diff --git a/advisories/unreviewed/2024/02/GHSA-2prc-4f47-p38v/GHSA-2prc-4f47-p38v.json b/advisories/unreviewed/2024/02/GHSA-2prc-4f47-p38v/GHSA-2prc-4f47-p38v.json index ed88afd2d39..7a7a92e1fe9 100644 --- a/advisories/unreviewed/2024/02/GHSA-2prc-4f47-p38v/GHSA-2prc-4f47-p38v.json +++ b/advisories/unreviewed/2024/02/GHSA-2prc-4f47-p38v/GHSA-2prc-4f47-p38v.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-2prc-4f47-p38v", - "modified": "2024-02-27T21:31:27Z", + "modified": "2024-12-06T18:30:44Z", "published": "2024-02-27T21:31:27Z", "aliases": [ "CVE-2021-46967" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-vdpa: fix vm_flags for virtqueue doorbell mapping\n\nThe virtqueue doorbell is usually implemented via registeres but we\ndon't provide the necessary vma->flags like VM_PFNMAP. This may cause\nseveral issues e.g when userspace tries to map the doorbell via vhost\nIOTLB, kernel may panic due to the page is not backed by page\nstructure. This patch fixes this by setting the necessary\nvm_flags. With this patch, try to map doorbell via IOTLB will fail\nwith bad address.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -33,7 +38,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-27T19:04:07Z" diff --git a/advisories/unreviewed/2024/02/GHSA-32cf-6454-vhqx/GHSA-32cf-6454-vhqx.json b/advisories/unreviewed/2024/02/GHSA-32cf-6454-vhqx/GHSA-32cf-6454-vhqx.json index bfa4a0980c0..57da639f6f0 100644 --- a/advisories/unreviewed/2024/02/GHSA-32cf-6454-vhqx/GHSA-32cf-6454-vhqx.json +++ b/advisories/unreviewed/2024/02/GHSA-32cf-6454-vhqx/GHSA-32cf-6454-vhqx.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-32cf-6454-vhqx", - "modified": "2024-02-28T09:30:36Z", + "modified": "2024-12-06T18:30:44Z", "published": "2024-02-28T09:30:36Z", "aliases": [ "CVE-2020-36786" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: [next] staging: media: atomisp: fix memory leak of object flash\n\nIn the case where the call to lm3554_platform_data_func returns an\nerror there is a memory leak on the error return path of object\nflash. Fix this by adding an error return path that will free\nflash and rename labels fail2 to fail3 and fail1 to fail2.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -32,8 +37,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-401" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-28T09:15:36Z" diff --git a/advisories/unreviewed/2024/02/GHSA-6mwq-mrw3-3m6c/GHSA-6mwq-mrw3-3m6c.json b/advisories/unreviewed/2024/02/GHSA-6mwq-mrw3-3m6c/GHSA-6mwq-mrw3-3m6c.json index ebffe7154c8..79590efee44 100644 --- a/advisories/unreviewed/2024/02/GHSA-6mwq-mrw3-3m6c/GHSA-6mwq-mrw3-3m6c.json +++ b/advisories/unreviewed/2024/02/GHSA-6mwq-mrw3-3m6c/GHSA-6mwq-mrw3-3m6c.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-6mwq-mrw3-3m6c", - "modified": "2024-02-27T21:31:27Z", + "modified": "2024-12-06T18:30:44Z", "published": "2024-02-27T21:31:27Z", "aliases": [ "CVE-2021-46955" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: fix stack OOB read while fragmenting IPv4 packets\n\nrunning openvswitch on kernels built with KASAN, it's possible to see the\nfollowing splat while testing fragmentation of IPv4 packets:\n\n BUG: KASAN: stack-out-of-bounds in ip_do_fragment+0x1b03/0x1f60\n Read of size 1 at addr ffff888112fc713c by task handler2/1367\n\n CPU: 0 PID: 1367 Comm: handler2 Not tainted 5.12.0-rc6+ #418\n Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014\n Call Trace:\n dump_stack+0x92/0xc1\n print_address_description.constprop.7+0x1a/0x150\n kasan_report.cold.13+0x7f/0x111\n ip_do_fragment+0x1b03/0x1f60\n ovs_fragment+0x5bf/0x840 [openvswitch]\n do_execute_actions+0x1bd5/0x2400 [openvswitch]\n ovs_execute_actions+0xc8/0x3d0 [openvswitch]\n ovs_packet_cmd_execute+0xa39/0x1150 [openvswitch]\n genl_family_rcv_msg_doit.isra.15+0x227/0x2d0\n genl_rcv_msg+0x287/0x490\n netlink_rcv_skb+0x120/0x380\n genl_rcv+0x24/0x40\n netlink_unicast+0x439/0x630\n netlink_sendmsg+0x719/0xbf0\n sock_sendmsg+0xe2/0x110\n ____sys_sendmsg+0x5ba/0x890\n ___sys_sendmsg+0xe9/0x160\n __sys_sendmsg+0xd3/0x170\n do_syscall_64+0x33/0x40\n entry_SYSCALL_64_after_hwframe+0x44/0xae\n RIP: 0033:0x7f957079db07\n Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 eb ec ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 24 ed ff ff 48\n RSP: 002b:00007f956ce35a50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e\n RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 00007f957079db07\n RDX: 0000000000000000 RSI: 00007f956ce35ae0 RDI: 0000000000000019\n RBP: 00007f956ce35ae0 R08: 0000000000000000 R09: 00007f9558006730\n R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\n R13: 00007f956ce37308 R14: 00007f956ce35f80 R15: 00007f956ce35ae0\n\n The buggy address belongs to the page:\n page:00000000af2a1d93 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x112fc7\n flags: 0x17ffffc0000000()\n raw: 0017ffffc0000000 0000000000000000 dead000000000122 0000000000000000\n raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000\n page dumped because: kasan: bad access detected\n\n addr ffff888112fc713c is located in stack of task handler2/1367 at offset 180 in frame:\n ovs_fragment+0x0/0x840 [openvswitch]\n\n this frame has 2 objects:\n [32, 144) 'ovs_dst'\n [192, 424) 'ovs_rt'\n\n Memory state around the buggy address:\n ffff888112fc7000: f3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff888112fc7080: 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00\n >ffff888112fc7100: 00 00 00 f2 f2 f2 f2 f2 f2 00 00 00 00 00 00 00\n ^\n ffff888112fc7180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffff888112fc7200: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00\n\nfor IPv4 packets, ovs_fragment() uses a temporary struct dst_entry. Then,\nin the following call graph:\n\n ip_do_fragment()\n ip_skb_dst_mtu()\n ip_dst_mtu_maybe_forward()\n ip_mtu_locked()\n\nthe pointer to struct dst_entry is used as pointer to struct rtable: this\nturns the access to struct members like rt_mtu_locked into an OOB read in\nthe stack. Fix this changing the temporary variable used for IPv4 packets\nin ovs_fragment(), similarly to what is done for IPv6 few lines below.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -52,8 +57,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-125" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-27T19:04:06Z" diff --git a/advisories/unreviewed/2024/02/GHSA-7r25-m49h-vw58/GHSA-7r25-m49h-vw58.json b/advisories/unreviewed/2024/02/GHSA-7r25-m49h-vw58/GHSA-7r25-m49h-vw58.json index 65a9018508c..50bda59efb0 100644 --- a/advisories/unreviewed/2024/02/GHSA-7r25-m49h-vw58/GHSA-7r25-m49h-vw58.json +++ b/advisories/unreviewed/2024/02/GHSA-7r25-m49h-vw58/GHSA-7r25-m49h-vw58.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-7r25-m49h-vw58", - "modified": "2024-02-27T21:31:27Z", + "modified": "2024-12-06T18:30:44Z", "published": "2024-02-27T21:31:27Z", "aliases": [ "CVE-2021-46956" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtiofs: fix memory leak in virtio_fs_probe()\n\nWhen accidentally passing twice the same tag to qemu, kmemleak ended up\nreporting a memory leak in virtiofs. Also, looking at the log I saw the\nfollowing error (that's when I realised the duplicated tag):\n\n virtiofs: probe of virtio5 failed with error -17\n\nHere's the kmemleak log for reference:\n\nunreferenced object 0xffff888103d47800 (size 1024):\n comm \"systemd-udevd\", pid 118, jiffies 4294893780 (age 18.340s)\n hex dump (first 32 bytes):\n 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........\n ff ff ff ff ff ff ff ff 80 90 02 a0 ff ff ff ff ................