From f623e630b6a9586e4be54f7db2f833538bb41dc9 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 22 Aug 2024 00:32:31 +0000 Subject: [PATCH] Publish Advisories GHSA-5794-c2rx-p78w GHSA-wf34-wc7h-9ffx GHSA-mqr3-mxfg-8rw7 GHSA-6x75-c972-w59f GHSA-mqx4-g9cq-jvc6 GHSA-q447-8rfw-f6hh GHSA-rfq8-469g-mx7f GHSA-hpj4-v4gg-8xfh GHSA-p4w9-8j85-2xw6 GHSA-gqv4-535f-vxpp GHSA-4jq7-4qmf-m333 GHSA-4wrc-8xjh-v948 GHSA-6fqv-gvfg-wqrx GHSA-7jcc-v4g6-5284 GHSA-rmh7-px2g-m7q9 --- .../GHSA-5794-c2rx-p78w.json | 11 +++-- .../GHSA-wf34-wc7h-9ffx.json | 11 +++-- .../GHSA-mqr3-mxfg-8rw7.json | 2 +- .../GHSA-6x75-c972-w59f.json | 11 +++-- .../GHSA-mqx4-g9cq-jvc6.json | 9 ++-- .../GHSA-q447-8rfw-f6hh.json | 2 +- .../GHSA-rfq8-469g-mx7f.json | 11 +++-- .../GHSA-hpj4-v4gg-8xfh.json | 9 ++-- .../GHSA-p4w9-8j85-2xw6.json | 9 ++-- .../GHSA-gqv4-535f-vxpp.json | 11 +++-- .../GHSA-4jq7-4qmf-m333.json | 42 +++++++++++++++++++ .../GHSA-4wrc-8xjh-v948.json | 11 +++-- .../GHSA-6fqv-gvfg-wqrx.json | 11 +++-- .../GHSA-7jcc-v4g6-5284.json | 11 +++-- .../GHSA-rmh7-px2g-m7q9.json | 2 +- 15 files changed, 119 insertions(+), 44 deletions(-) create mode 100644 advisories/unreviewed/2024/08/GHSA-4jq7-4qmf-m333/GHSA-4jq7-4qmf-m333.json diff --git a/advisories/unreviewed/2024/02/GHSA-5794-c2rx-p78w/GHSA-5794-c2rx-p78w.json b/advisories/unreviewed/2024/02/GHSA-5794-c2rx-p78w/GHSA-5794-c2rx-p78w.json index 76141d27ce3..0e34297aaec 100644 --- a/advisories/unreviewed/2024/02/GHSA-5794-c2rx-p78w/GHSA-5794-c2rx-p78w.json +++ b/advisories/unreviewed/2024/02/GHSA-5794-c2rx-p78w/GHSA-5794-c2rx-p78w.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5794-c2rx-p78w", - "modified": "2024-02-16T03:30:51Z", + "modified": "2024-08-22T00:31:02Z", "published": "2024-02-16T03:30:51Z", "aliases": [ "CVE-2024-0036" ], "details": "In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-16T02:15:51Z" diff --git a/advisories/unreviewed/2024/02/GHSA-wf34-wc7h-9ffx/GHSA-wf34-wc7h-9ffx.json b/advisories/unreviewed/2024/02/GHSA-wf34-wc7h-9ffx/GHSA-wf34-wc7h-9ffx.json index 2dfbbb2f333..f144666f621 100644 --- a/advisories/unreviewed/2024/02/GHSA-wf34-wc7h-9ffx/GHSA-wf34-wc7h-9ffx.json +++ b/advisories/unreviewed/2024/02/GHSA-wf34-wc7h-9ffx/GHSA-wf34-wc7h-9ffx.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-wf34-wc7h-9ffx", - "modified": "2024-02-16T00:30:28Z", + "modified": "2024-08-22T00:31:02Z", "published": "2024-02-16T00:30:28Z", "aliases": [ "CVE-2023-40107" ], "details": "In ARTPWriter of ARTPWriter.cpp, there is a possible use after free due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-15T23:15:08Z" diff --git a/advisories/unreviewed/2024/03/GHSA-mqr3-mxfg-8rw7/GHSA-mqr3-mxfg-8rw7.json b/advisories/unreviewed/2024/03/GHSA-mqr3-mxfg-8rw7/GHSA-mqr3-mxfg-8rw7.json index 65f7def0325..5f0e9061189 100644 --- a/advisories/unreviewed/2024/03/GHSA-mqr3-mxfg-8rw7/GHSA-mqr3-mxfg-8rw7.json +++ b/advisories/unreviewed/2024/03/GHSA-mqr3-mxfg-8rw7/GHSA-mqr3-mxfg-8rw7.json @@ -36,7 +36,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/04/GHSA-6x75-c972-w59f/GHSA-6x75-c972-w59f.json b/advisories/unreviewed/2024/04/GHSA-6x75-c972-w59f/GHSA-6x75-c972-w59f.json index e841f540959..6fa881b70a0 100644 --- a/advisories/unreviewed/2024/04/GHSA-6x75-c972-w59f/GHSA-6x75-c972-w59f.json +++ b/advisories/unreviewed/2024/04/GHSA-6x75-c972-w59f/GHSA-6x75-c972-w59f.