netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-489g-54j3-q6rq
GHSA-4x48-qpw5-qpgr
GHSA-52j3-f378-p3cw
GHSA-643q-778f-w3wx
GHSA-6gp9-mxjv-gqwr
GHSA-873w-h9q5-86gx
GHSA-crcx-wcr8-prj5
GHSA-f6rp-5fm6-qmhw
GHSA-gc3f-r2gj-mhrp
GHSA-rgxw-5jvr-8c53
GHSA-wwm6-7f3x-4fmg
GHSA-xcwr-rf3v-pxfj
This commit is contained in:
advisory-database[bot]
2024-10-25 00:34:28 +00:00
parent 2caaa5f076
commit df39802c62
12 changed files with 407 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2023/07/GHSA-489g-54j3-q6rq/GHSA-489g-54j3-q6rq.json
+1 -1
View File
@@ -40,7 +40,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2023/07/GHSA-4x48-qpw5-qpgr/GHSA-4x48-qpw5-qpgr.json
+1 -1
View File
@@ -40,7 +40,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"severity": "MODERATE",
"github_reviewed": false,
advisories/unreviewed/2024/10/GHSA-52j3-f378-p3cw/GHSA-52j3-f378-p3cw.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-52j3-f378-p3cw",
"modified": "2024-10-24T21:31:03Z",
"modified": "2024-10-25T00:33:06Z",
"published": "2024-10-24T21:31:03Z",
"aliases": [
"CVE-2024-48454"
],
"details": "An issue in SourceCodester Purchase Order Management System v1.0 allows a remote attacker to execute arbitrary code via the /admin?page=user component",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-24T19:15:15Z"
advisories/unreviewed/2024/10/GHSA-643q-778f-w3wx/GHSA-643q-778f-w3wx.json
+47
View File
@@ -0,0 +1,47 @@
{
"schema_version": "1.4.0",
"id": "GHSA-643q-778f-w3wx",
"modified": "2024-10-25T00:33:06Z",
"published": "2024-10-25T00:33:06Z",
"aliases": [
"CVE-2024-41617"
],
"details": "Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to Incorrect Access Control. The `redirect_if_not_loggedin` function in `functions_security.php` fails to terminate script execution after redirecting unauthenticated users. This flaw allows an unauthenticated attacker to upload arbitrary files, potentially leading to Remote Code Execution.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41617"
},
{
"type": "WEB",
"url": "https://github.com/moneymanagerex/web-money-manager-ex/issues/51"
},
{
"type": "WEB",
"url": "https://github.com/moneymanagerex/web-money-manager-ex/commit/f2850b295ee21bc299799343a3bc4d004d05651d"
},
{
"type": "WEB",
"url": "https://github.com/moneymanagerex/web-money-manager-ex/releases/tag/v1.2.3"
},
{
"type": "WEB",
"url": "https://youtu.be/JaOrlT9G3yo?t=88"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-24T22:15:03Z"
}
}
advisories/unreviewed/2024/10/GHSA-6gp9-mxjv-gqwr/GHSA-6gp9-mxjv-gqwr.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6gp9-mxjv-gqwr",
"modified": "2024-10-25T00:33:06Z",
"published": "2024-10-25T00:33:06Z",
"aliases": [
"CVE-2024-10351"
],
"details": "A vulnerability was found in Tenda RX9 Pro 22.03.02.20. It has been rated as critical. This issue affects the function sub_424CE0 of the file /goform/setMacFilterCfg of the component POST Request Handler. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10351"
},
{
"type": "WEB",
"url": "https://gitee.com/GXB0_0/iot-vul/blob/master/Tenda/RX9/20/setMacFilterCfg.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.281699"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.281699"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.427706"
},
{
"type": "WEB",
"url": "https://www.tenda.com.cn"
}
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-25T00:15:02Z"
}
}
advisories/unreviewed/2024/10/GHSA-873w-h9q5-86gx/GHSA-873w-h9q5-86gx.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-873w-h9q5-86gx",
"modified": "2024-10-24T18:30:44Z",
"modified": "2024-10-25T00:33:06Z",
"published": "2024-10-24T18:30:44Z",
"aliases": [
"CVE-2024-48548"
],
"details": "The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. This vulnerability allows attackers to arbitrarily construct a request to use the app to bind to unknown devices by finding a valid serial number via a bruteforce attack.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-24T17:15:17Z"
advisories/unreviewed/2024/10/GHSA-crcx-wcr8-prj5/GHSA-crcx-wcr8-prj5.json
+47
View File
@@ -0,0 +1,47 @@
{
"schema_version": "1.4.0",
"id": "GHSA-crcx-wcr8-prj5",
"modified": "2024-10-25T00:33:06Z",
"published": "2024-10-25T00:33:06Z",
"aliases": [
"CVE-2024-41618"
],
"details": "Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to SQL Injection in the `transaction_delete_group` function. The vulnerability is due to improper sanitization of user input in the `TrDeleteArr` parameter, which is directly incorporated into an SQL query.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41618"
},
{
"type": "WEB",
"url": "https://github.com/moneymanagerex/web-money-manager-ex/issues/51"
