diff --git a/advisories/github-reviewed/2024/07/GHSA-28mc-g557-92m7/GHSA-28mc-g557-92m7.json b/advisories/github-reviewed/2024/07/GHSA-28mc-g557-92m7/GHSA-28mc-g557-92m7.json new file mode 100644 index 00000000000..aac1f2f45ac --- /dev/null +++ b/advisories/github-reviewed/2024/07/GHSA-28mc-g557-92m7/GHSA-28mc-g557-92m7.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-28mc-g557-92m7", + "modified": "2024-07-31T15:29:36Z", + "published": "2024-07-30T21:31:28Z", + "aliases": [ + "CVE-2024-38986" + ], + "summary": "@75lb/deep-merge Prototype Pollution vulnerability", + "details": "Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge methods of lodash to merge objects.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@75lb/deep-merge" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.1.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38986" + }, + { + "type": "WEB", + "url": "https://github.com/75lb/deep-merge/issues/1" + }, + { + "type": "WEB", + "url": "https://gist.github.com/mestrtee/b20c3aee8bea16e1863933778da6e4cb" + }, + { + "type": "PACKAGE", + "url": "https://github.com/75lb/deep-merge" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1321" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-07-31T15:29:36Z", + "nvd_published_at": "2024-07-30T20:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-485m-923f-95wx/GHSA-485m-923f-95wx.json b/advisories/unreviewed/2024/06/GHSA-485m-923f-95wx/GHSA-485m-923f-95wx.json index c6b988a3943..0aab8b2f6d7 100644 --- a/advisories/unreviewed/2024/06/GHSA-485m-923f-95wx/GHSA-485m-923f-95wx.json +++ b/advisories/unreviewed/2024/06/GHSA-485m-923f-95wx/GHSA-485m-923f-95wx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-485m-923f-95wx", - "modified": "2024-06-25T15:31:09Z", + "modified": "2024-07-31T15:31:14Z", "published": "2024-06-25T15:31:09Z", "aliases": [ "CVE-2024-37085" diff --git a/advisories/unreviewed/2024/07/GHSA-273g-8x52-9gmv/GHSA-273g-8x52-9gmv.json b/advisories/unreviewed/2024/07/GHSA-273g-8x52-9gmv/GHSA-273g-8x52-9gmv.json index f0d4239eb22..c3d337f6112 100644 --- a/advisories/unreviewed/2024/07/GHSA-273g-8x52-9gmv/GHSA-273g-8x52-9gmv.json +++ b/advisories/unreviewed/2024/07/GHSA-273g-8x52-9gmv/GHSA-273g-8x52-9gmv.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-273g-8x52-9gmv", - "modified": "2024-07-10T09:30:38Z", + "modified": "2024-07-31T15:31:15Z", "published": "2024-07-10T09:30:38Z", "aliases": [ "CVE-2024-36450" ], "details": "Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product. As a result, a session ID may be obtained, a webpage may be altered, or a server may be halted.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-10T07:15:02Z" diff --git a/advisories/unreviewed/2024/07/GHSA-28mc-g557-92m7/GHSA-28mc-g557-92m7.json b/advisories/unreviewed/2024/07/GHSA-28mc-g557-92m7/GHSA-28mc-g557-92m7.json deleted file mode 100644 index f37397cc964..00000000000 --- a/advisories/unreviewed/2024/07/GHSA-28mc-g557-92m7/GHSA-28mc-g557-92m7.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-28mc-g557-92m7", - "modified": "2024-07-30T21:31:28Z", - "published": "2024-07-30T21:31:28Z", - "aliases": [ - "CVE-2024-38986" - ], - "details": "Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge methods of lodash to merge objects.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38986" - }, - { - "type": "WEB", - "url": "https://gist.github.com/mestrtee/b20c3aee8bea16e1863933778da6e4cb" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-07-30T20:15:03Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-2hwm-f3wp-3rq5/GHSA-2hwm-f3wp-3rq5.json b/advisories/unreviewed/2024/07/GHSA-2hwm-f3wp-3rq5/GHSA-2hwm-f3wp-3rq5.json new file mode 100644 index 00000000000..9557170e39b --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-2hwm-f3wp-3rq5/GHSA-2hwm-f3wp-3rq5.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2hwm-f3wp-3rq5", + "modified": "2024-07-31T15:31:18Z", + "published": "2024-07-31T15:31:18Z", + "aliases": [ + "CVE-2024-31199" + ], + "details": "A “CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')” allows malicious users to permanently inject arbitrary Javascript code.