netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-11-16 00:33:43 +00:00
parent fd17a013f6
commit e750d6db13
41 changed files with 621 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/02/GHSA-j6qq-7xp7-c5p5/GHSA-j6qq-7xp7-c5p5.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j6qq-7xp7-c5p5",
"modified": "2024-02-20T15:31:05Z",
"modified": "2024-11-16T00:31:47Z",
"published": "2024-02-20T15:31:05Z",
"aliases": [
"CVE-2024-1555"
],
"details": "When opening a website using the `firefox://` protocol handler, SameSite cookies were not properly respected. This vulnerability affects Firefox < 123.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-290"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-20T14:15:09Z"
advisories/unreviewed/2024/03/GHSA-gpvh-42rv-p6wg/GHSA-gpvh-42rv-p6wg.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gpvh-42rv-p6wg",
"modified": "2024-03-23T18:30:41Z",
"modified": "2024-11-16T00:31:48Z",
"published": "2024-03-18T06:30:51Z",
"aliases": [
"CVE-2021-47154"
],
"details": "The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address string, which (in some situations) allows attackers to bypass access control that is based on IP addresses.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"affected": [
@@ -43,7 +46,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-18T05:15:06Z"
advisories/unreviewed/2024/03/GHSA-h86r-ff52-49qg/GHSA-h86r-ff52-49qg.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h86r-ff52-49qg",
"modified": "2024-03-11T21:31:26Z",
"modified": "2024-11-16T00:31:48Z",
"published": "2024-03-11T21:31:26Z",
"aliases": [
"CVE-2024-27223"
],
"details": "In EUTRAN_LCS_DecodeFacilityInformationElement of LPP_LcsManagement.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure after authenticating the cell connection with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-11T19:15:48Z"
advisories/unreviewed/2024/03/GHSA-mfgg-7fpx-cp7p/GHSA-mfgg-7fpx-cp7p.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mfgg-7fpx-cp7p",
"modified": "2024-03-27T06:30:32Z",
"modified": "2024-11-16T00:31:48Z",
"published": "2024-03-27T06:30:32Z",
"aliases": [
"CVE-2023-45935"
],
"details": "Qt 6 through 6.6 was discovered to contain a NULL pointer dereference via the function QXcbConnection::initializeAllAtoms(). NOTE: this is disputed because it is not expected that an X application should continue to run when there is arbitrary anomalous behavior from the X server.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-27T05:15:47Z"
advisories/unreviewed/2024/03/GHSA-qc99-r4wh-c8h6/GHSA-qc99-r4wh-c8h6.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qc99-r4wh-c8h6",
"modified": "2024-03-29T00:30:34Z",
"modified": "2024-11-16T00:31:48Z",
"published": "2024-03-29T00:30:34Z",
"aliases": [
"CVE-2024-29316"
],
"details": "NodeBB 3.6.7 is vulnerable to Incorrect Access Control.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
@@ -31,7 +34,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-28T23:15:46Z"
advisories/unreviewed/2024/04/GHSA-7wqm-436q-gxcm/GHSA-7wqm-436q-gxcm.json
+1 -1
View File
@@ -28,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/05/GHSA-9gxf-r468-r4c5/GHSA-9gxf-r468-r4c5.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9gxf-r468-r4c5",
"modified": "2024-06-10T21:30:35Z",
"modified": "2024-11-16T00:31:49Z",
"published": "2024-05-14T15:32:53Z",
"aliases": [
"CVE-2024-27789"
],
"details": "A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, macOS Monterey 12.7.5, macOS Ventura 13.6.7, macOS Sonoma 14.4. An app may be able to access user-sensitive data.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
@@ -65,9 +68,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-922"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T15:13:01Z"
advisories/unreviewed/2024/06/GHSA-247v-cg43-r8xg/GHSA-247v-cg43-r8xg.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-247v-cg43-r8xg",
"modified": "2024-06-03T03:31:04Z",
"modified": "2024-11-16T00:31:49Z",
"published": "2024-06-03T03:31:04Z",
"aliases": [
"CVE-2024-20070"
],
