diff --git a/advisories/unreviewed/2024/11/GHSA-236f-m6gm-vp93/GHSA-236f-m6gm-vp93.json b/advisories/unreviewed/2024/11/GHSA-236f-m6gm-vp93/GHSA-236f-m6gm-vp93.json new file mode 100644 index 00000000000..18ce3b9a21a --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-236f-m6gm-vp93/GHSA-236f-m6gm-vp93.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-236f-m6gm-vp93", + "modified": "2024-11-18T06:30:36Z", + "published": "2024-11-18T06:30:36Z", + "aliases": [ + "CVE-2024-52944" + ], + "details": "An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24698. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting while viewing archived content. This could reflect back to an authenticated user without sanitization if executed by that user.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52944" + }, + { + "type": "WEB", + "url": "https://www.veritas.com/support/en_US/security/VTS24-013" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T06:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-3fvw-4j76-wpj7/GHSA-3fvw-4j76-wpj7.json b/advisories/unreviewed/2024/11/GHSA-3fvw-4j76-wpj7/GHSA-3fvw-4j76-wpj7.json new file mode 100644 index 00000000000..6f6866ea94b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-3fvw-4j76-wpj7/GHSA-3fvw-4j76-wpj7.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3fvw-4j76-wpj7", + "modified": "2024-11-18T06:30:36Z", + "published": "2024-11-18T06:30:36Z", + "aliases": [ + "CVE-2024-52922" + ], + "details": "In Bitcoin Core before 25.1, an attacker can cause a node to not download the latest block, because there can be minutes of delay when an announcing peer stalls instead of complying with the peer-to-peer protocol specification.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52922" + }, + { + "type": "WEB", + "url": "https://bitcoincore.org/en/2024/11/05/cb-stall-hindering-propagation" + }, + { + "type": "WEB", + "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T04:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-3r2v-8348-hx3r/GHSA-3r2v-8348-hx3r.json b/advisories/unreviewed/2024/11/GHSA-3r2v-8348-hx3r/GHSA-3r2v-8348-hx3r.json new file mode 100644 index 00000000000..264bbb10d85 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-3r2v-8348-hx3r/GHSA-3r2v-8348-hx3r.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3r2v-8348-hx3r", + "modified": "2024-11-18T06:30:36Z", + "published": "2024-11-18T06:30:36Z", + "aliases": [ + "CVE-2024-52946" + ], + "details": "An issue was discovered in LemonLDAP::NG before 2.20.1. An Improper Check during session refresh allows an authenticated user to raise their authentication level if the admin configured an \"Adaptative authentication rule\" with an increment instead of an absolute value.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52946" + }, + { + "type": "WEB", + "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3255" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T06:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-425w-xhjg-hfcm/GHSA-425w-xhjg-hfcm.json b/advisories/unreviewed/2024/11/GHSA-425w-xhjg-hfcm/GHSA-425w-xhjg-hfcm.json new file mode 100644 index 00000000000..31dab16ea8b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-425w-xhjg-hfcm/GHSA-425w-xhjg-hfcm.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-425w-xhjg-hfcm", + "modified": "2024-11-18T06:30:36Z", + "published": "2024-11-18T06:30:36Z", + "aliases": [ + "CVE-2024-52947" + ], + "details": "A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.20.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter of the upgrade session confirmation page (upgradeSession / forceUpgrade) if the \"Upgrade session\" plugin has been enabled by an admin", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52947" + }, + { + "type": "WEB", + "url": "https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3257" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T06:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-48rr-fh2m-hhjh/GHSA-48rr-fh2m-hhjh.json b/advisories/unreviewed/2024/11/GHSA-48rr-fh2m-hhjh/GHSA-48rr-fh2m-hhjh.json new file mode 100644 index 00000000000..f3405afafa8 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-48rr-fh2m-hhjh/GHSA-48rr-fh2m-hhjh.