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-6x75-c972-w59f", - "modified": "2024-04-03T18:30:40Z", + "modified": "2024-08-22T00:31:02Z", "published": "2024-04-03T18:30:40Z", "aliases": [ "CVE-2023-44039" ], "details": "In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO key) to register their FIDO authenticator to a victim’s account and consequently take over the account.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-287" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-03T16:15:07Z" diff --git a/advisories/unreviewed/2024/04/GHSA-mqx4-g9cq-jvc6/GHSA-mqx4-g9cq-jvc6.json b/advisories/unreviewed/2024/04/GHSA-mqx4-g9cq-jvc6/GHSA-mqx4-g9cq-jvc6.json index 189a72d7558..91b8dab319b 100644 --- a/advisories/unreviewed/2024/04/GHSA-mqx4-g9cq-jvc6/GHSA-mqx4-g9cq-jvc6.json +++ b/advisories/unreviewed/2024/04/GHSA-mqx4-g9cq-jvc6/GHSA-mqx4-g9cq-jvc6.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mqx4-g9cq-jvc6", - "modified": "2024-04-01T06:30:31Z", + "modified": "2024-08-22T00:31:02Z", "published": "2024-04-01T06:30:31Z", "aliases": [ "CVE-2024-2262" ], "details": "Themify WordPress plugin before 1.4.4 does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-01T05:15:07Z" diff --git a/advisories/unreviewed/2024/04/GHSA-q447-8rfw-f6hh/GHSA-q447-8rfw-f6hh.json b/advisories/unreviewed/2024/04/GHSA-q447-8rfw-f6hh/GHSA-q447-8rfw-f6hh.json index 8ea467e1b49..cbd71738ac0 100644 --- a/advisories/unreviewed/2024/04/GHSA-q447-8rfw-f6hh/GHSA-q447-8rfw-f6hh.json +++ b/advisories/unreviewed/2024/04/GHSA-q447-8rfw-f6hh/GHSA-q447-8rfw-f6hh.json @@ -28,7 +28,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], "severity": "HIGH", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/04/GHSA-rfq8-469g-mx7f/GHSA-rfq8-469g-mx7f.json b/advisories/unreviewed/2024/04/GHSA-rfq8-469g-mx7f/GHSA-rfq8-469g-mx7f.json index d7cd23ce6e2..cc4f339cf5f 100644 --- a/advisories/unreviewed/2024/04/GHSA-rfq8-469g-mx7f/GHSA-rfq8-469g-mx7f.json +++ b/advisories/unreviewed/2024/04/GHSA-rfq8-469g-mx7f/GHSA-rfq8-469g-mx7f.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-rfq8-469g-mx7f", - "modified": "2024-04-10T15:30:40Z", + "modified": "2024-08-22T00:31:02Z", "published": "2024-04-10T15:30:40Z", "aliases": [ "CVE-2024-27474" ], "details": "Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-10T15:16:04Z" diff --git a/advisories/unreviewed/2024/05/GHSA-hpj4-v4gg-8xfh/GHSA-hpj4-v4gg-8xfh.json b/advisories/unreviewed/2024/05/GHSA-hpj4-v4gg-8xfh/GHSA-hpj4-v4gg-8xfh.json index 6706f5360e6..b93f133a2c0 100644 --- a/advisories/unreviewed/2024/05/GHSA-hpj4-v4gg-8xfh/GHSA-hpj4-v4gg-8xfh.json +++ b/advisories/unreviewed/2024/05/GHSA-hpj4-v4gg-8xfh/GHSA-hpj4-v4gg-8xfh.