diff --git a/advisories/unreviewed/2023/10/GHSA-3229-mfqx-wc57/GHSA-3229-mfqx-wc57.json b/advisories/unreviewed/2023/10/GHSA-3229-mfqx-wc57/GHSA-3229-mfqx-wc57.json index 817ec33833c..371800a4b68 100644 --- a/advisories/unreviewed/2023/10/GHSA-3229-mfqx-wc57/GHSA-3229-mfqx-wc57.json +++ b/advisories/unreviewed/2023/10/GHSA-3229-mfqx-wc57/GHSA-3229-mfqx-wc57.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-3229-mfqx-wc57", - "modified": "2023-10-04T12:30:14Z", + "modified": "2023-12-19T15:30:27Z", "published": "2023-10-04T12:30:14Z", "aliases": [ "CVE-2023-2809" @@ -31,7 +31,7 @@ "CWE-312", "CWE-798" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-10-04T11:15:10Z" diff --git a/advisories/unreviewed/2023/10/GHSA-ccqp-gv79-xc45/GHSA-ccqp-gv79-xc45.json b/advisories/unreviewed/2023/10/GHSA-ccqp-gv79-xc45/GHSA-ccqp-gv79-xc45.json index a55d8e0e25d..44f632e55b8 100644 --- a/advisories/unreviewed/2023/10/GHSA-ccqp-gv79-xc45/GHSA-ccqp-gv79-xc45.json +++ b/advisories/unreviewed/2023/10/GHSA-ccqp-gv79-xc45/GHSA-ccqp-gv79-xc45.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-ccqp-gv79-xc45", - "modified": "2023-10-10T15:30:51Z", + "modified": "2023-12-19T15:30:28Z", "published": "2023-10-10T15:30:51Z", "aliases": [ "CVE-2023-5499" @@ -28,9 +28,10 @@ ], "database_specific": { "cwe_ids": [ - "CWE-200" + "CWE-200", + "CWE-532" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-10-10T14:15:11Z" diff --git a/advisories/unreviewed/2023/10/GHSA-jjmh-cxjf-3v7g/GHSA-jjmh-cxjf-3v7g.json b/advisories/unreviewed/2023/10/GHSA-jjmh-cxjf-3v7g/GHSA-jjmh-cxjf-3v7g.json index b267a765b68..9abda07a0a3 100644 --- a/advisories/unreviewed/2023/10/GHSA-jjmh-cxjf-3v7g/GHSA-jjmh-cxjf-3v7g.json +++ b/advisories/unreviewed/2023/10/GHSA-jjmh-cxjf-3v7g/GHSA-jjmh-cxjf-3v7g.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jjmh-cxjf-3v7g", - "modified": "2023-10-04T18:30:32Z", + "modified": "2023-12-19T15:30:27Z", "published": "2023-10-04T18:30:32Z", "aliases": [ "CVE-2021-3784" @@ -31,7 +31,7 @@ "CWE-285", "CWE-287" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-10-04T16:15:09Z" diff --git a/advisories/unreviewed/2023/12/GHSA-2gwm-8mq4-p9j4/GHSA-2gwm-8mq4-p9j4.json b/advisories/unreviewed/2023/12/GHSA-2gwm-8mq4-p9j4/GHSA-2gwm-8mq4-p9j4.json new file mode 100644 index 00000000000..6a4198cb61d --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-2gwm-8mq4-p9j4/GHSA-2gwm-8mq4-p9j4.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2gwm-8mq4-p9j4", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6913" + ], + "details": "A session hijacking vulnerability has been detected in the Imou Life application affecting version 6.7.0. This vulnerability could allow an attacker to hijack user accounts due to the QR code functionality not properly filtering codes when scanning a new device and directly running WebView without prompting or displaying it to the user. This vulnerability could trigger phishing attacks.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6913" + }, + { + "type": "WEB", + "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/session-hijacking-imou-life-app" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-384" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T15:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-2mpv-2j92-5mm4/GHSA-2mpv-2j92-5mm4.json b/advisories/unreviewed/2023/12/GHSA-2mpv-2j92-5mm4/GHSA-2mpv-2j92-5mm4.json new file mode 100644 index 00000000000..8ba6d834d32 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-2mpv-2j92-5mm4/GHSA-2mpv-2j92-5mm4.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2mpv-2j92-5mm4", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6867" + ], + "details": "The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission prompts. It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6867" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1863863" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-54/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-36vp-p2m5-97vp/GHSA-36vp-p2m5-97vp.json b/advisories/unreviewed/2023/12/GHSA-36vp-p2m5-97vp/GHSA-36vp-p2m5-97vp.json new file mode 100644 index 00000000000..f5725aab85d --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-36vp-p2m5-97vp/GHSA-36vp-p2m5-97vp.