\n backtrace:\n [<000000000ebb87c1>] virtio_fs_probe+0x171/0x7ae [virtiofs]\n [<00000000f8aca419>] virtio_dev_probe+0x15f/0x210\n [<000000004d6baf3c>] really_probe+0xea/0x430\n [<00000000a6ceeac8>] device_driver_attach+0xa8/0xb0\n [<00000000196f47a7>] __driver_attach+0x98/0x140\n [<000000000b20601d>] bus_for_each_dev+0x7b/0xc0\n [<00000000399c7b7f>] bus_add_driver+0x11b/0x1f0\n [<0000000032b09ba7>] driver_register+0x8f/0xe0\n [<00000000cdd55998>] 0xffffffffa002c013\n [<000000000ea196a2>] do_one_initcall+0x64/0x2e0\n [<0000000008f727ce>] do_init_module+0x5c/0x260\n [<000000003cdedab6>] __do_sys_finit_module+0xb5/0x120\n [<00000000ad2f48c6>] do_syscall_64+0x33/0x40\n [<00000000809526b5>] entry_SYSCALL_64_after_hwframe+0x44/0xae", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -36,8 +41,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-401" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-27T19:04:06Z" diff --git a/advisories/unreviewed/2024/02/GHSA-7ww5-chp8-5mwj/GHSA-7ww5-chp8-5mwj.json b/advisories/unreviewed/2024/02/GHSA-7ww5-chp8-5mwj/GHSA-7ww5-chp8-5mwj.json index 43387b1aed5..118a3407a9b 100644 --- a/advisories/unreviewed/2024/02/GHSA-7ww5-chp8-5mwj/GHSA-7ww5-chp8-5mwj.json +++ b/advisories/unreviewed/2024/02/GHSA-7ww5-chp8-5mwj/GHSA-7ww5-chp8-5mwj.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-7ww5-chp8-5mwj", - "modified": "2024-02-28T09:30:36Z", + "modified": "2024-12-06T18:30:44Z", "published": "2024-02-28T09:30:36Z", "aliases": [ "CVE-2020-36785" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()\n\nThe \"s3a_buf\" is freed along with all the other items on the\n\"asd->s3a_stats\" list. It leads to a double free and a use after free.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -32,8 +37,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-415" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-28T09:15:36Z" diff --git a/advisories/unreviewed/2024/02/GHSA-8f8j-69c8-v223/GHSA-8f8j-69c8-v223.json b/advisories/unreviewed/2024/02/GHSA-8f8j-69c8-v223/GHSA-8f8j-69c8-v223.json index 36ee5d6c76c..1438d25a3a9 100644 --- a/advisories/unreviewed/2024/02/GHSA-8f8j-69c8-v223/GHSA-8f8j-69c8-v223.json +++ b/advisories/unreviewed/2024/02/GHSA-8f8j-69c8-v223/GHSA-8f8j-69c8-v223.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-8f8j-69c8-v223", - "modified": "2024-02-27T21:31:27Z", + "modified": "2024-12-06T18:30:44Z", "published": "2024-02-27T21:31:27Z", "aliases": [ "CVE-2021-46966" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: custom_method: fix potential use-after-free issue\n\nIn cm_write(), buf is always freed when reaching the end of the\nfunction. If the requested count is less than table.length, the\nallocated buffer will be freed but subsequent calls to cm_write() will\nstill try to access it.\n\nRemove the unconditional kfree(buf) at the end of the function and\nset the buf to NULL in the -EINVAL error path to match the rest of\nfunction.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -52,8 +57,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-27T19:04:07Z" diff --git a/advisories/unreviewed/2024/02/GHSA-8xwq-c7xw-64cv/GHSA-8xwq-c7xw-64cv.json b/advisories/unreviewed/2024/02/GHSA-8xwq-c7xw-64cv/GHSA-8xwq-c7xw-64cv.json index 2cf7848d775..a1757164eb3 100644 --- a/advisories/unreviewed/2024/02/GHSA-8xwq-c7xw-64cv/GHSA-8xwq-c7xw-64cv.json +++ b/advisories/unreviewed/2024/02/GHSA-8xwq-c7xw-64cv/GHSA-8xwq-c7xw-64cv.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-8xwq-c7xw-64cv", - "modified": "2024-02-28T09:30:36Z", + "modified": "2024-12-06T18:30:44Z", "published": "2024-02-28T09:30:36Z", "aliases": [ "CVE-2020-36779" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: stm32f7: fix reference leak when pm_runtime_get_sync fails\n\nThe PM reference count is not expected to be incremented on\nreturn in these stm32f7_i2c_xx serious functions.\n\nHowever, pm_runtime_get_sync will increment the PM reference\ncount even failed. Forgetting to putting operation will result\nin a reference leak here.\n\nReplace it with pm_runtime_resume_and_get to keep usage\ncounter balanced.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -33,7 +38,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-28T09:15:36Z" diff --git a/advisories/unreviewed/2024/02/GHSA-f66f-jmx2-2jjm/GHSA-f66f-jmx2-2jjm.json b/advisories/unreviewed/2024/02/GHSA-f66f-jmx2-2jjm/GHSA-f66f-jmx2-2jjm.json index 7b8380d54d8..ceddc5ba62b 100644 --- a/advisories/unreviewed/2024/02/GHSA-f66f-jmx2-2jjm/GHSA-f66f-jmx2-2jjm.json +++ b/advisories/unreviewed/2024/02/GHSA-f66f-jmx2-2jjm/GHSA-f66f-jmx2-2jjm.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-f66f-jmx2-2jjm", - "modified": "2024-02-28T09:30:36Z", + "modified": "2024-12-06T18:30:44Z", "published": "2024-02-28T09:30:36Z", "aliases": [ "CVE-2020-36778" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: xiic: fix reference leak when pm_runtime_get_sync fails\n\nThe PM reference count is not expected to be incremented on\nreturn in xiic_xfer and xiic_i2c_remove.\n\nHowever, pm_runtime_get_sync will increment the PM reference\ncount even failed. Forgetting to putting operation will result\nin a reference leak here.\n\nReplace it with pm_runtime_resume_and_get to keep usage\ncounter balanced.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -33,7 +38,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-28T09:15:36Z" diff --git a/advisories/unreviewed/2024/02/GHSA-fxr5-32j9-7wfr/GHSA-fxr5-32j9-7wfr.json b/advisories/unreviewed/2024/02/GHSA-fxr5-32j9-7wfr/GHSA-fxr5-32j9-7wfr.json index 93e80046aa5..867fb0bce94 100644 --- a/advisories/unreviewed/2024/02/GHSA-fxr5-32j9-7wfr/GHSA-fxr5-32j9-7wfr.json +++ b/advisories/unreviewed/2024/02/GHSA-fxr5-32j9-7wfr/GHSA-fxr5-32j9-7wfr.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-fxr5-32j9-7wfr", - "modified": "2024-02-28T09:30:37Z", + "modified": "2024-12-06T18:30:44Z", "published": "2024-02-28T09:30:36Z", "aliases": [ "CVE-2021-46983" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvmet-rdma: Fix NULL deref when SEND is completed with error\n\nWhen running some traffic and taking down the link on peer, a\nretry counter exceeded error is received. This leads to\nnvmet_rdma_error_comp which tried accessing the cq_context to\nobtain the queue. The cq_context is no longer valid after the\nfix to use shared CQ mechanism and should be obtained similar\nto how it is obtained in other functions from the wc->qp.\n\n[ 905.786331] nvmet_rdma: SEND for CQE 0x00000000e3337f90 failed with status transport retry counter exceeded (12).\n[ 905.832048] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048\n[ 905.839919] PGD 0 P4D 0\n[ 905.842464] Oops: 0000 1 SMP NOPTI\n[ 905.846144] CPU: 13 PID: 1557 Comm: kworker/13:1H Kdump: loaded Tainted: G OE --------- - - 4.18.0-304.el8.x86_64 #1\n[ 905.872135] RIP: 0010:nvmet_rdma_error_comp+0x5/0x1b [nvmet_rdma]\n[ 905.878259] Code: 19 4f c0 e8 89 b3 a5 f6 e9 5b e0 ff ff 0f b7 75 14 4c 89 ea 48 c7 c7 08 1a 4f c0 e8 71 b3 a5 f6 e9 4b e0 ff ff 0f 1f 44 00 00 <48> 8b 47 48 48 85 c0 74 08 48 89 c7 e9 98 bf 49 00 e9 c3 e3 ff ff\n[ 905.897135] RSP: 0018:ffffab601c45fe28 EFLAGS: 00010246\n[ 905.902387] RAX: 0000000000000065 RBX: ffff9e729ea2f800 RCX: 0000000000000000\n[ 905.909558] RDX: 0000000000000000 RSI: ffff9e72df9567c8 RDI: 0000000000000000\n[ 905.916731] RBP: ffff9e729ea2b400 R08: 000000000000074d R09: 0000000000000074\n[ 905.923903] R10: 0000000000000000 R11: ffffab601c45fcc0 R12: 0000000000000010\n[ 905.931074] R13: 0000000000000000 R14: 0000000000000010 R15: ffff9e729ea2f400\n[ 905.938247] FS: 0000000000000000(0000) GS:ffff9e72df940000(0000) knlGS:0000000000000000\n[ 905.938249] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 905.950067] nvmet_rdma: SEND for CQE 0x00000000c7356cca failed with status transport retry counter exceeded (12).\n[ 905.961855] CR2: 0000000000000048 CR3: 000000678d010004 CR4: 00000000007706e0\n[ 905.961855] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 905.961856] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 905.961857] PKRU: 55555554\n[ 906.010315] Call Trace:\n[ 906.012778] __ib_process_cq+0x89/0x170 [ib_core]\n[ 906.017509] ib_cq_poll_work+0x26/0x80 [ib_core]\n[ 906.022152] process_one_work+0x1a7/0x360\n[ 906.026182] ? create_worker+0x1a0/0x1a0\n[ 906.030123] worker_thread+0x30/0x390\n[ 906.033802] ? create_worker+0x1a0/0x1a0\n[ 906.037744] kthread+0x116/0x130\n[ 906.040988] ? kthread_flush_work_fn+0x10/0x10\n[ 906.045456] ret_from_fork+0x1f/0x40", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -32,8 +37,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-28T09:15:37Z" diff --git a/advisories/unreviewed/2024/02/GHSA-j6gr-4vx9-gj76/GHSA-j6gr-4vx9-gj76.json b/advisories/unreviewed/2024/02/GHSA-j6gr-4vx9-gj76/GHSA-j6gr-4vx9-gj76.json index cc09f791da0..62306e1fbf8 100644 --- a/advisories/unreviewed/2024/02/GHSA-j6gr-4vx9-gj76/GHSA-j6gr-4vx9-gj76.json +++ b/advisories/unreviewed/2024/02/GHSA-j6gr-4vx9-gj76/GHSA-j6gr-4vx9-gj76.