Publish Advisories

GHSA-3832-gg43-7qm4
GHSA-5mwm-gfq5-259c
GHSA-6523-jf4r-c962

advisories/unreviewed/2024/07/GHSA-3832-gg43-7qm4/GHSA-3832-gg43-7qm4.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3832-gg43-7qm4",
+  "modified": "2024-07-17T12:31:11Z",
+  "published": "2024-07-17T12:31:11Z",
+  "aliases": [
+    "CVE-2024-27311"
+  ],
+  "details": "Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to directory traversal vulnerability which allows the user to upload new files to the server folder.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27311"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2024-27311.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-434"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-17T11:15:09Z"
+  }
+}

advisories/unreviewed/2024/07/GHSA-5mwm-gfq5-259c/GHSA-5mwm-gfq5-259c.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5mwm-gfq5-259c",
+  "modified": "2024-07-17T12:31:11Z",
+  "published": "2024-07-17T12:31:11Z",
+  "aliases": [
+    "CVE-2024-5471"
+  ],
+  "details": "Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to agent takeover vulnerability due to the hard-coded sensitive keys.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5471"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2024-5471.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-798"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-17T11:15:10Z"
+  }
+}

advisories/unreviewed/2024/07/GHSA-6523-jf4r-c962/GHSA-6523-jf4r-c962.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6523-jf4r-c962",
+  "modified": "2024-07-17T12:31:11Z",
+  "published": "2024-07-17T12:31:11Z",
+  "aliases": [
+    "CVE-2024-31411"
+  ],
+  "details": "Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes.\nSuch a dangerous type might be an executable file that may lead to a remote code execution (RCE).\nThe unrestricted upload is only possible for authenticated and authorized users.\nThis issue affects Apache StreamPipes: through 0.93.0.\n\nUsers are recommended to upgrade to version 0.95.0, which fixes the issue.\n\n",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31411"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/b0657okbwzg5xxs11hphvc9qrd9s70mt"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-434"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-17T10:15:01Z"
+  }
+}