diff --git a/advisories/unreviewed/2024/02/GHSA-48f4-cx87-w7mh/GHSA-48f4-cx87-w7mh.json b/advisories/unreviewed/2024/02/GHSA-48f4-cx87-w7mh/GHSA-48f4-cx87-w7mh.json index 099073947d1..c4cbd9dd480 100644 --- a/advisories/unreviewed/2024/02/GHSA-48f4-cx87-w7mh/GHSA-48f4-cx87-w7mh.json +++ b/advisories/unreviewed/2024/02/GHSA-48f4-cx87-w7mh/GHSA-48f4-cx87-w7mh.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-48f4-cx87-w7mh", - "modified": "2024-02-21T00:31:31Z", + "modified": "2024-12-04T21:30:50Z", "published": "2024-02-21T00:31:31Z", "aliases": [ "CVE-2023-50923" ], "details": "In QUIC in RFC 9000, the Latency Spin Bit specification (section 17.4) does not strictly constrain the bit value when the feature is disabled, which might allow remote attackers to construct a covert channel with data represented as changes to the bit value. NOTE: The \"Sheridan, S., Keane, A. (2015). In Proceedings of the 14th European Conference on Cyber Warfare and Security (ECCWS), University of Hertfordshire, Hatfield, UK.\" paper says \"Modern Internet communication protocols provide an almost infinite number of ways in which data can be hidden or embed whithin seemingly normal network traffic.\"", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -33,9 +34,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-21T00:15:07Z" diff --git a/advisories/unreviewed/2024/02/GHSA-wqm3-jgh5-wqrh/GHSA-wqm3-jgh5-wqrh.json b/advisories/unreviewed/2024/02/GHSA-wqm3-jgh5-wqrh/GHSA-wqm3-jgh5-wqrh.json index b41247276d3..ee4c96fbd9c 100644 --- a/advisories/unreviewed/2024/02/GHSA-wqm3-jgh5-wqrh/GHSA-wqm3-jgh5-wqrh.json +++ b/advisories/unreviewed/2024/02/GHSA-wqm3-jgh5-wqrh/GHSA-wqm3-jgh5-wqrh.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-wqm3-jgh5-wqrh", - "modified": "2024-02-29T00:30:23Z", + "modified": "2024-12-04T21:30:50Z", "published": "2024-02-29T00:30:23Z", "aliases": [ "CVE-2024-26450" ], "details": "Cross Site Scripting vulnerability in Piwigo before v.14.2.0 allows a remote attacker to escalate privileges via the batch function on the admin page.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" + } ], + "affected": [], "references": [ { "type": "WEB", @@ -25,9 +26,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-28T22:15:26Z" diff --git a/advisories/unreviewed/2024/03/GHSA-469c-p6p8-wh33/GHSA-469c-p6p8-wh33.json b/advisories/unreviewed/2024/03/GHSA-469c-p6p8-wh33/GHSA-469c-p6p8-wh33.json index 0d1511cd6f2..3043a257c85 100644 --- a/advisories/unreviewed/2024/03/GHSA-469c-p6p8-wh33/GHSA-469c-p6p8-wh33.json +++ b/advisories/unreviewed/2024/03/GHSA-469c-p6p8-wh33/GHSA-469c-p6p8-wh33.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-469c-p6p8-wh33", - "modified": "2024-03-03T12:30:31Z", + "modified": "2024-12-04T21:30:50Z", "published": "2024-03-03T12:30:31Z", "aliases": [ "CVE-2024-26469" ], "details": "Server-Side Request Forgery (SSRF) vulnerability in Tunis Soft \"Product Designer\" (productdesigner) module for PrestaShop before version 1.178.36, allows remote attackers to cause a denial of service (DoS) and escalate privileges via the url parameter in the postProcess() method.