Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-11-21 21:35:20 +00:00
parent 6d07b93029
commit f641c92cf7
66 changed files with 976 additions and 138 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4crf-28c7-v4gr",
-  "modified": "2024-11-18T16:27:06Z",
+  "modified": "2024-11-21T21:33:31Z",
  "published": "2024-08-21T06:32:18Z",
  "aliases": [
    "CVE-2024-6508"
@@ -52,6 +52,14 @@
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:8415"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2024:8991"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2024:9620"
+    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2024-6508"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-jpxc-vmjf-9fcj",
-  "modified": "2024-11-06T21:30:54Z",
+  "modified": "2024-11-21T21:33:31Z",
  "published": "2024-09-16T14:37:26Z",
  "aliases": [
    "CVE-2024-8775"
@@ -48,6 +48,10 @@
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:8969"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2024:9894"
+    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2024-8775"
@@ -65,7 +69,7 @@
    "cwe_ids": [
      "CWE-532"
    ],
-    "severity": "MODERATE",
+    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-16T22:49:05Z",
    "nvd_published_at": "2024-09-14T03:15:08Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3h3x-2hwv-hr52",
-  "modified": "2024-11-15T21:30:45Z",
+  "modified": "2024-11-21T21:33:31Z",
  "published": "2024-10-01T21:31:34Z",
  "aliases": [
    "CVE-2024-9355"
@@ -52,6 +52,10 @@
      "type": "WEB",
      "url": "https://github.com/golang-fips/openssl/pull/198"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2024:10133"
+    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:7502"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-586p-749j-fhwp",
-  "modified": "2024-11-13T09:30:56Z",
+  "modified": "2024-11-21T21:33:31Z",
  "published": "2024-10-09T15:32:21Z",
  "aliases": [
    "CVE-2024-9675"
@@ -76,6 +76,10 @@
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:9051"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2024:8994"
+    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:8984"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-fhqq-8f65-5xfc",
-  "modified": "2024-11-12T18:30:51Z",
+  "modified": "2024-11-21T21:33:31Z",
  "published": "2024-10-01T21:31:35Z",
  "aliases": [
    "CVE-2024-9407"
@@ -177,6 +177,10 @@
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:9459"
    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2024:9926"
+    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2024-9407"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-227f-45c5-prxw",
-  "modified": "2024-02-16T03:30:50Z",
+  "modified": "2024-11-21T21:33:29Z",
  "published": "2024-02-16T03:30:50Z",
  "aliases": [
    "CVE-2023-40122"
  ],
  "details": "In applyCustomDescription of SaveUi.java, there is a possible way to view other user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
  ],
  "affected": [

@@ -31,7 +34,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-16T02:15:50Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-gqvq-6r9g-ff5p",
-  "modified": "2024-02-18T06:30:32Z",
+  "modified": "2024-11-21T21:33:29Z",
  "published": "2024-02-18T06:30:32Z",
  "aliases": [
    "CVE-2023-52377"
  ],
  "details": "Vulnerability of input data not being verified in the cellular data module.Successful exploitation of this vulnerability may cause out-of-bounds access.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"
+    }
  ],
  "affected": [

@@ -31,7 +34,7 @@
    "cwe_ids": [
      "CWE-120"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-18T06:15:08Z"
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-770"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-v222-j2c4-g82m",
-  "modified": "2024-02-21T18:31:02Z",
+  "modified": "2024-11-21T21:33:30Z",
  "published": "2024-02-21T18:31:02Z",
  "aliases": [
    "CVE-2024-25896"
  ],
  "details": "ChurchCRM 5.5.0 EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EID POST parameter.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-89"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-21T18:15:51Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-54qr-qrfv-pmc3",
-  "modified": "2024-03-14T00:31:05Z",
+  "modified": "2024-11-21T21:33:30Z",
  "published": "2024-03-08T03:31:25Z",
  "aliases": [
    "CVE-2024-23264"
  ],
  "details": "A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Monterey 12.7.4, macOS Ventura 13.6.5, macOS Sonoma 14.4, visionOS 1.1, iOS 17.4 and iPadOS 17.4, iOS 16.7.6 and iPadOS 16.7.6, tvOS 17.4. An application may be able to read restricted memory.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
  ],
  "affected": [

@@ -69,9 +72,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-125"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-08T02:15:49Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5vw7-hf8v-5qgw",
-  "modified": "2024-03-11T18:31:08Z",
+  "modified": "2024-11-21T21:33:30Z",
  "published": "2024-03-11T18:31:08Z",
  "aliases": [
    "CVE-2024-0047"
  ],
  "details": "In writeUserLP of UserManagerService.java, device policies are serialized with an incorrect tag due to a logic error in the code. This could lead to local denial of service when policies are deserialized on reboot with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -39,7 +42,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-11T17:15:45Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8f65-fxmq-vvpx",
-  "modified": "2024-03-20T15:32:56Z",
+  "modified": "2024-11-21T21:33:30Z",
  "published": "2024-03-20T15:32:56Z",
  "aliases": [
    "CVE-2023-46839"
  ],
  "details": "PCI devices can make use of a functionality called phantom functions,\nthat when enabled allows the device to generate requests using the IDs\nof functions that are otherwise unpopulated.  This allows a device to\nextend the number of outstanding requests.\n\nSuch phantom functions need an IOMMU context setup, but failure to\nsetup the context is not fatal when the device is assigned.  Not\nfailing device assignment when such failure happens can lead to the\nprimary device being assigned to a guest, while some of the phantom\nfunctions are assigned to a different domain.\n",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-20T11:15:08Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c3wj-m54r-wfgq",
-  "modified": "2024-03-24T03:30:44Z",
+  "modified": "2024-11-21T21:33:30Z",
  "published": "2024-03-24T03:30:44Z",
  "aliases": [
    "CVE-2024-30156"
  ],
  "details": "Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-770"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-24T01:15:45Z"
@@ -80,7 +80,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-200"
+      "CWE-200",
+      "CWE-327"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-p8rh-8mxv-5w8q",
-  "modified": "2024-03-15T15:30:43Z",
+  "modified": "2024-11-21T21:33:30Z",
  "published": "2024-03-15T15:30:43Z",
  "aliases": [
    "CVE-2023-51525"
  ],
  "details": "Cross-Site Request Forgery (CSRF) vulnerability in Veribo, Roland Murg WP Simple Booking Calendar.This issue affects WP Simple Booking Calendar: from n/a through 2.0.8.4.\n\n",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [
      "CWE-352"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-15T14:15:07Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-r9x9-fwpc-8mmv",
-  "modified": "2024-03-11T18:31:08Z",
+  "modified": "2024-11-21T21:33:30Z",
  "published": "2024-03-11T18:31:08Z",
  "aliases": [
    "CVE-2024-0052"
  ],
  "details": "In multiple functions of healthconnect, there is a possible leakage of exercise route data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-862"
    ],
-    "severity": null,
+    "severity": "LOW",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-11T17:15:45Z"
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -36,7 +36,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-770"
    ],
    "severity": "LOW",
    "github_reviewed": false,
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-77"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-frv5-mfr5-q7h5",
-  "modified": "2024-05-07T18:30:33Z",
+  "modified": "2024-11-21T21:33:30Z",
  "published": "2024-05-07T18:30:33Z",
  "aliases": [
    "CVE-2024-33858"
  ],
  "details": "An issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The source_name parameter could be changed to an absolute path; this will write the CSV file to that path inside the /tmp directory.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-91"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-07T16:15:08Z"
--- a/Show More
+++ b/Show More