From aa1ed3bda498d9d0bdd29cf0ee575bcf676c46a1 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 21 Aug 2024 00:31:54 +0000 Subject: [PATCH] Publish Advisories GHSA-8gwm-v64w-x477 GHSA-qfrm-3569-884r GHSA-2w45-v2hv-rxp2 GHSA-3xr6-pm2j-p9qj GHSA-453r-h2v5-6vmq GHSA-5w7q-hp3j-xm99 GHSA-6247-7862-q2pq GHSA-68fj-vj36-gmvc GHSA-69w2-8rxh-w4m7 GHSA-7c63-hh47-864q GHSA-8gxf-54jp-wccf GHSA-8h54-x6jj-v528 GHSA-f95q-fwq6-mx8w GHSA-mxq3-jq8p-cph4 GHSA-q567-qjp8-m2mc GHSA-r9x9-2w3c-2654 GHSA-v4fq-rjqc-xp4w GHSA-v97r-2c8q-frf2 --- .../GHSA-8gwm-v64w-x477.json | 11 ++-- .../GHSA-qfrm-3569-884r.json | 9 ++- .../GHSA-2w45-v2hv-rxp2.json | 63 +++++++++++++++++++ .../GHSA-3xr6-pm2j-p9qj.json | 43 +++++++++++++ .../GHSA-453r-h2v5-6vmq.json | 39 ++++++++++++ .../GHSA-5w7q-hp3j-xm99.json | 39 ++++++++++++ .../GHSA-6247-7862-q2pq.json | 35 +++++++++++ .../GHSA-68fj-vj36-gmvc.json | 11 ++-- .../GHSA-69w2-8rxh-w4m7.json | 43 +++++++++++++ .../GHSA-7c63-hh47-864q.json | 11 ++-- .../GHSA-8gxf-54jp-wccf.json | 39 ++++++++++++ .../GHSA-8h54-x6jj-v528.json | 59 +++++++++++++++++ .../GHSA-f95q-fwq6-mx8w.json | 51 +++++++++++++++ .../GHSA-mxq3-jq8p-cph4.json | 50 +++++++++++++++ .../GHSA-q567-qjp8-m2mc.json | 11 ++-- .../GHSA-r9x9-2w3c-2654.json | 54 ++++++++++++++++ .../GHSA-v4fq-rjqc-xp4w.json | 11 ++-- .../GHSA-v97r-2c8q-frf2.json | 11 ++-- 18 files changed, 563 insertions(+), 27 deletions(-) create mode 100644 advisories/unreviewed/2024/08/GHSA-2w45-v2hv-rxp2/GHSA-2w45-v2hv-rxp2.json create mode 100644 advisories/unreviewed/2024/08/GHSA-3xr6-pm2j-p9qj/GHSA-3xr6-pm2j-p9qj.json create mode 100644 advisories/unreviewed/2024/08/GHSA-453r-h2v5-6vmq/GHSA-453r-h2v5-6vmq.json create mode 100644 advisories/unreviewed/2024/08/GHSA-5w7q-hp3j-xm99/GHSA-5w7q-hp3j-xm99.json create mode 100644 advisories/unreviewed/2024/08/GHSA-6247-7862-q2pq/GHSA-6247-7862-q2pq.json create mode 100644 advisories/unreviewed/2024/08/GHSA-69w2-8rxh-w4m7/GHSA-69w2-8rxh-w4m7.json create mode 100644 advisories/unreviewed/2024/08/GHSA-8gxf-54jp-wccf/GHSA-8gxf-54jp-wccf.json create mode 100644 advisories/unreviewed/2024/08/GHSA-8h54-x6jj-v528/GHSA-8h54-x6jj-v528.json create mode 100644 advisories/unreviewed/2024/08/GHSA-f95q-fwq6-mx8w/GHSA-f95q-fwq6-mx8w.json create mode 100644 advisories/unreviewed/2024/08/GHSA-mxq3-jq8p-cph4/GHSA-mxq3-jq8p-cph4.json create mode 100644 advisories/unreviewed/2024/08/GHSA-r9x9-2w3c-2654/GHSA-r9x9-2w3c-2654.json diff --git a/advisories/unreviewed/2024/03/GHSA-8gwm-v64w-x477/GHSA-8gwm-v64w-x477.json b/advisories/unreviewed/2024/03/GHSA-8gwm-v64w-x477/GHSA-8gwm-v64w-x477.json index 301c7375046..482a6228db8 100644 --- a/advisories/unreviewed/2024/03/GHSA-8gwm-v64w-x477/GHSA-8gwm-v64w-x477.json +++ b/advisories/unreviewed/2024/03/GHSA-8gwm-v64w-x477/GHSA-8gwm-v64w-x477.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-8gwm-v64w-x477", - "modified": "2024-03-19T06:30:53Z", + "modified": "2024-08-21T00:30:29Z", "published": "2024-03-19T06:30:53Z", "aliases": [ "CVE-2024-28447" ], "details": "Shenzhen Libituo Technology Co., Ltd LBT-T300-mini1 v1.2.9 was discovered to contain a buffer overflow via lan_ipaddr parameters at /apply.cgi.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-19T06:15:07Z" diff --git a/advisories/unreviewed/2024/04/GHSA-qfrm-3569-884r/GHSA-qfrm-3569-884r.json b/advisories/unreviewed/2024/04/GHSA-qfrm-3569-884r/GHSA-qfrm-3569-884r.json index 46e9e9bb565..a4c0c8c1a0a 100644 --- a/advisories/unreviewed/2024/04/GHSA-qfrm-3569-884r/GHSA-qfrm-3569-884r.json +++ b/advisories/unreviewed/2024/04/GHSA-qfrm-3569-884r/GHSA-qfrm-3569-884r.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-qfrm-3569-884r", - "modified": "2024-04-07T09:30:28Z", + "modified": "2024-08-21T00:30:29Z", "published": "2024-04-07T09:30:28Z", "aliases": [ "CVE-2024-30414" ], "details": "Command injection vulnerability in the AccountManager module.