From d3028785d6f91036c52088f0a255b549fa2c41fe Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 25 Dec 2023 03:31:39 +0000 Subject: [PATCH] Publish Advisories GHSA-5cw2-v2x8-w9xg GHSA-66jv-2xqf-9p8x GHSA-6q84-3g95-w6vx GHSA-8crg-9wvr-72vm GHSA-9mr3-mrj5-pc9x GHSA-jfmg-667v-4gmf GHSA-m54p-35qp-m26h GHSA-w3rp-w7w7-6prp GHSA-wh77-275q-j2qw --- .../GHSA-5cw2-v2x8-w9xg.json | 50 +++++++++++++++++++ .../GHSA-66jv-2xqf-9p8x.json | 46 +++++++++++++++++ .../GHSA-6q84-3g95-w6vx.json | 46 +++++++++++++++++ .../GHSA-8crg-9wvr-72vm.json | 46 +++++++++++++++++ .../GHSA-9mr3-mrj5-pc9x.json | 42 ++++++++++++++++ .../GHSA-jfmg-667v-4gmf.json | 42 ++++++++++++++++ .../GHSA-m54p-35qp-m26h.json | 46 +++++++++++++++++ .../GHSA-w3rp-w7w7-6prp.json | 46 +++++++++++++++++ .../GHSA-wh77-275q-j2qw.json | 42 ++++++++++++++++ 9 files changed, 406 insertions(+) create mode 100644 advisories/unreviewed/2023/12/GHSA-5cw2-v2x8-w9xg/GHSA-5cw2-v2x8-w9xg.json create mode 100644 advisories/unreviewed/2023/12/GHSA-66jv-2xqf-9p8x/GHSA-66jv-2xqf-9p8x.json create mode 100644 advisories/unreviewed/2023/12/GHSA-6q84-3g95-w6vx/GHSA-6q84-3g95-w6vx.json create mode 100644 advisories/unreviewed/2023/12/GHSA-8crg-9wvr-72vm/GHSA-8crg-9wvr-72vm.json create mode 100644 advisories/unreviewed/2023/12/GHSA-9mr3-mrj5-pc9x/GHSA-9mr3-mrj5-pc9x.json create mode 100644 advisories/unreviewed/2023/12/GHSA-jfmg-667v-4gmf/GHSA-jfmg-667v-4gmf.json create mode 100644 advisories/unreviewed/2023/12/GHSA-m54p-35qp-m26h/GHSA-m54p-35qp-m26h.json create mode 100644 advisories/unreviewed/2023/12/GHSA-w3rp-w7w7-6prp/GHSA-w3rp-w7w7-6prp.json create mode 100644 advisories/unreviewed/2023/12/GHSA-wh77-275q-j2qw/GHSA-wh77-275q-j2qw.json diff --git a/advisories/unreviewed/2023/12/GHSA-5cw2-v2x8-w9xg/GHSA-5cw2-v2x8-w9xg.json b/advisories/unreviewed/2023/12/GHSA-5cw2-v2x8-w9xg/GHSA-5cw2-v2x8-w9xg.json new file mode 100644 index 00000000000..309fafe2cc3 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-5cw2-v2x8-w9xg/GHSA-5cw2-v2x8-w9xg.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5cw2-v2x8-w9xg", + "modified": "2023-12-25T03:30:27Z", + "published": "2023-12-25T03:30:27Z", + "aliases": [ + "CVE-2023-7099" + ], + "details": "A vulnerability, which was classified as critical, has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This issue affects some unknown processing of the file bwdates-report-result.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248951.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7099" + }, + { + "type": "WEB", + "url": "https://github.com/laoquanshi/heishou/blob/main/niv%20-SQL" + }, + { + "type": "WEB", + "url": "https://github.com/laoquanshi/heishou/blob/main/sqlmap.png" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.248951" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.248951" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-25T03:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-66jv-2xqf-9p8x/GHSA-66jv-2xqf-9p8x.json b/advisories/unreviewed/2023/12/GHSA-66jv-2xqf-9p8x/GHSA-66jv-2xqf-9p8x.json new file mode 100644 index 00000000000..92770c9a1f4 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-66jv-2xqf-9p8x/GHSA-66jv-2xqf-9p8x.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-66jv-2xqf-9p8x", + "modified": "2023-12-25T03:30:27Z", + "published": "2023-12-25T03:30:27Z", + "aliases": [ + "CVE-2023-7098" + ], + "details": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in icret EasyImages 2.8.3. This vulnerability affects unknown code of the file app/hide.php. The manipulation of the argument key leads to path traversal: '../filedir'. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-248950 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7098" + }, + { + "type": "WEB", + "url": "https://note.zhaoj.in/share/MHnV2WLY9rxU" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.248950" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.248950" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-24" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-25T02:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-6q84-3g95-w6vx/GHSA-6q84-3g95-w6vx.json b/advisories/unreviewed/2023/12/GHSA-6q84-3g95-w6vx/GHSA-6q84-3g95-w6vx.json new file mode 100644 index 00000000000..c159474b3cd --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-6q84-3g95-w6vx/GHSA-6q84-3g95-w6vx.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6q84-3g95-w6vx", + "modified": "2023-12-25T03:30:27Z", + "published": "2023-12-25T03:30:27Z", + "aliases": [ + "CVE-2023-7095" + ], + "details": "A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248942 is the identifier assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7095" + }, + { + "type": "WEB", + "url": "https://github.com/unpWn4bL3/iot-security/blob/main/2.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.248942" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.248942" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-120" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-25T01:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-8crg-9wvr-72vm/GHSA-8crg-9wvr-72vm.json b/advisories/unreviewed/2023/12/GHSA-8crg-9wvr-72vm/GHSA-8crg-9wvr-72vm.json new file mode 100644 index 00000000000..1c14de1bdea --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-8crg-9wvr-72vm/GHSA-8crg-9wvr-72vm.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8crg-9wvr-72vm", + "modified": "2023-12-25T03:30:27Z", + "published": "2023-12-25T03:30:27Z", + "aliases": [ + "CVE-2023-7100" + ], + "details": "A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/bwdates-report-details.php. The manipulation of the argument fdate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248952.