diff --git a/advisories/unreviewed/2023/10/GHSA-7xw9-w465-6x42/GHSA-7xw9-w465-6x42.json b/advisories/unreviewed/2023/10/GHSA-7xw9-w465-6x42/GHSA-7xw9-w465-6x42.json index c04c4314892..c52ebdf5545 100644 --- a/advisories/unreviewed/2023/10/GHSA-7xw9-w465-6x42/GHSA-7xw9-w465-6x42.json +++ b/advisories/unreviewed/2023/10/GHSA-7xw9-w465-6x42/GHSA-7xw9-w465-6x42.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7xw9-w465-6x42", - "modified": "2024-04-01T18:30:56Z", + "modified": "2024-07-09T15:30:52Z", "published": "2023-10-18T06:30:30Z", "aliases": [ "CVE-2023-38545" @@ -25,6 +25,10 @@ "type": "WEB", "url": "https://curl.se/docs/CVE-2023-38545.html" }, + { + "type": "WEB", + "url": "https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ" diff --git a/advisories/unreviewed/2023/10/GHSA-x3qx-m3c2-qfhx/GHSA-x3qx-m3c2-qfhx.json b/advisories/unreviewed/2023/10/GHSA-x3qx-m3c2-qfhx/GHSA-x3qx-m3c2-qfhx.json index fabb69746f6..216339a5db2 100644 --- a/advisories/unreviewed/2023/10/GHSA-x3qx-m3c2-qfhx/GHSA-x3qx-m3c2-qfhx.json +++ b/advisories/unreviewed/2023/10/GHSA-x3qx-m3c2-qfhx/GHSA-x3qx-m3c2-qfhx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-x3qx-m3c2-qfhx", - "modified": "2023-11-16T23:47:49Z", + "modified": "2024-07-09T15:30:52Z", "published": "2023-10-18T06:30:30Z", "aliases": [ "CVE-2023-38546" @@ -25,6 +25,10 @@ "type": "WEB", "url": "https://curl.se/docs/CVE-2023-38546.html" }, + { + "type": "WEB", + "url": "https://forum.vmssoftware.com/viewtopic.php?f=8&t=8868" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OGMXNRNSJ4ETDK6FRNU3J7SABXPWCHSQ" diff --git a/advisories/unreviewed/2024/07/GHSA-3wq7-w8r7-pmvh/GHSA-3wq7-w8r7-pmvh.json b/advisories/unreviewed/2024/07/GHSA-3wq7-w8r7-pmvh/GHSA-3wq7-w8r7-pmvh.json new file mode 100644 index 00000000000..83ca9e65280 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-3wq7-w8r7-pmvh/GHSA-3wq7-w8r7-pmvh.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3wq7-w8r7-pmvh", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6606" + ], + "details": "Clipboard code failed to check the index on an array access. This could have lead to an out-of-bounds read. This vulnerability affects Firefox < 128.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6606" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1902305" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-29" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-54qp-7v9c-7xqf/GHSA-54qp-7v9c-7xqf.json b/advisories/unreviewed/2024/07/GHSA-54qp-7v9c-7xqf/GHSA-54qp-7v9c-7xqf.json new file mode 100644 index 00000000000..aecdc600e27 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-54qp-7v9c-7xqf/GHSA-54qp-7v9c-7xqf.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-54qp-7v9c-7xqf", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6527" + ], + "details": "SQL Injection vulnerability in parameter \"w\" in file \"druk.php\" in MegaBIP software allows unauthorized attacker to disclose the contents of the database and obtain administrator's token to modify the content of pages.  This issue affects MegaBIP software versions through 5.13.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:I/V:D/RE:M/U:Amber" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6527" + }, + { + "type": "WEB", + "url": "https://cert.pl/en/posts/2024/07/CVE-2024-6527" + }, + { + "type": "WEB", + "url": "https://cert.pl/posts/2024/07/CVE-2024-6527" + }, + { + "type": "WEB", + "url": "https://megabip.pl" + }, + { + "type": "WEB", + "url": "https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T14:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-6qqq-c4rv-g79r/GHSA-6qqq-c4rv-g79r.json b/advisories/unreviewed/2024/07/GHSA-6qqq-c4rv-g79r/GHSA-6qqq-c4rv-g79r.json new file mode 100644 index 00000000000..9969ee70f7f --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-6qqq-c4rv-g79r/GHSA-6qqq-c4rv-g79r.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6qqq-c4rv-g79r", + "modified": "2024-07-09T15:30:53Z", + "published": "2024-07-09T15:30:53Z", + "aliases": [ + "CVE-2024-37934" + ], + "details": "Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: from n/a through 3.8.4.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37934" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-plugin-3-8-4-subscriber-arbitrary-shortcode-execution-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T13:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-8c8x-848r-wqq7/GHSA-8c8x-848r-wqq7.json b/advisories/unreviewed/2024/07/GHSA-8c8x-848r-wqq7/GHSA-8c8x-848r-wqq7.json new file mode 100644 index 00000000000..b5d0a7c2425 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-8c8x-848r-wqq7/GHSA-8c8x-848r-wqq7.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8c8x-848r-wqq7", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6600" + ], + "details": "Due to large allocation checks in Angle for GLSL shaders being too lenient an out-of-bounds access could occur when allocating more than 8192 ints in private shader memory on mac OS. This vulnerability affects Firefox < 128 and Firefox ESR < 115.13.