From e4083b5b350e84faf0383a98269d644ca0ad5d71 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 3 Dec 2024 03:32:52 +0000 Subject: [PATCH] Publish Advisories GHSA-vxfp-88g2-6m62 GHSA-24v9-77xc-p8x9 GHSA-3787-f2g5-hhvq GHSA-5q23-39rg-fgrp GHSA-5wc4-pq8p-wrvp GHSA-wwv5-pfx5-r5w7 GHSA-xf8q-6qq2-4pq3 GHSA-xjwq-3px7-956p --- .../GHSA-vxfp-88g2-6m62.json | 12 +++--- .../GHSA-24v9-77xc-p8x9.json | 29 ++++++++++++++ .../GHSA-3787-f2g5-hhvq.json | 36 +++++++++++++++++ .../GHSA-5q23-39rg-fgrp.json | 36 +++++++++++++++++ .../GHSA-5wc4-pq8p-wrvp.json | 40 +++++++++++++++++++ .../GHSA-wwv5-pfx5-r5w7.json | 36 +++++++++++++++++ .../GHSA-xf8q-6qq2-4pq3.json | 36 +++++++++++++++++ .../GHSA-xjwq-3px7-956p.json | 29 ++++++++++++++ 8 files changed, 249 insertions(+), 5 deletions(-) create mode 100644 advisories/unreviewed/2024/12/GHSA-24v9-77xc-p8x9/GHSA-24v9-77xc-p8x9.json create mode 100644 advisories/unreviewed/2024/12/GHSA-3787-f2g5-hhvq/GHSA-3787-f2g5-hhvq.json create mode 100644 advisories/unreviewed/2024/12/GHSA-5q23-39rg-fgrp/GHSA-5q23-39rg-fgrp.json create mode 100644 advisories/unreviewed/2024/12/GHSA-5wc4-pq8p-wrvp/GHSA-5wc4-pq8p-wrvp.json create mode 100644 advisories/unreviewed/2024/12/GHSA-wwv5-pfx5-r5w7/GHSA-wwv5-pfx5-r5w7.json create mode 100644 advisories/unreviewed/2024/12/GHSA-xf8q-6qq2-4pq3/GHSA-xf8q-6qq2-4pq3.json create mode 100644 advisories/unreviewed/2024/12/GHSA-xjwq-3px7-956p/GHSA-xjwq-3px7-956p.json diff --git a/advisories/unreviewed/2022/05/GHSA-vxfp-88g2-6m62/GHSA-vxfp-88g2-6m62.json b/advisories/unreviewed/2022/05/GHSA-vxfp-88g2-6m62/GHSA-vxfp-88g2-6m62.json index c13c6557f69..b2e3a06b514 100644 --- a/advisories/unreviewed/2022/05/GHSA-vxfp-88g2-6m62/GHSA-vxfp-88g2-6m62.json +++ b/advisories/unreviewed/2022/05/GHSA-vxfp-88g2-6m62/GHSA-vxfp-88g2-6m62.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vxfp-88g2-6m62", - "modified": "2023-01-09T21:30:20Z", + "modified": "2024-12-03T03:31:27Z", "published": "2022-05-24T19:08:04Z", "aliases": [ "CVE-2021-20784" @@ -13,14 +13,16 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20784" }, + { + "type": "WEB", + "url": "https://jvn.jp/en/jp/JVN68971465" + }, { "type": "WEB", "url": "https://jvn.jp/en/jp/JVN68971465/index.html" @@ -36,7 +38,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-644" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/12/GHSA-24v9-77xc-p8x9/GHSA-24v9-77xc-p8x9.json b/advisories/unreviewed/2024/12/GHSA-24v9-77xc-p8x9/GHSA-24v9-77xc-p8x9.json new file mode 100644 index 00000000000..2d58493e330 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-24v9-77xc-p8x9/GHSA-24v9-77xc-p8x9.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-24v9-77xc-p8x9", + "modified": "2024-12-03T03:31:27Z", + "published": "2024-12-03T03:31:27Z", + "aliases": [ + "CVE-2018-9441" + ], + "details": "In sdp_copy_raw_data of sdp_discovery.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9441" + }, + { + "type": "WEB", + "url": "https://source.android.com/docs/security/bulletin/pixel/2018-08-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-03T01:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-3787-f2g5-hhvq/GHSA-3787-f2g5-hhvq.json b/advisories/unreviewed/2024/12/GHSA-3787-f2g5-hhvq/GHSA-3787-f2g5-hhvq.json new file mode 100644 index 00000000000..02e2fea779e --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-3787-f2g5-hhvq/GHSA-3787-f2g5-hhvq.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3787-f2g5-hhvq", + "modified": "2024-12-03T03:31:27Z", + "published": "2024-12-03T03:31:27Z", + "aliases": [ + "CVE-2024-9200" + ], + "details": "A post-authentication command injection vulnerability in the \"host\" parameter of the diagnostic function in Zyxel VMG4005-B50A firmware versions through V5.15(ABQA.2.2)C0 could allow an authenticated attacker with administrator privileges to execute operating system (OS) commands on a vulnerable device.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9200" + }, + { + "type": "WEB", + "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-and-post-authentication-command-injection-vulnerabilities-in-some-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wifi-extenders-12-03-2024" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-03T02:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-5q23-39rg-fgrp/GHSA-5q23-39rg-fgrp.json b/advisories/unreviewed/2024/12/GHSA-5q23-39rg-fgrp/GHSA-5q23-39rg-fgrp.json new file mode 100644 index 00000000000..5ad699c5494 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-5q23-39rg-fgrp/GHSA-5q23-39rg-fgrp.