netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-46ph-452x-f4g5
GHSA-wmqw-xg54-ch38
GHSA-33jw-2jpq-625x
GHSA-5f45-24fp-cx62
GHSA-84cg-qrp2-5ch9
GHSA-8m3r-rfc5-mrmg
GHSA-g3p7-6jrm-6c7q
GHSA-hh5f-w8h8-vh35
GHSA-mg6p-4qg9-v4wv
GHSA-mgrp-q987-h8p8
GHSA-mmp2-p685-v76h
GHSA-p5wh-m438-q8hr
GHSA-rhxj-v9fc-vpm2
GHSA-vj44-f7fj-3gf2
GHSA-xgpg-34fv-3xwr
This commit is contained in:
advisory-database[bot]
2024-09-11 00:32:12 +00:00
parent f867f5c690
commit e72eb7e5bb
15 changed files with 437 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2023/10/GHSA-46ph-452x-f4g5/GHSA-46ph-452x-f4g5.json
+1 -1
View File
@@ -28,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "CRITICAL",
"github_reviewed": false,
advisories/unreviewed/2023/10/GHSA-wmqw-xg54-ch38/GHSA-wmqw-xg54-ch38.json
+1 -1
View File
@@ -36,7 +36,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-358"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/09/GHSA-33jw-2jpq-625x/GHSA-33jw-2jpq-625x.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-33jw-2jpq-625x",
"modified": "2024-09-10T18:30:44Z",
"modified": "2024-09-11T00:30:51Z",
"published": "2024-09-10T18:30:44Z",
"aliases": [
"CVE-2023-37233"
],
"details": "Loftware Spectrum before 4.6 HF14 allows authenticated XXE attacks.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-611"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-10T16:15:18Z"
advisories/unreviewed/2024/09/GHSA-5f45-24fp-cx62/GHSA-5f45-24fp-cx62.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5f45-24fp-cx62",
"modified": "2024-09-11T00:30:51Z",
"published": "2024-09-11T00:30:51Z",
"aliases": [
"CVE-2024-40657"
],
"details": "In addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40657"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/packages/apps/Settings/+/8261e0ade3b414fea61d7fe9d8bc6df7a3fc8603"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-09-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-11T00:15:11Z"
}
}
advisories/unreviewed/2024/09/GHSA-84cg-qrp2-5ch9/GHSA-84cg-qrp2-5ch9.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-84cg-qrp2-5ch9",
"modified": "2024-09-11T00:30:51Z",
"published": "2024-09-11T00:30:51Z",
"aliases": [
"CVE-2024-40652"
],
"details": "In onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is provisioning due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40652"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/packages/apps/Settings/+/2909433f7d59dcdd0c74044b1c8e9f48927193dc"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-09-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-11T00:15:11Z"
}
}
advisories/unreviewed/2024/09/GHSA-8m3r-rfc5-mrmg/GHSA-8m3r-rfc5-mrmg.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8m3r-rfc5-mrmg",
"modified": "2024-09-11T00:30:51Z",
"published": "2024-09-11T00:30:51Z",
"aliases": [
"CVE-2024-40654"
],
"details": "In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40654"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/packages/apps/Settings/+/f1d0079c91734168c150f839168544f407b17b06"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-09-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-11T00:15:11Z"
}
}
advisories/unreviewed/2024/09/GHSA-g3p7-6jrm-6c7q/GHSA-g3p7-6jrm-6c7q.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g3p7-6jrm-6c7q",
"modified": "2024-09-11T00:30:51Z",
"published": "2024-09-11T00:30:51Z",
"aliases": [
"CVE-2024-40659"
],
"details": "In getRegistration of RemoteProvisioningService.java, there is a possible way to permanently disable the AndroidKeyStore key generation feature by updating the attestation keys of all installed apps due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40659"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/packages/modules/RemoteKeyProvisioning/+/c65dce4c6d8d54e47dce79a56e29e2223a2354e6"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-09-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-11T00:15:11Z"
}
}
advisories/unreviewed/2024/09/GHSA-hh5f-w8h8-vh35/GHSA-hh5f-w8h8-vh35.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hh5f-w8h8-vh35",
"modified": "2024-09-11T00:30:51Z",
"published": "2024-09-11T00:30:51Z",
"aliases": [
"CVE-2024-40650"
],
