From b822d8069a083d8100d036f942cd6ed744dd6edb Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 25 Mar 2024 15:31:09 +0000 Subject: [PATCH] Publish Advisories GHSA-6r3p-fcvm-xh7c GHSA-275x-9ffh-fhq2 GHSA-27fr-v43j-r34m GHSA-2r3w-v93h-m6vw GHSA-53g5-chm2-f34r GHSA-6cqh-4xr5-c65x GHSA-8ppr-www8-hfjx GHSA-8r8f-v2fj-h7cp GHSA-9ghw-mv5v-jx7g GHSA-cjhg-7x4h-7j52 GHSA-h638-qfh6-65v5 GHSA-rmxq-q4j3-rg8f GHSA-vvgj-qh7x-pf9r GHSA-vxx9-qwhq-hgf4 GHSA-x7hp-f23m-66mj --- .../GHSA-6r3p-fcvm-xh7c.json | 6 ++- .../GHSA-275x-9ffh-fhq2.json | 39 ++++++++++++++ .../GHSA-27fr-v43j-r34m.json | 39 ++++++++++++++ .../GHSA-2r3w-v93h-m6vw.json | 38 ++++++++++++++ .../GHSA-53g5-chm2-f34r.json | 39 ++++++++++++++ .../GHSA-6cqh-4xr5-c65x.json | 39 ++++++++++++++ .../GHSA-8ppr-www8-hfjx.json | 39 ++++++++++++++ .../GHSA-8r8f-v2fj-h7cp.json | 43 ++++++++++++++++ .../GHSA-9ghw-mv5v-jx7g.json | 39 ++++++++++++++ .../GHSA-cjhg-7x4h-7j52.json | 51 +++++++++++++++++++ .../GHSA-h638-qfh6-65v5.json | 38 ++++++++++++++ .../GHSA-rmxq-q4j3-rg8f.json | 39 ++++++++++++++ .../GHSA-vvgj-qh7x-pf9r.json | 6 ++- .../GHSA-vxx9-qwhq-hgf4.json | 43 ++++++++++++++++ .../GHSA-x7hp-f23m-66mj.json | 39 ++++++++++++++ 15 files changed, 535 insertions(+), 2 deletions(-) create mode 100644 advisories/unreviewed/2024/03/GHSA-275x-9ffh-fhq2/GHSA-275x-9ffh-fhq2.json create mode 100644 advisories/unreviewed/2024/03/GHSA-27fr-v43j-r34m/GHSA-27fr-v43j-r34m.json create mode 100644 advisories/unreviewed/2024/03/GHSA-2r3w-v93h-m6vw/GHSA-2r3w-v93h-m6vw.json create mode 100644 advisories/unreviewed/2024/03/GHSA-53g5-chm2-f34r/GHSA-53g5-chm2-f34r.json create mode 100644 advisories/unreviewed/2024/03/GHSA-6cqh-4xr5-c65x/GHSA-6cqh-4xr5-c65x.json create mode 100644 advisories/unreviewed/2024/03/GHSA-8ppr-www8-hfjx/GHSA-8ppr-www8-hfjx.json create mode 100644 advisories/unreviewed/2024/03/GHSA-8r8f-v2fj-h7cp/GHSA-8r8f-v2fj-h7cp.json create mode 100644 advisories/unreviewed/2024/03/GHSA-9ghw-mv5v-jx7g/GHSA-9ghw-mv5v-jx7g.json create mode 100644 advisories/unreviewed/2024/03/GHSA-cjhg-7x4h-7j52/GHSA-cjhg-7x4h-7j52.json create mode 100644 advisories/unreviewed/2024/03/GHSA-h638-qfh6-65v5/GHSA-h638-qfh6-65v5.json create mode 100644 advisories/unreviewed/2024/03/GHSA-rmxq-q4j3-rg8f/GHSA-rmxq-q4j3-rg8f.json create mode 100644 advisories/unreviewed/2024/03/GHSA-vxx9-qwhq-hgf4/GHSA-vxx9-qwhq-hgf4.json create mode 100644 advisories/unreviewed/2024/03/GHSA-x7hp-f23m-66mj/GHSA-x7hp-f23m-66mj.json diff --git a/advisories/github-reviewed/2020/12/GHSA-6r3p-fcvm-xh7c/GHSA-6r3p-fcvm-xh7c.json b/advisories/github-reviewed/2020/12/GHSA-6r3p-fcvm-xh7c/GHSA-6r3p-fcvm-xh7c.json index b1157ceeaa1..598bd8644a4 100644 --- a/advisories/github-reviewed/2020/12/GHSA-6r3p-fcvm-xh7c/GHSA-6r3p-fcvm-xh7c.json +++ b/advisories/github-reviewed/2020/12/GHSA-6r3p-fcvm-xh7c/GHSA-6r3p-fcvm-xh7c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6r3p-fcvm-xh7c", - "modified": "2023-08-30T21:02:31Z", + "modified": "2024-03-25T15:29:46Z", "published": "2020-12-17T21:00:58Z", "aliases": [ "CVE-2020-17513" @@ -40,6 +40,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-17513" }, + { + "type": "WEB", + "url": "https://github.com/apache/airflow/commit/b606b871226d649913a37fd074eeae5d86ebc3a1" + }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rb3647269f07cc2775ca6568cbfd4994d862c842a58120d2aba9c658a%40%3Cusers.airflow.apache.org%3E" diff --git a/advisories/unreviewed/2024/03/GHSA-275x-9ffh-fhq2/GHSA-275x-9ffh-fhq2.json b/advisories/unreviewed/2024/03/GHSA-275x-9ffh-fhq2/GHSA-275x-9ffh-fhq2.json new file mode 100644 index 00000000000..b8a2c8f6054 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-275x-9ffh-fhq2/GHSA-275x-9ffh-fhq2.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-275x-9ffh-fhq2", + "modified": "2024-03-25T15:30:39Z", + "published": "2024-03-25T15:30:39Z", + "aliases": [ + "CVE-2024-28393" + ], + "details": "SQL injection vulnerability in scalapay v.1.2.41 and before allows a remote attacker to escalate privileges via the ScalapayReturnModuleFrontController::postProcess() method.