diff --git a/advisories/unreviewed/2023/05/GHSA-2q9c-qj72-94fh/GHSA-2q9c-qj72-94fh.json b/advisories/unreviewed/2023/05/GHSA-2q9c-qj72-94fh/GHSA-2q9c-qj72-94fh.json index 88892ee57ae..0a1eafb2edf 100644 --- a/advisories/unreviewed/2023/05/GHSA-2q9c-qj72-94fh/GHSA-2q9c-qj72-94fh.json +++ b/advisories/unreviewed/2023/05/GHSA-2q9c-qj72-94fh/GHSA-2q9c-qj72-94fh.json @@ -57,7 +57,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-863" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2023/05/GHSA-597f-j5wg-h28f/GHSA-597f-j5wg-h28f.json b/advisories/unreviewed/2023/05/GHSA-597f-j5wg-h28f/GHSA-597f-j5wg-h28f.json index 3158d01a764..59326987f28 100644 --- a/advisories/unreviewed/2023/05/GHSA-597f-j5wg-h28f/GHSA-597f-j5wg-h28f.json +++ b/advisories/unreviewed/2023/05/GHSA-597f-j5wg-h28f/GHSA-597f-j5wg-h28f.json @@ -45,7 +45,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-120" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2023/05/GHSA-7crh-9v7x-2x2r/GHSA-7crh-9v7x-2x2r.json b/advisories/unreviewed/2023/05/GHSA-7crh-9v7x-2x2r/GHSA-7crh-9v7x-2x2r.json index bd08555a249..d4fc2e80ca5 100644 --- a/advisories/unreviewed/2023/05/GHSA-7crh-9v7x-2x2r/GHSA-7crh-9v7x-2x2r.json +++ b/advisories/unreviewed/2023/05/GHSA-7crh-9v7x-2x2r/GHSA-7crh-9v7x-2x2r.json @@ -45,7 +45,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-120" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2023/05/GHSA-f3f9-274w-r3m6/GHSA-f3f9-274w-r3m6.json b/advisories/unreviewed/2023/05/GHSA-f3f9-274w-r3m6/GHSA-f3f9-274w-r3m6.json index 29fed58f883..d9adc7749ac 100644 --- a/advisories/unreviewed/2023/05/GHSA-f3f9-274w-r3m6/GHSA-f3f9-274w-r3m6.json +++ b/advisories/unreviewed/2023/05/GHSA-f3f9-274w-r3m6/GHSA-f3f9-274w-r3m6.json @@ -26,7 +26,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-269" + "CWE-269", + "CWE-863" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/05/GHSA-g5c3-6p2q-wc3j/GHSA-g5c3-6p2q-wc3j.json b/advisories/unreviewed/2023/05/GHSA-g5c3-6p2q-wc3j/GHSA-g5c3-6p2q-wc3j.json index c1a9ed5c1c7..13427613e19 100644 --- a/advisories/unreviewed/2023/05/GHSA-g5c3-6p2q-wc3j/GHSA-g5c3-6p2q-wc3j.json +++ b/advisories/unreviewed/2023/05/GHSA-g5c3-6p2q-wc3j/GHSA-g5c3-6p2q-wc3j.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2023/05/GHSA-j23x-w7m9-8c47/GHSA-j23x-w7m9-8c47.json b/advisories/unreviewed/2023/05/GHSA-j23x-w7m9-8c47/GHSA-j23x-w7m9-8c47.json index 41e7415ae8a..b3d20c19889 100644 --- a/advisories/unreviewed/2023/05/GHSA-j23x-w7m9-8c47/GHSA-j23x-w7m9-8c47.json +++ b/advisories/unreviewed/2023/05/GHSA-j23x-w7m9-8c47/GHSA-j23x-w7m9-8c47.json @@ -37,7 +37,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-770" + ], "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2023/05/GHSA-r9vr-4rjx-2pxv/GHSA-r9vr-4rjx-2pxv.json b/advisories/unreviewed/2023/05/GHSA-r9vr-4rjx-2pxv/GHSA-r9vr-4rjx-2pxv.json index 1f3e4b6d14f..a2e9fb90859 100644 --- a/advisories/unreviewed/2023/05/GHSA-r9vr-4rjx-2pxv/GHSA-r9vr-4rjx-2pxv.json +++ b/advisories/unreviewed/2023/05/GHSA-r9vr-4rjx-2pxv/GHSA-r9vr-4rjx-2pxv.json @@ -33,7 +33,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-863" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2025/01/GHSA-3626-w2c4-wvvc/GHSA-3626-w2c4-wvvc.json b/advisories/unreviewed/2025/01/GHSA-3626-w2c4-wvvc/GHSA-3626-w2c4-wvvc.json index 33f8bc464bf..7c28c6febe0 100644 --- a/advisories/unreviewed/2025/01/GHSA-3626-w2c4-wvvc/GHSA-3626-w2c4-wvvc.json +++ b/advisories/unreviewed/2025/01/GHSA-3626-w2c4-wvvc/GHSA-3626-w2c4-wvvc.