mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-vmq6-5m68-f53m GHSA-9gp8-6cg8-7h34 GHSA-9442-gm4v-r222 GHSA-4gc7-5j7h-4qph GHSA-9mq2-v988-m7mr GHSA-fp86-2355-v99r GHSA-3q6h-q44p-xw88 GHSA-6v7c-pq5w-2jwg GHSA-w9cc-xrp8-ffx4 GHSA-45cm-4v3w-5jpw GHSA-x3h8-3mf2-v794 GHSA-2r3m-26p3-wr26 GHSA-3qm6-wcp5-fx9f GHSA-773m-x37x-96wr GHSA-88vw-p4cx-4677 GHSA-f63f-f9wj-5wjg GHSA-fr2x-xwp6-rg7p GHSA-g6j3-5m8r-7p3c GHSA-rwv8-hfhp-fj52 GHSA-whhw-2v2c-qg98 GHSA-xhf4-qqf8-2pw6
This commit is contained in:
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-vmq6-5m68-f53m",
|
||||
"modified": "2023-12-05T21:31:10Z",
|
||||
"modified": "2024-11-29T12:31:48Z",
|
||||
"published": "2023-11-29T12:30:16Z",
|
||||
"aliases": [
|
||||
"CVE-2023-6378"
|
||||
@@ -166,6 +166,10 @@
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://logback.qos.ch/news.html#1.3.12"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.netapp.com/advisory/ntap-20241129-0012"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-9gp8-6cg8-7h34",
|
||||
"modified": "2024-02-12T21:34:32Z",
|
||||
"modified": "2024-11-29T12:31:48Z",
|
||||
"published": "2024-02-06T00:30:25Z",
|
||||
"aliases": [
|
||||
"CVE-2023-34042"
|
||||
@@ -117,6 +117,10 @@
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/spring-projects/spring-security"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.netapp.com/advisory/ntap-20241129-0010"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://spring.io/security/cve-2023-34042"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-9442-gm4v-r222",
|
||||
"modified": "2024-10-17T14:08:20Z",
|
||||
"modified": "2024-11-29T12:31:48Z",
|
||||
"published": "2024-06-20T15:31:19Z",
|
||||
"aliases": [
|
||||
"CVE-2024-6162"
|
||||
@@ -109,6 +109,10 @@
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://issues.redhat.com/browse/UNDERTOW-2334"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.netapp.com/advisory/ntap-20241129-0009"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4gc7-5j7h-4qph",
|
||||
"modified": "2024-11-05T22:01:57Z",
|
||||
"modified": "2024-11-29T12:31:48Z",
|
||||
"published": "2024-10-18T06:30:32Z",
|
||||
"aliases": [
|
||||
"CVE-2024-38820"
|
||||
@@ -52,6 +52,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/spring-projects/spring-framework/commits/v6.2.0-RC2"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.netapp.com/advisory/ntap-20241129-0003"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://spring.io/security/cve-2024-38820"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-9mq2-v988-m7mr",
|
||||
"modified": "2022-09-25T00:00:26Z",
|
||||
"modified": "2024-11-29T12:31:47Z",
|
||||
"published": "2022-09-22T00:00:32Z",
|
||||
"aliases": [
|
||||
"CVE-2022-2795"
|
||||
@@ -13,9 +13,7 @@
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
@@ -29,6 +27,18 @@
|
||||
"type": "WEB",
|
||||
"url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7"
|
||||
@@ -45,6 +55,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://security.gentoo.org/glsa/202210-25"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.netapp.com/advisory/ntap-20241129-0002"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.debian.org/security/2022/dsa-5235"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-fp86-2355-v99r",
|
||||
"modified": "2023-04-13T21:30:27Z",
|
||||
"modified": "2024-11-29T12:31:47Z",
|
||||
"published": "2023-04-06T18:30:21Z",
|
||||
"aliases": [
|
||||
"CVE-2023-24537"
|
||||
@@ -38,6 +38,10 @@
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.gentoo.org/glsa/202311-09"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.netapp.com/advisory/ntap-20241129-0004"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3q6h-q44p-xw88",
|
||||
"modified": "2024-04-04T04:02:36Z",
|
||||
"modified": "2024-11-29T12:31:47Z",
|
||||
"published": "2023-05-11T18:30:17Z",
|
||||
"aliases": [
|
||||
"CVE-2023-24539"
|
||||
@@ -13,9 +13,7 @@
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
@@ -36,6 +34,10 @@
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://pkg.go.dev/vuln/GO-2023-1751"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.netapp.com/advisory/ntap-20241129-0005"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-6v7c-pq5w-2jwg",
|
||||
"modified": "2023-05-10T00:30:16Z",
|
||||
"modified": "2024-11-29T12:31:47Z",
|
||||
"published": "2023-05-10T00:30:16Z",
|
||||
"aliases": [
|
||||
"CVE-2023-2610"
|
||||
@@ -13,9 +13,7 @@
|
||||
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
@@ -41,6 +39,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PCLJN4QINITA3ZASKLEJ64C5TFNKELMO"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.netapp.com/advisory/ntap-20241129-0006"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://support.apple.com/kb/HT213844"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-w9cc-xrp8-ffx4",
|
||||
"modified": "2024-04-04T07:08:10Z",
|
||||
"modified": "2024-11-29T12:31:47Z",
|
||||
"published": "2023-08-22T21:30:27Z",
|
||||
"aliases": [
|
||||
"CVE-2022-48174"
|
||||
@@ -13,9 +13,7 @@
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
@@ -24,6 +22,10 @@
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://bugs.busybox.net/show_bug.cgi?id=15216"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.netapp.com/advisory/ntap-20241129-0001"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-x3h8-3mf2-v794",
|
||||
"modified": "2024-08-01T15:32:07Z",
|
||||
"modified": "2024-11-29T12:31:48Z",
|
||||
"published": "2024-07-24T09:30:40Z",
|
||||
"aliases": [
|
||||
"CVE-2024-6197"
|
||||
@@ -13,9 +13,7 @@
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
@@ -33,6 +31,10 @@
|
||||
"type": "WEB",
|
||||
"url": "https://curl.se/docs/CVE-2024-6197.json"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.netapp.com/advisory/ntap-20241129-0008"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "http://www.openwall.com/lists/oss-security/2024/07/24/1"
|
||||
@@ -43,9 +45,7 @@
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"cwe_ids": [],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2r3m-26p3-wr26",
|
||||
"modified": "2024-11-29T12:31:48Z",
|
||||
"published": "2024-11-29T12:31:48Z",
|
||||
"aliases": [
|
||||
"CVE-2024-11981"
|
||||
],
|
||||
