From efbcd9510e035182fa5e8de0675ec318edc0cef7 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 26 Sep 2024 21:32:37 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-8qg9-9fqc-xjj6.json | 5 ++- .../GHSA-r8qv-5mc6-cp4c.json | 3 +- .../GHSA-5h3v-c93c-9gh7.json | 2 +- .../GHSA-95xr-xpj5-h4g4.json | 2 +- .../GHSA-9v7r-x7cv-v437.json | 2 +- .../GHSA-hrxx-273v-pgj4.json | 2 +- .../GHSA-qr3g-7vmg-24hh.json | 5 ++- .../GHSA-x2jc-989c-47q4.json | 2 +- .../GHSA-9983-52gj-4grg.json | 3 +- .../GHSA-j64p-69wq-hp65.json | 3 +- .../GHSA-qfqw-rh34-r78m.json | 2 +- .../GHSA-326r-7r4v-wq8c.json | 2 +- .../GHSA-3f32-jc9w-78m7.json | 6 ++- .../GHSA-3j8x-8x9q-3m4r.json | 38 +++++++++++++++++ .../GHSA-3wp8-8gm9-x4mg.json | 35 ++++++++++++++++ .../GHSA-59hf-mpf8-pqjh.json | 2 +- .../GHSA-5ggj-j87m-p7xh.json | 9 ++-- .../GHSA-6f83-4pfw-m3vj.json | 6 ++- .../GHSA-6pj4-296c-2375.json | 2 +- .../GHSA-79gx-p4g6-75qp.json | 11 +++-- .../GHSA-7r6c-3p49-xqvv.json | 2 +- .../GHSA-9vgq-8h3w-xj2r.json | 11 +++-- .../GHSA-cwjv-mxfr-rrv9.json | 11 +++-- .../GHSA-f6qm-w5rg-95gh.json | 11 +++-- .../GHSA-f9m9-68wf-ppcf.json | 2 +- .../GHSA-fxq3-rjrf-gqq3.json | 3 +- .../GHSA-g922-hx36-gr43.json | 11 +++-- .../GHSA-gwp5-2fcr-m24v.json | 11 +++-- .../GHSA-j6pg-h597-gcx9.json | 11 +++-- .../GHSA-jg74-mwgw-v6x3.json | 38 +++++++++++++++++ .../GHSA-mrhc-m9q7-2fvp.json | 11 +++-- .../GHSA-mxf3-c3v5-9jpv.json | 6 ++- .../GHSA-qmm9-m4wr-gv24.json | 2 +- .../GHSA-qmr2-j5m9-cq3m.json | 42 +++++++++++++++++++ .../GHSA-qx4c-g8jj-h99q.json | 35 ++++++++++++++++ .../GHSA-rccv-3qjv-c8h5.json | 2 +- .../GHSA-rhfw-c6gf-ccq3.json | 11 +++-- .../GHSA-w37h-c34c-gwjm.json | 2 +- .../GHSA-wpxq-m249-cq6r.json | 2 +- .../GHSA-x6fp-542m-2mr8.json | 1 + .../GHSA-x85h-x3fh-9fpv.json | 11 +++-- 41 files changed, 309 insertions(+), 69 deletions(-) create mode 100644 advisories/unreviewed/2024/09/GHSA-3j8x-8x9q-3m4r/GHSA-3j8x-8x9q-3m4r.json create mode 100644 advisories/unreviewed/2024/09/GHSA-3wp8-8gm9-x4mg/GHSA-3wp8-8gm9-x4mg.json create mode 100644 advisories/unreviewed/2024/09/GHSA-jg74-mwgw-v6x3/GHSA-jg74-mwgw-v6x3.json create mode 100644 advisories/unreviewed/2024/09/GHSA-qmr2-j5m9-cq3m/GHSA-qmr2-j5m9-cq3m.json create mode 100644 advisories/unreviewed/2024/09/GHSA-qx4c-g8jj-h99q/GHSA-qx4c-g8jj-h99q.json diff --git a/advisories/unreviewed/2023/08/GHSA-8qg9-9fqc-xjj6/GHSA-8qg9-9fqc-xjj6.json b/advisories/unreviewed/2023/08/GHSA-8qg9-9fqc-xjj6/GHSA-8qg9-9fqc-xjj6.json index d4cffceb824..a76c926a8ac 100644 --- a/advisories/unreviewed/2023/08/GHSA-8qg9-9fqc-xjj6/GHSA-8qg9-9fqc-xjj6.json +++ b/advisories/unreviewed/2023/08/GHSA-8qg9-9fqc-xjj6/GHSA-8qg9-9fqc-xjj6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-8qg9-9fqc-xjj6", - "modified": "2024-04-04T06:37:04Z", + "modified": "2024-09-26T21:31:09Z", "published": "2023-08-08T03:30:15Z", "aliases": [ "CVE-2023-36926" @@ -33,7 +33,8 @@ "database_specific": { "cwe_ids": [ "CWE-200", - "CWE-287" + "CWE-287", + "CWE-306" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/08/GHSA-r8qv-5mc6-cp4c/GHSA-r8qv-5mc6-cp4c.json b/advisories/unreviewed/2023/08/GHSA-r8qv-5mc6-cp4c/GHSA-r8qv-5mc6-cp4c.json index 8dfb56943c4..b5f962f63ca 100644 --- a/advisories/unreviewed/2023/08/GHSA-r8qv-5mc6-cp4c/GHSA-r8qv-5mc6-cp4c.json +++ b/advisories/unreviewed/2023/08/GHSA-r8qv-5mc6-cp4c/GHSA-r8qv-5mc6-cp4c.json @@ -32,7 +32,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-200" + "CWE-200", + "CWE-327" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/09/GHSA-5h3v-c93c-9gh7/GHSA-5h3v-c93c-9gh7.json b/advisories/unreviewed/2023/09/GHSA-5h3v-c93c-9gh7/GHSA-5h3v-c93c-9gh7.json index 91ebd762616..8667c39abda 100644 --- a/advisories/unreviewed/2023/09/GHSA-5h3v-c93c-9gh7/GHSA-5h3v-c93c-9gh7.json +++ b/advisories/unreviewed/2023/09/GHSA-5h3v-c93c-9gh7/GHSA-5h3v-c93c-9gh7.json @@ -32,7 +32,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-200" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/09/GHSA-95xr-xpj5-h4g4/GHSA-95xr-xpj5-h4g4.json b/advisories/unreviewed/2023/09/GHSA-95xr-xpj5-h4g4/GHSA-95xr-xpj5-h4g4.json index 69b2e2c0a84..1598b78e243 100644 --- a/advisories/unreviewed/2023/09/GHSA-95xr-xpj5-h4g4/GHSA-95xr-xpj5-h4g4.json +++ b/advisories/unreviewed/2023/09/GHSA-95xr-xpj5-h4g4/GHSA-95xr-xpj5-h4g4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-95xr-xpj5-h4g4", - "modified": "2024-04-04T07:32:13Z", + "modified": "2024-09-26T21:31:10Z", "published": "2023-09-06T18:30:42Z", "aliases": [ "CVE-2023-38486" diff --git a/advisories/unreviewed/2023/09/GHSA-9v7r-x7cv-v437/GHSA-9v7r-x7cv-v437.json b/advisories/unreviewed/2023/09/GHSA-9v7r-x7cv-v437/GHSA-9v7r-x7cv-v437.json index 25de76de141..e4046574493 100644 --- a/advisories/unreviewed/2023/09/GHSA-9v7r-x7cv-v437/GHSA-9v7r-x7cv-v437.json +++ b/advisories/unreviewed/2023/09/GHSA-9v7r-x7cv-v437/GHSA-9v7r-x7cv-v437.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9v7r-x7cv-v437", - "modified": "2023-11-04T03:30:18Z", + "modified": "2024-09-26T21:31:10Z", "published": "2023-09-08T18:30:29Z", "aliases": [ "CVE-2023-39321" diff --git a/advisories/unreviewed/2023/09/GHSA-hrxx-273v-pgj4/GHSA-hrxx-273v-pgj4.json b/advisories/unreviewed/2023/09/GHSA-hrxx-273v-pgj4/GHSA-hrxx-273v-pgj4.json index 748948a951e..c753813cccf 100644 --- a/advisories/unreviewed/2023/09/GHSA-hrxx-273v-pgj4/GHSA-hrxx-273v-pgj4.json +++ b/advisories/unreviewed/2023/09/GHSA-hrxx-273v-pgj4/GHSA-hrxx-273v-pgj4.json @@ -36,7 +36,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/09/GHSA-qr3g-7vmg-24hh/GHSA-qr3g-7vmg-24hh.json b/advisories/unreviewed/2023/09/GHSA-qr3g-7vmg-24hh/GHSA-qr3g-7vmg-24hh.json index fafba8db728..339420e04b6 100644 --- a/advisories/unreviewed/2023/09/GHSA-qr3g-7vmg-24hh/GHSA-qr3g-7vmg-24hh.json +++ b/advisories/unreviewed/2023/09/GHSA-qr3g-7vmg-24hh/GHSA-qr3g-7vmg-24hh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qr3g-7vmg-24hh", - "modified": "2024-04-04T07:42:22Z", + "modified": "2024-09-26T21:31:10Z", "published": "2023-09-15T18:30:30Z", "aliases": [ "CVE-2023-40308" @@ -32,7 +32,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-476" + "CWE-476", + "CWE-787" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/09/GHSA-x2jc-989c-47q4/GHSA-x2jc-989c-47q4.json b/advisories/unreviewed/2023/09/GHSA-x2jc-989c-47q4/GHSA-x2jc-989c-47q4.json index 16bfb812cd9..aba316681e7 100644 --- a/advisories/unreviewed/2023/09/GHSA-x2jc-989c-47q4/GHSA-x2jc-989c-47q4.json +++ b/advisories/unreviewed/2023/09/GHSA-x2jc-989c-47q4/GHSA-x2jc-989c-47q4.json @@ -36,7 +36,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-22" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/10/GHSA-9983-52gj-4grg/GHSA-9983-52gj-4grg.json b/advisories/unreviewed/2023/10/GHSA-9983-52gj-4grg/GHSA-9983-52gj-4grg.json index 506b909f248..bf32e8578c1 100644 --- a/advisories/unreviewed/2023/10/GHSA-9983-52gj-4grg/GHSA-9983-52gj-4grg.json +++ b/advisories/unreviewed/2023/10/GHSA-9983-52gj-4grg/GHSA-9983-52gj-4grg.json @@ -32,7 +32,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-209" + "CWE-209", + "CWE-611" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/03/GHSA-j64p-69wq-hp65/GHSA-j64p-69wq-hp65.json b/advisories/unreviewed/2024/03/GHSA-j64p-69wq-hp65/GHSA-j64p-69wq-hp65.json index 09da8f86851..459b27d3fac 100644 --- a/advisories/unreviewed/2024/03/GHSA-j64p-69wq-hp65/GHSA-j64p-69wq-hp65.json +++ b/advisories/unreviewed/2024/03/GHSA-j64p-69wq-hp65/GHSA-j64p-69wq-hp65.