From e9c938be19995f35154dfab9f6b4c4bbf39a7fad Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 7 Aug 2024 15:32:40 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-gjpq-v684-hwg5.json | 11 ++-- .../GHSA-hjv2-rmr7-p354.json | 2 +- .../GHSA-vfxc-84q8-h5w2.json | 4 +- .../GHSA-3j9x-hj5x-f35c.json | 54 +++++++++++++++++++ .../GHSA-4r7q-rwrj-9wg2.json | 9 ++-- .../GHSA-5wvf-7fq8-m4w6.json | 2 +- .../GHSA-6f79-7mqv-qvj3.json | 54 +++++++++++++++++++ .../GHSA-795c-9xpc-xw6g.json | 43 +++++++++++++++ .../GHSA-87qc-q3w7-7m8w.json | 10 +++- .../GHSA-8pv9-qh96-9hc6.json | 35 ++++++++++++ .../GHSA-cmm9-h7p3-233m.json | 2 +- .../GHSA-cq2c-35gp-j9qc.json | 2 +- .../GHSA-fjrj-vrrh-qjx6.json | 9 ++-- .../GHSA-g494-wr54-xx2g.json | 9 ++-- .../GHSA-g682-677f-3p88.json | 54 +++++++++++++++++++ .../GHSA-h856-ffvv-xvr4.json | 35 ++++++++++++ .../GHSA-jh75-99hh-qvx9.json | 43 +++++++++++++++ .../GHSA-jvvm-gq28-8rgc.json | 2 +- .../GHSA-m6mx-rh5g-59hg.json | 54 +++++++++++++++++++ .../GHSA-pv4p-cwwg-4rph.json | 43 +++++++++++++++ .../GHSA-q3p7-c68q-j2hc.json | 43 +++++++++++++++ .../GHSA-r2cp-jr96-fmw7.json | 9 ++-- .../GHSA-r836-hh6v-rg5g.json | 43 +++++++++++++++ .../GHSA-vwfg-jj4j-3gwp.json | 54 +++++++++++++++++++ .../GHSA-x2r7-mhp8-xvhm.json | 11 ++-- .../GHSA-xm33-j896-m2gh.json | 9 ++-- 26 files changed, 615 insertions(+), 31 deletions(-) create mode 100644 advisories/unreviewed/2024/08/GHSA-3j9x-hj5x-f35c/GHSA-3j9x-hj5x-f35c.json create mode 100644 advisories/unreviewed/2024/08/GHSA-6f79-7mqv-qvj3/GHSA-6f79-7mqv-qvj3.json create mode 100644 advisories/unreviewed/2024/08/GHSA-795c-9xpc-xw6g/GHSA-795c-9xpc-xw6g.json create mode 100644 advisories/unreviewed/2024/08/GHSA-8pv9-qh96-9hc6/GHSA-8pv9-qh96-9hc6.json create mode 100644 advisories/unreviewed/2024/08/GHSA-g682-677f-3p88/GHSA-g682-677f-3p88.json create mode 100644 advisories/unreviewed/2024/08/GHSA-h856-ffvv-xvr4/GHSA-h856-ffvv-xvr4.json create mode 100644 advisories/unreviewed/2024/08/GHSA-jh75-99hh-qvx9/GHSA-jh75-99hh-qvx9.json create mode 100644 advisories/unreviewed/2024/08/GHSA-m6mx-rh5g-59hg/GHSA-m6mx-rh5g-59hg.json create mode 100644 advisories/unreviewed/2024/08/GHSA-pv4p-cwwg-4rph/GHSA-pv4p-cwwg-4rph.json create mode 100644 advisories/unreviewed/2024/08/GHSA-q3p7-c68q-j2hc/GHSA-q3p7-c68q-j2hc.json create mode 100644 advisories/unreviewed/2024/08/GHSA-r836-hh6v-rg5g/GHSA-r836-hh6v-rg5g.json create mode 100644 advisories/unreviewed/2024/08/GHSA-vwfg-jj4j-3gwp/GHSA-vwfg-jj4j-3gwp.json diff --git a/advisories/unreviewed/2024/03/GHSA-gjpq-v684-hwg5/GHSA-gjpq-v684-hwg5.json b/advisories/unreviewed/2024/03/GHSA-gjpq-v684-hwg5/GHSA-gjpq-v684-hwg5.json index 22d0393c1ea..ed138f4948d 100644 --- a/advisories/unreviewed/2024/03/GHSA-gjpq-v684-hwg5/GHSA-gjpq-v684-hwg5.json +++ b/advisories/unreviewed/2024/03/GHSA-gjpq-v684-hwg5/GHSA-gjpq-v684-hwg5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-gjpq-v684-hwg5", - "modified": "2024-03-21T03:36:45Z", + "modified": "2024-08-07T15:30:37Z", "published": "2024-03-21T03:36:45Z", "aliases": [ "CVE-2023-49980" ], "details": "A directory listing vulnerability in Best Student Result Management System v1.0 allows attackers to list directories and sensitive files within the application without requiring authorization.