Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2025-01-08 00:31:50 +00:00
parent 6c0b402586
commit f91b90bf96
32 changed files with 323 additions and 106 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-v898-4vh8-7f99",
-  "modified": "2022-05-13T01:47:48Z",
+  "modified": "2025-01-08T00:30:45Z",
  "published": "2022-05-13T01:47:48Z",
  "aliases": [
    "CVE-2017-9117"
@@ -19,6 +19,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9117"
    },
+    {
+      "type": "WEB",
+      "url": "https://gitlab.com/libtiff/libtiff/-/issues/89"
+    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/3606-1"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9cgg-v86h-hw54",
-  "modified": "2023-11-14T21:31:01Z",
+  "modified": "2025-01-08T00:30:47Z",
  "published": "2023-11-14T21:31:01Z",
  "aliases": [
    "CVE-2023-23583"
@@ -62,7 +62,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-1281"
+      "CWE-1281",
+      "CWE-276"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9q92-r559-g8xx",
-  "modified": "2024-06-26T00:31:37Z",
+  "modified": "2025-01-08T00:30:47Z",
  "published": "2024-04-17T12:32:04Z",
  "aliases": [
    "CVE-2024-26855"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()\n\nThe function ice_bridge_setlink() may encounter a NULL pointer dereference\nif nlmsg_find_attr() returns NULL and br_spec is dereferenced subsequently\nin nla_for_each_nested(). To address this issue, add a check to ensure that\nbr_spec is not NULL before proceeding with the nested attribute iteration.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -48,8 +53,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-476"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-17T11:15:08Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-24mf-qj78-vm87",
-  "modified": "2024-12-29T12:30:40Z",
+  "modified": "2025-01-08T00:30:48Z",
  "published": "2024-12-29T12:30:40Z",
  "aliases": [
    "CVE-2024-56740"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfs/localio: must clear res.replen in nfs_local_read_done\n\nOtherwise memory corruption can occur due to NFSv3 LOCALIO reads\nleaving garbage in res.replen:\n- nfs3_read_done() copies that into server->read_hdrsize; from there\n  nfs3_proc_read_setup() copies it to args.replen in new requests.\n- nfs3_xdr_enc_read3args() passes that to rpc_prepare_reply_pages()\n  which includes it in hdrsize for xdr_init_pages, so that rq_rcv_buf\n  contains a ridiculous len.\n- This is copied to rq_private_buf and xs_read_stream_request()\n  eventually passes the kvec to sock_recvmsg() which receives incoming\n  data into entirely the wrong place.\n\nThis is easily reproduced with NFSv3 LOCALIO that is servicing reads\nwhen it is made to pivot back to using normal RPC.  This switch back\nto using normal NFSv3 with RPC can occur for a few reasons but this\nissue was exposed with a test that stops and then restarts the NFSv3\nserver while LOCALIO is performing heavy read IO.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -24,8 +29,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-787"
+    ],
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-29T12:15:07Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-36r9-gj33-8p48",
-  "modified": "2024-12-29T12:30:41Z",
+  "modified": "2025-01-08T00:30:48Z",
  "published": "2024-12-29T12:30:40Z",
  "aliases": [
    "CVE-2024-56741"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: test: Fix memory leak for aa_unpack_strdup()\n\nThe string allocated by kmemdup() in aa_unpack_strdup() is not\nfreed and cause following memory leaks, free them to fix it.\n\n\tunreferenced object 0xffffff80c6af8a50 (size 8):\n\t  comm \"kunit_try_catch\", pid 225, jiffies 4294894407\n\t  hex dump (first 8 bytes):\n\t    74 65 73 74 69 6e 67 00                          testing.\n\t  backtrace (crc 5eab668b):\n\t    [<0000000001e3714d>] kmemleak_alloc+0x34/0x40\n\t    [<000000006e6c7776>] __kmalloc_node_track_caller_noprof+0x300/0x3e0\n\t    [<000000006870467c>] kmemdup_noprof+0x34/0x60\n\t    [<000000001176bb03>] aa_unpack_strdup+0xd0/0x18c\n\t    [<000000008ecde918>] policy_unpack_test_unpack_strdup_with_null_name+0xf8/0x3ec\n\t    [<0000000032ef8f77>] kunit_try_run_case+0x13c/0x3ac\n\t    [<00000000f3edea23>] kunit_generic_run_threadfn_adapter+0x80/0xec\n\t    [<00000000adf936cf>] kthread+0x2e8/0x374\n\t    [<0000000041bb1628>] ret_from_fork+0x10/0x20\n\tunreferenced object 0xffffff80c2a29090 (size 8):\n\t  comm \"kunit_try_catch\", pid 227, jiffies 4294894409\n\t  hex dump (first 8 bytes):\n\t    74 65 73 74 69 6e 67 00                          testing.\n\t  backtrace (crc 5eab668b):\n\t    [<0000000001e3714d>] kmemleak_alloc+0x34/0x40\n\t    [<000000006e6c7776>] __kmalloc_node_track_caller_noprof+0x300/0x3e0\n\t    [<000000006870467c>] kmemdup_noprof+0x34/0x60\n\t    [<000000001176bb03>] aa_unpack_strdup+0xd0/0x18c\n\t    [<0000000046a45c1a>] policy_unpack_test_unpack_strdup_with_name+0xd0/0x3c4\n\t    [<0000000032ef8f77>] kunit_try_run_case+0x13c/0x3ac\n\t    [<00000000f3edea23>] kunit_generic_run_threadfn_adapter+0x80/0xec\n\t    [<00000000adf936cf>] kthread+0x2e8/0x374\n\t    [<0000000041bb1628>] ret_from_fork+0x10/0x20",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -44,8 +49,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-401"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-29T12:15:07Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-84j2-855v-3f6q",
