diff --git a/advisories/github-reviewed/2019/10/GHSA-85rf-xh54-whp3/GHSA-85rf-xh54-whp3.json b/advisories/github-reviewed/2019/10/GHSA-85rf-xh54-whp3/GHSA-85rf-xh54-whp3.json index 565b250bd66..9e25dc8d50a 100644 --- a/advisories/github-reviewed/2019/10/GHSA-85rf-xh54-whp3/GHSA-85rf-xh54-whp3.json +++ b/advisories/github-reviewed/2019/10/GHSA-85rf-xh54-whp3/GHSA-85rf-xh54-whp3.json @@ -1,10 +1,10 @@ { "schema_version": "1.4.0", "id": "GHSA-85rf-xh54-whp3", - "modified": "2021-08-25T21:02:38Z", + "modified": "2024-01-05T15:29:09Z", "published": "2019-10-07T16:52:13Z", "aliases": [ - + "CVE-2024-22050" ], "summary": "Malicious URL drafting attack against iodines static file server may allow path traversal", "details": "### Impact\n\nA path traversal vulnerability was detected in iodine's static file service. This vulnerability effects any application running iodine's static file server on an effected iodine version.\n\nMalicious URL drafting may cause the static file server to attempt a response containing data from files that shouldn't be normally accessible from the public folder.\n\n### Patches\n\nThe vulnerability was patched in version 0.7.34. Please upgrade to the latest version.\n\n### Workarounds\n\nA possible workaround would be to disable the static file service and it's `X-Sendfile` support, sending static files using nginx or a source code solution (sending the data dynamically).\n\nHowever, it would be better to upgrade iodine to the latest version, as it also contains non-security related fixes.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email [Boaz Segev](https://github.com/boazsegev)", @@ -40,6 +40,10 @@ "type": "WEB", "url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22050" + }, { "type": "WEB", "url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889" diff --git a/advisories/github-reviewed/2022/07/GHSA-vpf7-q2rx-26mh/GHSA-vpf7-q2rx-26mh.json b/advisories/github-reviewed/2022/07/GHSA-vpf7-q2rx-26mh/GHSA-vpf7-q2rx-26mh.json index 72d8409fd28..323f790893a 100644 --- a/advisories/github-reviewed/2022/07/GHSA-vpf7-q2rx-26mh/GHSA-vpf7-q2rx-26mh.json +++ b/advisories/github-reviewed/2022/07/GHSA-vpf7-q2rx-26mh/GHSA-vpf7-q2rx-26mh.json @@ -43,6 +43,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36888" }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/hashicorp-vault-plugin/commit/3b38d767aba8bd98d6f4fb53c1f1678d95b5e752" + }, { "type": "PACKAGE", "url": "https://github.com/jenkinsci/hashicorp-vault-plugin" diff --git a/advisories/github-reviewed/2022/11/GHSA-v535-pc6r-77qh/GHSA-v535-pc6r-77qh.json b/advisories/github-reviewed/2022/11/GHSA-v535-pc6r-77qh/GHSA-v535-pc6r-77qh.json index 8f44b50b951..be3a6e5a974 100644 --- a/advisories/github-reviewed/2022/11/GHSA-v535-pc6r-77qh/GHSA-v535-pc6r-77qh.json +++ b/advisories/github-reviewed/2022/11/GHSA-v535-pc6r-77qh/GHSA-v535-pc6r-77qh.json @@ -43,6 +43,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45385" }, + { + "type": "WEB", + "url": "https://github.com/jenkinsci/dockerhub-notification-plugin/commit/1163d4f297af23266c032fc66bd603b97f9ecd4b" + }, { "type": "PACKAGE", "url": "https://github.com/jenkinsci/dockerhub-notification-plugin" diff --git a/advisories/github-reviewed/2024/01/GHSA-qwf7-rv77-fcr3/GHSA-qwf7-rv77-fcr3.json b/advisories/github-reviewed/2024/01/GHSA-qwf7-rv77-fcr3/GHSA-qwf7-rv77-fcr3.json new file mode 100644 index 00000000000..c785f930aff --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-qwf7-rv77-fcr3/GHSA-qwf7-rv77-fcr3.