diff --git a/advisories/unreviewed/2024/01/GHSA-v7gp-f4wc-h5w4/GHSA-v7gp-f4wc-h5w4.json b/advisories/unreviewed/2024/01/GHSA-v7gp-f4wc-h5w4/GHSA-v7gp-f4wc-h5w4.json index 857d19be2e8..9bee8f5ff27 100644 --- a/advisories/unreviewed/2024/01/GHSA-v7gp-f4wc-h5w4/GHSA-v7gp-f4wc-h5w4.json +++ b/advisories/unreviewed/2024/01/GHSA-v7gp-f4wc-h5w4/GHSA-v7gp-f4wc-h5w4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-v7gp-f4wc-h5w4", - "modified": "2024-01-29T18:31:46Z", + "modified": "2024-03-28T21:30:31Z", "published": "2024-01-22T15:30:23Z", "aliases": [ "CVE-2020-36771" @@ -25,6 +25,10 @@ "type": "WEB", "url": "https://blog.cloudlinux.com/cagefs-lve-wrappers-and-bsock-have-been-rolled-out-to-100" }, + { + "type": "WEB", + "url": "https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-01_CloudLinux_CageFS_Token_Disclosure" + }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/176790/CloudLinux-CageFS-7.1.1-1-Token-Disclosure.html" diff --git a/advisories/unreviewed/2024/01/GHSA-xcjc-c88c-v52w/GHSA-xcjc-c88c-v52w.json b/advisories/unreviewed/2024/01/GHSA-xcjc-c88c-v52w/GHSA-xcjc-c88c-v52w.json index 5962d3f2412..bc48157d5db 100644 --- a/advisories/unreviewed/2024/01/GHSA-xcjc-c88c-v52w/GHSA-xcjc-c88c-v52w.json +++ b/advisories/unreviewed/2024/01/GHSA-xcjc-c88c-v52w/GHSA-xcjc-c88c-v52w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xcjc-c88c-v52w", - "modified": "2024-01-29T18:31:47Z", + "modified": "2024-03-28T21:30:31Z", "published": "2024-01-22T15:30:23Z", "aliases": [ "CVE-2020-36772" @@ -25,6 +25,10 @@ "type": "WEB", "url": "https://blog.cloudlinux.com/lve-manager-lve-stats-lve-utils-and-alt-python27-cllib-have-been-rolled-out-to-100" }, + { + "type": "WEB", + "url": "https://github.com/sbaresearch/advisories/tree/public/2020/SBA-ADV-20200707-02_CloudLinux_CageFS_Insufficiently_Restricted_Proxy_Commands" + }, { "type": "WEB", "url": "http://packetstormsecurity.com/files/176791/CloudLinux-CageFS-7.0.8-2-Insufficiently-Restricted-Proxy-Command.html" diff --git a/advisories/unreviewed/2024/03/GHSA-2c78-596m-9g6p/GHSA-2c78-596m-9g6p.json b/advisories/unreviewed/2024/03/GHSA-2c78-596m-9g6p/GHSA-2c78-596m-9g6p.json new file mode 100644 index 00000000000..56cd43a9cab --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-2c78-596m-9g6p/GHSA-2c78-596m-9g6p.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2c78-596m-9g6p", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-25953" + ], + "details": "Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to denial of service, information tampering.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25953" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-61" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-4hww-mcvx-h475/GHSA-4hww-mcvx-h475.json b/advisories/unreviewed/2024/03/GHSA-4hww-mcvx-h475/GHSA-4hww-mcvx-h475.json new file mode 100644 index 00000000000..1e36ea23f61 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-4hww-mcvx-h475/GHSA-4hww-mcvx-h475.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4hww-mcvx-h475", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-25954" + ], + "details": "Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25954" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-613" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-667w-8cmv-fhv9/GHSA-667w-8cmv-fhv9.json b/advisories/unreviewed/2024/03/GHSA-667w-8cmv-fhv9/GHSA-667w-8cmv-fhv9.json new file mode 100644 index 00000000000..5c8cfa94375 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-667w-8cmv-fhv9/GHSA-667w-8cmv-fhv9.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-667w-8cmv-fhv9", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-28091" + ], + "details": "Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via User Defined Service in managed_services_add.asp (the victim must click an X for a deletion).", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28091" + }, + { + "type": "WEB", + "url": "https://github.com/actuator/cve/blob/main/Technicolor/CVE-2024-28091" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T20:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-6gq7-9m3q-25hx/GHSA-6gq7-9m3q-25hx.json b/advisories/unreviewed/2024/03/GHSA-6gq7-9m3q-25hx/GHSA-6gq7-9m3q-25hx.json new file mode 100644 index 00000000000..f6945eef7d9 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-6gq7-9m3q-25hx/GHSA-6gq7-9m3q-25hx.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6gq7-9m3q-25hx", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-31065" + ], + "details": "Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the City input field.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31065" + }, + { + "type": "WEB", + "url": "https://github.com/sahildari/cve/blob/master/CVE-2024-31065.md" + }, + { + "type": "WEB", + "url": "https://owasp.org/www-community/attacks/xss" + }, + { + "type": "WEB", + "url": "https://portswigger.net/web-security/cross-site-scripting/stored" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-6rvc-cc4c-ffwj/GHSA-6rvc-cc4c-ffwj.json b/advisories/unreviewed/2024/03/GHSA-6rvc-cc4c-ffwj/GHSA-6rvc-cc4c-ffwj.json new file mode 100644 index 00000000000..ca714655afd --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-6rvc-cc4c-ffwj/GHSA-6rvc-cc4c-ffwj.