-  "modified": "2024-12-29T12:30:41Z",
+  "modified": "2025-01-08T00:30:48Z",
  "published": "2024-12-29T12:30:41Z",
  "aliases": [
    "CVE-2024-56746"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()\n\nWhen information such as info->screen_base is not ready, calling\nsh7760fb_free_mem() does not release memory correctly. Call\ndma_free_coherent() instead.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -52,8 +57,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-401"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-29T12:15:08Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c33m-px5c-j98p",
-  "modified": "2024-12-29T12:30:40Z",
+  "modified": "2025-01-08T00:30:47Z",
  "published": "2024-12-29T12:30:40Z",
  "aliases": [
    "CVE-2024-56728"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c\n\nAdd error pointer check after calling otx2_mbox_get_rsp().",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -44,8 +49,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-754"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-29T12:15:06Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hh4q-f8cf-8p2p",
-  "modified": "2024-12-29T12:30:41Z",
+  "modified": "2025-01-08T00:30:48Z",
  "published": "2024-12-29T12:30:41Z",
  "aliases": [
    "CVE-2024-56747"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()\n\nHook \"qedi_ops->common->sb_init = qed_sb_init\" does not release the DMA\nmemory sb_virt when it fails. Add dma_free_coherent() to free it. This\nis the same way as qedr_alloc_mem_sb() and qede_alloc_mem_sb().",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -52,8 +57,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-401"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-29T12:15:08Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-jxx5-v8qw-45p6",
-  "modified": "2024-12-29T12:30:41Z",
+  "modified": "2025-01-08T00:30:48Z",
  "published": "2024-12-29T12:30:41Z",
  "aliases": [
    "CVE-2024-56745"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: Fix reset_method_store() memory leak\n\nIn reset_method_store(), a string is allocated via kstrndup() and assigned\nto the local \"options\". options is then used in with strsep() to find\nspaces:\n\n  while ((name = strsep(&options, \" \")) != NULL) {\n\nIf there are no remaining spaces, then options is set to NULL by strsep(),\nso the subsequent kfree(options) doesn't free the memory allocated via\nkstrndup().\n\nFix by using a separate tmp_options to iterate with strsep() so options is\npreserved.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -40,8 +45,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-401"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-29T12:15:07Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-pmwc-7qq9-mj6g",
-  "modified": "2024-12-29T12:30:41Z",
+  "modified": "2025-01-08T00:30:48Z",
  "published": "2024-12-29T12:30:40Z",
  "aliases": [
    "CVE-2024-56742"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio/mlx5: Fix an unwind issue in mlx5vf_add_migration_pages()\n\nFix an unwind issue in mlx5vf_add_migration_pages().\n\nIf a set of pages is allocated but fails to be added to the SG table,\nthey need to be freed to prevent a memory leak.\n\nAny pages successfully added to the SG table will be freed as part of\nmlx5vf_free_data_buffer().",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -28,8 +33,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-401"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-29T12:15:07Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-rcmj-jxvj-g49v",
-  "modified": "2024-12-29T12:30:40Z",
+  "modified": "2025-01-08T00:30:48Z",
  "published": "2024-12-29T12:30:40Z",
  "aliases": [
    "CVE-2024-56729"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: Initialize cfid->tcon before performing network ops\n\nAvoid leaking a tcon ref when a lease break races with opening the\ncached directory. Processing the leak break might take a reference to\nthe tcon in cached_dir_lease_break() and then fail to release the ref in\ncached_dir_offload_close, since cfid->tcon is still NULL.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -32,8 +37,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-401"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-29T12:15:07Z"
@@ -0,0 +1,29 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-43hc-8q23-h42p",
+  "modified": "2025-01-08T00:30:49Z",
+  "published": "2025-01-08T00:30:49Z",
+  "aliases": [
+    "CVE-2018-4301"
+  ],
+  "details": "This issue is fixed in SCSSU-201801. A potential stack based buffer overflow existed in GemaltoKeyHandle.cpp.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-4301"
+    },
+    {
+      "type": "WEB",
+      "url": "https://smartcardservices.github.io/security"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-08T00:15:24Z"
+  }
+}
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5r7w-j22r-58j4",
-  "modified": "2025-01-06T18:31:04Z",
+  "modified": "2025-01-08T00:30:49Z",
