Advisory Database Sync

advisories/github-reviewed/2024/05/GHSA-wq43-8r5p-w3mc/GHSA-wq43-8r5p-w3mc.json

@@ -0,0 +1,85 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wq43-8r5p-w3mc",
+  "modified": "2024-05-15T18:31:04Z",
+  "published": "2024-05-15T18:31:04Z",
+  "aliases": [
+
+  ],
+  "summary": "contao/core PHP object injection vulnerability allows for arbitrary code execution",
+  "details": "PHP object injection vulnerability was identified in contao/core due to untrusted data being passed to `deserialize()` function.\n",
+  "severity": [
+
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "contao/core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.0.0"
+            },
+            {
+              "fixed": "2.11.14"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "contao/core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.0.0"
+            },
+            {
+              "fixed": "3.2.5"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/contao/core/issues/6695"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/contao/core/commit/d67c46c1f1283134e3050244cfdda0ef26fa5cd4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/contao/core/commit/f939b5be8a0048ef779def3289e2072febef1b37"
+    },
+    {
+      "type": "WEB",
+      "url": "https://contao.org/en/news/major-security-hole-found-in-contao.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/2014-02-13.yaml"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-15T18:31:04Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2024/05/GHSA-wxxw-5gq6-j2g5/GHSA-wxxw-5gq6-j2g5.json

@@ -0,0 +1,92 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wxxw-5gq6-j2g5",
+  "modified": "2024-05-15T18:31:02Z",
+  "published": "2024-05-15T18:31:02Z",
+  "aliases": [
+
+  ],
+  "summary": "contao/core Insufficient input validation allows for code injection and remote execution",
+  "details": "contao/core versions 2.x prior to 2.11.17 and 3.x prior to 3.2.9 are vulnerable to arbitrary code execution on the server due to insufficient input validation. In fact, attackers can remove or change pathconfig.php by entering a URL, meaning that the entire Contao installation will no longer be accessible or malicious code can be executed.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "contao/core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.0.0"
+            },
+            {
+              "fixed": "2.11.17"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "contao/core"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.0.0"
+            },
+            {
+              "fixed": "3.2.9"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/contao/core/issues/6855"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/contao/core/commit/d45503568751a868193929ef349a49ae5e6686f0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/contao/core/commit/d4a14f167e0cbb2e77c7829299e5b36f55c1ebce"
+    },
+    {
+      "type": "WEB",
+      "url": "https://c-c-a.org/aktuelles/news/details/eine-neue-kritische-sicherheitsluecke-in-contao-entdeckt"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/2014-04-07.yaml"
+    },
+    {
+      "type": "WEB",
+      "url": "https://web.archive.org/web/20240214121817/https://contao.org/en/news/new-security-hole-found-in-contao"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-05-15T18:31:02Z",
+    "nvd_published_at": null
+  }
+}