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-3626-w2c4-wvvc", - "modified": "2025-01-29T00:31:54Z", + "modified": "2025-01-29T15:31:34Z", "published": "2025-01-29T00:31:54Z", "aliases": [ "CVE-2024-55968" ], "details": "An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. The com.dtexsystems.helper service, responsible for handling privileged operations within the macOS DTEX Event Forwarder agent, fails to implement critical client validation during XPC interprocess communication (IPC). Specifically, the service does not verify the code requirements, entitlements, security flags, or version of any client attempting to establish a connection. This lack of proper logic validation allows malicious actors to exploit the service's methods via unauthorized client connections, and escalate privileges to root by abusing the DTConnectionHelperProtocol protocol's submitQuery method over an unauthorized XPC connection.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-798" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-28T22:15:15Z" diff --git a/advisories/unreviewed/2025/01/GHSA-3gmf-fq2f-gwph/GHSA-3gmf-fq2f-gwph.json b/advisories/unreviewed/2025/01/GHSA-3gmf-fq2f-gwph/GHSA-3gmf-fq2f-gwph.json index c711a8f77b3..f38bb6e66c3 100644 --- a/advisories/unreviewed/2025/01/GHSA-3gmf-fq2f-gwph/GHSA-3gmf-fq2f-gwph.json +++ b/advisories/unreviewed/2025/01/GHSA-3gmf-fq2f-gwph/GHSA-3gmf-fq2f-gwph.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-3gmf-fq2f-gwph", - "modified": "2025-01-29T00:31:54Z", + "modified": "2025-01-29T15:31:34Z", "published": "2025-01-29T00:31:54Z", "aliases": [ "CVE-2024-56529" ], "details": "Mailcow through 2024-11b has a session fixation vulnerability in the web panel. It allows remote attackers to set a session identifier when HSTS is disabled on a victim's browser. After a user logs in, they are authenticated and the session identifier is valid. Then, a remote attacker can access the victim's web panel with the same session identifier.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-384" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-28T23:15:07Z" diff --git a/advisories/unreviewed/2025/01/GHSA-47fw-q27j-gr9f/GHSA-47fw-q27j-gr9f.json b/advisories/unreviewed/2025/01/GHSA-47fw-q27j-gr9f/GHSA-47fw-q27j-gr9f.json index 86f4ab217c5..329b8aebcc5 100644 --- a/advisories/unreviewed/2025/01/GHSA-47fw-q27j-gr9f/GHSA-47fw-q27j-gr9f.json +++ b/advisories/unreviewed/2025/01/GHSA-47fw-q27j-gr9f/GHSA-47fw-q27j-gr9f.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-47fw-q27j-gr9f", - "modified": "2025-01-29T06:31:50Z", + "modified": "2025-01-29T15:31:34Z", "published": "2025-01-29T06:31:50Z", "aliases": [ "CVE-2024-12749" ], "details": "The Competition Form WordPress plugin through 2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], "affected": [], "references": [ { @@ -21,7 +26,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-29T06:15:30Z" diff --git a/advisories/unreviewed/2025/01/GHSA-7h23-57pg-3hwc/GHSA-7h23-57pg-3hwc.json b/advisories/unreviewed/2025/01/GHSA-7h23-57pg-3hwc/GHSA-7h23-57pg-3hwc.json index 3f1321f92fd..e6b3799fdc1 100644 --- a/advisories/unreviewed/2025/01/GHSA-7h23-57pg-3hwc/GHSA-7h23-57pg-3hwc.json +++ b/advisories/unreviewed/2025/01/GHSA-7h23-57pg-3hwc/GHSA-7h23-57pg-3hwc.json @@ -42,7 +42,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-276" + "CWE-276", + "CWE-416" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/01/GHSA-8hpx-q4cx-gfxw/GHSA-8hpx-q4cx-gfxw.json b/advisories/unreviewed/2025/01/GHSA-8hpx-q4cx-gfxw/GHSA-8hpx-q4cx-gfxw.json index c3a97b99381..04098b28411 100644 --- a/advisories/unreviewed/2025/01/GHSA-8hpx-q4cx-gfxw/GHSA-8hpx-q4cx-gfxw.json +++ b/advisories/unreviewed/2025/01/GHSA-8hpx-q4cx-gfxw/GHSA-8hpx-q4cx-gfxw.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-8hpx-q4cx-gfxw", - "modified": "2025-01-29T00:31:55Z", + "modified": "2025-01-29T15:31:34Z", "published": "2025-01-29T00:31:55Z", "aliases": [ "CVE-2024-57519" ], "details": "An issue in Open5GS v.2.7.2 allows a remote attacker to cause a denial of service via the ogs_dbi_auth_info function in lib/dbi/subscription.c file.