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qwf7-rv77-fcr3", + "modified": "2024-01-05T15:28:54Z", + "published": "2024-01-04T21:30:24Z", + "withdrawn": "2024-01-05T15:28:54Z", + "aliases": [ + + ], + "summary": "Duplicate Advisory: Malicious URL drafting attack against iodines static file server may allow path traversal", + "details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-85rf-xh54-whp3. This link is maintained to preserve external references.\n\n### Original Description\nPath traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.\n\n", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "RubyGems", + "name": "iodine" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 0.7.33" + } + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22050" + }, + { + "type": "WEB", + "url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889" + }, + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-85rf-xh54-whp3" + }, + { + "type": "WEB", + "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-01-05T15:28:54Z", + "nvd_published_at": "2024-01-04T21:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2021/11/GHSA-h54q-fpvg-vhq5/GHSA-h54q-fpvg-vhq5.json b/advisories/unreviewed/2021/11/GHSA-h54q-fpvg-vhq5/GHSA-h54q-fpvg-vhq5.json index 0b5ffc03da9..676a2b535b9 100644 --- a/advisories/unreviewed/2021/11/GHSA-h54q-fpvg-vhq5/GHSA-h54q-fpvg-vhq5.json +++ b/advisories/unreviewed/2021/11/GHSA-h54q-fpvg-vhq5/GHSA-h54q-fpvg-vhq5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-h54q-fpvg-vhq5", - "modified": "2021-11-25T00:00:45Z", + "modified": "2024-01-05T15:30:23Z", "published": "2021-11-24T00:00:41Z", "aliases": [ "CVE-2021-24830" ], "details": "The Advanced Access Manager WordPress plugin before 6.8.0 does not escape some of its settings when outputting them, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ diff --git a/advisories/unreviewed/2022/05/GHSA-6v5w-2xvc-ghhh/GHSA-6v5w-2xvc-ghhh.json b/advisories/unreviewed/2022/05/GHSA-6v5w-2xvc-ghhh/GHSA-6v5w-2xvc-ghhh.json index b03d7b286be..07c8b805fca 100644 --- a/advisories/unreviewed/2022/05/GHSA-6v5w-2xvc-ghhh/GHSA-6v5w-2xvc-ghhh.json +++ b/advisories/unreviewed/2022/05/GHSA-6v5w-2xvc-ghhh/GHSA-6v5w-2xvc-ghhh.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-6v5w-2xvc-ghhh", - "modified": "2022-05-24T17:37:50Z", + "modified": "2024-01-05T15:30:22Z", "published": "2022-05-24T17:37:50Z", "aliases": [ "CVE-2020-35935" ], "details": "The Advanced Access Manager plugin before 6.6.2 for WordPress allows privilege escalation on profile updates via the aam_user_roles POST parameter if Multiple Role support is enabled. (The mechanism for deciding whether a user was entitled to add a role did not work in various custom-role scenarios.)", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ diff --git a/advisories/unreviewed/2022/05/GHSA-7q52-2r47-35qw/GHSA-7q52-2r47-35qw.json b/advisories/unreviewed/2022/05/GHSA-7q52-2r47-35qw/GHSA-7q52-2r47-35qw.json index 6d0d0fb47f3..eb7a203ab76 100644 --- a/advisories/unreviewed/2022/05/GHSA-7q52-2r47-35qw/GHSA-7q52-2r47-35qw.json +++ b/advisories/unreviewed/2022/05/GHSA-7q52-2r47-35qw/GHSA-7q52-2r47-35qw.