"details": "In modem, there is a possible information disclosure due to using risky cryptographic algorithm during connection establishment negotiation. This could lead to remote information disclosure, when weak encryption algorithm is used, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00942482; Issue ID: MSV-1469.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
"CWE-327"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-03T02:15:09Z"
advisories/unreviewed/2024/06/GHSA-prj9-gvpq-vj8x/GHSA-prj9-gvpq-vj8x.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-prj9-gvpq-vj8x",
"modified": "2024-06-18T06:30:42Z",
"modified": "2024-11-16T00:31:49Z",
"published": "2024-06-18T06:30:42Z",
"aliases": [
"CVE-2024-34024"
],
"details": "Observable response discrepancy issue exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, an unauthenticated remote attacker may determine if a username is valid or not.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
@@ -31,7 +34,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-18T06:15:11Z"
advisories/unreviewed/2024/07/GHSA-8g3v-wwhq-2r48/GHSA-8g3v-wwhq-2r48.json
+1 -1
View File
@@ -28,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-306"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/10/GHSA-f7h9-hrg7-94fg/GHSA-f7h9-hrg7-94fg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f7h9-hrg7-94fg",
"modified": "2024-10-01T15:32:08Z",
"modified": "2024-11-16T00:31:49Z",
"published": "2024-10-01T15:32:08Z",
"aliases": [
"CVE-2021-37577"
],
"details": "Bluetooth LE and BR/EDR Secure Connections pairing and Secure Simple Pairing using the Passkey entry protocol in Bluetooth Core Specifications 2.1 through 5.3 may permit an unauthenticated man-in-the-middle attacker to identify the Passkey used during pairing by reflection of a crafted public key with the same X coordinate as the offered public key and by reflection of the authentication evidence of the initiating device, potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. This is a related issue to CVE-2020-26558.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-01T15:15:06Z"
advisories/unreviewed/2024/11/GHSA-3vhp-r544-3wrg/GHSA-3vhp-r544-3wrg.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3vhp-r544-3wrg",
"modified": "2024-11-16T00:31:51Z",
"published": "2024-11-16T00:31:50Z",
"aliases": [
"CVE-2017-13310"
],
"details": "In createFromParcel of ViewPager.java, there is a possible read/write serialization issue leading to a permissions bypass. This could lead to local escalation of privilege where an app can start an activity with system privileges with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13310"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2018-05-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-15T22:15:14Z"
}
}
advisories/unreviewed/2024/11/GHSA-3x6q-p4ff-j7wv/GHSA-3x6q-p4ff-j7wv.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3x6q-p4ff-j7wv",
"modified": "2024-11-16T00:31:51Z",
"published": "2024-11-16T00:31:51Z",
"aliases": [
"CVE-2024-11261"
],
"details": "A vulnerability, which was classified as critical, was found in SourceCodester Student Record Management System 1.0. Affected is an unknown function of the file StudentRecordManagementSystem.cpp of the component Number of Students Menu. The manipulation leads to memory corruption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11261"
},
{
"type": "WEB",
"url": "https://github.com/Hacker0xone/CVE/issues/12"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.284718"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.284718"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.443906"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-15T22:15:14Z"
}
}
advisories/unreviewed/2024/11/GHSA-4g32-4h7x-954w/GHSA-4g32-4h7x-954w.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4g32-4h7x-954w",
"modified": "2024-11-15T21:30:47Z",
"modified": "2024-11-16T00:31:50Z",
"published": "2024-11-15T21:30:47Z",
"aliases": [
"CVE-2024-24459"
],
"details": "An invalid memory access when handling the ProtocolIE_ID field of S1Setup Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-15T20:15:19Z"
advisories/unreviewed/2024/11/GHSA-5gw7-xq3v-7q6c/GHSA-5gw7-xq3v-7q6c.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5gw7-xq3v-7q6c",
