From bc26396cc0c9bf4781fe881844c832e013260a4a Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 19 Dec 2024 09:32:16 +0000 Subject: [PATCH] Publish Advisories GHSA-6m28-8h39-8g6h GHSA-73w7-h363-3xgf GHSA-85g9-m9j2-hcx2 GHSA-87qx-mgq2-gx6h GHSA-8vr7-33jp-gfgw GHSA-mx92-m8m9-32fq --- .../GHSA-6m28-8h39-8g6h.json | 40 +++++++++++++++++++ .../GHSA-73w7-h363-3xgf.json | 40 +++++++++++++++++++ .../GHSA-85g9-m9j2-hcx2.json | 36 +++++++++++++++++ .../GHSA-87qx-mgq2-gx6h.json | 40 +++++++++++++++++++ .../GHSA-8vr7-33jp-gfgw.json | 36 +++++++++++++++++ .../GHSA-mx92-m8m9-32fq.json | 36 +++++++++++++++++ 6 files changed, 228 insertions(+) create mode 100644 advisories/unreviewed/2024/12/GHSA-6m28-8h39-8g6h/GHSA-6m28-8h39-8g6h.json create mode 100644 advisories/unreviewed/2024/12/GHSA-73w7-h363-3xgf/GHSA-73w7-h363-3xgf.json create mode 100644 advisories/unreviewed/2024/12/GHSA-85g9-m9j2-hcx2/GHSA-85g9-m9j2-hcx2.json create mode 100644 advisories/unreviewed/2024/12/GHSA-87qx-mgq2-gx6h/GHSA-87qx-mgq2-gx6h.json create mode 100644 advisories/unreviewed/2024/12/GHSA-8vr7-33jp-gfgw/GHSA-8vr7-33jp-gfgw.json create mode 100644 advisories/unreviewed/2024/12/GHSA-mx92-m8m9-32fq/GHSA-mx92-m8m9-32fq.json diff --git a/advisories/unreviewed/2024/12/GHSA-6m28-8h39-8g6h/GHSA-6m28-8h39-8g6h.json b/advisories/unreviewed/2024/12/GHSA-6m28-8h39-8g6h/GHSA-6m28-8h39-8g6h.json new file mode 100644 index 00000000000..497dd7dc9e9 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-6m28-8h39-8g6h/GHSA-6m28-8h39-8g6h.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6m28-8h39-8g6h", + "modified": "2024-12-19T09:30:47Z", + "published": "2024-12-19T09:30:47Z", + "aliases": [ + "CVE-2024-4230" + ], + "details": "External Control of File Name or Path vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versions 1.00 and later allows a malicious local attacker to execute an arbitrary malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4230" + }, + { + "type": "WEB", + "url": "https://jvn.jp/vu/JVNVU92857077/index.html" + }, + { + "type": "WEB", + "url": "https://www.edgecross.org/client_info/EDGECROSS/view/userweb/ext/en/data-download/pdf/ECD-TE10-0003-01-EN.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-73" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-19T08:17:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-73w7-h363-3xgf/GHSA-73w7-h363-3xgf.json b/advisories/unreviewed/2024/12/GHSA-73w7-h363-3xgf/GHSA-73w7-h363-3xgf.json new file mode 100644 index 00000000000..3c5636a31aa --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-73w7-h363-3xgf/GHSA-73w7-h363-3xgf.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-73w7-h363-3xgf", + "modified": "2024-12-19T09:30:47Z", + "published": "2024-12-19T09:30:47Z", + "aliases": [ + "CVE-2024-4229" + ], + "details": "Incorrect Default Permissions vulnerability in Edgecross Basic Software for Windows versions 1.00 and later and Edgecross Basic Software for Developers versions 1.00 and later allows a malicious local attacker to execute an arbitrary malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than a folder that only users with administrative privilege have permission to modify.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4229" + }, + { + "type": "WEB", + "url": "https://jvn.jp/vu/JVNVU92857077/index.html" + }, + { + "type": "WEB", + "url": "https://www.edgecross.org/client_info/EDGECROSS/view/userweb/ext/en/data-download/pdf/ECD-TE10-0003-01-EN.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-276" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-19T08:17:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-85g9-m9j2-hcx2/GHSA-85g9-m9j2-hcx2.json b/advisories/unreviewed/2024/12/GHSA-85g9-m9j2-hcx2/GHSA-85g9-m9j2-hcx2.json new file mode 100644 index 00000000000..e378696244c --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-85g9-m9j2-hcx2/GHSA-85g9-m9j2-hcx2.