diff --git a/advisories/unreviewed/2022/04/GHSA-rvg2-vh9m-cq32/GHSA-rvg2-vh9m-cq32.json b/advisories/unreviewed/2022/04/GHSA-rvg2-vh9m-cq32/GHSA-rvg2-vh9m-cq32.json index 45fb1a9939b..bc79151f31e 100644 --- a/advisories/unreviewed/2022/04/GHSA-rvg2-vh9m-cq32/GHSA-rvg2-vh9m-cq32.json +++ b/advisories/unreviewed/2022/04/GHSA-rvg2-vh9m-cq32/GHSA-rvg2-vh9m-cq32.json @@ -52,6 +52,10 @@ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2024/01/03/6" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/01/03/7" } ], "database_specific": { diff --git a/advisories/unreviewed/2023/12/GHSA-2x74-jrhg-mr4p/GHSA-2x74-jrhg-mr4p.json b/advisories/unreviewed/2023/12/GHSA-2x74-jrhg-mr4p/GHSA-2x74-jrhg-mr4p.json index a7a08bda38b..53921a583e1 100644 --- a/advisories/unreviewed/2023/12/GHSA-2x74-jrhg-mr4p/GHSA-2x74-jrhg-mr4p.json +++ b/advisories/unreviewed/2023/12/GHSA-2x74-jrhg-mr4p/GHSA-2x74-jrhg-mr4p.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-2x74-jrhg-mr4p", - "modified": "2023-12-25T09:30:21Z", + "modified": "2024-01-04T00:30:19Z", "published": "2023-12-25T09:30:21Z", "aliases": [ "CVE-2023-49954" ], "details": "The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-25T08:15:07Z" diff --git a/advisories/unreviewed/2023/12/GHSA-3253-93gv-fv6c/GHSA-3253-93gv-fv6c.json b/advisories/unreviewed/2023/12/GHSA-3253-93gv-fv6c/GHSA-3253-93gv-fv6c.json index d51fda26910..9306d993f4a 100644 --- a/advisories/unreviewed/2023/12/GHSA-3253-93gv-fv6c/GHSA-3253-93gv-fv6c.json +++ b/advisories/unreviewed/2023/12/GHSA-3253-93gv-fv6c/GHSA-3253-93gv-fv6c.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-3253-93gv-fv6c", - "modified": "2023-12-25T09:30:21Z", + "modified": "2024-01-04T00:30:19Z", "published": "2023-12-25T09:30:21Z", "aliases": [ "CVE-2023-36485" ], "details": "The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user via a malicious BPMN2 workflow definition file.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -35,7 +38,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-25T08:15:07Z" diff --git a/advisories/unreviewed/2023/12/GHSA-7246-m99m-q4pq/GHSA-7246-m99m-q4pq.json b/advisories/unreviewed/2023/12/GHSA-7246-m99m-q4pq/GHSA-7246-m99m-q4pq.json index ae6b550f650..6b3e62e519e 100644 --- a/advisories/unreviewed/2023/12/GHSA-7246-m99m-q4pq/GHSA-7246-m99m-q4pq.json +++ b/advisories/unreviewed/2023/12/GHSA-7246-m99m-q4pq/GHSA-7246-m99m-q4pq.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-7246-m99m-q4pq", - "modified": "2023-12-25T09:30:21Z", + "modified": "2024-01-04T00:30:20Z", "published": "2023-12-25T09:30:21Z", "aliases": [ "CVE-2023-38321" ], "details": "OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference, daemon crash, and Captive Portal outage) via a GET request to /opennds_auth/ that lacks a custom query string parameter and client-token.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-476" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-25T09:15:07Z" diff --git a/advisories/unreviewed/2023/12/GHSA-8wjx-p2f8-5rjp/GHSA-8wjx-p2f8-5rjp.json b/advisories/unreviewed/2023/12/GHSA-8wjx-p2f8-5rjp/GHSA-8wjx-p2f8-5rjp.json index f48aeb5e9c9..2d8093e573e 100644 --- a/advisories/unreviewed/2023/12/GHSA-8wjx-p2f8-5rjp/GHSA-8wjx-p2f8-5rjp.json +++ b/advisories/unreviewed/2023/12/GHSA-8wjx-p2f8-5rjp/GHSA-8wjx-p2f8-5rjp.