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-862" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-21T02:49:38Z" diff --git a/advisories/unreviewed/2024/07/GHSA-hjv2-rmr7-p354/GHSA-hjv2-rmr7-p354.json b/advisories/unreviewed/2024/07/GHSA-hjv2-rmr7-p354/GHSA-hjv2-rmr7-p354.json index d323a51ea4f..82e64a677e9 100644 --- a/advisories/unreviewed/2024/07/GHSA-hjv2-rmr7-p354/GHSA-hjv2-rmr7-p354.json +++ b/advisories/unreviewed/2024/07/GHSA-hjv2-rmr7-p354/GHSA-hjv2-rmr7-p354.json @@ -32,7 +32,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/07/GHSA-vfxc-84q8-h5w2/GHSA-vfxc-84q8-h5w2.json b/advisories/unreviewed/2024/07/GHSA-vfxc-84q8-h5w2/GHSA-vfxc-84q8-h5w2.json index 8435afe5104..27dec2b593b 100644 --- a/advisories/unreviewed/2024/07/GHSA-vfxc-84q8-h5w2/GHSA-vfxc-84q8-h5w2.json +++ b/advisories/unreviewed/2024/07/GHSA-vfxc-84q8-h5w2/GHSA-vfxc-84q8-h5w2.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vfxc-84q8-h5w2", - "modified": "2024-07-09T09:30:55Z", + "modified": "2024-08-07T15:30:38Z", "published": "2024-07-09T09:30:55Z", "aliases": [ "CVE-2024-3603" @@ -32,7 +32,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/08/GHSA-3j9x-hj5x-f35c/GHSA-3j9x-hj5x-f35c.json b/advisories/unreviewed/2024/08/GHSA-3j9x-hj5x-f35c/GHSA-3j9x-hj5x-f35c.json new file mode 100644 index 00000000000..11018eb25c3 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-3j9x-hj5x-f35c/GHSA-3j9x-hj5x-f35c.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3j9x-hj5x-f35c", + "modified": "2024-08-07T15:30:42Z", + "published": "2024-08-07T15:30:42Z", + "aliases": [ + "CVE-2024-7580" + ], + "details": "A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/system.html. The manipulation of the argument uploadedFile with the input ;whoami leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7580" + }, + { + "type": "WEB", + "url": "https://github.com/Push3AX/vul/blob/main/Alien%20Technology%20/ALR-F800.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.273860" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.273860" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.382481" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-07T15:15:56Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-4r7q-rwrj-9wg2/GHSA-4r7q-rwrj-9wg2.json b/advisories/unreviewed/2024/08/GHSA-4r7q-rwrj-9wg2/GHSA-4r7q-rwrj-9wg2.json index b901223eced..c6e85eb16f4 100644 --- a/advisories/unreviewed/2024/08/GHSA-4r7q-rwrj-9wg2/GHSA-4r7q-rwrj-9wg2.json +++ b/advisories/unreviewed/2024/08/GHSA-4r7q-rwrj-9wg2/GHSA-4r7q-rwrj-9wg2.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-4r7q-rwrj-9wg2", - "modified": "2024-08-06T21:30:48Z", + "modified": "2024-08-07T15:30:39Z", "published": "2024-08-06T21:30:47Z", "aliases": [ "CVE-2024-7533" ], "details": "Use after free in Sharing in Google Chrome on iOS prior to 127.0.6533.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-06T21:16:03Z" diff --git a/advisories/unreviewed/2024/08/GHSA-5wvf-7fq8-m4w6/GHSA-5wvf-7fq8-m4w6.json b/advisories/unreviewed/2024/08/GHSA-5wvf-7fq8-m4w6/GHSA-5wvf-7fq8-m4w6.json index b05b0c82e9c..ce9d5b8cf2f 100644 --- a/advisories/unreviewed/2024/08/GHSA-5wvf-7fq8-m4w6/GHSA-5wvf-7fq8-m4w6.json +++ b/advisories/unreviewed/2024/08/GHSA-5wvf-7fq8-m4w6/GHSA-5wvf-7fq8-m4w6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-5wvf-7fq8-m4w6", - "modified": "2024-08-07T12:31:28Z", + "modified": "2024-08-07T15:30:41Z", "published": "2024-08-07T12:31:28Z", "aliases": [ "CVE-2024-7266" diff --git a/advisories/unreviewed/2024/08/GHSA-6f79-7mqv-qvj3/GHSA-6f79-7mqv-qvj3.json b/advisories/unreviewed/2024/08/GHSA-6f79-7mqv-qvj3/GHSA-6f79-7mqv-qvj3.json new file mode 100644 index 00000000000..4ee6524df87 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-6f79-7mqv-qvj3/GHSA-6f79-7mqv-qvj3.