Publish Advisories

GHSA-vmq6-5m68-f53m
GHSA-9gp8-6cg8-7h34
GHSA-9442-gm4v-r222
GHSA-4gc7-5j7h-4qph
GHSA-9mq2-v988-m7mr
GHSA-fp86-2355-v99r
GHSA-3q6h-q44p-xw88
GHSA-6v7c-pq5w-2jwg
GHSA-w9cc-xrp8-ffx4
GHSA-45cm-4v3w-5jpw
GHSA-x3h8-3mf2-v794
GHSA-2r3m-26p3-wr26
GHSA-3qm6-wcp5-fx9f
GHSA-773m-x37x-96wr
GHSA-88vw-p4cx-4677
GHSA-f63f-f9wj-5wjg
GHSA-fr2x-xwp6-rg7p
GHSA-g6j3-5m8r-7p3c
GHSA-rwv8-hfhp-fj52
GHSA-whhw-2v2c-qg98
GHSA-xhf4-qqf8-2pw6
This commit is contained in:
advisory-database[bot]
2024-11-29 12:33:15 +00:00
parent 1522866be5
commit ca62fbddeb
21 changed files with 456 additions and 38 deletions
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vmq6-5m68-f53m",
"modified": "2023-12-05T21:31:10Z",
"modified": "2024-11-29T12:31:48Z",
"published": "2023-11-29T12:30:16Z",
"aliases": [
"CVE-2023-6378"
@@ -166,6 +166,10 @@
{
"type": "WEB",
"url": "https://logback.qos.ch/news.html#1.3.12"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241129-0012"
}
],
"database_specific": {
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9gp8-6cg8-7h34",
"modified": "2024-02-12T21:34:32Z",
"modified": "2024-11-29T12:31:48Z",
"published": "2024-02-06T00:30:25Z",
"aliases": [
"CVE-2023-34042"
@@ -117,6 +117,10 @@
"type": "PACKAGE",
"url": "https://github.com/spring-projects/spring-security"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241129-0010"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2023-34042"
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9442-gm4v-r222",
"modified": "2024-10-17T14:08:20Z",
"modified": "2024-11-29T12:31:48Z",
"published": "2024-06-20T15:31:19Z",
"aliases": [
"CVE-2024-6162"
@@ -109,6 +109,10 @@
{
"type": "WEB",
"url": "https://issues.redhat.com/browse/UNDERTOW-2334"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241129-0009"
}
],
"database_specific": {
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4gc7-5j7h-4qph",
"modified": "2024-11-05T22:01:57Z",
"modified": "2024-11-29T12:31:48Z",
"published": "2024-10-18T06:30:32Z",
"aliases": [
"CVE-2024-38820"
@@ -52,6 +52,10 @@
"type": "WEB",
"url": "https://github.com/spring-projects/spring-framework/commits/v6.2.0-RC2"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241129-0003"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2024-38820"
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9mq2-v988-m7mr",
"modified": "2022-09-25T00:00:26Z",
"modified": "2024-11-29T12:31:47Z",
"published": "2022-09-22T00:00:32Z",
"aliases": [
"CVE-2022-2795"
@@ -13,9 +13,7 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -29,6 +27,18 @@
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00007.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7"
@@ -45,6 +55,10 @@
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202210-25"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241129-0002"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5235"
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fp86-2355-v99r",
"modified": "2023-04-13T21:30:27Z",
"modified": "2024-11-29T12:31:47Z",
"published": "2023-04-06T18:30:21Z",
"aliases": [
"CVE-2023-24537"
@@ -38,6 +38,10 @@
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202311-09"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241129-0004"
}
],
"database_specific": {
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3q6h-q44p-xw88",
"modified": "2024-04-04T04:02:36Z",
"modified": "2024-11-29T12:31:47Z",
"published": "2023-05-11T18:30:17Z",
"aliases": [
"CVE-2023-24539"
@@ -13,9 +13,7 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -36,6 +34,10 @@
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2023-1751"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241129-0005"
}
],
"database_specific": {
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6v7c-pq5w-2jwg",
"modified": "2023-05-10T00:30:16Z",
"modified": "2024-11-29T12:31:47Z",
"published": "2023-05-10T00:30:16Z",
"aliases": [
"CVE-2023-2610"
@@ -13,9 +13,7 @@
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -41,6 +39,10 @@
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PCLJN4QINITA3ZASKLEJ64C5TFNKELMO"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241129-0006"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT213844"
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w9cc-xrp8-ffx4",
"modified": "2024-04-04T07:08:10Z",
"modified": "2024-11-29T12:31:47Z",
"published": "2023-08-22T21:30:27Z",
"aliases": [
"CVE-2022-48174"
@@ -13,9 +13,7 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -24,6 +22,10 @@
{
"type": "WEB",
"url": "https://bugs.busybox.net/show_bug.cgi?id=15216"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241129-0001"
}
],
"database_specific": {
File diff suppressed because one or more lines are too long
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-x3h8-3mf2-v794",
"modified": "2024-08-01T15:32:07Z",
"modified": "2024-11-29T12:31:48Z",
"published": "2024-07-24T09:30:40Z",
"aliases": [
"CVE-2024-6197"
@@ -13,9 +13,7 @@
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
],
"affected": [],
"references": [
{
"type": "ADVISORY",
@@ -33,6 +31,10 @@
"type": "WEB",