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28393" + }, + { + "type": "WEB", + "url": "https://addons.prestashop.com/fr/paiement-en-plusieurs-fois/87023-scalapay-payez-en-3-fois-sans-frais.html" + }, + { + "type": "WEB", + "url": "https://security.friendsofpresta.org/modules/2024/03/19/scalapay.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-25T14:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-27fr-v43j-r34m/GHSA-27fr-v43j-r34m.json b/advisories/unreviewed/2024/03/GHSA-27fr-v43j-r34m/GHSA-27fr-v43j-r34m.json new file mode 100644 index 00000000000..aac67e5d711 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-27fr-v43j-r34m/GHSA-27fr-v43j-r34m.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-27fr-v43j-r34m", + "modified": "2024-03-25T15:30:43Z", + "published": "2024-03-25T15:30:43Z", + "aliases": [ + "CVE-2024-30204" + ], + "details": "In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30204" + }, + { + "type": "WEB", + "url": "https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=6f9ea396f49cbe38c2173e0a72ba6af3e03b271c" + }, + { + "type": "WEB", + "url": "https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-25T15:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-2r3w-v93h-m6vw/GHSA-2r3w-v93h-m6vw.json b/advisories/unreviewed/2024/03/GHSA-2r3w-v93h-m6vw/GHSA-2r3w-v93h-m6vw.json new file mode 100644 index 00000000000..8dbea25a7d4 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-2r3w-v93h-m6vw/GHSA-2r3w-v93h-m6vw.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2r3w-v93h-m6vw", + "modified": "2024-03-25T15:30:39Z", + "published": "2024-03-25T15:30:38Z", + "aliases": [ + "CVE-2024-25002" + ], + "details": "Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25002" + }, + { + "type": "WEB", + "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-152190.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-25T14:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-53g5-chm2-f34r/GHSA-53g5-chm2-f34r.json b/advisories/unreviewed/2024/03/GHSA-53g5-chm2-f34r/GHSA-53g5-chm2-f34r.json new file mode 100644 index 00000000000..d0df6548457 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-53g5-chm2-f34r/GHSA-53g5-chm2-f34r.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-53g5-chm2-f34r", + "modified": "2024-03-25T15:30:39Z", + "published": "2024-03-25T15:30:39Z", + "aliases": [ + "CVE-2024-28387" + ], + "details": "An issue in axonaut v.3.1.23 and before allows a remote attacker to obtain sensitive information via the log.txt component.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28387" + }, + { + "type": "WEB", + "url": "https://axonaut.com/integration/detail/prestashop" + }, + { + "type": "WEB", + "url": "https://security.friendsofpresta.org/modules/2024/03/19/axonaut.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-25T14:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-6cqh-4xr5-c65x/GHSA-6cqh-4xr5-c65x.json b/advisories/unreviewed/2024/03/GHSA-6cqh-4xr5-c65x/GHSA-6cqh-4xr5-c65x.json new file mode 100644 index 00000000000..9204253f043 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-6cqh-4xr5-c65x/GHSA-6cqh-4xr5-c65x.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6cqh-4xr5-c65x", + "modified": "2024-03-25T15:30:40Z", + "published": "2024-03-25T15:30:40Z", + "aliases": [ + "CVE-2024-28435" + ], + "details": "The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28435" + }, + { + "type": "WEB", + "url": "https://github.com/b-hermes/vulnerability-research/tree/main/CVE-2024-28435" + }, + { + "type": "WEB", + "url": "https://github.com/twentyhq/twenty" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-25T14:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-8ppr-www8-hfjx/GHSA-8ppr-www8-hfjx.json b/advisories/unreviewed/2024/03/GHSA-8ppr-www8-hfjx/GHSA-8ppr-www8-hfjx.json new file mode 100644 index 00000000000..ae33bfbce72 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-8ppr-www8-hfjx/GHSA-8ppr-www8-hfjx.