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-hpj4-v4gg-8xfh", - "modified": "2024-05-14T18:30:52Z", + "modified": "2024-08-22T00:31:02Z", "published": "2024-05-14T18:30:52Z", "aliases": [ "CVE-2024-3590" ], "details": "The LetterPress WordPress plugin through 1.2.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as delete arbitrary subscribers", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-05-14T15:41:54Z" diff --git a/advisories/unreviewed/2024/05/GHSA-p4w9-8j85-2xw6/GHSA-p4w9-8j85-2xw6.json b/advisories/unreviewed/2024/05/GHSA-p4w9-8j85-2xw6/GHSA-p4w9-8j85-2xw6.json index b7a1dbba6f8..6c4c3ca6832 100644 --- a/advisories/unreviewed/2024/05/GHSA-p4w9-8j85-2xw6/GHSA-p4w9-8j85-2xw6.json +++ b/advisories/unreviewed/2024/05/GHSA-p4w9-8j85-2xw6/GHSA-p4w9-8j85-2xw6.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-p4w9-8j85-2xw6", - "modified": "2024-05-22T18:30:40Z", + "modified": "2024-08-22T00:31:02Z", "published": "2024-05-22T18:30:40Z", "aliases": [ "CVE-2024-33227" ], "details": "An issue in the component ddcdrv.sys of Nicomsoft WinI2C/DDC v3.7.4.0 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-05-22T16:15:10Z" diff --git a/advisories/unreviewed/2024/07/GHSA-gqv4-535f-vxpp/GHSA-gqv4-535f-vxpp.json b/advisories/unreviewed/2024/07/GHSA-gqv4-535f-vxpp/GHSA-gqv4-535f-vxpp.json index 918db7b392b..9ef83747971 100644 --- a/advisories/unreviewed/2024/07/GHSA-gqv4-535f-vxpp/GHSA-gqv4-535f-vxpp.json +++ b/advisories/unreviewed/2024/07/GHSA-gqv4-535f-vxpp/GHSA-gqv4-535f-vxpp.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-gqv4-535f-vxpp", - "modified": "2024-07-31T21:32:37Z", + "modified": "2024-08-22T00:31:02Z", "published": "2024-07-31T21:32:37Z", "aliases": [ "CVE-2024-41630" ], "details": "Stack-based buffer overflow vulnerability in Tenda AC18 V15.03.3.10_EN allows a remote attacker to execute arbitrary code via the ssid parameter at ip/goform/fast_setting_wifi_set.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-07-31T19:15:12Z" diff --git a/advisories/unreviewed/2024/08/GHSA-4jq7-4qmf-m333/GHSA-4jq7-4qmf-m333.json b/advisories/unreviewed/2024/08/GHSA-4jq7-4qmf-m333/GHSA-4jq7-4qmf-m333.json new file mode 100644 index 00000000000..8fc4fcdbe7d --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-4jq7-4qmf-m333/GHSA-4jq7-4qmf-m333.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4jq7-4qmf-m333", + "modified": "2024-08-22T00:31:03Z", + "published": "2024-08-22T00:31:03Z", + "aliases": [ + "CVE-2024-28987" + ], + "details": "The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28987" + }, + { + "type": "WEB", + "url": "https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2" + }, + { + "type": "WEB", + "url": "https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-798" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-21T22:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-4wrc-8xjh-v948/GHSA-4wrc-8xjh-v948.json b/advisories/unreviewed/2024/08/GHSA-4wrc-8xjh-v948/GHSA-4wrc-8xjh-v948.json index 1ef482f973d..71e4c3bea3d 100644 --- a/advisories/unreviewed/2024/08/GHSA-4wrc-8xjh-v948/GHSA-4wrc-8xjh-v948.json +++ b/advisories/unreviewed/2024/08/GHSA-4wrc-8xjh-v948/GHSA-4wrc-8xjh-v948.