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6f79-7mqv-qvj3", + "modified": "2024-08-07T15:30:42Z", + "published": "2024-08-07T15:30:42Z", + "aliases": [ + "CVE-2024-7578" + ], + "details": "A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been classified as critical. Affected is an unknown function of the file /var/www/cmd.php. The manipulation of the argument cmd leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7578" + }, + { + "type": "WEB", + "url": "https://github.com/Push3AX/vul/blob/main/Alien%20Technology%20/ALR-F800.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.273858" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.273858" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.382469" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-285" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-07T13:16:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-795c-9xpc-xw6g/GHSA-795c-9xpc-xw6g.json b/advisories/unreviewed/2024/08/GHSA-795c-9xpc-xw6g/GHSA-795c-9xpc-xw6g.json new file mode 100644 index 00000000000..216499540f1 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-795c-9xpc-xw6g/GHSA-795c-9xpc-xw6g.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-795c-9xpc-xw6g", + "modified": "2024-08-07T15:30:42Z", + "published": "2024-08-07T15:30:42Z", + "aliases": [ + "CVE-2024-41990" + ], + "details": "An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41990" + }, + { + "type": "WEB", + "url": "https://docs.djangoproject.com/en/dev/releases/security" + }, + { + "type": "WEB", + "url": "https://groups.google.com/forum/#%21forum/django-announce" + }, + { + "type": "WEB", + "url": "https://www.djangoproject.com/weblog/2024/aug/06/security-releases" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-07T15:15:56Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-87qc-q3w7-7m8w/GHSA-87qc-q3w7-7m8w.json b/advisories/unreviewed/2024/08/GHSA-87qc-q3w7-7m8w/GHSA-87qc-q3w7-7m8w.json index 8a828a1e053..1e809f45e20 100644 --- a/advisories/unreviewed/2024/08/GHSA-87qc-q3w7-7m8w/GHSA-87qc-q3w7-7m8w.json +++ b/advisories/unreviewed/2024/08/GHSA-87qc-q3w7-7m8w/GHSA-87qc-q3w7-7m8w.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-87qc-q3w7-7m8w", - "modified": "2024-08-01T21:31:40Z", + "modified": "2024-08-07T15:30:39Z", "published": "2024-08-01T15:32:20Z", "aliases": [ "CVE-2024-6923" @@ -29,6 +29,14 @@ "type": "WEB", "url": "https://github.com/python/cpython/pull/122233" }, + { + "type": "WEB", + "url": "https://github.com/python/cpython/commit/4766d1200fdf8b6728137aa2927a297e224d5fa7" + }, + { + "type": "WEB", + "url": "https://github.com/python/cpython/commit/4aaa4259b5a6e664b7316a4d60bdec7ee0f124d0" + }, { "type": "WEB", "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/QH3BUOE2DYQBWP7NAQ7UNHPPOELKISRW" diff --git a/advisories/unreviewed/2024/08/GHSA-8pv9-qh96-9hc6/GHSA-8pv9-qh96-9hc6.json b/advisories/unreviewed/2024/08/GHSA-8pv9-qh96-9hc6/GHSA-8pv9-qh96-9hc6.json new file mode 100644 index 00000000000..550fb0b3337 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-8pv9-qh96-9hc6/GHSA-8pv9-qh96-9hc6.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8pv9-qh96-9hc6", + "modified": "2024-08-07T15:30:42Z", + "published": "2024-08-07T15:30:42Z", + "aliases": [ + "CVE-2024-43045" + ], + "details": "Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' \"My Views\".", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43045" + }, + { + "type": "WEB", + "url": "https://www.jenkins.io/security/advisory/2024-08-07/#SECURITY-3349" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-07T14:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-cmm9-h7p3-233m/GHSA-cmm9-h7p3-233m.json b/advisories/unreviewed/2024/08/GHSA-cmm9-h7p3-233m/GHSA-cmm9-h7p3-233m.json index 648496fcef5..54f1c27847f 100644 --- a/advisories/unreviewed/2024/08/GHSA-cmm9-h7p3-233m/GHSA-cmm9-h7p3-233m.json +++ b/advisories/unreviewed/2024/08/GHSA-cmm9-h7p3-233m/GHSA-cmm9-h7p3-233m.