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j64p-69wq-hp65", - "modified": "2024-03-12T03:30:46Z", + "modified": "2024-09-26T21:31:10Z", "published": "2024-03-12T03:30:46Z", "aliases": [ "CVE-2024-22127" @@ -32,6 +32,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-77", "CWE-94" ], "severity": "CRITICAL", diff --git a/advisories/unreviewed/2024/05/GHSA-qfqw-rh34-r78m/GHSA-qfqw-rh34-r78m.json b/advisories/unreviewed/2024/05/GHSA-qfqw-rh34-r78m/GHSA-qfqw-rh34-r78m.json index b28923f6e99..e68677d7b9d 100644 --- a/advisories/unreviewed/2024/05/GHSA-qfqw-rh34-r78m/GHSA-qfqw-rh34-r78m.json +++ b/advisories/unreviewed/2024/05/GHSA-qfqw-rh34-r78m/GHSA-qfqw-rh34-r78m.json @@ -32,7 +32,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/09/GHSA-326r-7r4v-wq8c/GHSA-326r-7r4v-wq8c.json b/advisories/unreviewed/2024/09/GHSA-326r-7r4v-wq8c/GHSA-326r-7r4v-wq8c.json index bca431316dd..14fd47f0215 100644 --- a/advisories/unreviewed/2024/09/GHSA-326r-7r4v-wq8c/GHSA-326r-7r4v-wq8c.json +++ b/advisories/unreviewed/2024/09/GHSA-326r-7r4v-wq8c/GHSA-326r-7r4v-wq8c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-326r-7r4v-wq8c", - "modified": "2024-09-26T09:31:42Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-26T09:31:42Z", "aliases": [ "CVE-2024-47145" diff --git a/advisories/unreviewed/2024/09/GHSA-3f32-jc9w-78m7/GHSA-3f32-jc9w-78m7.json b/advisories/unreviewed/2024/09/GHSA-3f32-jc9w-78m7/GHSA-3f32-jc9w-78m7.json index 626565e9d5f..d0ad2c1354e 100644 --- a/advisories/unreviewed/2024/09/GHSA-3f32-jc9w-78m7/GHSA-3f32-jc9w-78m7.json +++ b/advisories/unreviewed/2024/09/GHSA-3f32-jc9w-78m7/GHSA-3f32-jc9w-78m7.json @@ -1,13 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-3f32-jc9w-78m7", - "modified": "2024-09-26T18:31:45Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-26T18:31:45Z", "aliases": [ "CVE-2024-47123" ], "details": "The goTenna Pro series use AES CTR mode for short, encrypted messages without any additional integrity checking mechanisms. This leaves messages malleable to any attacker that can access the message.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" diff --git a/advisories/unreviewed/2024/09/GHSA-3j8x-8x9q-3m4r/GHSA-3j8x-8x9q-3m4r.json b/advisories/unreviewed/2024/09/GHSA-3j8x-8x9q-3m4r/GHSA-3j8x-8x9q-3m4r.json new file mode 100644 index 00000000000..699250f57e8 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-3j8x-8x9q-3m4r/GHSA-3j8x-8x9q-3m4r.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3j8x-8x9q-3m4r", + "modified": "2024-09-26T21:31:11Z", + "published": "2024-09-26T21:31:11Z", + "aliases": [ + "CVE-2024-8118" + ], + "details": "In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8118" + }, + { + "type": "WEB", + "url": "https://grafana.com/security/security-advisories/cve-2024-8118" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-653" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-26T19:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-3wp8-8gm9-x4mg/GHSA-3wp8-8gm9-x4mg.json b/advisories/unreviewed/2024/09/GHSA-3wp8-8gm9-x4mg/GHSA-3wp8-8gm9-x4mg.json new file mode 100644 index 00000000000..06c65cb4542 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-3wp8-8gm9-x4mg/GHSA-3wp8-8gm9-x4mg.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3wp8-8gm9-x4mg", + "modified": "2024-09-26T21:31:11Z", + "published": "2024-09-26T21:31:11Z", + "aliases": [ + "CVE-2024-46628" + ], + "details": "Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the usbPartitionName parameter in the formSetUSBPartitionUmount function.