diff --git a/advisories/unreviewed/2024/02/GHSA-3mgm-628r-4cx7/GHSA-3mgm-628r-4cx7.json b/advisories/unreviewed/2024/02/GHSA-3mgm-628r-4cx7/GHSA-3mgm-628r-4cx7.json index 715205d8603..b96293a9418 100644 --- a/advisories/unreviewed/2024/02/GHSA-3mgm-628r-4cx7/GHSA-3mgm-628r-4cx7.json +++ b/advisories/unreviewed/2024/02/GHSA-3mgm-628r-4cx7/GHSA-3mgm-628r-4cx7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3mgm-628r-4cx7", - "modified": "2024-02-29T06:30:32Z", + "modified": "2024-02-29T15:32:25Z", "published": "2024-02-29T06:30:32Z", "aliases": [ "CVE-2023-51696" diff --git a/advisories/unreviewed/2024/02/GHSA-4g4j-672p-6638/GHSA-4g4j-672p-6638.json b/advisories/unreviewed/2024/02/GHSA-4g4j-672p-6638/GHSA-4g4j-672p-6638.json new file mode 100644 index 00000000000..742b5604c14 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-4g4j-672p-6638/GHSA-4g4j-672p-6638.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4g4j-672p-6638", + "modified": "2024-02-29T15:32:26Z", + "published": "2024-02-29T15:32:26Z", + "aliases": [ + "CVE-2024-0864" + ], + "details": "Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution (RCE) attack via an improper input validation in a file_upload.php file which serves as an example.\nBy default, Laragon is not vulnerable until a user decides to use the aforementioned plugin. \n", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0864" + }, + { + "type": "WEB", + "url": "https://cert.pl/en/posts/2024/02/CVE-2024-0864" + }, + { + "type": "WEB", + "url": "https://cert.pl/posts/2024/02/CVE-2024-0864" + }, + { + "type": "WEB", + "url": "https://laragon.org" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-29T13:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-69cq-jw85-57p8/GHSA-69cq-jw85-57p8.json b/advisories/unreviewed/2024/02/GHSA-69cq-jw85-57p8/GHSA-69cq-jw85-57p8.json new file mode 100644 index 00000000000..adbe67bab6f --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-69cq-jw85-57p8/GHSA-69cq-jw85-57p8.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-69cq-jw85-57p8", + "modified": "2024-02-29T15:32:27Z", + "published": "2024-02-29T15:32:27Z", + "aliases": [ + "CVE-2023-52485" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Wake DMCUB before sending a command\n\n[Why]\nWe can hang in place trying to send commands when the DMCUB isn't\npowered on.\n\n[How]\nFor functions that execute within a DC context or DC lock we can\nwrap the direct calls to dm_execute_dmub_cmd/list with code that\nexits idle power optimizations and reallows once we're done with\nthe command submission on success.\n\nFor DM direct submissions the DM will need to manage the enter/exit\nsequencing manually.\n\nWe cannot invoke a DMCUB command directly within the DM execution\nhelper or we can deadlock.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52485" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/303197775a97416b62d4da69280d0c120a20e009" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/8892780834ae294bc3697c7d0e056d7743900b39" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-29T15:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json b/advisories/unreviewed/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json new file mode 100644 index 00000000000..79929e08bfc --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-q76r-7p4q-mqpw/GHSA-q76r-7p4q-mqpw.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q76r-7p4q-mqpw", + "modified": "2024-02-29T15:32:26Z", + "published": "2024-02-29T15:32:26Z", + "aliases": [ + "CVE-2024-2001" + ], + "details": "A Cross-Site Scripting vulnerability in Cockpit CMS affecting version 2.7.0. This vulnerability could allow an authenticated user to upload an infected PDF file and store a malicious JavaScript payload to be executed when the file is uploaded.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2001" + }, + { + "type": "WEB", + "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-cockpit-cms" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-29T14:15:45Z" + } +} \ No newline at end of file