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-36vp-p2m5-97vp", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6864" + ], + "details": "Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6864" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1736385%2C1810805%2C1846328%2C1856090%2C1858033%2C1858509%2C1862089%2C1862777%2C1864015" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-54/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-55/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-3863-2447-669p/GHSA-3863-2447-669p.json b/advisories/unreviewed/2023/12/GHSA-3863-2447-669p/GHSA-3863-2447-669p.json new file mode 100644 index 00000000000..32ca7bb52bc --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-3863-2447-669p/GHSA-3863-2447-669p.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3863-2447-669p", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6730" + ], + "details": "Deserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6730" + }, + { + "type": "WEB", + "url": "https://github.com/huggingface/transformers/commit/1d63b0ec361e7a38f1339385e8a5a855085532ce" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/423611ee-7a2a-442a-babb-3ed2f8385c16" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T13:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-3r8p-3x67-72v8/GHSA-3r8p-3x67-72v8.json b/advisories/unreviewed/2023/12/GHSA-3r8p-3x67-72v8/GHSA-3r8p-3x67-72v8.json index 4107dd3a74b..63eb653a008 100644 --- a/advisories/unreviewed/2023/12/GHSA-3r8p-3x67-72v8/GHSA-3r8p-3x67-72v8.json +++ b/advisories/unreviewed/2023/12/GHSA-3r8p-3x67-72v8/GHSA-3r8p-3x67-72v8.json @@ -21,6 +21,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6448" }, + { + "type": "WEB", + "url": "https://downloads.unitronicsplc.com/Sites/plc/Technical_Library/Unitronics-Cybersecurity-Advisory-2023-001-CVE-2023-6448.pdf" + }, { "type": "WEB", "url": "https://downloads.unitronicsplc.com/Sites/plc/Visilogic/Version_Changes-Bug_Reports/VisiLogic%209.9.00%20Version%20changes.pdf" diff --git a/advisories/unreviewed/2023/12/GHSA-3xch-57qj-5x2p/GHSA-3xch-57qj-5x2p.json b/advisories/unreviewed/2023/12/GHSA-3xch-57qj-5x2p/GHSA-3xch-57qj-5x2p.json new file mode 100644 index 00000000000..4455e51ca86 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-3xch-57qj-5x2p/GHSA-3xch-57qj-5x2p.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3xch-57qj-5x2p", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6868" + ], + "details": "In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one. This could allow empty messages to be sent from unauthorized parties.\n*This bug only affects Firefox on Android.* This vulnerability affects Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6868" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1865488" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-43mg-g32w-94qf/GHSA-43mg-g32w-94qf.json b/advisories/unreviewed/2023/12/GHSA-43mg-g32w-94qf/GHSA-43mg-g32w-94qf.json new file mode 100644 index 00000000000..05dbb9cee4f --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-43mg-g32w-94qf/GHSA-43mg-g32w-94qf.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-43mg-g32w-94qf", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6871" + ], + "details": "Under certain conditions, Firefox did not display a warning when a user attempted to navigate to a new protocol handler. This vulnerability affects Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6871" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1828334" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-5c8h-j5h5-r8w3/GHSA-5c8h-j5h5-r8w3.json b/advisories/unreviewed/2023/12/GHSA-5c8h-j5h5-r8w3/GHSA-5c8h-j5h5-r8w3.json new file mode 100644 index 00000000000..0b4112910d9 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-5c8h-j5h5-r8w3/GHSA-5c8h-j5h5-r8w3.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5c8h-j5h5-r8w3", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6865" + ], + "details": "`EncryptingOutputStream` was susceptible to exposing uninitialized data. This issue could only be abused in order to write data to a local disk which may have implications for private browsing mode. This vulnerability affects Firefox ESR < 115.6 and Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6865" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1864123" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-54/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-5x56-7cpg-238g/GHSA-5x56-7cpg-238g.json b/advisories/unreviewed/2023/12/GHSA-5x56-7cpg-238g/GHSA-5x56-7cpg-238g.json new file mode 100644 index 00000000000..5a4c25a6eff --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-5x56-7cpg-238g/GHSA-5x56-7cpg-238g.