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46628" + }, + { + "type": "WEB", + "url": "https://github.com/Question-h/vuln/blob/master/Remote%20Code%20Execution%20Vulnerability%20in%20Tenda%20G3%20Router.md" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-26T20:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-59hf-mpf8-pqjh/GHSA-59hf-mpf8-pqjh.json b/advisories/unreviewed/2024/09/GHSA-59hf-mpf8-pqjh/GHSA-59hf-mpf8-pqjh.json index 527b15eb73d..1deb6f4b2e9 100644 --- a/advisories/unreviewed/2024/09/GHSA-59hf-mpf8-pqjh/GHSA-59hf-mpf8-pqjh.json +++ b/advisories/unreviewed/2024/09/GHSA-59hf-mpf8-pqjh/GHSA-59hf-mpf8-pqjh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-59hf-mpf8-pqjh", - "modified": "2024-09-26T09:31:42Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-26T09:31:42Z", "aliases": [ "CVE-2024-47003" diff --git a/advisories/unreviewed/2024/09/GHSA-5ggj-j87m-p7xh/GHSA-5ggj-j87m-p7xh.json b/advisories/unreviewed/2024/09/GHSA-5ggj-j87m-p7xh/GHSA-5ggj-j87m-p7xh.json index 091cfbaa4bf..e1d29551cc5 100644 --- a/advisories/unreviewed/2024/09/GHSA-5ggj-j87m-p7xh/GHSA-5ggj-j87m-p7xh.json +++ b/advisories/unreviewed/2024/09/GHSA-5ggj-j87m-p7xh/GHSA-5ggj-j87m-p7xh.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5ggj-j87m-p7xh", - "modified": "2024-09-26T09:31:42Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-26T09:31:42Z", "aliases": [ "CVE-2024-47044" ], "details": "Multiple Home GateWay/Hikari Denwa routers provided by NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION are vulnerable to insufficient access restrictions for Device Setting pages. If this vulnerability is exploited, an attacker who identified WAN-side IPv6 address may access the product's Device Setting page via WAN-side. Note that, the same products are also provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION, but the vulnerability only affects products subscribed and used in NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATION areas.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } ], "affected": [ @@ -47,7 +50,7 @@ "cwe_ids": [ "CWE-451" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-26T09:15:02Z" diff --git a/advisories/unreviewed/2024/09/GHSA-6f83-4pfw-m3vj/GHSA-6f83-4pfw-m3vj.json b/advisories/unreviewed/2024/09/GHSA-6f83-4pfw-m3vj/GHSA-6f83-4pfw-m3vj.json index 37141894b3b..3f823cbe29a 100644 --- a/advisories/unreviewed/2024/09/GHSA-6f83-4pfw-m3vj/GHSA-6f83-4pfw-m3vj.json +++ b/advisories/unreviewed/2024/09/GHSA-6f83-4pfw-m3vj/GHSA-6f83-4pfw-m3vj.json @@ -1,13 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-6f83-4pfw-m3vj", - "modified": "2024-09-19T09:36:03Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-19T09:36:03Z", "aliases": [ "CVE-2024-47088" ], "details": "This vulnerability exists in Apex Softcell LD Geo due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack on login OTP, which could lead to gain unauthorized access to other user accounts.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" diff --git a/advisories/unreviewed/2024/09/GHSA-6pj4-296c-2375/GHSA-6pj4-296c-2375.json b/advisories/unreviewed/2024/09/GHSA-6pj4-296c-2375/GHSA-6pj4-296c-2375.json index fbd64d05710..6d82d03fdfd 100644 --- a/advisories/unreviewed/2024/09/GHSA-6pj4-296c-2375/GHSA-6pj4-296c-2375.json +++ b/advisories/unreviewed/2024/09/GHSA-6pj4-296c-2375/GHSA-6pj4-296c-2375.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/09/GHSA-79gx-p4g6-75qp/GHSA-79gx-p4g6-75qp.json b/advisories/unreviewed/2024/09/GHSA-79gx-p4g6-75qp/GHSA-79gx-p4g6-75qp.json index fb21cccd29c..2452eb31b00 100644 --- a/advisories/unreviewed/2024/09/GHSA-79gx-p4g6-75qp/GHSA-79gx-p4g6-75qp.json +++ b/advisories/unreviewed/2024/09/GHSA-79gx-p4g6-75qp/GHSA-79gx-p4g6-75qp.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-79gx-p4g6-75qp", - "modified": "2024-09-25T18:31:21Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-25T18:31:21Z", "aliases": [ "CVE-2024-45750" ], "details": "An issue in TheGreenBow Windows Standard VPN Client 6.87.108 (and older), Windows Enterprise VPN Client 6.87.109 (and older), Windows Enterprise VPN Client 7.5.007 (and older), Android VPN Client 6.4.5 (and older) VPN Client Linux 3.4 (and older), VPN Client MacOS 2.4.10 (and older) allows a remote attacker to execute arbitrary code via the IKEv2 Authentication phase, it accepts malformed ECDSA signatures and establishes the tunnel.