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-200" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/08/GHSA-cq2c-35gp-j9qc/GHSA-cq2c-35gp-j9qc.json b/advisories/unreviewed/2024/08/GHSA-cq2c-35gp-j9qc/GHSA-cq2c-35gp-j9qc.json index 941ca2600e7..8b590762e95 100644 --- a/advisories/unreviewed/2024/08/GHSA-cq2c-35gp-j9qc/GHSA-cq2c-35gp-j9qc.json +++ b/advisories/unreviewed/2024/08/GHSA-cq2c-35gp-j9qc/GHSA-cq2c-35gp-j9qc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-cq2c-35gp-j9qc", - "modified": "2024-08-07T12:31:28Z", + "modified": "2024-08-07T15:30:41Z", "published": "2024-08-07T12:31:28Z", "aliases": [ "CVE-2024-7267" diff --git a/advisories/unreviewed/2024/08/GHSA-fjrj-vrrh-qjx6/GHSA-fjrj-vrrh-qjx6.json b/advisories/unreviewed/2024/08/GHSA-fjrj-vrrh-qjx6/GHSA-fjrj-vrrh-qjx6.json index 3d23cc69550..0af38cfe4c9 100644 --- a/advisories/unreviewed/2024/08/GHSA-fjrj-vrrh-qjx6/GHSA-fjrj-vrrh-qjx6.json +++ b/advisories/unreviewed/2024/08/GHSA-fjrj-vrrh-qjx6/GHSA-fjrj-vrrh-qjx6.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-fjrj-vrrh-qjx6", - "modified": "2024-08-07T06:31:10Z", + "modified": "2024-08-07T15:30:40Z", "published": "2024-08-07T06:31:10Z", "aliases": [ "CVE-2024-6494" ], "details": "The WordPress File Upload WordPress plugin before 4.24.8 does not properly sanitize and escape certain parameters, which could allow unauthenticated users to execute stored cross-site scripting (XSS) attacks.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-07T06:16:47Z" diff --git a/advisories/unreviewed/2024/08/GHSA-g494-wr54-xx2g/GHSA-g494-wr54-xx2g.json b/advisories/unreviewed/2024/08/GHSA-g494-wr54-xx2g/GHSA-g494-wr54-xx2g.json index 62501295807..a68710f2a31 100644 --- a/advisories/unreviewed/2024/08/GHSA-g494-wr54-xx2g/GHSA-g494-wr54-xx2g.json +++ b/advisories/unreviewed/2024/08/GHSA-g494-wr54-xx2g/GHSA-g494-wr54-xx2g.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-g494-wr54-xx2g", - "modified": "2024-08-06T18:30:57Z", + "modified": "2024-08-07T15:30:39Z", "published": "2024-08-06T18:30:57Z", "aliases": [ "CVE-2024-7000" ], "details": "Use after free in CSS in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-06T16:15:50Z" diff --git a/advisories/unreviewed/2024/08/GHSA-g682-677f-3p88/GHSA-g682-677f-3p88.json b/advisories/unreviewed/2024/08/GHSA-g682-677f-3p88/GHSA-g682-677f-3p88.json new file mode 100644 index 00000000000..9b157327e61 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-g682-677f-3p88/GHSA-g682-677f-3p88.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g682-677f-3p88", + "modified": "2024-08-07T15:30:42Z", + "published": "2024-08-07T15:30:42Z", + "aliases": [ + "CVE-2024-7579" + ], + "details": "A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been declared as critical. Affected by this vulnerability is the function popen of the file /var/www/cgi-bin/upgrade.cgi of the component File Name Handler. The manipulation of the argument uploadedFile leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7579" + }, + { + "type": "WEB", + "url": "https://github.com/Push3AX/vul/blob/main/Alien%20Technology%20/ALR-F800.