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-48rr-fh2m-hhjh", + "modified": "2024-11-18T06:30:36Z", + "published": "2024-11-18T06:30:36Z", + "aliases": [ + "CVE-2024-11309" + ], + "details": "The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11309" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/en/cp-139-8243-3d818-2.html" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/tw/cp-132-8242-384a1-1.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-23" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T06:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-4w2f-m236-fggc/GHSA-4w2f-m236-fggc.json b/advisories/unreviewed/2024/11/GHSA-4w2f-m236-fggc/GHSA-4w2f-m236-fggc.json new file mode 100644 index 00000000000..bb70706a880 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-4w2f-m236-fggc/GHSA-4w2f-m236-fggc.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4w2f-m236-fggc", + "modified": "2024-11-18T06:30:36Z", + "published": "2024-11-18T06:30:36Z", + "aliases": [ + "CVE-2024-52943" + ], + "details": "An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24697. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting (XSS) while viewing archived content. This could reflect back to an authenticated user without sanitization if executed by that user.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52943" + }, + { + "type": "WEB", + "url": "https://www.veritas.com/support/en_US/security/VTS24-013" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T06:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-7ph6-jpfh-8f79/GHSA-7ph6-jpfh-8f79.json b/advisories/unreviewed/2024/11/GHSA-7ph6-jpfh-8f79/GHSA-7ph6-jpfh-8f79.json new file mode 100644 index 00000000000..b43d7d5fa0b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-7ph6-jpfh-8f79/GHSA-7ph6-jpfh-8f79.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7ph6-jpfh-8f79", + "modified": "2024-11-18T06:30:35Z", + "published": "2024-11-18T06:30:35Z", + "aliases": [ + "CVE-2024-52914" + ], + "details": "In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed transaction.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52914" + }, + { + "type": "WEB", + "url": "https://bitcoincore.org/en/2024/07/03/disclose-orphan-dos" + }, + { + "type": "WEB", + "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T04:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-fx2f-v4hx-q8h6/GHSA-fx2f-v4hx-q8h6.json b/advisories/unreviewed/2024/11/GHSA-fx2f-v4hx-q8h6/GHSA-fx2f-v4hx-q8h6.json new file mode 100644 index 00000000000..401e14b3379 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-fx2f-v4hx-q8h6/GHSA-fx2f-v4hx-q8h6.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fx2f-v4hx-q8h6", + "modified": "2024-11-18T06:30:35Z", + "published": "2024-11-18T06:30:35Z", + "aliases": [ + "CVE-2024-52917" + ], + "details": "Bitcoin Core before 22.0 has a miniupnp infinite loop in which it allocates memory on the basis of random data received over the network, e.g., large M-SEARCH replies from a fake UPnP device.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52917" + }, + { + "type": "WEB", + "url": "https://bitcoincore.org/en/2024/07/31/disclose-upnp-oom" + }, + { + "type": "WEB", + "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T04:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-h7hm-94xj-mhpm/GHSA-h7hm-94xj-mhpm.json b/advisories/unreviewed/2024/11/GHSA-h7hm-94xj-mhpm/GHSA-h7hm-94xj-mhpm.json new file mode 100644 index 00000000000..ada40cec8ae --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-h7hm-94xj-mhpm/GHSA-h7hm-94xj-mhpm.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h7hm-94xj-mhpm", + "modified": "2024-11-18T06:30:35Z", + "published": "2024-11-18T06:30:35Z", + "aliases": [ + "CVE-2024-52913" + ], + "details": "In Bitcoin Core before 0.21.0, an attacker could prevent a node from seeing a specific unconfirmed transaction, because transaction re-requests are mishandled.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52913" + }, + { + "type": "WEB", + "url": "https://bitcoincore.org/en/2024/07/03/disclose_already_asked_for" + }, + { + "type": "WEB", + "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T04:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hcpj-7xxx-7pm4/GHSA-hcpj-7xxx-7pm4.json b/advisories/unreviewed/2024/11/GHSA-hcpj-7xxx-7pm4/GHSA-hcpj-7xxx-7pm4.json new file mode 100644 index 00000000000..7ddf4f6e6d5 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-hcpj-7xxx-7pm4/GHSA-hcpj-7xxx-7pm4.