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-287" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-25T18:15:05Z" diff --git a/advisories/unreviewed/2024/09/GHSA-7r6c-3p49-xqvv/GHSA-7r6c-3p49-xqvv.json b/advisories/unreviewed/2024/09/GHSA-7r6c-3p49-xqvv/GHSA-7r6c-3p49-xqvv.json index 86cba292c42..bb2b6b1e548 100644 --- a/advisories/unreviewed/2024/09/GHSA-7r6c-3p49-xqvv/GHSA-7r6c-3p49-xqvv.json +++ b/advisories/unreviewed/2024/09/GHSA-7r6c-3p49-xqvv/GHSA-7r6c-3p49-xqvv.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7r6c-3p49-xqvv", - "modified": "2024-09-13T15:31:35Z", + "modified": "2024-09-26T21:31:10Z", "published": "2024-09-13T15:31:35Z", "aliases": [ "CVE-2024-5870" diff --git a/advisories/unreviewed/2024/09/GHSA-9vgq-8h3w-xj2r/GHSA-9vgq-8h3w-xj2r.json b/advisories/unreviewed/2024/09/GHSA-9vgq-8h3w-xj2r/GHSA-9vgq-8h3w-xj2r.json index 2e0338f7934..915f5d68b8d 100644 --- a/advisories/unreviewed/2024/09/GHSA-9vgq-8h3w-xj2r/GHSA-9vgq-8h3w-xj2r.json +++ b/advisories/unreviewed/2024/09/GHSA-9vgq-8h3w-xj2r/GHSA-9vgq-8h3w-xj2r.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9vgq-8h3w-xj2r", - "modified": "2024-09-26T18:31:44Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-26T18:31:44Z", "aliases": [ "CVE-2024-45983" ], "details": "A Cross-Site Request Forgery (CSRF) vulnerability exists in kishan0725's Hospital Management System version 6.3.5. The vulnerability allows an attacker to craft a malicious HTML form that submits a request to delete a doctor record. By enticing an authenticated admin user to visit the specially crafted web page, the attacker can leverage the victim's browser to make unauthorized requests to the vulnerable endpoint, effectively allowing the attacker to perform actions on behalf of the admin without their consent.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-26T16:15:08Z" diff --git a/advisories/unreviewed/2024/09/GHSA-cwjv-mxfr-rrv9/GHSA-cwjv-mxfr-rrv9.json b/advisories/unreviewed/2024/09/GHSA-cwjv-mxfr-rrv9/GHSA-cwjv-mxfr-rrv9.json index 49c0389fadd..eeae39c5bcd 100644 --- a/advisories/unreviewed/2024/09/GHSA-cwjv-mxfr-rrv9/GHSA-cwjv-mxfr-rrv9.json +++ b/advisories/unreviewed/2024/09/GHSA-cwjv-mxfr-rrv9/GHSA-cwjv-mxfr-rrv9.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-cwjv-mxfr-rrv9", - "modified": "2024-09-26T18:31:44Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-26T18:31:44Z", "aliases": [ "CVE-2024-45981" ], "details": "A host header injection vulnerability in BookReviewLibrary 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-601" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-26T17:15:04Z" diff --git a/advisories/unreviewed/2024/09/GHSA-f6qm-w5rg-95gh/GHSA-f6qm-w5rg-95gh.json b/advisories/unreviewed/2024/09/GHSA-f6qm-w5rg-95gh/GHSA-f6qm-w5rg-95gh.json index 5c4cd11f1cb..7e482e0a262 100644 --- a/advisories/unreviewed/2024/09/GHSA-f6qm-w5rg-95gh/GHSA-f6qm-w5rg-95gh.json +++ b/advisories/unreviewed/2024/09/GHSA-f6qm-w5rg-95gh/GHSA-f6qm-w5rg-95gh.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-f6qm-w5rg-95gh", - "modified": "2024-09-26T18:31:44Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-26T18:31:44Z", "aliases": [ "CVE-2024-45979" ], "details": "A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-601" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-26T17:15:03Z" diff --git a/advisories/unreviewed/2024/09/GHSA-f9m9-68wf-ppcf/GHSA-f9m9-68wf-ppcf.json b/advisories/unreviewed/2024/09/GHSA-f9m9-68wf-ppcf/GHSA-f9m9-68wf-ppcf.json index cc3ef74d411..a9c8609970c 100644 --- a/advisories/unreviewed/2024/09/GHSA-f9m9-68wf-ppcf/GHSA-f9m9-68wf-ppcf.json +++ b/advisories/unreviewed/2024/09/GHSA-f9m9-68wf-ppcf/GHSA-f9m9-68wf-ppcf.