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7100" + }, + { + "type": "WEB", + "url": "https://medium.com/@2839549219ljk/restaurant-table-booking-system-sql-injection-vulnerability-30708cfabe03" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.248952" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.248952" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-25T03:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-9mr3-mrj5-pc9x/GHSA-9mr3-mrj5-pc9x.json b/advisories/unreviewed/2023/12/GHSA-9mr3-mrj5-pc9x/GHSA-9mr3-mrj5-pc9x.json new file mode 100644 index 00000000000..20bb0481b74 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-9mr3-mrj5-pc9x/GHSA-9mr3-mrj5-pc9x.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9mr3-mrj5-pc9x", + "modified": "2023-12-25T03:30:27Z", + "published": "2023-12-25T03:30:27Z", + "aliases": [ + "CVE-2023-49880" + ], + "details": "In the Message Entry and Repair (MER) facility of IBM Financial Transaction Manager for SWIFT Services 3.2.4 the sending address and the message type of FIN messages are assumed to be immutable. However, an attacker might modify these elements of a business transaction. IBM X-Force ID: 273183.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49880" + }, + { + "type": "WEB", + "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/273183" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7101167" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-25T03:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-jfmg-667v-4gmf/GHSA-jfmg-667v-4gmf.json b/advisories/unreviewed/2023/12/GHSA-jfmg-667v-4gmf/GHSA-jfmg-667v-4gmf.json new file mode 100644 index 00000000000..e54bca3bfed --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-jfmg-667v-4gmf/GHSA-jfmg-667v-4gmf.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jfmg-667v-4gmf", + "modified": "2023-12-25T03:30:27Z", + "published": "2023-12-25T03:30:27Z", + "aliases": [ + "CVE-2021-38927" + ], + "details": "IBM Aspera Console 3.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 210322.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38927" + }, + { + "type": "WEB", + "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/210322" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7101252" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-25T03:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-m54p-35qp-m26h/GHSA-m54p-35qp-m26h.json b/advisories/unreviewed/2023/12/GHSA-m54p-35qp-m26h/GHSA-m54p-35qp-m26h.json new file mode 100644 index 00000000000..3adb0034c6c --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-m54p-35qp-m26h/GHSA-m54p-35qp-m26h.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m54p-35qp-m26h", + "modified": "2023-12-25T03:30:27Z", + "published": "2023-12-25T03:30:27Z", + "aliases": [ + "CVE-2023-7096" + ], + "details": "A vulnerability was found in code-projects Faculty Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/php/crud.php. The manipulation of the argument fieldname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248948.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7096" + }, + { + "type": "WEB", + "url": "https://github.com/Glunko/vulnerability/blob/main/Faculty-Management-System_sql.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.248948" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.248948" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-25T01:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-w3rp-w7w7-6prp/GHSA-w3rp-w7w7-6prp.json b/advisories/unreviewed/2023/12/GHSA-w3rp-w7w7-6prp/GHSA-w3rp-w7w7-6prp.json new file mode 100644 index 00000000000..016e23ca60d --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-w3rp-w7w7-6prp/GHSA-w3rp-w7w7-6prp.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w3rp-w7w7-6prp", + "modified": "2023-12-25T03:30:27Z", + "published": "2023-12-25T03:30:27Z", + "aliases": [ + "CVE-2023-7097" + ], + "details": "A vulnerability classified as critical has been found in code-projects Water Billing System 1.0. This affects an unknown part of the file /addbill.php. The manipulation of the argument owners_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248949 was assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7097" + }, + { + "type": "WEB", + "url": "https://github.com/Glunko/vulnerability/blob/main/Water-Billing-System_sql.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.248949" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.248949" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-25T02:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-wh77-275q-j2qw/GHSA-wh77-275q-j2qw.json b/advisories/unreviewed/2023/12/GHSA-wh77-275q-j2qw/GHSA-wh77-275q-j2qw.json new file mode 100644 index 00000000000..42dbaa202d8 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-wh77-275q-j2qw/GHSA-wh77-275q-j2qw.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wh77-275q-j2qw", + "modified": "2023-12-25T03:30:27Z", + "published": "2023-12-25T03:30:27Z", + "aliases": [ + "CVE-2023-43064" + ], + "details": "Facsimile Support for IBM i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause arbitrary code to run with the privilege of the user invoking the facsimile support. IBM X-Force ID: 267689.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43064" + }, + { + "type": "WEB", + "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/267689" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7101330" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-427" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-25T03:15:08Z" + } +} \ No newline at end of file