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hcpj-7xxx-7pm4", + "modified": "2024-11-18T06:30:36Z", + "published": "2024-11-18T06:30:36Z", + "aliases": [ + "CVE-2024-52945" + ], + "details": "An issue was discovered in Veritas NetBackup before 10.5. This only applies to NetBackup components running on a Windows Operating System. If a user executes specific NetBackup commands or an attacker uses social engineering techniques to impel the user to execute the commands, a malicious DLL could be loaded, resulting in execution of the attacker's code in the user's security context.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52945" + }, + { + "type": "WEB", + "url": "https://www.veritas.com/content/support/en_US/security/VTS24-012" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T06:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hjr8-c78p-hrvc/GHSA-hjr8-c78p-hrvc.json b/advisories/unreviewed/2024/11/GHSA-hjr8-c78p-hrvc/GHSA-hjr8-c78p-hrvc.json new file mode 100644 index 00000000000..ac2654373da --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-hjr8-c78p-hrvc/GHSA-hjr8-c78p-hrvc.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hjr8-c78p-hrvc", + "modified": "2024-11-18T06:30:36Z", + "published": "2024-11-18T06:30:36Z", + "aliases": [ + "CVE-2024-11310" + ], + "details": "The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11310" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/en/cp-139-8245-ad7d7-2.html" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/tw/cp-132-8244-c45b5-1.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-23" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T06:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-m86g-cwq8-wqrm/GHSA-m86g-cwq8-wqrm.json b/advisories/unreviewed/2024/11/GHSA-m86g-cwq8-wqrm/GHSA-m86g-cwq8-wqrm.json new file mode 100644 index 00000000000..8f224f3c80e --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-m86g-cwq8-wqrm/GHSA-m86g-cwq8-wqrm.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m86g-cwq8-wqrm", + "modified": "2024-11-18T06:30:35Z", + "published": "2024-11-18T06:30:35Z", + "aliases": [ + "CVE-2024-52915" + ], + "details": "Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52915" + }, + { + "type": "WEB", + "url": "https://bitcoincore.org/en/2024/07/03/disclose-inv-buffer-blowup" + }, + { + "type": "WEB", + "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T04:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-mh9h-44jv-cw34/GHSA-mh9h-44jv-cw34.json b/advisories/unreviewed/2024/11/GHSA-mh9h-44jv-cw34/GHSA-mh9h-44jv-cw34.json new file mode 100644 index 00000000000..e7714d86c80 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-mh9h-44jv-cw34/GHSA-mh9h-44jv-cw34.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mh9h-44jv-cw34", + "modified": "2024-11-18T06:30:36Z", + "published": "2024-11-18T06:30:35Z", + "aliases": [ + "CVE-2024-43704" + ], + "details": "Software installed and run as a non-privileged user may conduct improper GPU system calls to gain access to the graphics buffers of a parent process.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43704" + }, + { + "type": "WEB", + "url": "https://www.imaginationtech.com/gpu-driver-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-668" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T05:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-mxcf-88m3-99v7/GHSA-mxcf-88m3-99v7.json b/advisories/unreviewed/2024/11/GHSA-mxcf-88m3-99v7/GHSA-mxcf-88m3-99v7.json new file mode 100644 index 00000000000..7fdb79a6158 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-mxcf-88m3-99v7/GHSA-mxcf-88m3-99v7.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mxcf-88m3-99v7", + "modified": "2024-11-18T06:30:35Z", + "published": "2024-11-18T06:30:35Z", + "aliases": [ + "CVE-2024-52912" + ], + "details": "Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the time offset for newly connecting peers) and an abs64 logic bug.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52912" + }, + { + "type": "WEB", + "url": "https://bitcoincore.org/en/2024/07/03/disclose-timestamp-overflow" + }, + { + "type": "WEB", + "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T04:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-px5f-j76h-8w39/GHSA-px5f-j76h-8w39.json b/advisories/unreviewed/2024/11/GHSA-px5f-j76h-8w39/GHSA-px5f-j76h-8w39.json new file mode 100644 index 00000000000..5c4dddba8fe --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-px5f-j76h-8w39/GHSA-px5f-j76h-8w39.