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-8wjx-p2f8-5rjp", - "modified": "2023-12-26T06:30:33Z", + "modified": "2024-01-04T00:30:20Z", "published": "2023-12-26T06:30:33Z", "aliases": [ "CVE-2023-27150" ], "details": "openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-26T04:15:07Z" diff --git a/advisories/unreviewed/2023/12/GHSA-9cxj-f8g7-43v7/GHSA-9cxj-f8g7-43v7.json b/advisories/unreviewed/2023/12/GHSA-9cxj-f8g7-43v7/GHSA-9cxj-f8g7-43v7.json index da6409bbc70..aedc61f3cf9 100644 --- a/advisories/unreviewed/2023/12/GHSA-9cxj-f8g7-43v7/GHSA-9cxj-f8g7-43v7.json +++ b/advisories/unreviewed/2023/12/GHSA-9cxj-f8g7-43v7/GHSA-9cxj-f8g7-43v7.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9cxj-f8g7-43v7", - "modified": "2023-12-25T09:30:21Z", + "modified": "2024-01-04T00:30:19Z", "published": "2023-12-25T09:30:21Z", "aliases": [ "CVE-2023-31224" ], "details": "There is broken access control during authentication in Jamf Pro Server before 10.46.1.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-287" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-25T08:15:07Z" diff --git a/advisories/unreviewed/2023/12/GHSA-9rg4-33x9-wfrh/GHSA-9rg4-33x9-wfrh.json b/advisories/unreviewed/2023/12/GHSA-9rg4-33x9-wfrh/GHSA-9rg4-33x9-wfrh.json index 411ea8fc22e..20e26f079c7 100644 --- a/advisories/unreviewed/2023/12/GHSA-9rg4-33x9-wfrh/GHSA-9rg4-33x9-wfrh.json +++ b/advisories/unreviewed/2023/12/GHSA-9rg4-33x9-wfrh/GHSA-9rg4-33x9-wfrh.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9rg4-33x9-wfrh", - "modified": "2023-12-25T09:30:21Z", + "modified": "2024-01-04T00:30:19Z", "published": "2023-12-25T09:30:21Z", "aliases": [ "CVE-2023-49944" ], "details": "The Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local administrators to bypass this feature by decrypting the shared key, or by locating the decrypted shared key in process memory. The threat is mitigated by the Agent Protection feature.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-25T08:15:07Z" diff --git a/advisories/unreviewed/2023/12/GHSA-9w73-mrh2-35pj/GHSA-9w73-mrh2-35pj.json b/advisories/unreviewed/2023/12/GHSA-9w73-mrh2-35pj/GHSA-9w73-mrh2-35pj.json index d2a111df7d6..83cf4132e8f 100644 --- a/advisories/unreviewed/2023/12/GHSA-9w73-mrh2-35pj/GHSA-9w73-mrh2-35pj.json +++ b/advisories/unreviewed/2023/12/GHSA-9w73-mrh2-35pj/GHSA-9w73-mrh2-35pj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9w73-mrh2-35pj", - "modified": "2023-12-25T09:30:21Z", + "modified": "2024-01-04T00:30:19Z", "published": "2023-12-25T09:30:21Z", "aliases": [ "CVE-2023-36486" ], "details": "The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user by uploading a workflow definition file with a malicious filename.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -35,7 +38,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-25T08:15:07Z" diff --git a/advisories/unreviewed/2023/12/GHSA-j3jw-c3vp-jg36/GHSA-j3jw-c3vp-jg36.json b/advisories/unreviewed/2023/12/GHSA-j3jw-c3vp-jg36/GHSA-j3jw-c3vp-jg36.json index d2e852bb3f6..a9d9c91a670 100644 --- a/advisories/unreviewed/2023/12/GHSA-j3jw-c3vp-jg36/GHSA-j3jw-c3vp-jg36.json +++ b/advisories/unreviewed/2023/12/GHSA-j3jw-c3vp-jg36/GHSA-j3jw-c3vp-jg36.