netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-09-23 18:31:43 +00:00
parent 9ed10b7342
commit ebf48a24bb
58 changed files with 770 additions and 131 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/10/GHSA-g5jq-hrmx-g9ph/GHSA-g5jq-hrmx-g9ph.json
+1 -1
View File
@@ -32,7 +32,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2023/09/GHSA-97pf-794f-gmgm/GHSA-97pf-794f-gmgm.json
+1 -1
View File
@@ -32,7 +32,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2023/10/GHSA-qf5j-mx4g-56pf/GHSA-qf5j-mx4g-56pf.json
+1 -1
View File
@@ -28,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "CRITICAL",
"github_reviewed": false,
advisories/unreviewed/2023/10/GHSA-x676-9gf4-jg53/GHSA-x676-9gf4-jg53.json
+1
View File
@@ -28,6 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-617"
],
"severity": "HIGH",
advisories/unreviewed/2023/10/GHSA-xwf2-9m25-2hpf/GHSA-xwf2-9m25-2hpf.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xwf2-9m25-2hpf",
"modified": "2023-11-14T03:30:53Z",
"modified": "2024-09-23T18:30:32Z",
"published": "2023-10-01T03:30:18Z",
"aliases": [
"CVE-2023-43907"
advisories/unreviewed/2024/06/GHSA-7w82-8h79-m4wp/GHSA-7w82-8h79-m4wp.json
+6 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7w82-8h79-m4wp",
"modified": "2024-06-17T18:31:35Z",
"modified": "2024-09-23T18:30:33Z",
"published": "2024-06-17T18:31:35Z",
"aliases": [
"CVE-2024-6056"
@@ -11,6 +11,10 @@
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
@@ -40,6 +44,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-204"
],
"severity": "LOW",
advisories/unreviewed/2024/07/GHSA-gv63-8gqg-3525/GHSA-gv63-8gqg-3525.json
+7 -2
View File
@@ -1,13 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gv63-8gqg-3525",
"modified": "2024-07-16T18:31:42Z",
"modified": "2024-09-23T18:30:33Z",
"published": "2024-07-16T18:31:42Z",
"aliases": [
"CVE-2024-6326"
],
"details": "An exposure of sensitive information vulnerability exists in the Rockwell Automation FactoryTalk® System Service. A malicious user could exploit this vulnerability by starting a back-up or restore process, which temporarily exposes private keys, passwords, pre-shared keys, and database folders when they are temporarily copied to an interim folder. This vulnerability is due to the lack of explicit permissions set on the backup folder. If private keys are obtained by a malicious user, they could impersonate resources on the secured network.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
@@ -28,7 +32,8 @@
],
"database_specific": {
"cwe_ids": [
"CWE-269"
"CWE-269",
"CWE-276"
],
"severity": "LOW",
"github_reviewed": false,
advisories/unreviewed/2024/09/GHSA-23qc-7hjx-vwmv/GHSA-23qc-7hjx-vwmv.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-23qc-7hjx-vwmv",
"modified": "2024-09-23T18:30:34Z",
"published": "2024-09-23T18:30:34Z",
"aliases": [
"CVE-2024-34331"
],
"details": "A lack of code signature verification in Parallels Desktop for Mac v19.3.0 and below allows attackers to escalate privileges via a crafted macOS installer, because Parallels Service is setuid root.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34331"
},
{
"type": "WEB",
"url": "https://kb.parallels.com/129860"
},
{
"type": "WEB",
"url": "https://khronokernel.com/macos/2024/05/30/CVE-2024-34331.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-23T16:15:05Z"
}
}
advisories/unreviewed/2024/09/GHSA-2gm9-phpp-rvm3/GHSA-2gm9-phpp-rvm3.json
+1 -1
View File
@@ -29,7 +29,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"github_reviewed": false,
advisories/unreviewed/2024/09/GHSA-2h8m-mjqv-x98p/GHSA-2h8m-mjqv-x98p.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2h8m-mjqv-x98p",
"modified": "2024-09-18T09:30:37Z",
"modified": "2024-09-23T18:30:34Z",