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6rvc-cc4c-ffwj", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-25506" + ], + "details": "Cross Site Scripting vulnerability in Process Maker, Inc ProcessMaker before 4.0 allows a remote attacker to run arbitrary code via control of the pm_sys_sys cookie.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25506" + }, + { + "type": "WEB", + "url": "https://medium.com/%40proflamyt/cve-2024-25506-425ba3212fb6" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T20:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-88v9-rfqm-4wj5/GHSA-88v9-rfqm-4wj5.json b/advisories/unreviewed/2024/03/GHSA-88v9-rfqm-4wj5/GHSA-88v9-rfqm-4wj5.json new file mode 100644 index 00000000000..628d940d28d --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-88v9-rfqm-4wj5/GHSA-88v9-rfqm-4wj5.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-88v9-rfqm-4wj5", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-27719" + ], + "details": "A cross site scripting (XSS) vulnerability in rems FAQ Management System v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the Frequently Asked Question field in the Add FAQ function.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27719" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com/php/17175/faq-management-system-using-php-and-mysql-source-code.html" + }, + { + "type": "WEB", + "url": "https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2024-002" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-8rqc-wx6q-m4qc/GHSA-8rqc-wx6q-m4qc.json b/advisories/unreviewed/2024/03/GHSA-8rqc-wx6q-m4qc/GHSA-8rqc-wx6q-m4qc.json new file mode 100644 index 00000000000..c7c5c767987 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-8rqc-wx6q-m4qc/GHSA-8rqc-wx6q-m4qc.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8rqc-wx6q-m4qc", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-2947" + ], + "details": "A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2947" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-2947" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2271614" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-77" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-95jq-jh69-72cq/GHSA-95jq-jh69-72cq.json b/advisories/unreviewed/2024/03/GHSA-95jq-jh69-72cq/GHSA-95jq-jh69-72cq.json new file mode 100644 index 00000000000..2309a944ad1 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-95jq-jh69-72cq/GHSA-95jq-jh69-72cq.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-95jq-jh69-72cq", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-25963" + ], + "details": "Dell PowerScale OneFS, versions 8.2.2.x through 9.5.0.x contains a use of a broken cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25963" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-327" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-96hc-g58p-3pq7/GHSA-96hc-g58p-3pq7.json b/advisories/unreviewed/2024/03/GHSA-96hc-g58p-3pq7/GHSA-96hc-g58p-3pq7.json new file mode 100644 index 00000000000..6c71a2e0fca --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-96hc-g58p-3pq7/GHSA-96hc-g58p-3pq7.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-96hc-g58p-3pq7", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-31062" + ], + "details": "Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Street input field.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31062" + }, + { + "type": "WEB", + "url": "https://github.com/sahildari/cve/blob/master/CVE-2024-31062.md" + }, + { + "type": "WEB", + "url": "https://owasp.org/www-community/attacks/xss" + }, + { + "type": "WEB", + "url": "https://portswigger.net/web-security/cross-site-scripting/stored" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-f2p5-3c35-8j2x/GHSA-f2p5-3c35-8j2x.json b/advisories/unreviewed/2024/03/GHSA-f2p5-3c35-8j2x/GHSA-f2p5-3c35-8j2x.json new file mode 100644 index 00000000000..ff5390e2b3b --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-f2p5-3c35-8j2x/GHSA-f2p5-3c35-8j2x.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f2p5-3c35-8j2x", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-25960" + ], + "details": "Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains a cleartext transmission of sensitive information vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25960" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-319" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-g43f-xr59-68c4/GHSA-g43f-xr59-68c4.json b/advisories/unreviewed/2024/03/GHSA-g43f-xr59-68c4/GHSA-g43f-xr59-68c4.json new file mode 100644 index 00000000000..4433efae95c --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-g43f-xr59-68c4/GHSA-g43f-xr59-68c4.