From d5860747618462dcc6b1003d171760f00c5fa282 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 17 Jul 2024 12:32:41 +0000
Subject: [PATCH] Publish Advisories

GHSA-3832-gg43-7qm4
GHSA-5mwm-gfq5-259c
GHSA-6523-jf4r-c962
---
 .../GHSA-3832-gg43-7qm4.json                  | 38 +++++++++++++++++++
 .../GHSA-5mwm-gfq5-259c.json                  | 38 +++++++++++++++++++
 .../GHSA-6523-jf4r-c962.json                  | 35 +++++++++++++++++
 3 files changed, 111 insertions(+)
 create mode 100644 advisories/unreviewed/2024/07/GHSA-3832-gg43-7qm4/GHSA-3832-gg43-7qm4.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-5mwm-gfq5-259c/GHSA-5mwm-gfq5-259c.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-6523-jf4r-c962/GHSA-6523-jf4r-c962.json

diff --git a/advisories/unreviewed/2024/07/GHSA-3832-gg43-7qm4/GHSA-3832-gg43-7qm4.json b/advisories/unreviewed/2024/07/GHSA-3832-gg43-7qm4/GHSA-3832-gg43-7qm4.json
new file mode 100644
index 00000000000..5b9316f59c4
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-3832-gg43-7qm4/GHSA-3832-gg43-7qm4.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3832-gg43-7qm4",
+  "modified": "2024-07-17T12:31:11Z",
+  "published": "2024-07-17T12:31:11Z",
+  "aliases": [
+    "CVE-2024-27311"
+  ],
+  "details": "Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to directory traversal vulnerability which allows the user to upload new files to the server folder.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27311"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2024-27311.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-434"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-17T11:15:09Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-5mwm-gfq5-259c/GHSA-5mwm-gfq5-259c.json b/advisories/unreviewed/2024/07/GHSA-5mwm-gfq5-259c/GHSA-5mwm-gfq5-259c.json
new file mode 100644
index 00000000000..6bf2be7fe16
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-5mwm-gfq5-259c/GHSA-5mwm-gfq5-259c.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5mwm-gfq5-259c",
+  "modified": "2024-07-17T12:31:11Z",
+  "published": "2024-07-17T12:31:11Z",
+  "aliases": [
+    "CVE-2024-5471"
+  ],
+  "details": "Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to agent takeover vulnerability due to the hard-coded sensitive keys.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5471"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2024-5471.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-798"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-17T11:15:10Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-6523-jf4r-c962/GHSA-6523-jf4r-c962.json b/advisories/unreviewed/2024/07/GHSA-6523-jf4r-c962/GHSA-6523-jf4r-c962.json
new file mode 100644
index 00000000000..de0f827e7ee
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-6523-jf4r-c962/GHSA-6523-jf4r-c962.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6523-jf4r-c962",
+  "modified": "2024-07-17T12:31:11Z",
+  "published": "2024-07-17T12:31:11Z",
+  "aliases": [
+    "CVE-2024-31411"
+  ],
+  "details": "Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes.\nSuch a dangerous type might be an executable file that may lead to a remote code execution (RCE).\nThe unrestricted upload is only possible for authenticated and authorized users.\nThis issue affects Apache StreamPipes: through 0.93.0.\n\nUsers are recommended to upgrade to version 0.95.0, which fixes the issue.\n\n",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31411"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread/b0657okbwzg5xxs11hphvc9qrd9s70mt"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-434"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-17T10:15:01Z"
+  }
+}
\ No newline at end of file