From d427e6fd7098e54011add2a587ee35482e03dd95 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 27 Sep 2024 12:33:13 +0000 Subject: [PATCH] Publish Advisories GHSA-355v-2rjx-fpx7 GHSA-4p95-3g4h-2755 GHSA-5h7f-c7rw-mrcq GHSA-5v8f-chv2-mx64 GHSA-5w3f-r5cr-vf3x GHSA-6gjq-h8hp-wvhf GHSA-6jf6-c3j9-xm36 GHSA-6rjg-v5w9-9cc5 GHSA-78wc-gq29-f2pq GHSA-cc38-c48r-xgx6 GHSA-f5cq-8c4f-j2qr GHSA-fwqw-q9j8-9crv GHSA-h346-3fwc-p8mx GHSA-m794-h492-36rv GHSA-p6qp-r9qf-v2m7 GHSA-r868-f942-gcw7 GHSA-vfp4-75h3-xv6m GHSA-whmv-pp49-rwhh --- .../GHSA-355v-2rjx-fpx7.json | 54 +++++++++++++++++++ .../GHSA-4p95-3g4h-2755.json | 38 +++++++++++++ .../GHSA-5h7f-c7rw-mrcq.json | 38 +++++++++++++ .../GHSA-5v8f-chv2-mx64.json | 38 +++++++++++++ .../GHSA-5w3f-r5cr-vf3x.json | 38 +++++++++++++ .../GHSA-6gjq-h8hp-wvhf.json | 38 +++++++++++++ .../GHSA-6jf6-c3j9-xm36.json | 50 +++++++++++++++++ .../GHSA-6rjg-v5w9-9cc5.json | 38 +++++++++++++ .../GHSA-78wc-gq29-f2pq.json | 46 ++++++++++++++++ .../GHSA-cc38-c48r-xgx6.json | 38 +++++++++++++ .../GHSA-f5cq-8c4f-j2qr.json | 38 +++++++++++++ .../GHSA-fwqw-q9j8-9crv.json | 38 +++++++++++++ .../GHSA-h346-3fwc-p8mx.json | 38 +++++++++++++ .../GHSA-m794-h492-36rv.json | 54 +++++++++++++++++++ .../GHSA-p6qp-r9qf-v2m7.json | 54 +++++++++++++++++++ .../GHSA-r868-f942-gcw7.json | 38 +++++++++++++ .../GHSA-vfp4-75h3-xv6m.json | 54 +++++++++++++++++++ .../GHSA-whmv-pp49-rwhh.json | 54 +++++++++++++++++++ 18 files changed, 784 insertions(+) create mode 100644 advisories/unreviewed/2024/09/GHSA-355v-2rjx-fpx7/GHSA-355v-2rjx-fpx7.json create mode 100644 advisories/unreviewed/2024/09/GHSA-4p95-3g4h-2755/GHSA-4p95-3g4h-2755.json create mode 100644 advisories/unreviewed/2024/09/GHSA-5h7f-c7rw-mrcq/GHSA-5h7f-c7rw-mrcq.json create mode 100644 advisories/unreviewed/2024/09/GHSA-5v8f-chv2-mx64/GHSA-5v8f-chv2-mx64.json create mode 100644 advisories/unreviewed/2024/09/GHSA-5w3f-r5cr-vf3x/GHSA-5w3f-r5cr-vf3x.json create mode 100644 advisories/unreviewed/2024/09/GHSA-6gjq-h8hp-wvhf/GHSA-6gjq-h8hp-wvhf.json create mode 100644 advisories/unreviewed/2024/09/GHSA-6jf6-c3j9-xm36/GHSA-6jf6-c3j9-xm36.json create mode 100644 advisories/unreviewed/2024/09/GHSA-6rjg-v5w9-9cc5/GHSA-6rjg-v5w9-9cc5.json create mode 100644 advisories/unreviewed/2024/09/GHSA-78wc-gq29-f2pq/GHSA-78wc-gq29-f2pq.json create mode 100644 advisories/unreviewed/2024/09/GHSA-cc38-c48r-xgx6/GHSA-cc38-c48r-xgx6.json create mode 100644 advisories/unreviewed/2024/09/GHSA-f5cq-8c4f-j2qr/GHSA-f5cq-8c4f-j2qr.json create mode 100644 advisories/unreviewed/2024/09/GHSA-fwqw-q9j8-9crv/GHSA-fwqw-q9j8-9crv.json create mode 100644 advisories/unreviewed/2024/09/GHSA-h346-3fwc-p8mx/GHSA-h346-3fwc-p8mx.json create mode 100644 advisories/unreviewed/2024/09/GHSA-m794-h492-36rv/GHSA-m794-h492-36rv.json create mode 100644 advisories/unreviewed/2024/09/GHSA-p6qp-r9qf-v2m7/GHSA-p6qp-r9qf-v2m7.json create mode 100644 advisories/unreviewed/2024/09/GHSA-r868-f942-gcw7/GHSA-r868-f942-gcw7.json create mode 100644 advisories/unreviewed/2024/09/GHSA-vfp4-75h3-xv6m/GHSA-vfp4-75h3-xv6m.json create mode 100644 advisories/unreviewed/2024/09/GHSA-whmv-pp49-rwhh/GHSA-whmv-pp49-rwhh.json diff --git a/advisories/unreviewed/2024/09/GHSA-355v-2rjx-fpx7/GHSA-355v-2rjx-fpx7.json b/advisories/unreviewed/2024/09/GHSA-355v-2rjx-fpx7/GHSA-355v-2rjx-fpx7.json new file mode 100644 index 00000000000..81182d4fd79 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-355v-2rjx-fpx7/GHSA-355v-2rjx-fpx7.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-355v-2rjx-fpx7", + "modified": "2024-09-27T12:31:40Z", + "published": "2024-09-27T12:31:40Z", + "aliases": [ + "CVE-2024-9277" + ], + "details": "A vulnerability classified as problematic was found in Langflow up to 1.0.18. Affected by this vulnerability is an unknown functionality of the file \\src\\backend\\base\\langflow\\interface\\utils.py of the component HTTP POST Request Handler. The manipulation of the argument remaining_text leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9277" + }, + { + "type": "WEB", + "url": "https://rumbling-slice-eb0.notion.site/Remote-Redos-in-https-github-com-langflow-ai-langflow-067159ced0d5494e91b06071384969c4?pvs=4" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.278659" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.278659" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.410043" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T11:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-4p95-3g4h-2755/GHSA-4p95-3g4h-2755.json b/advisories/unreviewed/2024/09/GHSA-4p95-3g4h-2755/GHSA-4p95-3g4h-2755.json new file mode 100644 index 00000000000..1a30917664c --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-4p95-3g4h-2755/GHSA-4p95-3g4h-2755.