\nImpact: Successful exploitation of this vulnerability may affect service confidentiality.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ "CWE-78" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-07T08:15:07Z" diff --git a/advisories/unreviewed/2024/08/GHSA-2w45-v2hv-rxp2/GHSA-2w45-v2hv-rxp2.json b/advisories/unreviewed/2024/08/GHSA-2w45-v2hv-rxp2/GHSA-2w45-v2hv-rxp2.json new file mode 100644 index 00000000000..d87d9d66296 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-2w45-v2hv-rxp2/GHSA-2w45-v2hv-rxp2.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2w45-v2hv-rxp2", + "modified": "2024-08-21T00:30:29Z", + "published": "2024-08-21T00:30:29Z", + "aliases": [ + "CVE-2024-43861" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: qmi_wwan: fix memory leak for not ip packets\n\nFree the unused skb when not ip packets arrive.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43861" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/37c093449704017870604994ba9b813cdb9475a4" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3c90a69533b5bba73401ef884d033ea49ee99662" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/7ab107544b777c3bd7feb9fe447367d8edd5b202" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c4251a3deccad852b27e60625f31fba6cc14372f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c6c5b91424fafc0f83852d961c10c7e43a001882" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/da518cc9b64df391795d9952aed551e0f782e446" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e87f52225e04a7001bf55bbd7a330fa4252327b5" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f2c353227de14b0289298ffc3ba92058c4768384" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-20T22:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-3xr6-pm2j-p9qj/GHSA-3xr6-pm2j-p9qj.json b/advisories/unreviewed/2024/08/GHSA-3xr6-pm2j-p9qj/GHSA-3xr6-pm2j-p9qj.json new file mode 100644 index 00000000000..1a5911293f8 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-3xr6-pm2j-p9qj/GHSA-3xr6-pm2j-p9qj.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3xr6-pm2j-p9qj", + "modified": "2024-08-21T00:30:30Z", + "published": "2024-08-21T00:30:30Z", + "aliases": [ + "CVE-2024-43866" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Always drain health in shutdown callback\n\nThere is no point in recovery during device shutdown. if health\nwork started need to wait for it to avoid races and NULL pointer\naccess.\n\nHence, drain health WQ on shutdown callback.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43866" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/1b75da22ed1e6171e261bc9265370162553d5393" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6048dec754554a1303d632be6042d3feb3295285" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/6b6c2ebd83f2bf97e8f221479372aaca97a4a9b2" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-21T00:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-453r-h2v5-6vmq/GHSA-453r-h2v5-6vmq.json b/advisories/unreviewed/2024/08/GHSA-453r-h2v5-6vmq/GHSA-453r-h2v5-6vmq.json new file mode 100644 index 00000000000..7cacd7f875d --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-453r-h2v5-6vmq/GHSA-453r-h2v5-6vmq.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-453r-h2v5-6vmq", + "modified": "2024-08-21T00:30:29Z", + "published": "2024-08-21T00:30:29Z", + "aliases": [ + "CVE-2024-43865" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/fpu: Re-add exception handling in load_fpu_state()\n\nWith the recent rewrite of the fpu code exception handling for the\nlfpc instruction within load_fpu_state() was erroneously removed.\n\nAdd it again to prevent that loading invalid floating point register\nvalues cause an unhandled specification exception.