netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2m77-r88p-x375
GHSA-546p-247r-9672
GHSA-5j8c-469m-fq24
GHSA-5qm4-39ww-g3wc
GHSA-75g8-qq4f-vwx8
GHSA-7xrv-5wwq-6q83
GHSA-8q6r-7pj6-2j2p
GHSA-97c4-2w4v-c7r8
GHSA-g98x-h3mj-jpm8
GHSA-hhvh-688h-p9xw
GHSA-jjpg-fxf6-vwcx
GHSA-jqf8-33jw-9pf8
GHSA-xhqw-4hcq-fcvr
GHSA-xqvw-7hh9-jm8v
This commit is contained in:
advisory-database[bot]
2024-07-31 09:33:03 +00:00
parent b861cf2b64
commit dd6c577b78
14 changed files with 629 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/07/GHSA-2m77-r88p-x375/GHSA-2m77-r88p-x375.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2m77-r88p-x375",
"modified": "2024-07-31T09:30:50Z",
"published": "2024-07-31T09:30:50Z",
"aliases": [
"CVE-2024-32857"
],
"details": "Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and escalation of privilege",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32857"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000225474/dsa-2024-242"
}
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T09:15:03Z"
}
}
advisories/unreviewed/2024/07/GHSA-546p-247r-9672/GHSA-546p-247r-9672.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-546p-247r-9672",
"modified": "2024-07-31T09:30:49Z",
"published": "2024-07-31T09:30:49Z",
"aliases": [
"CVE-2024-7299"
],
"details": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Bolt CMS 3.7.1. It has been rated as problematic. This issue affects some unknown processing of the file /preview/page of the component Entry Preview Handler. The manipulation of the argument body leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273167. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7299"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.273167"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.273167"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.379971"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T07:15:02Z"
}
}
advisories/unreviewed/2024/07/GHSA-5j8c-469m-fq24/GHSA-5j8c-469m-fq24.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5j8c-469m-fq24",
"modified": "2024-07-31T09:30:49Z",
"published": "2024-07-31T09:30:49Z",
"aliases": [
"CVE-2024-6980"
],
"details": "A verbose error handling issue in the proxy service implemented in the GravityZone Update Server allows an attacker to cause a server-side request forgery. This issue only affects GravityZone Console versions before 6.38.1-5 running only on premise.",
"severity": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6980"
},
{
"type": "WEB",
"url": "https://www.bitdefender.com/consumer/support/support/security-advisories/verbose-error-handling-issue-in-gravityzone-update-server-proxy-service"
}
],
"database_specific": {
"cwe_ids": [
"CWE-209"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T07:15:02Z"
}
}
advisories/unreviewed/2024/07/GHSA-5qm4-39ww-g3wc/GHSA-5qm4-39ww-g3wc.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5qm4-39ww-g3wc",
"modified": "2024-07-31T09:30:50Z",
"published": "2024-07-31T09:30:50Z",
"aliases": [
"CVE-2024-7308"
],
"details": "A vulnerability was found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /view_bill.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273200.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7308"
},
{
"type": "WEB",
"url": "https://gist.github.com/topsky979/c11fd2c1b9027831031de2e58cbf5ff3"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.273200"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.273200"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.382329"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T09:15:05Z"
}
}
advisories/unreviewed/2024/07/GHSA-75g8-qq4f-vwx8/GHSA-75g8-qq4f-vwx8.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-75g8-qq4f-vwx8",
"modified": "2024-07-31T09:30:49Z",
"published": "2024-07-31T09:30:49Z",
"aliases": [
"CVE-2023-28074"
],
"details": "Dell BSAFE Crypto-C Micro Edition 4.1.5 and Dell BSAFE Micro Edition Suite, versions 4.0 through 4.6.1 and version 5.0 contain a buffer over-read vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28074"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000212325/dsa-2023-120-dell-bsafe-micro-edition-suite-security-update"
}
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T08:15:02Z"
}
}
advisories/unreviewed/2024/07/GHSA-7xrv-5wwq-6q83/GHSA-7xrv-5wwq-6q83.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7xrv-5wwq-6q83",
"modified": "2024-07-31T09:30:50Z",
"published": "2024-07-31T09:30:50Z",
"aliases": [
"CVE-2024-7306"
],
"details": "A vulnerability, which was classified as critical, was found in SourceCodester Establishment Billing Management System 1.0. Affected is an unknown function of the file /manage_block.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-273198 is the identifier assigned to this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7306"
},
{
"type": "WEB",
"url": "https://gist.github.com/topsky979/0d5ec3fac4f1fc895478344be5521575"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.273198"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.273198"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.382327"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T08:15:03Z"
}
}
advisories/unreviewed/2024/07/GHSA-8q6r-7pj6-2j2p/GHSA-8q6r-7pj6-2j2p.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8q6r-7pj6-2j2p",
"modified": "2024-07-31T09:30:50Z",
"published": "2024-07-31T09:30:50Z",
"aliases": [
"CVE-2024-37142"
],
"details": "Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and escalation of privilege",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37142"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000225474/dsa-2024-242"