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8ppr-www8-hfjx", + "modified": "2024-03-25T15:30:41Z", + "published": "2024-03-25T15:30:41Z", + "aliases": [ + "CVE-2024-29650" + ], + "details": "An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29650" + }, + { + "type": "WEB", + "url": "https://gist.github.com/tariqhawis/1bc340ca5ea6ae115c9ab9665cfd5921" + }, + { + "type": "WEB", + "url": "https://learn.snyk.io/lesson/prototype-pollution/#a0a863a5-fd3a-539f-e1ed-a0769f6c6e3b" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-25T15:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-8r8f-v2fj-h7cp/GHSA-8r8f-v2fj-h7cp.json b/advisories/unreviewed/2024/03/GHSA-8r8f-v2fj-h7cp/GHSA-8r8f-v2fj-h7cp.json new file mode 100644 index 00000000000..8ad858d8baa --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-8r8f-v2fj-h7cp/GHSA-8r8f-v2fj-h7cp.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8r8f-v2fj-h7cp", + "modified": "2024-03-25T15:30:41Z", + "published": "2024-03-25T15:30:41Z", + "aliases": [ + "CVE-2024-30202" + ], + "details": "In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30202" + }, + { + "type": "WEB", + "url": "https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=befa9fcaae29a6c9a283ba371c3c5234c7f644eb" + }, + { + "type": "WEB", + "url": "https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29" + }, + { + "type": "WEB", + "url": "https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=003ddacf1c8d869b1858181c29ea21b731a8d8d9" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-25T15:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-9ghw-mv5v-jx7g/GHSA-9ghw-mv5v-jx7g.json b/advisories/unreviewed/2024/03/GHSA-9ghw-mv5v-jx7g/GHSA-9ghw-mv5v-jx7g.json new file mode 100644 index 00000000000..a6887e5a3b8 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-9ghw-mv5v-jx7g/GHSA-9ghw-mv5v-jx7g.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9ghw-mv5v-jx7g", + "modified": "2024-03-25T15:30:40Z", + "published": "2024-03-25T15:30:40Z", + "aliases": [ + "CVE-2024-25175" + ], + "details": "An issue in Kickdler before v1.107.0 allows attackers to provide an XSS payload via a HTTP response splitting attack.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25175" + }, + { + "type": "WEB", + "url": "https://github.com/jet-pentest/CVE-2024-25175" + }, + { + "type": "WEB", + "url": "https://www.kickidler.com" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-25T15:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-cjhg-7x4h-7j52/GHSA-cjhg-7x4h-7j52.json b/advisories/unreviewed/2024/03/GHSA-cjhg-7x4h-7j52/GHSA-cjhg-7x4h-7j52.json new file mode 100644 index 00000000000..2b2952726b7 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-cjhg-7x4h-7j52/GHSA-cjhg-7x4h-7j52.json @@ -0,0 +1,51 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cjhg-7x4h-7j52", + "modified": "2024-03-25T15:30:39Z", + "published": "2024-03-25T15:30:39Z", + "aliases": [ + "CVE-2024-28386" + ], + "details": "An issue in Home-Made.io fastmagsync v.1.7.51 and before allows a remote attacker to execute arbitrary code via the getPhpBin() component.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28386" + }, + { + "type": "WEB", + "url": "https://reference1.example.com/modules/fastmagsync/crons/cron_mutualise_job_queue.php?hosting=.%20%26%20%20echo%20%27%3C%3Fphp%20echo%20%2242ovh%22%3B%27%20%3E%20a.php%3B%23&syncway=tofastmag" + }, + { + "type": "WEB", + "url": "https://security.friendsofpresta.org/modules/2024/03/19/fastmagsync.html" + }, + { + "type": "WEB", + "url": "https://www.home-made.io/module-fastmag-sync-prestashop" + }, + { + "type": "WEB", + "url": "http://fastmagsync.com" + }, + { + "type": "WEB", + "url": "http://home-madeio.com" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-25T14:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-h638-qfh6-65v5/GHSA-h638-qfh6-65v5.json b/advisories/unreviewed/2024/03/GHSA-h638-qfh6-65v5/GHSA-h638-qfh6-65v5.json new file mode 100644 index 00000000000..090766bd1ea --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-h638-qfh6-65v5/GHSA-h638-qfh6-65v5.