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43865" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/4734406c39238cbeafe66f0060084caa3247ff53" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/494b14138201f07343e5488db6360c828fcc8cf6" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-21T00:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-5w7q-hp3j-xm99/GHSA-5w7q-hp3j-xm99.json b/advisories/unreviewed/2024/08/GHSA-5w7q-hp3j-xm99/GHSA-5w7q-hp3j-xm99.json new file mode 100644 index 00000000000..ca9a4496c6a --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-5w7q-hp3j-xm99/GHSA-5w7q-hp3j-xm99.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5w7q-hp3j-xm99", + "modified": "2024-08-21T00:30:30Z", + "published": "2024-08-21T00:30:30Z", + "aliases": [ + "CVE-2024-43868" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv/purgatory: align riscv_kernel_entry\n\nWhen alignment handling is delegated to the kernel, everything must be\nword-aligned in purgatory, since the trap handler is then set to the\nkexec one. Without the alignment, hitting the exception would\nultimately crash. On other occasions, the kernel's handler would take\ncare of exceptions.\nThis has been tested on a JH7110 SoC with oreboot and its SBI delegating\nunaligned access exceptions and the kernel configured to handle them.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43868" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/5d4aaf16a8255f7c71790e211724ba029609c5ff" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/fb197c5d2fd24b9af3d4697d0cf778645846d6d5" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-21T00:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-6247-7862-q2pq/GHSA-6247-7862-q2pq.json b/advisories/unreviewed/2024/08/GHSA-6247-7862-q2pq/GHSA-6247-7862-q2pq.json new file mode 100644 index 00000000000..e518793ef70 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-6247-7862-q2pq/GHSA-6247-7862-q2pq.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6247-7862-q2pq", + "modified": "2024-08-21T00:30:29Z", + "published": "2024-08-21T00:30:29Z", + "aliases": [ + "CVE-2024-22281" + ], + "details": "** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies.\n\nThis issue affects Apache Helix Front (UI): all versions.\n\nAs this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.\n\nNOTE: This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22281" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/zt26fpmrqx3fzcy8nv3b43kb3xllo5ny" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-668" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-20T23:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-68fj-vj36-gmvc/GHSA-68fj-vj36-gmvc.json b/advisories/unreviewed/2024/08/GHSA-68fj-vj36-gmvc/GHSA-68fj-vj36-gmvc.json index 1c55161c84a..f02e2d9101b 100644 --- a/advisories/unreviewed/2024/08/GHSA-68fj-vj36-gmvc/GHSA-68fj-vj36-gmvc.json +++ b/advisories/unreviewed/2024/08/GHSA-68fj-vj36-gmvc/GHSA-68fj-vj36-gmvc.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-68fj-vj36-gmvc", - "modified": "2024-08-20T15:32:13Z", + "modified": "2024-08-21T00:30:29Z", "published": "2024-08-20T15:32:13Z", "aliases": [ "CVE-2024-42581" ], "details": "A Cross-Site Request Forgery (CSRF) in the component delete_group.php of Warehouse Inventory System v2.0 allows attackers to escalate privileges.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-20T13:15:08Z" diff --git a/advisories/unreviewed/2024/08/GHSA-69w2-8rxh-w4m7/GHSA-69w2-8rxh-w4m7.json b/advisories/unreviewed/2024/08/GHSA-69w2-8rxh-w4m7/GHSA-69w2-8rxh-w4m7.json new file mode 100644 index 00000000000..4235a9ad26f --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-69w2-8rxh-w4m7/GHSA-69w2-8rxh-w4m7.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-69w2-8rxh-w4m7", + "modified": "2024-08-21T00:30:29Z", + "published": "2024-08-21T00:30:29Z", + "aliases": [ + "CVE-2024-43864" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix CT entry update leaks of modify header context\n\nThe cited commit allocates a new modify header to replace the old\none when updating CT entry. But if failed to allocate a new one, eg.