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5x56-7cpg-238g", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6862" + ], + "details": "A use-after-free was identified in the `nsDNSService::Init`. This issue appears to manifest rarely during start-up. This vulnerability affects Firefox ESR < 115.6 and Thunderbird < 115.6.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6862" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1868042" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-54/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-55/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-63rr-fhmr-42fq/GHSA-63rr-fhmr-42fq.json b/advisories/unreviewed/2023/12/GHSA-63rr-fhmr-42fq/GHSA-63rr-fhmr-42fq.json new file mode 100644 index 00000000000..0a6481f8982 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-63rr-fhmr-42fq/GHSA-63rr-fhmr-42fq.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-63rr-fhmr-42fq", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-50762" + ], + "details": "When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user. This is because the text was interpreted as a MIME message and the first paragraph was always treated as an email header section. A digitally signed text from a different context, such as a signed GIT commit, could be used to spoof an email message. This vulnerability affects Thunderbird < 115.6.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50762" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1862625" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-55/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-86pm-w7xp-8c7p/GHSA-86pm-w7xp-8c7p.json b/advisories/unreviewed/2023/12/GHSA-86pm-w7xp-8c7p/GHSA-86pm-w7xp-8c7p.json new file mode 100644 index 00000000000..149ea75e411 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-86pm-w7xp-8c7p/GHSA-86pm-w7xp-8c7p.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-86pm-w7xp-8c7p", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-50761" + ], + "details": "The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. If present, Thunderbird did not compare the signature creation date with the message date and time, and displayed a valid signature despite a date or time mismatch. This could be used to give recipients the impression that a message was sent at a different date or time. This vulnerability affects Thunderbird < 115.6.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50761" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1865647" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-55/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-8c4w-xw52-85px/GHSA-8c4w-xw52-85px.json b/advisories/unreviewed/2023/12/GHSA-8c4w-xw52-85px/GHSA-8c4w-xw52-85px.json new file mode 100644 index 00000000000..07d4e228046 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-8c4w-xw52-85px/GHSA-8c4w-xw52-85px.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8c4w-xw52-85px", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6869" + ], + "details": "A `` element could have been manipulated to paint content outside of a sandboxed iframe. This could allow untrusted content to display under the guise of trusted content. This vulnerability affects Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6869" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1799036" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-8fq6-p869-285x/GHSA-8fq6-p869-285x.json b/advisories/unreviewed/2023/12/GHSA-8fq6-p869-285x/GHSA-8fq6-p869-285x.json new file mode 100644 index 00000000000..7263d87a248 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-8fq6-p869-285x/GHSA-8fq6-p869-285x.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8fq6-p869-285x", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6857" + ], + "details": "When resolving a symlink, a race may occur where the buffer passed to `readlink` may actually be smaller than necessary. \n*This bug only affects Firefox on Unix-based operating systems (Android, Linux, MacOS). Windows is unaffected.