From a42e102657365f3005199d9e21124bcd6196ef30 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 14 Oct 2024 09:32:15 +0000 Subject: [PATCH] Publish Advisories GHSA-m4mp-v249-x3mh GHSA-qmmj-jp9v-hhrm GHSA-gxh8-w3x9-26pq GHSA-v26c-v53c-85v2 GHSA-v8f2-89xw-2297 GHSA-6vmr-rjpc-xf64 GHSA-c5hh-282x-jrgh GHSA-f5xg-8xpf-gr98 GHSA-m3gr-45jc-g2rp GHSA-mwrq-qv64-xgq7 GHSA-wvvr-rxq8-c379 GHSA-wxp4-9485-gpcm --- .../GHSA-m4mp-v249-x3mh.json | 3 +- .../GHSA-qmmj-jp9v-hhrm.json | 3 +- .../GHSA-gxh8-w3x9-26pq.json | 1 + .../GHSA-v26c-v53c-85v2.json | 3 +- .../GHSA-v8f2-89xw-2297.json | 3 +- .../GHSA-6vmr-rjpc-xf64.json | 42 +++++++++++++++++++ .../GHSA-c5hh-282x-jrgh.json | 42 +++++++++++++++++++ .../GHSA-f5xg-8xpf-gr98.json | 6 ++- .../GHSA-m3gr-45jc-g2rp.json | 35 ++++++++++++++++ .../GHSA-mwrq-qv64-xgq7.json | 38 +++++++++++++++++ .../GHSA-wvvr-rxq8-c379.json | 38 +++++++++++++++++ .../GHSA-wxp4-9485-gpcm.json | 35 ++++++++++++++++ 12 files changed, 244 insertions(+), 5 deletions(-) create mode 100644 advisories/unreviewed/2024/10/GHSA-6vmr-rjpc-xf64/GHSA-6vmr-rjpc-xf64.json create mode 100644 advisories/unreviewed/2024/10/GHSA-c5hh-282x-jrgh/GHSA-c5hh-282x-jrgh.json create mode 100644 advisories/unreviewed/2024/10/GHSA-m3gr-45jc-g2rp/GHSA-m3gr-45jc-g2rp.json create mode 100644 advisories/unreviewed/2024/10/GHSA-mwrq-qv64-xgq7/GHSA-mwrq-qv64-xgq7.json create mode 100644 advisories/unreviewed/2024/10/GHSA-wvvr-rxq8-c379/GHSA-wvvr-rxq8-c379.json create mode 100644 advisories/unreviewed/2024/10/GHSA-wxp4-9485-gpcm/GHSA-wxp4-9485-gpcm.json diff --git a/advisories/unreviewed/2023/10/GHSA-m4mp-v249-x3mh/GHSA-m4mp-v249-x3mh.json b/advisories/unreviewed/2023/10/GHSA-m4mp-v249-x3mh/GHSA-m4mp-v249-x3mh.json index 47c5a5e5ec1..29bdc8c5051 100644 --- a/advisories/unreviewed/2023/10/GHSA-m4mp-v249-x3mh/GHSA-m4mp-v249-x3mh.json +++ b/advisories/unreviewed/2023/10/GHSA-m4mp-v249-x3mh/GHSA-m4mp-v249-x3mh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-m4mp-v249-x3mh", - "modified": "2024-10-09T15:32:17Z", + "modified": "2024-10-14T09:30:52Z", "published": "2023-10-23T09:30:18Z", "aliases": [ "CVE-2023-45802" @@ -49,6 +49,7 @@ "database_specific": { "cwe_ids": [ "CWE-400", + "CWE-404", "CWE-770" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2024/02/GHSA-qmmj-jp9v-hhrm/GHSA-qmmj-jp9v-hhrm.json b/advisories/unreviewed/2024/02/GHSA-qmmj-jp9v-hhrm/GHSA-qmmj-jp9v-hhrm.json index 7e8824bfd0e..307408c62de 100644 --- a/advisories/unreviewed/2024/02/GHSA-qmmj-jp9v-hhrm/GHSA-qmmj-jp9v-hhrm.json +++ b/advisories/unreviewed/2024/02/GHSA-qmmj-jp9v-hhrm/GHSA-qmmj-jp9v-hhrm.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-284" + "CWE-284", + "CWE-306" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/03/GHSA-gxh8-w3x9-26pq/GHSA-gxh8-w3x9-26pq.json b/advisories/unreviewed/2024/03/GHSA-gxh8-w3x9-26pq/GHSA-gxh8-w3x9-26pq.json index c9c640346e8..8ff1ed1a3cd 100644 --- a/advisories/unreviewed/2024/03/GHSA-gxh8-w3x9-26pq/GHSA-gxh8-w3x9-26pq.json +++ b/advisories/unreviewed/2024/03/GHSA-gxh8-w3x9-26pq/GHSA-gxh8-w3x9-26pq.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-1220", "CWE-284" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2024/04/GHSA-v26c-v53c-85v2/GHSA-v26c-v53c-85v2.json b/advisories/unreviewed/2024/04/GHSA-v26c-v53c-85v2/GHSA-v26c-v53c-85v2.json index dbe1f262e14..b68f3db1ec9 100644 --- a/advisories/unreviewed/2024/04/GHSA-v26c-v53c-85v2/GHSA-v26c-v53c-85v2.json +++ b/advisories/unreviewed/2024/04/GHSA-v26c-v53c-85v2/GHSA-v26c-v53c-85v2.