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -28,8 +33,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-770" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-28T23:15:08Z" diff --git a/advisories/unreviewed/2025/01/GHSA-c476-j253-5rgq/GHSA-c476-j253-5rgq.json b/advisories/unreviewed/2025/01/GHSA-c476-j253-5rgq/GHSA-c476-j253-5rgq.json index 4a7a64f3ba3..5ba6731af24 100644 --- a/advisories/unreviewed/2025/01/GHSA-c476-j253-5rgq/GHSA-c476-j253-5rgq.json +++ b/advisories/unreviewed/2025/01/GHSA-c476-j253-5rgq/GHSA-c476-j253-5rgq.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-c476-j253-5rgq", - "modified": "2025-01-29T00:31:54Z", + "modified": "2025-01-29T15:31:34Z", "published": "2025-01-29T00:31:54Z", "aliases": [ "CVE-2024-29869" ], "details": "Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. Users are recommended to upgrade to version 4.0.1, which fixes this issue.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], "affected": [], "references": [ { @@ -39,7 +44,7 @@ "cwe_ids": [ "CWE-732" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-28T22:15:15Z" diff --git a/advisories/unreviewed/2025/01/GHSA-cf7w-246v-3mp8/GHSA-cf7w-246v-3mp8.json b/advisories/unreviewed/2025/01/GHSA-cf7w-246v-3mp8/GHSA-cf7w-246v-3mp8.json index 950f1fe4613..dd88e50539e 100644 --- a/advisories/unreviewed/2025/01/GHSA-cf7w-246v-3mp8/GHSA-cf7w-246v-3mp8.json +++ b/advisories/unreviewed/2025/01/GHSA-cf7w-246v-3mp8/GHSA-cf7w-246v-3mp8.json @@ -26,7 +26,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-120" + "CWE-120", + "CWE-787" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2025/01/GHSA-h5jh-rp76-q242/GHSA-h5jh-rp76-q242.json b/advisories/unreviewed/2025/01/GHSA-h5jh-rp76-q242/GHSA-h5jh-rp76-q242.json new file mode 100644 index 00000000000..c357873a4c1 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-h5jh-rp76-q242/GHSA-h5jh-rp76-q242.json @@ -0,0 +1,41 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h5jh-rp76-q242", + "modified": "2025-01-29T15:31:35Z", + "published": "2025-01-29T15:31:35Z", + "aliases": [ + "CVE-2024-57438" + ], + "details": "Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57438" + }, + { + "type": "WEB", + "url": "https://gitee.com/y_project/RuoYi" + }, + { + "type": "WEB", + "url": "https://github.com/peccc/restful_vul/blob/main/ruoyi_insecure_role_assignments/ruoyi_insecure_role_assignments.md" + }, + { + "type": "WEB", + "url": "https://github.com/yangzongzhuan/RuoYi" + }, + { + "type": "WEB", + "url": "https://ruoyi.vip" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-qq5h-rjj9-q9qg/GHSA-qq5h-rjj9-q9qg.json b/advisories/unreviewed/2025/01/GHSA-qq5h-rjj9-q9qg/GHSA-qq5h-rjj9-q9qg.json new file mode 100644 index 00000000000..59d7cbf03e3 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-qq5h-rjj9-q9qg/GHSA-qq5h-rjj9-q9qg.json @@ -0,0 +1,41 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qq5h-rjj9-q9qg", + "modified": "2025-01-29T15:31:35Z", + "published": "2025-01-29T15:31:35Z", + "aliases": [ + "CVE-2024-57439" + ], + "details": "An issue in the reset password interface of ruoyi v4.8.0 allows attackers with Admin privileges to cause a Denial of Service (DoS) by duplicating the login name of the account.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57439" + }, + { + "type": "WEB", + "url": "https://gitee.com/y_project/RuoYi" + }, + { + "type": "WEB", + "url": "https://github.com/peccc/restful_vul/blob/main/ruoyi_dos/ruoyi_dos.md" + }, + { + "type": "WEB", + "url": "https://github.com/yangzongzhuan/RuoYi" + }, + { + "type": "WEB", + "url": "https://ruoyi.vip" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-v664-qgx9-wf79/GHSA-v664-qgx9-wf79.json b/advisories/unreviewed/2025/01/GHSA-v664-qgx9-wf79/GHSA-v664-qgx9-wf79.json new file mode 100644 index 00000000000..5046634d59d --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-v664-qgx9-wf79/GHSA-v664-qgx9-wf79.