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4p95-3g4h-2755", + "modified": "2024-09-27T12:31:39Z", + "published": "2024-09-27T12:31:39Z", + "aliases": [ + "CVE-2024-47291" + ], + "details": "Permission vulnerability in the ActivityManagerService (AMS) module\nImpact: Successful exploitation of this vulnerability may affect availability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47291" + }, + { + "type": "WEB", + "url": "https://consumer.huawei.com/en/support/bulletin/2024/10" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T11:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-5h7f-c7rw-mrcq/GHSA-5h7f-c7rw-mrcq.json b/advisories/unreviewed/2024/09/GHSA-5h7f-c7rw-mrcq/GHSA-5h7f-c7rw-mrcq.json new file mode 100644 index 00000000000..64cc08a84ff --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-5h7f-c7rw-mrcq/GHSA-5h7f-c7rw-mrcq.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5h7f-c7rw-mrcq", + "modified": "2024-09-27T12:31:39Z", + "published": "2024-09-27T12:31:39Z", + "aliases": [ + "CVE-2024-47290" + ], + "details": "Input validation vulnerability in the USB service module\nImpact: Successful exploitation of this vulnerability may affect availability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47290" + }, + { + "type": "WEB", + "url": "https://consumer.huawei.com/en/support/bulletin/2024/10" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T11:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-5v8f-chv2-mx64/GHSA-5v8f-chv2-mx64.json b/advisories/unreviewed/2024/09/GHSA-5v8f-chv2-mx64/GHSA-5v8f-chv2-mx64.json new file mode 100644 index 00000000000..1101f3131cd --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-5v8f-chv2-mx64/GHSA-5v8f-chv2-mx64.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5v8f-chv2-mx64", + "modified": "2024-09-27T12:31:40Z", + "published": "2024-09-27T12:31:40Z", + "aliases": [ + "CVE-2024-8644" + ], + "details": "Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka JavaScript Hijacking).This issue affects ValeApp: before v2.0.0.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8644" + }, + { + "type": "WEB", + "url": "https://www.usom.gov.tr/bildirim/tr-24-1562" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-315" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T12:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-5w3f-r5cr-vf3x/GHSA-5w3f-r5cr-vf3x.json b/advisories/unreviewed/2024/09/GHSA-5w3f-r5cr-vf3x/GHSA-5w3f-r5cr-vf3x.json new file mode 100644 index 00000000000..6fd5689fb84 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-5w3f-r5cr-vf3x/GHSA-5w3f-r5cr-vf3x.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5w3f-r5cr-vf3x", + "modified": "2024-09-27T12:31:40Z", + "published": "2024-09-27T12:31:40Z", + "aliases": [ + "CVE-2024-8643" + ], + "details": "Session Fixation vulnerability in Oceanic Software ValeApp allows Brute Force, Session Hijacking.This issue affects ValeApp: before v2.0.0.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8643" + }, + { + "type": "WEB", + "url": "https://www.usom.gov.tr/bildirim/tr-24-1562" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-384" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T12:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-6gjq-h8hp-wvhf/GHSA-6gjq-h8hp-wvhf.json b/advisories/unreviewed/2024/09/GHSA-6gjq-h8hp-wvhf/GHSA-6gjq-h8hp-wvhf.json new file mode 100644 index 00000000000..08b04f6b93c --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-6gjq-h8hp-wvhf/GHSA-6gjq-h8hp-wvhf.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6gjq-h8hp-wvhf", + "modified": "2024-09-27T12:31:40Z", + "published": "2024-09-27T12:31:40Z", + "aliases": [ + "CVE-2024-47292" + ], + "details": "Path traversal vulnerability in the Bluetooth module\nImpact: Successful exploitation of this vulnerability may affect service confidentiality.