From cd3ba99f0301adab87012aa8ee3f635d87db28ea Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 25 Jul 2024 12:33:28 +0000 Subject: [PATCH] Publish Advisories GHSA-5ggc-7h9v-5396 GHSA-5h92-393w-8jc6 GHSA-5p3h-jv56-rj58 GHSA-gjgq-589q-fh55 GHSA-h97q-2rxr-wfvp GHSA-j8gc-p4v9-w5pj GHSA-p528-3mvf-gr87 GHSA-w9r5-vvjm-q25m --- .../GHSA-5ggc-7h9v-5396.json | 50 +++++++++++++++++++ .../GHSA-5h92-393w-8jc6.json | 38 ++++++++++++++ .../GHSA-5p3h-jv56-rj58.json | 38 ++++++++++++++ .../GHSA-gjgq-589q-fh55.json | 38 ++++++++++++++ .../GHSA-h97q-2rxr-wfvp.json | 38 ++++++++++++++ .../GHSA-j8gc-p4v9-w5pj.json | 38 ++++++++++++++ .../GHSA-p528-3mvf-gr87.json | 38 ++++++++++++++ .../GHSA-w9r5-vvjm-q25m.json | 38 ++++++++++++++ 8 files changed, 316 insertions(+) create mode 100644 advisories/unreviewed/2024/07/GHSA-5ggc-7h9v-5396/GHSA-5ggc-7h9v-5396.json create mode 100644 advisories/unreviewed/2024/07/GHSA-5h92-393w-8jc6/GHSA-5h92-393w-8jc6.json create mode 100644 advisories/unreviewed/2024/07/GHSA-5p3h-jv56-rj58/GHSA-5p3h-jv56-rj58.json create mode 100644 advisories/unreviewed/2024/07/GHSA-gjgq-589q-fh55/GHSA-gjgq-589q-fh55.json create mode 100644 advisories/unreviewed/2024/07/GHSA-h97q-2rxr-wfvp/GHSA-h97q-2rxr-wfvp.json create mode 100644 advisories/unreviewed/2024/07/GHSA-j8gc-p4v9-w5pj/GHSA-j8gc-p4v9-w5pj.json create mode 100644 advisories/unreviewed/2024/07/GHSA-p528-3mvf-gr87/GHSA-p528-3mvf-gr87.json create mode 100644 advisories/unreviewed/2024/07/GHSA-w9r5-vvjm-q25m/GHSA-w9r5-vvjm-q25m.json diff --git a/advisories/unreviewed/2024/07/GHSA-5ggc-7h9v-5396/GHSA-5ggc-7h9v-5396.json b/advisories/unreviewed/2024/07/GHSA-5ggc-7h9v-5396/GHSA-5ggc-7h9v-5396.json new file mode 100644 index 00000000000..6ab02898e43 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-5ggc-7h9v-5396/GHSA-5ggc-7h9v-5396.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5ggc-7h9v-5396", + "modified": "2024-07-25T12:32:00Z", + "published": "2024-07-25T12:32:00Z", + "aliases": [ + "CVE-2024-6589" + ], + "details": "The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'render_content_block_template' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6589" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.2.6.8.2/inc/block-template/class-block-template-archive-course.php#L28" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.2.6.8.2/inc/block-template/class-block-template-single-course.php#L28" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3124296" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ba79bf95-08f8-4aa6-968b-f76a09ce52b8?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-98" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-25T11:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-5h92-393w-8jc6/GHSA-5h92-393w-8jc6.json b/advisories/unreviewed/2024/07/GHSA-5h92-393w-8jc6/GHSA-5h92-393w-8jc6.json new file mode 100644 index 00000000000..193c10c6db0 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-5h92-393w-8jc6/GHSA-5h92-393w-8jc6.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5h92-393w-8jc6", + "modified": "2024-07-25T12:32:02Z", + "published": "2024-07-25T12:32:02Z", + "aliases": [ + "CVE-2024-39674" + ], + "details": "Plaintext vulnerability in the Gallery search module.\nImpact: Successful exploitation of this vulnerability will affect availability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39674" + }, + { + "type": "WEB", + "url": "https://consumer.huawei.com/en/support/bulletin/2024/7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-312" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-25T12:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-5p3h-jv56-rj58/GHSA-5p3h-jv56-rj58.json b/advisories/unreviewed/2024/07/GHSA-5p3h-jv56-rj58/GHSA-5p3h-jv56-rj58.json new file mode 100644 index 00000000000..608974d33f7 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-5p3h-jv56-rj58/GHSA-5p3h-jv56-rj58.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5p3h-jv56-rj58", + "modified": "2024-07-25T12:32:01Z", + "published": "2024-07-25T12:32:01Z", + "aliases": [ + "CVE-2024-39672" + ], + "details": "Memory request logic vulnerability in the memory module.