netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-08-16 00:33:30 +00:00
parent 1b220aed44
commit ef0c379f85
31 changed files with 803 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2023/03/GHSA-74h5-c7r2-qfwr/GHSA-74h5-c7r2-qfwr.json
+9 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-74h5-c7r2-qfwr",
"modified": "2023-03-28T21:30:20Z",
"modified": "2024-08-16T00:32:02Z",
"published": "2023-03-24T21:30:50Z",
"aliases": [
"CVE-2023-20971"
@@ -21,6 +21,14 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20971"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/6c22d6c1e69676c5c68d21928aa5486bfd1bd131"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-08-01"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2023-03-01"
advisories/unreviewed/2023/10/GHSA-jqg7-34mv-rqjm/GHSA-jqg7-34mv-rqjm.json
+9 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jqg7-34mv-rqjm",
"modified": "2023-11-04T03:30:19Z",
"modified": "2024-08-16T00:32:04Z",
"published": "2023-10-30T18:30:25Z",
"aliases": [
"CVE-2023-21351"
@@ -21,9 +21,17 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21351"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/26522c0e82fd3a9bcbd01409217291d97dcdabcf"
},
{
"type": "WEB",
"url": "https://source.android.com/docs/security/bulletin/android-14"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-08-01"
}
],
"database_specific": {
advisories/unreviewed/2024/02/GHSA-mj4c-frrv-hprq/GHSA-mj4c-frrv-hprq.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mj4c-frrv-hprq",
"modified": "2024-02-27T03:31:02Z",
"modified": "2024-08-16T00:32:04Z",
"published": "2024-02-27T03:31:02Z",
"aliases": [
"CVE-2024-22917"
],
"details": "SQL injection vulnerability in Dynamic Lab Management System Project in PHP v.1.0 allows a remote attacker to execute arbitrary code via a crafted script.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-27T02:15:06Z"
advisories/unreviewed/2024/02/GHSA-mmjv-3699-c2q5/GHSA-mmjv-3699-c2q5.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mmjv-3699-c2q5",
"modified": "2024-02-28T00:31:55Z",
"modified": "2024-08-16T00:32:04Z",
"published": "2024-02-28T00:31:55Z",
"aliases": [
"CVE-2024-26542"
],
"details": "Cross Site Scripting vulnerability in Bonitasoft, S.A v.7.14. and fixed in v.9.0.2, 8.0.3, 7.15.7, 7.14.8 allows attackers to execute arbitrary code via a crafted payload to the Groups Display name field.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-27T22:15:15Z"
advisories/unreviewed/2024/02/GHSA-v4q2-79g6-j728/GHSA-v4q2-79g6-j728.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v4q2-79g6-j728",
"modified": "2024-06-10T18:30:52Z",
"modified": "2024-08-16T00:32:04Z",
"published": "2024-02-20T18:30:35Z",
"aliases": [
"CVE-2024-24474"
],
"details": "Buffer Overflow vulnerability in Qemu before v.8.2.0 allows a remote attacker to execute arbitrary code via the async_len variable to the FIFO buffer component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -37,9 +40,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-120"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-20T18:15:52Z"
advisories/unreviewed/2024/03/GHSA-6fq2-mvcq-gw26/GHSA-6fq2-mvcq-gw26.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6fq2-mvcq-gw26",
"modified": "2024-03-04T15:31:07Z",
"modified": "2024-08-16T00:32:04Z",
"published": "2024-03-04T15:31:07Z",
"aliases": [
"CVE-2024-27680"
],
"details": "Flusity-CMS v2.33 is vulnerable to Cross Site Scripting (XSS) in the \"Contact form.\"",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-04T15:15:07Z"
advisories/unreviewed/2024/03/GHSA-7fc6-ggpp-78xq/GHSA-7fc6-ggpp-78xq.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7fc6-ggpp-78xq",
"modified": "2024-03-07T21:30:21Z",
"modified": "2024-08-16T00:32:04Z",
"published": "2024-03-07T21:30:21Z",
"aliases": [
"CVE-2024-24035"
],
"details": "Cross Site Scripting (XSS) vulnerability in Setor Informatica SIL 3.1 allows attackers to run arbitrary code via the hmessage parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-07T21:15:08Z"
advisories/unreviewed/2024/03/GHSA-7ppq-5vxg-mxp7/GHSA-7ppq-5vxg-mxp7.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7ppq-5vxg-mxp7",
"modified": "2024-03-02T00:31:32Z",
"modified": "2024-08-16T00:32:04Z",
"published": "2024-03-02T00:31:32Z",
"aliases": [
"CVE-2024-24512"
],
"details": "Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-01T23:15:08Z"
advisories/unreviewed/2024/03/GHSA-832m-mwp6-jcr3/GHSA-832m-mwp6-jcr3.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-832m-mwp6-jcr3",
"modified": "2024-03-06T03:30:29Z",
"modified": "2024-08-16T00:32:04Z",
"published": "2024-03-06T03:30:29Z",
"aliases": [
"CVE-2023-49974"
],
"details": "A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the contact parameter at /customer_support/index.php?page=customer_list.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-06T01:15:07Z"
advisories/unreviewed/2024/03/GHSA-9ghw-mv5v-jx7g/GHSA-9ghw-mv5v-jx7g.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9ghw-mv5v-jx7g",
"modified": "2024-03-25T15:30:40Z",
"modified": "2024-08-16T00:32:04Z",
"published": "2024-03-25T15:30:40Z",
"aliases": [
"CVE-2024-25175"
],
"details": "An issue in Kickdler before v1.107.0 allows attackers to provide an XSS payload via a HTTP response splitting attack.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-25T15:15:52Z"
advisories/unreviewed/2024/03/GHSA-cmx2-vf3h-cg9p/GHSA-cmx2-vf3h-cg9p.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cmx2-vf3h-cg9p",
"modified": "2024-03-13T09:31:22Z",
"modified": "2024-08-16T00:32:04Z",
"published": "2024-03-13T09:31:22Z",
"aliases": [
"CVE-2024-28623"
],