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-f9m9-68wf-ppcf", - "modified": "2024-09-13T15:31:35Z", + "modified": "2024-09-26T21:31:10Z", "published": "2024-09-13T15:31:35Z", "aliases": [ "CVE-2024-5884" diff --git a/advisories/unreviewed/2024/09/GHSA-fxq3-rjrf-gqq3/GHSA-fxq3-rjrf-gqq3.json b/advisories/unreviewed/2024/09/GHSA-fxq3-rjrf-gqq3/GHSA-fxq3-rjrf-gqq3.json index e5545c29405..65ac2950222 100644 --- a/advisories/unreviewed/2024/09/GHSA-fxq3-rjrf-gqq3/GHSA-fxq3-rjrf-gqq3.json +++ b/advisories/unreviewed/2024/09/GHSA-fxq3-rjrf-gqq3/GHSA-fxq3-rjrf-gqq3.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-121" + "CWE-121", + "CWE-787" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/09/GHSA-g922-hx36-gr43/GHSA-g922-hx36-gr43.json b/advisories/unreviewed/2024/09/GHSA-g922-hx36-gr43/GHSA-g922-hx36-gr43.json index 3bc15339967..682e62fbdc8 100644 --- a/advisories/unreviewed/2024/09/GHSA-g922-hx36-gr43/GHSA-g922-hx36-gr43.json +++ b/advisories/unreviewed/2024/09/GHSA-g922-hx36-gr43/GHSA-g922-hx36-gr43.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-g922-hx36-gr43", - "modified": "2024-09-26T18:31:45Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-26T18:31:45Z", "aliases": [ "CVE-2024-45984" ], "details": "A Cross Site Scripting (XSS) vulnerability in add_donor.php of Blood Bank And Donation Management System 1.0 allows an attacker to inject malicious scripts that will be executed when the Donor List is viewed.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-26T18:15:08Z" diff --git a/advisories/unreviewed/2024/09/GHSA-gwp5-2fcr-m24v/GHSA-gwp5-2fcr-m24v.json b/advisories/unreviewed/2024/09/GHSA-gwp5-2fcr-m24v/GHSA-gwp5-2fcr-m24v.json index 1f6fb29af9f..5f30d1c9904 100644 --- a/advisories/unreviewed/2024/09/GHSA-gwp5-2fcr-m24v/GHSA-gwp5-2fcr-m24v.json +++ b/advisories/unreviewed/2024/09/GHSA-gwp5-2fcr-m24v/GHSA-gwp5-2fcr-m24v.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-gwp5-2fcr-m24v", - "modified": "2024-09-26T18:31:45Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-26T18:31:45Z", "aliases": [ "CVE-2024-45985" ], "details": "A Cross Site Scripting (XSS) vulnerability in update_contact.php of Blood Bank and Donation Management System v1.0 allows an attacker to inject malicious scripts via the name parameter of the update_contact.php", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-26T18:15:08Z" diff --git a/advisories/unreviewed/2024/09/GHSA-j6pg-h597-gcx9/GHSA-j6pg-h597-gcx9.json b/advisories/unreviewed/2024/09/GHSA-j6pg-h597-gcx9/GHSA-j6pg-h597-gcx9.json index 9e5c55d26af..6c43afb4c1b 100644 --- a/advisories/unreviewed/2024/09/GHSA-j6pg-h597-gcx9/GHSA-j6pg-h597-gcx9.json +++ b/advisories/unreviewed/2024/09/GHSA-j6pg-h597-gcx9/GHSA-j6pg-h597-gcx9.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-j6pg-h597-gcx9", - "modified": "2024-09-26T18:31:44Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-26T18:31:44Z", "aliases": [ "CVE-2024-45980" ], "details": "A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This allows attackers to arbitrarily reset other users' passwords and compromise their accounts.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-640" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-26T17:15:03Z" diff --git a/advisories/unreviewed/2024/09/GHSA-jg74-mwgw-v6x3/GHSA-jg74-mwgw-v6x3.json b/advisories/unreviewed/2024/09/GHSA-jg74-mwgw-v6x3/GHSA-jg74-mwgw-v6x3.json new file mode 100644 index 00000000000..14cee84dfe0 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-jg74-mwgw-v6x3/GHSA-jg74-mwgw-v6x3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jg74-mwgw-v6x3", + "modified": "2024-09-26T21:31:11Z", + "published": "2024-09-26T21:31:11Z", + "aliases": [ + "CVE-2024-7594" + ], + "details": "Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7594" + }, + { + "type": "WEB", + "url": "https://discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/70251" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-732" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-26T20:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-mrhc-m9q7-2fvp/GHSA-mrhc-m9q7-2fvp.json b/advisories/unreviewed/2024/09/GHSA-mrhc-m9q7-2fvp/GHSA-mrhc-m9q7-2fvp.json index fc6895ff4df..3179dcb1206 100644 --- a/advisories/unreviewed/2024/09/GHSA-mrhc-m9q7-2fvp/GHSA-mrhc-m9q7-2fvp.json +++ b/advisories/unreviewed/2024/09/GHSA-mrhc-m9q7-2fvp/GHSA-mrhc-m9q7-2fvp.