advisories/unreviewed/2024/05/GHSA-26f5-24g6-27vm/GHSA-26f5-24g6-27vm.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-26f5-24g6-27vm",
+  "modified": "2024-05-15T18:30:35Z",
+  "published": "2024-05-15T18:30:35Z",
+  "aliases": [
+    "CVE-2024-20256"
+  ],
+  "details": "A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web Appliance could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface.\n\nThis vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20256"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-bgG5WHOD"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T18:15:08Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-2h39-83vm-vq42/GHSA-2h39-83vm-vq42.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2h39-83vm-vq42",
+  "modified": "2024-05-15T18:30:34Z",
+  "published": "2024-05-15T18:30:34Z",
+  "aliases": [
+    "CVE-2023-7258"
+  ],
+  "details": "A denial of service exists in Gvisor Sandbox where a bug in reference counting code in mount point tracking could lead to a panic, making it possible for an attacker running as root and with permission to mount volumes to kill the sandbox. We recommend upgrading past commit 6a112c60a257dadac59962e0bc9e9b5aee70b5b6",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7258"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/google/gvisor/commit/6a112c60a257dadac59962e0bc9e9b5aee70b5b6"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-400"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T17:15:09Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-34wr-w2h3-hr5x/GHSA-34wr-w2h3-hr5x.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-34wr-w2h3-hr5x",
+  "modified": "2024-05-15T18:30:35Z",
+  "published": "2024-05-15T18:30:35Z",
+  "aliases": [
+    "CVE-2024-3488"
+  ],
+  "details": "File Upload vulnerability in unauthenticated\nsession found in OpenText™ iManager 3.2.6.0200. The vulnerability could allow ant attacker to upload a\nfile without authentication.\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3488"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T17:15:14Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-389q-94h9-f6qm/GHSA-389q-94h9-f6qm.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-389q-94h9-f6qm",
+  "modified": "2024-05-15T18:30:34Z",
+  "published": "2024-05-15T18:30:34Z",
+  "aliases": [
+    "CVE-2024-28042"
+  ],
+  "details": "SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Center.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28042"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-02"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-1357"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T17:15:10Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-57h3-6mh3-cjrr/GHSA-57h3-6mh3-cjrr.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-57h3-6mh3-cjrr",
+  "modified": "2024-05-15T18:30:34Z",
+  "published": "2024-05-15T18:30:34Z",
+  "aliases": [
+    "CVE-2024-27593"
+  ],
+  "details": "A stored cross-site scripting (XSS) vulnerability in the Filter function of Eramba Version 3.22.3 Community Edition allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the filter name field. This vulnerability has been fixed in version 3.23.0.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27593"
+    },
+    {
+      "type": "WEB",
+      "url": "https://blog.smarttecs.com/posts/2024-002-cve-2024-27593"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T17:15:10Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-585p-p962-9hrc/GHSA-585p-p962-9hrc.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-585p-p962-9hrc",
+  "modified": "2024-05-15T18:30:34Z",
+  "published": "2024-05-15T18:30:34Z",
+  "aliases": [
+    "CVE-2023-5938"
+  ],
+  "details": "Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attacks.\n\n\n\nAn administrator able to provide tampered archives to be processed by the affected versions of Arc may be able to have arbitrary files extracted to arbitrary filesystem locations. Leveraging this issue, an attacker may be able to overwrite arbitrary files on the target filesystem and cause critical impacts on the system (e.g., arbitrary command execution on the victim’s machine).",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5938"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.nozominetworks.com/NN-2023:16-01"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T17:15:09Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-6xj9-2c6f-3mhx/GHSA-6xj9-2c6f-3mhx.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6xj9-2c6f-3mhx",
+  "modified": "2024-05-15T18:30:35Z",
+  "published": "2024-05-15T18:30:35Z",
+  "aliases": [
+    "CVE-2024-20258"
+  ],
+  "details": "A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface.\n\n This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20258"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sma-wsa-xss-bgG5WHOD"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T18:15:09Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-76v2-48w6-crxr/GHSA-76v2-48w6-crxr.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-76v2-48w6-crxr",
+  "modified": "2024-05-15T18:30:35Z",
+  "published": "2024-05-15T18:30:35Z",
+  "aliases": [
+    "CVE-2024-28087"
+  ],
+  "details": "In Bonitasoft runtime Community edition, the lack of dynamic permissions causes IDOR vulnerability. Dynamic permissions existed only in Subscription edition and have now been restored in Community edition, where they are not custmizable.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28087"
+    },
+    {
+      "type": "WEB",
+      "url": "https://documentation.bonitasoft.com/bonita/latest/release-notes#_fixes_in_bonita_2024_1_2024_04_11"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T17:15:10Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-77g7-q65f-rmxf/GHSA-77g7-q65f-rmxf.json

@@ -0,0 +1,50 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-77g7-q65f-rmxf",
+  "modified": "2024-05-15T18:30:36Z",
+  "published": "2024-05-15T18:30:36Z",
+  "aliases": [
+    "CVE-2024-4905"
+  ],
+  "details": "A vulnerability classified as critical has been found in Kashipara College Management System 1.0. Affected is an unknown function of the file view_students_each_detail.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-264438 is the identifier assigned to this vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4905"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/E1CHO/cve_hub/blob/main/College%20Management%20System/College%20Management%20System%20-%20vuln%201.pdf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.264438"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.264438"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.332543"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T18:15:11Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-8483-3cvj-46c5/GHSA-8483-3cvj-46c5.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8483-3cvj-46c5",
+  "modified": "2024-05-15T18:30:35Z",
+  "published": "2024-05-15T18:30:35Z",
+  "aliases": [
+    "CVE-2024-3967"
+  ],
+  "details": "Remote Code\nExecution has been discovered in\nOpenText™ iManager 3.2.6.0200. The vulnerability can\ntrigger remote code execution unisng unsafe java object deserialization.\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3967"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-502"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T17:15:14Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-856w-rm82-4hp7/GHSA-856w-rm82-4hp7.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-856w-rm82-4hp7",
+  "modified": "2024-05-15T18:30:35Z",
+  "published": "2024-05-15T18:30:35Z",
+  "aliases": [
+    "CVE-2024-4837"
+  ],
+  "details": "In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via a trust boundary violation vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4837"
+    },
+    {
+      "type": "WEB",
+      "url": "https://docs.telerik.com/report-server/knowledge-base/information-exposure-cve-2024-4837"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-200"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T17:15:16Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-8jrr-vwjm-wj7q/GHSA-8jrr-vwjm-wj7q.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8jrr-vwjm-wj7q",
+  "modified": "2024-05-15T18:30:35Z",
+  "published": "2024-05-15T18:30:35Z",
+  "aliases": [
+    "CVE-2024-3484"
+  ],
+  "details": "Path Traversal found in OpenText™ iManager 3.2.6.0200. This can lead to privilege escalation\nor file disclosure.\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3484"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T17:15:13Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-8mcf-fh2m-245p/GHSA-8mcf-fh2m-245p.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8mcf-fh2m-245p",
+  "modified": "2024-05-15T18:30:36Z",
+  "published": "2024-05-15T18:30:36Z",
+  "aliases": [
+    "CVE-2024-20394"
+  ],
+  "details": "A vulnerability in Cisco AppDynamics Network Visibility Agent could allow an unauthenticated, local attacker to cause a denial of service (DoS) condition on an affected device.\n\n This vulnerability is due to the inability to handle unexpected input. An attacker who has local device access could exploit this vulnerability by sending an HTTP request to the targeted service. A successful exploit could allow the attacker to cause a DoS condition by stopping the Network Agent Service on the local device.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-20394"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-appd-netvisdos-9zNbsJtK"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T18:15:10Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-946r-mx2c-f2pf/GHSA-946r-mx2c-f2pf.json