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-j6gr-4vx9-gj76", - "modified": "2024-02-28T09:30:36Z", + "modified": "2024-12-06T18:30:44Z", "published": "2024-02-28T09:30:36Z", "aliases": [ "CVE-2020-36782" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails\n\nThe PM reference count is not expected to be incremented on\nreturn in lpi2c_imx_master_enable.\n\nHowever, pm_runtime_get_sync will increment the PM reference\ncount even failed. Forgetting to putting operation will result\nin a reference leak here.\n\nReplace it with pm_runtime_resume_and_get to keep usage\ncounter balanced.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -37,7 +42,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-28T09:15:36Z" diff --git a/advisories/unreviewed/2024/02/GHSA-jm6x-683j-pm4v/GHSA-jm6x-683j-pm4v.json b/advisories/unreviewed/2024/02/GHSA-jm6x-683j-pm4v/GHSA-jm6x-683j-pm4v.json index 4ff47f7ed79..8272168032e 100644 --- a/advisories/unreviewed/2024/02/GHSA-jm6x-683j-pm4v/GHSA-jm6x-683j-pm4v.json +++ b/advisories/unreviewed/2024/02/GHSA-jm6x-683j-pm4v/GHSA-jm6x-683j-pm4v.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-jm6x-683j-pm4v", - "modified": "2024-02-28T09:30:36Z", + "modified": "2024-12-06T18:30:44Z", "published": "2024-02-28T09:30:36Z", "aliases": [ "CVE-2020-36781" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: imx: fix reference leak when pm_runtime_get_sync fails\n\nIn i2c_imx_xfer() and i2c_imx_remove(), the pm reference count\nis not expected to be incremented on return.\n\nHowever, pm_runtime_get_sync will increment pm reference count\neven failed. Forgetting to putting operation will result in a\nreference leak here.\n\nReplace it with pm_runtime_resume_and_get to keep usage\ncounter balanced.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -33,7 +38,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-28T09:15:36Z" diff --git a/advisories/unreviewed/2024/02/GHSA-jq5v-68r8-42wc/GHSA-jq5v-68r8-42wc.json b/advisories/unreviewed/2024/02/GHSA-jq5v-68r8-42wc/GHSA-jq5v-68r8-42wc.json index 37bb9d03bc1..42bf496a3f5 100644 --- a/advisories/unreviewed/2024/02/GHSA-jq5v-68r8-42wc/GHSA-jq5v-68r8-42wc.json +++ b/advisories/unreviewed/2024/02/GHSA-jq5v-68r8-42wc/GHSA-jq5v-68r8-42wc.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-jq5v-68r8-42wc", - "modified": "2024-02-28T09:30:36Z", + "modified": "2024-12-06T18:30:44Z", "published": "2024-02-28T09:30:36Z", "aliases": [ "CVE-2020-36784" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: cadence: fix reference leak when pm_runtime_get_sync fails\n\nThe PM reference count is not expected to be incremented on\nreturn in functions cdns_i2c_master_xfer and cdns_reg_slave.\n\nHowever, pm_runtime_get_sync will increment pm usage counter\neven failed. Forgetting to putting operation will result in a\nreference leak here.\n\nReplace it with pm_runtime_resume_and_get to keep usage\ncounter balanced.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -33,7 +38,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-28T09:15:36Z" diff --git a/advisories/unreviewed/2024/02/GHSA-xgg4-mwfh-3vj5/GHSA-xgg4-mwfh-3vj5.json b/advisories/unreviewed/2024/02/GHSA-xgg4-mwfh-3vj5/GHSA-xgg4-mwfh-3vj5.json index 4fc0a375302..e55e0961081 100644 --- a/advisories/unreviewed/2024/02/GHSA-xgg4-mwfh-3vj5/GHSA-xgg4-mwfh-3vj5.json +++ b/advisories/unreviewed/2024/02/GHSA-xgg4-mwfh-3vj5/GHSA-xgg4-mwfh-3vj5.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-xgg4-mwfh-3vj5", - "modified": "2024-02-28T09:30:36Z", + "modified": "2024-12-06T18:30:44Z", "published": "2024-02-28T09:30:36Z", "aliases": [ "CVE-2021-46981" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnbd: Fix NULL pointer in flush_workqueue\n\nOpen /dev/nbdX first, the config_refs will be 1 and\nthe pointers in nbd_device are still null. Disconnect\n/dev/nbdX, then reference a null recv_workq. The\nprotection by config_refs in nbd_genl_disconnect is useless.\n\n[ 656.366194] BUG: kernel NULL pointer dereference, address: 0000000000000020\n[ 656.368943] #PF: supervisor write access in kernel mode\n[ 656.369844] #PF: error_code(0x0002) - not-present page\n[ 656.370717] PGD 10cc87067 P4D 10cc87067 PUD 1074b4067 PMD 0\n[ 656.371693] Oops: 0002 [#1] SMP\n[ 656.372242] CPU: 5 PID: 7977 Comm: nbd-client Not tainted 5.11.0-rc5-00040-g76c057c84d28 #1\n[ 656.373661] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014\n[ 656.375904] RIP: 0010:mutex_lock+0x29/0x60\n[ 656.376627] Code: 00 0f 1f 44 00 00 55 48 89 fd 48 83 05 6f d7 fe 08 01 e8 7a c3 ff ff 48 83 05 6a d7 fe 08 01 31 c0 65 48 8b 14 25 00 6d 01 00 48 0f b1 55 d\n[ 656.378934] RSP: 0018:ffffc900005eb9b0 EFLAGS: 00010246\n[ 656.379350] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\n[ 656.379915] RDX: ffff888104cf2600 RSI: ffffffffaae8f452 RDI: 0000000000000020\n[ 656.380473] RBP: 0000000000000020 R08: 0000000000000000 R09: ffff88813bd6b318\n[ 656.381039] R10: 00000000000000c7 R11: fefefefefefefeff R12: ffff888102710b40\n[ 656.381599] R13: ffffc900005eb9e0 R14: ffffffffb2930680 R15: ffff88810770ef00\n[ 656.382166] FS: 00007fdf117ebb40(0000) GS:ffff88813bd40000(0000) knlGS:0000000000000000\n[ 656.382806] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 656.383261] CR2: 0000000000000020 CR3: 0000000100c84000 CR4: 00000000000006e0\n[ 656.383819] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 656.384370] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 656.384927] Call Trace:\n[ 656.385111] flush_workqueue+0x92/0x6c0\n[ 656.385395] nbd_disconnect_and_put+0x81/0xd0\n[ 656.385716] nbd_genl_disconnect+0x125/0x2a0\n[ 656.386034] genl_family_rcv_msg_doit.isra.0+0x102/0x1b0\n[ 656.386422] genl_rcv_msg+0xfc/0x2b0\n[ 656.386685] ? nbd_ioctl+0x490/0x490\n[ 656.386954] ? genl_family_rcv_msg_doit.isra.0+0x1b0/0x1b0\n[ 656.387354] netlink_rcv_skb+0x62/0x180\n[ 656.387638] genl_rcv+0x34/0x60\n[ 656.387874] netlink_unicast+0x26d/0x590\n[ 656.388162] netlink_sendmsg+0x398/0x6c0\n[ 656.388451] ? netlink_rcv_skb+0x180/0x180\n[ 656.388750] ____sys_sendmsg+0x1da/0x320\n[ 656.389038] ? ____sys_recvmsg+0x130/0x220\n[ 656.389334] ___sys_sendmsg+0x8e/0xf0\n[ 656.389605] ? ___sys_recvmsg+0xa2/0xf0\n[ 656.389889] ? handle_mm_fault+0x1671/0x21d0\n[ 656.390201] __sys_sendmsg+0x6d/0xe0\n[ 656.390464] __x64_sys_sendmsg+0x23/0x30\n[ 656.390751] do_syscall_64+0x45/0x70\n[ 656.391017] entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nTo fix it, just add if (nbd->recv_workq) to nbd_disconnect_and_put().", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -36,8 +41,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-28T09:15:37Z" diff --git a/advisories/unreviewed/2024/02/GHSA-xrvh-c235-ph9w/GHSA-xrvh-c235-ph9w.json b/advisories/unreviewed/2024/02/GHSA-xrvh-c235-ph9w/GHSA-xrvh-c235-ph9w.json index 735a5606a58..fddba2df128 100644 --- a/advisories/unreviewed/2024/02/GHSA-xrvh-c235-ph9w/GHSA-xrvh-c235-ph9w.json +++ b/advisories/unreviewed/2024/02/GHSA-xrvh-c235-ph9w/GHSA-xrvh-c235-ph9w.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-xrvh-c235-ph9w", - "modified": "2024-02-28T09:30:36Z", + "modified": "2024-12-06T18:30:44Z", "published": "2024-02-28T09:30:36Z", "aliases": [ "CVE-2020-36783" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: img-scb: fix reference leak when pm_runtime_get_sync fails\n\nThe PM reference count is not expected to be incremented on\nreturn in functions img_i2c_xfer and img_i2c_init.\n\nHowever, pm_runtime_get_sync will increment the PM reference\ncount even failed. Forgetting to putting operation will result\nin a reference leak here.\n\nReplace it with pm_runtime_resume_and_get to keep usage\ncounter balanced.