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6600" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1888340" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-29" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-30" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-8m6g-73m4-9jxj/GHSA-8m6g-73m4-9jxj.json b/advisories/unreviewed/2024/07/GHSA-8m6g-73m4-9jxj/GHSA-8m6g-73m4-9jxj.json index b0904bd91f2..3b4609d4530 100644 --- a/advisories/unreviewed/2024/07/GHSA-8m6g-73m4-9jxj/GHSA-8m6g-73m4-9jxj.json +++ b/advisories/unreviewed/2024/07/GHSA-8m6g-73m4-9jxj/GHSA-8m6g-73m4-9jxj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-8m6g-73m4-9jxj", - "modified": "2024-07-08T18:31:18Z", + "modified": "2024-07-09T15:30:53Z", "published": "2024-07-08T18:31:18Z", "aliases": [ "CVE-2024-39203" ], "details": "A cross-site scripting (XSS) vulnerability in the Backend Theme Management module of Z-BlogPHP v1.7.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-08T16:15:08Z" diff --git a/advisories/unreviewed/2024/07/GHSA-9vqr-5j64-p9wr/GHSA-9vqr-5j64-p9wr.json b/advisories/unreviewed/2024/07/GHSA-9vqr-5j64-p9wr/GHSA-9vqr-5j64-p9wr.json new file mode 100644 index 00000000000..e4da9de6d0e --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-9vqr-5j64-p9wr/GHSA-9vqr-5j64-p9wr.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9vqr-5j64-p9wr", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6604" + ], + "details": "Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 128 and Firefox ESR < 115.13.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6604" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1748105%2C1837550%2C1884266" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-29" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-30" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-cpfv-mr66-74v6/GHSA-cpfv-mr66-74v6.json b/advisories/unreviewed/2024/07/GHSA-cpfv-mr66-74v6/GHSA-cpfv-mr66-74v6.json new file mode 100644 index 00000000000..5142bb310bd --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-cpfv-mr66-74v6/GHSA-cpfv-mr66-74v6.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cpfv-mr66-74v6", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6605" + ], + "details": "Firefox Android allowed immediate interaction with permission prompts. This could be used for tapjacking. This vulnerability affects Firefox < 128.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6605" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1836786" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-29" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-cpm6-fp82-cq6m/GHSA-cpm6-fp82-cq6m.json b/advisories/unreviewed/2024/07/GHSA-cpm6-fp82-cq6m/GHSA-cpm6-fp82-cq6m.json new file mode 100644 index 00000000000..6770d79d440 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-cpm6-fp82-cq6m/GHSA-cpm6-fp82-cq6m.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cpm6-fp82-cq6m", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6612" + ], + "details": "CSP violations generated links in the console tab of the developer tools, pointing to the violating resource. This caused a DNS prefetch which leaked that a CSP violation happened. This vulnerability affects Firefox < 128.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6612" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1880374" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-29" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-fj5c-r5jw-5wp8/GHSA-fj5c-r5jw-5wp8.json b/advisories/unreviewed/2024/07/GHSA-fj5c-r5jw-5wp8/GHSA-fj5c-r5jw-5wp8.json new file mode 100644 index 00000000000..c285b9b7600 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-fj5c-r5jw-5wp8/GHSA-fj5c-r5jw-5wp8.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fj5c-r5jw-5wp8", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6613" + ], + "details": "The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6613" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1900523" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-29" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-gq55-cjrv-p49j/GHSA-gq55-cjrv-p49j.json b/advisories/unreviewed/2024/07/GHSA-gq55-cjrv-p49j/GHSA-gq55-cjrv-p49j.json new file mode 100644 index 00000000000..fa04041cae2 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-gq55-cjrv-p49j/GHSA-gq55-cjrv-p49j.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gq55-cjrv-p49j", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6607" + ], + "details": "It was possible to prevent a user from exiting pointerlock when pressing escape and to overlay customValidity notifications from a `<select>` element over certain permission prompts. This could be used to confuse a user into giving a site unintended permissions. This vulnerability affects Firefox < 128.