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-px5f-j76h-8w39", + "modified": "2024-11-18T06:30:35Z", + "published": "2024-11-18T06:30:35Z", + "aliases": [ + "CVE-2019-25220" + ], + "details": "Bitcoin Core before 24.0.1 allows remote attackers to cause a denial of service (daemon crash) via a flood of low-difficulty header chains (aka a \"Chain Width Expansion\" attack) because a node does not first verify that a presented chain has enough work before committing to store it.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25220" + }, + { + "type": "WEB", + "url": "https://bitcoincore.org/en/2024/09/18/disclose-headers-oom" + }, + { + "type": "WEB", + "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures" + }, + { + "type": "WEB", + "url": "https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-October/017354.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T04:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-qcrh-jqxf-mgm4/GHSA-qcrh-jqxf-mgm4.json b/advisories/unreviewed/2024/11/GHSA-qcrh-jqxf-mgm4/GHSA-qcrh-jqxf-mgm4.json new file mode 100644 index 00000000000..596bd60fc7e --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-qcrh-jqxf-mgm4/GHSA-qcrh-jqxf-mgm4.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qcrh-jqxf-mgm4", + "modified": "2024-11-18T06:30:36Z", + "published": "2024-11-18T06:30:36Z", + "aliases": [ + "CVE-2024-52926" + ], + "details": "Delinea Privilege Manager before 12.0.2 mishandles the security of the Windows agent.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52926" + }, + { + "type": "WEB", + "url": "https://docs.delinea.com/online-help/privilege-manager/release-notes/12.0.2-combined.htm" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T04:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-qcxm-3xrq-pj5f/GHSA-qcxm-3xrq-pj5f.json b/advisories/unreviewed/2024/11/GHSA-qcxm-3xrq-pj5f/GHSA-qcxm-3xrq-pj5f.json new file mode 100644 index 00000000000..9caa9d42877 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-qcxm-3xrq-pj5f/GHSA-qcxm-3xrq-pj5f.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qcxm-3xrq-pj5f", + "modified": "2024-11-18T06:30:35Z", + "published": "2024-11-18T06:30:35Z", + "aliases": [ + "CVE-2024-52916" + ], + "details": "Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum difficulty headers.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52916" + }, + { + "type": "WEB", + "url": "https://bitcoincore.org/en/2024/07/03/disclose-header-spam" + }, + { + "type": "WEB", + "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T04:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-qwp9-p9rr-h729/GHSA-qwp9-p9rr-h729.json b/advisories/unreviewed/2024/11/GHSA-qwp9-p9rr-h729/GHSA-qwp9-p9rr-h729.json new file mode 100644 index 00000000000..64e8428c161 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-qwp9-p9rr-h729/GHSA-qwp9-p9rr-h729.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qwp9-p9rr-h729", + "modified": "2024-11-18T06:30:35Z", + "published": "2024-11-18T06:30:35Z", + "aliases": [ + "CVE-2024-52919" + ], + "details": "Bitcoin Core before 22.0 has a CAddrMan nIdCount integer overflow and resultant assertion failure (and daemon exit) via a flood of addr messages.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52919" + }, + { + "type": "WEB", + "url": "https://bitcoincore.org/en/2024/07/31/disclose-addrman-int-overflow" + }, + { + "type": "WEB", + "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T04:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-r2ph-vgmf-8gqh/GHSA-r2ph-vgmf-8gqh.json b/advisories/unreviewed/2024/11/GHSA-r2ph-vgmf-8gqh/GHSA-r2ph-vgmf-8gqh.json new file mode 100644 index 00000000000..0aa7b485303 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-r2ph-vgmf-8gqh/GHSA-r2ph-vgmf-8gqh.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r2ph-vgmf-8gqh", + "modified": "2024-11-18T06:30:36Z", + "published": "2024-11-18T06:30:36Z", + "aliases": [ + "CVE-2024-52940" + ], + "details": "AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic. The attacker must know the victim's AnyDesk ID.