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47292" + }, + { + "type": "WEB", + "url": "https://consumer.huawei.com/en/support/bulletin/2024/10" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T11:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-6jf6-c3j9-xm36/GHSA-6jf6-c3j9-xm36.json b/advisories/unreviewed/2024/09/GHSA-6jf6-c3j9-xm36/GHSA-6jf6-c3j9-xm36.json new file mode 100644 index 00000000000..493bc38b374 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-6jf6-c3j9-xm36/GHSA-6jf6-c3j9-xm36.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6jf6-c3j9-xm36", + "modified": "2024-09-27T12:31:40Z", + "published": "2024-09-27T12:31:40Z", + "aliases": [ + "CVE-2024-9276" + ], + "details": "A vulnerability classified as problematic has been found in TMsoft MyAuth Gateway 3. Affected is an unknown function of the file /index.php. The manipulation of the argument console/nocache/cmd leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9276" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.278658" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.278658" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.409126" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T11:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-6rjg-v5w9-9cc5/GHSA-6rjg-v5w9-9cc5.json b/advisories/unreviewed/2024/09/GHSA-6rjg-v5w9-9cc5/GHSA-6rjg-v5w9-9cc5.json new file mode 100644 index 00000000000..eb27b920132 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-6rjg-v5w9-9cc5/GHSA-6rjg-v5w9-9cc5.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6rjg-v5w9-9cc5", + "modified": "2024-09-27T12:31:40Z", + "published": "2024-09-27T12:31:40Z", + "aliases": [ + "CVE-2024-8609" + ], + "details": "Insertion of Sensitive Information into Log File vulnerability in Oceanic Software ValeApp allows Query System for Information.This issue affects ValeApp: before v2.0.0.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8609" + }, + { + "type": "WEB", + "url": "https://www.usom.gov.tr/bildirim/tr-24-1562" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T12:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-78wc-gq29-f2pq/GHSA-78wc-gq29-f2pq.json b/advisories/unreviewed/2024/09/GHSA-78wc-gq29-f2pq/GHSA-78wc-gq29-f2pq.json new file mode 100644 index 00000000000..0ceb03f968f --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-78wc-gq29-f2pq/GHSA-78wc-gq29-f2pq.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-78wc-gq29-f2pq", + "modified": "2024-09-27T12:31:39Z", + "published": "2024-09-27T12:31:39Z", + "aliases": [ + "CVE-2024-9202" + ], + "details": "In Eclipse Dataspace Components versions 0.1.3 to 0.9.0, the Connector component filters which datasets (= data offers) another party can see in a requested catalog, to ensure that only authorized parties are able to view restricted offers.\nHowever, there is the possibility to request a single dataset, which should be subject to the same filtering process, but currently is missing the correct filtering.\n\n\nThis enables parties to potentially see datasets they should not have access to, thereby exposing sensitive information. Exploiting this vulnerability requires knowing the ID of a restricted dataset, but some IDs may be guessed by trying out many IDs in an automated way.\n\n\nAffected code:\n DatasetResolverImpl, L76-79 https://github.com/eclipse-edc/Connector/blob/v0.9.0/core/control-plane/control-plane-catalog/src/main/java/org/eclipse/edc/connector/controlplane/catalog/DatasetResolverImpl.java", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:Amber" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9202" + }, + { + "type": "WEB", + "url": "https://github.com/eclipse-edc/Connector/pull/4490" + }, + { + "type": "WEB", + "url": "https://github.com/eclipse-edc/Connector/pull/4491" + }, + { + "type": "WEB", + "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/35" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T10:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-cc38-c48r-xgx6/GHSA-cc38-c48r-xgx6.json b/advisories/unreviewed/2024/09/GHSA-cc38-c48r-xgx6/GHSA-cc38-c48r-xgx6.json new file mode 100644 index 00000000000..33030582b48 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-cc38-c48r-xgx6/GHSA-cc38-c48r-xgx6.