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31199" + }, + { + "type": "WEB", + "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31199" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-31T14:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-2mr4-jwhc-j589/GHSA-2mr4-jwhc-j589.json b/advisories/unreviewed/2024/07/GHSA-2mr4-jwhc-j589/GHSA-2mr4-jwhc-j589.json new file mode 100644 index 00000000000..490b9a97dcd --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-2mr4-jwhc-j589/GHSA-2mr4-jwhc-j589.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2mr4-jwhc-j589", + "modified": "2024-07-31T15:31:17Z", + "published": "2024-07-31T15:31:17Z", + "aliases": [ + "CVE-2024-6208" + ], + "details": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm_all_packages' shortcode in all versions up to, and including, 3.2.97 due to insufficient input sanitization and output escaping on the 'cols' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6208" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Package/views/all-packages-shortcode.php?rev=3097323#L10" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Package/views/all-packages-shortcode.php?rev=3097323#L302" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3126662" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7c67d2f8-d918-42ef-a301-27eed7fa41b2?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-31T13:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-4wvg-c8hr-7h76/GHSA-4wvg-c8hr-7h76.json b/advisories/unreviewed/2024/07/GHSA-4wvg-c8hr-7h76/GHSA-4wvg-c8hr-7h76.json new file mode 100644 index 00000000000..9f4b0badaeb --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-4wvg-c8hr-7h76/GHSA-4wvg-c8hr-7h76.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4wvg-c8hr-7h76", + "modified": "2024-07-31T15:31:18Z", + "published": "2024-07-31T15:31:18Z", + "aliases": [ + "CVE-2024-31202" + ], + "details": "A “CWE-732: Incorrect Permission Assignment for Critical Resource” in the ThermoscanIP installation folder allows a local attacker to perform a Local Privilege Escalation.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31202" + }, + { + "type": "WEB", + "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31202" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-732" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-31T14:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-5j5f-mr3p-j7cr/GHSA-5j5f-mr3p-j7cr.json b/advisories/unreviewed/2024/07/GHSA-5j5f-mr3p-j7cr/GHSA-5j5f-mr3p-j7cr.json new file mode 100644 index 00000000000..4debc6daed5 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-5j5f-mr3p-j7cr/GHSA-5j5f-mr3p-j7cr.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5j5f-mr3p-j7cr", + "modified": "2024-07-31T15:31:18Z", + "published": "2024-07-31T15:31:18Z", + "aliases": [ + "CVE-2024-3083" + ], + "details": "A “CWE-352: Cross-Site Request Forgery (CSRF)” can be exploited by remote attackers to perform state-changing operations with administrative privileges by luring authenticated victims into visiting a malicious web page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3083" + }, + { + "type": "WEB", + "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-3083" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-31T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-6x5j-7272-4wjc/GHSA-6x5j-7272-4wjc.json b/advisories/unreviewed/2024/07/GHSA-6x5j-7272-4wjc/GHSA-6x5j-7272-4wjc.json new file mode 100644 index 00000000000..4b6674e9b1d --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-6x5j-7272-4wjc/GHSA-6x5j-7272-4wjc.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6x5j-7272-4wjc", + "modified": "2024-07-31T15:31:18Z", + "published": "2024-07-31T15:31:18Z", + "aliases": [ + "CVE-2024-31200" + ], + "details": "A “CWE-201: Insertion of Sensitive Information Into Sent Data” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext when an administrative session is open in the browser.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31200" + }, + { + "type": "WEB", + "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31200" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-201" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-31T14:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-96m3-7m8m-wmff/GHSA-96m3-7m8m-wmff.json b/advisories/unreviewed/2024/07/GHSA-96m3-7m8m-wmff/GHSA-96m3-7m8m-wmff.json new file mode 100644 index 00000000000..e329b0b8fbc --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-96m3-7m8m-wmff/GHSA-96m3-7m8m-wmff.