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mrhc-m9q7-2fvp", - "modified": "2024-09-26T18:31:44Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-26T18:31:44Z", "aliases": [ "CVE-2024-41605" ], "details": "An issue in Foxit Software Foxit PDF Reader v.2024.2.2.25170 allows a local attacker to execute arbitrary code via the FoxitPDFReaderUpdater.exe component", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-26T16:15:08Z" diff --git a/advisories/unreviewed/2024/09/GHSA-mxf3-c3v5-9jpv/GHSA-mxf3-c3v5-9jpv.json b/advisories/unreviewed/2024/09/GHSA-mxf3-c3v5-9jpv/GHSA-mxf3-c3v5-9jpv.json index 31453fdc991..d6619cd1937 100644 --- a/advisories/unreviewed/2024/09/GHSA-mxf3-c3v5-9jpv/GHSA-mxf3-c3v5-9jpv.json +++ b/advisories/unreviewed/2024/09/GHSA-mxf3-c3v5-9jpv/GHSA-mxf3-c3v5-9jpv.json @@ -1,13 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mxf3-c3v5-9jpv", - "modified": "2024-09-19T09:36:03Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-19T09:36:03Z", "aliases": [ "CVE-2024-47089" ], "details": "This vulnerability exists in the Apex Softcell LD Geo due to improper validation of the transaction token ID in the API endpoint. An authenticated remote attacker could exploit this vulnerability by manipulating the transaction token ID in the API request leading to unauthorized access and modification of transactions belonging to other users.", "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + }, { "type": "CVSS_V4", "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" diff --git a/advisories/unreviewed/2024/09/GHSA-qmm9-m4wr-gv24/GHSA-qmm9-m4wr-gv24.json b/advisories/unreviewed/2024/09/GHSA-qmm9-m4wr-gv24/GHSA-qmm9-m4wr-gv24.json index 784bb917312..18012673c2e 100644 --- a/advisories/unreviewed/2024/09/GHSA-qmm9-m4wr-gv24/GHSA-qmm9-m4wr-gv24.json +++ b/advisories/unreviewed/2024/09/GHSA-qmm9-m4wr-gv24/GHSA-qmm9-m4wr-gv24.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/09/GHSA-qmr2-j5m9-cq3m/GHSA-qmr2-j5m9-cq3m.json b/advisories/unreviewed/2024/09/GHSA-qmr2-j5m9-cq3m/GHSA-qmr2-j5m9-cq3m.json new file mode 100644 index 00000000000..92227eced63 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-qmr2-j5m9-cq3m/GHSA-qmr2-j5m9-cq3m.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qmr2-j5m9-cq3m", + "modified": "2024-09-26T21:31:11Z", + "published": "2024-09-26T21:31:11Z", + "aliases": [ + "CVE-2024-6769" + ], + "details": "A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated attacker to elevate from a medium integrity process to a high integrity process without the intervention of a UAC prompt.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6769" + }, + { + "type": "WEB", + "url": "https://www.fortra.com/security/advisories/research/fr-2024-002" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-426" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-26T21:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-qx4c-g8jj-h99q/GHSA-qx4c-g8jj-h99q.json b/advisories/unreviewed/2024/09/GHSA-qx4c-g8jj-h99q/GHSA-qx4c-g8jj-h99q.json new file mode 100644 index 00000000000..9020205bea7 --- /dev/null +++ b/advisories/unreviewed/2024/09/GHSA-qx4c-g8jj-h99q/GHSA-qx4c-g8jj-h99q.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qx4c-g8jj-h99q", + "modified": "2024-09-26T21:31:11Z", + "published": "2024-09-26T21:31:11Z", + "aliases": [ + "CVE-2024-45986" + ], + "details": "A stored Cross-Site Scripting (XSS) vulnerability was identified in Projectworld Online Voting System 1.0 that occurs when an account is registered with a malicious javascript payload. The payload is stored and subsequently executed in the voter.php and profile.php pages whenever the account information is accessed.