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cc38-c48r-xgx6", + "modified": "2024-09-27T12:31:40Z", + "published": "2024-09-27T12:31:40Z", + "aliases": [ + "CVE-2024-8608" + ], + "details": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Oceanic Software ValeApp allows Stored XSS.This issue affects ValeApp: before v2.0.0.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8608" + }, + { + "type": "WEB", + "url": "https://www.usom.gov.tr/bildirim/tr-24-1562" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T12:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-f5cq-8c4f-j2qr/GHSA-f5cq-8c4f-j2qr.json b/advisories/unreviewed/2024/09/GHSA-f5cq-8c4f-j2qr/GHSA-f5cq-8c4f-j2qr.json new file mode 100644 index 00000000000..acc33e5268b --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-f5cq-8c4f-j2qr/GHSA-f5cq-8c4f-j2qr.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f5cq-8c4f-j2qr", + "modified": "2024-09-27T12:31:40Z", + "published": "2024-09-27T12:31:40Z", + "aliases": [ + "CVE-2024-47293" + ], + "details": "Out-of-bounds write vulnerability in the HAL-WIFI module\nImpact: Successful exploitation of this vulnerability may affect availability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47293" + }, + { + "type": "WEB", + "url": "https://consumer.huawei.com/en/support/bulletin/2024/10" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-130" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T11:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-fwqw-q9j8-9crv/GHSA-fwqw-q9j8-9crv.json b/advisories/unreviewed/2024/09/GHSA-fwqw-q9j8-9crv/GHSA-fwqw-q9j8-9crv.json new file mode 100644 index 00000000000..f206273c00c --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-fwqw-q9j8-9crv/GHSA-fwqw-q9j8-9crv.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fwqw-q9j8-9crv", + "modified": "2024-09-27T12:31:40Z", + "published": "2024-09-27T12:31:40Z", + "aliases": [ + "CVE-2024-47294" + ], + "details": "Access permission verification vulnerability in the input method framework module\nImpact: Successful exploitation of this vulnerability may affect availability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47294" + }, + { + "type": "WEB", + "url": "https://consumer.huawei.com/en/support/bulletin/2024/10" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T11:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-h346-3fwc-p8mx/GHSA-h346-3fwc-p8mx.json b/advisories/unreviewed/2024/09/GHSA-h346-3fwc-p8mx/GHSA-h346-3fwc-p8mx.json new file mode 100644 index 00000000000..3fb1da7fc60 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-h346-3fwc-p8mx/GHSA-h346-3fwc-p8mx.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h346-3fwc-p8mx", + "modified": "2024-09-27T12:31:40Z", + "published": "2024-09-27T12:31:40Z", + "aliases": [ + "CVE-2024-8607" + ], + "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oceanic Software ValeApp allows SQL Injection.This issue affects ValeApp: before v2.0.0.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8607" + }, + { + "type": "WEB", + "url": "https://www.usom.gov.tr/bildirim/tr-24-1562" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T12:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-m794-h492-36rv/GHSA-m794-h492-36rv.json b/advisories/unreviewed/2024/09/GHSA-m794-h492-36rv/GHSA-m794-h492-36rv.json new file mode 100644 index 00000000000..9185c901e48 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-m794-h492-36rv/GHSA-m794-h492-36rv.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m794-h492-36rv", + "modified": "2024-09-27T12:31:40Z", + "published": "2024-09-27T12:31:40Z", + "aliases": [ + "CVE-2024-9278" + ], + "details": "A vulnerability, which was classified as critical, has been found in HuankeMao SCRM up to 0.0.3. Affected by this issue is the function upload_domain_verification_file of the file WxkConfig.php of the component Administrator Backend. The manipulation of the argument domain_verification_file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9278" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.278660" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.278660" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.410393" + }, + { + "type": "WEB", + "url": "https://wiki.shikangsi.com/post/share/96b7d919-1749-4e2b-bda2-b80d2fd23865" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T11:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-p6qp-r9qf-v2m7/GHSA-p6qp-r9qf-v2m7.json b/advisories/unreviewed/2024/09/GHSA-p6qp-r9qf-v2m7/GHSA-p6qp-r9qf-v2m7.json new file mode 100644 index 00000000000..70ec0e5a2f7 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-p6qp-r9qf-v2m7/GHSA-p6qp-r9qf-v2m7.