Advisory Database Sync

advisories/unreviewed/2023/06/GHSA-33cf-32gf-rq6j/GHSA-33cf-32gf-rq6j.json

@@ -25,7 +25,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-89"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,

advisories/unreviewed/2023/06/GHSA-4vgv-pwv7-ff8j/GHSA-4vgv-pwv7-ff8j.json

@@ -25,7 +25,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-770"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,

advisories/unreviewed/2023/06/GHSA-775x-pffr-hqmc/GHSA-775x-pffr-hqmc.json

@@ -25,7 +25,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-89"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,

advisories/unreviewed/2023/06/GHSA-96m3-m78r-2xq9/GHSA-96m3-m78r-2xq9.json

@@ -25,7 +25,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-89"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,

advisories/unreviewed/2023/06/GHSA-99j5-xj2q-86w3/GHSA-99j5-xj2q-86w3.json

@@ -25,7 +25,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-770"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,

advisories/unreviewed/2023/06/GHSA-mpff-353q-5493/GHSA-mpff-353q-5493.json

@@ -25,7 +25,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-770"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,

advisories/unreviewed/2023/06/GHSA-xxxp-8x92-f69v/GHSA-xxxp-8x92-f69v.json

@@ -25,7 +25,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-770"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,

advisories/unreviewed/2024/02/GHSA-whm2-8r5j-rj8q/GHSA-whm2-8r5j-rj8q.json

@@ -1,18 +1,19 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-whm2-8r5j-rj8q",
-  "modified": "2024-02-29T03:33:17Z",
+  "modified": "2024-12-02T18:31:54Z",
   "published": "2024-02-29T03:33:17Z",
   "aliases": [
     "CVE-2024-21723"
   ],
   "details": "Inadequate parsing of URLs could result into an open redirect.",
   "severity": [
-
-  ],
-  "affected": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+    }
   ],
+  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
@@ -27,7 +28,7 @@
     "cwe_ids": [
       "CWE-601"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-02-29T01:44:03Z"

advisories/unreviewed/2024/06/GHSA-289g-wh2w-9hg2/GHSA-289g-wh2w-9hg2.json

@@ -13,9 +13,7 @@
       "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"
     }
   ],
-  "affected": [
-
-  ],
+  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
@@ -28,7 +26,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-862"
     ],
     "severity": "MODERATE",
     "github_reviewed": false,

advisories/unreviewed/2024/07/GHSA-8cxh-wxvq-9jgw/GHSA-8cxh-wxvq-9jgw.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8cxh-wxvq-9jgw",
-  "modified": "2024-07-22T21:30:39Z",
+  "modified": "2024-12-02T18:31:54Z",
   "published": "2024-07-22T21:30:39Z",
   "aliases": [
     "CVE-2024-40075"
   ],
   "details": "Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -20,8 +25,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-611"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-07-22T19:15:02Z"

advisories/unreviewed/2024/07/GHSA-fpq9-w5cw-5hf8/GHSA-fpq9-w5cw-5hf8.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-fpq9-w5cw-5hf8",
-  "modified": "2024-08-21T15:30:49Z",
+  "modified": "2024-12-02T18:31:54Z",
   "published": "2024-07-01T21:31:14Z",
   "aliases": [
     "CVE-2024-38476"
@@ -26,6 +26,10 @@
     {
       "type": "WEB",
       "url": "https://security.netapp.com/advisory/ntap-20240712-0001"
+    },
+    {
+      "type": "WEB",
+      "url": "http://www.openwall.com/lists/oss-security/2024/07/01/9"
     }
   ],
   "database_specific": {

advisories/unreviewed/2024/11/GHSA-2gx6-qrpp-c4p3/GHSA-2gx6-qrpp-c4p3.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2gx6-qrpp-c4p3",
-  "modified": "2024-11-29T21:31:04Z",
+  "modified": "2024-12-02T18:31:55Z",
   "published": "2024-11-29T21:31:04Z",
   "aliases": [
     "CVE-2024-35371"
   ],
   "details": "Ant-Media-Serverv2.8.2 is affected by Improper Output Neutralization for Logs. The vulnerability stems from insufficient input sanitization in the logging mechanism. Without proper filtering or validation, user-controllable data, such as identifiers or other sensitive information, can be included in log entries without restrictions.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -28,8 +33,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-125"
+    ],
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-11-29T20:15:20Z"