@@ -0,0 +1,50 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-946r-mx2c-f2pf",
+  "modified": "2024-05-15T18:30:34Z",
+  "published": "2024-05-15T18:30:34Z",
+  "aliases": [
+    "CVE-2024-4903"
+  ],
+  "details": "A vulnerability was found in Tongda OA 2017. It has been declared as critical. This vulnerability affects unknown code of the file /general/meeting/manage/delete.php. The manipulation of the argument M_ID_STR leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264436. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4903"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Hefei-Coffee/cve/blob/main/sql3.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.264436"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.264436"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.330632"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T16:15:11Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-c24r-pxmj-hx9h/GHSA-c24r-pxmj-hx9h.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c24r-pxmj-hx9h",
+  "modified": "2024-05-15T18:30:34Z",
+  "published": "2024-05-15T18:30:34Z",
+  "aliases": [
+    "CVE-2024-3319"
+  ],
+  "details": "An issue was identified in the Identity Security Cloud (ISC) Transform preview and IdentityProfile preview API endpoints that allowed an authenticated administrator to execute user-defined templates as part of attribute transforms which could allow remote code execution on the host.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3319"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.sailpoint.com/security-advisories"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-94"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T16:15:11Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-c5q5-64hr-5mwm/GHSA-c5q5-64hr-5mwm.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-c5q5-64hr-5mwm",
+  "modified": "2024-05-15T18:30:35Z",
+  "published": "2024-05-15T18:30:35Z",
+  "aliases": [
+    "CVE-2024-3968"
+  ],
+  "details": "Remote Code\nExecution has been discovered in\nOpenText™ iManager 3.2.6.0200. The vulnerability can\ntrigger remote code execution using custom file upload task.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3968"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T17:15:14Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-cj69-9qw7-84pj/GHSA-cj69-9qw7-84pj.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cj69-9qw7-84pj",
+  "modified": "2024-05-15T18:30:35Z",
+  "published": "2024-05-15T18:30:35Z",
+  "aliases": [
+    "CVE-2024-3487"
+  ],
+  "details": "Broken Authentication vulnerability discovered in OpenText™ iManager 3.2.6.0200. This\nvulnerability allows an attacker to manipulate certain parameters to bypass\nauthentication.\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3487"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-287"
+    ],
+    "severity": "LOW",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T17:15:14Z"
+  }
+}

advisories/unreviewed/2024/05/GHSA-cmcg-f6r6-g4hh/GHSA-cmcg-f6r6-g4hh.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cmcg-f6r6-g4hh",
+  "modified": "2024-05-15T18:30:35Z",
+  "published": "2024-05-15T18:30:35Z",
+  "aliases": [
+    "CVE-2024-3486"
+  ],
+  "details": "XML External Entity injection vulnerability found in OpenText™ iManager 3.2.6.0200. This could lead to information disclosure and remote code execution.\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3486"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.netiq.com/documentation/imanager-32/imanager326_patch3_hf1_releasenotes/data/imanager326_patch3_hf1_releasenotes.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-611"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-05-15T17:15:13Z"
+  }
+}