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-96m3-7m8m-wmff", + "modified": "2024-07-31T15:31:18Z", + "published": "2024-07-31T15:31:18Z", + "aliases": [ + "CVE-2024-31201" + ], + "details": "A “CWE-428: Unquoted Search Path or Element” affects the ThermoscanIP_Scrutation service. Such misconfiguration could be abused in scenarios where incorrect permissions were assigned to the C:\\ path to attempt a privilege escalation on the local machine.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31201" + }, + { + "type": "WEB", + "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31201" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-428" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-31T14:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-9p6g-5797-v553/GHSA-9p6g-5797-v553.json b/advisories/unreviewed/2024/07/GHSA-9p6g-5797-v553/GHSA-9p6g-5797-v553.json index 0e599f12626..7a9544a820f 100644 --- a/advisories/unreviewed/2024/07/GHSA-9p6g-5797-v553/GHSA-9p6g-5797-v553.json +++ b/advisories/unreviewed/2024/07/GHSA-9p6g-5797-v553/GHSA-9p6g-5797-v553.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9p6g-5797-v553", - "modified": "2024-07-10T09:30:41Z", + "modified": "2024-07-31T15:31:15Z", "published": "2024-07-10T09:30:41Z", "aliases": [ "CVE-2024-39489" ], "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: fix memleak in seg6_hmac_init_algo\n\nseg6_hmac_init_algo returns without cleaning up the previous allocations\nif one fails, so it's going to leak all that memory and the crypto tfms.\n\nUpdate seg6_hmac_exit to only free the memory when allocated, so we can\nreuse the code directly.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -53,9 +56,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-401" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-10T08:15:11Z" diff --git a/advisories/unreviewed/2024/07/GHSA-gwf9-9829-4r2v/GHSA-gwf9-9829-4r2v.json b/advisories/unreviewed/2024/07/GHSA-gwf9-9829-4r2v/GHSA-gwf9-9829-4r2v.json new file mode 100644 index 00000000000..0efcc927b8c --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-gwf9-9829-4r2v/GHSA-gwf9-9829-4r2v.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gwf9-9829-4r2v", + "modified": "2024-07-31T15:31:18Z", + "published": "2024-07-31T15:31:18Z", + "aliases": [ + "CVE-2024-31203" + ], + "details": "A “CWE-121: Stack-based Buffer Overflow” in the wd210std.dll dynamic library packaged with the ThermoscanIP installer allows a local attacker to possibly trigger a Denial-of-Service (DoS) condition on the target component.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31203" + }, + { + "type": "WEB", + "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-31203" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-121" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-31T14:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-h85p-v7mg-h47q/GHSA-h85p-v7mg-h47q.json b/advisories/unreviewed/2024/07/GHSA-h85p-v7mg-h47q/GHSA-h85p-v7mg-h47q.json new file mode 100644 index 00000000000..2d7e54a3e3c --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-h85p-v7mg-h47q/GHSA-h85p-v7mg-h47q.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h85p-v7mg-h47q", + "modified": "2024-07-31T15:31:18Z", + "published": "2024-07-31T15:31:18Z", + "aliases": [ + "CVE-2024-37135" + ], + "details": "DM5500 5.16.0.0, contains an information disclosure vulnerability. A local attacker with high privileges could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37135" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-us/000227424/dsa-2024-290-security-update-for-dell-powerprotect-data-manager-appliance-dm5500-for-multiple-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-256" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-31T14:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-p9qx-gfwc-8q38/GHSA-p9qx-gfwc-8q38.json b/advisories/unreviewed/2024/07/GHSA-p9qx-gfwc-8q38/GHSA-p9qx-gfwc-8q38.json index 9e52e445cb4..179868cc255 100644 --- a/advisories/unreviewed/2024/07/GHSA-p9qx-gfwc-8q38/GHSA-p9qx-gfwc-8q38.json +++ b/advisories/unreviewed/2024/07/GHSA-p9qx-gfwc-8q38/GHSA-p9qx-gfwc-8q38.