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-03T10:15:06Z" diff --git a/advisories/unreviewed/2024/03/GHSA-j2cw-j27w-3f6m/GHSA-j2cw-j27w-3f6m.json b/advisories/unreviewed/2024/03/GHSA-j2cw-j27w-3f6m/GHSA-j2cw-j27w-3f6m.json index 1035a23a06b..ccc39d04a88 100644 --- a/advisories/unreviewed/2024/03/GHSA-j2cw-j27w-3f6m/GHSA-j2cw-j27w-3f6m.json +++ b/advisories/unreviewed/2024/03/GHSA-j2cw-j27w-3f6m/GHSA-j2cw-j27w-3f6m.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-j2cw-j27w-3f6m", - "modified": "2024-03-13T21:31:02Z", + "modified": "2024-12-04T21:30:50Z", "published": "2024-03-08T03:31:24Z", "aliases": [ "CVE-2024-23249" ], "details": "The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.4. Processing a file may lead to a denial-of-service or potentially disclose memory contents.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-404" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-08T02:15:48Z" diff --git a/advisories/unreviewed/2024/03/GHSA-wwvg-qmhg-chgp/GHSA-wwvg-qmhg-chgp.json b/advisories/unreviewed/2024/03/GHSA-wwvg-qmhg-chgp/GHSA-wwvg-qmhg-chgp.json index 21455cb2e87..f61fea2b19e 100644 --- a/advisories/unreviewed/2024/03/GHSA-wwvg-qmhg-chgp/GHSA-wwvg-qmhg-chgp.json +++ b/advisories/unreviewed/2024/03/GHSA-wwvg-qmhg-chgp/GHSA-wwvg-qmhg-chgp.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-wwvg-qmhg-chgp", - "modified": "2024-05-01T18:30:36Z", + "modified": "2024-12-04T21:30:50Z", "published": "2024-03-20T15:32:39Z", "aliases": [ "CVE-2024-28565" ], "details": "Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the psdParser::ReadImageData() function when reading images in PSD format.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -32,8 +37,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-120" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-20T06:15:09Z" diff --git a/advisories/unreviewed/2024/04/GHSA-23r4-x5xc-qw4f/GHSA-23r4-x5xc-qw4f.json b/advisories/unreviewed/2024/04/GHSA-23r4-x5xc-qw4f/GHSA-23r4-x5xc-qw4f.json index 50ce3609872..cbf6dd39bea 100644 --- a/advisories/unreviewed/2024/04/GHSA-23r4-x5xc-qw4f/GHSA-23r4-x5xc-qw4f.json +++ b/advisories/unreviewed/2024/04/GHSA-23r4-x5xc-qw4f/GHSA-23r4-x5xc-qw4f.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-23r4-x5xc-qw4f", - "modified": "2024-04-10T18:30:47Z", + "modified": "2024-12-04T21:30:51Z", "published": "2024-04-10T18:30:47Z", "aliases": [ "CVE-2024-23735" ], "details": "Cross Site Scripting (XSS) vulnerability in in the S/MIME certificate upload functionality of the User Profile pages in savignano S/Notify before 4.0.0 for Confluence allows attackers to manipulate user data via specially crafted certificate.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -24,8 +29,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-10T16:15:09Z" diff --git a/advisories/unreviewed/2024/04/GHSA-5473-w6gq-5r5g/GHSA-5473-w6gq-5r5g.json b/advisories/unreviewed/2024/04/GHSA-5473-w6gq-5r5g/GHSA-5473-w6gq-5r5g.json index 1ac67432442..605ec9a136b 100644 --- a/advisories/unreviewed/2024/04/GHSA-5473-w6gq-5r5g/GHSA-5473-w6gq-5r5g.json +++ b/advisories/unreviewed/2024/04/GHSA-5473-w6gq-5r5g/GHSA-5473-w6gq-5r5g.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-5473-w6gq-5r5g", - "modified": "2024-07-03T21:39:42Z", + "modified": "2024-12-04T21:30:51Z", "published": "2024-04-28T00:30:23Z", "aliases": [ "CVE-2023-52722" ], "details": "An issue was discovered in Artifex Ghostscript through 10.01.0. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Type 1 standard.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" + } + ], "affected": [], "references": [ { @@ -25,7 +30,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-28T00:15:07Z" diff --git a/advisories/unreviewed/2024/04/GHSA-95fq-qfw9-w29v/GHSA-95fq-qfw9-w29v.json b/advisories/unreviewed/2024/04/GHSA-95fq-qfw9-w29v/GHSA-95fq-qfw9-w29v.json index 2a0b3d6ea82..83ac479522b 100644 --- a/advisories/unreviewed/2024/04/GHSA-95fq-qfw9-w29v/GHSA-95fq-qfw9-w29v.json +++ b/advisories/unreviewed/2024/04/GHSA-95fq-qfw9-w29v/GHSA-95fq-qfw9-w29v.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-95fq-qfw9-w29v", - "modified": "2024-04-01T15:30:29Z", + "modified": "2024-12-04T21:30:50Z", "published": "2024-04-01T15:30:29Z", "aliases": [ "CVE-2024-30864" ], "details": "netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/config_ISCGroupTimePolicy.php.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-01T15:15:50Z" diff --git a/advisories/unreviewed/2024/04/GHSA-g9gh-7wv9-6wcr/GHSA-g9gh-7wv9-6wcr.json b/advisories/unreviewed/2024/04/GHSA-g9gh-7wv9-6wcr/GHSA-g9gh-7wv9-6wcr.json index 8829b2abc15..369eb16846b 100644 --- a/advisories/unreviewed/2024/04/GHSA-g9gh-7wv9-6wcr/GHSA-g9gh-7wv9-6wcr.json +++ b/advisories/unreviewed/2024/04/GHSA-g9gh-7wv9-6wcr/GHSA-g9gh-7wv9-6wcr.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-g9gh-7wv9-6wcr", - "modified": "2024-04-30T00:30:34Z", + "modified": "2024-12-04T21:30:51Z", "published": "2024-04-30T00:30:34Z", "aliases": [ "CVE-2023-52724" ], "details": "Open Networking Foundation SD-RAN onos-kpimon 0.4.7 allows out-of-bounds array access in the processIndicationFormat1 function.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-30T00:15:07Z" diff --git a/advisories/unreviewed/2024/04/GHSA-gj98-2c7c-vmc4/GHSA-gj98-2c7c-vmc4.json b/advisories/unreviewed/2024/04/GHSA-gj98-2c7c-vmc4/GHSA-gj98-2c7c-vmc4.json index e3bf18aa70f..963bd17bf36 100644 --- a/advisories/unreviewed/2024/04/GHSA-gj98-2c7c-vmc4/GHSA-gj98-2c7c-vmc4.json +++ b/advisories/unreviewed/2024/04/GHSA-gj98-2c7c-vmc4/GHSA-gj98-2c7c-vmc4.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-gj98-2c7c-vmc4", - "modified": "2024-04-05T15:30:31Z", + "modified": "2024-12-04T21:30:50Z", "published": "2024-04-05T15:30:31Z", "aliases": [ "CVE-2024-31852" ], "details": "LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is \"we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production.\"", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], "affected": [], "references": [ { @@ -33,7 +38,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-05T15:15:08Z" diff --git a/advisories/unreviewed/2024/04/GHSA-wxwf-hc4j-fc3q/GHSA-wxwf-hc4j-fc3q.json b/advisories/unreviewed/2024/04/GHSA-wxwf-hc4j-fc3q/GHSA-wxwf-hc4j-fc3q.json index 2dcf2c85d22..b4587986213 100644 --- a/advisories/unreviewed/2024/04/GHSA-wxwf-hc4j-fc3q/GHSA-wxwf-hc4j-fc3q.json +++ b/advisories/unreviewed/2024/04/GHSA-wxwf-hc4j-fc3q/GHSA-wxwf-hc4j-fc3q.json @@ -25,7 +25,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-190" + ], "severity": "LOW", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/05/GHSA-7296-qmw6-c5cw/GHSA-7296-qmw6-c5cw.json b/advisories/unreviewed/2024/05/GHSA-7296-qmw6-c5cw/GHSA-7296-qmw6-c5cw.json index a5b02511a1a..b1378854cfd 100644 --- a/advisories/unreviewed/2024/05/GHSA-7296-qmw6-c5cw/GHSA-7296-qmw6-c5cw.json +++ b/advisories/unreviewed/2024/05/GHSA-7296-qmw6-c5cw/GHSA-7296-qmw6-c5cw.