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5q23-39rg-fgrp", + "modified": "2024-12-03T03:31:27Z", + "published": "2024-12-03T03:31:27Z", + "aliases": [ + "CVE-2024-8748" + ], + "details": "A buffer overflow vulnerability in the packet parser of the third-party library \"libclinkc\" in Zyxel VMG8825-T50K firmware versions through V5.50(ABOM.8.4)C0 could allow an attacker to cause a temporary denial of service (DoS) condition against the web management interface by sending a crafted HTTP POST request to a vulnerable device.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8748" + }, + { + "type": "WEB", + "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-and-post-authentication-command-injection-vulnerabilities-in-some-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wifi-extenders-12-03-2024" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-120" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-03T02:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-5wc4-pq8p-wrvp/GHSA-5wc4-pq8p-wrvp.json b/advisories/unreviewed/2024/12/GHSA-5wc4-pq8p-wrvp/GHSA-5wc4-pq8p-wrvp.json new file mode 100644 index 00000000000..88e21b1b73b --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-5wc4-pq8p-wrvp/GHSA-5wc4-pq8p-wrvp.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5wc4-pq8p-wrvp", + "modified": "2024-12-03T03:31:27Z", + "published": "2024-12-03T03:31:27Z", + "aliases": [ + "CVE-2024-9694" + ], + "details": "The CMSMasters Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 1.14.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9694" + }, + { + "type": "WEB", + "url": "https://docs.cmsmasters.net/cmsmasters-elementor-addon-changelog" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb78b64-ebe3-44e9-9061-d380693c5566?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-03T03:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-wwv5-pfx5-r5w7/GHSA-wwv5-pfx5-r5w7.json b/advisories/unreviewed/2024/12/GHSA-wwv5-pfx5-r5w7/GHSA-wwv5-pfx5-r5w7.json new file mode 100644 index 00000000000..3e090b40e12 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-wwv5-pfx5-r5w7/GHSA-wwv5-pfx5-r5w7.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wwv5-pfx5-r5w7", + "modified": "2024-12-03T03:31:27Z", + "published": "2024-12-03T03:31:27Z", + "aliases": [ + "CVE-2024-45068" + ], + "details": "Authentication credentials leakage vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center OVA.\n\n\nThis issue affects Hitachi Ops Center Common Services: from 10.9.3-00 before 11.0.3-00; Hitachi Ops Center OVA: from 10.9.3-00 before 11.0.2-01.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45068" + }, + { + "type": "WEB", + "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-149/index.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1392" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-03T03:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-xf8q-6qq2-4pq3/GHSA-xf8q-6qq2-4pq3.json b/advisories/unreviewed/2024/12/GHSA-xf8q-6qq2-4pq3/GHSA-xf8q-6qq2-4pq3.json new file mode 100644 index 00000000000..e09ad95a092 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-xf8q-6qq2-4pq3/GHSA-xf8q-6qq2-4pq3.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xf8q-6qq2-4pq3", + "modified": "2024-12-03T03:31:27Z", + "published": "2024-12-03T03:31:27Z", + "aliases": [ + "CVE-2024-9197" + ], + "details": "A post-authentication buffer overflow vulnerability in the parameter \"action\" of the CGI program in Zyxel VMG3625-T50B firmware versions through V5.50(ABPM.9.2)C0 could allow an authenticated attacker with administrator privileges to cause a temporary denial of service (DoS) condition against the web management interface by sending a crafted HTTP GET request to a vulnerable device if the function ZyEE is enabled.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9197" + }, + { + "type": "WEB", + "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-buffer-overflow-and-post-authentication-command-injection-vulnerabilities-in-some-4g-lte-5g-nr-cpe-dsl-ethernet-cpe-fiber-onts-and-wifi-extenders-12-03-2024" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-120" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-03T02:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-xjwq-3px7-956p/GHSA-xjwq-3px7-956p.json b/advisories/unreviewed/2024/12/GHSA-xjwq-3px7-956p/GHSA-xjwq-3px7-956p.json new file mode 100644 index 00000000000..189eeeecd02 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-xjwq-3px7-956p/GHSA-xjwq-3px7-956p.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xjwq-3px7-956p", + "modified": "2024-12-03T03:31:27Z", + "published": "2024-12-03T03:31:27Z", + "aliases": [ + "CVE-2018-9449" + ], + "details": "In process_service_search_attr_rsp of sdp_discovery.cc, there is a possible out of bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9449" + }, + { + "type": "WEB", + "url": "https://source.android.com/docs/security/bulletin/pixel/2018-08-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-03T01:15:04Z" + } +} \ No newline at end of file