\nexceed the max number firmware can support, modify header will be\nan error pointer that will trigger a panic when deallocating it. And\nthe old modify header point is copied to old attr. When the old\nattr is freed, the old modify header is lost.\n\nFix it by restoring the old attr to attr when failed to allocate a\nnew modify header context. So when the CT entry is freed, the right\nmodify header context will be freed. And the panic of accessing\nerror pointer is also fixed.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43864" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/025f2b85a5e5a46df14ecf162c3c80a957a36d0b" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/89064d09c56b44c668509bf793c410484f63f5ad" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/daab2cc17b6b6ab158566bba037e9551fd432b59" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-21T00:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-7c63-hh47-864q/GHSA-7c63-hh47-864q.json b/advisories/unreviewed/2024/08/GHSA-7c63-hh47-864q/GHSA-7c63-hh47-864q.json index 14d5071755b..8ead0bdc930 100644 --- a/advisories/unreviewed/2024/08/GHSA-7c63-hh47-864q/GHSA-7c63-hh47-864q.json +++ b/advisories/unreviewed/2024/08/GHSA-7c63-hh47-864q/GHSA-7c63-hh47-864q.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-7c63-hh47-864q", - "modified": "2024-08-20T15:32:13Z", + "modified": "2024-08-21T00:30:29Z", "published": "2024-08-20T15:32:13Z", "aliases": [ "CVE-2024-42609" ], "details": "Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/admin_backup.php?dobackup=avatars", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-20T15:15:22Z" diff --git a/advisories/unreviewed/2024/08/GHSA-8gxf-54jp-wccf/GHSA-8gxf-54jp-wccf.json b/advisories/unreviewed/2024/08/GHSA-8gxf-54jp-wccf/GHSA-8gxf-54jp-wccf.json new file mode 100644 index 00000000000..44e52b998af --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-8gxf-54jp-wccf/GHSA-8gxf-54jp-wccf.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8gxf-54jp-wccf", + "modified": "2024-08-21T00:30:29Z", + "published": "2024-08-21T00:30:29Z", + "aliases": [ + "CVE-2024-43862" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wan: fsl_qmc_hdlc: Convert carrier_lock spinlock to a mutex\n\nThe carrier_lock spinlock protects the carrier detection. While it is\nheld, framer_get_status() is called which in turn takes a mutex.\nThis is not correct and can lead to a deadlock.\n\nA run with PROVE_LOCKING enabled detected the issue:\n [ BUG: Invalid wait context ]\n ...\n c204ddbc (&framer->mutex){+.+.}-{3:3}, at: framer_get_status+0x40/0x78\n other info that might help us debug this:\n context-{4:4}\n 2 locks held by ifconfig/146:\n #0: c0926a38 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x12c/0x664\n #1: c2006a40 (&qmc_hdlc->carrier_lock){....}-{2:2}, at: qmc_hdlc_framer_set_carrier+0x30/0x98\n\nAvoid the spinlock usage and convert carrier_lock to a mutex.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43862" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c4d6a347ba7babdf9d90a0eb24048c266cae0532" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f223d2b4acb7a45a6e0581cb380e1af1a6dc7ab9" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-21T00:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-8h54-x6jj-v528/GHSA-8h54-x6jj-v528.json b/advisories/unreviewed/2024/08/GHSA-8h54-x6jj-v528/GHSA-8h54-x6jj-v528.json new file mode 100644 index 00000000000..9a683ed87e0 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-8h54-x6jj-v528/GHSA-8h54-x6jj-v528.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8h54-x6jj-v528", + "modified": "2024-08-21T00:30:30Z", + "published": "2024-08-21T00:30:30Z", + "aliases": [ + "CVE-2024-43867" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau: prime: fix refcount underflow\n\nCalling nouveau_bo_ref() on a nouveau_bo without initializing it (and\nhence the backing ttm_bo) leads to a refcount underflow.