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-7q52-2r47-35qw", - "modified": "2022-05-24T17:37:49Z", + "modified": "2024-01-05T15:30:22Z", "published": "2022-05-24T17:37:49Z", "aliases": [ "CVE-2020-35934" ], "details": "The Advanced Access Manager plugin before 6.6.2 for WordPress displays the unfiltered user object (including all metadata) upon login via the REST API (aam/v1/authenticate or aam/v2/authenticate). This is a security problem if this object stores information that the user is not supposed to have (e.g., custom metadata added by a different plugin).", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } ], "affected": [ @@ -25,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-200", "CWE-732" ], "severity": "MODERATE", diff --git a/advisories/unreviewed/2022/05/GHSA-p367-375f-q2f8/GHSA-p367-375f-q2f8.json b/advisories/unreviewed/2022/05/GHSA-p367-375f-q2f8/GHSA-p367-375f-q2f8.json index f5333fda059..23f454d64b5 100644 --- a/advisories/unreviewed/2022/05/GHSA-p367-375f-q2f8/GHSA-p367-375f-q2f8.json +++ b/advisories/unreviewed/2022/05/GHSA-p367-375f-q2f8/GHSA-p367-375f-q2f8.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-p367-375f-q2f8", - "modified": "2022-05-17T19:57:16Z", + "modified": "2024-01-05T15:30:21Z", "published": "2022-05-17T19:57:16Z", "aliases": [ "CVE-2014-6059" ], "details": "WordPress Advanced Access Manager Plugin before 2.8.2 has an Arbitrary File Overwrite Vulnerability", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ diff --git a/advisories/unreviewed/2023/06/GHSA-3x5r-c923-f923/GHSA-3x5r-c923-f923.json b/advisories/unreviewed/2023/06/GHSA-3x5r-c923-f923/GHSA-3x5r-c923-f923.json index 7b087fe24fc..3ac30bccae2 100644 --- a/advisories/unreviewed/2023/06/GHSA-3x5r-c923-f923/GHSA-3x5r-c923-f923.json +++ b/advisories/unreviewed/2023/06/GHSA-3x5r-c923-f923/GHSA-3x5r-c923-f923.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3x5r-c923-f923", - "modified": "2023-06-27T15:30:28Z", + "modified": "2024-01-05T15:30:23Z", "published": "2023-06-23T18:30:24Z", "aliases": [ "CVE-2023-32373" @@ -21,6 +21,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32373" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213757" @@ -50,7 +54,7 @@ "cwe_ids": [ "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-06-23T18:15:12Z" diff --git a/advisories/unreviewed/2023/06/GHSA-m85j-wjrj-c4rg/GHSA-m85j-wjrj-c4rg.json b/advisories/unreviewed/2023/06/GHSA-m85j-wjrj-c4rg/GHSA-m85j-wjrj-c4rg.json index a9982690447..04b5facf52f 100644 --- a/advisories/unreviewed/2023/06/GHSA-m85j-wjrj-c4rg/GHSA-m85j-wjrj-c4rg.json +++ b/advisories/unreviewed/2023/06/GHSA-m85j-wjrj-c4rg/GHSA-m85j-wjrj-c4rg.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-m85j-wjrj-c4rg", - "modified": "2023-06-30T09:30:19Z", + "modified": "2024-01-05T15:30:23Z", "published": "2023-06-23T18:30:23Z", "aliases": [ "CVE-2023-28204" @@ -21,6 +21,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28204" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213757" @@ -50,7 +54,7 @@ "cwe_ids": [ "CWE-125" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-06-23T18:15:11Z" diff --git a/advisories/unreviewed/2023/06/GHSA-rh53-wvg6-9v8m/GHSA-rh53-wvg6-9v8m.json b/advisories/unreviewed/2023/06/GHSA-rh53-wvg6-9v8m/GHSA-rh53-wvg6-9v8m.json index ff0fed0afbd..352bcf9eab7 100644 --- a/advisories/unreviewed/2023/06/GHSA-rh53-wvg6-9v8m/GHSA-rh53-wvg6-9v8m.json +++ b/advisories/unreviewed/2023/06/GHSA-rh53-wvg6-9v8m/GHSA-rh53-wvg6-9v8m.json @@ -29,6 +29,10 @@ "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DF2RESDBALYFDF6OEJDUYFSN7XJADFRD/" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213811" diff --git a/advisories/unreviewed/2023/07/GHSA-57gp-c4c9-4j3c/GHSA-57gp-c4c9-4j3c.json b/advisories/unreviewed/2023/07/GHSA-57gp-c4c9-4j3c/GHSA-57gp-c4c9-4j3c.json index d3d7c39a803..63cea1bfdc9 100644 --- a/advisories/unreviewed/2023/07/GHSA-57gp-c4c9-4j3c/GHSA-57gp-c4c9-4j3c.json +++ b/advisories/unreviewed/2023/07/GHSA-57gp-c4c9-4j3c/GHSA-57gp-c4c9-4j3c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-57gp-c4c9-4j3c", - "modified": "2023-08-02T03:30:20Z", + "modified": "2024-01-05T15:30:23Z", "published": "2023-07-27T00:30:57Z", "aliases": [ "CVE-2023-38133" @@ -29,6 +29,10 @@ "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213841" @@ -66,7 +70,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-07-27T00:15:15Z" diff --git a/advisories/unreviewed/2023/07/GHSA-959x-mqwc-q2fp/GHSA-959x-mqwc-q2fp.json b/advisories/unreviewed/2023/07/GHSA-959x-mqwc-q2fp/GHSA-959x-mqwc-q2fp.json index 0abc85d9fe2..622b0089c73 100644 --- a/advisories/unreviewed/2023/07/GHSA-959x-mqwc-q2fp/GHSA-959x-mqwc-q2fp.json +++ b/advisories/unreviewed/2023/07/GHSA-959x-mqwc-q2fp/GHSA-959x-mqwc-q2fp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-959x-mqwc-q2fp", - "modified": "2023-08-03T18:30:29Z", + "modified": "2024-01-05T15:30:23Z", "published": "2023-07-28T06:30:39Z", "aliases": [ "CVE-2023-38592" @@ -29,6 +29,10 @@ "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213841" @@ -58,7 +62,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-07-28T05:15:10Z" diff --git a/advisories/unreviewed/2023/07/GHSA-9hxv-f7q5-4j7c/GHSA-9hxv-f7q5-4j7c.json b/advisories/unreviewed/2023/07/GHSA-9hxv-f7q5-4j7c/GHSA-9hxv-f7q5-4j7c.json index 3cd9f5a3d48..376753923f0 100644 --- a/advisories/unreviewed/2023/07/GHSA-9hxv-f7q5-4j7c/GHSA-9hxv-f7q5-4j7c.json +++ b/advisories/unreviewed/2023/07/GHSA-9hxv-f7q5-4j7c/GHSA-9hxv-f7q5-4j7c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9hxv-f7q5-4j7c", - "modified": "2023-08-01T21:30:42Z", + "modified": "2024-01-05T15:30:23Z", "published": "2023-07-27T03:30:28Z", "aliases": [ "CVE-2023-32393" @@ -21,6 +21,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32393" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213599" @@ -42,7 +46,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-07-27T01:15:23Z" diff --git a/advisories/unreviewed/2023/07/GHSA-c9g8-3cc3-422m/GHSA-c9g8-3cc3-422m.json b/advisories/unreviewed/2023/07/GHSA-c9g8-3cc3-422m/GHSA-c9g8-3cc3-422m.json index abb37d3ee9a..bc53c74156c 100644 --- a/advisories/unreviewed/2023/07/GHSA-c9g8-3cc3-422m/GHSA-c9g8-3cc3-422m.json +++ b/advisories/unreviewed/2023/07/GHSA-c9g8-3cc3-422m/GHSA-c9g8-3cc3-422m.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-c9g8-3cc3-422m", - "modified": "2023-08-03T18:30:29Z", + "modified": "2024-01-05T15:30:23Z", "published": "2023-07-28T06:30:39Z", "aliases": [ "CVE-2023-38599" @@ -29,6 +29,10 @@ "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213841" @@ -66,7 +70,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-07-28T05:15:10Z" diff --git a/advisories/unreviewed/2023/07/GHSA-p785-479c-32q6/GHSA-p785-479c-32q6.json b/advisories/unreviewed/2023/07/GHSA-p785-479c-32q6/GHSA-p785-479c-32q6.json index 3948528dc8a..1228474c748 100644 --- a/advisories/unreviewed/2023/07/GHSA-p785-479c-32q6/GHSA-p785-479c-32q6.json +++ b/advisories/unreviewed/2023/07/GHSA-p785-479c-32q6/GHSA-p785-479c-32q6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-p785-479c-32q6", - "modified": "2023-08-03T00:30:15Z", + "modified": "2024-01-05T15:30:23Z", "published": "2023-07-27T03:30:29Z", "aliases": [ "CVE-2023-38600" @@ -29,6 +29,10 @@ "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213841" @@ -62,7 +66,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-07-27T01:15:38Z" diff --git a/advisories/unreviewed/2023/07/GHSA-pxp9-4fx7-v479/GHSA-pxp9-4fx7-v479.json b/advisories/unreviewed/2023/07/GHSA-pxp9-4fx7-v479/GHSA-pxp9-4fx7-v479.json index 8ac889495cb..effc3c5c3e4 100644 --- a/advisories/unreviewed/2023/07/GHSA-pxp9-4fx7-v479/GHSA-pxp9-4fx7-v479.json +++ b/advisories/unreviewed/2023/07/GHSA-pxp9-4fx7-v479/GHSA-pxp9-4fx7-v479.