* This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6857" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1796023" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-54/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-55/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-95mg-jgfx-54v9/GHSA-95mg-jgfx-54v9.json b/advisories/unreviewed/2023/12/GHSA-95mg-jgfx-54v9/GHSA-95mg-jgfx-54v9.json index cb23415a88d..d070e440cc3 100644 --- a/advisories/unreviewed/2023/12/GHSA-95mg-jgfx-54v9/GHSA-95mg-jgfx-54v9.json +++ b/advisories/unreviewed/2023/12/GHSA-95mg-jgfx-54v9/GHSA-95mg-jgfx-54v9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-95mg-jgfx-54v9", - "modified": "2023-12-19T12:30:19Z", + "modified": "2023-12-19T15:30:29Z", "published": "2023-12-19T12:30:19Z", "aliases": [ "CVE-2023-46104" @@ -24,6 +24,10 @@ { "type": "WEB", "url": "https://lists.apache.org/thread/yxbxg4wryb7cb7wyybk11l5nqy0rsrvl" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2023/12/19/1" } ], "database_specific": { diff --git a/advisories/unreviewed/2023/12/GHSA-96p4-h67r-wqfm/GHSA-96p4-h67r-wqfm.json b/advisories/unreviewed/2023/12/GHSA-96p4-h67r-wqfm/GHSA-96p4-h67r-wqfm.json new file mode 100644 index 00000000000..8a87f05f95a --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-96p4-h67r-wqfm/GHSA-96p4-h67r-wqfm.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-96p4-h67r-wqfm", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6860" + ], + "details": "The `VideoBridge` allowed any content process to use textures produced by remote decoders. This could be abused to escape the sandbox. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6860" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1854669" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-54/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-55/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-9846-hqmr-2486/GHSA-9846-hqmr-2486.json b/advisories/unreviewed/2023/12/GHSA-9846-hqmr-2486/GHSA-9846-hqmr-2486.json new file mode 100644 index 00000000000..bc6d1926ae3 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-9846-hqmr-2486/GHSA-9846-hqmr-2486.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9846-hqmr-2486", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6856" + ], + "details": "The WebGL `DrawElementsInstanced` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6856" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1843782" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-54/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-55/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-9f8v-397v-w8c6/GHSA-9f8v-397v-w8c6.json b/advisories/unreviewed/2023/12/GHSA-9f8v-397v-w8c6/GHSA-9f8v-397v-w8c6.json new file mode 100644 index 00000000000..aa9920184e6 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-9f8v-397v-w8c6/GHSA-9f8v-397v-w8c6.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9f8v-397v-w8c6", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6873" + ], + "details": "Memory safety bugs present in Firefox 120. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6873" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1855327%2C1862089%2C1862723" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-chfc-x833-27cm/GHSA-chfc-x833-27cm.json b/advisories/unreviewed/2023/12/GHSA-chfc-x833-27cm/GHSA-chfc-x833-27cm.json index 36ad975dbdd..6a71aa4b4df 100644 --- a/advisories/unreviewed/2023/12/GHSA-chfc-x833-27cm/GHSA-chfc-x833-27cm.json +++ b/advisories/unreviewed/2023/12/GHSA-chfc-x833-27cm/GHSA-chfc-x833-27cm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-chfc-x833-27cm", - "modified": "2023-12-15T15:30:28Z", + "modified": "2023-12-19T15:30:29Z", "published": "2023-12-15T15:30:28Z", "aliases": [ "CVE-2023-49170" diff --git a/advisories/unreviewed/2023/12/GHSA-cm9x-r8m9-x222/GHSA-cm9x-r8m9-x222.json b/advisories/unreviewed/2023/12/GHSA-cm9x-r8m9-x222/GHSA-cm9x-r8m9-x222.json new file mode 100644 index 00000000000..57d73ab921b --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-cm9x-r8m9-x222/GHSA-cm9x-r8m9-x222.