From b75c10df2d7c6357f7ebfa14efddc82501cf6576 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 1 Mar 2024 06:34:26 +0000 Subject: [PATCH] Publish Advisories GHSA-jv9p-xg7j-p65c GHSA-vqf3-8wjf-vm68 GHSA-jqrq-gqwg-r8r5 GHSA-q9rx-4p5p-q33x GHSA-6jvg-hp25-42f6 GHSA-8w7r-5fhv-vwj9 GHSA-xf53-c458-r6pv --- .../GHSA-jv9p-xg7j-p65c.json | 12 +++++- .../GHSA-vqf3-8wjf-vm68.json | 23 +++++++++-- .../GHSA-jqrq-gqwg-r8r5.json | 6 ++- .../GHSA-q9rx-4p5p-q33x.json | 6 ++- .../GHSA-6jvg-hp25-42f6.json | 35 +++++++++++++++++ .../GHSA-8w7r-5fhv-vwj9.json | 35 +++++++++++++++++ .../GHSA-xf53-c458-r6pv.json | 39 +++++++++++++++++++ 7 files changed, 148 insertions(+), 8 deletions(-) create mode 100644 advisories/unreviewed/2024/03/GHSA-6jvg-hp25-42f6/GHSA-6jvg-hp25-42f6.json create mode 100644 advisories/unreviewed/2024/03/GHSA-8w7r-5fhv-vwj9/GHSA-8w7r-5fhv-vwj9.json create mode 100644 advisories/unreviewed/2024/03/GHSA-xf53-c458-r6pv/GHSA-xf53-c458-r6pv.json diff --git a/advisories/unreviewed/2023/10/GHSA-jv9p-xg7j-p65c/GHSA-jv9p-xg7j-p65c.json b/advisories/unreviewed/2023/10/GHSA-jv9p-xg7j-p65c/GHSA-jv9p-xg7j-p65c.json index 3c7f68da8dc..b24797a902f 100644 --- a/advisories/unreviewed/2023/10/GHSA-jv9p-xg7j-p65c/GHSA-jv9p-xg7j-p65c.json +++ b/advisories/unreviewed/2023/10/GHSA-jv9p-xg7j-p65c/GHSA-jv9p-xg7j-p65c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jv9p-xg7j-p65c", - "modified": "2023-10-25T03:30:36Z", + "modified": "2024-03-01T06:33:05Z", "published": "2023-10-18T18:31:38Z", "aliases": [ "CVE-2023-46009" @@ -24,13 +24,21 @@ { "type": "WEB", "url": "https://github.com/kohler/gifsicle/issues/196" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3I6Z7VAHUYX3Q4DULJ76NFD2CIFZJYH5" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WLTXJS6AIKPGVOAJ7EYC4HL3NEG6CGF" } ], "database_specific": { "cwe_ids": [ "CWE-697" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-10-18T16:15:08Z" diff --git a/advisories/unreviewed/2023/10/GHSA-vqf3-8wjf-vm68/GHSA-vqf3-8wjf-vm68.json b/advisories/unreviewed/2023/10/GHSA-vqf3-8wjf-vm68/GHSA-vqf3-8wjf-vm68.json index 4d250e0ee6d..438f084489e 100644 --- a/advisories/unreviewed/2023/10/GHSA-vqf3-8wjf-vm68/GHSA-vqf3-8wjf-vm68.json +++ b/advisories/unreviewed/2023/10/GHSA-vqf3-8wjf-vm68/GHSA-vqf3-8wjf-vm68.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-vqf3-8wjf-vm68", - "modified": "2023-10-09T21:30:27Z", + "modified": "2024-03-01T06:33:05Z", "published": "2023-10-09T21:30:27Z", "aliases": [ "CVE-2023-44821" ], "details": "Buffer Overflow vulnerability in gifsicle v.1.92 allows a remote attacker to cause a denial of service via the --crop parameter in the command line parameters.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -21,13 +24,25 @@ { "type": "WEB", "url": "https://github.com/kohler/gifsicle/issues/195" + }, + { + "type": "WEB", + "url": "https://github.com/kohler/gifsicle/issues/65" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3I6Z7VAHUYX3Q4DULJ76NFD2CIFZJYH5" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3WLTXJS6AIKPGVOAJ7EYC4HL3NEG6CGF" } ], "database_specific": { "cwe_ids": [ - + "CWE-401" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-10-09T20:15:10Z" diff --git a/advisories/unreviewed/2024/02/GHSA-jqrq-gqwg-r8r5/GHSA-jqrq-gqwg-r8r5.json b/advisories/unreviewed/2024/02/GHSA-jqrq-gqwg-r8r5/GHSA-jqrq-gqwg-r8r5.json index 3c528c47b48..79942501c9b 100644 --- a/advisories/unreviewed/2024/02/GHSA-jqrq-gqwg-r8r5/GHSA-jqrq-gqwg-r8r5.json +++ b/advisories/unreviewed/2024/02/GHSA-jqrq-gqwg-r8r5/GHSA-jqrq-gqwg-r8r5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jqrq-gqwg-r8r5", - "modified": "2024-02-13T18:38:23Z", + "modified": "2024-03-01T06:33:06Z", "published": "2024-02-13T18:38:23Z", "aliases": [ "CVE-2024-21338" @@ -21,6 +21,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21338" }, + { + "type": "WEB", + "url": "https://decoded.avast.io/janvojtesek/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day" + }, { "type": "WEB", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21338" diff --git a/advisories/unreviewed/2024/02/GHSA-q9rx-4p5p-q33x/GHSA-q9rx-4p5p-q33x.json b/advisories/unreviewed/2024/02/GHSA-q9rx-4p5p-q33x/GHSA-q9rx-4p5p-q33x.json index ad98e8ec0a9..38d086e0d75 100644 --- a/advisories/unreviewed/2024/02/GHSA-q9rx-4p5p-q33x/GHSA-q9rx-4p5p-q33x.json +++ b/advisories/unreviewed/2024/02/GHSA-q9rx-4p5p-q33x/GHSA-q9rx-4p5p-q33x.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-q9rx-4p5p-q33x", - "modified": "2024-02-22T00:31:01Z", + "modified": "2024-03-01T06:33:06Z", "published": "2024-02-22T00:31:01Z", "aliases": [ "CVE-2024-0446" @@ -21,6 +21,10 @@ { "type": "WEB", "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0002" + }, + { + "type": "WEB", + "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/03/GHSA-6jvg-hp25-42f6/GHSA-6jvg-hp25-42f6.json b/advisories/unreviewed/2024/03/GHSA-6jvg-hp25-42f6/GHSA-6jvg-hp25-42f6.json new file mode 100644 index 00000000000..7760907c84a --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-6jvg-hp25-42f6/GHSA-6jvg-hp25-42f6.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6jvg-hp25-42f6", + "modified": "2024-03-01T06:33:06Z", + "published": "2024-03-01T06:33:06Z", + "aliases": [ + "CVE-2024-22891" + ], + "details": "Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22891" + }, + { + "type": "WEB", + "url": "https://github.com/EQSTLab/PoC/tree/main/2024/RCE/CVE-2024-22891" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-01T06:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-8w7r-5fhv-vwj9/GHSA-8w7r-5fhv-vwj9.json b/advisories/unreviewed/2024/03/GHSA-8w7r-5fhv-vwj9/GHSA-8w7r-5fhv-vwj9.json new file mode 100644 index 00000000000..54b1164df95 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-8w7r-5fhv-vwj9/GHSA-8w7r-5fhv-vwj9.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8w7r-5fhv-vwj9", + "modified": "2024-03-01T06:33:06Z", + "published": "2024-03-01T06:33:06Z", + "aliases": [ + "CVE-2024-25293" + ], + "details": "mjml-app versions 3.0.4 and 3.1.0-beta were discovered to contain a remote code execution (RCE) via the href attribute.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25293" + }, + { + "type": "WEB", + "url": "https://github.com/EQSTLab/PoC/tree/main/2024/LCE/CVE-2024-25293" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-01T06:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-xf53-c458-r6pv/GHSA-xf53-c458-r6pv.json b/advisories/unreviewed/2024/03/GHSA-xf53-c458-r6pv/GHSA-xf53-c458-r6pv.json new file mode 100644 index 00000000000..a6868280182 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-xf53-c458-r6pv/GHSA-xf53-c458-r6pv.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xf53-c458-r6pv", + "modified": "2024-03-01T06:33:06Z", + "published": "2024-03-01T06:33:06Z", + "aliases": [ + "CVE-2024-25386" + ], + "details": "Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote attacker to execute arbitrary code via the format_logfile.pl file.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25386" + }, + { + "type": "WEB", + "url": "https://gist.github.com/Shulelk/15c9ba8d6b54dd4256a50a24ac7dd0a2" + }, + { + "type": "WEB", + "url": "https://sec.1i6w31fen9.top/2024/02/02/dcf-operations-window-remote-command-execute" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-01T06:15:48Z" + } +} \ No newline at end of file