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-4wrc-8xjh-v948", - "modified": "2024-08-21T18:31:28Z", + "modified": "2024-08-22T00:31:02Z", "published": "2024-08-21T18:31:28Z", "aliases": [ "CVE-2023-29929" ], "details": "Buffer Overflow vulnerability found in Kemptechnologies Loadmaster before v.7.2.60.0 allows a remote attacker to casue a denial of service via the libkemplink.so, isreverse library.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-121" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-21T18:15:09Z" diff --git a/advisories/unreviewed/2024/08/GHSA-6fqv-gvfg-wqrx/GHSA-6fqv-gvfg-wqrx.json b/advisories/unreviewed/2024/08/GHSA-6fqv-gvfg-wqrx/GHSA-6fqv-gvfg-wqrx.json index 885c40e11f4..6ef31cbea98 100644 --- a/advisories/unreviewed/2024/08/GHSA-6fqv-gvfg-wqrx/GHSA-6fqv-gvfg-wqrx.json +++ b/advisories/unreviewed/2024/08/GHSA-6fqv-gvfg-wqrx/GHSA-6fqv-gvfg-wqrx.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-6fqv-gvfg-wqrx", - "modified": "2024-08-21T18:31:28Z", + "modified": "2024-08-22T00:31:02Z", "published": "2024-08-21T18:31:28Z", "aliases": [ "CVE-2024-42786" ], "details": "A SQL injection vulnerability in \"/music/view_user.php\" in Kashipara Music Management System v1.0 allows an attacker to execute arbitrary SQL commands via the \"id\" parameter of View User Profile Page.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-21T18:15:10Z" diff --git a/advisories/unreviewed/2024/08/GHSA-7jcc-v4g6-5284/GHSA-7jcc-v4g6-5284.json b/advisories/unreviewed/2024/08/GHSA-7jcc-v4g6-5284/GHSA-7jcc-v4g6-5284.json index 4dcdb8ca024..f2e5aa2661b 100644 --- a/advisories/unreviewed/2024/08/GHSA-7jcc-v4g6-5284/GHSA-7jcc-v4g6-5284.json +++ b/advisories/unreviewed/2024/08/GHSA-7jcc-v4g6-5284/GHSA-7jcc-v4g6-5284.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-7jcc-v4g6-5284", - "modified": "2024-08-21T18:31:28Z", + "modified": "2024-08-22T00:31:02Z", "published": "2024-08-21T18:31:28Z", "aliases": [ "CVE-2024-42777" ], "details": "An Unrestricted file upload vulnerability was found in \"/music/ajax.php?action=signup\" of Kashipara Music Management System v1.0, which allows attackers to execute arbitrary code via uploading a crafted PHP file.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-434" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-21T18:15:09Z" diff --git a/advisories/unreviewed/2024/08/GHSA-rmh7-px2g-m7q9/GHSA-rmh7-px2g-m7q9.json b/advisories/unreviewed/2024/08/GHSA-rmh7-px2g-m7q9/GHSA-rmh7-px2g-m7q9.json index 9bd27e948a7..e1cfe1907c0 100644 --- a/advisories/unreviewed/2024/08/GHSA-rmh7-px2g-m7q9/GHSA-rmh7-px2g-m7q9.json +++ b/advisories/unreviewed/2024/08/GHSA-rmh7-px2g-m7q9/GHSA-rmh7-px2g-m7q9.json @@ -32,7 +32,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], "severity": "CRITICAL", "github_reviewed": false,