From aeb6e8750cfef341f6534433f2d68938786c5496 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 30 Jun 2023 20:24:17 +0000
Subject: [PATCH] Publish Advisories

GHSA-m2qf-hxjv-5gpq
GHSA-49mv-vfcp-8gg9
GHSA-8jxm-xp43-qh3q
---
 .../GHSA-m2qf-hxjv-5gpq/GHSA-m2qf-hxjv-5gpq.json  |  4 ++++
 .../GHSA-49mv-vfcp-8gg9/GHSA-49mv-vfcp-8gg9.json  | 15 +++++++++++++--
 .../GHSA-8jxm-xp43-qh3q/GHSA-8jxm-xp43-qh3q.json  |  4 ++--
 3 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/advisories/github-reviewed/2023/05/GHSA-m2qf-hxjv-5gpq/GHSA-m2qf-hxjv-5gpq.json b/advisories/github-reviewed/2023/05/GHSA-m2qf-hxjv-5gpq/GHSA-m2qf-hxjv-5gpq.json
index d062177877e..b38625963de 100644
--- a/advisories/github-reviewed/2023/05/GHSA-m2qf-hxjv-5gpq/GHSA-m2qf-hxjv-5gpq.json
+++ b/advisories/github-reviewed/2023/05/GHSA-m2qf-hxjv-5gpq/GHSA-m2qf-hxjv-5gpq.json
@@ -96,6 +96,10 @@
     {
       "type": "WEB",
       "url": "https://github.com/pypa/advisory-database/tree/main/vulns/flask/PYSEC-2023-62.yaml"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.debian.org/security/2023/dsa-5442"
     }
   ],
   "database_specific": {
diff --git a/advisories/github-reviewed/2023/06/GHSA-49mv-vfcp-8gg9/GHSA-49mv-vfcp-8gg9.json b/advisories/github-reviewed/2023/06/GHSA-49mv-vfcp-8gg9/GHSA-49mv-vfcp-8gg9.json
index da6d506fa43..0035bd1d5ef 100644
--- a/advisories/github-reviewed/2023/06/GHSA-49mv-vfcp-8gg9/GHSA-49mv-vfcp-8gg9.json
+++ b/advisories/github-reviewed/2023/06/GHSA-49mv-vfcp-8gg9/GHSA-49mv-vfcp-8gg9.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-49mv-vfcp-8gg9",
-  "modified": "2023-06-23T21:38:31Z",
+  "modified": "2023-06-30T20:23:28Z",
   "published": "2023-06-22T21:30:49Z",
   "aliases": [
     "CVE-2023-35132"
@@ -9,7 +9,10 @@
   "summary": "Moodle vulnerable to SQL Injection",
   "details": "A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    }
   ],
   "affected": [
     {
@@ -120,6 +123,14 @@
       "type": "PACKAGE",
       "url": "https://github.com/moodle/moodle"
     },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7A72KX4WU6GK2CX4TKYFGFASPKOEOJFC/"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5QAEAGJ44NVXLAJFJXKARKC45OGEDXT/"
+    },
     {
       "type": "WEB",
       "url": "https://moodle.org/mod/forum/discuss.php?d=447830"
diff --git a/advisories/github-reviewed/2023/06/GHSA-8jxm-xp43-qh3q/GHSA-8jxm-xp43-qh3q.json b/advisories/github-reviewed/2023/06/GHSA-8jxm-xp43-qh3q/GHSA-8jxm-xp43-qh3q.json
index 329f97d1fc2..37cd2a53ca0 100644
--- a/advisories/github-reviewed/2023/06/GHSA-8jxm-xp43-qh3q/GHSA-8jxm-xp43-qh3q.json
+++ b/advisories/github-reviewed/2023/06/GHSA-8jxm-xp43-qh3q/GHSA-8jxm-xp43-qh3q.json
@@ -1,10 +1,10 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8jxm-xp43-qh3q",
-  "modified": "2023-06-21T22:08:34Z",
+  "modified": "2023-06-30T20:22:45Z",
   "published": "2023-06-21T22:08:34Z",
   "aliases": [
-    "CVE-2023-35170"
+    "CVE-2023-34758"
   ],
   "summary": "Silver vulnerable to MitM attack against implants due to a cryptography vulnerability",
   "details": "### Summary\nThe current cryptography implementation in Sliver up to version 1.5.39 allows a MitM with access to the corresponding implant binary to execute arbitrary codes on implanted devices via intercepted and crafted responses. (Reserved CVE ID: CVE-2023-34758)\n\n### Details\nPlease see [the PoC repo](https://github.com/tangent65536/Slivjacker).\n\n### PoC\nPlease also see [the PoC repo](https://github.com/tangent65536/Slivjacker).\nTo setup a simple PoC environment,  \n 1. Generate an implant with its C2 set to the PoC server's address and copy the embedded private implant key and public server key into the config json.  \n 2. Run the implant on a separate VM and a `notepad.exe` window should pop up on the implanted VM.  \n\n### Impact\nA successful attack grants the attacker permission to execute arbitrary code on the implanted device.  \n  \n### References\nhttps://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go  \nhttps://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go  \nhttps://github.com/tangent65536/Slivjacker  \n\n### Credits\n[Ting-Wei Hsieh](https://github.com/tangent65536) from [CHT Security Co. Ltd.](https://www.chtsecurity.com/?lang=en)",