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h638-qfh6-65v5", + "modified": "2024-03-25T15:30:40Z", + "published": "2024-03-25T15:30:40Z", + "aliases": [ + "CVE-2024-2865" + ], + "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mergen Software Quality Management System allows SQL Injection.This issue affects Quality Management System: through 25032024.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2865" + }, + { + "type": "WEB", + "url": "https://www.usom.gov.tr/bildirim/tr-24-0229" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-25T14:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-rmxq-q4j3-rg8f/GHSA-rmxq-q4j3-rg8f.json b/advisories/unreviewed/2024/03/GHSA-rmxq-q4j3-rg8f/GHSA-rmxq-q4j3-rg8f.json new file mode 100644 index 00000000000..1d866a8f75e --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-rmxq-q4j3-rg8f/GHSA-rmxq-q4j3-rg8f.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rmxq-q4j3-rg8f", + "modified": "2024-03-25T15:30:42Z", + "published": "2024-03-25T15:30:42Z", + "aliases": [ + "CVE-2024-30203" + ], + "details": "In Emacs before 29.3, Gnus treats inline MIME contents as trusted.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30203" + }, + { + "type": "WEB", + "url": "https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=937b9042ad7426acdcca33e3d931d8f495bdd804" + }, + { + "type": "WEB", + "url": "https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-25T15:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-vvgj-qh7x-pf9r/GHSA-vvgj-qh7x-pf9r.json b/advisories/unreviewed/2024/03/GHSA-vvgj-qh7x-pf9r/GHSA-vvgj-qh7x-pf9r.json index 0a7a051f014..c3456951ad5 100644 --- a/advisories/unreviewed/2024/03/GHSA-vvgj-qh7x-pf9r/GHSA-vvgj-qh7x-pf9r.json +++ b/advisories/unreviewed/2024/03/GHSA-vvgj-qh7x-pf9r/GHSA-vvgj-qh7x-pf9r.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vvgj-qh7x-pf9r", - "modified": "2024-03-24T09:31:04Z", + "modified": "2024-03-25T15:30:38Z", "published": "2024-03-24T09:31:04Z", "aliases": [ "CVE-2024-2856" @@ -32,6 +32,10 @@ { "type": "WEB", "url": "https://vuldb.com/?id.257780" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.299741" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/03/GHSA-vxx9-qwhq-hgf4/GHSA-vxx9-qwhq-hgf4.json b/advisories/unreviewed/2024/03/GHSA-vxx9-qwhq-hgf4/GHSA-vxx9-qwhq-hgf4.json new file mode 100644 index 00000000000..3b9885a038b --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-vxx9-qwhq-hgf4/GHSA-vxx9-qwhq-hgf4.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vxx9-qwhq-hgf4", + "modified": "2024-03-25T15:30:43Z", + "published": "2024-03-25T15:30:43Z", + "aliases": [ + "CVE-2024-30205" + ], + "details": "In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30205" + }, + { + "type": "WEB", + "url": "https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=2bc865ace050ff118db43f01457f95f95112b877" + }, + { + "type": "WEB", + "url": "https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29" + }, + { + "type": "WEB", + "url": "https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=4255d5dcc0657915f90e4fba7e0a5514cced514d" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-25T15:15:52Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-x7hp-f23m-66mj/GHSA-x7hp-f23m-66mj.json b/advisories/unreviewed/2024/03/GHSA-x7hp-f23m-66mj/GHSA-x7hp-f23m-66mj.json new file mode 100644 index 00000000000..a59638778dd --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-x7hp-f23m-66mj/GHSA-x7hp-f23m-66mj.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x7hp-f23m-66mj", + "modified": "2024-03-25T15:30:39Z", + "published": "2024-03-25T15:30:39Z", + "aliases": [ + "CVE-2024-28434" + ], + "details": "The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0. A crafted svg file can trigger the execution of the javascript code.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28434" + }, + { + "type": "WEB", + "url": "https://github.com/b-hermes/vulnerability-research/tree/main/CVE-2024-28434" + }, + { + "type": "WEB", + "url": "https://github.com/twentyhq/twenty" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-25T14:15:09Z" + } +} \ No newline at end of file