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -37,7 +42,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-28T09:15:36Z" diff --git a/advisories/unreviewed/2024/03/GHSA-h86r-ff52-49qg/GHSA-h86r-ff52-49qg.json b/advisories/unreviewed/2024/03/GHSA-h86r-ff52-49qg/GHSA-h86r-ff52-49qg.json index 4f3e03c718d..40824b84888 100644 --- a/advisories/unreviewed/2024/03/GHSA-h86r-ff52-49qg/GHSA-h86r-ff52-49qg.json +++ b/advisories/unreviewed/2024/03/GHSA-h86r-ff52-49qg/GHSA-h86r-ff52-49qg.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-125" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/03/GHSA-v558-mxh5-rq8q/GHSA-v558-mxh5-rq8q.json b/advisories/unreviewed/2024/03/GHSA-v558-mxh5-rq8q/GHSA-v558-mxh5-rq8q.json index 148e9d14d80..1dbc2d9c4db 100644 --- a/advisories/unreviewed/2024/03/GHSA-v558-mxh5-rq8q/GHSA-v558-mxh5-rq8q.json +++ b/advisories/unreviewed/2024/03/GHSA-v558-mxh5-rq8q/GHSA-v558-mxh5-rq8q.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-125" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/05/GHSA-594v-v6mq-rw7x/GHSA-594v-v6mq-rw7x.json b/advisories/unreviewed/2024/05/GHSA-594v-v6mq-rw7x/GHSA-594v-v6mq-rw7x.json index 6235336201f..1c63b2d6415 100644 --- a/advisories/unreviewed/2024/05/GHSA-594v-v6mq-rw7x/GHSA-594v-v6mq-rw7x.json +++ b/advisories/unreviewed/2024/05/GHSA-594v-v6mq-rw7x/GHSA-594v-v6mq-rw7x.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-79" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/07/GHSA-jvmf-76g5-h4gv/GHSA-jvmf-76g5-h4gv.json b/advisories/unreviewed/2024/07/GHSA-jvmf-76g5-h4gv/GHSA-jvmf-76g5-h4gv.json index 82b6a80e9b0..4858c1ff3c0 100644 --- a/advisories/unreviewed/2024/07/GHSA-jvmf-76g5-h4gv/GHSA-jvmf-76g5-h4gv.json +++ b/advisories/unreviewed/2024/07/GHSA-jvmf-76g5-h4gv/GHSA-jvmf-76g5-h4gv.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-jvmf-76g5-h4gv", - "modified": "2024-07-04T03:31:38Z", + "modified": "2024-12-06T18:30:45Z", "published": "2024-07-04T03:31:38Z", "aliases": [ "CVE-2024-38344" ], "details": "A cross-site request forgery vulnerability exists in WP Tweet Walls versions prior to 1.0.4. If this vulnerability is exploited, an attacker allows a user who logs in to the WordPress site where the affected plugin is enabled to access a malicious page. As a result, the user may perform unintended operations on the WordPress site.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-04T01:15:02Z" diff --git a/advisories/unreviewed/2024/07/GHSA-rjwc-235r-8986/GHSA-rjwc-235r-8986.json b/advisories/unreviewed/2024/07/GHSA-rjwc-235r-8986/GHSA-rjwc-235r-8986.json index 9f63de33197..39913c975a2 100644 --- a/advisories/unreviewed/2024/07/GHSA-rjwc-235r-8986/GHSA-rjwc-235r-8986.json +++ b/advisories/unreviewed/2024/07/GHSA-rjwc-235r-8986/GHSA-rjwc-235r-8986.json @@ -41,7 +41,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-367" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/10/GHSA-c45f-33wq-x2qc/GHSA-c45f-33wq-x2qc.json b/advisories/unreviewed/2024/10/GHSA-c45f-33wq-x2qc/GHSA-c45f-33wq-x2qc.json index 3bc506a51ac..7dd77dc9d8f 100644 --- a/advisories/unreviewed/2024/10/GHSA-c45f-33wq-x2qc/GHSA-c45f-33wq-x2qc.json +++ b/advisories/unreviewed/2024/10/GHSA-c45f-33wq-x2qc/GHSA-c45f-33wq-x2qc.json @@ -51,7 +51,8 @@ "database_specific": { "cwe_ids": [ "CWE-276", - "CWE-77" + "CWE-77", + "CWE-78" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/12/GHSA-29xv-m659-vj7w/GHSA-29xv-m659-vj7w.json b/advisories/unreviewed/2024/12/GHSA-29xv-m659-vj7w/GHSA-29xv-m659-vj7w.json new file mode 100644 index 00000000000..d636d77006b --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-29xv-m659-vj7w/GHSA-29xv-m659-vj7w.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-29xv-m659-vj7w", + "modified": "2024-12-06T18:30:46Z", + "published": "2024-12-06T18:30:46Z", + "aliases": [ + "CVE-2024-42494" + ], + "details": "Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view and exfiltrate sensitive information from all cloud accounts registered to Ruijie's services", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42494" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-359" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T18:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-4rc8-3mc7-r96j/GHSA-4rc8-3mc7-r96j.json b/advisories/unreviewed/2024/12/GHSA-4rc8-3mc7-r96j/GHSA-4rc8-3mc7-r96j.json index b0d9d623c9f..34681e8990e 100644 --- a/advisories/unreviewed/2024/12/GHSA-4rc8-3mc7-r96j/GHSA-4rc8-3mc7-r96j.json +++ b/advisories/unreviewed/2024/12/GHSA-4rc8-3mc7-r96j/GHSA-4rc8-3mc7-r96j.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-4rc8-3mc7-r96j", - "modified": "2024-12-06T06:30:57Z", + "modified": "2024-12-06T18:30:45Z", "published": "2024-12-06T06:30:57Z", "aliases": [ "CVE-2024-10480" ], "details": "The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-06T06:15:19Z" diff --git a/advisories/unreviewed/2024/12/GHSA-4rf6-vjg6-7466/GHSA-4rf6-vjg6-7466.json b/advisories/unreviewed/2024/12/GHSA-4rf6-vjg6-7466/GHSA-4rf6-vjg6-7466.json new file mode 100644 index 00000000000..bdfdab5eb4e --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-4rf6-vjg6-7466/GHSA-4rf6-vjg6-7466.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4rf6-vjg6-7466", + "modified": "2024-12-06T18:30:46Z", + "published": "2024-12-06T18:30:46Z", + "aliases": [ + "CVE-2024-47547" + ], + "details": "Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication vulnerable to brute force attacks.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47547" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-640" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T18:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-59xx-9g47-6hc5/GHSA-59xx-9g47-6hc5.json b/advisories/unreviewed/2024/12/GHSA-59xx-9g47-6hc5/GHSA-59xx-9g47-6hc5.json new file mode 100644 index 00000000000..72d587e889c --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-59xx-9g47-6hc5/GHSA-59xx-9g47-6hc5.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-59xx-9g47-6hc5", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-50393" + ], + "details": "A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.9.2954 build 20241120 and later\nQTS 5.2.2.2950 build 20241114 and later\nQuTS hero h5.1.9.2954 build 20241120 and later\nQuTS hero h5.2.2.2952 build 20241116 and later", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50393" + }, + { + "type": "WEB", + "url": "https://www.qnap.com/en/security-advisory/qsa-24-49" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T17:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-5p7p-gj53-x6pp/GHSA-5p7p-gj53-x6pp.json b/advisories/unreviewed/2024/12/GHSA-5p7p-gj53-x6pp/GHSA-5p7p-gj53-x6pp.json new file mode 100644 index 00000000000..9d5b949ce53 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-5p7p-gj53-x6pp/GHSA-5p7p-gj53-x6pp.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5p7p-gj53-x6pp", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-50389" + ], + "details": "A SQL injection vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to inject malicious code.\n\nWe have already fixed the vulnerability in the following version:\nQuRouter 2.4.5.032 and later", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50389" + }, + { + "type": "WEB", + "url": "https://www.qnap.com/en/security-advisory/qsa-24-45" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T17:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-5x22-49wv-3m34/GHSA-5x22-49wv-3m34.json b/advisories/unreviewed/2024/12/GHSA-5x22-49wv-3m34/GHSA-5x22-49wv-3m34.json new file mode 100644 index 00000000000..9bb1b85d8d3 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-5x22-49wv-3m34/GHSA-5x22-49wv-3m34.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5x22-49wv-3m34", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-50387" + ], + "details": "A SQL injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to inject malicious code.\n\nWe have already fixed the vulnerability in the following version:\nSMB Service 4.15.002 and later\nSMB Service h4.15.002 and later", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50387" + }, + { + "type": "WEB", + "url": "https://www.qnap.com/en/security-advisory/qsa-24-42" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T17:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-664m-m8f4-chcx/GHSA-664m-m8f4-chcx.json b/advisories/unreviewed/2024/12/GHSA-664m-m8f4-chcx/GHSA-664m-m8f4-chcx.json index 88b3386d73f..dffed1a1c45 100644 --- a/advisories/unreviewed/2024/12/GHSA-664m-m8f4-chcx/GHSA-664m-m8f4-chcx.json +++ b/advisories/unreviewed/2024/12/GHSA-664m-m8f4-chcx/GHSA-664m-m8f4-chcx.