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cm9x-r8m9-x222", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6858" + ], + "details": "Firefox was susceptible to a heap buffer overflow in `nsTextFragment` due to insufficient OOM handling. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6858" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1826791" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-54/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-55/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-g49j-j489-3xpf/GHSA-g49j-j489-3xpf.json b/advisories/unreviewed/2023/12/GHSA-g49j-j489-3xpf/GHSA-g49j-j489-3xpf.json index edf03a4183c..e36d91fa88e 100644 --- a/advisories/unreviewed/2023/12/GHSA-g49j-j489-3xpf/GHSA-g49j-j489-3xpf.json +++ b/advisories/unreviewed/2023/12/GHSA-g49j-j489-3xpf/GHSA-g49j-j489-3xpf.json @@ -24,6 +24,10 @@ { "type": "WEB", "url": "https://lists.apache.org/thread/985h6ltvtbvdoysso780kkj7x744cds5" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2023/12/19/3" } ], "database_specific": { diff --git a/advisories/unreviewed/2023/12/GHSA-g9fc-wq66-mpcr/GHSA-g9fc-wq66-mpcr.json b/advisories/unreviewed/2023/12/GHSA-g9fc-wq66-mpcr/GHSA-g9fc-wq66-mpcr.json new file mode 100644 index 00000000000..5715e7d161f --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-g9fc-wq66-mpcr/GHSA-g9fc-wq66-mpcr.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g9fc-wq66-mpcr", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6866" + ], + "details": "TypedArrays can be fallible and lacked proper exception handling. This could lead to abuse in other APIs which expect TypedArrays to always succeed. This vulnerability affects Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6866" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1849037" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-gv5f-2gxw-3xr9/GHSA-gv5f-2gxw-3xr9.json b/advisories/unreviewed/2023/12/GHSA-gv5f-2gxw-3xr9/GHSA-gv5f-2gxw-3xr9.json new file mode 100644 index 00000000000..529d4095bba --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-gv5f-2gxw-3xr9/GHSA-gv5f-2gxw-3xr9.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gv5f-2gxw-3xr9", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6280" + ], + "details": "An XXE (XML External Entity) vulnerability has been detected in 52North WPS affecting versions prior to 4.0.0-beta.11. This vulnerability allows the use of external entities in its WebProcessingService servlet for an attacker to retrieve files by making HTTP requests to the internal network.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6280" + }, + { + "type": "WEB", + "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/xml-external-entity-reference-52north-wps" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-611" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T15:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-gx9r-x967-x29h/GHSA-gx9r-x967-x29h.json b/advisories/unreviewed/2023/12/GHSA-gx9r-x967-x29h/GHSA-gx9r-x967-x29h.json new file mode 100644 index 00000000000..fdfbcaab83c --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-gx9r-x967-x29h/GHSA-gx9r-x967-x29h.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gx9r-x967-x29h", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6859" + ], + "details": "A use-after-free condition affected TLS socket creation when under memory pressure. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6859" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1840144" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-54/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-55/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-hx5f-6r56-q754/GHSA-hx5f-6r56-q754.json b/advisories/unreviewed/2023/12/GHSA-hx5f-6r56-q754/GHSA-hx5f-6r56-q754.json new file mode 100644 index 00000000000..ee791b62b6c --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-hx5f-6r56-q754/GHSA-hx5f-6r56-q754.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hx5f-6r56-q754", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6863" + ], + "details": "The `ShutdownObserver()` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destructor. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6863" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1868901" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-54/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-55/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-jfxj-xf67-x723/GHSA-jfxj-xf67-x723.json b/advisories/unreviewed/2023/12/GHSA-jfxj-xf67-x723/GHSA-jfxj-xf67-x723.json index 5a86ad44898..ca7285c7759 100644 --- a/advisories/unreviewed/2023/12/GHSA-jfxj-xf67-x723/GHSA-jfxj-xf67-x723.json +++ b/advisories/unreviewed/2023/12/GHSA-jfxj-xf67-x723/GHSA-jfxj-xf67-x723.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jfxj-xf67-x723", - "modified": "2023-12-19T12:30:19Z", + "modified": "2023-12-19T15:30:29Z", "published": "2023-12-19T12:30:19Z", "aliases": [ "CVE-2023-49736" @@ -24,6 +24,10 @@ { "type": "WEB", "url": "https://lists.apache.org/thread/1kf481bgs3451qcz6hfhobs7xvhp8n1p" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2023/12/19/2" } ], "database_specific": { diff --git a/advisories/unreviewed/2023/12/GHSA-jhcj-v5hx-prgh/GHSA-jhcj-v5hx-prgh.json b/advisories/unreviewed/2023/12/GHSA-jhcj-v5hx-prgh/GHSA-jhcj-v5hx-prgh.json new file mode 100644 index 00000000000..5fd5bb549dd --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-jhcj-v5hx-prgh/GHSA-jhcj-v5hx-prgh.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jhcj-v5hx-prgh", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6870" + ], + "details": "Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications displayed by Firefox. \n*This issue only affects Android versions of Firefox and Firefox Focus.* This vulnerability affects Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6870" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1823316" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-jq9x-r769-726q/GHSA-jq9x-r769-726q.json b/advisories/unreviewed/2023/12/GHSA-jq9x-r769-726q/GHSA-jq9x-r769-726q.json new file mode 100644 index 00000000000..ce34a7cadf9 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-jq9x-r769-726q/GHSA-jq9x-r769-726q.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jq9x-r769-726q", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-43870" + ], + "details": "When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could access the installer batch file or reverse engineer the source code to gain access to the root certificate password. Using the root certificate and password they could then create their own certificates to emulate another site. Then by establishing a proxy service to emulate the site they could monitor traffic passed between the end user and the site allowing access to the data content.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43870" + }, + { + "type": "WEB", + "url": "https://www.paxton-access.com/systems/net2/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-798" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T15:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-jx6q-fq9h-6g7q/GHSA-jx6q-fq9h-6g7q.json b/advisories/unreviewed/2023/12/GHSA-jx6q-fq9h-6g7q/GHSA-jx6q-fq9h-6g7q.json new file mode 100644 index 00000000000..ef5cda5698b --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-jx6q-fq9h-6g7q/GHSA-jx6q-fq9h-6g7q.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jx6q-fq9h-6g7q", + "modified": "2023-12-19T15:30:29Z", + "published": "2023-12-19T15:30:29Z", + "aliases": [ + "CVE-2019-25158" + ], + "details": "A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app.js. The manipulation leads to os command injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as 29d9c25415911ea2f8b6de247cb5c4607d13d434. It is recommended to upgrade the affected component. VDB-248278 is the identifier assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25158" + }, + { + "type": "WEB", + "url": "https://github.com/pedroetb/tts-api/commit/29d9c25415911ea2f8b6de247cb5c4607d13d434" + }, + { + "type": "WEB", + "url": "https://github.com/pedroetb/tts-api/releases/tag/v2.2.0" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.248278" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.248278" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T13:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-jxv6-m6pm-cqh2/GHSA-jxv6-m6pm-cqh2.json b/advisories/unreviewed/2023/12/GHSA-jxv6-m6pm-cqh2/GHSA-jxv6-m6pm-cqh2.json new file mode 100644 index 00000000000..2549d8b1035 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-jxv6-m6pm-cqh2/GHSA-jxv6-m6pm-cqh2.