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-200" + "CWE-200", + "CWE-306" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/04/GHSA-v8f2-89xw-2297/GHSA-v8f2-89xw-2297.json b/advisories/unreviewed/2024/04/GHSA-v8f2-89xw-2297/GHSA-v8f2-89xw-2297.json index 551b3bd45d2..e6c4e06b9fb 100644 --- a/advisories/unreviewed/2024/04/GHSA-v8f2-89xw-2297/GHSA-v8f2-89xw-2297.json +++ b/advisories/unreviewed/2024/04/GHSA-v8f2-89xw-2297/GHSA-v8f2-89xw-2297.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-284" + "CWE-284", + "CWE-306" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/10/GHSA-6vmr-rjpc-xf64/GHSA-6vmr-rjpc-xf64.json b/advisories/unreviewed/2024/10/GHSA-6vmr-rjpc-xf64/GHSA-6vmr-rjpc-xf64.json new file mode 100644 index 00000000000..c259ad9df5c --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-6vmr-rjpc-xf64/GHSA-6vmr-rjpc-xf64.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6vmr-rjpc-xf64", + "modified": "2024-10-14T09:30:54Z", + "published": "2024-10-14T09:30:54Z", + "aliases": [ + "CVE-2024-9139" + ], + "details": "The affected product permits OS command injection through improperly restricted commands, potentially allowing attackers to execute arbitrary code.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9139" + }, + { + "type": "WEB", + "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-14T09:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-c5hh-282x-jrgh/GHSA-c5hh-282x-jrgh.json b/advisories/unreviewed/2024/10/GHSA-c5hh-282x-jrgh/GHSA-c5hh-282x-jrgh.json new file mode 100644 index 00000000000..6279b7d5293 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-c5hh-282x-jrgh/GHSA-c5hh-282x-jrgh.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c5hh-282x-jrgh", + "modified": "2024-10-14T09:30:54Z", + "published": "2024-10-14T09:30:54Z", + "aliases": [ + "CVE-2024-9137" + ], + "details": "The affected product lacks an authentication check when sending commands to the server via the Moxa service. This vulnerability allows an attacker to execute specified commands, potentially leading to unauthorized downloads or uploads of configuration files and system compromise.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9137" + }, + { + "type": "WEB", + "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-241154-missing-authentication-and-os-command-injection-vulnerabilities-in-routers-and-network-security-appliances" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-306" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-14T09:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-f5xg-8xpf-gr98/GHSA-f5xg-8xpf-gr98.json b/advisories/unreviewed/2024/10/GHSA-f5xg-8xpf-gr98/GHSA-f5xg-8xpf-gr98.json index d9e627203ab..72e971601e8 100644 --- a/advisories/unreviewed/2024/10/GHSA-f5xg-8xpf-gr98/GHSA-f5xg-8xpf-gr98.json +++ b/advisories/unreviewed/2024/10/GHSA-f5xg-8xpf-gr98/GHSA-f5xg-8xpf-gr98.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-f5xg-8xpf-gr98", - "modified": "2024-10-09T15:32:18Z", + "modified": "2024-10-14T09:30:53Z", "published": "2024-10-09T12:30:52Z", "aliases": [ "CVE-2024-9575" @@ -25,6 +25,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9575" }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/pretix-widget/wordpress-pretix-widget-plugin-1-0-5-local-file-inclusion-vulnerability?_s_id=cve" + }, { "type": "WEB", "url": "https://pretix.eu/about/en/blog/20241009-wordpress-plugin-1-0-6" diff --git a/advisories/unreviewed/2024/10/GHSA-m3gr-45jc-g2rp/GHSA-m3gr-45jc-g2rp.json b/advisories/unreviewed/2024/10/GHSA-m3gr-45jc-g2rp/GHSA-m3gr-45jc-g2rp.json new file mode 100644 index 00000000000..6f6131f9be1 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-m3gr-45jc-g2rp/GHSA-m3gr-45jc-g2rp.