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-664m-m8f4-chcx", - "modified": "2024-12-06T00:31:47Z", + "modified": "2024-12-06T18:30:45Z", "published": "2024-12-06T00:31:47Z", "aliases": [ "CVE-2018-9390" ], "details": "In procfile_write of gl_proc.c, there is a possible out of bounds read of a\n function pointer due to an incorrect bounds check. This could lead to local\n escalation of privilege with System execution privileges needed. User\n interaction is not needed for exploitation.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-125" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-05T23:15:04Z" diff --git a/advisories/unreviewed/2024/12/GHSA-6hfr-hxpf-c7m6/GHSA-6hfr-hxpf-c7m6.json b/advisories/unreviewed/2024/12/GHSA-6hfr-hxpf-c7m6/GHSA-6hfr-hxpf-c7m6.json new file mode 100644 index 00000000000..0c8c498294b --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-6hfr-hxpf-c7m6/GHSA-6hfr-hxpf-c7m6.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6hfr-hxpf-c7m6", + "modified": "2024-12-06T18:30:46Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-53691" + ], + "details": "A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.8.2823 build 20240712 and later\nQTS 5.2.0.2802 build 20240620 and later\nQuTS hero h5.1.8.2823 build 20240712 and later\nQuTS hero h5.2.0.2802 build 20240620 and later", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53691" + }, + { + "type": "WEB", + "url": "https://www.qnap.com/en/security-advisory/qsa-24-28" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-59" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T17:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-6hm2-gx4w-jp78/GHSA-6hm2-gx4w-jp78.json b/advisories/unreviewed/2024/12/GHSA-6hm2-gx4w-jp78/GHSA-6hm2-gx4w-jp78.json new file mode 100644 index 00000000000..fed722dc959 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-6hm2-gx4w-jp78/GHSA-6hm2-gx4w-jp78.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6hm2-gx4w-jp78", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-50677" + ], + "details": "A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50677" + }, + { + "type": "WEB", + "url": "https://github.com/ZumiYumi/CVE-2024-50677" + }, + { + "type": "WEB", + "url": "https://github.com/oroinc/orocommerce-application" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T16:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-6rp7-x538-xh3v/GHSA-6rp7-x538-xh3v.json b/advisories/unreviewed/2024/12/GHSA-6rp7-x538-xh3v/GHSA-6rp7-x538-xh3v.json index e5e0c5687cc..583a189420c 100644 --- a/advisories/unreviewed/2024/12/GHSA-6rp7-x538-xh3v/GHSA-6rp7-x538-xh3v.json +++ b/advisories/unreviewed/2024/12/GHSA-6rp7-x538-xh3v/GHSA-6rp7-x538-xh3v.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-6rp7-x538-xh3v", - "modified": "2024-12-06T00:31:46Z", + "modified": "2024-12-06T18:30:45Z", "published": "2024-12-06T00:31:46Z", "aliases": [ "CVE-2018-9388" ], "details": "In store_upgrade and store_cmd of drivers/input/touchscreen/stm/ftm4_pdc.c, there are out of bound writes due to missing bounds checks or integer underflows. These could lead to escalation of privilege.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-05T23:15:04Z" diff --git a/advisories/unreviewed/2024/12/GHSA-73fp-mp5x-w6pr/GHSA-73fp-mp5x-w6pr.json b/advisories/unreviewed/2024/12/GHSA-73fp-mp5x-w6pr/GHSA-73fp-mp5x-w6pr.json index 42d07b654a6..c3bcf01a0c5 100644 --- a/advisories/unreviewed/2024/12/GHSA-73fp-mp5x-w6pr/GHSA-73fp-mp5x-w6pr.json +++ b/advisories/unreviewed/2024/12/GHSA-73fp-mp5x-w6pr/GHSA-73fp-mp5x-w6pr.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-73fp-mp5x-w6pr", - "modified": "2024-12-06T06:30:57Z", + "modified": "2024-12-06T18:30:45Z", "published": "2024-12-06T06:30:57Z", "aliases": [ "CVE-2024-10551" ], "details": "The Sticky Social Icons WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-06T06:15:22Z" diff --git a/advisories/unreviewed/2024/12/GHSA-798g-qgw9-v4mf/GHSA-798g-qgw9-v4mf.json b/advisories/unreviewed/2024/12/GHSA-798g-qgw9-v4mf/GHSA-798g-qgw9-v4mf.json new file mode 100644 index 00000000000..cdbbba266ec --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-798g-qgw9-v4mf/GHSA-798g-qgw9-v4mf.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-798g-qgw9-v4mf", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-48867" + ], + "details": "An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.9.2954 build 20241120 and later\nQTS 5.2.2.2950 build 20241114 and later\nQuTS hero h5.1.9.2954 build 20241120 and later\nQuTS hero h5.2.2.2952 build 20241116 and later", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48867" + }, + { + "type": "WEB", + "url": "https://www.qnap.com/en/security-advisory/qsa-24-49" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-93" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T17:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-7p8v-c2c9-mh3r/GHSA-7p8v-c2c9-mh3r.json b/advisories/unreviewed/2024/12/GHSA-7p8v-c2c9-mh3r/GHSA-7p8v-c2c9-mh3r.json new file mode 100644 index 00000000000..79f11f5c86d --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-7p8v-c2c9-mh3r/GHSA-7p8v-c2c9-mh3r.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7p8v-c2c9-mh3r", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-48865" + ], + "details": "An improper certificate validation vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow attackers with local network access to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.9.2954 build 20241120 and later\nQTS 5.2.2.2950 build 20241114 and later\nQuTS hero h5.1.9.2954 build 20241120 and later\nQuTS hero h5.2.2.2952 build 20241116 and later", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48865" + }, + { + "type": "WEB", + "url": "https://www.qnap.com/en/security-advisory/qsa-24-49" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-295" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T17:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-8jjx-px56-3jpp/GHSA-8jjx-px56-3jpp.json b/advisories/unreviewed/2024/12/GHSA-8jjx-px56-3jpp/GHSA-8jjx-px56-3jpp.json index 82106ab80cf..285f765f09a 100644 --- a/advisories/unreviewed/2024/12/GHSA-8jjx-px56-3jpp/GHSA-8jjx-px56-3jpp.json +++ b/advisories/unreviewed/2024/12/GHSA-8jjx-px56-3jpp/GHSA-8jjx-px56-3jpp.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-8jjx-px56-3jpp", - "modified": "2024-12-06T00:31:46Z", + "modified": "2024-12-06T18:30:45Z", "published": "2024-12-06T00:31:46Z", "aliases": [ "CVE-2018-9386" ], "details": "In reboot_block_command of htc reboot_block driver, there is a possible\n stack buffer overflow due to a missing bounds check. This could lead to\n local escalation of privilege with System execution privileges needed. User\n interaction is not needed for exploitation.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-120" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-05T23:15:04Z" diff --git a/advisories/unreviewed/2024/12/GHSA-98v8-wh2r-mmhc/GHSA-98v8-wh2r-mmhc.json b/advisories/unreviewed/2024/12/GHSA-98v8-wh2r-mmhc/GHSA-98v8-wh2r-mmhc.json new file mode 100644 index 00000000000..c32580b2036 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-98v8-wh2r-mmhc/GHSA-98v8-wh2r-mmhc.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-98v8-wh2r-mmhc", + "modified": "2024-12-06T18:30:46Z", + "published": "2024-12-06T18:30:46Z", + "aliases": [ + "CVE-2024-52558" + ], + "details": "The affected product is vulnerable to an integer underflow. An unauthenticated attacker could send a malformed HTTP request, which could allow the attacker to crash the program.