\nImpact: Successful exploitation of this vulnerability will affect integrity and availability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39672" + }, + { + "type": "WEB", + "url": "https://consumer.huawei.com/en/support/bulletin/2024/7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-25T12:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-gjgq-589q-fh55/GHSA-gjgq-589q-fh55.json b/advisories/unreviewed/2024/07/GHSA-gjgq-589q-fh55/GHSA-gjgq-589q-fh55.json new file mode 100644 index 00000000000..56fd6f96152 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-gjgq-589q-fh55/GHSA-gjgq-589q-fh55.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gjgq-589q-fh55", + "modified": "2024-07-25T12:32:00Z", + "published": "2024-07-25T12:32:00Z", + "aliases": [ + "CVE-2023-7271" + ], + "details": "Privilege escalation vulnerability in the NMS module\nImpact: Successful exploitation of this vulnerability will affect availability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7271" + }, + { + "type": "WEB", + "url": "https://consumer.huawei.com/en/support/bulletin/2024/7" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-25T12:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-h97q-2rxr-wfvp/GHSA-h97q-2rxr-wfvp.json b/advisories/unreviewed/2024/07/GHSA-h97q-2rxr-wfvp/GHSA-h97q-2rxr-wfvp.json new file mode 100644 index 00000000000..9da194b89d3 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-h97q-2rxr-wfvp/GHSA-h97q-2rxr-wfvp.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h97q-2rxr-wfvp", + "modified": "2024-07-25T12:32:02Z", + "published": "2024-07-25T12:32:02Z", + "aliases": [ + "CVE-2024-39673" + ], + "details": "Vulnerability of serialisation/deserialisation mismatch in the iAware module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39673" + }, + { + "type": "WEB", + "url": "https://consumer.huawei.com/en/support/bulletin/2024/7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-26" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-25T12:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-j8gc-p4v9-w5pj/GHSA-j8gc-p4v9-w5pj.json b/advisories/unreviewed/2024/07/GHSA-j8gc-p4v9-w5pj/GHSA-j8gc-p4v9-w5pj.json new file mode 100644 index 00000000000..9dc8bd8df40 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-j8gc-p4v9-w5pj/GHSA-j8gc-p4v9-w5pj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j8gc-p4v9-w5pj", + "modified": "2024-07-25T12:32:01Z", + "published": "2024-07-25T12:32:01Z", + "aliases": [ + "CVE-2024-39670" + ], + "details": "Privilege escalation vulnerability in the account synchronisation module.\nImpact: Successful exploitation of this vulnerability will affect availability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39670" + }, + { + "type": "WEB", + "url": "https://consumer.huawei.com/en/support/bulletin/2024/7" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-25T12:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-p528-3mvf-gr87/GHSA-p528-3mvf-gr87.json b/advisories/unreviewed/2024/07/GHSA-p528-3mvf-gr87/GHSA-p528-3mvf-gr87.json new file mode 100644 index 00000000000..8096097f5d9 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-p528-3mvf-gr87/GHSA-p528-3mvf-gr87.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p528-3mvf-gr87", + "modified": "2024-07-25T12:32:00Z", + "published": "2024-07-25T12:32:00Z", + "aliases": [ + "CVE-2024-37084" + ], + "details": "In Spring Cloud Data Flow versions prior to 2.11.4,  a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37084" + }, + { + "type": "WEB", + "url": "https://spring.io/security/cve-2024-37084" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-25T10:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-w9r5-vvjm-q25m/GHSA-w9r5-vvjm-q25m.json b/advisories/unreviewed/2024/07/GHSA-w9r5-vvjm-q25m/GHSA-w9r5-vvjm-q25m.json new file mode 100644 index 00000000000..3588db80849 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-w9r5-vvjm-q25m/GHSA-w9r5-vvjm-q25m.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w9r5-vvjm-q25m", + "modified": "2024-07-25T12:32:01Z", + "published": "2024-07-25T12:32:01Z", + "aliases": [ + "CVE-2024-39671" + ], + "details": "Access control vulnerability in the security verification module.\nImpact: Successful exploitation of this vulnerability may affect service confidentiality.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39671" + }, + { + "type": "WEB", + "url": "https://consumer.huawei.com/en/support/bulletin/2024/7" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-25T12:15:02Z" + } +} \ No newline at end of file