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.273859" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.273859" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.382470" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-07T14:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-h856-ffvv-xvr4/GHSA-h856-ffvv-xvr4.json b/advisories/unreviewed/2024/08/GHSA-h856-ffvv-xvr4/GHSA-h856-ffvv-xvr4.json new file mode 100644 index 00000000000..6a9d9b94995 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-h856-ffvv-xvr4/GHSA-h856-ffvv-xvr4.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h856-ffvv-xvr4", + "modified": "2024-08-07T15:30:42Z", + "published": "2024-08-07T15:30:42Z", + "aliases": [ + "CVE-2024-43044" + ], + "details": "Jenkins 2.470 and earlier, LTS 2.452.3 and earlier allows agent processes to read arbitrary files from the Jenkins controller file system by using the `ClassLoaderProxy#fetchJar` method in the Remoting library.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43044" + }, + { + "type": "WEB", + "url": "https://www.jenkins.io/security/advisory/2024-08-07/#SECURITY-3430" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-07T14:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-jh75-99hh-qvx9/GHSA-jh75-99hh-qvx9.json b/advisories/unreviewed/2024/08/GHSA-jh75-99hh-qvx9/GHSA-jh75-99hh-qvx9.json new file mode 100644 index 00000000000..080fd1b0eb0 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-jh75-99hh-qvx9/GHSA-jh75-99hh-qvx9.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jh75-99hh-qvx9", + "modified": "2024-08-07T15:30:42Z", + "published": "2024-08-07T15:30:42Z", + "aliases": [ + "CVE-2024-41989" + ], + "details": "An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The floatformat template filter is subject to significant memory consumption when given a string representation of a number in scientific notation with a large exponent.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41989" + }, + { + "type": "WEB", + "url": "https://docs.djangoproject.com/en/dev/releases/security" + }, + { + "type": "WEB", + "url": "https://groups.google.com/forum/#%21forum/django-announce" + }, + { + "type": "WEB", + "url": "https://www.djangoproject.com/weblog/2024/aug/06/security-releases" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-07T15:15:56Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-jvvm-gq28-8rgc/GHSA-jvvm-gq28-8rgc.json b/advisories/unreviewed/2024/08/GHSA-jvvm-gq28-8rgc/GHSA-jvvm-gq28-8rgc.json index 3ae8181b051..802ea282c29 100644 --- a/advisories/unreviewed/2024/08/GHSA-jvvm-gq28-8rgc/GHSA-jvvm-gq28-8rgc.json +++ b/advisories/unreviewed/2024/08/GHSA-jvvm-gq28-8rgc/GHSA-jvvm-gq28-8rgc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jvvm-gq28-8rgc", - "modified": "2024-08-07T12:31:28Z", + "modified": "2024-08-07T15:30:40Z", "published": "2024-08-07T12:31:28Z", "aliases": [ "CVE-2024-7265" diff --git a/advisories/unreviewed/2024/08/GHSA-m6mx-rh5g-59hg/GHSA-m6mx-rh5g-59hg.json b/advisories/unreviewed/2024/08/GHSA-m6mx-rh5g-59hg/GHSA-m6mx-rh5g-59hg.json new file mode 100644 index 00000000000..5ff4428f938 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-m6mx-rh5g-59hg/GHSA-m6mx-rh5g-59hg.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m6mx-rh5g-59hg", + "modified": "2024-08-07T15:30:42Z", + "published": "2024-08-07T15:30:41Z", + "aliases": [ + "CVE-2024-7355" + ], + "details": "The Organization chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_input’ and 'node_description' parameter in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this can only be exploited by administrators, but the ability to use and configure charts can be extended to subscribers.