Publish Advisories

GHSA-m4mp-v249-x3mh
GHSA-qmmj-jp9v-hhrm
GHSA-gxh8-w3x9-26pq
GHSA-v26c-v53c-85v2
GHSA-v8f2-89xw-2297
GHSA-6vmr-rjpc-xf64
GHSA-c5hh-282x-jrgh
GHSA-f5xg-8xpf-gr98
GHSA-m3gr-45jc-g2rp
GHSA-mwrq-qv64-xgq7
GHSA-wvvr-rxq8-c379
GHSA-wxp4-9485-gpcm

advisories/unreviewed/2023/10/GHSA-m4mp-v249-x3mh/GHSA-m4mp-v249-x3mh.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-m4mp-v249-x3mh",
-  "modified": "2024-10-09T15:32:17Z",
+  "modified": "2024-10-14T09:30:52Z",
   "published": "2023-10-23T09:30:18Z",
   "aliases": [
     "CVE-2023-45802"
@@ -49,6 +49,7 @@
   "database_specific": {
     "cwe_ids": [
       "CWE-400",
+      "CWE-404",
       "CWE-770"
     ],
     "severity": "MODERATE",

advisories/unreviewed/2024/02/GHSA-qmmj-jp9v-hhrm/GHSA-qmmj-jp9v-hhrm.json

@@ -28,7 +28,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-284"
+      "CWE-284",
+      "CWE-306"
     ],
     "severity": "MODERATE",
     "github_reviewed": false,

advisories/unreviewed/2024/03/GHSA-gxh8-w3x9-26pq/GHSA-gxh8-w3x9-26pq.json

@@ -28,6 +28,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
+      "CWE-1220",
       "CWE-284"
     ],
     "severity": "MODERATE",

advisories/unreviewed/2024/04/GHSA-v26c-v53c-85v2/GHSA-v26c-v53c-85v2.json

@@ -28,7 +28,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-200"
+      "CWE-200",
+      "CWE-306"
     ],
     "severity": "MODERATE",
     "github_reviewed": false,

advisories/unreviewed/2024/04/GHSA-v8f2-89xw-2297/GHSA-v8f2-89xw-2297.json

@@ -28,7 +28,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-284"
+      "CWE-284",
+      "CWE-306"
     ],
     "severity": "CRITICAL",
     "github_reviewed": false,

advisories/unreviewed/2024/10/GHSA-6vmr-rjpc-xf64/GHSA-6vmr-rjpc-xf64.json

@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6vmr-rjpc-xf64",
+  "modified": "2024-10-14T09:30:54Z",
+  "published": "2024-10-14T09:30:54Z",
+  "aliases": [
+    "CVE-2024-9139"
+  ],
+  "details": "The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrary code.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9139"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-78"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-14T09:15:04Z"
+  }
+}

advisories/unreviewed/2024/10/GHSA-c5hh-282x-jrgh/GHSA-c5hh-282x-jrgh.json

@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c5hh-282x-jrgh",
+  "modified": "2024-10-14T09:30:54Z",
+  "published": "2024-10-14T09:30:54Z",
+  "aliases": [
+    "CVE-2024-9137"
+  ],
+  "details": "The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuration files and system compromise.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9137"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-306"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-14T09:15:04Z"
+  }
+}

advisories/unreviewed/2024/10/GHSA-f5xg-8xpf-gr98/GHSA-f5xg-8xpf-gr98.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-f5xg-8xpf-gr98",
-  "modified": "2024-10-09T15:32:18Z",
+  "modified": "2024-10-14T09:30:53Z",
   "published": "2024-10-09T12:30:52Z",
   "aliases": [
     "CVE-2024-9575"
@@ -25,6 +25,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9575"
     },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/vulnerability/pretix-widget/wordpress-pretix-widget-plugin-1-0-5-local-file-inclusion-vulnerability?_s_id=cve"
+    },
     {
       "type": "WEB",
       "url": "https://pretix.eu/about/en/blog/20241009-wordpress-plugin-1-0-6"

advisories/unreviewed/2024/10/GHSA-m3gr-45jc-g2rp/GHSA-m3gr-45jc-g2rp.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-m3gr-45jc-g2rp",
+  "modified": "2024-10-14T09:30:54Z",
+  "published": "2024-10-14T09:30:54Z",
+  "aliases": [
+    "CVE-2024-46911"
+  ],
+  "details": "Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content and this combined with a deficiency in Roller's CSRF protections allowed an escalation of privileges attack. This issue affects Apache Roller before 6.1.4.\n\nRoller users who run multi-blog/user Roller websites are recommended to upgrade to version 6.1.4, which fixes the issue.\n\nRoller 6.1.4 release announcement:  https://lists.apache.org/thread/3c3f6rwqptyw6wdc95654fq5vlosqdpw",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46911"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/6m0ghjo9j92qty00t2qb6qf2spds0p5t"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-352"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-14T09:15:04Z"
+  }
+}

advisories/unreviewed/2024/10/GHSA-mwrq-qv64-xgq7/GHSA-mwrq-qv64-xgq7.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mwrq-qv64-xgq7",
+  "modified": "2024-10-14T09:30:53Z",
+  "published": "2024-10-14T09:30:53Z",
+  "aliases": [
+    "CVE-2024-38862"
+  ],
+  "details": "Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35, <2.1.0p48 and <=2.0.0p39 (EOL) causes SNMP and IMPI secrets of host and folder properties to be written to audit log files accessible to administrators.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38862"
+    },
+    {
+      "type": "WEB",
+      "url": "https://checkmk.com/werk/17095"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-532"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-14T08:15:02Z"
+  }
+}

advisories/unreviewed/2024/10/GHSA-wvvr-rxq8-c379/GHSA-wvvr-rxq8-c379.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wvvr-rxq8-c379",
+  "modified": "2024-10-14T09:30:53Z",
+  "published": "2024-10-14T09:30:53Z",
+  "aliases": [
+    "CVE-2024-38863"
+  ],
+  "details": "Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35 and <2.1.0p48 could lead to a leak of the token to facilitate targeted phishing attacks.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38863"
+    },
+    {
+      "type": "WEB",
+      "url": "https://checkmk.com/werk/17096"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-598"
+    ],
+    "severity": "LOW",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-14T08:15:02Z"
+  }
+}

advisories/unreviewed/2024/10/GHSA-wxp4-9485-gpcm/GHSA-wxp4-9485-gpcm.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wxp4-9485-gpcm",
+  "modified": "2024-10-14T09:30:53Z",
+  "published": "2024-10-14T09:30:53Z",
+  "aliases": [
+    "CVE-2024-43701"
+  ],
+  "details": "Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43701"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-362"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-14T09:15:04Z"
+  }
+}