diff --git a/advisories/unreviewed/2024/02/GHSA-3prf-2gpr-5j48/GHSA-3prf-2gpr-5j48.json b/advisories/unreviewed/2024/02/GHSA-3prf-2gpr-5j48/GHSA-3prf-2gpr-5j48.json new file mode 100644 index 00000000000..f3a46258e49 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-3prf-2gpr-5j48/GHSA-3prf-2gpr-5j48.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3prf-2gpr-5j48", + "modified": "2024-02-16T12:30:34Z", + "published": "2024-02-16T12:30:34Z", + "aliases": [ + "CVE-2024-22426" + ], + "details": "\nDell RecoverPoint for Virtual Machines 5.3.x contains an OS Command injection vulnerability. An unauthenticated remote\nattacker could potentially exploit this vulnerability, leading to execute arbitrary operating system commands, which will get executed in the context of the root user, resulting in a complete system compromise.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22426" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-us/000222133/dsa-2024-092-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-16T12:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-9m95-x9fm-78hh/GHSA-9m95-x9fm-78hh.json b/advisories/unreviewed/2024/02/GHSA-9m95-x9fm-78hh/GHSA-9m95-x9fm-78hh.json new file mode 100644 index 00000000000..b7ce8afe912 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-9m95-x9fm-78hh/GHSA-9m95-x9fm-78hh.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9m95-x9fm-78hh", + "modified": "2024-02-16T12:30:34Z", + "published": "2024-02-16T12:30:34Z", + "aliases": [ + "CVE-2024-22425" + ], + "details": "\nDell RecoverPoint for Virtual Machines 5.3.x contains a brute force/dictionary attack vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to launch a brute force attack or a dictionary attack against the RecoverPoint login form. This allows attackers to brute-force the password of valid users in an automated manner.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22425" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-us/000222133/dsa-2024-092-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-307" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-16T12:15:07Z" + } +} \ No newline at end of file