"published": "2024-09-18T09:30:37Z",
"aliases": [
"CVE-2024-46773"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Check denominator pbn_div before used\n\n[WHAT & HOW]\nA denominator cannot be 0, and is checked before used.\n\nThis fixes 1 DIVIDE_BY_ZERO issue reported by Coverity.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-369"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-18T08:15:05Z"
advisories/unreviewed/2024/09/GHSA-2hj6-cwhm-rfg9/GHSA-2hj6-cwhm-rfg9.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2hj6-cwhm-rfg9",
"modified": "2024-09-20T21:31:39Z",
"modified": "2024-09-23T18:30:34Z",
"published": "2024-09-20T21:31:39Z",
"aliases": [
"CVE-2024-46103"
],
"details": "SEMCMS 4.8 is vulnerable to SQL Injection via SEMCMS_Main.php.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-20T21:15:12Z"
advisories/unreviewed/2024/09/GHSA-39rx-hmmc-q5pv/GHSA-39rx-hmmc-q5pv.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-39rx-hmmc-q5pv",
"modified": "2024-09-23T18:30:34Z",
"published": "2024-09-23T18:30:34Z",
"aliases": [
"CVE-2024-41228"
],
"details": "A symlink following vulnerability in the pouch cp function of AliyunContainerService pouch v1.3.1 allows attackers to escalate privileges and write arbitrary files.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41228"
},
{
"type": "WEB",
"url": "https://gist.github.com/cafan/68ed2d065a4b9c1c37c70a18077ad27b"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-23T16:15:05Z"
}
}
advisories/unreviewed/2024/09/GHSA-4366-c9hw-r9qg/GHSA-4366-c9hw-r9qg.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4366-c9hw-r9qg",
"modified": "2024-09-18T09:30:37Z",
"modified": "2024-09-23T18:30:34Z",
"published": "2024-09-18T09:30:37Z",
"aliases": [
"CVE-2024-46762"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen: privcmd: Fix possible access to a freed kirqfd instance\n\nNothing prevents simultaneous ioctl calls to privcmd_irqfd_assign() and\nprivcmd_irqfd_deassign(). If that happens, it is possible that a kirqfd\ncreated and added to the irqfds_list by privcmd_irqfd_assign() may get\nremoved by another thread executing privcmd_irqfd_deassign(), while the\nformer is still using it after dropping the locks.\n\nThis can lead to a situation where an already freed kirqfd instance may\nbe accessed and cause kernel oops.\n\nUse SRCU locking to prevent the same, as is done for the KVM\nimplementation for irqfds.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-18T08:15:04Z"
advisories/unreviewed/2024/09/GHSA-473p-xqgv-xxw3/GHSA-473p-xqgv-xxw3.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-473p-xqgv-xxw3",
"modified": "2024-09-17T21:30:33Z",
"modified": "2024-09-23T18:30:33Z",
"published": "2024-09-17T21:30:33Z",
"aliases": [
"CVE-2024-8909"
],
"details": "Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [
@@ -31,7 +34,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T21:15:13Z"
advisories/unreviewed/2024/09/GHSA-58mw-2g79-hjm6/GHSA-58mw-2g79-hjm6.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-58mw-2g79-hjm6",
"modified": "2024-09-18T09:30:37Z",
"modified": "2024-09-23T18:30:34Z",
"published": "2024-09-18T09:30:37Z",
"aliases": [
"CVE-2024-46759"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (adc128d818) Fix underflows seen when writing limit attributes\n\nDIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large\nnegative number such as -9223372036854775808 is provided by the user.\nFix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -53,9 +56,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-191"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-18T08:15:04Z"
advisories/unreviewed/2024/09/GHSA-632r-423p-9jx4/GHSA-632r-423p-9jx4.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-632r-423p-9jx4",