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-85g9-m9j2-hcx2", + "modified": "2024-12-19T09:30:47Z", + "published": "2024-12-19T09:30:47Z", + "aliases": [ + "CVE-2024-12569" + ], + "details": "Disclosure of sensitive information in HikVision camera driver's log file in XProtect Device Pack allows an attacker to read camera credentials stored in the Recording Server under specific conditions.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12569" + }, + { + "type": "WEB", + "url": "https://supportcommunity.milestonesys.com/KBRedir?art=000067740&lang=en_US" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-19T09:16:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-87qx-mgq2-gx6h/GHSA-87qx-mgq2-gx6h.json b/advisories/unreviewed/2024/12/GHSA-87qx-mgq2-gx6h/GHSA-87qx-mgq2-gx6h.json new file mode 100644 index 00000000000..502d5058c3d --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-87qx-mgq2-gx6h/GHSA-87qx-mgq2-gx6h.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-87qx-mgq2-gx6h", + "modified": "2024-12-19T09:30:47Z", + "published": "2024-12-19T09:30:47Z", + "aliases": [ + "CVE-2024-12560" + ], + "details": "The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.5 via the 'btn_block_duplicate_post' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract potentially sensitive data from draft, scheduled (future), private, and password protected posts.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12560" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3208482/button-block" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac55e988-2b41-459b-9ab1-e5f9fdca203f?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-19T07:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-8vr7-33jp-gfgw/GHSA-8vr7-33jp-gfgw.json b/advisories/unreviewed/2024/12/GHSA-8vr7-33jp-gfgw/GHSA-8vr7-33jp-gfgw.json new file mode 100644 index 00000000000..b795fb52010 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-8vr7-33jp-gfgw/GHSA-8vr7-33jp-gfgw.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8vr7-33jp-gfgw", + "modified": "2024-12-19T09:30:47Z", + "published": "2024-12-19T09:30:47Z", + "aliases": [ + "CVE-2020-12819" + ], + "details": "A heap-based buffer overflow vulnerability in the processing of Link Control Protocol messages in FortiGate versions 5.6.12, 6.0.10, 6.2.4 and 6.4.1 and earlier may allow a remote attacker with valid SSL VPN credentials to crash the SSL VPN daemon by sending a large LCP packet, when tunnel mode is enabled. Arbitrary code execution may be theoretically possible, albeit practically very difficult to achieve in this context", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12819" + }, + { + "type": "WEB", + "url": "https://fortiguard.com/advisory/FG-IR-20-082" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-122" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-19T08:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-mx92-m8m9-32fq/GHSA-mx92-m8m9-32fq.json b/advisories/unreviewed/2024/12/GHSA-mx92-m8m9-32fq/GHSA-mx92-m8m9-32fq.json new file mode 100644 index 00000000000..2c2fab7a8ed --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-mx92-m8m9-32fq/GHSA-mx92-m8m9-32fq.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mx92-m8m9-32fq", + "modified": "2024-12-19T09:30:47Z", + "published": "2024-12-19T09:30:47Z", + "aliases": [ + "CVE-2021-26093" + ], + "details": "An access of uninitialized pointer (CWE-824) vulnerability in FortiWLC versions 8.6.0, 8.5.3 and earlier may allow a local and authenticated attacker to crash the access point being managed by the controller by executing a crafted CLI command.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26093" + }, + { + "type": "WEB", + "url": "https://fortiguard.com/psirt/FG-IR-21-002" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-824" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-19T08:15:14Z" + } +} \ No newline at end of file