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jxv6-m6pm-cqh2", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6135" + ], + "details": "Multiple NSS NIST curves were susceptible to a side-channel attack known as \"Minerva\". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6135" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1853908" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-m2ff-6895-cr34/GHSA-m2ff-6895-cr34.json b/advisories/unreviewed/2023/12/GHSA-m2ff-6895-cr34/GHSA-m2ff-6895-cr34.json new file mode 100644 index 00000000000..ebd1c973d10 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-m2ff-6895-cr34/GHSA-m2ff-6895-cr34.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m2ff-6895-cr34", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6932" + ], + "details": "A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation.\n\nA race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread.\n\nWe recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6932" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=e2b706c691905fe78468c361aaabc719d0a496f1" + }, + { + "type": "WEB", + "url": "https://kernel.dance/e2b706c691905fe78468c361aaabc719d0a496f1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-mj5m-hchj-w87j/GHSA-mj5m-hchj-w87j.json b/advisories/unreviewed/2023/12/GHSA-mj5m-hchj-w87j/GHSA-mj5m-hchj-w87j.json index eaf915a47a0..48d3b748377 100644 --- a/advisories/unreviewed/2023/12/GHSA-mj5m-hchj-w87j/GHSA-mj5m-hchj-w87j.json +++ b/advisories/unreviewed/2023/12/GHSA-mj5m-hchj-w87j/GHSA-mj5m-hchj-w87j.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mj5m-hchj-w87j", - "modified": "2023-12-14T15:30:23Z", + "modified": "2023-12-19T15:30:29Z", "published": "2023-12-14T15:30:23Z", "aliases": [ "CVE-2023-50011" ], "details": "PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-14T15:15:10Z" diff --git a/advisories/unreviewed/2023/12/GHSA-p744-68mc-9w5j/GHSA-p744-68mc-9w5j.json b/advisories/unreviewed/2023/12/GHSA-p744-68mc-9w5j/GHSA-p744-68mc-9w5j.json new file mode 100644 index 00000000000..67efddc1190 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-p744-68mc-9w5j/GHSA-p744-68mc-9w5j.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p744-68mc-9w5j", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6861" + ], + "details": "The `nsWindow::PickerOpen(void)` method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects Firefox ESR < 115.6, Thunderbird < 115.6, and Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6861" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1864118" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-54/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-55/" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-qm6q-r7qr-vxjp/GHSA-qm6q-r7qr-vxjp.json b/advisories/unreviewed/2023/12/GHSA-qm6q-r7qr-vxjp/GHSA-qm6q-r7qr-vxjp.json new file mode 100644 index 00000000000..14a971bfbef --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-qm6q-r7qr-vxjp/GHSA-qm6q-r7qr-vxjp.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qm6q-r7qr-vxjp", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6872" + ], + "details": "Browser tab titles were being leaked by GNOME to system logs. This could potentially expose the browsing habits of users running in a private tab. This vulnerability affects Firefox < 121.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6872" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1849186" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2023-56/" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-qrq8-p6j7-hh57/GHSA-qrq8-p6j7-hh57.json b/advisories/unreviewed/2023/12/GHSA-qrq8-p6j7-hh57/GHSA-qrq8-p6j7-hh57.json index c2fdde1e23a..ab00ffeb1c6 100644 --- a/advisories/unreviewed/2023/12/GHSA-qrq8-p6j7-hh57/GHSA-qrq8-p6j7-hh57.json +++ b/advisories/unreviewed/2023/12/GHSA-qrq8-p6j7-hh57/GHSA-qrq8-p6j7-hh57.