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g43f-xr59-68c4", + "modified": "2024-03-28T21:30:32Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-28090" + ], + "details": "Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via User name in dyn_dns.asp.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28090" + }, + { + "type": "WEB", + "url": "https://github.com/actuator/cve/blob/main/Technicolor/CVE-2024-28090" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T20:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-g58w-wr93-q367/GHSA-g58w-wr93-q367.json b/advisories/unreviewed/2024/03/GHSA-g58w-wr93-q367/GHSA-g58w-wr93-q367.json new file mode 100644 index 00000000000..94271ab9c42 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-g58w-wr93-q367/GHSA-g58w-wr93-q367.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g58w-wr93-q367", + "modified": "2024-03-28T21:30:32Z", + "published": "2024-03-28T21:30:32Z", + "aliases": [ + "CVE-2024-3019" + ], + "details": "A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3019" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-3019" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2271898" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-668" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-gmh5-hrww-qvc2/GHSA-gmh5-hrww-qvc2.json b/advisories/unreviewed/2024/03/GHSA-gmh5-hrww-qvc2/GHSA-gmh5-hrww-qvc2.json new file mode 100644 index 00000000000..efb19c30cd7 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-gmh5-hrww-qvc2/GHSA-gmh5-hrww-qvc2.json @@ -0,0 +1,63 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gmh5-hrww-qvc2", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-28713" + ], + "details": "An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file to the theme management feature.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28713" + }, + { + "type": "WEB", + "url": "https://gitee.com/mtons/mblog" + }, + { + "type": "WEB", + "url": "https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%871.png" + }, + { + "type": "WEB", + "url": "https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%872.png" + }, + { + "type": "WEB", + "url": "https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%873.png" + }, + { + "type": "WEB", + "url": "https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%874.png" + }, + { + "type": "WEB", + "url": "https://github.com/JiangXiaoBaiJia/cve/blob/main/%E5%9B%BE%E7%89%875.png" + }, + { + "type": "WEB", + "url": "https://github.com/JiangXiaoBaiJia/cve/blob/main/Mblog%20blog%20system%20has%20SSTI%20template%20injection%20vulnerability.md" + }, + { + "type": "WEB", + "url": "http://mblog.com" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-j9cj-hqr5-3wcm/GHSA-j9cj-hqr5-3wcm.json b/advisories/unreviewed/2024/03/GHSA-j9cj-hqr5-3wcm/GHSA-j9cj-hqr5-3wcm.json new file mode 100644 index 00000000000..0f309b8359c --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-j9cj-hqr5-3wcm/GHSA-j9cj-hqr5-3wcm.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j9cj-hqr5-3wcm", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-25955" + ], + "details": "Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability leading to an execution of an inserted command. Dell recommends customers to upgrade at the earliest opportunity.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25955" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-us/000223609/dsa-2024-108-dell-powermaxos-5978-dell-powermax-os-10-0-1-5-dell-powermax-os-10-1-0-2-dell-unisphere-360-unisphere-powermax-unisphere-powermax-vapp-dell-solutions-enabler-vapp-and-dell-powermax-eem-security-update-for-multiple-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-jpx5-qv8q-fwxp/GHSA-jpx5-qv8q-fwxp.json b/advisories/unreviewed/2024/03/GHSA-jpx5-qv8q-fwxp/GHSA-jpx5-qv8q-fwxp.json new file mode 100644 index 00000000000..8be4e0da94a --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-jpx5-qv8q-fwxp/GHSA-jpx5-qv8q-fwxp.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jpx5-qv8q-fwxp", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-25971" + ], + "details": "Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to information disclosure, denial-of-service.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25971" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-us/000223556/dsa-2024-132-security-update-dell-power-protect-data-manager-for-multiple-security-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-611" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-mh7w-3v8g-mcr4/GHSA-mh7w-3v8g-mcr4.json b/advisories/unreviewed/2024/03/GHSA-mh7w-3v8g-mcr4/GHSA-mh7w-3v8g-mcr4.json new file mode 100644 index 00000000000..ec076f1c642 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-mh7w-3v8g-mcr4/GHSA-mh7w-3v8g-mcr4.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mh7w-3v8g-mcr4", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-31061" + ], + "details": "Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Last Name input field.