Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-09-10 15:32:26 +00:00
parent 5eaa960567
commit f5b859f145
34 changed files with 1005 additions and 24 deletions
@@ -40,7 +40,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-125"
    ],
    "severity": "LOW",
    "github_reviewed": false,
@@ -1,13 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-g638-3qxw-g3gp",
-  "modified": "2024-07-16T18:31:42Z",
+  "modified": "2024-09-10T15:31:03Z",
  "published": "2024-07-16T18:31:42Z",
  "aliases": [
    "CVE-2024-6089"
  ],
  "details": "An input validation vulnerability exists in the Rockwell Automation 5015 - AENFTXT when a manipulated PTP packet is sent, causing the secondary adapter to result in a major nonrecoverable fault. If exploited, a power cycle is required to recover the product.",
  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    },
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-j73p-gc9r-3pf8",
-  "modified": "2024-07-22T15:32:39Z",
+  "modified": "2024-09-10T15:31:03Z",
  "published": "2024-07-22T12:30:36Z",
  "aliases": [
    "CVE-2024-34457"
  ],
  "details": "On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authorization token to view everyone's user flink information, including executeSQL and config.\n\nMitigation:\n\nall users should upgrade to 2.1.4\n\n",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -29,9 +32,10 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-269"
+      "CWE-269",
+      "CWE-639"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-22T10:15:03Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-vhqm-6frc-f35m",
-  "modified": "2024-07-17T09:30:49Z",
+  "modified": "2024-09-10T15:31:03Z",
  "published": "2024-07-17T09:30:49Z",
  "aliases": [
    "CVE-2024-40617"
  ],
  "details": "Path traversal vulnerability exists in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS). If a remote authenticated attacker with User Class privilege sends a specially crafted request to the affected product, access restricted files containing sensitive information may be accessed. As a result, Administrator Class privileges of the product may be hijacked.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-22"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-17T09:15:03Z"
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-122"
+      "CWE-122",
+      "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,13 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-23q7-9vq5-jc43",
-  "modified": "2024-09-10T12:30:38Z",
+  "modified": "2024-09-10T15:31:04Z",
  "published": "2024-09-10T12:30:38Z",
  "aliases": [
    "CVE-2024-40754"
  ],
  "details": "Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine allows Overflow Buffers.This issue affects Escargot: 4.0.0.",
  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
@@ -0,0 +1,47 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2h5m-ffc8-9ffr",
+  "modified": "2024-09-10T15:31:04Z",
+  "published": "2024-09-10T15:31:04Z",
+  "aliases": [
+    "CVE-2024-37728"
+  ],
+  "details": "Arbitrary File Read vulnerability in Xi'an Daxi Information Technology Co., Ltd OfficeWeb365 v.7.18.23.0 and v8.6.1.0 allows a remote attacker to obtain sensitive information via the \"Pic/Indexes\" interface",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37728"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/wy876/POC/blob/main/OfficeWeb365/OfficeWeb365_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/xuetang1125/OfficeWeb365/blob/main/OfficeWeb365_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E6%BC%8F%E6%B4%9E%20.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://ti.qianxin.com/vulnerability/notice-list?value=officeweb365"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.cnnvd.org.cn/home/warn"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-10T14:15:12Z"
+  }
+}
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3g3x-qrhw-j5jj",
+  "modified": "2024-09-10T15:31:04Z",
+  "published": "2024-09-10T15:31:04Z",
+  "aliases": [
+    "CVE-2023-37230"
+  ],
+  "details": "Loftware Spectrum (testDeviceConnection) before 5.1 allows SSRF.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37230"
+    },
+    {
+      "type": "WEB",
+      "url": "https://code-white.com"
+    },
+    {
+      "type": "WEB",
+      "url": "https://code-white.com/public-vulnerability-list"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-10T14:15:12Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4r99-7p57-xjr3",
+  "modified": "2024-09-10T15:31:05Z",
+  "published": "2024-09-10T15:31:05Z",
+  "aliases": [
+    "CVE-2024-36511"
+  ],
+  "details": "An improperly implemented security check for standard vulnerability [CWE-358] in FortiADC Web Application Firewall (WAF) 7.4.0 through 7.4.4, 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions, 6.0 all versions when cookie security policy is enabled may allow an attacker, under specific conditions, to retrieve the initial encrypted and signed cookie protected by the feature",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36511"
+    },
+    {
+      "type": "WEB",
+      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-22-256"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-358"
+    ],
+    "severity": "LOW",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-10T15:15:16Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5f48-j349-fj3m",
+  "modified": "2024-09-10T15:31:04Z",
+  "published": "2024-09-10T15:31:04Z",
+  "aliases": [
+    "CVE-2024-23184"
+  ],
+  "details": "Having a large number of address headers (From, To, Cc, Bcc, etc.) becomes excessively CPU intensive. With 100k header lines CPU usage is already 12 seconds, and in a production environment we observed 500k header lines taking 18 minutes to parse. Since this can be triggered by external actors sending emails to a victim, this is a security issue. An external attacker can send specially crafted messages that consume target system resources and cause outage. One can implement restrictions on address headers on MTA component preceding Dovecot. No publicly available exploits are known.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23184"