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52940" + }, + { + "type": "WEB", + "url": "https://download.anydesk.com/changelog.txt" + }, + { + "type": "WEB", + "url": "https://github.com/ebrasha/abdal-anydesk-remote-ip-detector" + }, + { + "type": "WEB", + "url": "https://x.com/ProfShafiei/status/1850856458017009830" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T05:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-rxgg-vpm5-pccw/GHSA-rxgg-vpm5-pccw.json b/advisories/unreviewed/2024/11/GHSA-rxgg-vpm5-pccw/GHSA-rxgg-vpm5-pccw.json new file mode 100644 index 00000000000..63b2566013d --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-rxgg-vpm5-pccw/GHSA-rxgg-vpm5-pccw.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rxgg-vpm5-pccw", + "modified": "2024-11-18T06:30:35Z", + "published": "2024-11-18T06:30:35Z", + "aliases": [ + "CVE-2024-52921" + ], + "details": "In Bitcoin Core before 25.0, a peer can affect the download state of other peers by sending a mutated block.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52921" + }, + { + "type": "WEB", + "url": "https://bitcoincore.org/en/2024/10/08/disclose-mutated-blocks-hindering-propagation" + }, + { + "type": "WEB", + "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T04:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-v64h-qhh7-j6qf/GHSA-v64h-qhh7-j6qf.json b/advisories/unreviewed/2024/11/GHSA-v64h-qhh7-j6qf/GHSA-v64h-qhh7-j6qf.json new file mode 100644 index 00000000000..3d114584a98 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-v64h-qhh7-j6qf/GHSA-v64h-qhh7-j6qf.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v64h-qhh7-j6qf", + "modified": "2024-11-18T06:30:36Z", + "published": "2024-11-18T06:30:36Z", + "aliases": [ + "CVE-2024-52941" + ], + "details": "An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24695. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting (XSS) while viewing archived content. This could reflect back to an authenticated user without sanitization if executed by that user.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52941" + }, + { + "type": "WEB", + "url": "https://www.veritas.com/support/en_US/security/VTS24-013" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T06:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-v664-p69f-2qfg/GHSA-v664-p69f-2qfg.json b/advisories/unreviewed/2024/11/GHSA-v664-p69f-2qfg/GHSA-v664-p69f-2qfg.json new file mode 100644 index 00000000000..6725ae7d6ce --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-v664-p69f-2qfg/GHSA-v664-p69f-2qfg.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v664-p69f-2qfg", + "modified": "2024-11-18T06:30:36Z", + "published": "2024-11-18T06:30:36Z", + "aliases": [ + "CVE-2024-5030" + ], + "details": "The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5030" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/2c2e994c-31bd-4de4-9480-b86f980d4130" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T06:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vmjh-4373-j57w/GHSA-vmjh-4373-j57w.json b/advisories/unreviewed/2024/11/GHSA-vmjh-4373-j57w/GHSA-vmjh-4373-j57w.json new file mode 100644 index 00000000000..d829fdfbe45 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-vmjh-4373-j57w/GHSA-vmjh-4373-j57w.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vmjh-4373-j57w", + "modified": "2024-11-18T06:30:36Z", + "published": "2024-11-18T06:30:36Z", + "aliases": [ + "CVE-2024-52942" + ], + "details": "An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24696. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting (XSS) while viewing archived content. This could reflect back to an authenticated user without sanitization if executed by that user.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52942" + }, + { + "type": "WEB", + "url": "https://www.veritas.com/support/en_US/security/VTS24-013" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T06:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vr6g-27c6-8qqc/GHSA-vr6g-27c6-8qqc.json b/advisories/unreviewed/2024/11/GHSA-vr6g-27c6-8qqc/GHSA-vr6g-27c6-8qqc.json new file mode 100644 index 00000000000..413680b527b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-vr6g-27c6-8qqc/GHSA-vr6g-27c6-8qqc.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vr6g-27c6-8qqc", + "modified": "2024-11-18T06:30:35Z", + "published": "2024-11-18T06:30:35Z", + "aliases": [ + "CVE-2024-52918" + ], + "details": "Bitcoin-Qt in Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption and application crash) via a BIP21 r parameter for a URL that has a large file.