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-pxp9-4fx7-v479", - "modified": "2023-08-03T00:30:15Z", + "modified": "2024-01-05T15:30:23Z", "published": "2023-07-27T03:30:29Z", "aliases": [ "CVE-2023-38611" @@ -29,6 +29,10 @@ "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213841" @@ -62,7 +66,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-07-27T01:15:39Z" diff --git a/advisories/unreviewed/2023/07/GHSA-qfg5-2446-wqxx/GHSA-qfg5-2446-wqxx.json b/advisories/unreviewed/2023/07/GHSA-qfg5-2446-wqxx/GHSA-qfg5-2446-wqxx.json index aa85a0c655d..021a05e06d3 100644 --- a/advisories/unreviewed/2023/07/GHSA-qfg5-2446-wqxx/GHSA-qfg5-2446-wqxx.json +++ b/advisories/unreviewed/2023/07/GHSA-qfg5-2446-wqxx/GHSA-qfg5-2446-wqxx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qfg5-2446-wqxx", - "modified": "2023-08-03T21:30:44Z", + "modified": "2024-01-05T15:30:23Z", "published": "2023-07-27T03:30:29Z", "aliases": [ "CVE-2023-38572" @@ -29,6 +29,10 @@ "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213841" @@ -66,7 +70,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-07-27T01:15:36Z" diff --git a/advisories/unreviewed/2023/07/GHSA-rv3f-cww5-rv8r/GHSA-rv3f-cww5-rv8r.json b/advisories/unreviewed/2023/07/GHSA-rv3f-cww5-rv8r/GHSA-rv3f-cww5-rv8r.json index 452079bed4d..2c7cb3fb306 100644 --- a/advisories/unreviewed/2023/07/GHSA-rv3f-cww5-rv8r/GHSA-rv3f-cww5-rv8r.json +++ b/advisories/unreviewed/2023/07/GHSA-rv3f-cww5-rv8r/GHSA-rv3f-cww5-rv8r.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rv3f-cww5-rv8r", - "modified": "2023-08-01T21:30:42Z", + "modified": "2024-01-05T15:30:23Z", "published": "2023-07-27T00:30:57Z", "aliases": [ "CVE-2023-38594" @@ -29,6 +29,10 @@ "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213841" @@ -66,7 +70,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-07-27T00:15:15Z" diff --git a/advisories/unreviewed/2023/07/GHSA-v874-wp44-mhr4/GHSA-v874-wp44-mhr4.json b/advisories/unreviewed/2023/07/GHSA-v874-wp44-mhr4/GHSA-v874-wp44-mhr4.json index d0d62394cda..2125e323251 100644 --- a/advisories/unreviewed/2023/07/GHSA-v874-wp44-mhr4/GHSA-v874-wp44-mhr4.json +++ b/advisories/unreviewed/2023/07/GHSA-v874-wp44-mhr4/GHSA-v874-wp44-mhr4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-v874-wp44-mhr4", - "modified": "2023-08-02T03:30:20Z", + "modified": "2024-01-05T15:30:23Z", "published": "2023-07-27T00:30:57Z", "aliases": [ "CVE-2023-37450" @@ -21,6 +21,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37450" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213826" @@ -46,7 +50,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-07-27T00:15:15Z" diff --git a/advisories/unreviewed/2023/07/GHSA-xf6p-jxqp-mvh4/GHSA-xf6p-jxqp-mvh4.json b/advisories/unreviewed/2023/07/GHSA-xf6p-jxqp-mvh4/GHSA-xf6p-jxqp-mvh4.json index 40b2f2a29a9..ee68993a06d 100644 --- a/advisories/unreviewed/2023/07/GHSA-xf6p-jxqp-mvh4/GHSA-xf6p-jxqp-mvh4.json +++ b/advisories/unreviewed/2023/07/GHSA-xf6p-jxqp-mvh4/GHSA-xf6p-jxqp-mvh4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xf6p-jxqp-mvh4", - "modified": "2023-08-03T00:30:14Z", + "modified": "2024-01-05T15:30:23Z", "published": "2023-07-27T03:30:29Z", "aliases": [ "CVE-2023-38595" @@ -29,6 +29,10 @@ "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213841" @@ -62,7 +66,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-07-27T01:15:37Z" diff --git a/advisories/unreviewed/2023/07/GHSA-xqh8-5mp7-f6qr/GHSA-xqh8-5mp7-f6qr.json b/advisories/unreviewed/2023/07/GHSA-xqh8-5mp7-f6qr/GHSA-xqh8-5mp7-f6qr.json index 00cd6078132..1859f59ab42 100644 --- a/advisories/unreviewed/2023/07/GHSA-xqh8-5mp7-f6qr/GHSA-xqh8-5mp7-f6qr.json +++ b/advisories/unreviewed/2023/07/GHSA-xqh8-5mp7-f6qr/GHSA-xqh8-5mp7-f6qr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xqh8-5mp7-f6qr", - "modified": "2023-08-01T21:30:42Z", + "modified": "2024-01-05T15:30:23Z", "published": "2023-07-27T00:30:57Z", "aliases": [ "CVE-2023-38597" @@ -29,6 +29,10 @@ "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KQXJYKTGLKI6TJEFJCKPHCNY7PS72OER/" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213841" @@ -58,7 +62,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-07-27T00:15:16Z" diff --git a/advisories/unreviewed/2023/08/GHSA-p6rj-wprj-c52h/GHSA-p6rj-wprj-c52h.json b/advisories/unreviewed/2023/08/GHSA-p6rj-wprj-c52h/GHSA-p6rj-wprj-c52h.json index 9bf172bbf06..8e373ecfe2c 100644 --- a/advisories/unreviewed/2023/08/GHSA-p6rj-wprj-c52h/GHSA-p6rj-wprj-c52h.json +++ b/advisories/unreviewed/2023/08/GHSA-p6rj-wprj-c52h/GHSA-p6rj-wprj-c52h.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-p6rj-wprj-c52h", - "modified": "2023-08-19T03:32:19Z", + "modified": "2024-01-05T15:30:23Z", "published": "2023-08-15T00:31:22Z", "aliases": [ "CVE-2023-28198" @@ -21,6 +21,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28198" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213670" @@ -38,7 +42,7 @@ "cwe_ids": [ "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-08-14T23:15:10Z" diff --git a/advisories/unreviewed/2023/09/GHSA-6x6m-3789-2cmw/GHSA-6x6m-3789-2cmw.json b/advisories/unreviewed/2023/09/GHSA-6x6m-3789-2cmw/GHSA-6x6m-3789-2cmw.json index b947b60697d..a802b308d1b 100644 --- a/advisories/unreviewed/2023/09/GHSA-6x6m-3789-2cmw/GHSA-6x6m-3789-2cmw.json +++ b/advisories/unreviewed/2023/09/GHSA-6x6m-3789-2cmw/GHSA-6x6m-3789-2cmw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6x6m-3789-2cmw", - "modified": "2023-10-15T03:30:30Z", + "modified": "2024-01-05T15:30:24Z", "published": "2023-09-06T21:32:51Z", "aliases": [ "CVE-2023-40397" @@ -21,6 +21,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40397" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213843" @@ -34,7 +38,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-09-06T21:15:13Z" diff --git a/advisories/unreviewed/2023/09/GHSA-m6rg-hrc7-fqpj/GHSA-m6rg-hrc7-fqpj.json b/advisories/unreviewed/2023/09/GHSA-m6rg-hrc7-fqpj/GHSA-m6rg-hrc7-fqpj.json index 288bc7d905d..80cfefc5bb8 100644 --- a/advisories/unreviewed/2023/09/GHSA-m6rg-hrc7-fqpj/GHSA-m6rg-hrc7-fqpj.json +++ b/advisories/unreviewed/2023/09/GHSA-m6rg-hrc7-fqpj/GHSA-m6rg-hrc7-fqpj.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-m6rg-hrc7-fqpj", - "modified": "2023-09-08T18:30:29Z", + "modified": "2024-01-05T15:30:23Z", "published": "2023-09-06T03:30:19Z", "aliases": [ "CVE-2023-32370" @@ -21,6 +21,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32370" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT213670" @@ -34,7 +38,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-09-06T02:15:09Z" diff --git a/advisories/unreviewed/2023/12/GHSA-53qp-xq7m-xppp/GHSA-53qp-xq7m-xppp.json b/advisories/unreviewed/2023/12/GHSA-53qp-xq7m-xppp/GHSA-53qp-xq7m-xppp.json index b0e702a3c9f..afc95b4787e 100644 --- a/advisories/unreviewed/2023/12/GHSA-53qp-xq7m-xppp/GHSA-53qp-xq7m-xppp.json +++ b/advisories/unreviewed/2023/12/GHSA-53qp-xq7m-xppp/GHSA-53qp-xq7m-xppp.json @@ -29,6 +29,10 @@ "type": "WEB", "url": "https://modzero.com/en/advisories/mz-23-01-poly-voip-devices/" }, + { + "type": "WEB", + "url": "https://modzero.com/en/blog/multiple-vulnerabilities-in-poly-products/" + }, { "type": "WEB", "url": "https://vuldb.com/?ctiid.249255" diff --git a/advisories/unreviewed/2023/12/GHSA-769q-5ww3-v8ww/GHSA-769q-5ww3-v8ww.json b/advisories/unreviewed/2023/12/GHSA-769q-5ww3-v8ww/GHSA-769q-5ww3-v8ww.json index fbea6e929c4..fc46af1518a 100644 --- a/advisories/unreviewed/2023/12/GHSA-769q-5ww3-v8ww/GHSA-769q-5ww3-v8ww.json +++ b/advisories/unreviewed/2023/12/GHSA-769q-5ww3-v8ww/GHSA-769q-5ww3-v8ww.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-769q-5ww3-v8ww", - "modified": "2023-12-26T21:30:33Z", + "modified": "2024-01-05T15:30:24Z", "published": "2023-12-26T21:30:33Z", "aliases": [ "CVE-2023-6114" ], "details": "The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-552" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-26T19:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-95hw-v8fq-666q/GHSA-95hw-v8fq-666q.json b/advisories/unreviewed/2023/12/GHSA-95hw-v8fq-666q/GHSA-95hw-v8fq-666q.json index 3eb14d588a5..00b4298271d 100644 --- a/advisories/unreviewed/2023/12/GHSA-95hw-v8fq-666q/GHSA-95hw-v8fq-666q.json +++ b/advisories/unreviewed/2023/12/GHSA-95hw-v8fq-666q/GHSA-95hw-v8fq-666q.json @@ -29,6 +29,10 @@ "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT214031" diff --git a/advisories/unreviewed/2023/12/GHSA-mj7q-7phw-qxj9/GHSA-mj7q-7phw-qxj9.json b/advisories/unreviewed/2023/12/GHSA-mj7q-7phw-qxj9/GHSA-mj7q-7phw-qxj9.json index 58fce4f4e1b..6bdb382a041 100644 --- a/advisories/unreviewed/2023/12/GHSA-mj7q-7phw-qxj9/GHSA-mj7q-7phw-qxj9.json +++ b/advisories/unreviewed/2023/12/GHSA-mj7q-7phw-qxj9/GHSA-mj7q-7phw-qxj9.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mj7q-7phw-qxj9", - "modified": "2023-12-29T09:30:25Z", + "modified": "2024-01-05T15:30:24Z", "published": "2023-12-29T09:30:25Z", "aliases": [ "CVE-2023-23634" ], "details": "SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-29T07:15:10Z" diff --git a/advisories/unreviewed/2023/12/GHSA-phhr-cqm7-gjv6/GHSA-phhr-cqm7-gjv6.json b/advisories/unreviewed/2023/12/GHSA-phhr-cqm7-gjv6/GHSA-phhr-cqm7-gjv6.json index 7a3c62dd91f..3956ecf6ebb 100644 --- a/advisories/unreviewed/2023/12/GHSA-phhr-cqm7-gjv6/GHSA-phhr-cqm7-gjv6.json +++ b/advisories/unreviewed/2023/12/GHSA-phhr-cqm7-gjv6/GHSA-phhr-cqm7-gjv6.json @@ -29,6 +29,10 @@ "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P5LQS6VEI7VIZNC7QGQ62EOV45R5RJIR/" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-04" + }, { "type": "WEB", "url": "https://support.apple.com/en-us/HT214031" diff --git a/advisories/unreviewed/2023/12/GHSA-qjcj-xg77-6c32/GHSA-qjcj-xg77-6c32.json b/advisories/unreviewed/2023/12/GHSA-qjcj-xg77-6c32/GHSA-qjcj-xg77-6c32.json index 49da9a22a46..6cf9885b541 100644 --- a/advisories/unreviewed/2023/12/GHSA-qjcj-xg77-6c32/GHSA-qjcj-xg77-6c32.json +++ b/advisories/unreviewed/2023/12/GHSA-qjcj-xg77-6c32/GHSA-qjcj-xg77-6c32.json @@ -45,6 +45,10 @@ "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D2N2P5LMP3V7IJONALV2KOFL4NUU23CJ/" }, + { + "type": "WEB", + "url": "https://security.gentoo.org/glsa/202401-03" + }, { "type": "WEB", "url": "https://support.apple.com/kb/HT214035" diff --git a/advisories/unreviewed/2023/12/GHSA-r64h-95wm-rrfq/GHSA-r64h-95wm-rrfq.json b/advisories/unreviewed/2023/12/GHSA-r64h-95wm-rrfq/GHSA-r64h-95wm-rrfq.json index 9881363448c..b95cfef7614 100644 --- a/advisories/unreviewed/2023/12/GHSA-r64h-95wm-rrfq/GHSA-r64h-95wm-rrfq.json +++ b/advisories/unreviewed/2023/12/GHSA-r64h-95wm-rrfq/GHSA-r64h-95wm-rrfq.