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v664-qgx9-wf79", + "modified": "2025-01-29T15:31:35Z", + "published": "2025-01-29T15:31:35Z", + "aliases": [ + "CVE-2024-57436" + ], + "details": "RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to impersonate Admin users via using a crafted cookie.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57436" + }, + { + "type": "WEB", + "url": "https://github.com/peccc/restful_vul/blob/main/ruoyi_elevation_of_privileges/ruoyi_elevation_of_privileges.md" + }, + { + "type": "WEB", + "url": "https://github.com/yangzongzhuan/RuoYi" + }, + { + "type": "WEB", + "url": "https://ruoyi.vip" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T15:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-wq97-58c8-w5g5/GHSA-wq97-58c8-w5g5.json b/advisories/unreviewed/2025/01/GHSA-wq97-58c8-w5g5/GHSA-wq97-58c8-w5g5.json index ca9c4d0a0fd..eecfa025403 100644 --- a/advisories/unreviewed/2025/01/GHSA-wq97-58c8-w5g5/GHSA-wq97-58c8-w5g5.json +++ b/advisories/unreviewed/2025/01/GHSA-wq97-58c8-w5g5/GHSA-wq97-58c8-w5g5.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-wq97-58c8-w5g5", - "modified": "2025-01-29T00:31:54Z", + "modified": "2025-01-29T15:31:34Z", "published": "2025-01-29T00:31:54Z", "aliases": [ "CVE-2024-48310" ], "details": "AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code. Attackers may use these keys to access the backend API or other sensitive information.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-798" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-28T23:15:07Z" diff --git a/advisories/unreviewed/2025/01/GHSA-x26x-c8x5-v2rm/GHSA-x26x-c8x5-v2rm.json b/advisories/unreviewed/2025/01/GHSA-x26x-c8x5-v2rm/GHSA-x26x-c8x5-v2rm.json index dd05afe09cb..c3f2ee35568 100644 --- a/advisories/unreviewed/2025/01/GHSA-x26x-c8x5-v2rm/GHSA-x26x-c8x5-v2rm.json +++ b/advisories/unreviewed/2025/01/GHSA-x26x-c8x5-v2rm/GHSA-x26x-c8x5-v2rm.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-x26x-c8x5-v2rm", - "modified": "2025-01-29T12:31:45Z", + "modified": "2025-01-29T15:31:34Z", "published": "2025-01-29T12:31:45Z", "aliases": [ "CVE-2025-0762" ], "details": "Use after free in DevTools in Google Chrome prior to 132.0.6834.159 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -27,7 +32,7 @@ "cwe_ids": [ "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2025-01-29T11:15:09Z" diff --git a/advisories/unreviewed/2025/01/GHSA-xf79-8g8m-ch82/GHSA-xf79-8g8m-ch82.json b/advisories/unreviewed/2025/01/GHSA-xf79-8g8m-ch82/GHSA-xf79-8g8m-ch82.json new file mode 100644 index 00000000000..12dabe0f0ff --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-xf79-8g8m-ch82/GHSA-xf79-8g8m-ch82.json @@ -0,0 +1,41 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xf79-8g8m-ch82", + "modified": "2025-01-29T15:31:35Z", + "published": "2025-01-29T15:31:35Z", + "aliases": [ + "CVE-2024-57437" + ], + "details": "RuoYi v4.8.0 was discovered to contain a SQL injection vulnerability via the orderby parameter at /monitor/online/list.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57437" + }, + { + "type": "WEB", + "url": "https://gitee.com/y_project/RuoYi" + }, + { + "type": "WEB", + "url": "https://github.com/peccc/restful_vul/blob/main/ruoyi_sqli_orderby/ruoyi_sqli_orderby.md" + }, + { + "type": "WEB", + "url": "https://github.com/yangzongzhuan/RuoYi" + }, + { + "type": "WEB", + "url": "https://ruoyi.vip" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T15:15:17Z" + } +} \ No newline at end of file