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-p9qx-gfwc-8q38", - "modified": "2024-07-10T15:30:28Z", + "modified": "2024-07-31T15:31:15Z", "published": "2024-07-10T15:30:28Z", "aliases": [ "CVE-2024-40334" ], "details": "idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/serverFile_deal.php?mudi=upFileDel&dataID=3", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-10T13:15:10Z" diff --git a/advisories/unreviewed/2024/07/GHSA-qxx3-fwc4-2mv7/GHSA-qxx3-fwc4-2mv7.json b/advisories/unreviewed/2024/07/GHSA-qxx3-fwc4-2mv7/GHSA-qxx3-fwc4-2mv7.json new file mode 100644 index 00000000000..063947773e5 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-qxx3-fwc4-2mv7/GHSA-qxx3-fwc4-2mv7.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qxx3-fwc4-2mv7", + "modified": "2024-07-31T15:31:19Z", + "published": "2024-07-31T15:31:18Z", + "aliases": [ + "CVE-2024-3082" + ], + "details": "A “CWE-256: Plaintext Storage of a Password” affecting the administrative account allows an attacker with physical access to the machine to retrieve the password in cleartext.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3082" + }, + { + "type": "WEB", + "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-3082" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-256" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-31T14:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-r49h-6qxq-624f/GHSA-r49h-6qxq-624f.json b/advisories/unreviewed/2024/07/GHSA-r49h-6qxq-624f/GHSA-r49h-6qxq-624f.json new file mode 100644 index 00000000000..bd77332820f --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-r49h-6qxq-624f/GHSA-r49h-6qxq-624f.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r49h-6qxq-624f", + "modified": "2024-07-31T15:31:19Z", + "published": "2024-07-31T15:31:19Z", + "aliases": [ + "CVE-2024-7340" + ], + "details": "The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7340" + }, + { + "type": "WEB", + "url": "https://github.com/wandb/weave/pull/1657" + }, + { + "type": "WEB", + "url": "https://research.jfrog.com/vulnerabilities/wandb-weave-server-remote-arbitrary-file-leak-jfsa-2024-001039248" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-31T15:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-v458-23rq-7r33/GHSA-v458-23rq-7r33.json b/advisories/unreviewed/2024/07/GHSA-v458-23rq-7r33/GHSA-v458-23rq-7r33.json index dc4e3a1b9cd..5a482b195f4 100644 --- a/advisories/unreviewed/2024/07/GHSA-v458-23rq-7r33/GHSA-v458-23rq-7r33.json +++ b/advisories/unreviewed/2024/07/GHSA-v458-23rq-7r33/GHSA-v458-23rq-7r33.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-v458-23rq-7r33", - "modified": "2024-07-10T15:30:28Z", + "modified": "2024-07-31T15:31:15Z", "published": "2024-07-10T15:30:28Z", "aliases": [ "CVE-2024-40332" ], "details": "idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/moneyRecord_deal.php?mudi=delRecord", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-10T14:15:12Z" diff --git a/advisories/unreviewed/2024/07/GHSA-x4cv-g6r2-3w7r/GHSA-x4cv-g6r2-3w7r.json b/advisories/unreviewed/2024/07/GHSA-x4cv-g6r2-3w7r/GHSA-x4cv-g6r2-3w7r.json new file mode 100644 index 00000000000..e7eeaa9dcfd --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-x4cv-g6r2-3w7r/GHSA-x4cv-g6r2-3w7r.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x4cv-g6r2-3w7r", + "modified": "2024-07-31T15:31:17Z", + "published": "2024-07-31T15:31:17Z", + "aliases": [ + "CVE-2024-39379" + ], + "details": "Acrobat for Edge versions 126.0.2592.81 and earlier are affected by an out-of-bounds read vulnerability that could lead to arbitrary file system read access. An attacker could exploit this vulnerability to read contents from a location in memory past the buffer boundary, potentially leading to sensitive information disclosure. Exploitation of this issue requires user interaction in that a victim must open a malicious file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39379" + }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-39379" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-31T13:15:10Z" + } +} \ No newline at end of file