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-7296-qmw6-c5cw", - "modified": "2024-05-21T18:31:22Z", + "modified": "2024-12-04T21:30:51Z", "published": "2024-05-21T18:31:22Z", "aliases": [ "CVE-2023-52829" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath12k: fix possible out-of-bound write in ath12k_wmi_ext_hal_reg_caps()\n\nreg_cap.phy_id is extracted from WMI event and could be an unexpected value\nin case some errors happen. As a result out-of-bound write may occur to\nsoc->hal_reg_cap. Fix it by validating reg_cap.phy_id before using it.\n\nThis is found during code review.\n\nCompile tested only.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -33,9 +34,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-05-21T16:15:20Z" diff --git a/advisories/unreviewed/2024/05/GHSA-8j9h-4rqp-j66g/GHSA-8j9h-4rqp-j66g.json b/advisories/unreviewed/2024/05/GHSA-8j9h-4rqp-j66g/GHSA-8j9h-4rqp-j66g.json index 753d837b138..f7d977157f5 100644 --- a/advisories/unreviewed/2024/05/GHSA-8j9h-4rqp-j66g/GHSA-8j9h-4rqp-j66g.json +++ b/advisories/unreviewed/2024/05/GHSA-8j9h-4rqp-j66g/GHSA-8j9h-4rqp-j66g.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-8j9h-4rqp-j66g", - "modified": "2024-05-04T21:30:33Z", + "modified": "2024-12-04T21:30:51Z", "published": "2024-05-04T21:30:33Z", "aliases": [ "CVE-2024-34468" ], "details": "Rukovoditel before 3.5.3 allows XSS via user_photo to My Page.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -20,8 +25,10 @@ } ], "database_specific": { - "cwe_ids": [], - "severity": null, + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-05-04T20:15:07Z" diff --git a/advisories/unreviewed/2024/05/GHSA-wcx3-63mm-h8x6/GHSA-wcx3-63mm-h8x6.json b/advisories/unreviewed/2024/05/GHSA-wcx3-63mm-h8x6/GHSA-wcx3-63mm-h8x6.json index cfa9c6c00c2..4086d710e8f 100644 --- a/advisories/unreviewed/2024/05/GHSA-wcx3-63mm-h8x6/GHSA-wcx3-63mm-h8x6.json +++ b/advisories/unreviewed/2024/05/GHSA-wcx3-63mm-h8x6/GHSA-wcx3-63mm-h8x6.json @@ -1,18 +1,19 @@ { "schema_version": "1.4.0", "id": "GHSA-wcx3-63mm-h8x6", - "modified": "2024-06-10T18:30:57Z", + "modified": "2024-12-04T21:30:51Z", "published": "2024-05-05T21:30:30Z", "aliases": [ "CVE-2024-34500" ], "details": "An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.", "severity": [ - - ], - "affected": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -33,9 +34,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-05-05T19:15:07Z" diff --git a/advisories/unreviewed/2024/06/GHSA-vjx7-hf5r-chv4/GHSA-vjx7-hf5r-chv4.json b/advisories/unreviewed/2024/06/GHSA-vjx7-hf5r-chv4/GHSA-vjx7-hf5r-chv4.json index 36601e97538..3c2826a85e5 100644 --- a/advisories/unreviewed/2024/06/GHSA-vjx7-hf5r-chv4/GHSA-vjx7-hf5r-chv4.json +++ b/advisories/unreviewed/2024/06/GHSA-vjx7-hf5r-chv4/GHSA-vjx7-hf5r-chv4.