json b/advisories/unreviewed/2024/09/GHSA-crm8-393f-r7jh/GHSA-crm8-393f-r7jh.json index e11c46d9350..ff73fe0cba5 100644 --- a/advisories/unreviewed/2024/09/GHSA-crm8-393f-r7jh/GHSA-crm8-393f-r7jh.json +++ b/advisories/unreviewed/2024/09/GHSA-crm8-393f-r7jh/GHSA-crm8-393f-r7jh.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-crm8-393f-r7jh", - "modified": "2024-09-03T18:31:32Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-09-03T18:31:32Z", "aliases": [ "CVE-2024-42901" ], "details": "A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-03T18:15:08Z" diff --git a/advisories/unreviewed/2024/09/GHSA-gpmp-h4rx-q9xp/GHSA-gpmp-h4rx-q9xp.json b/advisories/unreviewed/2024/09/GHSA-gpmp-h4rx-q9xp/GHSA-gpmp-h4rx-q9xp.json index 4847c4a4992..3ca3dfaf0f9 100644 --- a/advisories/unreviewed/2024/09/GHSA-gpmp-h4rx-q9xp/GHSA-gpmp-h4rx-q9xp.json +++ b/advisories/unreviewed/2024/09/GHSA-gpmp-h4rx-q9xp/GHSA-gpmp-h4rx-q9xp.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-gpmp-h4rx-q9xp", - "modified": "2024-09-03T18:31:32Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-09-03T18:31:32Z", "aliases": [ "CVE-2024-38456" ], "details": "HIGH-LEIT V05.08.01.03 and HIGH-LEIT V04.25.00.00 to 4.25.01.01 for Windows from Vivavis contain an insecure file and folder permissions vulnerability in prunsrv.exe. A regular user (non-admin) can exploit the weak folder and file permissions to escalate privileges and execute arbitrary code in the context of NT AUTHORITY\\SYSTEM.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-732" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-03T18:15:08Z" diff --git a/advisories/unreviewed/2024/09/GHSA-hvhq-mcxw-w38r/GHSA-hvhq-mcxw-w38r.json b/advisories/unreviewed/2024/09/GHSA-hvhq-mcxw-w38r/GHSA-hvhq-mcxw-w38r.json index eace88cbea6..2ebffea6df2 100644 --- a/advisories/unreviewed/2024/09/GHSA-hvhq-mcxw-w38r/GHSA-hvhq-mcxw-w38r.json +++ b/advisories/unreviewed/2024/09/GHSA-hvhq-mcxw-w38r/GHSA-hvhq-mcxw-w38r.json @@ -1,13 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-hvhq-mcxw-w38r", - "modified": "2024-09-03T12:30:32Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-09-03T12:30:32Z", "aliases": [ "CVE-2024-45586" ], "details": "This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" diff --git a/advisories/unreviewed/2024/09/GHSA-mcwc-jfpx-gq94/GHSA-mcwc-jfpx-gq94.json b/advisories/unreviewed/2024/09/GHSA-mcwc-jfpx-gq94/GHSA-mcwc-jfpx-gq94.json index 6becb06c1fd..eaef779883e 100644 --- a/advisories/unreviewed/2024/09/GHSA-mcwc-jfpx-gq94/GHSA-mcwc-jfpx-gq94.json +++ b/advisories/unreviewed/2024/09/GHSA-mcwc-jfpx-gq94/GHSA-mcwc-jfpx-gq94.json @@ -1,13 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mcwc-jfpx-gq94", - "modified": "2024-09-03T12:30:33Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-09-03T12:30:33Z", "aliases": [ "CVE-2024-45588" ], "details": "This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Preference module of the application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized access and modification of sensitive information belonging to other users.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" diff --git a/advisories/unreviewed/2024/09/GHSA-vp6m-7x2g-h3wf/GHSA-vp6m-7x2g-h3wf.json b/advisories/unreviewed/2024/09/GHSA-vp6m-7x2g-h3wf/GHSA-vp6m-7x2g-h3wf.json new file mode 100644 index 00000000000..fefca255e4e --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-vp6m-7x2g-h3wf/GHSA-vp6m-7x2g-h3wf.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vp6m-7x2g-h3wf", + "modified": "2024-09-03T21:31:12Z", + "published": "2024-09-03T21:31:12Z", + "aliases": [ + "CVE-2024-45180" + ], + "details": "SquaredUp DS for SCOM 6.2.1.11104 allows XSS.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45180" + }, + { + "type": "WEB", + "url": "https://scomsupport.squaredup.com/reference/security-advisory/cve-2024-45180-stored-cross-site-scripting-knowledge-editor-tile" + }, + { + "type": "WEB", + "url": "https://squaredup.com" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-03T20:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-wqr2-8c98-rxv3/GHSA-wqr2-8c98-rxv3.json b/advisories/unreviewed/2024/09/GHSA-wqr2-8c98-rxv3/GHSA-wqr2-8c98-rxv3.json index 8cd640d7f81..ba52b09d31f 100644 --- a/advisories/unreviewed/2024/09/GHSA-wqr2-8c98-rxv3/GHSA-wqr2-8c98-rxv3.json +++ b/advisories/unreviewed/2024/09/GHSA-wqr2-8c98-rxv3/GHSA-wqr2-8c98-rxv3.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-wqr2-8c98-rxv3", - "modified": "2024-09-03T18:31:32Z", + "modified": "2024-09-03T21:31:12Z", "published": "2024-09-03T18:31:32Z", "aliases": [ "CVE-2024-42902" ], "details": "An issue in the js_localize.php function of LimeSurvey v6.6.2 and before allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js_localize.php function", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-03T18:15:08Z"