Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-09-26 21:32:37 +00:00
parent 9905ac0af8
commit efbcd9510e
41 changed files with 309 additions and 69 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8qg9-9fqc-xjj6",
-  "modified": "2024-04-04T06:37:04Z",
+  "modified": "2024-09-26T21:31:09Z",
  "published": "2023-08-08T03:30:15Z",
  "aliases": [
    "CVE-2023-36926"
@@ -33,7 +33,8 @@
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
-      "CWE-287"
+      "CWE-287",
+      "CWE-306"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-200"
+      "CWE-200",
+      "CWE-327"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-200"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-95xr-xpj5-h4g4",
-  "modified": "2024-04-04T07:32:13Z",
+  "modified": "2024-09-26T21:31:10Z",
  "published": "2023-09-06T18:30:42Z",
  "aliases": [
    "CVE-2023-38486"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9v7r-x7cv-v437",
-  "modified": "2023-11-04T03:30:18Z",
+  "modified": "2024-09-26T21:31:10Z",
  "published": "2023-09-08T18:30:29Z",
  "aliases": [
    "CVE-2023-39321"
@@ -36,7 +36,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-284"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-qr3g-7vmg-24hh",
-  "modified": "2024-04-04T07:42:22Z",
+  "modified": "2024-09-26T21:31:10Z",
  "published": "2023-09-15T18:30:30Z",
  "aliases": [
    "CVE-2023-40308"
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-476"
+      "CWE-476",
+      "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -36,7 +36,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-22"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-209"
+      "CWE-209",
+      "CWE-611"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-j64p-69wq-hp65",
-  "modified": "2024-03-12T03:30:46Z",
+  "modified": "2024-09-26T21:31:10Z",
  "published": "2024-03-12T03:30:46Z",
  "aliases": [
    "CVE-2024-22127"
@@ -32,6 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-77",
      "CWE-94"
    ],
    "severity": "CRITICAL",
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-787"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-326r-7r4v-wq8c",
-  "modified": "2024-09-26T09:31:42Z",
+  "modified": "2024-09-26T21:31:11Z",
  "published": "2024-09-26T09:31:42Z",
  "aliases": [
    "CVE-2024-47145"
@@ -1,13 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3f32-jc9w-78m7",
-  "modified": "2024-09-26T18:31:45Z",
+  "modified": "2024-09-26T21:31:11Z",
  "published": "2024-09-26T18:31:45Z",
  "aliases": [
    "CVE-2024-47123"
  ],
  "details": "The goTenna Pro series use AES CTR mode for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to any attacker that can access the message.",
  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N"
+    },
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3j8x-8x9q-3m4r",
+  "modified": "2024-09-26T21:31:11Z",
+  "published": "2024-09-26T21:31:11Z",
+  "aliases": [
+    "CVE-2024-8118"
+  ],
+  "details": "In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8118"
+    },
+    {
+      "type": "WEB",
+      "url": "https://grafana.com/security/security-advisories/cve-2024-8118"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-653"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-26T19:15:07Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3wp8-8gm9-x4mg",
+  "modified": "2024-09-26T21:31:11Z",
+  "published": "2024-09-26T21:31:11Z",
+  "aliases": [
+    "CVE-2024-46628"
+  ],
+  "details": "Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the usbPartitionName parameter in the formSetUSBPartitionUmount function.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46628"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Question-h/vuln/blob/master/Remote%20Code%20Execution%20Vulnerability%20in%20Tenda%20G3%20Router.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-26T20:15:06Z"
+  }
+}
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-59hf-mpf8-pqjh",
-  "modified": "2024-09-26T09:31:42Z",
+  "modified": "2024-09-26T21:31:11Z",
  "published": "2024-09-26T09:31:42Z",
  "aliases": [
    "CVE-2024-47003"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5ggj-j87m-p7xh",
-  "modified": "2024-09-26T09:31:42Z",
+  "modified": "2024-09-26T21:31:11Z",
  "published": "2024-09-26T09:31:42Z",
  "aliases": [
    "CVE-2024-47044"
  ],
  "details": "Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION are vulnerable to insufficient access restrictions for Device Setting pages. If this vulnerability is exploited, an attacker who identified WAN-side IPv6 address may access the product's Device Setting page via WAN-side. Note that, the same products are also provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION, but the vulnerability only affects products subscribed and used in NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION areas.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
  ],
  "affected": [

@@ -47,7 +50,7 @@
    "cwe_ids": [
      "CWE-451"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-26T09:15:02Z"
@@ -1,13 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-6f83-4pfw-m3vj",
-  "modified": "2024-09-19T09:36:03Z",
+  "modified": "2024-09-26T21:31:11Z",
  "published": "2024-09-19T09:36:03Z",
  "aliases": [
    "CVE-2024-47088"
  ],
  "details": "This vulnerability exists in Apex Softcell LD Geo due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack on login OTP, which could lead to gain unauthorized access to other user accounts.",
  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-89"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-79gx-p4g6-75qp",
-  "modified": "2024-09-25T18:31:21Z",
+  "modified": "2024-09-26T21:31:11Z",
  "published": "2024-09-25T18:31:21Z",
  "aliases": [
    "CVE-2024-45750"
  ],
  "details": "An issue in TheGreenBow Windows Standard VPN Client 6.87.108 (and older), Windows Enterprise VPN Client 6.87.109 (and older), Windows Enterprise VPN Client 7.5.007 (and older), Android VPN Client 6.4.5 (and older) VPN Client Linux 3.4 (and older), VPN Client MacOS 2.4.10 (and older) allows a remote attacker to execute arbitrary code via the IKEv2 Authentication phase, it accepts malformed ECDSA signatures and establishes the tunnel.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-287"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-25T18:15:05Z"
--- a/Show More
+++ b/Show More