\n\nInstead of calling nouveau_bo_ref() in the unwind path of\ndrm_gem_object_init(), clean things up manually.\n\n(cherry picked from commit 1b93f3e89d03cfc576636e195466a0d728ad8de5)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43867" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/16998763c62bb465ebc409d0373b9cdcef1a61a6" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/2a1b327d57a8ac080977633a18999f032d7e9e3f" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3bcb8bba72ce89667fa863054956267c450c47ef" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/906372e753c5027a1dc88743843b6aa2ad1aaecf" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a9bf3efc33f1fbf88787a277f7349459283c9b95" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/ebebba4d357b6c67f96776a48ddbaf0060fa4c10" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/f23cd66933fe76b84d8e282e5606b4d99068c320" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-21T00:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-f95q-fwq6-mx8w/GHSA-f95q-fwq6-mx8w.json b/advisories/unreviewed/2024/08/GHSA-f95q-fwq6-mx8w/GHSA-f95q-fwq6-mx8w.json new file mode 100644 index 00000000000..c1935d0daa5 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-f95q-fwq6-mx8w/GHSA-f95q-fwq6-mx8w.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f95q-fwq6-mx8w", + "modified": "2024-08-21T00:30:29Z", + "published": "2024-08-21T00:30:29Z", + "aliases": [ + "CVE-2024-43863" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vmwgfx: Fix a deadlock in dma buf fence polling\n\nIntroduce a version of the fence ops that on release doesn't remove\nthe fence from the pending list, and thus doesn't require a lock to\nfix poll->fence wait->fence unref deadlocks.\n\nvmwgfx overwrites the wait callback to iterate over the list of all\nfences and update their status, to do that it holds a lock to prevent\nthe list modifcations from other threads. The fence destroy callback\nboth deletes the fence and removes it from the list of pending\nfences, for which it holds a lock.\n\ndma buf polling cb unrefs a fence after it's been signaled: so the poll\ncalls the wait, which signals the fences, which are being destroyed.\nThe destruction tries to acquire the lock on the pending fences list\nwhich it can never get because it's held by the wait from which it\nwas called.\n\nOld bug, but not a lot of userspace apps were using dma-buf polling\ninterfaces. Fix those, in particular this fixes KDE stalls/deadlock.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43863" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/3b933b16c996af8adb6bc1b5748a63dfb41a82bc" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/9e20d028d8d1deb1e7fed18f22ffc01669cf3237" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a8943969f9ead2fd3044fc826140a21622ef830e" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/c98ab18b9f315ff977c2c65d7c71298ef98be8e3" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/e58337100721f3cc0c7424a18730e4f39844934f" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-21T00:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-mxq3-jq8p-cph4/GHSA-mxq3-jq8p-cph4.json b/advisories/unreviewed/2024/08/GHSA-mxq3-jq8p-cph4/GHSA-mxq3-jq8p-cph4.json new file mode 100644 index 00000000000..057adee6389 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-mxq3-jq8p-cph4/GHSA-mxq3-jq8p-cph4.