"modified": "2024-11-16T00:31:51Z",
"published": "2024-11-16T00:31:51Z",
"aliases": [
"CVE-2017-13314"
],
"details": "In setAllowOnlyVpnForUids of NetworkManagementService.java, there is a possible security settings bypass due to a missing permission check. This could lead to local escalation of privilege allowing users to access non-VPN networks, when they are supposed to be restricted to the VPN networks, with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13314"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2018-05-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-15T22:15:14Z"
}
}
advisories/unreviewed/2024/11/GHSA-5qw6-857j-hf24/GHSA-5qw6-857j-hf24.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5qw6-857j-hf24",
"modified": "2024-11-16T00:31:51Z",
"published": "2024-11-16T00:31:51Z",
"aliases": [
"CVE-2024-51765"
],
"details": "A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on configuration, this vulnerability may lead to local/cluster unauthorized access.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51765"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbcr04748en_us&docLocale=en_US"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-15T22:15:16Z"
}
}
advisories/unreviewed/2024/11/GHSA-5v3w-3pq2-qhxx/GHSA-5v3w-3pq2-qhxx.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5v3w-3pq2-qhxx",
"modified": "2024-11-16T00:31:51Z",
"published": "2024-11-16T00:31:51Z",
"aliases": [
"CVE-2024-11262"
],
"details": "A vulnerability has been found in SourceCodester Student Record Management System 1.0 and classified as critical. Affected by this vulnerability is the function main of the component View All Student Marks. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11262"
},
{
"type": "WEB",
"url": "https://github.com/Hacker0xone/CVE/issues/13"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.284719"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.284719"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.443950"
},
{
"type": "WEB",
"url": "https://www.sourcecodester.com"
}
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-15T23:15:10Z"
}
}
advisories/unreviewed/2024/11/GHSA-62mp-w633-xcfv/GHSA-62mp-w633-xcfv.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-62mp-w633-xcfv",
"modified": "2024-11-15T18:30:51Z",
"modified": "2024-11-16T00:31:50Z",
"published": "2024-11-15T18:30:51Z",
"aliases": [
"CVE-2024-24450"
],
"details": "Stack-based memcpy buffer overflow in the ngap_handle_pdu_session_resource_setup_response routine in OpenAirInterface CN5G AMF <= 2.0.0 allows a remote attacker with access to the N2 interface to carry out denial of service against the AMF and potentially execute code by sending a PDU Session Resource Setup Response with a suffciently large FailedToSetupList IE.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-120"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-15T18:15:27Z"
advisories/unreviewed/2024/11/GHSA-72v3-rgjm-mj6f/GHSA-72v3-rgjm-mj6f.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-72v3-rgjm-mj6f",
"modified": "2024-11-13T00:30:48Z",
"modified": "2024-11-16T00:31:50Z",
"published": "2024-11-13T00:30:48Z",
"aliases": [
"CVE-2021-27702"
],
"details": "Sercomm Router Etisalat Model S3- AC2100 is affected by Incorrect Access Control via the diagnostic utility in the router dashboard.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T23:15:03Z"
advisories/unreviewed/2024/11/GHSA-7pj9-85vv-hh5r/GHSA-7pj9-85vv-hh5r.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7pj9-85vv-hh5r",
"modified": "2024-11-15T21:30:47Z",
"modified": "2024-11-16T00:31:50Z",
"published": "2024-11-15T21:30:47Z",
"aliases": [
"CVE-2024-24454"
],
"details": "An invalid memory access when handling the ProtocolIE_ID field of E-RAB Modify Request messages in Athonet vEPC MME v11.4.0 allows attackers to cause a Denial of Service (DoS) to the cellular network by repeatedly initiating connections and sending a crafted payload.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-15T20:15:19Z"

Some files were not shown because too many files have changed in this diff Show More