From e96ef71f741c1b052ce9e00e7a1b504f6889ee02 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 3 Jan 2024 12:31:39 +0000 Subject: [PATCH] Publish Advisories GHSA-rvg2-vh9m-cq32 GHSA-4hjv-8mmr-jxwv GHSA-3mv3-2f4g-87xm GHSA-5f9q-hg2v-3887 GHSA-cmm4-pc7p-g834 GHSA-9xg9-hh45-xcm6 GHSA-crwj-2r3c-gx2g GHSA-fxm9-385w-jhq7 --- .../GHSA-rvg2-vh9m-cq32.json | 4 ++ .../GHSA-4hjv-8mmr-jxwv.json | 4 ++ .../GHSA-3mv3-2f4g-87xm.json | 4 ++ .../GHSA-5f9q-hg2v-3887.json | 4 ++ .../GHSA-cmm4-pc7p-g834.json | 4 ++ .../GHSA-9xg9-hh45-xcm6.json | 39 ++++++++++++++++ .../GHSA-crwj-2r3c-gx2g.json | 39 ++++++++++++++++ .../GHSA-fxm9-385w-jhq7.json | 46 +++++++++++++++++++ 8 files changed, 144 insertions(+) create mode 100644 advisories/unreviewed/2024/01/GHSA-9xg9-hh45-xcm6/GHSA-9xg9-hh45-xcm6.json create mode 100644 advisories/unreviewed/2024/01/GHSA-crwj-2r3c-gx2g/GHSA-crwj-2r3c-gx2g.json create mode 100644 advisories/unreviewed/2024/01/GHSA-fxm9-385w-jhq7/GHSA-fxm9-385w-jhq7.json diff --git a/advisories/unreviewed/2022/04/GHSA-rvg2-vh9m-cq32/GHSA-rvg2-vh9m-cq32.json b/advisories/unreviewed/2022/04/GHSA-rvg2-vh9m-cq32/GHSA-rvg2-vh9m-cq32.json index df5f00a5246..45fb1a9939b 100644 --- a/advisories/unreviewed/2022/04/GHSA-rvg2-vh9m-cq32/GHSA-rvg2-vh9m-cq32.json +++ b/advisories/unreviewed/2022/04/GHSA-rvg2-vh9m-cq32/GHSA-rvg2-vh9m-cq32.json @@ -48,6 +48,10 @@ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2023/12/28/6" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/01/03/6" } ], "database_specific": { diff --git a/advisories/unreviewed/2022/10/GHSA-4hjv-8mmr-jxwv/GHSA-4hjv-8mmr-jxwv.json b/advisories/unreviewed/2022/10/GHSA-4hjv-8mmr-jxwv/GHSA-4hjv-8mmr-jxwv.json index 2203af84023..3a69546b859 100644 --- a/advisories/unreviewed/2022/10/GHSA-4hjv-8mmr-jxwv/GHSA-4hjv-8mmr-jxwv.json +++ b/advisories/unreviewed/2022/10/GHSA-4hjv-8mmr-jxwv/GHSA-4hjv-8mmr-jxwv.json @@ -100,6 +100,10 @@ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2023/12/28/5" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/01/03/5" } ], "database_specific": { diff --git a/advisories/unreviewed/2023/03/GHSA-3mv3-2f4g-87xm/GHSA-3mv3-2f4g-87xm.json b/advisories/unreviewed/2023/03/GHSA-3mv3-2f4g-87xm/GHSA-3mv3-2f4g-87xm.json index b523262bd6d..e544afe3ea0 100644 --- a/advisories/unreviewed/2023/03/GHSA-3mv3-2f4g-87xm/GHSA-3mv3-2f4g-87xm.json +++ b/advisories/unreviewed/2023/03/GHSA-3mv3-2f4g-87xm/GHSA-3mv3-2f4g-87xm.json @@ -32,6 +32,10 @@ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2023/12/28/3" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/01/03/3" } ], "database_specific": { diff --git a/advisories/unreviewed/2023/07/GHSA-5f9q-hg2v-3887/GHSA-5f9q-hg2v-3887.json b/advisories/unreviewed/2023/07/GHSA-5f9q-hg2v-3887/GHSA-5f9q-hg2v-3887.json index baec71ce1b1..ab2e462a809 100644 --- a/advisories/unreviewed/2023/07/GHSA-5f9q-hg2v-3887/GHSA-5f9q-hg2v-3887.json +++ b/advisories/unreviewed/2023/07/GHSA-5f9q-hg2v-3887/GHSA-5f9q-hg2v-3887.json @@ -36,6 +36,10 @@ { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2023/12/28/4" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/01/03/4" } ], "database_specific": { diff --git a/advisories/unreviewed/2023/12/GHSA-cmm4-pc7p-g834/GHSA-cmm4-pc7p-g834.json b/advisories/unreviewed/2023/12/GHSA-cmm4-pc7p-g834/GHSA-cmm4-pc7p-g834.json index 0a811bb084f..2ce484705de 100644 --- a/advisories/unreviewed/2023/12/GHSA-cmm4-pc7p-g834/GHSA-cmm4-pc7p-g834.json +++ b/advisories/unreviewed/2023/12/GHSA-cmm4-pc7p-g834/GHSA-cmm4-pc7p-g834.json @@ -25,6 +25,10 @@ { "type": "WEB", "url": "https://www.openoffice.org/security/cves/CVE-2023-47804.html" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/01/03/3" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/01/GHSA-9xg9-hh45-xcm6/GHSA-9xg9-hh45-xcm6.json b/advisories/unreviewed/2024/01/GHSA-9xg9-hh45-xcm6/GHSA-9xg9-hh45-xcm6.json new file mode 100644 index 00000000000..f349d8e43df --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-9xg9-hh45-xcm6/GHSA-9xg9-hh45-xcm6.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9xg9-hh45-xcm6", + "modified": "2024-01-03T12:30:21Z", + "published": "2024-01-03T12:30:21Z", + "aliases": [ + "CVE-2023-51784" + ], + "details": "Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.9.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick [1] to solve it.\n\n[1] https://github.com/apache/inlong/pull/9329 \n\n", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51784" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/4nxbyl6mh5jgh0plk0qposbxwn6w9h8j" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/01/03/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-03T10:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-crwj-2r3c-gx2g/GHSA-crwj-2r3c-gx2g.json b/advisories/unreviewed/2024/01/GHSA-crwj-2r3c-gx2g/GHSA-crwj-2r3c-gx2g.json new file mode 100644 index 00000000000..86834985786 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-crwj-2r3c-gx2g/GHSA-crwj-2r3c-gx2g.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-crwj-2r3c-gx2g", + "modified": "2024-01-03T12:30:21Z", + "published": "2024-01-03T12:30:21Z", + "aliases": [ + "CVE-2023-51785" + ], + "details": "Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary file read attack using mysql driver. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick [1] to solve it.\n\n[1]  https://github.com/apache/inlong/pull/9331 \n\n", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51785" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/g0yjmtjqvp8bnf1j0tdsk0nhfozjdjno" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/01/03/2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-03T10:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-fxm9-385w-jhq7/GHSA-fxm9-385w-jhq7.json b/advisories/unreviewed/2024/01/GHSA-fxm9-385w-jhq7/GHSA-fxm9-385w-jhq7.json new file mode 100644 index 00000000000..b5122f8ee7f --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-fxm9-385w-jhq7/GHSA-fxm9-385w-jhq7.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fxm9-385w-jhq7", + "modified": "2024-01-03T12:30:21Z", + "published": "2024-01-03T12:30:21Z", + "aliases": [ + "CVE-2024-0201" + ], + "details": "The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_settings' function in versions up to, and including, 2.5. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0201" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/product-expiry-for-woocommerce/tags/2.5/product-expiry-for-woocommerce.php#L263" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/product-expiry-for-woocommerce/tags/2.6/product-expiry-for-woocommerce.php?rev=3014924#L263" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c4006612-770a-482f-a8c2-e62f607914a9?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-03T10:15:09Z" + } +} \ No newline at end of file