Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-09-12 21:33:07 +00:00
parent 41739fea80
commit d1cf51f8fe
51 changed files with 899 additions and 80 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-jcrr-rr6w-8c83",
-  "modified": "2023-12-22T19:51:38Z",
+  "modified": "2024-09-12T21:32:39Z",
  "published": "2023-12-22T12:31:52Z",
  "aliases": [
    "CVE-2023-49391"
@@ -55,7 +55,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-94"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2xgw-64w9-83wm",
-  "modified": "2023-02-09T21:30:28Z",
+  "modified": "2024-09-12T21:32:00Z",
  "published": "2023-02-02T18:30:48Z",
  "aliases": [
    "CVE-2023-0651"
@@ -11,6 +11,10 @@
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  ],
  "affected": [
@@ -36,6 +40,10 @@
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.220038"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.82316"
    }
  ],
  "database_specific": {
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-269"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4qww-v3r6-7335",
-  "modified": "2023-11-02T18:30:23Z",
+  "modified": "2024-09-12T21:32:00Z",
  "published": "2023-10-22T21:36:10Z",
  "aliases": [
    "CVE-2023-46306"
@@ -36,7 +36,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-284"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-200"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-94"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-400"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-6pp8-37pj-mhcc",
-  "modified": "2024-01-30T21:30:28Z",
+  "modified": "2024-09-12T21:32:00Z",
  "published": "2024-01-23T21:30:21Z",
  "aliases": [
    "CVE-2023-52325"
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-98"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4pmw-7j2g-cfp7",
-  "modified": "2024-07-29T09:36:16Z",
+  "modified": "2024-09-12T21:32:00Z",
  "published": "2024-07-29T09:36:16Z",
  "aliases": [
    "CVE-2024-41143"
  ],
  "details": "Origin validation error vulnerability exists in SKYSEA Client View Ver.3.013.00 to Ver.19.210.04e. If this vulnerability is exploited, an arbitrary process may be executed with SYSTEM privilege by a user who can log in to the PC where the product's Windows client is installed.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-346"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-29T09:15:02Z"
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-200"
+      "CWE-200",
+      "CWE-862"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-27qw-rmpj-379q",
-  "modified": "2024-08-29T18:31:35Z",
+  "modified": "2024-09-12T21:32:00Z",
  "published": "2024-08-26T12:31:20Z",
  "aliases": [
    "CVE-2024-44939"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix null ptr deref in dtInsertEntry\n\n[syzbot reported]\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 0 PID: 5061 Comm: syz-executor404 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nRIP: 0010:dtInsertEntry+0xd0c/0x1780 fs/jfs/jfs_dtree.c:3713\n...\n[Analyze]\nIn dtInsertEntry(), when the pointer h has the same value as p, after writing\nname in UniStrncpy_to_le(), p->header.flag will be cleared. This will cause the\npreviously true judgment \"p->header.flag & BT-LEAF\" to change to no after writing\nthe name operation, this leads to entering an incorrect branch and accessing the\nuninitialized object ih when judging this condition for the second time.\n\n[Fix]\nAfter got the page, check freelist first, if freelist == 0 then exit dtInsert()\nand return -EINVAL.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -37,9 +40,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-476"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-26T12:15:06Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-27rm-pvpp-228f",
-  "modified": "2024-08-23T21:30:42Z",
+  "modified": "2024-09-12T21:32:00Z",
  "published": "2024-08-23T21:30:42Z",
  "aliases": [
    "CVE-2024-37392"
  ],
  "details": "A stored Cross-Site Scripting (XSS) vulnerability has been identified in SMSEagle software version < 6.0. The vulnerability arises because the application did not properly sanitize user input in the SMS messages in the inbox. This could allow an attacker to inject malicious JavaScript code into an SMS message, which gets executed when the SMS is viewed and specially interacted in web-GUI.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-23T21:15:07Z"
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-277"
+      "CWE-277",
+      "CWE-732"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-277"
+      "CWE-277",
+      "CWE-732"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-crf2-q686-qj4r",
-  "modified": "2024-08-13T18:31:15Z",
+  "modified": "2024-09-12T21:32:00Z",
  "published": "2024-08-13T18:31:15Z",
  "aliases": [
    "CVE-2024-36446"
  ],
  "details": "The provisioning manager component of Mitel MiVoice MX-ONE through 7.6 SP1 could allow an authenticated attacker to conduct an authentication bypass attack due to improper access control. A successful exploit could allow an attacker to bypass the authorization schema.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-13T17:15:23Z"
@@ -1,13 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-pm23-3px3-qrh7",
-  "modified": "2024-08-26T00:30:54Z",
+  "modified": "2024-09-12T21:32:00Z",
  "published": "2024-08-26T00:30:54Z",
  "aliases": [
    "CVE-2024-8158"
  ],
  "details": "A bug in the 9p authentication implementation within lib9p allows an attacker with an existing valid user within the configured auth server to impersonate any other valid filesystem user.\n\nThis is due to lib9p not properly verifying that the uname given in the Tauth and Tattach 9p messages matches the client UID returned from the factotum authentication handshake.\n\n\nThe only filesystem making use of these functions within the base 9front systems is the experimental hjfs disk filesystem, other disk filesystems (cwfs and gefs) are not affected by this bug.\n\nThis bug was inherited from Plan 9 and is present in all versions of 9front and is remedied fully in commit 9645ae07eb66a59015e3e118d0024790c37400da.",
  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
+    },
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:C/RE:L/U:Red"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-vp43-mc38-mmg5",
-  "modified": "2024-08-26T03:30:44Z",
+  "modified": "2024-09-12T21:32:00Z",
  "published": "2024-08-26T03:30:44Z",
  "aliases": [
    "CVE-2024-8073"
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-20"
+      "CWE-20",
+      "CWE-77"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3qv6-5f5f-f89j",
+  "modified": "2024-09-12T21:32:02Z",
+  "published": "2024-09-12T21:32:02Z",
+  "aliases": [
+    "CVE-2024-34336"
+  ],
+  "details": "User enumeration vulnerability in ORDAT FOSS-Online before v2.24.01 allows attackers to determine if an account exists in the application by comparing the server responses of the forgot password functionality.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34336"
+    },
+    {
+      "type": "WEB",
+      "url": "https://mind-bytes.de/offenlegung-existierender-benutzerkonten-in-foss-online-cve-2024-34336"
+    },
+    {
+      "type": "WEB",
+      "url": "http://foss-online.com"
+    },
+    {
+      "type": "WEB",
+      "url": "http://ordat.com"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-204"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-12T19:15:03Z"
+  }
+}
--- a/Show More
+++ b/Show More