Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-08-27 15:34:09 +00:00
parent df18b6df00
commit baf927d89d
71 changed files with 632 additions and 147 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-g488-m495-9mgj",
-  "modified": "2024-02-08T18:30:38Z",
+  "modified": "2024-08-27T15:32:42Z",
  "published": "2023-10-03T03:31:24Z",
  "aliases": [
    "CVE-2023-5345"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-xgr2-4f4q-m3p9",
-  "modified": "2023-11-14T15:30:24Z",
+  "modified": "2024-08-27T15:32:42Z",
  "published": "2023-11-14T15:30:24Z",
  "aliases": [
    "CVE-2023-6111"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-q94c-x56g-qr59",
-  "modified": "2024-01-15T21:30:24Z",
+  "modified": "2024-08-27T15:32:42Z",
  "published": "2024-01-15T21:30:24Z",
  "aliases": [
    "CVE-2024-0562"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2942-jp7w-55rc",
-  "modified": "2024-03-15T09:30:37Z",
+  "modified": "2024-08-27T15:32:42Z",
  "published": "2024-03-15T09:30:37Z",
  "aliases": [
    "CVE-2024-27756"
  ],
  "details": "An issue in GLPI v.10.0.12 and before allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the title field.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-94"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-15T07:15:09Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-fq86-8676-6j38",
-  "modified": "2024-03-19T18:32:00Z",
+  "modified": "2024-08-27T15:32:42Z",
  "published": "2024-03-19T18:32:00Z",
  "aliases": [
    "CVE-2023-42920"
  ],
  "details": "Claris International has fixed a dylib hijacking vulnerability in the FileMaker Pro.app and Claris Pro.app versions on macOS.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-19T17:15:08Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-mfrg-mc7h-8xrw",
-  "modified": "2024-03-18T00:30:44Z",
+  "modified": "2024-08-27T15:32:42Z",
  "published": "2024-03-18T00:30:44Z",
  "aliases": [
    "CVE-2024-23139"
  ],
  "details": "An Out-Of-Bounds Write Vulnerability in Autodesk FBX Review version 1.5.3.0 and prior may lead to code execution or information disclosure through maliciously crafted ActionScript Byte Code “ABC” files. ABC files are created by the Flash compiler and contain executable code. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.\n",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [
      "CWE-787"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-18T00:15:07Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-f636-m6gc-99ch",
-  "modified": "2024-04-03T18:30:43Z",
+  "modified": "2024-08-27T15:32:42Z",
  "published": "2024-04-03T18:30:43Z",
  "aliases": [
    "CVE-2024-27674"
  ],
  "details": "Macro Expert through 4.9.4 allows BUILTIN\\Users:(OI)(CI)(M) access to the \"%PROGRAMFILES(X86)%\\GrassSoft\\Macro Expert\" folder and thus an unprivileged user can escalate to SYSTEM by replacing the MacroService.exe binary.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-277"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-03T17:15:55Z"
@@ -40,7 +40,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-121"
+      "CWE-121",
+      "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -28,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-22",
      "CWE-73"
    ],
    "severity": "HIGH",
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7hm7-x364-qr2m",
-  "modified": "2024-07-30T09:31:51Z",
+  "modified": "2024-08-27T15:32:42Z",
  "published": "2024-07-30T09:31:51Z",
  "aliases": [
    "CVE-2024-42104"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: add missing check for inode numbers on directory entries\n\nSyzbot reported that mounting and unmounting a specific pattern of\ncorrupted nilfs2 filesystem images causes a use-after-free of metadata\nfile inodes, which triggers a kernel bug in lru_add_fn().\n\nAs Jan Kara pointed out, this is because the link count of a metadata file\ngets corrupted to 0, and nilfs_evict_inode(), which is called from iput(),\ntries to delete that inode (ifile inode in this case).\n\nThe inconsistency occurs because directories containing the inode numbers\nof these metadata files that should not be visible in the namespace are\nread without checking.\n\nFix this issue by treating the inode numbers of these internal files as\nerrors in the sanity check helper when reading directory folios/pages.\n\nAlso thanks to Hillf Danton and Matthew Wilcox for their initial mm-layer\nanalysis.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -53,9 +56,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-416"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-30T08:15:02Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-994f-f72h-4mcv",
-  "modified": "2024-07-30T09:31:51Z",
+  "modified": "2024-08-27T15:32:42Z",