"details": "RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_section.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-13T08:15:43Z"
advisories/unreviewed/2024/03/GHSA-f738-2p56-xf85/GHSA-f738-2p56-xf85.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f738-2p56-xf85",
"modified": "2024-03-08T00:33:39Z",
"modified": "2024-08-16T00:32:04Z",
"published": "2024-03-08T00:33:39Z",
"aliases": [
"CVE-2024-25327"
],
"details": "Cross Site Scripting (XSS) vulnerability in Justice Systems FullCourt Enterprise v.8.2 allows a remote attacker to execute arbitrary code via the formatCaseNumber parameter of the Citation search function.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-08T00:15:49Z"
advisories/unreviewed/2024/03/GHSA-g7vc-r5r2-8x6v/GHSA-g7vc-r5r2-8x6v.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g7vc-r5r2-8x6v",
"modified": "2024-03-02T00:31:33Z",
"modified": "2024-08-16T00:32:04Z",
"published": "2024-03-02T00:31:33Z",
"aliases": [
"CVE-2024-25438"
],
"details": "A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-01T23:15:08Z"
advisories/unreviewed/2024/06/GHSA-94mv-6g8w-jxvx/GHSA-94mv-6g8w-jxvx.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-94mv-6g8w-jxvx",
"modified": "2024-06-11T21:32:17Z",
"modified": "2024-08-16T00:32:04Z",
"published": "2024-06-11T21:32:17Z",
"aliases": [
"CVE-2024-28020"
advisories/unreviewed/2024/08/GHSA-35gp-5q9f-g9pq/GHSA-35gp-5q9f-g9pq.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-35gp-5q9f-g9pq",
"modified": "2024-08-16T00:32:05Z",
"published": "2024-08-16T00:32:05Z",
"aliases": [
"CVE-2024-34737"
],
"details": "In ensureSetPipAspectRatioQuotaTracker of ActivityClientController.java, there is a possible way to generate unmovable and undeletable pip windows due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34737"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/8b473b3f79642f42eeeffbfe572df6c6cbe9d79e"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-08-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-15T22:15:06Z"
}
}
advisories/unreviewed/2024/08/GHSA-423g-mrq6-vpvp/GHSA-423g-mrq6-vpvp.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-423g-mrq6-vpvp",
"modified": "2024-08-16T00:32:05Z",
"published": "2024-08-16T00:32:05Z",
"aliases": [
"CVE-2024-34739"
],
"details": "In shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible escape from SUW due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34739"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/50e1f8f36e32928d10e72324c05a203a6db9f7fb"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-08-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-15T22:15:06Z"
}
}
advisories/unreviewed/2024/08/GHSA-4627-mxfh-2ghm/GHSA-4627-mxfh-2ghm.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4627-mxfh-2ghm",
"modified": "2024-08-16T00:32:05Z",
"published": "2024-08-16T00:32:05Z",
"aliases": [
"CVE-2024-34743"
],
"details": "In setTransactionState of SurfaceFlinger.cpp, there is a possible way to perform tapjacking due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34743"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/native/+/3f85323b27d95a57bfa87cbf68dd4a143f9f88ad"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-08-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-15T22:15:06Z"
}
}
advisories/unreviewed/2024/08/GHSA-4m4w-x26h-2qjx/GHSA-4m4w-x26h-2qjx.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4m4w-x26h-2qjx",
"modified": "2024-08-16T00:32:05Z",
"published": "2024-08-16T00:32:05Z",
"aliases": [
"CVE-2024-34742"
],
"details": "In shouldWrite of OwnersData.java, there is a possible edge case that prevents MDM policies from being persisted due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34742"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/688e5c3012eb0a4ea88361588cf5026c10e4a42c"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-08-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-15T22:15:06Z"
}
}
advisories/unreviewed/2024/08/GHSA-598c-cc55-mwv5/GHSA-598c-cc55-mwv5.json
+55
View File
@@ -0,0 +1,55 @@
{
"schema_version": "1.4.0",
"id": "GHSA-598c-cc55-mwv5",
"modified": "2024-08-16T00:32:05Z",
"published": "2024-08-16T00:32:05Z",
"aliases": [
"CVE-2024-34731"
],
"details": "In multiple functions of TranscodingResourcePolicy.cpp, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34731"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/av/+/4b68b00993849b6a7f0e6d075bc2c8bb2e184e61"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/hardware/interfaces/+/0ff19d1f89614fce9454fb415bcbfcbcf3caf76e"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/hardware/interfaces/+/d63d09261806f7f1aa01406867f2a9e169356fca"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/system/nfc/+/1037992b9abcde1e3560bd895f62644a68563b3d"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/system/security/+/d3805312d73433e34ef69a645b553a2969c5dc93"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-08-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-15T22:15:06Z"
}
}
advisories/unreviewed/2024/08/GHSA-67q8-hw3v-9fj4/GHSA-67q8-hw3v-9fj4.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-67q8-hw3v-9fj4",
"modified": "2024-08-16T00:32:05Z",
"published": "2024-08-16T00:32:05Z",
"aliases": [
"CVE-2024-34734"
],
"details": "In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable the active VPN app from the lockscreen due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34734"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/frameworks/base/+/207584fb6f820eba14251251d7e9331bfd57adb8"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2024-08-01"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-15T22:15:06Z"
}
}

Some files were not shown because too many files have changed in this diff Show More