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52558" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-340-02" + }, + { + "type": "WEB", + "url": "https://www.planet.com.tw/en/support/downloads?method=keyword&keyword=v1.305b241111" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-191" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T18:15:26Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-98x8-3rxx-9jj8/GHSA-98x8-3rxx-9jj8.json b/advisories/unreviewed/2024/12/GHSA-98x8-3rxx-9jj8/GHSA-98x8-3rxx-9jj8.json new file mode 100644 index 00000000000..b8cda8ff59f --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-98x8-3rxx-9jj8/GHSA-98x8-3rxx-9jj8.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-98x8-3rxx-9jj8", + "modified": "2024-12-06T18:30:46Z", + "published": "2024-12-06T18:30:46Z", + "aliases": [ + "CVE-2024-52320" + ], + "details": "The affected product is vulnerable to a command injection. An unauthenticated attacker could send commands through a malicious HTTP request which could result in remote code execution.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52320" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-340-02" + }, + { + "type": "WEB", + "url": "https://www.planet.com.tw/en/support/downloads?method=keyword&keyword=v1.305b241111" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T18:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-9c26-wm2f-5pm9/GHSA-9c26-wm2f-5pm9.json b/advisories/unreviewed/2024/12/GHSA-9c26-wm2f-5pm9/GHSA-9c26-wm2f-5pm9.json new file mode 100644 index 00000000000..9f77768dc7f --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-9c26-wm2f-5pm9/GHSA-9c26-wm2f-5pm9.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9c26-wm2f-5pm9", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-48863" + ], + "details": "A command injection vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.\n\nWe have already fixed the vulnerability in the following version:\nLicense Center 1.9.43 and later", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48863" + }, + { + "type": "WEB", + "url": "https://www.qnap.com/en/security-advisory/qsa-24-50" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T17:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-9jcj-c3px-4jc5/GHSA-9jcj-c3px-4jc5.json b/advisories/unreviewed/2024/12/GHSA-9jcj-c3px-4jc5/GHSA-9jcj-c3px-4jc5.json index ea708c13682..1247dde25a8 100644 --- a/advisories/unreviewed/2024/12/GHSA-9jcj-c3px-4jc5/GHSA-9jcj-c3px-4jc5.json +++ b/advisories/unreviewed/2024/12/GHSA-9jcj-c3px-4jc5/GHSA-9jcj-c3px-4jc5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9jcj-c3px-4jc5", - "modified": "2024-12-04T18:32:35Z", + "modified": "2024-12-06T18:30:45Z", "published": "2024-12-02T15:31:41Z", "aliases": [ "CVE-2024-10905" diff --git a/advisories/unreviewed/2024/12/GHSA-cjf2-3qp2-r229/GHSA-cjf2-3qp2-r229.json b/advisories/unreviewed/2024/12/GHSA-cjf2-3qp2-r229/GHSA-cjf2-3qp2-r229.json new file mode 100644 index 00000000000..2d3360f6715 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-cjf2-3qp2-r229/GHSA-cjf2-3qp2-r229.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cjf2-3qp2-r229", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-54750" + ], + "details": "Ubiquiti U6-LR 6.6.65 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54750" + }, + { + "type": "WEB", + "url": "https://colorful-meadow-5b9.notion.site/U6-LR_HardCode_vuln-14bc216a1c30806487ebdda3bb984e91?pvs=4" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-798" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T16:15:23Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-f4rv-5346-m4jx/GHSA-f4rv-5346-m4jx.json b/advisories/unreviewed/2024/12/GHSA-f4rv-5346-m4jx/GHSA-f4rv-5346-m4jx.json new file mode 100644 index 00000000000..7983dfc25b5 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-f4rv-5346-m4jx/GHSA-f4rv-5346-m4jx.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f4rv-5346-m4jx", + "modified": "2024-12-06T18:30:46Z", + "published": "2024-12-06T18:30:46Z", + "aliases": [ + "CVE-2024-50404" + ], + "details": "A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations.\n\nWe have already fixed the vulnerability in the following versions:\nQsync Central 4.4.0.16_20240819 ( 2024/08/19 ) and later", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50404" + }, + { + "type": "WEB", + "url": "https://www.qnap.com/en/security-advisory/qsa-24-48" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-59" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T17:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-ffhp-q35w-w8gx/GHSA-ffhp-q35w-w8gx.json b/advisories/unreviewed/2024/12/GHSA-ffhp-q35w-w8gx/GHSA-ffhp-q35w-w8gx.json new file mode 100644 index 00000000000..80a5fdaf6c9 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-ffhp-q35w-w8gx/GHSA-ffhp-q35w-w8gx.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ffhp-q35w-w8gx", + "modified": "2024-12-06T18:30:46Z", + "published": "2024-12-06T18:30:46Z", + "aliases": [ + "CVE-2024-47043" + ], + "details": "Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could enable an attacker to correlate a device serial number and the user's phone number and part of the email address.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47043" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-922" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T18:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-fg4q-6vvm-xqgr/GHSA-fg4q-6vvm-xqgr.json b/advisories/unreviewed/2024/12/GHSA-fg4q-6vvm-xqgr/GHSA-fg4q-6vvm-xqgr.json new file mode 100644 index 00000000000..fbb129b9325 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-fg4q-6vvm-xqgr/GHSA-fg4q-6vvm-xqgr.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fg4q-6vvm-xqgr", + "modified": "2024-12-06T18:30:46Z", + "published": "2024-12-06T18:30:46Z", + "aliases": [ + "CVE-2024-55268" + ], + "details": "A Reflected Cross Site Scripting (XSS) vulnerability was found in /covidtms/registered-user-testing.php in PHPGurukul COVID 19 Testing Management System 1.0 which allows remote attackers to execute arbitrary code via the regmobilenumber parameter.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55268" + }, + { + "type": "WEB", + "url": "https://github.com/Santoshcyber1/CVE-wirteup/blob/main/Phpgurukul/COVID19/Reflected%20Cross%20Site%20reg.pdf" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T17:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-h2vr-gv3v-gqhp/GHSA-h2vr-gv3v-gqhp.json b/advisories/unreviewed/2024/12/GHSA-h2vr-gv3v-gqhp/GHSA-h2vr-gv3v-gqhp.json new file mode 100644 index 00000000000..f8ae207eb93 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-h2vr-gv3v-gqhp/GHSA-h2vr-gv3v-gqhp.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h2vr-gv3v-gqhp", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-48868" + ], + "details": "An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.9.2954 build 20241120 and later\nQTS 5.2.2.2950 build 20241114 and later\nQuTS hero h5.1.9.2954 build 20241120 and later\nQuTS hero h5.2.2.2952 build 20241116 and later", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48868" + }, + { + "type": "WEB", + "url": "https://www.qnap.com/en/security-advisory/qsa-24-49" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-93" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T17:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-j59c-f72p-pc4w/GHSA-j59c-f72p-pc4w.json b/advisories/unreviewed/2024/12/GHSA-j59c-f72p-pc4w/GHSA-j59c-f72p-pc4w.json new file mode 100644 index 00000000000..0ce0b632115 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-j59c-f72p-pc4w/GHSA-j59c-f72p-pc4w.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j59c-f72p-pc4w", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-30129" + ], + "details": "The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would cause the request to be sent to a completely different domain/IP address.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30129" + }, + { + "type": "WEB", + "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0117533" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-644" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T16:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-jpgm-g5cc-54qg/GHSA-jpgm-g5cc-54qg.json b/advisories/unreviewed/2024/12/GHSA-jpgm-g5cc-54qg/GHSA-jpgm-g5cc-54qg.json new file mode 100644 index 00000000000..403e0a41990 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-jpgm-g5cc-54qg/GHSA-jpgm-g5cc-54qg.