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31061" + }, + { + "type": "WEB", + "url": "https://github.com/sahildari/cve/blob/master/CVE-2024-31061.md" + }, + { + "type": "WEB", + "url": "https://owasp.org/www-community/attacks/xss" + }, + { + "type": "WEB", + "url": "https://portswigger.net/web-security/cross-site-scripting/stored" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-r2p4-xrgf-rxrx/GHSA-r2p4-xrgf-rxrx.json b/advisories/unreviewed/2024/03/GHSA-r2p4-xrgf-rxrx/GHSA-r2p4-xrgf-rxrx.json new file mode 100644 index 00000000000..943f39e00ab --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-r2p4-xrgf-rxrx/GHSA-r2p4-xrgf-rxrx.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r2p4-xrgf-rxrx", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-25952" + ], + "details": "Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to denial of service, information tampering.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25952" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-61" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-rggc-4jrg-r8g6/GHSA-rggc-4jrg-r8g6.json b/advisories/unreviewed/2024/03/GHSA-rggc-4jrg-r8g6/GHSA-rggc-4jrg-r8g6.json new file mode 100644 index 00000000000..b043a4c5bd9 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-rggc-4jrg-r8g6/GHSA-rggc-4jrg-r8g6.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rggc-4jrg-r8g6", + "modified": "2024-03-28T21:30:32Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-23727" + ], + "details": "The YI Smart Kami Vision com.kamivision.yismart application through 1.0.0_20231219 for Android allows a remote attacker to execute arbitrary JavaScript code via an implicit intent to the com.ants360.yicamera.activity.WebViewActivity component.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23727" + }, + { + "type": "WEB", + "url": "https://github.com/actuator/yi/blob/main/com.kamivision.yismart.V1.0.0_20231219.md" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T21:16:01Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-vx4h-fxv4-24pq/GHSA-vx4h-fxv4-24pq.json b/advisories/unreviewed/2024/03/GHSA-vx4h-fxv4-24pq/GHSA-vx4h-fxv4-24pq.json new file mode 100644 index 00000000000..591ab82e204 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-vx4h-fxv4-24pq/GHSA-vx4h-fxv4-24pq.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vx4h-fxv4-24pq", + "modified": "2024-03-28T21:30:30Z", + "published": "2024-03-28T21:30:30Z", + "aliases": [ + "CVE-2024-25946" + ], + "details": "Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability leading to an execution of an inserted command. Dell recommends customers to upgrade at the earliest opportunity.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25946" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-us/000223609/dsa-2024-108-dell-powermaxos-5978-dell-powermax-os-10-0-1-5-dell-powermax-os-10-1-0-2-dell-unisphere-360-unisphere-powermax-unisphere-powermax-vapp-dell-solutions-enabler-vapp-and-dell-powermax-eem-security-update-for-multiple-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-x7j5-3p38-f69m/GHSA-x7j5-3p38-f69m.json b/advisories/unreviewed/2024/03/GHSA-x7j5-3p38-f69m/GHSA-x7j5-3p38-f69m.json new file mode 100644 index 00000000000..4d4fb9572dd --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-x7j5-3p38-f69m/GHSA-x7j5-3p38-f69m.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x7j5-3p38-f69m", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-31063" + ], + "details": "Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Email input field.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31063" + }, + { + "type": "WEB", + "url": "https://github.com/sahildari/cve/blob/master/CVE-2024-31063.md" + }, + { + "type": "WEB", + "url": "https://owasp.org/www-community/attacks/xss" + }, + { + "type": "WEB", + "url": "https://portswigger.net/web-security/cross-site-scripting/stored" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-xhcj-9vv5-9686/GHSA-xhcj-9vv5-9686.json b/advisories/unreviewed/2024/03/GHSA-xhcj-9vv5-9686/GHSA-xhcj-9vv5-9686.json new file mode 100644 index 00000000000..0da87e424c8 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-xhcj-9vv5-9686/GHSA-xhcj-9vv5-9686.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xhcj-9vv5-9686", + "modified": "2024-03-28T21:30:31Z", + "published": "2024-03-28T21:30:31Z", + "aliases": [ + "CVE-2024-31064" + ], + "details": "Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the First Name input field.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31064" + }, + { + "type": "WEB", + "url": "https://drive.google.com/file/d/1yTIeXAPs3PJcQwj9gxhvs92zTdBwKGVB/view?usp=sharing" + }, + { + "type": "WEB", + "url": "https://github.com/sahildari/cve/blob/master/CVE-2024-31064.md" + }, + { + "type": "WEB", + "url": "http://insurance.com" + }, + { + "type": "WEB", + "url": "http://sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-28T19:15:49Z" + } +} \ No newline at end of file