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7355" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/organization-chart/trunk/admin/assets/js/tree_page.js#L207" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/organization-chart/trunk/admin/assets/js/tree_page.js#L217" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3131569/#file0" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/organization-chart/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/04641506-5b0e-48bc-ad50-c81dda996ecf?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-07T13:16:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-pv4p-cwwg-4rph/GHSA-pv4p-cwwg-4rph.json b/advisories/unreviewed/2024/08/GHSA-pv4p-cwwg-4rph/GHSA-pv4p-cwwg-4rph.json new file mode 100644 index 00000000000..03695760be2 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-pv4p-cwwg-4rph/GHSA-pv4p-cwwg-4rph.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pv4p-cwwg-4rph", + "modified": "2024-08-07T15:30:42Z", + "published": "2024-08-07T15:30:42Z", + "aliases": [ + "CVE-2024-42005" + ], + "details": "An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. QuerySet.values() and values_list() methods on models with a JSONField are subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42005" + }, + { + "type": "WEB", + "url": "https://docs.djangoproject.com/en/dev/releases/security" + }, + { + "type": "WEB", + "url": "https://groups.google.com/forum/#%21forum/django-announce" + }, + { + "type": "WEB", + "url": "https://www.djangoproject.com/weblog/2024/aug/06/security-releases" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-07T15:15:56Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-q3p7-c68q-j2hc/GHSA-q3p7-c68q-j2hc.json b/advisories/unreviewed/2024/08/GHSA-q3p7-c68q-j2hc/GHSA-q3p7-c68q-j2hc.json new file mode 100644 index 00000000000..e098ca87b89 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-q3p7-c68q-j2hc/GHSA-q3p7-c68q-j2hc.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q3p7-c68q-j2hc", + "modified": "2024-08-07T15:30:42Z", + "published": "2024-08-07T15:30:42Z", + "aliases": [ + "CVE-2024-43199" + ], + "details": "Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43199" + }, + { + "type": "WEB", + "url": "https://github.com/NagiosEnterprises/ndoutils/pull/65" + }, + { + "type": "WEB", + "url": "https://github.com/NagiosEnterprises/ndoutils/commit/18ef12037f4a68772d6840cbaa08aa2da07d2891" + }, + { + "type": "WEB", + "url": "https://github.com/NagiosEnterprises/ndoutils/compare/ndoutils-2.1.3...ndoutils-2.1.4" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-07T14:15:33Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-r2cp-jr96-fmw7/GHSA-r2cp-jr96-fmw7.json b/advisories/unreviewed/2024/08/GHSA-r2cp-jr96-fmw7/GHSA-r2cp-jr96-fmw7.json index ff6fb6ec292..56afa7edbad 100644 --- a/advisories/unreviewed/2024/08/GHSA-r2cp-jr96-fmw7/GHSA-r2cp-jr96-fmw7.json +++ b/advisories/unreviewed/2024/08/GHSA-r2cp-jr96-fmw7/GHSA-r2cp-jr96-fmw7.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-r2cp-jr96-fmw7", - "modified": "2024-08-01T06:30:35Z", + "modified": "2024-08-07T15:30:38Z", "published": "2024-08-01T06:30:34Z", "aliases": [ "CVE-2024-6496" ], "details": "The Light Poll WordPress plugin through 1.0.0 does not have CSRF checks when deleting polls, which could allow attackers to make logged in users perform such action via a CSRF attack", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-01T06:15:02Z" diff --git a/advisories/unreviewed/2024/08/GHSA-r836-hh6v-rg5g/GHSA-r836-hh6v-rg5g.json b/advisories/unreviewed/2024/08/GHSA-r836-hh6v-rg5g/GHSA-r836-hh6v-rg5g.json new file mode 100644 index 00000000000..092bd5faa97 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-r836-hh6v-rg5g/GHSA-r836-hh6v-rg5g.