Advisory Database Sync

advisories/unreviewed/2023/12/GHSA-278h-99f9-m238/GHSA-278h-99f9-m238.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-278h-99f9-m238",
+  "modified": "2023-12-14T21:31:16Z",
+  "published": "2023-12-14T21:31:16Z",
+  "aliases": [
+    "CVE-2023-50472"
+  ],
+  "details": "cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50472"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/DaveGamble/cJSON/issues/803"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-12-14T20:15:53Z"
+  }
+}

advisories/unreviewed/2023/12/GHSA-2g42-jgwr-h29g/GHSA-2g42-jgwr-h29g.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2g42-jgwr-h29g",
-  "modified": "2023-12-12T15:30:58Z",
+  "modified": "2023-12-14T21:31:15Z",
   "published": "2023-12-12T15:30:58Z",
   "aliases": [
     "CVE-2023-49992"
   ],
   "details": "Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Overflow via the function RemoveEnding at dictionary.c.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-787"
     ],
-    "severity": null,
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2023-12-12T14:15:07Z"

advisories/unreviewed/2023/12/GHSA-2gxf-v2x6-xmcm/GHSA-2gxf-v2x6-xmcm.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2gxf-v2x6-xmcm",
-  "modified": "2023-12-12T15:30:58Z",
+  "modified": "2023-12-14T21:31:15Z",
   "published": "2023-12-12T15:30:58Z",
   "aliases": [
     "CVE-2023-49994"
   ],
   "details": "Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-697"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2023-12-12T14:15:07Z"

advisories/unreviewed/2023/12/GHSA-2h32-h397-qgv2/GHSA-2h32-h397-qgv2.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2h32-h397-qgv2",
-  "modified": "2023-12-12T15:30:59Z",
+  "modified": "2023-12-14T21:31:15Z",
   "published": "2023-12-12T15:30:59Z",
   "aliases": [
     "CVE-2020-12614"
   ],
   "details": "An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. If the publisher criteria is selected, it defines the name of a publisher that must be present in the certificate (and also requires that the certificate is valid). If an Add Admin token is protected by this criteria, it can be leveraged by a malicious actor to achieve Elevation of Privileges from standard user to administrator.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
 
@@ -31,7 +34,7 @@
     "cwe_ids": [
 
     ],
-    "severity": null,
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2023-12-12T15:15:07Z"

advisories/unreviewed/2023/12/GHSA-478w-7mxw-36gh/GHSA-478w-7mxw-36gh.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-478w-7mxw-36gh",
-  "modified": "2023-12-12T09:30:33Z",
+  "modified": "2023-12-14T21:31:14Z",
   "published": "2023-12-12T09:30:33Z",
   "aliases": [
     "CVE-2023-49809"

advisories/unreviewed/2023/12/GHSA-47p2-p2p7-c22c/GHSA-47p2-p2p7-c22c.json

@@ -28,7 +28,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-668"
     ],
     "severity": "MODERATE",
     "github_reviewed": false,

advisories/unreviewed/2023/12/GHSA-4gj5-jpg2-r4vj/GHSA-4gj5-jpg2-r4vj.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-4gj5-jpg2-r4vj",
-  "modified": "2023-12-12T09:30:33Z",
+  "modified": "2023-12-14T21:31:14Z",
   "published": "2023-12-12T09:30:33Z",
   "aliases": [
     "CVE-2023-6547"

advisories/unreviewed/2023/12/GHSA-56fm-mg9v-8c3h/GHSA-56fm-mg9v-8c3h.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-56fm-mg9v-8c3h",
-  "modified": "2023-12-12T15:30:59Z",
+  "modified": "2023-12-14T21:31:15Z",
   "published": "2023-12-12T15:30:59Z",
   "aliases": [
     "CVE-2023-46454"
   ],
   "details": "In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the package information functionality.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-78"
     ],
-    "severity": null,
+    "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2023-12-12T15:15:07Z"

advisories/unreviewed/2023/12/GHSA-66qm-3q49-g6g2/GHSA-66qm-3q49-g6g2.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-66qm-3q49-g6g2",
-  "modified": "2023-12-12T09:30:32Z",
+  "modified": "2023-12-14T21:31:14Z",
   "published": "2023-12-12T09:30:32Z",
   "aliases": [
     "CVE-2023-48642"
   ],
   "details": "Archer Platform 6.x before 6.13 P2 (6.13.0.2) contains an authenticated HTML content injection vulnerability. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 (6.14.0) is also a fixed release.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-79"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2023-12-12T08:15:07Z"

advisories/unreviewed/2023/12/GHSA-6ww3-v82p-jv78/GHSA-6ww3-v82p-jv78.json

@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6ww3-v82p-jv78",
+  "modified": "2023-12-14T21:31:16Z",
+  "published": "2023-12-14T21:31:16Z",
+  "aliases": [
+    "CVE-2023-0248"
+  ],
+  "details": "An attacker with physical access to the Kantech Gen1 ioSmart card reader with firmware version prior to 1.7.2 in certain circumstances can recover the reader's communication memory between the card and reader.\n\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0248"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-02"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-200"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-12-14T21:15:07Z"
+  }
+}

