Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2025-01-06 15:32:07 +00:00
parent b6ef50e17e
commit b77e97d34c
40 changed files with 316 additions and 91 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-frjj-4mjw-3gmf",
-  "modified": "2022-05-24T16:55:32Z",
+  "modified": "2025-01-06T15:30:58Z",
  "published": "2022-05-24T16:55:32Z",
  "aliases": [
    "CVE-2019-10891"
@@ -22,6 +22,10 @@
    {
      "type": "WEB",
      "url": "https://github.com/Kirin-say/Vulnerabilities/blob/master/DIR-806_Code_Injection.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10282"
    }
  ],
  "database_specific": {
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-x629-5xff-w7qg",
-  "modified": "2024-07-03T18:31:15Z",
+  "modified": "2025-01-06T15:30:58Z",
  "published": "2022-05-17T03:11:58Z",
  "aliases": [
    "CVE-2015-2051"
@@ -19,6 +19,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2051"
    },
+    {
+      "type": "WEB",
+      "url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10282"
+    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/37171"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-45v7-mh84-5f9p",
-  "modified": "2022-09-02T00:01:10Z",
+  "modified": "2025-01-06T15:30:58Z",
  "published": "2022-08-29T00:00:33Z",
  "aliases": [
    "CVE-2022-37055"
@@ -23,6 +23,10 @@
      "type": "WEB",
      "url": "https://drive.google.com/file/d/1hmIk0jQoex4QDyjIUg_6yxi-J6ROCh8S/view?usp=sharing"
    },
+    {
+      "type": "WEB",
+      "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308"
+    },
    {
      "type": "WEB",
      "url": "https://www.dlink.com/en/security-bulletin"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8jw9-7jrj-wp3f",
-  "modified": "2022-09-02T00:01:05Z",
+  "modified": "2025-01-06T15:30:58Z",
  "published": "2022-08-29T00:00:33Z",
  "aliases": [
    "CVE-2022-37057"
@@ -23,6 +23,10 @@
      "type": "WEB",
      "url": "https://drive.google.com/file/d/1_UUpraFTxxB97ujrgVLQZXQ8Q8M58BAF/view?usp=sharing"
    },
+    {
+      "type": "WEB",
+      "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308"
+    },
    {
      "type": "WEB",
      "url": "https://www.dlink.com/en/security-bulletin"
@@ -30,7 +34,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-77"
+      "CWE-77",
+      "CWE-78"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9h5m-xxfw-pfmj",
-  "modified": "2022-09-02T00:01:10Z",
+  "modified": "2025-01-06T15:30:58Z",
  "published": "2022-08-29T00:00:33Z",
  "aliases": [
    "CVE-2022-37056"
@@ -23,6 +23,10 @@
      "type": "WEB",
      "url": "https://drive.google.com/file/d/127tqMUvAxQ4OlycoSNtcP0x2282Y75GJ/view?usp=sharing"
    },
+    {
+      "type": "WEB",
+      "url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308"
+    },
    {
      "type": "WEB",
      "url": "https://www.dlink.com/en/security-bulletin"
@@ -30,7 +34,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-77"
+      "CWE-77",
+      "CWE-78"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-q9cc-2q3j-jfm7",
-  "modified": "2024-08-05T21:31:19Z",
+  "modified": "2025-01-06T15:30:58Z",
  "published": "2024-05-06T15:30:39Z",
  "aliases": [
    "CVE-2024-33112"
@@ -19,6 +19,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33112"
    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/yj94/Yj_learning/blob/b597925953d8bbb286a63f0019bb547c1617cb61/Week16/D-LINK-POC.md"
+    },
    {
      "type": "WEB",
      "url": "https://github.com/yj94/Yj_learning/blob/main/Week16/D-LINK-POC.md"
@@ -26,7 +30,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-77"
+      "CWE-77",
+      "CWE-78"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -46,7 +46,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-89"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -46,7 +46,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-89"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-6895-2frg-pq5j",
-  "modified": "2024-12-19T00:37:35Z",
+  "modified": "2025-01-06T15:30:58Z",
  "published": "2024-12-19T00:37:35Z",
  "aliases": [
    "CVE-2024-12695"
  ],
  "details": "Out of bounds write in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -27,7 +32,7 @@
    "cwe_ids": [
      "CWE-787"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-18T22:15:06Z"
@@ -46,7 +46,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-89"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-281"
+      "CWE-281",
+      "CWE-59"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -42,7 +42,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-89"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-m84q-p89f-6cc5",
-  "modified": "2024-12-19T00:37:35Z",
+  "modified": "2025-01-06T15:30:58Z",
  "published": "2024-12-19T00:37:35Z",
  "aliases": [
    "CVE-2024-12693"
  ],
  "details": "Out of bounds memory access in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -25,7 +30,7 @@
  ],
  "database_specific": {
    "cwe_ids": [],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-18T22:15:06Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-ppp3-73jm-5rm6",
-  "modified": "2024-12-27T15:31:56Z",
+  "modified": "2025-01-06T15:30:59Z",
  "published": "2024-12-27T15:31:56Z",
  "aliases": [
    "CVE-2024-56675"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors\n\nUprobes always use bpf_prog_run_array_uprobe() under tasks-trace-RCU\nprotection. But it is possible to attach a non-sleepable BPF program to a\nuprobe, and non-sleepable BPF programs are freed via normal RCU (see\n__bpf_prog_put_noref()). This leads to UAF of the bpf_prog because a normal\nRCU grace period does not imply a tasks-trace-RCU grace period.\n\nFix it by explicitly waiting for a tasks-trace-RCU grace period after\nremoving the attachment of a bpf_prog to a perf_event.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -32,8 +37,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-416"
+    ],
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-27T15:15:27Z"
@@ -42,7 +42,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-74"
+      "CWE-74",
+      "CWE-89"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-24m8-vx7p-q7mf",
-  "modified": "2025-01-06T06:30:46Z",
+  "modified": "2025-01-06T15:30:59Z",
  "published": "2025-01-06T06:30:45Z",
  "aliases": [
    "CVE-2024-12302"
  ],
  "details": "The Icegram Engage  WordPress plugin before 3.1.32 does not sanitise and escape some of its Campaign settings, which could allow authors and above to perform Stored Cross-Site Scripting attacks",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -21,7 +26,7 @@
  ],
  "database_specific": {
    "cwe_ids": [],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-06T06:15:06Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2h9f-xm25-q379",
-  "modified": "2025-01-06T06:30:45Z",
+  "modified": "2025-01-06T15:30:59Z",
  "published": "2025-01-06T06:30:45Z",
  "aliases": [
    "CVE-2024-20153"
  ],
  "details": "In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08990446 / ALPS09057442; Issue ID: MSV-1598.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -23,7 +28,7 @@
    "cwe_ids": [
      "CWE-304"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-06T04:15:07Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-52qc-q82v-p8hj",
-  "modified": "2025-01-04T03:33:08Z",
+  "modified": "2025-01-06T15:30:59Z",
  "published": "2025-01-04T03:33:08Z",
  "aliases": [
    "CVE-2025-22388"
  ],
  "details": "An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting (XSS) vulnerability exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising user data, escalating privileges, or executing unauthorized actions. The issue exists in multiple areas, including content editing, link management, and file uploads.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -23,7 +28,7 @@
    "cwe_ids": [
      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-04T02:15:07Z"
--- a/Show More
+++ b/Show More