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r836-hh6v-rg5g", + "modified": "2024-08-07T15:30:42Z", + "published": "2024-08-07T15:30:42Z", + "aliases": [ + "CVE-2024-41991" + ], + "details": "An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41991" + }, + { + "type": "WEB", + "url": "https://docs.djangoproject.com/en/dev/releases/security" + }, + { + "type": "WEB", + "url": "https://groups.google.com/forum/#%21forum/django-announce" + }, + { + "type": "WEB", + "url": "https://www.djangoproject.com/weblog/2024/aug/06/security-releases" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-07T15:15:56Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-vwfg-jj4j-3gwp/GHSA-vwfg-jj4j-3gwp.json b/advisories/unreviewed/2024/08/GHSA-vwfg-jj4j-3gwp/GHSA-vwfg-jj4j-3gwp.json new file mode 100644 index 00000000000..872335fe00a --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-vwfg-jj4j-3gwp/GHSA-vwfg-jj4j-3gwp.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vwfg-jj4j-3gwp", + "modified": "2024-08-07T15:30:43Z", + "published": "2024-08-07T15:30:43Z", + "aliases": [ + "CVE-2024-7581" + ], + "details": "A vulnerability classified as critical has been found in Tenda A301 15.13.08.12. This affects the function formWifiBasicSet of the file /goform/WifiBasicSet. The manipulation of the argument security leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7581" + }, + { + "type": "WEB", + "url": "https://github.com/BeaCox/IoT_vuln/tree/main/tenda/A301/WifiBasicSet_bof" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.273861" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.273861" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.382745" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-121" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-07T15:15:56Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-x2r7-mhp8-xvhm/GHSA-x2r7-mhp8-xvhm.json b/advisories/unreviewed/2024/08/GHSA-x2r7-mhp8-xvhm/GHSA-x2r7-mhp8-xvhm.json index 8d2291c8063..d0a560d524e 100644 --- a/advisories/unreviewed/2024/08/GHSA-x2r7-mhp8-xvhm/GHSA-x2r7-mhp8-xvhm.json +++ b/advisories/unreviewed/2024/08/GHSA-x2r7-mhp8-xvhm/GHSA-x2r7-mhp8-xvhm.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-x2r7-mhp8-xvhm", - "modified": "2024-08-06T15:30:54Z", + "modified": "2024-08-07T15:30:39Z", "published": "2024-08-06T15:30:54Z", "aliases": [ "CVE-2024-33897" ], "details": "A compromised HMS Networks Cosy+ device could be used to request a Certificate Signing Request from Talk2m for another device, resulting in an availability issue. The issue was patched on the Talk2m production server on April 18, 2024.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-425" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-06T14:16:03Z" diff --git a/advisories/unreviewed/2024/08/GHSA-xm33-j896-m2gh/GHSA-xm33-j896-m2gh.json b/advisories/unreviewed/2024/08/GHSA-xm33-j896-m2gh/GHSA-xm33-j896-m2gh.json index 4ace7f81e16..8bed593684e 100644 --- a/advisories/unreviewed/2024/08/GHSA-xm33-j896-m2gh/GHSA-xm33-j896-m2gh.json +++ b/advisories/unreviewed/2024/08/GHSA-xm33-j896-m2gh/GHSA-xm33-j896-m2gh.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-xm33-j896-m2gh", - "modified": "2024-08-05T06:30:37Z", + "modified": "2024-08-07T15:30:39Z", "published": "2024-08-05T06:30:37Z", "aliases": [ "CVE-2024-2232" ], "details": "The lacks CSRF checks allowing a user to invite any user to any group (including private groups)", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-05T06:16:40Z"