advisories/unreviewed/2023/12/GHSA-756q-cg5p-5457/GHSA-756q-cg5p-5457.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-756q-cg5p-5457",
+  "modified": "2023-12-14T21:31:16Z",
+  "published": "2023-12-14T21:31:16Z",
+  "aliases": [
+    "CVE-2023-45894"
+  ],
+  "details": "The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a remote attacker to achieve remote code execution via standard kiosk breakout techniques.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45894"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Oracle-Security/CVEs/blob/main/Parallels%20Remote%20Server/readme.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-12-14T20:15:52Z"
+  }
+}

advisories/unreviewed/2023/12/GHSA-7fw8-2j3x-v679/GHSA-7fw8-2j3x-v679.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7fw8-2j3x-v679",
-  "modified": "2023-12-12T15:30:59Z",
+  "modified": "2023-12-14T21:31:15Z",
   "published": "2023-12-12T15:30:59Z",
   "aliases": [
     "CVE-2020-28369"
   ],
   "details": "In BeyondTrust Privilege Management for Windows (aka PMfW) through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the user-writable location %WINDIR%\\Temp.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
 
@@ -29,9 +32,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-427"
     ],
-    "severity": null,
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2023-12-12T15:15:07Z"

advisories/unreviewed/2023/12/GHSA-8p5h-3mcg-frjf/GHSA-8p5h-3mcg-frjf.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8p5h-3mcg-frjf",
-  "modified": "2023-12-12T15:30:59Z",
+  "modified": "2023-12-14T21:31:15Z",
   "published": "2023-12-12T15:30:59Z",
   "aliases": [
     "CVE-2023-50495"
   ],
   "details": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
   ],
   "affected": [
 
@@ -31,7 +34,7 @@
     "cwe_ids": [
 
     ],
-    "severity": null,
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2023-12-12T15:15:07Z"

advisories/unreviewed/2023/12/GHSA-8q46-8c27-mjgg/GHSA-8q46-8c27-mjgg.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8q46-8c27-mjgg",
-  "modified": "2023-12-12T12:30:51Z",
+  "modified": "2023-12-14T21:31:14Z",
   "published": "2023-12-12T12:30:51Z",
   "aliases": [
     "CVE-2023-41963"
   ],
   "details": "Denial-of-service (DoS) vulnerability exists in FTP service of HMI GC-A2 series. If a remote unauthenticated attacker sends a specially crafted packets to specific ports, a denial-of-service (DoS) condition may occur.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
   ],
   "affected": [
 
@@ -29,9 +32,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-400"
     ],
-    "severity": null,
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2023-12-12T10:15:10Z"

advisories/unreviewed/2023/12/GHSA-8x4c-6c7p-x5wp/GHSA-8x4c-6c7p-x5wp.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8x4c-6c7p-x5wp",
+  "modified": "2023-12-14T21:31:16Z",
+  "published": "2023-12-14T21:31:16Z",
+  "aliases": [
+    "CVE-2023-50017"
+  ],
+  "details": "Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/database/backup",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50017"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/849200701/cms/blob/main/CSRF%20exists%20in%20the%20backup%20and%20restore%20location.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-12-14T19:15:16Z"
+  }
+}

advisories/unreviewed/2023/12/GHSA-8xqf-3483-8954/GHSA-8xqf-3483-8954.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8xqf-3483-8954",
+  "modified": "2023-12-14T21:31:16Z",
+  "published": "2023-12-14T21:31:16Z",
+  "aliases": [
+    "CVE-2023-4694"
+  ],
+  "details": "Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when sending a SOAP message to the service on TCP port 3911 that contains a body but no header.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4694"
+    },
+    {
+      "type": "WEB",
+      "url": "https://support.hp.com/us-en/document/ish_9823639-9823677-16/hpsbpi03894"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2023-12-14T19:15:16Z"
+  }
+}

advisories/unreviewed/2023/12/GHSA-9qvw-gvq6-g569/GHSA-9qvw-gvq6-g569.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9qvw-gvq6-g569",
-  "modified": "2023-12-12T12:30:53Z",
+  "modified": "2023-12-14T21:31:14Z",
   "published": "2023-12-12T12:30:53Z",
   "aliases": [
     "CVE-2023-46281"

advisories/unreviewed/2023/12/GHSA-fmr5-j3hh-jpg4/GHSA-fmr5-j3hh-jpg4.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-fmr5-j3hh-jpg4",
-  "modified": "2023-12-12T12:30:54Z",
+  "modified": "2023-12-14T21:31:14Z",
   "published": "2023-12-12T12:30:54Z",
   "aliases": [
     "CVE-2023-46282"

advisories/unreviewed/2023/12/GHSA-fwfm-f7pg-rq6r/GHSA-fwfm-f7pg-rq6r.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-fwfm-f7pg-rq6r",
-  "modified": "2023-12-12T03:31:45Z",
+  "modified": "2023-12-14T21:31:13Z",
   "published": "2023-12-12T03:31:45Z",
   "aliases": [
     "CVE-2023-49058"

advisories/unreviewed/2023/12/GHSA-gcgw-q47m-prvj/GHSA-gcgw-q47m-prvj.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-gcgw-q47m-prvj",
-  "modified": "2023-12-12T09:30:31Z",
+  "modified": "2023-12-14T21:31:13Z",
   "published": "2023-12-12T03:31:45Z",
   "aliases": [
     "CVE-2023-50422"