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-j3jw-c3vp-jg36", - "modified": "2023-12-25T09:30:21Z", + "modified": "2024-01-04T00:30:19Z", "published": "2023-12-25T09:30:21Z", "aliases": [ "CVE-2023-49226" ], "details": "An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-77" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-25T08:15:07Z" diff --git a/advisories/unreviewed/2023/12/GHSA-pc38-vvqw-jq9r/GHSA-pc38-vvqw-jq9r.json b/advisories/unreviewed/2023/12/GHSA-pc38-vvqw-jq9r/GHSA-pc38-vvqw-jq9r.json index 7e5267d13c2..3d29fbe8a12 100644 --- a/advisories/unreviewed/2023/12/GHSA-pc38-vvqw-jq9r/GHSA-pc38-vvqw-jq9r.json +++ b/advisories/unreviewed/2023/12/GHSA-pc38-vvqw-jq9r/GHSA-pc38-vvqw-jq9r.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-pc38-vvqw-jq9r", - "modified": "2023-12-25T09:30:21Z", + "modified": "2024-01-04T00:30:19Z", "published": "2023-12-25T09:30:21Z", "aliases": [ "CVE-2023-38826" ], "details": "A Cross Site Scripting (XSS) vulnerability exists in Follet Learning Solutions Destiny through 20.0_1U. via the handlewpesearchform.do. searchString.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-25T08:15:07Z" diff --git a/advisories/unreviewed/2023/12/GHSA-q565-26vc-vpx8/GHSA-q565-26vc-vpx8.json b/advisories/unreviewed/2023/12/GHSA-q565-26vc-vpx8/GHSA-q565-26vc-vpx8.json index d36978602b1..0a82cb25beb 100644 --- a/advisories/unreviewed/2023/12/GHSA-q565-26vc-vpx8/GHSA-q565-26vc-vpx8.json +++ b/advisories/unreviewed/2023/12/GHSA-q565-26vc-vpx8/GHSA-q565-26vc-vpx8.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-q565-26vc-vpx8", - "modified": "2023-12-25T09:30:21Z", + "modified": "2024-01-04T00:30:19Z", "published": "2023-12-25T09:30:21Z", "aliases": [ "CVE-2022-34268" ], "details": "An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the host.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-502" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-25T08:15:07Z" diff --git a/advisories/unreviewed/2024/01/GHSA-32h2-7245-4mh4/GHSA-32h2-7245-4mh4.json b/advisories/unreviewed/2024/01/GHSA-32h2-7245-4mh4/GHSA-32h2-7245-4mh4.json new file mode 100644 index 00000000000..451cd799356 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-32h2-7245-4mh4/GHSA-32h2-7245-4mh4.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-32h2-7245-4mh4", + "modified": "2024-01-04T00:30:20Z", + "published": "2024-01-04T00:30:20Z", + "aliases": [ + "CVE-2023-5138" + ], + "details": "Glitch detection is not enabled by default for the CortexM33 core in Silicon Labs secure vault high parts EFx32xG2xB, except EFR32xG21B.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5138" + }, + { + "type": "WEB", + "url": "https://community.silabs.com/069Vm0000004f6DIAQ" + }, + { + "type": "WEB", + "url": "https://github.com/SiliconLabs/gecko_sdk" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-909" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-03T23:15:08Z" + } +} \ No newline at end of file