Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2023-07-06 18:32:17 +00:00
parent c4f5a9885c
commit d93073b653
32 changed files with 535 additions and 38 deletions
@@ -28,6 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-121",
      "CWE-787"
    ],
    "severity": "CRITICAL",
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-295v-9m5g-79q9",
-  "modified": "2023-07-06T06:30:17Z",
+  "modified": "2023-07-06T18:30:51Z",
  "published": "2023-06-28T21:30:29Z",
  "aliases": [
    "CVE-2023-3090"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3652-93x3-2rrr",
-  "modified": "2023-06-26T12:30:22Z",
+  "modified": "2023-07-06T18:30:50Z",
  "published": "2023-06-26T12:30:22Z",
  "aliases": [
    "CVE-2023-36631"
  ],
  "details": "** DISPUTED ** Lack of access control in wfc.exe in Malwarebytes Binisoft Windows Firewall Control 6.9.2.0 allows local unprivileged users to bypass Windows Firewall restrictions via the user interface's rules tab. NOTE: the vendor's perspective is \"this is intended behavior as the application can be locked using a password.\"",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3jff-v2mx-4rwr",
-  "modified": "2023-06-26T21:30:59Z",
+  "modified": "2023-07-06T18:30:50Z",
  "published": "2023-06-26T21:30:59Z",
  "aliases": [
    "CVE-2023-36252"
  ],
  "details": "An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a remote authenticated attacker to execute arbitrary code and cause a denial of service via a the session expiration function.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-287"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4v9h-2pcw-v2q7",
-  "modified": "2023-06-27T18:30:34Z",
+  "modified": "2023-07-06T18:30:51Z",
  "published": "2023-06-27T18:30:34Z",
  "aliases": [
    "CVE-2023-33566"
  ],
  "details": "An unauthorized node injection vulnerability has been identified in ROS2 Foxy Fitzroy versions where ROS_VERSION is 2 and ROS_PYTHON_VERSION is 3. This vulnerability could allow a malicious user to inject malicious ROS2 nodes into the system remotely. Once injected, these nodes could disrupt the normal operations of the system or cause other potentially harmful behavior.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-74"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -40,6 +40,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-502",
      "CWE-94"
    ],
    "severity": null,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-6q6r-9q5h-h93m",
-  "modified": "2023-06-28T00:30:44Z",
+  "modified": "2023-07-06T18:30:51Z",
  "published": "2023-06-28T00:30:44Z",
  "aliases": [
    "CVE-2023-25001"
  ],
  "details": "A maliciously crafted SKP file in Autodesk Navisworks 2023 and 2022 be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-416"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -36,7 +36,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-1333"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8r8v-fx37-wpw7",
-  "modified": "2023-06-29T00:31:04Z",
+  "modified": "2023-07-06T18:30:51Z",
  "published": "2023-06-29T00:31:04Z",
  "aliases": [
    "CVE-2023-3357"
  ],
  "details": "A NULL pointer dereference flaw was found in the Linux kernel AMD Sensor Fusion Hub driver. This flaw allows a local user to crash the system.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -36,7 +36,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-367"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-cqw3-c4x8-fq47",
-  "modified": "2023-06-27T18:30:34Z",
+  "modified": "2023-07-06T18:30:51Z",
  "published": "2023-06-27T18:30:34Z",
  "aliases": [
    "CVE-2023-33567"
  ],
  "details": "An unauthorized access vulnerability has been discovered in ROS2 Foxy Fitzroy versions where ROS_VERSION is 2 and ROS_PYTHON_VERSION is 3. This vulnerability could potentially allow a malicious user to gain unauthorized access to multiple ROS2 nodes remotely. Unauthorized access to these nodes could result in compromised system integrity, the execution of arbitrary commands, and disclosure of sensitive information.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hg6h-cj3j-wp77",
-  "modified": "2023-06-29T00:31:04Z",
+  "modified": "2023-07-06T18:30:51Z",
  "published": "2023-06-29T00:31:04Z",
  "aliases": [
    "CVE-2023-3359"
  ],
  "details": "An issue was discovered in the Linux kernel brcm_nvram_parse in drivers/nvmem/brcm_nvram.c. Lacks for the check of the return value of kzalloc() can cause the NULL Pointer Dereference.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -21,6 +21,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36002"
    },
+    {
+      "type": "WEB",
+      "url": "https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-0004"
+    },
    {
      "type": "WEB",
      "url": "https://www.proofpoint.com/us/security/security-advisories/pfpt-sa-2023-005"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-mfmf-m5jw-cfqh",
-  "modified": "2023-06-28T03:31:03Z",
+  "modified": "2023-07-06T18:30:51Z",
  "published": "2023-06-28T03:31:03Z",
  "aliases": [
    "CVE-2022-48505"
  ],
  "details": "This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file system",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
+    }
  ],
  "affected": [

@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-p642-fwhv-jwmj",
-  "modified": "2023-06-28T00:30:45Z",
+  "modified": "2023-07-06T18:30:51Z",
  "published": "2023-06-28T00:30:45Z",
  "aliases": [
    "CVE-2023-25002"
  ],
  "details": "A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-416"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-q9h3-8p32-277m",
-  "modified": "2023-06-28T21:30:29Z",
+  "modified": "2023-07-06T18:30:51Z",
  "published": "2023-06-28T21:30:29Z",
  "aliases": [
    "CVE-2023-33592"
  ],
  "details": "Lost and Found Information System v1.0 was discovered to contain a SQL injection vulnerability via the component /php-lfis/admin/?page=system_info/contact_information.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-89"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-qjwq-qh5c-p96w",
-  "modified": "2023-06-29T15:30:35Z",
+  "modified": "2023-07-06T18:30:51Z",
  "published": "2023-06-29T15:30:35Z",
  "aliases": [
    "CVE-2015-1313"
  ],
  "details": "JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that are returned to the web browser after an initial unauthenticated request.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -29,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-425"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-rc54-8mxm-g5hf",
-  "modified": "2023-06-28T09:30:23Z",
+  "modified": "2023-07-06T18:30:51Z",
  "published": "2023-06-28T09:30:23Z",
  "aliases": [
    "CVE-2023-3034"
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-20"
+      "CWE-20",
+      "CWE-79"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-rmg8-h2h6-5wwf",
-  "modified": "2023-06-29T00:31:04Z",
+  "modified": "2023-07-06T18:30:51Z",
  "published": "2023-06-29T00:31:04Z",
  "aliases": [
    "CVE-2023-3358"
  ],
  "details": "A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a local user to crash the system.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

--- a/Show More
+++ b/Show More