  "published": "2024-07-30T09:31:51Z",
  "aliases": [
    "CVE-2024-42109"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unconditionally flush pending work before notifier\n\nsyzbot reports:\n\nKASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831\nKASAN: slab-uaf in nft_commit_release net/netfilter/nf_tables_api.c:9530\nKASAN: slab-uaf int nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\nRead of size 2 at addr ffff88802b0051c4 by task kworker/1:1/45\n[..]\nWorkqueue: events nf_tables_trans_destroy_work\nCall Trace:\n nft_ctx_update include/net/netfilter/nf_tables.h:1831 [inline]\n nft_commit_release net/netfilter/nf_tables_api.c:9530 [inline]\n nf_tables_trans_destroy_work+0x152b/0x1750 net/netfilter/nf_tables_api.c:9597\n\nProblem is that the notifier does a conditional flush, but its possible\nthat the table-to-be-removed is still referenced by transactions being\nprocessed by the worker, so we need to flush unconditionally.\n\nWe could make the flush_work depend on whether we found a table to delete\nin nf-next to avoid the flush for most cases.\n\nAFAICS this problem is only exposed in nf-next, with\ncommit e169285f8c56 (\"netfilter: nf_tables: do not store nft_ctx in transaction objects\"),\nwith this commit applied there is an unconditional fetch of\ntable->family which is whats triggering the above splat.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -43,7 +46,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-30T08:15:03Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-mwj6-494m-mx84",
-  "modified": "2024-07-29T18:30:43Z",
+  "modified": "2024-08-27T15:32:42Z",
  "published": "2024-07-29T18:30:43Z",
  "aliases": [
    "CVE-2024-42094"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: Avoid explicit cpumask var allocation on stack\n\nFor CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask\nvariable on stack is not recommended since it can cause potential stack\noverflow.\n\nInstead, kernel code should always use *cpumask_var API(s) to allocate\ncpumask var in config-neutral way, leaving allocation strategy to\nCONFIG_CPUMASK_OFFSTACK.\n\nUse *cpumask_var API(s) to address it.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -53,9 +56,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-787"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-29T18:15:11Z"
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2q4w-x8h2-2fvh",
+  "modified": "2024-08-27T15:32:49Z",
+  "published": "2024-08-27T15:32:49Z",
+  "aliases": [
+    "CVE-2024-8181"
+  ],
+  "details": "An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an administrator and allow them to access restricted functionality.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8181"
+    },
+    {
+      "type": "WEB",
+      "url": "https://tenable.com/security/research/tra-2024-22-0"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-08-27T13:15:06Z"
+  }
+}
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-787"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-338f-rfqj-8jxw",
-  "modified": "2024-08-23T15:30:34Z",
+  "modified": "2024-08-27T15:32:43Z",
  "published": "2024-08-23T15:30:34Z",
  "aliases": [
    "CVE-2024-36516"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3cj6-45x3-vrjj",
-  "modified": "2024-08-23T15:30:34Z",
+  "modified": "2024-08-27T15:32:43Z",
  "published": "2024-08-23T15:30:34Z",
  "aliases": [
    "CVE-2024-5466"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3g58-rjqp-pmgh",
-  "modified": "2024-08-26T18:33:34Z",
+  "modified": "2024-08-27T15:32:46Z",
  "published": "2024-08-26T18:33:34Z",
  "aliases": [
    "CVE-2024-45265"
  ],
  "details": "A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to execute arbitrary SQL commands via the psid parameter.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-26T18:15:07Z"
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-48x4-mx8f-gr4h",
+  "modified": "2024-08-27T15:32:51Z",
+  "published": "2024-08-27T15:32:51Z",
+  "aliases": [
+    "CVE-2024-8182"
+  ],
+  "details": "An Unauthenticated Denial of Service (DoS) vulnerability exists in Flowise version 1.8.2 leading to a complete crash of the instance running a vulnerable version due to improper handling of user supplied input to the “/api/v1/get-upload-file” api endpoint.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8182"
+    },
+    {
+      "type": "WEB",
+      "url": "https://tenable.com/security/research/tra-2024-34"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-400"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-08-27T13:15:07Z"
+  }
+}
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-119"
+      "CWE-119",
+      "CWE-125"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
--- a/Show More
+++ b/Show More