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mxq3-jq8p-cph4", + "modified": "2024-08-21T00:30:30Z", + "published": "2024-08-21T00:30:30Z", + "aliases": [ + "CVE-2024-8022" + ], + "details": "A vulnerability was found in Genexis Tilgin Home Gateway 322_AS0500-03_05_13_05. It has been rated as problematic. This issue affects some unknown processing of the file /vood/cgi-bin/vood_view.cgi?lang=EN&act=user/spec_conf&sessionId=86213915328111654515&user=A&message2user=Account%20updated. The manipulation of the argument Phone Number leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8022" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.275291" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.275291" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.389913" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-21T00:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-q567-qjp8-m2mc/GHSA-q567-qjp8-m2mc.json b/advisories/unreviewed/2024/08/GHSA-q567-qjp8-m2mc/GHSA-q567-qjp8-m2mc.json index f3ee24fe369..84c2c25a24b 100644 --- a/advisories/unreviewed/2024/08/GHSA-q567-qjp8-m2mc/GHSA-q567-qjp8-m2mc.json +++ b/advisories/unreviewed/2024/08/GHSA-q567-qjp8-m2mc/GHSA-q567-qjp8-m2mc.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-q567-qjp8-m2mc", - "modified": "2024-08-20T15:32:12Z", + "modified": "2024-08-21T00:30:29Z", "published": "2024-08-20T15:32:12Z", "aliases": [ "CVE-2024-42565" ], "details": "ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/contact/delete?action=delete.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-20T13:15:07Z" diff --git a/advisories/unreviewed/2024/08/GHSA-r9x9-2w3c-2654/GHSA-r9x9-2w3c-2654.json b/advisories/unreviewed/2024/08/GHSA-r9x9-2w3c-2654/GHSA-r9x9-2w3c-2654.json new file mode 100644 index 00000000000..2afe836e18c --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-r9x9-2w3c-2654/GHSA-r9x9-2w3c-2654.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r9x9-2w3c-2654", + "modified": "2024-08-21T00:30:30Z", + "published": "2024-08-21T00:30:30Z", + "aliases": [ + "CVE-2024-8023" + ], + "details": "A vulnerability classified as critical has been found in chillzhuang SpringBlade 4.1.0. Affected is an unknown function of the file /api/blade-system/menu/list?updatexml. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8023" + }, + { + "type": "WEB", + "url": "https://gist.github.com/topsky979/74dcbe81062718f314d81fb6ad5dc1e0" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.275292" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.275292" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.390087" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-21T00:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-v4fq-rjqc-xp4w/GHSA-v4fq-rjqc-xp4w.json b/advisories/unreviewed/2024/08/GHSA-v4fq-rjqc-xp4w/GHSA-v4fq-rjqc-xp4w.json index e5abe10781e..e363036e3ee 100644 --- a/advisories/unreviewed/2024/08/GHSA-v4fq-rjqc-xp4w/GHSA-v4fq-rjqc-xp4w.json +++ b/advisories/unreviewed/2024/08/GHSA-v4fq-rjqc-xp4w/GHSA-v4fq-rjqc-xp4w.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-v4fq-rjqc-xp4w", - "modified": "2024-08-20T15:32:13Z", + "modified": "2024-08-21T00:30:29Z", "published": "2024-08-20T15:32:12Z", "aliases": [ "CVE-2024-42574" ], "details": "School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at attendance.php.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-20T13:15:08Z" diff --git a/advisories/unreviewed/2024/08/GHSA-v97r-2c8q-frf2/GHSA-v97r-2c8q-frf2.json b/advisories/unreviewed/2024/08/GHSA-v97r-2c8q-frf2/GHSA-v97r-2c8q-frf2.json index 91f0c7de4a2..ed382e31ad3 100644 --- a/advisories/unreviewed/2024/08/GHSA-v97r-2c8q-frf2/GHSA-v97r-2c8q-frf2.json +++ b/advisories/unreviewed/2024/08/GHSA-v97r-2c8q-frf2/GHSA-v97r-2c8q-frf2.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-v97r-2c8q-frf2", - "modified": "2024-08-20T15:32:12Z", + "modified": "2024-08-21T00:30:29Z", "published": "2024-08-20T15:32:12Z", "aliases": [ "CVE-2024-42558" ], "details": "Hotel Management System commit 91caab8 was discovered to contain a SQL injection vulnerability via the book_id parameter at admin_modify_room.php.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-20T13:15:06Z"