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6607" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1694513" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-29" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-gr8h-x6ch-p7gj/GHSA-gr8h-x6ch-p7gj.json b/advisories/unreviewed/2024/07/GHSA-gr8h-x6ch-p7gj/GHSA-gr8h-x6ch-p7gj.json new file mode 100644 index 00000000000..ce0d3ffa87d --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-gr8h-x6ch-p7gj/GHSA-gr8h-x6ch-p7gj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gr8h-x6ch-p7gj", + "modified": "2024-07-09T15:30:53Z", + "published": "2024-07-09T15:30:53Z", + "aliases": [ + "CVE-2024-37520" + ], + "details": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons allows Path Traversal.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 2.1.12.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37520" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/shopbuilder/wordpress-shopbuilder-elementor-woocommerce-builder-addons-plugin-2-1-12-local-file-inclusion-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T13:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-h7q8-vff8-p3j8/GHSA-h7q8-vff8-p3j8.json b/advisories/unreviewed/2024/07/GHSA-h7q8-vff8-p3j8/GHSA-h7q8-vff8-p3j8.json new file mode 100644 index 00000000000..6abee88cdd7 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-h7q8-vff8-p3j8/GHSA-h7q8-vff8-p3j8.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h7q8-vff8-p3j8", + "modified": "2024-07-09T15:30:55Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6614" + ], + "details": "The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox < 128.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6614" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1902983" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-29" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-hc4f-jc7g-w997/GHSA-hc4f-jc7g-w997.json b/advisories/unreviewed/2024/07/GHSA-hc4f-jc7g-w997/GHSA-hc4f-jc7g-w997.json new file mode 100644 index 00000000000..ff4f796379d --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-hc4f-jc7g-w997/GHSA-hc4f-jc7g-w997.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hc4f-jc7g-w997", + "modified": "2024-07-09T15:30:53Z", + "published": "2024-07-09T15:30:53Z", + "aliases": [ + "CVE-2023-39328" + ], + "details": "A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an application crash through a maliciously crafted file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39328" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2023-39328" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219236" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T14:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-hr59-q2gm-7hrj/GHSA-hr59-q2gm-7hrj.json b/advisories/unreviewed/2024/07/GHSA-hr59-q2gm-7hrj/GHSA-hr59-q2gm-7hrj.json new file mode 100644 index 00000000000..bd9a845c669 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-hr59-q2gm-7hrj/GHSA-hr59-q2gm-7hrj.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hr59-q2gm-7hrj", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6611" + ], + "details": "A nested iframe, triggering a cross-site navigation, could send SameSite=Strict or Lax cookies. This vulnerability affects Firefox < 128.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6611" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1844827" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-29" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-j476-hf2q-984g/GHSA-j476-hf2q-984g.json b/advisories/unreviewed/2024/07/GHSA-j476-hf2q-984g/GHSA-j476-hf2q-984g.json new file mode 100644 index 00000000000..1f5bb635441 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-j476-hf2q-984g/GHSA-j476-hf2q-984g.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j476-hf2q-984g", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6603" + ], + "details": "In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerability affects Firefox < 128 and Firefox ESR < 115.13.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6603" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1895081" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-29" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-30" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-j4r7-p9fp-w3f3/GHSA-j4r7-p9fp-w3f3.json b/advisories/unreviewed/2024/07/GHSA-j4r7-p9fp-w3f3/GHSA-j4r7-p9fp-w3f3.json new file mode 100644 index 00000000000..c8909cc6c22 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-j4r7-p9fp-w3f3/GHSA-j4r7-p9fp-w3f3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j4r7-p9fp-w3f3", + "modified": "2024-07-09T15:30:53Z", + "published": "2024-07-09T15:30:53Z", + "aliases": [ + "CVE-2024-22271" + ], + "details": "In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions.\n\nSpecifically, an application is vulnerable when all of the following are true:\n\nUser is using Spring Cloud Function Web module\n\nAffected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8\n\nReferences https://spring.io/security/cve-2022-22979   https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/  History 2020-01-16: Initial vulnerability report published.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22271" + }, + { + "type": "WEB", + "url": "https://spring.io/security/cve-2024-22271" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T13:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-mrph-x5vw-m2pr/GHSA-mrph-x5vw-m2pr.json b/advisories/unreviewed/2024/07/GHSA-mrph-x5vw-m2pr/GHSA-mrph-x5vw-m2pr.json new file mode 100644 index 00000000000..622623a51ff --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-mrph-x5vw-m2pr/GHSA-mrph-x5vw-m2pr.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mrph-x5vw-m2pr", + "modified": "2024-07-09T15:30:53Z", + "published": "2024-07-09T15:30:53Z", + "aliases": [ + "CVE-2024-37952" + ], + "details": "Improper Privilege Management vulnerability in themeenergy BookYourTravel allows Privilege Escalation.This issue affects BookYourTravel: from n/a through 8.18.17.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37952" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/bookyourtravel/wordpress-bookyourtravel-theme-8-18-17-subscriber-privilege-escalation-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T13:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-p36m-8r3w-rq6p/GHSA-p36m-8r3w-rq6p.json b/advisories/unreviewed/2024/07/GHSA-p36m-8r3w-rq6p/GHSA-p36m-8r3w-rq6p.json new file mode 100644 index 00000000000..324376fe841 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-p36m-8r3w-rq6p/GHSA-p36m-8r3w-rq6p.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p36m-8r3w-rq6p", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6598" + ], + "details": "A denial-of-service attack is possible through the execution functionality of KNIME Business Hub 1.10.0 and 1.10.1. It allows an authenticated attacker with job execution privileges to execute a job that causes internal messages to pile up until there are no more resources available for processing new messages. This leads to an outage of most functionality of KNIME Business Hub. Recovery from the situation is only possible by manual administrator interaction. Please contact our support for instructions in case you have run into this situation.\n\n\nUpdating to KNIME Business Hub 1.10.2 or later solves the problem.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6598" + }, + { + "type": "WEB", + "url": "https://www.knime.com/security/advisories#CVE-2024-6598" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-770" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T14:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-r595-x79c-68p4/GHSA-r595-x79c-68p4.json b/advisories/unreviewed/2024/07/GHSA-r595-x79c-68p4/GHSA-r595-x79c-68p4.json new file mode 100644 index 00000000000..8ce7ca232d5 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-r595-x79c-68p4/GHSA-r595-x79c-68p4.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r595-x79c-68p4", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6610" + ], + "details": "Form validation popups could capture escape key presses. Therefore, spamming form validation messages could be used to prevent users from exiting full-screen mode. This vulnerability affects Firefox < 128.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6610" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1883396" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-29" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-rgx6-gx96-7frc/GHSA-rgx6-gx96-7frc.json b/advisories/unreviewed/2024/07/GHSA-rgx6-gx96-7frc/GHSA-rgx6-gx96-7frc.json new file mode 100644 index 00000000000..2931854a10f --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-rgx6-gx96-7frc/GHSA-rgx6-gx96-7frc.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rgx6-gx96-7frc", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-2177" + ], + "details": "A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2177" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/2383443" + }, + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/444467" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1021" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T14:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-rjwc-235r-8986/GHSA-rjwc-235r-8986.json b/advisories/unreviewed/2024/07/GHSA-rjwc-235r-8986/GHSA-rjwc-235r-8986.json new file mode 100644 index 00000000000..dfc35afb83f --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-rjwc-235r-8986/GHSA-rjwc-235r-8986.