},
{
"type": "WEB",
"url": "https://github.com/moneymanagerex/web-money-manager-ex/commit/f2850b295ee21bc299799343a3bc4d004d05651d"
},
{
"type": "WEB",
"url": "https://github.com/moneymanagerex/web-money-manager-ex/releases/tag/v1.2.3"
},
{
"type": "WEB",
"url": "https://www.youtube.com/watch?v=JaOrlT9G3yo"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-24T22:15:03Z"
}
}
advisories/unreviewed/2024/10/GHSA-f6rp-5fm6-qmhw/GHSA-f6rp-5fm6-qmhw.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f6rp-5fm6-qmhw",
"modified": "2024-10-24T18:30:43Z",
"modified": "2024-10-25T00:33:06Z",
"published": "2024-10-24T18:30:43Z",
"aliases": [
"CVE-2024-48544"
],
"details": "Incorrect access control in the firmware update and download processes of Sylvania Smart Home v3.0.3 allows attackers to access sensitive information by analyzing the code and data within the APK file.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-24T17:15:17Z"
advisories/unreviewed/2024/10/GHSA-gc3f-r2gj-mhrp/GHSA-gc3f-r2gj-mhrp.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gc3f-r2gj-mhrp",
"modified": "2024-10-25T00:33:06Z",
"published": "2024-10-25T00:33:06Z",
"aliases": [
"CVE-2024-10348"
],
"details": "A vulnerability was found in SourceCodester Best House Rental Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php?page=tenants of the component Manage Tenant Details. The manipulation of the argument Last Name/First Name/Middle Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only shows the field \"Last Name\" to be affected. Other fields might be affected as well.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10348"
},
{
"type": "WEB",
"url": "https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/house-rental-management-system.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.281697"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.281697"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.427471"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-24T22:15:03Z"
}
}
advisories/unreviewed/2024/10/GHSA-rgxw-5jvr-8c53/GHSA-rgxw-5jvr-8c53.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rgxw-5jvr-8c53",
"modified": "2024-10-25T00:33:06Z",
"published": "2024-10-25T00:33:06Z",
"aliases": [
"CVE-2024-10353"
],
"details": "A vulnerability classified as critical has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file /admin-dashboard. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This affects a different product and is a different issue than CVE-2024-40480.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10353"
},
{
"type": "WEB",
"url": "https://drive.google.com/file/d/1hEXfbOOkWdYzaSI6ORQvPGBtn09R12Ui/view?usp=drive_link"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.281700"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.281700"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.427957"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-25T00:15:02Z"
}
}
advisories/unreviewed/2024/10/GHSA-wwm6-7f3x-4fmg/GHSA-wwm6-7f3x-4fmg.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wwm6-7f3x-4fmg",
"modified": "2024-10-25T00:33:06Z",
"published": "2024-10-25T00:33:06Z",
"aliases": [
"CVE-2024-10349"
],
"details": "A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as critical. Affected by this issue is the function delete_tenant of the file /ajax.php?action=delete_tenant. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10349"
},
{
"type": "WEB",
"url": "https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/house-rentalmanagement-system1.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.281696"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.281696"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.427472"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-24T22:15:03Z"
}
}
advisories/unreviewed/2024/10/GHSA-xcwr-rf3v-pxfj/GHSA-xcwr-rf3v-pxfj.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xcwr-rf3v-pxfj",
"modified": "2024-10-25T00:33:06Z",
"published": "2024-10-25T00:33:06Z",
"aliases": [
"CVE-2024-10350"
],
"details": "A vulnerability was found in code-projects Hospital Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/add-doctor.php. The manipulation of the argument docname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10350"
},
{
"type": "WEB",
"url": "https://github.com/RTio7/cve/issues/1"
},
{
"type": "WEB",
"url": "https://code-projects.org"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.281698"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.281698"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.427705"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-24T23:15:13Z"
}
}