Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-11-12 21:31:26 +00:00
parent d4c240ac89
commit f8acf8f385
129 changed files with 3468 additions and 144 deletions
@@ -1,20 +1,43 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-pgrc-8wp5-5mvq",
-  "modified": "2024-11-12T18:30:51Z",
+  "modified": "2024-11-12T21:30:21Z",
  "published": "2024-11-11T21:31:48Z",
  "aliases": [
    "CVE-2024-51135"
  ],
+  "summary": "powertac-server XML External Entity vulnerability",
  "details": "An XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing malicious XML entities.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"
    }
  ],
  "affected": [
-
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.powertac:server-interface"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.9.0"
+            }
+          ]
+        }
+      ]
+    }
  ],
  "references": [
    {
@@ -26,25 +49,21 @@
      "url": "https://github.com/powertac/powertac-server/issues/1166"
    },
    {
-      "type": "WEB",
+      "type": "PACKAGE",
      "url": "https://github.com/powertac/powertac-server"
    },
    {
      "type": "WEB",
      "url": "https://mvnrepository.com/artifact/org.powertac/server-interface"
-    },
-    {
-      "type": "WEB",
-      "url": "http://www.powertac.org"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
-    "severity": "CRITICAL",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-11-12T21:30:21Z",
    "nvd_published_at": "2024-11-11T19:15:04Z"
  }
 }
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4x8h-5jjw-88xr",
-  "modified": "2024-02-22T21:30:33Z",
+  "modified": "2024-11-12T21:30:49Z",
  "published": "2024-02-22T21:30:33Z",
  "aliases": [
    "CVE-2024-25369"
  ],
  "details": "A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the group_id parameter.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-22T20:15:56Z"
@@ -32,7 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-wp8h-p32h-fwvc",
-  "modified": "2024-02-20T15:31:05Z",
+  "modified": "2024-11-12T21:30:49Z",
  "published": "2024-02-20T15:31:05Z",
  "aliases": [
    "CVE-2024-1556"
  ],
  "details": "The incorrect object was checked for NULL in the built-in profiler, potentially leading to invalid memory access and undefined behavior. *Note:* This issue only affects the application when the profiler is running. This vulnerability affects Firefox < 123.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-754"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-20T14:15:09Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-xc5j-3rmm-qh4c",
-  "modified": "2024-02-15T21:31:27Z",
+  "modified": "2024-11-12T21:30:48Z",
  "published": "2024-02-15T21:31:27Z",
  "aliases": [
    "CVE-2024-25373"
  ],
  "details": "Tenda AC10V4.0 V16.03.10.20 was discovered to contain a stack overflow via the page parameter in the sub_49B384 function.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-120"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-15T19:15:14Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5pvw-wf9w-xx8v",
-  "modified": "2024-03-27T06:30:30Z",
+  "modified": "2024-11-12T21:30:49Z",
  "published": "2024-03-27T06:30:30Z",
  "aliases": [
    "CVE-2023-39804"
  ],
  "details": "In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -35,7 +38,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-27T04:15:08Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-62m6-hw85-vr62",
-  "modified": "2024-03-05T15:32:41Z",
+  "modified": "2024-11-12T21:30:49Z",
  "published": "2024-03-05T15:32:41Z",
  "aliases": [
    "CVE-2024-27625"
  ],
  "details": "CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Manager module of the admin panel. Specifically, the issue arises due to inadequate sanitization of user input in the \"New directory\" field.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-05T14:15:49Z"
@@ -25,7 +25,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-434"
    ],
    "severity": null,
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-vr4m-r8hq-rpgr",
-  "modified": "2024-06-27T12:30:44Z",
+  "modified": "2024-11-12T21:30:49Z",
  "published": "2024-03-06T09:30:28Z",
  "aliases": [
    "CVE-2023-52601"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix array-index-out-of-bounds in dbAdjTree\n\nCurrently there is a bound check missing in the dbAdjTree while\naccessing the dmt_stree. To add the required check added the bool is_ctl\nwhich is required to determine the size as suggest in the following\ncommit.\nhttps://lore.kernel.org/linux-kernel-mentees/f9475918-2186-49b8-b801-6f0f9e75f4fa@oracle.com/",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -61,9 +64,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-129"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-06T07:15:10Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-29xc-2rhm-5f2q",
-  "modified": "2024-04-04T09:30:34Z",
+  "modified": "2024-11-12T21:30:49Z",
  "published": "2024-04-04T09:30:34Z",
  "aliases": [
    "CVE-2024-29007"
  ],