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45986" + }, + { + "type": "WEB", + "url": "https://github.com/soursec/CVEs/tree/main/CVE-2024-45986" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-09-26T21:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/09/GHSA-rccv-3qjv-c8h5/GHSA-rccv-3qjv-c8h5.json b/advisories/unreviewed/2024/09/GHSA-rccv-3qjv-c8h5/GHSA-rccv-3qjv-c8h5.json index 40dcd8d627e..fe1d41a1aee 100644 --- a/advisories/unreviewed/2024/09/GHSA-rccv-3qjv-c8h5/GHSA-rccv-3qjv-c8h5.json +++ b/advisories/unreviewed/2024/09/GHSA-rccv-3qjv-c8h5/GHSA-rccv-3qjv-c8h5.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/09/GHSA-rhfw-c6gf-ccq3/GHSA-rhfw-c6gf-ccq3.json b/advisories/unreviewed/2024/09/GHSA-rhfw-c6gf-ccq3/GHSA-rhfw-c6gf-ccq3.json index cc0754f9243..3cedd091321 100644 --- a/advisories/unreviewed/2024/09/GHSA-rhfw-c6gf-ccq3/GHSA-rhfw-c6gf-ccq3.json +++ b/advisories/unreviewed/2024/09/GHSA-rhfw-c6gf-ccq3/GHSA-rhfw-c6gf-ccq3.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rhfw-c6gf-ccq3", - "modified": "2024-09-26T18:31:44Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-26T18:31:44Z", "aliases": [ "CVE-2024-46632" ], "details": "Assimp v5.4.3 is vulnerable to Buffer Overflow via the MD5Importer::LoadMD5MeshFile function.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-122" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-26T16:15:08Z" diff --git a/advisories/unreviewed/2024/09/GHSA-w37h-c34c-gwjm/GHSA-w37h-c34c-gwjm.json b/advisories/unreviewed/2024/09/GHSA-w37h-c34c-gwjm/GHSA-w37h-c34c-gwjm.json index acff2a111cf..50f2ab3d76d 100644 --- a/advisories/unreviewed/2024/09/GHSA-w37h-c34c-gwjm/GHSA-w37h-c34c-gwjm.json +++ b/advisories/unreviewed/2024/09/GHSA-w37h-c34c-gwjm/GHSA-w37h-c34c-gwjm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-w37h-c34c-gwjm", - "modified": "2024-09-26T09:31:41Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-26T09:31:41Z", "aliases": [ "CVE-2024-45843" diff --git a/advisories/unreviewed/2024/09/GHSA-wpxq-m249-cq6r/GHSA-wpxq-m249-cq6r.json b/advisories/unreviewed/2024/09/GHSA-wpxq-m249-cq6r/GHSA-wpxq-m249-cq6r.json index 4a2cb60b114..c8147315e04 100644 --- a/advisories/unreviewed/2024/09/GHSA-wpxq-m249-cq6r/GHSA-wpxq-m249-cq6r.json +++ b/advisories/unreviewed/2024/09/GHSA-wpxq-m249-cq6r/GHSA-wpxq-m249-cq6r.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/09/GHSA-x6fp-542m-2mr8/GHSA-x6fp-542m-2mr8.json b/advisories/unreviewed/2024/09/GHSA-x6fp-542m-2mr8/GHSA-x6fp-542m-2mr8.json index 6ea00d8ff0f..4a97eb80647 100644 --- a/advisories/unreviewed/2024/09/GHSA-x6fp-542m-2mr8/GHSA-x6fp-542m-2mr8.json +++ b/advisories/unreviewed/2024/09/GHSA-x6fp-542m-2mr8/GHSA-x6fp-542m-2mr8.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-476", "CWE-704" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2024/09/GHSA-x85h-x3fh-9fpv/GHSA-x85h-x3fh-9fpv.json b/advisories/unreviewed/2024/09/GHSA-x85h-x3fh-9fpv/GHSA-x85h-x3fh-9fpv.json index 1cee784aff8..69edd4ace70 100644 --- a/advisories/unreviewed/2024/09/GHSA-x85h-x3fh-9fpv/GHSA-x85h-x3fh-9fpv.json +++ b/advisories/unreviewed/2024/09/GHSA-x85h-x3fh-9fpv/GHSA-x85h-x3fh-9fpv.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-x85h-x3fh-9fpv", - "modified": "2024-09-26T18:31:44Z", + "modified": "2024-09-26T21:31:11Z", "published": "2024-09-26T18:31:44Z", "aliases": [ "CVE-2024-44860" ], "details": "An information disclosure vulnerability in the /Letter/PrintQr/ endpoint of Solvait v24.4.2 allows attackers to access sensitive data via a crafted request.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-09-26T17:15:03Z"