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-vjx7-hf5r-chv4", - "modified": "2024-06-24T06:30:55Z", + "modified": "2024-12-04T21:30:51Z", "published": "2024-06-24T06:30:55Z", "aliases": [ "CVE-2024-4900" ], "details": "The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above role to perform Open redirect attacks against any user viewing a malicious post", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], "affected": [], "references": [ { @@ -21,7 +26,7 @@ ], "database_specific": { "cwe_ids": [], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-06-24T06:15:11Z" diff --git a/advisories/unreviewed/2024/09/GHSA-rqj4-hg4x-qw45/GHSA-rqj4-hg4x-qw45.json b/advisories/unreviewed/2024/09/GHSA-rqj4-hg4x-qw45/GHSA-rqj4-hg4x-qw45.json index d31fe0aa86e..9ebbb4fb2f4 100644 --- a/advisories/unreviewed/2024/09/GHSA-rqj4-hg4x-qw45/GHSA-rqj4-hg4x-qw45.json +++ b/advisories/unreviewed/2024/09/GHSA-rqj4-hg4x-qw45/GHSA-rqj4-hg4x-qw45.json @@ -29,7 +29,9 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-476" + ], "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, diff --git a/advisories/unreviewed/2024/11/GHSA-397j-j3xj-vcr3/GHSA-397j-j3xj-vcr3.json b/advisories/unreviewed/2024/11/GHSA-397j-j3xj-vcr3/GHSA-397j-j3xj-vcr3.json index a5e8a794eff..6575118445b 100644 --- a/advisories/unreviewed/2024/11/GHSA-397j-j3xj-vcr3/GHSA-397j-j3xj-vcr3.json +++ b/advisories/unreviewed/2024/11/GHSA-397j-j3xj-vcr3/GHSA-397j-j3xj-vcr3.json @@ -17,9 +17,7 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -44,7 +42,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-4f47-wxrx-fmj7/GHSA-4f47-wxrx-fmj7.json b/advisories/unreviewed/2024/11/GHSA-4f47-wxrx-fmj7/GHSA-4f47-wxrx-fmj7.json index caf42a14853..39bd8ae4584 100644 --- a/advisories/unreviewed/2024/11/GHSA-4f47-wxrx-fmj7/GHSA-4f47-wxrx-fmj7.json +++ b/advisories/unreviewed/2024/11/GHSA-4f47-wxrx-fmj7/GHSA-4f47-wxrx-fmj7.json @@ -17,9 +17,7 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-5r88-6jm3-pfvc/GHSA-5r88-6jm3-pfvc.json b/advisories/unreviewed/2024/11/GHSA-5r88-6jm3-pfvc/GHSA-5r88-6jm3-pfvc.json index 73e128ab884..a20604d73fe 100644 --- a/advisories/unreviewed/2024/11/GHSA-5r88-6jm3-pfvc/GHSA-5r88-6jm3-pfvc.json +++ b/advisories/unreviewed/2024/11/GHSA-5r88-6jm3-pfvc/GHSA-5r88-6jm3-pfvc.json @@ -17,9 +17,7 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-82vh-c6r8-fwq3/GHSA-82vh-c6r8-fwq3.json b/advisories/unreviewed/2024/11/GHSA-82vh-c6r8-fwq3/GHSA-82vh-c6r8-fwq3.json index 54b8dcb571b..234600bbdf1 100644 --- a/advisories/unreviewed/2024/11/GHSA-82vh-c6r8-fwq3/GHSA-82vh-c6r8-fwq3.json +++ b/advisories/unreviewed/2024/11/GHSA-82vh-c6r8-fwq3/GHSA-82vh-c6r8-fwq3.json @@ -46,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-74" + "CWE-74", + "CWE-89" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-h8jw-v8m2-669r/GHSA-h8jw-v8m2-669r.json b/advisories/unreviewed/2024/11/GHSA-h8jw-v8m2-669r/GHSA-h8jw-v8m2-669r.json index f91a0c950f2..7f6510c17b8 100644 --- a/advisories/unreviewed/2024/11/GHSA-h8jw-v8m2-669r/GHSA-h8jw-v8m2-669r.json +++ b/advisories/unreviewed/2024/11/GHSA-h8jw-v8m2-669r/GHSA-h8jw-v8m2-669r.json @@ -17,9 +17,7 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-j8p2-5922-rxpr/GHSA-j8p2-5922-rxpr.json b/advisories/unreviewed/2024/11/GHSA-j8p2-5922-rxpr/GHSA-j8p2-5922-rxpr.json index aa2214a96c1..dcf705dea77 100644 --- a/advisories/unreviewed/2024/11/GHSA-j8p2-5922-rxpr/GHSA-j8p2-5922-rxpr.json +++ b/advisories/unreviewed/2024/11/GHSA-j8p2-5922-rxpr/GHSA-j8p2-5922-rxpr.json @@ -17,9 +17,7 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-mj99-xh44-q75g/GHSA-mj99-xh44-q75g.json b/advisories/unreviewed/2024/11/GHSA-mj99-xh44-q75g/GHSA-mj99-xh44-q75g.json index f58f09f9586..5e7c4c2648f 100644 --- a/advisories/unreviewed/2024/11/GHSA-mj99-xh44-q75g/GHSA-mj99-xh44-q75g.json +++ b/advisories/unreviewed/2024/11/GHSA-mj99-xh44-q75g/GHSA-mj99-xh44-q75g.json @@ -17,9 +17,7 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -44,7 +42,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-284" + "CWE-284", + "CWE-434" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/11/GHSA-mx67-gpgv-qm6w/GHSA-mx67-gpgv-qm6w.json b/advisories/unreviewed/2024/11/GHSA-mx67-gpgv-qm6w/GHSA-mx67-gpgv-qm6w.json index 564eeb8fdc0..9368887581a 100644 --- a/advisories/unreviewed/2024/11/GHSA-mx67-gpgv-qm6w/GHSA-mx67-gpgv-qm6w.json +++ b/advisories/unreviewed/2024/11/GHSA-mx67-gpgv-qm6w/GHSA-mx67-gpgv-qm6w.json @@ -17,9 +17,7 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-rwvw-fh44-w2r2/GHSA-rwvw-fh44-w2r2.json b/advisories/unreviewed/2024/11/GHSA-rwvw-fh44-w2r2/GHSA-rwvw-fh44-w2r2.json index bf3e247b7f0..51d4471af90 100644 --- a/advisories/unreviewed/2024/11/GHSA-rwvw-fh44-w2r2/GHSA-rwvw-fh44-w2r2.json +++ b/advisories/unreviewed/2024/11/GHSA-rwvw-fh44-w2r2/GHSA-rwvw-fh44-w2r2.json @@ -17,9 +17,7 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-v755-r9fp-w5gj/GHSA-v755-r9fp-w5gj.json b/advisories/unreviewed/2024/11/GHSA-v755-r9fp-w5gj/GHSA-v755-r9fp-w5gj.json index 9b7579dca2c..2cb78590d9d 100644 --- a/advisories/unreviewed/2024/11/GHSA-v755-r9fp-w5gj/GHSA-v755-r9fp-w5gj.json +++ b/advisories/unreviewed/2024/11/GHSA-v755-r9fp-w5gj/GHSA-v755-r9fp-w5gj.json @@ -17,9 +17,7 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-vhvx-3f4j-g64m/GHSA-vhvx-3f4j-g64m.json b/advisories/unreviewed/2024/11/GHSA-vhvx-3f4j-g64m/GHSA-vhvx-3f4j-g64m.json index 15de92f4f6f..07e69641a45 100644 --- a/advisories/unreviewed/2024/11/GHSA-vhvx-3f4j-g64m/GHSA-vhvx-3f4j-g64m.json +++ b/advisories/unreviewed/2024/11/GHSA-vhvx-3f4j-g64m/GHSA-vhvx-3f4j-g64m.json @@ -17,9 +17,7 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/11/GHSA-x6vf-7crv-fr5w/GHSA-x6vf-7crv-fr5w.json b/advisories/unreviewed/2024/11/GHSA-x6vf-7crv-fr5w/GHSA-x6vf-7crv-fr5w.json index 8c76f95d7e3..fb76cf2b330 100644 --- a/advisories/unreviewed/2024/11/GHSA-x6vf-7crv-fr5w/GHSA-x6vf-7crv-fr5w.json +++ b/advisories/unreviewed/2024/11/GHSA-x6vf-7crv-fr5w/GHSA-x6vf-7crv-fr5w.json @@ -17,9 +17,7 @@ "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -48,7 +46,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-284" + "CWE-284", + "CWE-434" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/12/GHSA-4fh7-m2wx-6wfm/GHSA-4fh7-m2wx-6wfm.json b/advisories/unreviewed/2024/12/GHSA-4fh7-m2wx-6wfm/GHSA-4fh7-m2wx-6wfm.json new file mode 100644 index 00000000000..78c40307c56 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-4fh7-m2wx-6wfm/GHSA-4fh7-m2wx-6wfm.json @@ -0,0 +1,37 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4fh7-m2wx-6wfm", + "modified": "2024-12-04T21:30:52Z", + "published": "2024-12-04T21:30:52Z", + "aliases": [ + "CVE-2024-51210" + ], + "details": "Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all content that has previously been pasted into the document. NOTE: in several similar products, this is the intentional behavior for anyone who knows the full document ID and corresponding URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51210" + }, + { + "type": "WEB", + "url": "https://firebase.blog/posts/2013/04/announcing-firepad-our-open-source" + }, + { + "type": "WEB", + "url": "https://github.com/FirebaseExtended/firepad/releases/tag/v1.5.11" + }, + { + "type": "WEB", + "url": "https://medium.com/@adityaahuja.work/accessing-full-history-of-firepad-users-ddc889e73936" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T21:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-4x6p-mgm4-pgfq/GHSA-4x6p-mgm4-pgfq.json b/advisories/unreviewed/2024/12/GHSA-4x6p-mgm4-pgfq/GHSA-4x6p-mgm4-pgfq.json new file mode 100644 index 00000000000..d2404d7bd4c --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-4x6p-mgm4-pgfq/GHSA-4x6p-mgm4-pgfq.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4x6p-mgm4-pgfq", + "modified": "2024-12-04T21:30:52Z", + "published": "2024-12-04T21:30:52Z", + "aliases": [ + "CVE-2024-54674" + ], + "details": "app/View/GalaxyClusters/cluster_export_misp_galaxy.ctp in MISP through 2.5.2 has stored XSS when exporting custom clusters into the misp-galaxy format.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54674" + }, + { + "type": "WEB", + "url": "https://github.com/MISP/MISP/commit/d0330989e235a8a9f43c90817896de87a589ef7d" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T21:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-63g3-m4j7-2vpw/GHSA-63g3-m4j7-2vpw.json b/advisories/unreviewed/2024/12/GHSA-63g3-m4j7-2vpw/GHSA-63g3-m4j7-2vpw.json new file mode 100644 index 00000000000..340e17ae785 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-63g3-m4j7-2vpw/GHSA-63g3-m4j7-2vpw.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-63g3-m4j7-2vpw", + "modified": "2024-12-04T21:30:52Z", + "published": "2024-12-04T21:30:52Z", + "aliases": [ + "CVE-2024-50947" + ], + "details": "An issue in kmqtt v0.2.7 allows attackers to cause a Denial of Service (DoS) via a crafted request.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50947" + }, + { + "type": "WEB", + "url": "https://gist.github.com/pengwGit/40934164f68a8a45ebaacfcdeb598fcb" + }, + { + "type": "WEB", + "url": "https://github.com/davidepianca98/KMQTT" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T21:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-fr2r-2pc4-h4f4/GHSA-fr2r-2pc4-h4f4.json b/advisories/unreviewed/2024/12/GHSA-fr2r-2pc4-h4f4/GHSA-fr2r-2pc4-h4f4.json index 055d1ae3ded..f65c89b40dd 100644 --- a/advisories/unreviewed/2024/12/GHSA-fr2r-2pc4-h4f4/GHSA-fr2r-2pc4-h4f4.json +++ b/advisories/unreviewed/2024/12/GHSA-fr2r-2pc4-h4f4/GHSA-fr2r-2pc4-h4f4.json @@ -1,13 +1,18 @@ { "schema_version": "1.4.0", "id": "GHSA-fr2r-2pc4-h4f4", - "modified": "2024-12-04T18:32:36Z", + "modified": "2024-12-04T21:30:52Z", "published": "2024-12-04T18:32:36Z", "aliases": [ "CVE-2024-12196" ], "details": "Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of an entry without the view password permission.", - "severity": [], + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], "affected": [], "references": [ { @@ -23,7 +28,7 @@ "cwe_ids": [ "CWE-863" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-12-04T18:15:13Z" diff --git a/advisories/unreviewed/2024/12/GHSA-g7g9-rh3x-m925/GHSA-g7g9-rh3x-m925.json b/advisories/unreviewed/2024/12/GHSA-g7g9-rh3x-m925/GHSA-g7g9-rh3x-m925.json new file mode 100644 index 00000000000..a0fa7955238 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-g7g9-rh3x-m925/GHSA-g7g9-rh3x-m925.json @@ -0,0 +1,33 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g7g9-rh3x-m925", + "modified": "2024-12-04T21:30:52Z", + "published": "2024-12-04T21:30:52Z", + "aliases": [ + "CVE-2024-39219" + ], + "details": "An issue in Aginode GigaSwitch V5 before version 7.06G allows authenticated attackers with Administrator privileges to upload an earlier firmware version, exposing the device to previously patched vulnerabilities.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39219" + }, + { + "type": "WEB", + "url": "https://blog.hackvens.fr/advisories/CVE-2024-39967-CVE-2024-39219-GigaSwitch.html" + }, + { + "type": "WEB", + "url": "https://www.aginode.support/support/documentation" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T21:15:24Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-j4j6-mjqg-x2j7/GHSA-j4j6-mjqg-x2j7.json b/advisories/unreviewed/2024/12/GHSA-j4j6-mjqg-x2j7/GHSA-j4j6-mjqg-x2j7.json new file mode 100644 index 00000000000..69b9685d194 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-j4j6-mjqg-x2j7/GHSA-j4j6-mjqg-x2j7.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j4j6-mjqg-x2j7", + "modified": "2024-12-04T21:30:52Z", + "published": "2024-12-04T21:30:52Z", + "aliases": [ + "CVE-2024-54675" + ], + "details": "app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54675" + }, + { + "type": "WEB", + "url": "https://github.com/MISP/MISP/commit/e02c2b864a85d14d64adf9f878f9c7b2bdd15173" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T21:15:25Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json b/advisories/unreviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json new file mode 100644 index 00000000000..134ce395823 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-mqvr-2rp8-j7h4/GHSA-mqvr-2rp8-j7h4.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mqvr-2rp8-j7h4", + "modified": "2024-12-04T21:30:52Z", + "published": "2024-12-04T21:30:52Z", + "aliases": [ + "CVE-2024-38829" + ], + "details": "A vulnerability in VMware Tanzu Spring LDAP allows data exposure for case sensitive comparisons.This issue affects Spring LDAP: from 2.4.0 through 2.4.3, from 3.0.0 through 3.0.9, from 3.1.0 through 3.1.7, from 3.2.0 through 3.2.7, AND all versions prior to 2.4.0.\n\nThe usage of String.toLowerCase() and String.toUpperCase() has some Locale dependent exceptions that could potentially result in unintended columns from being queried\nRelated to CVE-2024-38820 https://spring.io/security/cve-2024-38820", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38829" + }, + { + "type": "WEB", + "url": "https://spring.io/security/cve-2024-38829" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-178" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T21:15:24Z" + } +} \ No newline at end of file