"modified": "2024-09-18T09:30:37Z",
"modified": "2024-09-23T18:30:34Z",
"published": "2024-09-18T09:30:37Z",
"aliases": [
"CVE-2024-46779"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/imagination: Free pvr_vm_gpuva after unlink\n\nThis caused a measurable memory leak. Although the individual\nallocations are small, the leaks occurs in a high-usage codepath\n(remapping or unmapping device memory) so they add up quickly.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-401"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-18T08:15:05Z"
advisories/unreviewed/2024/09/GHSA-6cx3-28wh-wjwv/GHSA-6cx3-28wh-wjwv.json
+1
View File
@@ -32,6 +32,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-120",
"CWE-121"
],
"severity": "MODERATE",
advisories/unreviewed/2024/09/GHSA-6f62-3596-g6w7/GHSA-6f62-3596-g6w7.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6f62-3596-g6w7",
"modified": "2024-09-22T03:30:30Z",
"modified": "2024-09-23T18:30:34Z",
"published": "2024-09-22T03:30:30Z",
"aliases": [
"CVE-2024-47220"
],
"details": "An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., \"GET /admin HTTP/1.1\\r\\n\" inside of a \"POST /user HTTP/1.1\\r\\n\" request. NOTE: the supplier's position is \"Webrick should not be used in production.\"",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-22T01:15:11Z"
advisories/unreviewed/2024/09/GHSA-6gcw-xcpf-vr88/GHSA-6gcw-xcpf-vr88.json
+6 -1
View File
@@ -1,13 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6gcw-xcpf-vr88",
"modified": "2024-09-19T18:30:52Z",
"modified": "2024-09-23T18:30:34Z",
"published": "2024-09-19T18:30:52Z",
"aliases": [
"CVE-2024-8651"
],
"details": "A vulnerability in NetCat CMS allows an attacker to send a specially crafted http request that can be used to check whether a user exists in the system, which could be a basis for further attacks.\nThis issue affects NetCat CMS v. 6.4.0.24126.2 and possibly others.\n\nApply patch from vendor https://netcat.ru/ https://netcat.ru/] . Versions 6.4.0.24248 and on have the patch.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
@@ -28,6 +32,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-203",
"CWE-204"
],
"severity": "MODERATE",
advisories/unreviewed/2024/09/GHSA-6vq9-c7rm-r447/GHSA-6vq9-c7rm-r447.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6vq9-c7rm-r447",
"modified": "2024-09-18T09:30:37Z",
"modified": "2024-09-23T18:30:33Z",
"published": "2024-09-18T09:30:37Z",
"aliases": [
"CVE-2024-46760"
],
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: usb: schedule rx work after everything is set up\n\nRight now it's possible to hit NULL pointer dereference in\nrtw_rx_fill_rx_status on hw object and/or its fields because\ninitialization routine can start getting USB replies before\nrtw_dev is fully setup.\n\nThe stack trace looks like this:\n\nrtw_rx_fill_rx_status\nrtw8821c_query_rx_desc\nrtw_usb_rx_handler\n...\nqueue_work\nrtw_usb_read_port_complete\n...\nusb_submit_urb\nrtw_usb_rx_resubmit\nrtw_usb_init_rx\nrtw_usb_probe\n\nSo while we do the async stuff rtw_usb_probe continues and calls\nrtw_register_hw, which does all kinds of initialization (e.g.\nvia ieee80211_register_hw) that rtw_rx_fill_rx_status relies on.\n\nFix this by moving the first usb_submit_urb after everything\nis set up.\n\nFor me, this bug manifested as:\n[ 8.893177] rtw_8821cu 1-1:1.2: band wrong, packet dropped\n[ 8.910904] rtw_8821cu 1-1:1.2: hw->conf.chandef.chan NULL in rtw_rx_fill_rx_status\nbecause I'm using Larry's backport of rtw88 driver with the NULL\nchecks in rtw_rx_fill_rx_status.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-18T08:15:04Z"

Some files were not shown because too many files have changed in this diff Show More