}
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T09:15:04Z"
}
}
advisories/unreviewed/2024/07/GHSA-97c4-2w4v-c7r8/GHSA-97c4-2w4v-c7r8.json
+43
View File
@@ -0,0 +1,43 @@
{
"schema_version": "1.4.0",
"id": "GHSA-97c4-2w4v-c7r8",
"modified": "2024-07-31T09:30:49Z",
"published": "2024-07-31T09:30:49Z",
"aliases": [
"CVE-2024-7264"
],
"details": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7264"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2629968"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2024-7264.html"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2024-7264.json"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T08:15:02Z"
}
}
advisories/unreviewed/2024/07/GHSA-g98x-h3mj-jpm8/GHSA-g98x-h3mj-jpm8.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g98x-h3mj-jpm8",
"modified": "2024-07-31T09:30:50Z",
"published": "2024-07-31T09:30:50Z",
"aliases": [
"CVE-2024-2508"
],
"details": "The WP Mobile Menu plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_menu_item_icon function in all versions up to, and including, 2.8.4.4. This makes it possible for unauthenticated attackers to add the '_mobmenu_icon' post meta to arbitrary posts with an arbitrary (but sanitized) value. NOTE: Version 2.8.4.4 contains a partial fix for this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2508"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fmobile-menu%2Ftrunk%2Fincludes%2Fclass-wp-mobile-menu-core.php&old=3125561&new_path=%2Fmobile-menu%2Ftrunk%2Fincludes%2Fclass-wp-mobile-menu-core.php&new=3125561&sfp_email=&sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3cd9569f-3cda-4482-8ccd-c3f362b4e651?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T09:15:02Z"
}
}
advisories/unreviewed/2024/07/GHSA-hhvh-688h-p9xw/GHSA-hhvh-688h-p9xw.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hhvh-688h-p9xw",
"modified": "2024-07-31T09:30:49Z",
"published": "2024-07-31T09:30:49Z",
"aliases": [
"CVE-2024-7303"
],
"details": "A vulnerability was found in itsourcecode Online Blood Bank Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /request.php of the component Send Blood Request Page. The manipulation of the argument Address/bloodgroup leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-273185 was assigned to this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7303"
},
{
"type": "WEB",
"url": "https://github.com/cl4irv0yance/CVEs/issues/1"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.273185"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.273185"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.382035"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T08:15:02Z"
}
}
advisories/unreviewed/2024/07/GHSA-jjpg-fxf6-vwcx/GHSA-jjpg-fxf6-vwcx.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jjpg-fxf6-vwcx",
"modified": "2024-07-31T09:30:50Z",
"published": "2024-07-31T09:30:50Z",
"aliases": [
"CVE-2024-37129"
],
"details": "Dell Inventory Collector, versions prior to 12.3.0.6 contains a Path Traversal vulnerability. A local authenticated malicious user could potentially exploit this vulnerability, leading to arbitrary code execution on the system.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37129"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000225779/dsa-2024-263"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T09:15:04Z"
}
}
advisories/unreviewed/2024/07/GHSA-jqf8-33jw-9pf8/GHSA-jqf8-33jw-9pf8.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jqf8-33jw-9pf8",
"modified": "2024-07-31T09:30:50Z",
"published": "2024-07-31T09:30:50Z",
"aliases": [
"CVE-2024-7307"
],
"details": "A vulnerability has been found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /manage_billing.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273199.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7307"
},
{
"type": "WEB",
"url": "https://gist.github.com/topsky979/df642bf14cce32c58d4805b6f6cf44e0"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.273199"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.273199"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.382328"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T09:15:05Z"
}
}
advisories/unreviewed/2024/07/GHSA-xhqw-4hcq-fcvr/GHSA-xhqw-4hcq-fcvr.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xhqw-4hcq-fcvr",
"modified": "2024-07-31T09:30:49Z",
"published": "2024-07-31T09:30:49Z",
"aliases": [
"CVE-2024-7300"
],
"details": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in Bolt CMS 3.7.1. Affected is an unknown function of the file /bolt/editcontent/showcases of the component Showcase Creation Handler. The manipulation of the argument textarea leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273168. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7300"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.273168"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.273168"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.380678"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T07:15:02Z"
}
}
advisories/unreviewed/2024/07/GHSA-xqvw-7hh9-jm8v/GHSA-xqvw-7hh9-jm8v.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xqvw-7hh9-jm8v",
"modified": "2024-07-31T09:30:50Z",
"published": "2024-07-31T09:30:50Z",
"aliases": [
"CVE-2024-37127"
],
"details": "Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading to arbitrary code execution and escalation of privilege",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37127"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000225474/dsa-2024-242"
}
],
"database_specific": {
"cwe_ids": [
"CWE-427"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T09:15:03Z"
}
}