"details": "In wifi_item_edit_content of styles.xml , there is a possible FRP bypass due to Missing check for FRP state. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40650"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/packages/apps/Settings/+/2968ccc911956fa5813a9a6a5e5c8970e383a60f"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-09-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-11T00:15:11Z"
}
}
advisories/unreviewed/2024/09/GHSA-mg6p-4qg9-v4wv/GHSA-mg6p-4qg9-v4wv.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mg6p-4qg9-v4wv",
"modified": "2024-09-11T00:30:51Z",
"published": "2024-09-11T00:30:51Z",
"aliases": [
"CVE-2024-40655"
],
"details": "In bindAndGetCallIdentification of CallScreeningServiceHelper.java, there is a possible way to maintain a while-in-use permission in the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40655"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/packages/services/Telecomm/+/eeef54b37a362f506ea3aa155baddc545b6a909a"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-09-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-11T00:15:11Z"
}
}
advisories/unreviewed/2024/09/GHSA-mgrp-q987-h8p8/GHSA-mgrp-q987-h8p8.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mgrp-q987-h8p8",
"modified": "2024-09-11T00:30:51Z",
"published": "2024-09-11T00:30:51Z",
"aliases": [
"CVE-2024-40656"
],
"details": "In handleCreateConferenceComplete of ConnectionServiceWrapper.java, there is a possible way to reveal images across users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40656"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/packages/services/Telecomm/+/f3e6a6c02439401eb7aeb3749ee5ec0b51a625b9"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-09-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-11T00:15:11Z"
}
}
advisories/unreviewed/2024/09/GHSA-mmp2-p685-v76h/GHSA-mmp2-p685-v76h.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mmp2-p685-v76h",
"modified": "2024-09-11T00:30:51Z",
"published": "2024-09-11T00:30:51Z",
"aliases": [
"CVE-2024-23716"
],
"details": "In DevmemIntPFNotify of devicemem_server.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23716"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-09-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-11T00:15:10Z"
}
}
advisories/unreviewed/2024/09/GHSA-p5wh-m438-q8hr/GHSA-p5wh-m438-q8hr.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p5wh-m438-q8hr",
"modified": "2024-09-11T00:30:51Z",
"published": "2024-09-11T00:30:51Z",
"aliases": [
"CVE-2024-31336"
],
"details": "N/A",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31336"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-09-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-11T00:15:11Z"
}
}
advisories/unreviewed/2024/09/GHSA-rhxj-v9fc-vpm2/GHSA-rhxj-v9fc-vpm2.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rhxj-v9fc-vpm2",
"modified": "2024-09-10T18:30:44Z",
"modified": "2024-09-11T00:30:51Z",
"published": "2024-09-10T18:30:44Z",
"aliases": [
"CVE-2024-44815"
],
"details": "An issue in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain sensitive information via SPI flash Firmware W25Q64JV",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-10T16:15:20Z"
advisories/unreviewed/2024/09/GHSA-vj44-f7fj-3gf2/GHSA-vj44-f7fj-3gf2.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vj44-f7fj-3gf2",
"modified": "2024-09-11T00:30:51Z",
"published": "2024-09-11T00:30:51Z",
"aliases": [
"CVE-2024-40662"
],
"details": "In scheme of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40662"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/e7af00cafb52a25933ec4edb80c5111d42af0237"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-09-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-11T00:15:11Z"
}
}
advisories/unreviewed/2024/09/GHSA-xgpg-34fv-3xwr/GHSA-xgpg-34fv-3xwr.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xgpg-34fv-3xwr",
"modified": "2024-09-11T00:30:51Z",
"published": "2024-09-11T00:30:51Z",
"aliases": [
"CVE-2024-40658"
],
"details": "In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40658"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/av/+/6d23fa05a40e5462d4b9bad28afa932e6e12a4f3"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-09-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-11T00:15:11Z"
}
}