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qrq8-p6j7-hh57", - "modified": "2023-12-14T18:30:21Z", + "modified": "2023-12-19T15:30:29Z", "published": "2023-12-14T18:30:21Z", "aliases": [ "CVE-2023-6364" diff --git a/advisories/unreviewed/2023/12/GHSA-r8hg-9v6r-2mq2/GHSA-r8hg-9v6r-2mq2.json b/advisories/unreviewed/2023/12/GHSA-r8hg-9v6r-2mq2/GHSA-r8hg-9v6r-2mq2.json new file mode 100644 index 00000000000..ef7c46c7c33 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-r8hg-9v6r-2mq2/GHSA-r8hg-9v6r-2mq2.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r8hg-9v6r-2mq2", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-1514" + ], + "details": "A vulnerability exists in the component RTU500 Scripting interface. When a client connects to a server using TLS, the server presents a certificate. This certificate links a public key to the identity of the service and is signed by a Certification Authority (CA), allowing the client to validate that the remote service can be trusted and is not malicious. If the client does not validate the parameters of the certificate, then attackers could be able to spoof the identity of the service. An attacker could exploit the vulnerability by using faking the identity of a RTU500 device and intercepting the messages initiated via the RTU500 Scripting interface.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1514" + }, + { + "type": "WEB", + "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000152&languageCode=en&Preview=true" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-295" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T15:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-v254-5m89-3qf2/GHSA-v254-5m89-3qf2.json b/advisories/unreviewed/2023/12/GHSA-v254-5m89-3qf2/GHSA-v254-5m89-3qf2.json index 57f17b93e5c..a3294857741 100644 --- a/advisories/unreviewed/2023/12/GHSA-v254-5m89-3qf2/GHSA-v254-5m89-3qf2.json +++ b/advisories/unreviewed/2023/12/GHSA-v254-5m89-3qf2/GHSA-v254-5m89-3qf2.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-v254-5m89-3qf2", - "modified": "2023-12-13T09:30:32Z", + "modified": "2023-12-19T15:30:29Z", "published": "2023-12-13T09:30:32Z", "aliases": [ "CVE-2023-6534" ], "details": "In versions of FreeBSD 14.0-RELEASE before 14-RELEASE-p2, FreeBSD 13.2-RELEASE before 13.2-RELEASE-p7 and FreeBSD 12.4-RELEASE before 12.4-RELEASE-p9, the pf(4) packet filter incorrectly validates TCP sequence numbers.  This could allow a malicious actor to execute a denial-of-service attack against hosts behind the firewall.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-13T09:15:34Z" diff --git a/advisories/unreviewed/2023/12/GHSA-x25m-g22v-6hgf/GHSA-x25m-g22v-6hgf.json b/advisories/unreviewed/2023/12/GHSA-x25m-g22v-6hgf/GHSA-x25m-g22v-6hgf.json new file mode 100644 index 00000000000..19416a66851 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-x25m-g22v-6hgf/GHSA-x25m-g22v-6hgf.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x25m-g22v-6hgf", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6711" + ], + "details": "Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. Specially crafted messages sent to the mentioned components are not validated properly and can result in buffer overflow and as final consequence to a reboot of an RTU500 CMU.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6711" + }, + { + "type": "WEB", + "url": "https://publisher.hitachienergy.com/preview?DocumentId=8DBD000184&languageCode=en&Preview=true" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T15:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-xv88-q3gm-mmjp/GHSA-xv88-q3gm-mmjp.json b/advisories/unreviewed/2023/12/GHSA-xv88-q3gm-mmjp/GHSA-xv88-q3gm-mmjp.json new file mode 100644 index 00000000000..792c6ee911a --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-xv88-q3gm-mmjp/GHSA-xv88-q3gm-mmjp.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xv88-q3gm-mmjp", + "modified": "2023-12-19T15:30:30Z", + "published": "2023-12-19T15:30:30Z", + "aliases": [ + "CVE-2023-6931" + ], + "details": "A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation.\n\nA perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().\n\nWe recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6931" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=382c27f4ed28f803b1f1473ac2d8db0afc795a1b" + }, + { + "type": "WEB", + "url": "https://kernel.dance/382c27f4ed28f803b1f1473ac2d8db0afc795a1b" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-19T14:15:08Z" + } +} \ No newline at end of file