netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-5794-c2rx-p78w
GHSA-wf34-wc7h-9ffx
GHSA-mqr3-mxfg-8rw7
GHSA-6x75-c972-w59f
GHSA-mqx4-g9cq-jvc6
GHSA-q447-8rfw-f6hh
GHSA-rfq8-469g-mx7f
GHSA-hpj4-v4gg-8xfh
GHSA-p4w9-8j85-2xw6
GHSA-gqv4-535f-vxpp
GHSA-4jq7-4qmf-m333
GHSA-4wrc-8xjh-v948
GHSA-6fqv-gvfg-wqrx
GHSA-7jcc-v4g6-5284
GHSA-rmh7-px2g-m7q9
This commit is contained in:
advisory-database[bot]
2024-08-22 00:32:31 +00:00
parent 77791ecdcb
commit f623e630b6
15 changed files with 119 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/02/GHSA-5794-c2rx-p78w/GHSA-5794-c2rx-p78w.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5794-c2rx-p78w",
"modified": "2024-02-16T03:30:51Z",
"modified": "2024-08-22T00:31:02Z",
"published": "2024-02-16T03:30:51Z",
"aliases": [
"CVE-2024-0036"
],
"details": "In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-16T02:15:51Z"
advisories/unreviewed/2024/02/GHSA-wf34-wc7h-9ffx/GHSA-wf34-wc7h-9ffx.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wf34-wc7h-9ffx",
"modified": "2024-02-16T00:30:28Z",
"modified": "2024-08-22T00:31:02Z",
"published": "2024-02-16T00:30:28Z",
"aliases": [
"CVE-2023-40107"
],
"details": "In ARTPWriter of ARTPWriter.cpp, there is a possible use after free due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-15T23:15:08Z"
advisories/unreviewed/2024/03/GHSA-mqr3-mxfg-8rw7/GHSA-mqr3-mxfg-8rw7.json
+1 -1
View File
@@ -36,7 +36,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/04/GHSA-6x75-c972-w59f/GHSA-6x75-c972-w59f.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6x75-c972-w59f",
"modified": "2024-04-03T18:30:40Z",
"modified": "2024-08-22T00:31:02Z",
"published": "2024-04-03T18:30:40Z",
"aliases": [
"CVE-2023-44039"
],
"details": "In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO key) to register their FIDO authenticator to a victim’s account and consequently take over the account.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-03T16:15:07Z"
advisories/unreviewed/2024/04/GHSA-mqx4-g9cq-jvc6/GHSA-mqx4-g9cq-jvc6.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mqx4-g9cq-jvc6",
"modified": "2024-04-01T06:30:31Z",
"modified": "2024-08-22T00:31:02Z",
"published": "2024-04-01T06:30:31Z",
"aliases": [
"CVE-2024-2262"
],
"details": "Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-01T05:15:07Z"
advisories/unreviewed/2024/04/GHSA-q447-8rfw-f6hh/GHSA-q447-8rfw-f6hh.json
+1 -1
View File
@@ -28,7 +28,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/04/GHSA-rfq8-469g-mx7f/GHSA-rfq8-469g-mx7f.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rfq8-469g-mx7f",
"modified": "2024-04-10T15:30:40Z",
"modified": "2024-08-22T00:31:02Z",
"published": "2024-04-10T15:30:40Z",
"aliases": [
"CVE-2024-27474"
],
"details": "Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-10T15:16:04Z"
advisories/unreviewed/2024/05/GHSA-hpj4-v4gg-8xfh/GHSA-hpj4-v4gg-8xfh.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hpj4-v4gg-8xfh",
"modified": "2024-05-14T18:30:52Z",
"modified": "2024-08-22T00:31:02Z",
"published": "2024-05-14T18:30:52Z",
"aliases": [
"CVE-2024-3590"
],
"details": "The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as delete arbitrary subscribers",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T15:41:54Z"
advisories/unreviewed/2024/05/GHSA-p4w9-8j85-2xw6/GHSA-p4w9-8j85-2xw6.json
+6 -3
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p4w9-8j85-2xw6",
"modified": "2024-05-22T18:30:40Z",
"modified": "2024-08-22T00:31:02Z",
"published": "2024-05-22T18:30:40Z",
"aliases": [
"CVE-2024-33227"
],
"details": "An issue in the component ddcdrv.sys of Nicomsoft WinI2C/DDC v3.7.4.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -27,7 +30,7 @@
"cwe_ids": [
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-22T16:15:10Z"
advisories/unreviewed/2024/07/GHSA-gqv4-535f-vxpp/GHSA-gqv4-535f-vxpp.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gqv4-535f-vxpp",
"modified": "2024-07-31T21:32:37Z",
"modified": "2024-08-22T00:31:02Z",
"published": "2024-07-31T21:32:37Z",
"aliases": [
"CVE-2024-41630"
],
"details": "Stack-based buffer overflow vulnerability in Tenda AC18 V15.03.3.10_EN allows a remote attacker to execute arbitrary code via the ssid parameter at ip/goform/fast_setting_wifi_set.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L"
}
],
"affected": [
@@ -33,9 +36,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T19:15:12Z"
advisories/unreviewed/2024/08/GHSA-4jq7-4qmf-m333/GHSA-4jq7-4qmf-m333.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4jq7-4qmf-m333",
"modified": "2024-08-22T00:31:03Z",
"published": "2024-08-22T00:31:03Z",
"aliases": [
"CVE-2024-28987"
],
"details": "The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28987"
},
{
"type": "WEB",
"url": "https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2"
},
{
"type": "WEB",
"url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987"
}
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-21T22:15:04Z"
}
}
advisories/unreviewed/2024/08/GHSA-4wrc-8xjh-v948/GHSA-4wrc-8xjh-v948.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4wrc-8xjh-v948",
"modified": "2024-08-21T18:31:28Z",
"modified": "2024-08-22T00:31:02Z",
"published": "2024-08-21T18:31:28Z",
"aliases": [
"CVE-2023-29929"
],
"details": "Buffer Overflow vulnerability found in Kemptechnologies Loadmaster before v.7.2.60.0 allows a remote attacker to casue a denial of service via the libkemplink.so, isreverse library.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-21T18:15:09Z"
advisories/unreviewed/2024/08/GHSA-6fqv-gvfg-wqrx/GHSA-6fqv-gvfg-wqrx.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6fqv-gvfg-wqrx",
"modified": "2024-08-21T18:31:28Z",
"modified": "2024-08-22T00:31:02Z",
"published": "2024-08-21T18:31:28Z",
"aliases": [
"CVE-2024-42786"
],
"details": "A SQL injection vulnerability in \"/music/view_user.php\" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the \"id\" parameter of View User Profile Page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-21T18:15:10Z"
advisories/unreviewed/2024/08/GHSA-7jcc-v4g6-5284/GHSA-7jcc-v4g6-5284.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7jcc-v4g6-5284",
"modified": "2024-08-21T18:31:28Z",
"modified": "2024-08-22T00:31:02Z",
"published": "2024-08-21T18:31:28Z",
"aliases": [
"CVE-2024-42777"
],
"details": "An Unrestricted file upload vulnerability was found in \"/music/ajax.php?action=signup\" of Kashipara Music Management System v1.0, which allows attackers to execute arbitrary code via uploading a crafted PHP file.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-21T18:15:09Z"
advisories/unreviewed/2024/08/GHSA-rmh7-px2g-m7q9/GHSA-rmh7-px2g-m7q9.json
+1 -1
View File
@@ -32,7 +32,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "CRITICAL",
"github_reviewed": false,