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rjwc-235r-8986", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6601" + ], + "details": "A race condition could lead to a cross-origin container obtaining permissions of the top-level origin. This vulnerability affects Firefox < 128 and Firefox ESR < 115.13.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6601" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1890748" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-29" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-30" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-v6r5-wp7h-cj77/GHSA-v6r5-wp7h-cj77.json b/advisories/unreviewed/2024/07/GHSA-v6r5-wp7h-cj77/GHSA-v6r5-wp7h-cj77.json new file mode 100644 index 00000000000..f8fa5e4721f --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-v6r5-wp7h-cj77/GHSA-v6r5-wp7h-cj77.json @@ -0,0 +1,43 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v6r5-wp7h-cj77", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6602" + ], + "details": "A mismatch between allocator and deallocator could have lead to memory corruption. This vulnerability affects Firefox < 128 and Firefox ESR < 115.13.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6602" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1895032" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-29" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-30" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-vr96-9xq4-q4jp/GHSA-vr96-9xq4-q4jp.json b/advisories/unreviewed/2024/07/GHSA-vr96-9xq4-q4jp/GHSA-vr96-9xq4-q4jp.json new file mode 100644 index 00000000000..0ff84762c8c --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-vr96-9xq4-q4jp/GHSA-vr96-9xq4-q4jp.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vr96-9xq4-q4jp", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6608" + ], + "details": "It was possible to move the cursor using pointerlock from an iframe. This allowed moving the cursor outside of the viewport and the Firefox window. This vulnerability affects Firefox < 128.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6608" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1743329" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-29" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T15:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-vx4h-hw7f-47c3/GHSA-vx4h-hw7f-47c3.json b/advisories/unreviewed/2024/07/GHSA-vx4h-hw7f-47c3/GHSA-vx4h-hw7f-47c3.json new file mode 100644 index 00000000000..5cff15d1eb8 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-vx4h-hw7f-47c3/GHSA-vx4h-hw7f-47c3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vx4h-hw7f-47c3", + "modified": "2024-07-09T15:30:53Z", + "published": "2024-07-09T15:30:53Z", + "aliases": [ + "CVE-2024-37513" + ], + "details": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themewinter WPCafe allows Path Traversal.This issue affects WPCafe: from n/a through 2.2.27.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37513" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/wp-cafe/wordpress-wpcafe-plugin-2-2-27-local-file-inclusion-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T13:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-x2q3-f99c-25ff/GHSA-x2q3-f99c-25ff.json b/advisories/unreviewed/2024/07/GHSA-x2q3-f99c-25ff/GHSA-x2q3-f99c-25ff.json new file mode 100644 index 00000000000..cb62ba55f64 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-x2q3-f99c-25ff/GHSA-x2q3-f99c-25ff.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x2q3-f99c-25ff", + "modified": "2024-07-09T15:30:55Z", + "published": "2024-07-09T15:30:55Z", + "aliases": [ + "CVE-2024-6615" + ], + "details": "Memory safety bugs present in Firefox 127. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 128.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6615" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1892875%2C1894428%2C1898364" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-29" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T15:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-xcm3-jhmr-9fhh/GHSA-xcm3-jhmr-9fhh.json b/advisories/unreviewed/2024/07/GHSA-xcm3-jhmr-9fhh/GHSA-xcm3-jhmr-9fhh.json new file mode 100644 index 00000000000..fd413623fbc --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-xcm3-jhmr-9fhh/GHSA-xcm3-jhmr-9fhh.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xcm3-jhmr-9fhh", + "modified": "2024-07-09T15:30:54Z", + "published": "2024-07-09T15:30:54Z", + "aliases": [ + "CVE-2024-6609" + ], + "details": "When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. This vulnerability affects Firefox < 128.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6609" + }, + { + "type": "WEB", + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1839258" + }, + { + "type": "WEB", + "url": "https://www.mozilla.org/security/advisories/mfsa2024-29" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-09T15:15:12Z" + } +} \ No newline at end of file