"details": "Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11981"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.twcert.org.tw/en/cp-139-8276-1defb-2.html"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.twcert.org.tw/tw/cp-132-8275-50f42-1.html"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-288"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-11-29T07:15:05Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-3qm6-wcp5-fx9f",
|
||||
"modified": "2024-11-29T12:31:48Z",
|
||||
"published": "2024-11-29T12:31:48Z",
|
||||
"aliases": [
|
||||
"CVE-2024-11013"
|
||||
],
|
||||
"details": "Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVERGE IX-R/IX-V Ver1.2.15 and earlier allows a attacker to inject an arbitrary CLI commands to be executed on the device via the management interface.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11013"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://https://jpn.nec.com/security-info/secinfo/nv24-009_en.html"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-77"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-11-29T08:15:03Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-773m-x37x-96wr",
|
||||
"modified": "2024-11-29T12:31:49Z",
|
||||
"published": "2024-11-29T12:31:49Z",
|
||||
"aliases": [
|
||||
"CVE-2024-9044"
|
||||
],
|
||||
"details": "A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9044"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.ag.ch/de/verwaltung/dfr/steuern/natuerliche-personen/steuererklaerung-easytax"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-611"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-11-29T08:15:05Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,40 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-88vw-p4cx-4677",
|
||||
"modified": "2024-11-29T12:31:49Z",
|
||||
"published": "2024-11-29T12:31:49Z",
|
||||
"aliases": [
|
||||
"CVE-2024-11983"
|
||||
],
|
||||
"details": "Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject arbitrary system commands into a specific SSH function and execute them on the device.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11983"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.twcert.org.tw/en/cp-139-8280-ae6e1-2.html"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.twcert.org.tw/tw/cp-132-8279-bf67e-1.html"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-78"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-11-29T08:15:04Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-f63f-f9wj-5wjg",
|
||||
"modified": "2024-11-29T12:31:49Z",
|
||||
"published": "2024-11-29T12:31:49Z",
|
||||
"aliases": [
|
||||
"CVE-2024-47094"
|
||||
],
|
||||
"details": "Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p22, <2.2.0p37, <2.1.0p50 (EOL) causes remote site secrets to be written to web log files accessible to local site users.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V4",
|
||||
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47094"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://checkmk.com/werk/17342"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-532"
|
||||
],
|
||||
"severity": "MODERATE",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-11-29T10:15:10Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-fr2x-xwp6-rg7p",
|
||||
"modified": "2024-11-29T12:31:48Z",
|
||||
"published": "2024-11-29T12:31:48Z",
|
||||
"aliases": [
|
||||
"CVE-2024-11481"
|
||||
],
|
||||
"details": "A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11481"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://thrive.trellix.com/s/article/000014058"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-22"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-11-29T08:15:04Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,40 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-g6j3-5m8r-7p3c",
|
||||
"modified": "2024-11-29T12:31:49Z",
|
||||
"published": "2024-11-29T12:31:49Z",
|
||||
"aliases": [
|
||||
"CVE-2024-50357"
|
||||
],
|
||||
"details": "FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration makes http-server (GUI) enabled, which means REST-APIs are also enabled. The username and the password for REST-APIs are configured in the factory default configuration. As a result, an attacker may obtain and/or alter the affected product's settings via REST-APIs.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50357"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://jvn.jp/en/vu/JVNVU95001899"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.centurysys.co.jp/backnumber/nxr_common/20241031-01.html"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-684"
|
||||
],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-11-29T10:15:10Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,40 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-rwv8-hfhp-fj52",
|
||||
"modified": "2024-11-29T12:31:48Z",
|
||||
"published": "2024-11-29T12:31:48Z",
|
||||
"aliases": [
|
||||
"CVE-2024-11982"
|
||||
],
|
||||
"details": "Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve plaintext passwords.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11982"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.twcert.org.tw/en/cp-139-8278-cb581-2.html"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://www.twcert.org.tw/tw/cp-132-8277-88b20-1.html"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-256"
|
||||
],
|
||||
"severity": "HIGH",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-11-29T08:15:04Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-whhw-2v2c-qg98",
|
||||
"modified": "2024-11-29T12:31:48Z",
|
||||
"published": "2024-11-29T12:31:48Z",
|
||||
"aliases": [
|
||||
"CVE-2024-11482"
|
||||
],
|
||||
"details": "A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
||||
}
|
||||
],
|
||||
"affected": [],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11482"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://thrive.trellix.com/s/article/000014058#h2_0"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
"CWE-78"
|
||||
],
|
||||
"severity": "CRITICAL",
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-11-29T08:15:04Z"
|
||||
}
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user