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m3gr-45jc-g2rp", + "modified": "2024-10-14T09:30:54Z", + "published": "2024-10-14T09:30:54Z", + "aliases": [ + "CVE-2024-46911" + ], + "details": "Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trusted to publish arbitrary weblog content and this combined with a deficiency in Roller's CSRF protections allowed an escalation of privileges attack. This issue affects Apache Roller before 6.1.4.\n\nRoller users who run multi-blog/user Roller websites are recommended to upgrade to version 6.1.4, which fixes the issue.\n\nRoller 6.1.4 release announcement:  https://lists.apache.org/thread/3c3f6rwqptyw6wdc95654fq5vlosqdpw", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46911" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/6m0ghjo9j92qty00t2qb6qf2spds0p5t" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-14T09:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-mwrq-qv64-xgq7/GHSA-mwrq-qv64-xgq7.json b/advisories/unreviewed/2024/10/GHSA-mwrq-qv64-xgq7/GHSA-mwrq-qv64-xgq7.json new file mode 100644 index 00000000000..5477e4d1fcf --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-mwrq-qv64-xgq7/GHSA-mwrq-qv64-xgq7.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mwrq-qv64-xgq7", + "modified": "2024-10-14T09:30:53Z", + "published": "2024-10-14T09:30:53Z", + "aliases": [ + "CVE-2024-38862" + ], + "details": "Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35, <2.1.0p48 and <=2.0.0p39 (EOL) causes SNMP and IMPI secrets of host and folder properties to be written to audit log files accessible to administrators.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38862" + }, + { + "type": "WEB", + "url": "https://checkmk.com/werk/17095" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-14T08:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-wvvr-rxq8-c379/GHSA-wvvr-rxq8-c379.json b/advisories/unreviewed/2024/10/GHSA-wvvr-rxq8-c379/GHSA-wvvr-rxq8-c379.json new file mode 100644 index 00000000000..893b701af38 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-wvvr-rxq8-c379/GHSA-wvvr-rxq8-c379.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wvvr-rxq8-c379", + "modified": "2024-10-14T09:30:53Z", + "published": "2024-10-14T09:30:53Z", + "aliases": [ + "CVE-2024-38863" + ], + "details": "Exposure of CSRF tokens in query parameters on specific requests in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35 and <2.1.0p48 could lead to a leak of the token to facilitate targeted phishing attacks.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38863" + }, + { + "type": "WEB", + "url": "https://checkmk.com/werk/17096" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-598" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-14T08:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-wxp4-9485-gpcm/GHSA-wxp4-9485-gpcm.json b/advisories/unreviewed/2024/10/GHSA-wxp4-9485-gpcm/GHSA-wxp4-9485-gpcm.json new file mode 100644 index 00000000000..8e5d87ace09 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-wxp4-9485-gpcm/GHSA-wxp4-9485-gpcm.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wxp4-9485-gpcm", + "modified": "2024-10-14T09:30:53Z", + "published": "2024-10-14T09:30:53Z", + "aliases": [ + "CVE-2024-43701" + ], + "details": "Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43701" + }, + { + "type": "WEB", + "url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-362" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-14T09:15:04Z" + } +} \ No newline at end of file