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jpgm-g5cc-54qg", + "modified": "2024-12-06T18:30:46Z", + "published": "2024-12-06T18:30:46Z", + "aliases": [ + "CVE-2024-48871" + ], + "details": "The affected product is vulnerable to a stack-based buffer overflow. An unauthenticated attacker could send a malicious HTTP request that the webserver fails to properly check input size before copying data to the stack, potentially allowing remote code execution.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48871" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-340-02" + }, + { + "type": "WEB", + "url": "https://www.planet.com.tw/en/support/downloads?method=keyword&keyword=v1.305b241111" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-121" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T18:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-m3fm-4744-qmhg/GHSA-m3fm-4744-qmhg.json b/advisories/unreviewed/2024/12/GHSA-m3fm-4744-qmhg/GHSA-m3fm-4744-qmhg.json new file mode 100644 index 00000000000..637e20656df --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-m3fm-4744-qmhg/GHSA-m3fm-4744-qmhg.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m3fm-4744-qmhg", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-50388" + ], + "details": "An OS command injection vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to execute commands.\n\nWe have already fixed the vulnerability in the following version:\nHBS 3 Hybrid Backup Sync 25.1.1.673 and later", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50388" + }, + { + "type": "WEB", + "url": "https://www.qnap.com/en/security-advisory/qsa-24-41" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-77" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T17:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-m75h-x6q6-7qg6/GHSA-m75h-x6q6-7qg6.json b/advisories/unreviewed/2024/12/GHSA-m75h-x6q6-7qg6/GHSA-m75h-x6q6-7qg6.json new file mode 100644 index 00000000000..a8c3ae5c2fb --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-m75h-x6q6-7qg6/GHSA-m75h-x6q6-7qg6.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m75h-x6q6-7qg6", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-48866" + ], + "details": "An improper handling of URL encoding (Hex Encoding) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to run the system into unexpected state.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.9.2954 build 20241120 and later\nQTS 5.2.2.2950 build 20241114 and later\nQuTS hero h5.1.9.2954 build 20241120 and later\nQuTS hero h5.2.2.2952 build 20241116 and later", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48866" + }, + { + "type": "WEB", + "url": "https://www.qnap.com/en/security-advisory/qsa-24-49" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-177" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T17:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-mqhq-rj42-jpjp/GHSA-mqhq-rj42-jpjp.json b/advisories/unreviewed/2024/12/GHSA-mqhq-rj42-jpjp/GHSA-mqhq-rj42-jpjp.json new file mode 100644 index 00000000000..0ef0d8d2f4d --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-mqhq-rj42-jpjp/GHSA-mqhq-rj42-jpjp.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mqhq-rj42-jpjp", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-48859" + ], + "details": "An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to compromise the security of the system.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.9.2954 build 20241120 and later\nQTS 5.2.2.2950 build 20241114 and later\nQuTS hero h5.1.9.2954 build 20241120 and later\nQuTS hero h5.2.2.2952 build 20241116 and later", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48859" + }, + { + "type": "WEB", + "url": "https://www.qnap.com/en/security-advisory/qsa-24-49" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T17:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-ph84-rcj2-fxxm/GHSA-ph84-rcj2-fxxm.json b/advisories/unreviewed/2024/12/GHSA-ph84-rcj2-fxxm/GHSA-ph84-rcj2-fxxm.json new file mode 100644 index 00000000000..e4aab6229cb --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-ph84-rcj2-fxxm/GHSA-ph84-rcj2-fxxm.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ph84-rcj2-fxxm", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-12254" + ], + "details": "Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines()\n method would not \"pause\" writing and signal to the Protocol to drain \nthe buffer to the wire once the write buffer reached the \"high-water \nmark\". Because of this, Protocols would not periodically drain the write\n buffer potentially leading to memory exhaustion.\n\n\n\n\n\nThis\n vulnerability likely impacts a small number of users, you must be using\n Python 3.12.0 or later, on macOS or Linux, using the asyncio module \nwith protocols, and using .writelines() method which had new \nzero-copy-on-write behavior in Python 3.12.0 and later. If not all of \nthese factors are true then your usage of Python is unaffected.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12254" + }, + { + "type": "WEB", + "url": "https://github.com/python/cpython/issues/127655" + }, + { + "type": "WEB", + "url": "https://github.com/python/cpython/pull/127656" + }, + { + "type": "WEB", + "url": "https://github.com/python/cpython/commit/71e8429ac8e2adc10084ab5ec29a62f4b6671a82" + }, + { + "type": "WEB", + "url": "https://github.com/python/cpython/commit/9aa0deb2eef2655a1029ba228527b152353135b5" + }, + { + "type": "WEB", + "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/H4O3UBAOAQQXGT4RE3E4XQYR5XLROORB" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T16:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-q3rj-96fw-94q2/GHSA-q3rj-96fw-94q2.json b/advisories/unreviewed/2024/12/GHSA-q3rj-96fw-94q2/GHSA-q3rj-96fw-94q2.json new file mode 100644 index 00000000000..279e60cccf2 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-q3rj-96fw-94q2/GHSA-q3rj-96fw-94q2.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q3rj-96fw-94q2", + "modified": "2024-12-06T18:30:46Z", + "published": "2024-12-06T18:30:46Z", + "aliases": [ + "CVE-2024-48703" + ], + "details": "PhpGurukul Medical Card Generation System v1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/search-medicalcard.php via the searchdata parameter.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48703" + }, + { + "type": "WEB", + "url": "https://github.com/0xBhushan/Writeups/blob/main/CVE/phpGurukul/Medical%20Card%20Generation%20System/Reflected%20Cross-Site%20Scripting%20%28XSS%29-Search.pdf" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T18:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-q759-j7h3-76hj/GHSA-q759-j7h3-76hj.json b/advisories/unreviewed/2024/12/GHSA-q759-j7h3-76hj/GHSA-q759-j7h3-76hj.json index ffe6d894044..452a0bb835b 100644 --- a/advisories/unreviewed/2024/12/GHSA-q759-j7h3-76hj/GHSA-q759-j7h3-76hj.json +++ b/advisories/unreviewed/2024/12/GHSA-q759-j7h3-76hj/GHSA-q759-j7h3-76hj.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-q759-j7h3-76hj", - "modified": "2024-12-06T00:31:47Z", + "modified": "2024-12-06T18:30:45Z", "published": "2024-12-06T00:31:47Z", "aliases": [ "CVE-2018-9391" ], "details": "In update_gps_sv and output_vzw_debug of\n vendor/mediatek/proprietary/hardware/connectivity/gps/gps_hal/src/gpshal_wor\n ker.c, there is a possible out of bounds write due to a missing bounds\n check. This could lead to local escalation of privilege with System\n execution privileges needed. User interaction is not needed for\n exploitation.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-787" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-05T23:15:04Z" diff --git a/advisories/unreviewed/2024/12/GHSA-qv8f-7m6r-v8hp/GHSA-qv8f-7m6r-v8hp.json b/advisories/unreviewed/2024/12/GHSA-qv8f-7m6r-v8hp/GHSA-qv8f-7m6r-v8hp.json new file mode 100644 index 00000000000..7f11a31bc15 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-qv8f-7m6r-v8hp/GHSA-qv8f-7m6r-v8hp.