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52918" + }, + { + "type": "WEB", + "url": "https://bitcoincore.org/en/2024/07/03/disclose-bip70-crash" + }, + { + "type": "WEB", + "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T04:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w2jg-6vfx-xj22/GHSA-w2jg-6vfx-xj22.json b/advisories/unreviewed/2024/11/GHSA-w2jg-6vfx-xj22/GHSA-w2jg-6vfx-xj22.json new file mode 100644 index 00000000000..a830f32621e --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w2jg-6vfx-xj22/GHSA-w2jg-6vfx-xj22.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w2jg-6vfx-xj22", + "modified": "2024-11-18T06:30:35Z", + "published": "2024-11-18T06:30:35Z", + "aliases": [ + "CVE-2015-20111" + ], + "details": "miniupnp before 4c90b87, as used in Bitcoin Core before 0.12 and other products, lacks checks for snprintf return values, leading to a buffer overflow and significant data leak, a different vulnerability than CVE-2019-12107. In Bitcoin Core before 0.12, remote code execution was possible in conjunction with CVE-2015-6031 exploitation.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-20111" + }, + { + "type": "WEB", + "url": "https://github.com/miniupnp/miniupnp/pull/157" + }, + { + "type": "WEB", + "url": "https://github.com/miniupnp/miniupnp/commit/4c90b87ce3d2517097880279e8c3daa7731100e6" + }, + { + "type": "WEB", + "url": "https://bitcoincore.org/en/2024/07/03/disclose_upnp_rce" + }, + { + "type": "WEB", + "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T04:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w3c8-7r8f-9jp8/GHSA-w3c8-7r8f-9jp8.json b/advisories/unreviewed/2024/11/GHSA-w3c8-7r8f-9jp8/GHSA-w3c8-7r8f-9jp8.json new file mode 100644 index 00000000000..d62ed131442 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w3c8-7r8f-9jp8/GHSA-w3c8-7r8f-9jp8.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w3c8-7r8f-9jp8", + "modified": "2024-11-18T06:30:35Z", + "published": "2024-11-18T06:30:35Z", + "aliases": [ + "CVE-2024-38828" + ], + "details": "Spring MVC controller methods with an @RequestBody byte[] method parameter are vulnerable to a DoS attack.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38828" + }, + { + "type": "WEB", + "url": "https://spring.io/security/cve-2024-38828" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T04:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w9wj-2hjp-gx85/GHSA-w9wj-2hjp-gx85.json b/advisories/unreviewed/2024/11/GHSA-w9wj-2hjp-gx85/GHSA-w9wj-2hjp-gx85.json new file mode 100644 index 00000000000..a7c2f52dc72 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w9wj-2hjp-gx85/GHSA-w9wj-2hjp-gx85.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w9wj-2hjp-gx85", + "modified": "2024-11-18T06:30:36Z", + "published": "2024-11-18T06:30:36Z", + "aliases": [ + "CVE-2024-11308" + ], + "details": "The DVC from TRCore encrypts files using a hardcoded key. Attackers can use this key to decrypt the files and restore the original content.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11308" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/en/cp-139-8241-1af92-2.html" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/tw/cp-132-8240-562c3-1.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-321" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T06:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-wqx3-8496-4xhc/GHSA-wqx3-8496-4xhc.json b/advisories/unreviewed/2024/11/GHSA-wqx3-8496-4xhc/GHSA-wqx3-8496-4xhc.json new file mode 100644 index 00000000000..bac360d3295 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-wqx3-8496-4xhc/GHSA-wqx3-8496-4xhc.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wqx3-8496-4xhc", + "modified": "2024-11-18T06:30:35Z", + "published": "2024-11-18T06:30:35Z", + "aliases": [ + "CVE-2024-52920" + ], + "details": "Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed GETDATA message.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52920" + }, + { + "type": "WEB", + "url": "https://bitcoincore.org/en/2024/07/03/disclose-getdata-cpu" + }, + { + "type": "WEB", + "url": "https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-18T04:15:04Z" + } +} \ No newline at end of file