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-r64h-95wm-rrfq", - "modified": "2023-12-28T06:30:24Z", + "modified": "2024-01-05T15:30:24Z", "published": "2023-12-28T06:30:24Z", "aliases": [ "CVE-2023-50445" ], "details": "Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the get_system_log and get_crash_log functions of the logread module, as well as the upgrade_online function of the upgrade module.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-78" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-28T05:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-x33q-m927-7mq6/GHSA-x33q-m927-7mq6.json b/advisories/unreviewed/2023/12/GHSA-x33q-m927-7mq6/GHSA-x33q-m927-7mq6.json index 0a3dc18bd13..a579eb39349 100644 --- a/advisories/unreviewed/2023/12/GHSA-x33q-m927-7mq6/GHSA-x33q-m927-7mq6.json +++ b/advisories/unreviewed/2023/12/GHSA-x33q-m927-7mq6/GHSA-x33q-m927-7mq6.json @@ -48,7 +48,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-122" + "CWE-122", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/01/GHSA-qwf7-rv77-fcr3/GHSA-qwf7-rv77-fcr3.json b/advisories/unreviewed/2024/01/GHSA-qwf7-rv77-fcr3/GHSA-qwf7-rv77-fcr3.json deleted file mode 100644 index 957142285bb..00000000000 --- a/advisories/unreviewed/2024/01/GHSA-qwf7-rv77-fcr3/GHSA-qwf7-rv77-fcr3.json +++ /dev/null @@ -1,47 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-qwf7-rv77-fcr3", - "modified": "2024-01-04T21:30:24Z", - "published": "2024-01-04T21:30:24Z", - "aliases": [ - "CVE-2024-22050" - ], - "details": "Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to read files outside the public folder via malicious URLs.\n\n", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "WEB", - "url": "https://github.com/boazsegev/iodine/security/advisories/GHSA-85rf-xh54-whp3" - }, - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22050" - }, - { - "type": "WEB", - "url": "https://github.com/boazsegev/iodine/commit/5558233fb7defda706b4f9c87c17759705949889" - }, - { - "type": "ADVISORY", - "url": "https://github.com/advisories/GHSA-85rf-xh54-whp3" - }, - { - "type": "WEB", - "url": "https://vulncheck.com/advisories/vc-advisory-GHSA-85rf-xh54-whp3" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-22" - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-01-04T21:15:10Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-xpp4-g6wp-qmp7/GHSA-xpp4-g6wp-qmp7.json b/advisories/unreviewed/2024/01/GHSA-xpp4-g6wp-qmp7/GHSA-xpp4-g6wp-qmp7.json new file mode 100644 index 00000000000..3c531bfe2b2 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-xpp4-g6wp-qmp7/GHSA-xpp4-g6wp-qmp7.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xpp4-g6wp-qmp7", + "modified": "2024-01-05T15:30:24Z", + "published": "2024-01-05T15:30:24Z", + "aliases": [ + "CVE-2024-0246" + ], + "details": "A vulnerability classified as problematic has been found in IceWarp 12.0.2.1/12.0.3.1. This affects an unknown part of the file /install/ of the component Utility Download Handler. The manipulation of the argument lang with the input 1%27\"()%26%25 leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249759. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0246" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.249759" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.249759" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-05T14:15:48Z" + } +} \ No newline at end of file