advisories/unreviewed/2024/11/GHSA-44gv-75g5-gcm5/GHSA-44gv-75g5-gcm5.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-44gv-75g5-gcm5",
-  "modified": "2024-11-29T18:34:03Z",
+  "modified": "2024-12-02T18:31:54Z",
   "published": "2024-11-29T18:34:03Z",
   "aliases": [
     "CVE-2024-36617"
   ],
   "details": "FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -28,8 +33,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-190"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-11-29T18:15:07Z"

advisories/unreviewed/2024/11/GHSA-6wff-g5m3-3vrq/GHSA-6wff-g5m3-3vrq.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-6wff-g5m3-3vrq",
-  "modified": "2024-11-29T21:31:04Z",
+  "modified": "2024-12-02T18:31:55Z",
   "published": "2024-11-29T21:31:04Z",
   "aliases": [
     "CVE-2024-35367"
   ],
   "details": "FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -28,8 +33,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-125"
+    ],
+    "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-11-29T20:15:19Z"

advisories/unreviewed/2024/11/GHSA-8737-h7fg-9xgj/GHSA-8737-h7fg-9xgj.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8737-h7fg-9xgj",
-  "modified": "2024-11-27T18:34:04Z",
+  "modified": "2024-12-02T18:31:54Z",
   "published": "2024-11-27T15:31:46Z",
   "aliases": [
     "CVE-2024-53920"
   ],
   "details": "In elisp-mode.el in GNU Emacs through 30.0.92, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -36,8 +41,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-94"
+    ],
+    "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-11-27T15:15:26Z"

advisories/unreviewed/2024/11/GHSA-cg28-v4wq-whv5/GHSA-cg28-v4wq-whv5.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-cg28-v4wq-whv5",
-  "modified": "2024-11-29T21:31:04Z",
+  "modified": "2024-12-02T18:31:55Z",
   "published": "2024-11-29T21:31:04Z",
   "aliases": [
     "CVE-2024-36610"
   ],
   "details": "A deserialization vulnerability exists in the Stub class of the VarDumper module in Symfony v7.0.3. The vulnerability stems from deficiencies in the original implementation when handling properties with null or uninitialized values. An attacker could construct specific serialized data and use this vulnerability to execute unauthorized code.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -28,8 +33,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-94"
+    ],
+    "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-11-29T20:15:20Z"

advisories/unreviewed/2024/11/GHSA-crqc-m66h-cvr4/GHSA-crqc-m66h-cvr4.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-crqc-m66h-cvr4",
-  "modified": "2024-11-29T21:31:03Z",
+  "modified": "2024-12-02T18:31:55Z",
   "published": "2024-11-29T21:31:03Z",
   "aliases": [
     "CVE-2024-36616"
   ],
   "details": "An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -28,8 +33,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-190"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-11-29T19:15:07Z"

advisories/unreviewed/2024/11/GHSA-f9m5-926v-fxw4/GHSA-f9m5-926v-fxw4.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-f9m5-926v-fxw4",
-  "modified": "2024-11-29T18:34:03Z",
+  "modified": "2024-12-02T18:31:54Z",
   "published": "2024-11-29T18:34:03Z",
   "aliases": [
     "CVE-2024-36618"
   ],
   "details": "FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -28,8 +33,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-190"
+    ],
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-11-29T18:15:07Z"

advisories/unreviewed/2024/11/GHSA-g5wv-cvf4-2r98/GHSA-g5wv-cvf4-2r98.json

@@ -1,18 +1,19 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-g5wv-cvf4-2r98",
-  "modified": "2024-11-26T15:31:02Z",
+  "modified": "2024-12-02T18:31:54Z",
   "published": "2024-11-26T15:31:02Z",
   "aliases": [
     "CVE-2024-11696"
   ],
   "details": "The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed.  Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5.",
   "severity": [
-
-  ],
-  "affected": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
+    }
   ],
+  "affected": [],
   "references": [
     {
       "type": "ADVISORY",
@@ -41,9 +42,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-347"
     ],
-    "severity": null,
+    "severity": "MODERATE",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-11-26T14:15:19Z"

advisories/unreviewed/2024/11/GHSA-gq96-59xw-28wj/GHSA-gq96-59xw-28wj.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-gq96-59xw-28wj",
-  "modified": "2024-11-29T21:31:04Z",
+  "modified": "2024-12-02T18:31:55Z",
   "published": "2024-11-29T21:31:04Z",
   "aliases": [
     "CVE-2024-35366"
   ],
   "details": "FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {
@@ -28,8 +33,10 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-120"
+    ],
+    "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-11-29T20:15:19Z"