Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-01-02 06:31:44 +00:00
parent 9f77295cb4
commit b4c597ddb5
29 changed files with 1126 additions and 0 deletions
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-25rm-72cp-x5mm",
+  "modified": "2024-01-02T06:30:31Z",
+  "published": "2024-01-02T06:30:31Z",
+  "aliases": [
+    "CVE-2023-33113"
+  ],
+  "details": "Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33113"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:12Z"
+  }
+}
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-44qm-928x-6p3g",
+  "modified": "2024-01-02T06:30:31Z",
+  "published": "2024-01-02T06:30:31Z",
+  "aliases": [
+    "CVE-2023-47039"
+  ],
+  "details": "A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and execute `cmd.exe` within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. This flaw allows an attacker with limited privileges to place`cmd.exe` in locations with weak permissions, such as `C:\\ProgramData`. By doing so, arbitrary code can be executed when an administrator attempts to use this executable from these compromised locations.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47039"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/security/cve/CVE-2023-47039"
+    },
+    {
+      "type": "WEB",
+      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056746"
+    },
+    {
+      "type": "WEB",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2249525"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-122"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:13Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4q33-wj3r-p79q",
+  "modified": "2024-01-02T06:30:31Z",
+  "published": "2024-01-02T06:30:31Z",
+  "aliases": [
+    "CVE-2023-43512"
+  ],
+  "details": "Transient DOS while parsing GATT service data when the total amount of memory that is required by the multiple services is greater than the actual size of the services buffer.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43512"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:13Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4w3j-4m96-c92x",
+  "modified": "2024-01-02T06:30:30Z",
+  "published": "2024-01-02T06:30:30Z",
+  "aliases": [
+    "CVE-2023-28583"
+  ],
+  "details": "Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28583"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:08Z"
+  }
+}
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5rxp-9658-h93v",
+  "modified": "2024-01-02T06:30:30Z",
+  "published": "2024-01-02T06:30:30Z",
+  "aliases": [
+    "CVE-2023-26157"
+  ],
+  "details": "Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving section->num_pages in decode_r2007.c.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26157"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/LibreDWG/libredwg/issues/850"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/LibreDWG/libredwg/commit/c8cf03ce4c2315b146caf582ea061c0460193bcc"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.snyk.io/vuln/SNYK-UNMANAGED-LIBREDWG-6070730"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-400"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T05:15:08Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5w5c-6hmq-mgpr",
+  "modified": "2024-01-02T06:30:31Z",
+  "published": "2024-01-02T06:30:31Z",
+  "aliases": [
+    "CVE-2023-43511"
+  ],
+  "details": "Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43511"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:13Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-864j-6gwg-g82x",
+  "modified": "2024-01-02T06:30:31Z",
+  "published": "2024-01-02T06:30:31Z",
+  "aliases": [
+    "CVE-2023-33094"
+  ],
+  "details": "Memory corruption while running VK synchronization with KASAN enabled.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33094"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:11Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8p2w-c42w-3mfv",
+  "modified": "2024-01-02T06:30:31Z",
+  "published": "2024-01-02T06:30:31Z",
+  "aliases": [
+    "CVE-2023-33108"
+  ],
+  "details": "Memory corruption in Graphics Driver when destroying a context with KGSL_GPU_AUX_COMMAND_TIMELINE objects queued.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33108"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:11Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9fw6-m2v2-f3rp",
+  "modified": "2024-01-02T06:30:30Z",
+  "published": "2024-01-02T06:30:30Z",
+  "aliases": [
+    "CVE-2023-33038"
+  ],
+  "details": "Memory corruption while receiving a message in Bus Socket Transport Server.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33038"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:10Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9gv7-j9wm-9q6p",
+  "modified": "2024-01-02T06:30:31Z",
+  "published": "2024-01-02T06:30:31Z",
+  "aliases": [
+    "CVE-2023-33109"
+  ],
+  "details": "Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33109"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:11Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c44g-2jv9-3436",
+  "modified": "2024-01-02T06:30:31Z",
+  "published": "2024-01-02T06:30:31Z",
+  "aliases": [
+    "CVE-2023-33112"
+  ],
+  "details": "Transient DOS when WLAN firmware receives \"reassoc response\" frame including RIC_DATA element.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33112"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:11Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c543-q7r3-jw94",
+  "modified": "2024-01-02T06:30:30Z",
+  "published": "2024-01-02T06:30:30Z",
+  "aliases": [
+    "CVE-2023-33014"
+  ],
+  "details": "Information disclosure in Core services while processing a Diag command.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33014"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:08Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c8p2-9jx9-h338",
+  "modified": "2024-01-02T06:30:31Z",
+  "published": "2024-01-02T06:30:31Z",
+  "aliases": [
+    "CVE-2023-33114"
+  ],
+  "details": "Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33114"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:12Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cv8x-5cww-p4pf",
+  "modified": "2024-01-02T06:30:31Z",
+  "published": "2024-01-02T06:30:31Z",
+  "aliases": [
+    "CVE-2023-33116"
+  ],
+  "details": "Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33116"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:12Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cvq4-g535-rh5v",
+  "modified": "2024-01-02T06:30:30Z",
+  "published": "2024-01-02T06:30:30Z",
+  "aliases": [
+    "CVE-2023-33085"
+  ],
+  "details": "Memory corruption in wearables while processing data from AON.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33085"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:10Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cxcm-vgv2-mq4g",
+  "modified": "2024-01-02T06:30:30Z",
+  "published": "2024-01-02T06:30:30Z",
+  "aliases": [
+    "CVE-2023-33062"
+  ],
+  "details": "Transient DOS in WLAN Firmware while parsing a BTM request.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33062"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:10Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-fffh-vg75-287f",
+  "modified": "2024-01-02T06:30:30Z",
+  "published": "2024-01-02T06:30:30Z",
+  "aliases": [
+    "CVE-2023-33037"
+  ],
+  "details": "Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33037"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:10Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-gf8x-c888-36h7",
+  "modified": "2024-01-02T06:30:31Z",
+  "published": "2024-01-02T06:30:31Z",
+  "aliases": [
+    "CVE-2023-33117"
+  ],
+  "details": "Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33117"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:12Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-gxgx-xpgc-8hmf",
+  "modified": "2024-01-02T06:30:30Z",
+  "published": "2024-01-02T06:30:30Z",
+  "aliases": [
+    "CVE-2023-33025"
+  ],
+  "details": "Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33025"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2024-bulletin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T06:15:08Z"
+  }
+}
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jchw-25xp-jwwc",
+  "modified": "2024-01-02T06:30:30Z",
+  "published": "2024-01-02T06:30:30Z",
+  "aliases": [
+    "CVE-2023-26159"
+  ],
+  "details": "Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26159"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/follow-redirects/follow-redirects/issues/235"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/follow-redirects/follow-redirects/pull/236"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-01-02T05:15:08Z"
+  }
+}
--- a/Show More
+++ b/Show More