  "published": "2025-01-06T18:31:04Z",
  "aliases": [
    "CVE-2024-56766"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: rawnand: fix double free in atmel_pmecc_create_user()\n\nThe \"user\" pointer was converted from being allocated with kzalloc() to\nbeing allocated by devm_kzalloc().  Calling kfree(user) will lead to a\ndouble free.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -32,8 +37,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-415"
+    ],
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-06T17:15:43Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-6574-vqv8-9334",
-  "modified": "2025-01-06T18:31:03Z",
+  "modified": "2025-01-08T00:30:49Z",
  "published": "2025-01-06T18:31:03Z",
  "aliases": [
    "CVE-2024-56759"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free when COWing tree bock and tracing is enabled\n\nWhen a COWing a tree block, at btrfs_cow_block(), and we have the\ntracepoint trace_btrfs_cow_block() enabled and preemption is also enabled\n(CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent\nbuffer while inside the tracepoint code. This is because in some paths\nthat call btrfs_cow_block(), such as btrfs_search_slot(), we are holding\nthe last reference on the extent buffer @buf so btrfs_force_cow_block()\ndrops the last reference on the @buf extent buffer when it calls\nfree_extent_buffer_stale(buf), which schedules the release of the extent\nbuffer with RCU. This means that if we are on a kernel with preemption,\nthe current task may be preempted before calling trace_btrfs_cow_block()\nand the extent buffer already released by the time trace_btrfs_cow_block()\nis called, resulting in a use-after-free.\n\nFix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to\nbtrfs_force_cow_block() before the COWed extent buffer is freed.\nThis also has a side effect of invoking the tracepoint in the tree defrag\ncode, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is\ncalled there, but this is fine and it was actually missing there.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -24,8 +29,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-416"
+    ],
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-06T17:15:40Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-73m7-qfq5-gqj4",
-  "modified": "2025-01-06T18:31:04Z",
+  "modified": "2025-01-08T00:30:49Z",
  "published": "2025-01-06T18:31:04Z",
  "aliases": [
    "CVE-2024-56768"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP\n\nOn x86-64 calling bpf_get_smp_processor_id() in a kernel with CONFIG_SMP\ndisabled can trigger the following bug, as pcpu_hot is unavailable:\n\n [    8.471774] BUG: unable to handle page fault for address: 00000000936a290c\n [    8.471849] #PF: supervisor read access in kernel mode\n [    8.471881] #PF: error_code(0x0000) - not-present page\n\nFix by inlining a return 0 in the !CONFIG_SMP case.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -25,7 +30,7 @@
  ],
  "database_specific": {
    "cwe_ids": [],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-06T17:15:43Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7vgm-4f6w-wj5f",
-  "modified": "2025-01-06T18:31:03Z",
+  "modified": "2025-01-08T00:30:49Z",
  "published": "2025-01-06T18:31:03Z",
  "aliases": [
    "CVE-2024-56760"
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/MSI: Handle lack of irqdomain gracefully\n\nAlexandre observed a warning emitted from pci_msi_setup_msi_irqs() on a\nRISCV platform which does not provide PCI/MSI support:\n\n WARNING: CPU: 1 PID: 1 at drivers/pci/msi/msi.h:121 pci_msi_setup_msi_irqs+0x2c/0x32\n __pci_enable_msix_range+0x30c/0x596\n pci_msi_setup_msi_irqs+0x2c/0x32\n pci_alloc_irq_vectors_affinity+0xb8/0xe2\n\nRISCV uses hierarchical interrupt domains and correctly does not implement\nthe legacy fallback. The warning triggers from the legacy fallback stub.\n\nThat warning is bogus as the PCI/MSI layer knows whether a PCI/MSI parent\ndomain is associated with the device or not. There is a check for MSI-X,\nwhich has a legacy assumption. But that legacy fallback assumption is only\nvalid when legacy support is enabled, but otherwise the check should simply\nreturn -ENOTSUPP.\n\nLoongarch tripped over the same problem and blindly enabled legacy support\nwithout implementing the legacy fallbacks. There are weak implementations\nwhich return an error, so the problem was papered over.\n\nCorrect pci_msi_domain_supports() to evaluate the legacy mode and add\nthe missing supported check into the MSI enable path to complete it.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -29,7 +34,7 @@
  ],
  "database_specific": {
    "cwe_ids": [],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-06T17:15:41Z"
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8w34-gxm3-8xv6",
-  "modified": "2025-01-07T00:31:40Z",
+  "modified": "2025-01-08T00:30:49Z",
  "published": "2025-01-07T00:31:40Z",
  "aliases": [
    "CVE-2024-54764"
  ],
  "details": "An access control issue in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -21,7 +26,7 @@
  ],
  "database_specific": {
    "cwe_ids": [],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-06T23:15:06Z"
--- a/Show More
+++ b/Show More