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qv8f-7m6r-v8hp", + "modified": "2024-12-06T18:30:46Z", + "published": "2024-12-06T18:30:46Z", + "aliases": [ + "CVE-2024-11220" + ], + "details": "A local low-level user on the server machine with credentials to the running OAS services can create and execute a report with an rdlx file on the server system itself. Any code within the rdlx file of the report executes with SYSTEM privileges, resulting in privilege escalation.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11220" + }, + { + "type": "WEB", + "url": "https://openautomationsoftware.com/downloads" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-03" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-279" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T18:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-qwrm-c5rf-9g92/GHSA-qwrm-c5rf-9g92.json b/advisories/unreviewed/2024/12/GHSA-qwrm-c5rf-9g92/GHSA-qwrm-c5rf-9g92.json new file mode 100644 index 00000000000..c049ff45a15 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-qwrm-c5rf-9g92/GHSA-qwrm-c5rf-9g92.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qwrm-c5rf-9g92", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-50403" + ], + "details": "A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.2.2.2950 build 20241114 and later\nQuTS hero h5.2.2.2952 build 20241116 and later", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50403" + }, + { + "type": "WEB", + "url": "https://www.qnap.com/en/security-advisory/qsa-24-49" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-134" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T17:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-r8r9-qqg8-94h8/GHSA-r8r9-qqg8-94h8.json b/advisories/unreviewed/2024/12/GHSA-r8r9-qqg8-94h8/GHSA-r8r9-qqg8-94h8.json index f23aa4c8dae..738cca9cd7c 100644 --- a/advisories/unreviewed/2024/12/GHSA-r8r9-qqg8-94h8/GHSA-r8r9-qqg8-94h8.json +++ b/advisories/unreviewed/2024/12/GHSA-r8r9-qqg8-94h8/GHSA-r8r9-qqg8-94h8.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-r8r9-qqg8-94h8", - "modified": "2024-12-06T00:31:46Z", + "modified": "2024-12-06T18:30:45Z", "published": "2024-12-06T00:31:46Z", "aliases": [ "CVE-2017-13308" ], "details": "In tscpu_write_GPIO_out and mtkts_Abts_write of mtk_ts_Abts.c, there is a possible buffer overflow in an sscanf due to improper input validation. This could lead to a local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-120" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-05T22:15:18Z" diff --git a/advisories/unreviewed/2024/12/GHSA-rhph-9qcj-jrgq/GHSA-rhph-9qcj-jrgq.json b/advisories/unreviewed/2024/12/GHSA-rhph-9qcj-jrgq/GHSA-rhph-9qcj-jrgq.json new file mode 100644 index 00000000000..a0dbbd18c96 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-rhph-9qcj-jrgq/GHSA-rhph-9qcj-jrgq.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rhph-9qcj-jrgq", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-54745" + ], + "details": "WAVLINK WN701AE M01AE_V240305 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54745" + }, + { + "type": "WEB", + "url": "https://colorful-meadow-5b9.notion.site/WN701AE_HardCode_vuln-14ac216a1c308015b571e68810d83e16?pvs=4" + }, + { + "type": "WEB", + "url": "https://docs.wavlink.xyz/Firmware_ch/fm-701e" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T16:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-wc2c-7p6r-2qq8/GHSA-wc2c-7p6r-2qq8.json b/advisories/unreviewed/2024/12/GHSA-wc2c-7p6r-2qq8/GHSA-wc2c-7p6r-2qq8.json new file mode 100644 index 00000000000..530859e0dec --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-wc2c-7p6r-2qq8/GHSA-wc2c-7p6r-2qq8.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wc2c-7p6r-2qq8", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-54747" + ], + "details": "WAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54747" + }, + { + "type": "WEB", + "url": "https://colorful-meadow-5b9.notion.site/WN531P3_HardCode_vuln-14ac216a1c30805c9b4dd59028d866cc?pvs=73" + }, + { + "type": "WEB", + "url": "https://docs.wavlink.xyz/Firmware_ch/fm-531p3" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T16:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-wmwq-h234-5c33/GHSA-wmwq-h234-5c33.json b/advisories/unreviewed/2024/12/GHSA-wmwq-h234-5c33/GHSA-wmwq-h234-5c33.json new file mode 100644 index 00000000000..e08de63f39c --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-wmwq-h234-5c33/GHSA-wmwq-h234-5c33.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wmwq-h234-5c33", + "modified": "2024-12-06T18:30:46Z", + "published": "2024-12-06T18:30:46Z", + "aliases": [ + "CVE-2024-51727" + ], + "details": "Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a feature that could enable attackers to invalidate a legitimate user's session and cause a denial-of-service attack on a user's account.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51727" + }, + { + "type": "WEB", + "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-338-01" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-826" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T18:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-wp8p-p4jj-23wc/GHSA-wp8p-p4jj-23wc.json b/advisories/unreviewed/2024/12/GHSA-wp8p-p4jj-23wc/GHSA-wp8p-p4jj-23wc.json new file mode 100644 index 00000000000..191e689177d --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-wp8p-p4jj-23wc/GHSA-wp8p-p4jj-23wc.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wp8p-p4jj-23wc", + "modified": "2024-12-06T18:30:45Z", + "published": "2024-12-06T18:30:45Z", + "aliases": [ + "CVE-2024-50402" + ], + "details": "A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to obtain secret data or modify memory.\n\nWe have already fixed the vulnerability in the following versions:\nQTS 5.1.9.2954 build 20241120 and later\nQTS 5.2.2.2950 build 20241114 and later\nQuTS hero h5.1.9.2954 build 20241120 and later\nQuTS hero h5.2.2.2952 build 20241116 and later", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50402" + }, + { + "type": "WEB", + "url": "https://www.qnap.com/en/security-advisory/qsa-24-49" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-134" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T17:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-x73j-6c5w-6h22/GHSA-x73j-6c5w-6h22.json b/advisories/unreviewed/2024/12/GHSA-x73j-6c5w-6h22/GHSA-x73j-6c5w-6h22.json index 9834e4fdd71..f16d1fd6842 100644 --- a/advisories/unreviewed/2024/12/GHSA-x73j-6c5w-6h22/GHSA-x73j-6c5w-6h22.json +++ b/advisories/unreviewed/2024/12/GHSA-x73j-6c5w-6h22/GHSA-x73j-6c5w-6h22.json @@ -1,13 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-x73j-6c5w-6h22", - "modified": "2024-12-05T18:31:03Z", + "modified": "2024-12-06T18:30:45Z", "published": "2024-12-05T18:31:03Z", "aliases": [ "CVE-2024-11158" ], "details": "An “uninitialized variable” code execution vulnerability exists in the \n\nRockwell Automation Arena®\n\n that could allow a threat actor to craft a DOE file and force the software to access a variable before it being initialized. If exploited, a threat actor could leverage this vulnerability to execute arbitrary code. To exploit this vulnerability, a legitimate user must execute the malicious code crafted by the threat actor.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" diff --git a/advisories/unreviewed/2024/12/GHSA-xprr-92x5-gfg6/GHSA-xprr-92x5-gfg6.json b/advisories/unreviewed/2024/12/GHSA-xprr-92x5-gfg6/GHSA-xprr-92x5-gfg6.json new file mode 100644 index 00000000000..ac2e8d6b4ba --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-xprr-92x5-gfg6/GHSA-xprr-92x5-gfg6.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xprr-92x5-gfg6", + "modified": "2024-12-06T18:30:46Z", + "published": "2024-12-06T18:30:46Z", + "aliases": [ + "CVE-2024-54749" + ], + "details": "Ubiquiti U7-Pro 7.0.35 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54749" + }, + { + "type": "WEB", + "url": "https://colorful-meadow-5b9.notion.site/U7-Pro_HardCode_vuln-14bc216a1c30802e9c4cd03753e880cc?pvs=4" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-06T17:15:12Z" + } +} \ No newline at end of file