Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-09-05 21:33:14 +00:00
parent f84252ecc9
commit cd272ebac8
33 changed files with 323 additions and 80 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-prcq-52f8-fp44",
-  "modified": "2024-02-23T21:02:00Z",
+  "modified": "2024-09-05T21:32:21Z",
  "published": "2022-05-17T05:19:14Z",
  "aliases": [
    "CVE-2012-3446"
@@ -48,6 +48,10 @@
      "type": "PACKAGE",
      "url": "https://github.com/apache/libcloud"
    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/apache-libcloud/PYSEC-2012-12.yaml"
+    },
    {
      "type": "WEB",
      "url": "https://svn.apache.org/repos/asf/libcloud/trunk/CHANGES"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9cqc-m6m2-286c",
-  "modified": "2022-05-24T17:27:40Z",
+  "modified": "2024-09-05T21:31:32Z",
  "published": "2022-05-24T17:27:40Z",
  "aliases": [
    "CVE-2020-24198"
  ],
  "details": "A persistent cross-site scripting vulnerability in Sourcecodester Stock Management System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'Brand Name.'",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -22,6 +25,10 @@
      "type": "WEB",
      "url": "https://cxsecurity.com/issue/WLB-2020090024"
    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Ambarella-Inc/amba-cve-info/tree/main/cve-2020-24918"
+    },
    {
      "type": "WEB",
      "url": "https://www.sourcecodester.com/php/14366/stock-management-system-php.html"
@@ -29,7 +36,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-400"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-400"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4mgj-2pcm-grp4",
-  "modified": "2023-11-09T03:30:19Z",
+  "modified": "2024-09-05T21:31:32Z",
  "published": "2023-11-02T00:30:32Z",
  "aliases": [
    "CVE-2023-44954"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-qvcf-7rv4-rh36",
-  "modified": "2023-11-14T21:30:50Z",
+  "modified": "2024-09-05T21:31:33Z",
  "published": "2023-11-06T06:30:27Z",
  "aliases": [
    "CVE-2023-47253"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-36xj-gcr2-cgrf",
-  "modified": "2024-02-05T15:30:23Z",
+  "modified": "2024-09-05T21:31:33Z",
  "published": "2024-01-24T18:31:01Z",
  "aliases": [
    "CVE-2023-51888"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-gf9w-j28x-vmch",
-  "modified": "2024-02-03T00:31:32Z",
+  "modified": "2024-09-05T21:31:33Z",
  "published": "2024-01-29T15:30:29Z",
  "aliases": [
    "CVE-2023-6503"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-mxxf-4gg8-94vw",
-  "modified": "2024-08-26T12:31:19Z",
+  "modified": "2024-09-05T21:31:33Z",
  "published": "2024-08-26T12:31:19Z",
  "aliases": [
    "CVE-2024-43890"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix overflow in get_free_elt()\n\n\"tracing_map->next_elt\" in get_free_elt() is at risk of overflowing.\n\nOnce it overflows, new elements can still be inserted into the tracing_map\neven though the maximum number of elements (`max_elts`) has been reached.\nContinuing to insert elements after the overflow could result in the\ntracing_map containing \"tracing_map->max_size\" elements, leaving no empty\nentries.\nIf any attempt is made to insert an element into a full tracing_map using\n`__tracing_map_insert()`, it will cause an infinite loop with preemption\ndisabled, leading to a CPU hang problem.\n\nFix this by preventing any further increments to \"tracing_map->next_elt\"\nonce it reaches \"tracing_map->max_elt\".",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -53,9 +56,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-190"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-26T11:15:04Z"
@@ -1,13 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-rcmr-c4gr-768m",
-  "modified": "2024-08-28T06:30:31Z",
+  "modified": "2024-09-05T21:31:33Z",
  "published": "2024-08-26T18:33:34Z",
  "aliases": [
    "CVE-2024-7401"
  ],
  "details": "Netskope was notified about a security gap in Netskope Client enrollment process where NSClient is using a static token “Orgkey” as authentication parameter. Since this a static token, if leaked, cannot be rotated or revoked. A malicious actor can use this token to enroll NSClient from a customer’s tenant and impersonate a user.",
  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
+    },
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-vhvg-rmxw-qrqr",
-  "modified": "2024-08-28T21:31:28Z",
+  "modified": "2024-09-05T21:31:33Z",
  "published": "2024-08-26T18:33:34Z",
  "aliases": [
    "CVE-2024-42913"
  ],
  "details": "RuoYi CMS v4.7.9 was discovered to contain a SQL injection vulnerability via the job_id parameter at /sasfs1.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-89"
    ],
-    "severity": null,
+    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-26T18:15:07Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-w88v-q2mr-5mff",
-  "modified": "2024-08-26T12:31:19Z",
+  "modified": "2024-09-05T21:31:33Z",
  "published": "2024-08-26T12:31:19Z",
  "aliases": [
    "CVE-2024-43896"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: cs-amp-lib: Fix NULL pointer crash if efi.get_variable is NULL\n\nCall efi_rt_services_supported() to check that efi.get_variable exists\nbefore calling it.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-476"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-26T11:15:04Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5qmx-gqwp-wvwm",
-  "modified": "2024-09-05T18:30:56Z",
+  "modified": "2024-09-05T21:31:34Z",
  "published": "2024-09-05T18:30:56Z",
  "aliases": [
    "CVE-2024-45171"
  ],
  "details": "An issue was discovered in za-internet C-MOR Video Surveillance 5.2401. Due to improper user input validation, it is possible to upload dangerous files, for instance PHP code, to the C-MOR system. By analyzing the C-MOR web interface, it was found out that the upload functionality for backup files allows an authenticated user to upload arbitrary files. The only condition is that the filename contains a .cbkf string. Therefore, webshell.cbkf.php is considered a valid file name for the C-MOR web application. Uploaded files are stored within the directory \"/srv/www/backups\" on the C-MOR system, and can thus be accessed via the URL https://<HOST>/backup/upload_<FILENAME>. Due to broken access control, low-privileged authenticated users can also use this file upload functionality.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-434"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-05T16:15:08Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-82fj-4p4v-8rc2",
-  "modified": "2024-09-05T18:30:57Z",
+  "modified": "2024-09-05T21:31:34Z",
  "published": "2024-09-05T18:30:57Z",
  "aliases": [
    "CVE-2024-45589"
  ],
  "details": "RapidIdentity LTS through 2023.0.2 and Cloud through 2024.08.0 improperly restricts excessive authentication attempts and allows a remote attacker to cause a denial of service via the username parameters.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-307"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-05T16:15:08Z"
--- a/Show More
+++ b/Show More