From e339726eb68bc598d0bf302eaaf5280cb6b36142 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 3 Jan 2025 03:31:48 +0000 Subject: [PATCH] Publish Advisories GHSA-2f82-fhcf-rx3f GHSA-2vvg-qw4w-m46v GHSA-c9wr-34xc-92vr GHSA-fvg9-4m3g-p4h7 GHSA-m5fr-264j-4mq3 GHSA-q4c8-95h3-qpvr GHSA-q7cq-v47g-g2v2 GHSA-rr2x-3m79-49mj GHSA-vvqr-c837-hr5q --- .../GHSA-2f82-fhcf-rx3f.json | 33 +++++++++++ .../GHSA-2vvg-qw4w-m46v.json | 33 +++++++++++ .../GHSA-c9wr-34xc-92vr.json | 33 +++++++++++ .../GHSA-fvg9-4m3g-p4h7.json | 33 +++++++++++ .../GHSA-m5fr-264j-4mq3.json | 29 ++++++++++ .../GHSA-q4c8-95h3-qpvr.json | 56 ++++++++++++++++++ .../GHSA-q7cq-v47g-g2v2.json | 33 +++++++++++ .../GHSA-rr2x-3m79-49mj.json | 57 +++++++++++++++++++ .../GHSA-vvqr-c837-hr5q.json | 33 +++++++++++ 9 files changed, 340 insertions(+) create mode 100644 advisories/unreviewed/2025/01/GHSA-2f82-fhcf-rx3f/GHSA-2f82-fhcf-rx3f.json create mode 100644 advisories/unreviewed/2025/01/GHSA-2vvg-qw4w-m46v/GHSA-2vvg-qw4w-m46v.json create mode 100644 advisories/unreviewed/2025/01/GHSA-c9wr-34xc-92vr/GHSA-c9wr-34xc-92vr.json create mode 100644 advisories/unreviewed/2025/01/GHSA-fvg9-4m3g-p4h7/GHSA-fvg9-4m3g-p4h7.json create mode 100644 advisories/unreviewed/2025/01/GHSA-m5fr-264j-4mq3/GHSA-m5fr-264j-4mq3.json create mode 100644 advisories/unreviewed/2025/01/GHSA-q4c8-95h3-qpvr/GHSA-q4c8-95h3-qpvr.json create mode 100644 advisories/unreviewed/2025/01/GHSA-q7cq-v47g-g2v2/GHSA-q7cq-v47g-g2v2.json create mode 100644 advisories/unreviewed/2025/01/GHSA-rr2x-3m79-49mj/GHSA-rr2x-3m79-49mj.json create mode 100644 advisories/unreviewed/2025/01/GHSA-vvqr-c837-hr5q/GHSA-vvqr-c837-hr5q.json diff --git a/advisories/unreviewed/2025/01/GHSA-2f82-fhcf-rx3f/GHSA-2f82-fhcf-rx3f.json b/advisories/unreviewed/2025/01/GHSA-2f82-fhcf-rx3f/GHSA-2f82-fhcf-rx3f.json new file mode 100644 index 00000000000..eaee02bab61 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-2f82-fhcf-rx3f/GHSA-2f82-fhcf-rx3f.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2f82-fhcf-rx3f", + "modified": "2025-01-03T03:30:29Z", + "published": "2025-01-03T03:30:29Z", + "aliases": [ + "CVE-2024-43769" + ], + "details": "In isPackageDeviceAdmin of PackageManagerService.java, there is a possible edge case which could prevent the uninstallation of CloudDpc due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43769" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/frameworks/base/+/619ffc299bf33566ba6daee8301ee0fc96e015f4" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-12-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T01:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-2vvg-qw4w-m46v/GHSA-2vvg-qw4w-m46v.json b/advisories/unreviewed/2025/01/GHSA-2vvg-qw4w-m46v/GHSA-2vvg-qw4w-m46v.json new file mode 100644 index 00000000000..c7efae88fc4 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-2vvg-qw4w-m46v/GHSA-2vvg-qw4w-m46v.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2vvg-qw4w-m46v", + "modified": "2025-01-03T03:30:29Z", + "published": "2025-01-03T03:30:29Z", + "aliases": [ + "CVE-2024-43764" + ], + "details": "In onPrimaryClipChanged of ClipboardListener.java, there is a possible way to partially bypass lock screen. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43764" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/frameworks/base/+/70eb75df7d342429c3ee225feb7c011df727442f" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-12-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T01:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-c9wr-34xc-92vr/GHSA-c9wr-34xc-92vr.json b/advisories/unreviewed/2025/01/GHSA-c9wr-34xc-92vr/GHSA-c9wr-34xc-92vr.json new file mode 100644 index 00000000000..7c6bcb08f4a --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-c9wr-34xc-92vr/GHSA-c9wr-34xc-92vr.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c9wr-34xc-92vr", + "modified": "2025-01-03T03:30:29Z", + "published": "2025-01-03T03:30:29Z", + "aliases": [ + "CVE-2024-43762" + ], + "details": "In multiple locations, there is a possible way to avoid unbinding of a service from the system due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43762" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/frameworks/base/+/ae43ac7f3d3d5112b0f54b5315a15b08208acf9c" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-12-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T01:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-fvg9-4m3g-p4h7/GHSA-fvg9-4m3g-p4h7.json b/advisories/unreviewed/2025/01/GHSA-fvg9-4m3g-p4h7/GHSA-fvg9-4m3g-p4h7.json new file mode 100644 index 00000000000..c82550d9a67 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-fvg9-4m3g-p4h7/GHSA-fvg9-4m3g-p4h7.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fvg9-4m3g-p4h7", + "modified": "2025-01-03T03:30:29Z", + "published": "2025-01-03T03:30:29Z", + "aliases": [ + "CVE-2024-43768" + ], + "details": "In skia_alloc_func of SkDeflate.