"url": "https://curl.se/docs/CVE-2024-6197.json"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20241129-0008"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/07/24/1"
@@ -43,9 +45,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2r3m-26p3-wr26",
"modified": "2024-11-29T12:31:48Z",
"published": "2024-11-29T12:31:48Z",
"aliases": [
"CVE-2024-11981"
],
"details": "Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11981"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/en/cp-139-8276-1defb-2.html"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-8275-50f42-1.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-29T07:15:05Z"
}
}
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3qm6-wcp5-fx9f",
"modified": "2024-11-29T12:31:48Z",
"published": "2024-11-29T12:31:48Z",
"aliases": [
"CVE-2024-11013"
],
"details": "Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVERGE IX-R/IX-V Ver1.2.15 and earlier allows a attacker to inject an arbitrary CLI commands to be executed on the device via the management interface.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11013"
},
{
"type": "WEB",
"url": "https://https://jpn.nec.com/security-info/secinfo/nv24-009_en.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-29T08:15:03Z"
}
}
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-773m-x37x-96wr",
"modified": "2024-11-29T12:31:49Z",
"published": "2024-11-29T12:31:49Z",
"aliases": [
"CVE-2024-9044"
],
"details": "A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9044"
},
{
"type": "WEB",
"url": "https://www.ag.ch/de/verwaltung/dfr/steuern/natuerliche-personen/steuererklaerung-easytax"
}
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-29T08:15:05Z"
}
}
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-88vw-p4cx-4677",
"modified": "2024-11-29T12:31:49Z",
"published": "2024-11-29T12:31:49Z",
"aliases": [
"CVE-2024-11983"
],
"details": "Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject arbitrary system commands into a specific SSH function and execute them on the device.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11983"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/en/cp-139-8280-ae6e1-2.html"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-8279-bf67e-1.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-29T08:15:04Z"
}
}
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f63f-f9wj-5wjg",
"modified": "2024-11-29T12:31:49Z",
"published": "2024-11-29T12:31:49Z",
"aliases": [
"CVE-2024-47094"
],
"details": "Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p22, <2.2.0p37, <2.1.0p50 (EOL) causes remote site secrets to be written to web log files accessible to local site users.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47094"
},
{
"type": "WEB",
"url": "https://checkmk.com/werk/17342"
}
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-29T10:15:10Z"
}
}
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fr2x-xwp6-rg7p",
"modified": "2024-11-29T12:31:48Z",
"published": "2024-11-29T12:31:48Z",
"aliases": [
"CVE-2024-11481"
],
"details": "A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11481"
},
{
"type": "WEB",
"url": "https://thrive.trellix.com/s/article/000014058"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-29T08:15:04Z"
}
}
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g6j3-5m8r-7p3c",
"modified": "2024-11-29T12:31:49Z",
"published": "2024-11-29T12:31:49Z",
"aliases": [
"CVE-2024-50357"
],
"details": "FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration makes http-server (GUI) enabled, which means REST-APIs are also enabled. The username and the password for REST-APIs are configured in the factory default configuration. As a result, an attacker may obtain and/or alter the affected product's settings via REST-APIs.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50357"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU95001899"
},
{
"type": "WEB",
"url": "https://www.centurysys.co.jp/backnumber/nxr_common/20241031-01.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-684"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-29T10:15:10Z"
}
}
@@ -0,0 +1,40 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rwv8-hfhp-fj52",
"modified": "2024-11-29T12:31:48Z",
"published": "2024-11-29T12:31:48Z",
"aliases": [
"CVE-2024-11982"
],
"details": "Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve plaintext passwords.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11982"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/en/cp-139-8278-cb581-2.html"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-8277-88b20-1.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-29T08:15:04Z"
}
}
@@ -0,0 +1,36 @@
{
"schema_version": "1.4.0",
"id": "GHSA-whhw-2v2c-qg98",
"modified": "2024-11-29T12:31:48Z",
"published": "2024-11-29T12:31:48Z",
"aliases": [
"CVE-2024-11482"
],
"details": "A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, executed as the root user.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11482"
},
{
"type": "WEB",
"url": "https://thrive.trellix.com/s/article/000014058#h2_0"
}
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-29T08:15:04Z"
}
}

Some files were not shown because too many files have changed in this diff Show More