+    },
+    {
+      "type": "WEB",
+      "url": "https://documentation.open-xchange.com/dovecot/security/advisories/csaf/2024/oxdc-adv-2024-0002.json"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-770"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-10T15:15:14Z"
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-69wq-4pfq-hqxh",
-  "modified": "2024-09-08T06:30:33Z",
+  "modified": "2024-09-10T15:31:03Z",
  "published": "2024-09-08T06:30:33Z",
  "aliases": [
    "CVE-2024-6928"
  ],
  "details": "The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-08T06:15:02Z"
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-82mg-vc5c-pcm3",
+  "modified": "2024-09-10T15:31:04Z",
+  "published": "2024-09-10T15:31:04Z",
+  "aliases": [
+    "CVE-2023-37229"
+  ],
+  "details": "Loftware Spectrum before 5.1 allows SSRF.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37229"
+    },
+    {
+      "type": "WEB",
+      "url": "https://code-white.com"
+    },
+    {
+      "type": "WEB",
+      "url": "https://code-white.com/public-vulnerability-list"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-10T14:15:12Z"
+  }
+}
@@ -0,0 +1,43 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8635-cr25-p8xq",
+  "modified": "2024-09-10T15:31:04Z",
+  "published": "2024-09-10T15:31:04Z",
+  "aliases": [
+    "CVE-2023-37226"
+  ],
+  "details": "Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37226"
+    },
+    {
+      "type": "WEB",
+      "url": "https://code-white.com"
+    },
+    {
+      "type": "WEB",
+      "url": "https://code-white.com/public-vulnerability-list"
+    },
+    {
+      "type": "WEB",
+      "url": "https://docs.loftware.com/spectrum-releasenotes/Content/Hotfix/4.6_HF14.htm"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-10T14:15:11Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8832-5jj9-833x",
+  "modified": "2024-09-10T15:31:04Z",
+  "published": "2024-09-10T15:31:04Z",
+  "aliases": [
+    "CVE-2024-21753"
+  ],
+  "details": "A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiClientEMS versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.13, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8, 1.2.1 through 1.2.5 allows attacker to perform a denial of service, read or write a limited number of files via specially crafted HTTP requests",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21753"
+    },
+    {
+      "type": "WEB",
+      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-362"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-10T15:15:14Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8g2h-4x5w-4v4p",
+  "modified": "2024-09-10T15:31:05Z",
+  "published": "2024-09-10T15:31:05Z",
+  "aliases": [
+    "CVE-2024-42423"
+  ],
+  "details": "Citrix Workspace App version 23.9.0.24.4 on Dell ThinOS 2311 contains an Incorrect Authorization vulnerability when Citrix CEB is enabled for WebLogin. A local unauthenticated user with low privileges may potentially exploit this vulnerability to bypass existing controls and perform unauthorized actions leading to information disclosure and tampering.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42423"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.dell.com/support/kbdoc/en-us/000225289/dsa-2024-229-security-update-for-dell-thinos-vulnerabilities"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-863"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-10T15:15:17Z"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8j7x-j8g8-g329",
+  "modified": "2024-09-10T15:31:05Z",
+  "published": "2024-09-10T15:31:05Z",
+  "aliases": [
+    "CVE-2024-27257"
+  ],
+  "details": "IBM OpenPages 8.3 and 9.0 potentially exposes information about client-side source code through use of JavaScript source maps to unauthorized users.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27257"
+    },
+    {
+      "type": "WEB",
+      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/283966"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.ibm.com/support/pages/node/7167702"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-540"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-10T15:15:15Z"
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c4p9-95wg-q39w",
-  "modified": "2024-09-09T21:31:23Z",
+  "modified": "2024-09-10T15:31:04Z",
  "published": "2024-09-09T21:31:23Z",
  "aliases": [
    "CVE-2024-44411"
  ],
  "details": "D-Link DI-8300 v16.07.26A1 is vulnerable to command injection via the msp_info_htm function.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -33,9 +36,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-94"
    ],
-    "severity": null,
+    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-09T21:15:11Z"
@@ -0,0 +1,43 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cgp2-rgv5-7hcp",
+  "modified": "2024-09-10T15:31:04Z",
+  "published": "2024-09-10T15:31:04Z",
+  "aliases": [
+    "CVE-2023-37227"
+  ],
+  "details": "Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37227"
+    },
+    {
+      "type": "WEB",
+      "url": "https://code-white.com"
+    },
+    {
+      "type": "WEB",
+      "url": "https://code-white.com/public-vulnerability-list"
+    },
+    {
+      "type": "WEB",
+      "url": "https://docs.loftware.com/spectrum-releasenotes/Content/Hotfix/4.6_HF13.htm"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-10T14:15:12Z"
+  }
+}
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cqpj-cqf7-q68j",
+  "modified": "2024-09-10T15:31:04Z",
+  "published": "2024-09-10T15:31:04Z",
+  "aliases": [
+    "CVE-2024-44867"
+  ],
+  "details": "phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44867"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ChengZyin/CVE-2024-44867/blob/main/CVE-2024-44867.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ChengZyin/Exploit/blob/ChengZyin-patch-1/README.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-10T14:15:13Z"
+  }
+}
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-121"
+      "CWE-121",
+      "CWE-787"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
--- a/Show More
+++ b/Show More