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43768" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/external/skia/+/b5543cb8c6b95623743016055220378efe73eb93" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-12-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T01:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-m5fr-264j-4mq3/GHSA-m5fr-264j-4mq3.json b/advisories/unreviewed/2025/01/GHSA-m5fr-264j-4mq3/GHSA-m5fr-264j-4mq3.json new file mode 100644 index 00000000000..eb7ad49cc4c --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-m5fr-264j-4mq3/GHSA-m5fr-264j-4mq3.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m5fr-264j-4mq3", + "modified": "2025-01-03T03:30:26Z", + "published": "2025-01-03T03:30:26Z", + "aliases": [ + "CVE-2024-43077" + ], + "details": "In DevmemValidateFlags of devicemem_server.c , there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43077" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-12-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T01:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-q4c8-95h3-qpvr/GHSA-q4c8-95h3-qpvr.json b/advisories/unreviewed/2025/01/GHSA-q4c8-95h3-qpvr/GHSA-q4c8-95h3-qpvr.json new file mode 100644 index 00000000000..fed9cd21b48 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-q4c8-95h3-qpvr/GHSA-q4c8-95h3-qpvr.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q4c8-95h3-qpvr", + "modified": "2025-01-03T03:30:29Z", + "published": "2025-01-03T03:30:29Z", + "aliases": [ + "CVE-2025-0176" + ], + "details": "A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /user/add_cart.php. The manipulation of the argument id/qty leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0176" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://gist.github.com/Masamuneee/9c539b89dad40033a5037b744e394ae0" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.290105" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.290105" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.473347" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T02:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-q7cq-v47g-g2v2/GHSA-q7cq-v47g-g2v2.json b/advisories/unreviewed/2025/01/GHSA-q7cq-v47g-g2v2/GHSA-q7cq-v47g-g2v2.json new file mode 100644 index 00000000000..2333cf991fc --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-q7cq-v47g-g2v2/GHSA-q7cq-v47g-g2v2.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q7cq-v47g-g2v2", + "modified": "2025-01-03T03:30:29Z", + "published": "2025-01-03T03:30:29Z", + "aliases": [ + "CVE-2024-43767" + ], + "details": "In prepare_to_draw_into_mask of SkBlurMaskFilterImpl.cpp, there is a possible heap overflow due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43767" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/external/skia/+/796c2040f641bb287dba66c9823ce45e9f8b5807" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-12-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T01:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-rr2x-3m79-49mj/GHSA-rr2x-3m79-49mj.json b/advisories/unreviewed/2025/01/GHSA-rr2x-3m79-49mj/GHSA-rr2x-3m79-49mj.json new file mode 100644 index 00000000000..5a5d32c51f9 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-rr2x-3m79-49mj/GHSA-rr2x-3m79-49mj.json @@ -0,0 +1,57 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rr2x-3m79-49mj", + "modified": "2025-01-03T03:30:29Z", + "published": "2025-01-03T03:30:29Z", + "aliases": [ + "CVE-2025-0174" + ], + "details": "A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0. It has been classified as critical. This affects an unknown part of the file /user/search_result2.php of the component Parameter Handler. The manipulation of the argument search leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0174" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://gist.github.com/Masamuneee/ca3f96ac0ec34bb7c1dd4bfd180f11bb" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.290103" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.290103" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.473330" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74", + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T01:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-vvqr-c837-hr5q/GHSA-vvqr-c837-hr5q.json b/advisories/unreviewed/2025/01/GHSA-vvqr-c837-hr5q/GHSA-vvqr-c837-hr5q.json new file mode 100644 index 00000000000..95881890ccd --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-vvqr-c837-hr5q/GHSA-vvqr-c837-hr5q.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vvqr-c837-hr5q", + "modified": "2025-01-03T03:30:29Z", + "published": "2025-01-03T03:30:29Z", + "aliases": [ + "CVE-2024-43097" + ], + "details": "In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43097" + }, + { + "type": "WEB", + "url": "https://android.googlesource.com/platform/external/skia/+/8d355fe1d0795fc30b84194b87563f75c6f8f2a7" + }, + { + "type": "WEB", + "url": "https://source.android.com/security/bulletin/2024-12-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-03T01:15:07Z" + } +} \ No newline at end of file