  "details": "The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means of following 301 HTTP redirects presented by external servers when downloading templates or ISOs. Users are recommended to upgrade to version 4.18.1.1 or 4.19.0.1, which fixes this issue.\n\n",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [
      "CWE-918"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-04T08:15:06Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7hpg-wrjj-gghq",
-  "modified": "2024-05-01T18:30:40Z",
+  "modified": "2024-11-12T21:30:49Z",
  "published": "2024-04-10T15:30:40Z",
  "aliases": [
    "CVE-2024-31309"
  ],
  "details": "HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.  Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.\n\nUsers can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute.  ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases.\nUsers are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.\n\n",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -51,7 +54,7 @@
    "cwe_ids": [
      "CWE-20"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-10T12:15:09Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c4ch-cv96-r58v",
-  "modified": "2024-07-30T03:30:51Z",
+  "modified": "2024-11-12T21:30:49Z",
  "published": "2024-04-04T21:30:31Z",
  "aliases": [
    "CVE-2024-24795"
  ],
  "details": "HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.\n\nUsers are recommended to upgrade to version 2.4.59, which fixes this issue.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
+    }
  ],
  "affected": [

@@ -61,9 +64,10 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-113"
+      "CWE-113",
+      "CWE-444"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-04T20:15:08Z"
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-xc8j-mr73-m6wv",
-  "modified": "2024-04-16T18:31:34Z",
+  "modified": "2024-11-12T21:30:49Z",
  "published": "2024-04-16T18:31:34Z",
  "aliases": [
    "CVE-2024-3855"
  ],
  "details": "In certain cases the JIT incorrectly optimized MSubstr operations, which led to out-of-bounds reads. This vulnerability affects Firefox < 125.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-125"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-16T16:15:08Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-84g5-5pmf-46fw",
-  "modified": "2024-06-25T03:31:07Z",
+  "modified": "2024-11-12T21:30:49Z",
  "published": "2024-06-25T03:31:07Z",
  "aliases": [
    "CVE-2024-23149"
  ],
  "details": "A maliciously crafted SLDDRW file, when parsed in ODXSW_DLL.dll through Autodesk applications, can force an Out-of-Bound Read. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [
      "CWE-125"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-25T03:15:10Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8qrf-6p9x-7w92",
-  "modified": "2024-06-03T21:30:43Z",
+  "modified": "2024-11-12T21:30:49Z",
  "published": "2024-06-03T21:30:43Z",
  "aliases": [
    "CVE-2024-31684"
  ],
  "details": "Incorrect access control in the fingerprint authentication mechanism of Bitdefender Mobile Security v4.11.3-gms allows attackers to bypass fingerprint authentication due to the use of a deprecated API.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-306"
    ],
-    "severity": null,
+    "severity": "LOW",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-03T19:15:09Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-g545-rmg6-689p",
-  "modified": "2024-06-25T21:31:13Z",
+  "modified": "2024-11-12T21:30:49Z",
  "published": "2024-06-03T21:30:44Z",
  "aliases": [
    "CVE-2023-51219"
  ],
  "details": "A deep link validation issue in KakaoTalk 10.4.3 allowed a remote adversary to direct users to run any attacker-controller JavaScript within a WebView. The impact was further escalated by triggering another WebView that leaked its access token in a HTTP request header. Ultimately, this access token could be used to takeover another user's account and read her/his chat messages.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-444"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-03T20:15:08Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-rf2p-c3v5-v8fm",
-  "modified": "2024-06-25T15:31:09Z",
+  "modified": "2024-11-12T21:30:49Z",
  "published": "2024-06-25T15:31:09Z",
  "aliases": [
    "CVE-2024-37086"
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-125"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-jc4p-8qhr-mrv4",
-  "modified": "2024-07-01T06:31:17Z",
+  "modified": "2024-11-12T21:30:49Z",
  "published": "2024-07-01T06:31:17Z",
  "aliases": [
    "CVE-2024-38480"
  ],
  "details": "\"Piccoma\" App for Android and iOS versions prior to 6.20.0 uses a hard-coded API key for an external service, which may allow a local attacker to obtain the API key. Note that the users of the app are not directly affected by this vulnerability.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
  ],
  "affected": [

@@ -33,9 +36,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-798"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-01T05:15:04Z"
@@ -28,7 +28,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-306"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
--- a/Show More
+++ b/Show More