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p6qp-r9qf-v2m7", + "modified": "2024-09-27T12:31:40Z", + "published": "2024-09-27T12:31:40Z", + "aliases": [ + "CVE-2024-9275" + ], + "details": "A vulnerability was found in jeanmarc77 123solar up to 1.8.4.5. It has been rated as critical. This issue affects some unknown processing of the file /admin/admin_invt2.php. The manipulation of the argument PROTOCOLx leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9275" + }, + { + "type": "WEB", + "url": "https://github.com/jeanmarc77/123solar/issues/75" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.278657" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.278657" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.408326" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-73" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T11:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-r868-f942-gcw7/GHSA-r868-f942-gcw7.json b/advisories/unreviewed/2024/09/GHSA-r868-f942-gcw7/GHSA-r868-f942-gcw7.json new file mode 100644 index 00000000000..6b2ba63e5f9 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-r868-f942-gcw7/GHSA-r868-f942-gcw7.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r868-f942-gcw7", + "modified": "2024-09-27T12:31:40Z", + "published": "2024-09-27T12:31:40Z", + "aliases": [ + "CVE-2024-9136" + ], + "details": "Access permission verification vulnerability in the App Multiplier module\nImpact: Successful exploitation of this vulnerability may affect service confidentiality.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9136" + }, + { + "type": "WEB", + "url": "https://consumer.huawei.com/en/support/bulletin/2024/10" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T11:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-vfp4-75h3-xv6m/GHSA-vfp4-75h3-xv6m.json b/advisories/unreviewed/2024/09/GHSA-vfp4-75h3-xv6m/GHSA-vfp4-75h3-xv6m.json new file mode 100644 index 00000000000..b4fe7fb27d4 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-vfp4-75h3-xv6m/GHSA-vfp4-75h3-xv6m.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vfp4-75h3-xv6m", + "modified": "2024-09-27T12:31:40Z", + "published": "2024-09-27T12:31:40Z", + "aliases": [ + "CVE-2024-9279" + ], + "details": "A vulnerability, which was classified as problematic, was found in funnyzpc Mee-Admin up to 1.6. This affects an unknown part of the file /mee/index of the component User Center. The manipulation of the argument User Nickname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9279" + }, + { + "type": "WEB", + "url": "https://github.com/Armnying/Vulnerability-recurrence-sortin/blob/main/Mee-admin-xss.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.278661" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.278661" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.411118" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T12:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-whmv-pp49-rwhh/GHSA-whmv-pp49-rwhh.json b/advisories/unreviewed/2024/09/GHSA-whmv-pp49-rwhh/GHSA-whmv-pp49-rwhh.json new file mode 100644 index 00000000000..59d9ea92f1a --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-whmv-pp49-rwhh/GHSA-whmv-pp49-rwhh.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-whmv-pp49-rwhh", + "modified": "2024-09-27T12:31:40Z", + "published": "2024-09-27T12:31:40Z", + "aliases": [ + "CVE-2024-9280" + ], + "details": "A vulnerability has been found in kalvinGit kvf-admin up to f12a94dc1ebb7d1c51ee978a85e4c7ed75c620ff and classified as critical. This vulnerability affects the function fileUpload of the file FileUploadKit.java. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9280" + }, + { + "type": "WEB", + "url": "https://github.com/Arvin-Shi/111/issues/1" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.278662" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.278662" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.410994" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-27T12:15:05Z" + } +} \ No newline at end of file