Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2025-02-25 21:33:14 +00:00
parent e859f64e0c
commit b3ffac1d6e
58 changed files with 917 additions and 63 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-48cj-44rg-fxc7",
-  "modified": "2023-04-03T18:32:06Z",
+  "modified": "2025-02-25T21:31:20Z",
  "published": "2023-03-23T21:30:19Z",
  "aliases": [
    "CVE-2023-1513"
@@ -35,6 +35,10 @@
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html"
    },
+    {
+      "type": "WEB",
+      "url": "https://lore.kernel.org/kvm/20230214103304.3689213-1-gregkh%40linuxfoundation.org"
+    },
    {
      "type": "WEB",
      "url": "https://lore.kernel.org/kvm/20230214103304.3689213-1-gregkh@linuxfoundation.org"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9xmf-4p3w-hc8w",
-  "modified": "2023-03-28T21:30:17Z",
+  "modified": "2025-02-25T21:31:22Z",
  "published": "2023-03-23T21:30:17Z",
  "aliases": [
    "CVE-2023-28611"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-m8h2-2q9c-f24g",
-  "modified": "2023-03-28T18:30:30Z",
+  "modified": "2025-02-25T21:31:16Z",
  "published": "2023-03-21T18:30:20Z",
  "aliases": [
    "CVE-2023-1304"
@@ -25,7 +25,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-269"
+    ],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-94c6-6qpc-j73m",
-  "modified": "2024-04-04T05:34:55Z",
+  "modified": "2025-02-25T21:31:16Z",
  "published": "2023-07-06T19:24:12Z",
  "aliases": [
    "CVE-2023-28663"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-vhvr-7ww4-7fgj",
-  "modified": "2024-03-13T15:31:05Z",
+  "modified": "2025-02-25T21:31:24Z",
  "published": "2024-03-13T15:31:05Z",
  "aliases": [
    "CVE-2023-52608"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Check mailbox/SMT channel for consistency\n\nOn reception of a completion interrupt the shared memory area is accessed\nto retrieve the message header at first and then, if the message sequence\nnumber identifies a transaction which is still pending, the related\npayload is fetched too.\n\nWhen an SCMI command times out the channel ownership remains with the\nplatform until eventually a late reply is received and, as a consequence,\nany further transmission attempt remains pending, waiting for the channel\nto be relinquished by the platform.\n\nOnce that late reply is received the channel ownership is given back\nto the agent and any pending request is then allowed to proceed and\noverwrite the SMT area of the just delivered late reply; then the wait\nfor the reply to the new request starts.\n\nIt has been observed that the spurious IRQ related to the late reply can\nbe wrongly associated with the freshly enqueued request: when that happens\nthe SCMI stack in-flight lookup procedure is fooled by the fact that the\nmessage header now present in the SMT area is related to the new pending\ntransaction, even though the real reply has still to arrive.\n\nThis race-condition on the A2P channel can be detected by looking at the\nchannel status bits: a genuine reply from the platform will have set the\nchannel free bit before triggering the completion IRQ.\n\nAdd a consistency check to validate such condition in the A2P ISR.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -36,8 +41,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-362"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-13T14:15:07Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8xj7-c2mm-v3r5",
-  "modified": "2024-10-08T18:33:17Z",
+  "modified": "2025-02-25T21:31:27Z",
  "published": "2024-10-08T18:33:17Z",
  "aliases": [
    "CVE-2024-43583"
@@ -19,6 +19,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43583"
    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Kvngtheta/CVE-2024-43583-PoC/blob/main/poc-43583.py"
+    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43583"
@@ -50,7 +50,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-89"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -42,7 +42,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-284"
+      "CWE-284",
+      "CWE-434"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -26,6 +26,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-79",
      "CWE-80"
    ],
    "severity": "HIGH",
@@ -42,7 +42,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-89"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -42,7 +42,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-89"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -46,7 +46,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-89"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -46,7 +46,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-89"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,13 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-264g-h4m4-r2w6",
-  "modified": "2025-02-19T09:33:30Z",
+  "modified": "2025-02-25T21:31:34Z",
  "published": "2025-02-19T09:33:29Z",
  "aliases": [
    "CVE-2025-1135"
  ],
  "details": "A vulnerability exists in ChurchCRM 5.13.0. and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL Injection vulnerability in the BatchWinnerEntry functionality. The CurrentFundraiser parameter is directly concatenated into an SQL query without sufficient sanitization, allowing an attacker to manipulate database queries and execute arbitrary commands, potentially leading to data exfiltration, modification, or deletion. Please note the vulnerability requires Administrator privileges.",
  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    },
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:H/U:Red"
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2hv6-9hx6-7j2g",
+  "modified": "2025-02-25T21:31:44Z",
+  "published": "2025-02-25T21:31:44Z",
+  "aliases": [
+    "CVE-2024-45426"
+  ],
+  "details": "Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45426"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24038"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-708"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-25T20:15:35Z"
+  }
+}
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2pq9-46mh-w84j",
-  "modified": "2025-02-14T06:30:36Z",
+  "modified": "2025-02-25T21:31:33Z",
  "published": "2025-02-14T06:30:36Z",
  "aliases": [
    "CVE-2024-13692"
@@ -46,7 +46,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-285"
+      "CWE-285",
+      "CWE-639"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2w4f-h4cf-767r",
+  "modified": "2025-02-25T21:31:43Z",
+  "published": "2025-02-25T21:31:43Z",
+  "aliases": [
+    "CVE-2024-45421"
+  ],
+  "details": "Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network access.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45421"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24043"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-122"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-25T20:15:35Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-33xp-654m-3j2x",
+  "modified": "2025-02-25T21:31:45Z",
+  "published": "2025-02-25T21:31:45Z",
+  "aliases": [
+    "CVE-2024-53879"
+  ],
+  "details": "NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a malformed ELF file to cuobjdump. A successful exploit of this vulnerability might lead to a partial denial of service.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53879"
+    },
+    {
+      "type": "WEB",
+      "url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5594"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-1284"
+    ],
+    "severity": "LOW",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-02-25T21:15:17Z"
+  }
+}
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3w3w-mjc4-w534",
-  "modified": "2025-02-14T06:30:36Z",
+  "modified": "2025-02-25T21:31:33Z",
  "published": "2025-02-14T06:30:36Z",
  "aliases": [
    "CVE-2024-13641"
--- a/Show More
+++ b/Show More