Publish Advisories

GHSA-8m9j-2f32-2vx4
GHSA-p528-3mvf-gr87
GHSA-q623-2j2j-23jj
GHSA-r49h-6qxq-624f
GHSA-vprp-94p9-5jp8

advisories/github-reviewed/2024/07/GHSA-8m9j-2f32-2vx4/GHSA-8m9j-2f32-2vx4.json

@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-8m9j-2f32-2vx4",
-  "modified": "2024-07-31T22:03:16Z",
+  "modified": "2024-08-02T15:58:47Z",
   "published": "2024-07-31T20:54:08Z",
   "aliases": [
     "CVE-2024-41955"
   ],
   "summary": "MobSF vulnerable to Open Redirect in Login Redirect",
-  "details": "### Impact\nAn open redirect vulnerability exist in MobSF authentication view. \n\nPoC\n1. Go to http://127.0.0.1:8000/login/?next=//afine.com in a web browser.\n2. Enter credentials and press \"Sign In\".\n3. You will be redirected to [afine.com](http://afine.com/)\n\nUsers who are not using authentication are not impacted.\n\n### Patches\nUpdate to MobSF v4.0.5\n\n### Workarounds\nDisable Authentication\n\n### References\nFix: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/fdaad81314f393d324c1ede79627e9d47986c8c8\n\n### Reporter\n Marcin Węgłowski ",
+  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nAn open redirect vulnerability exist in MobSF authentication view. \n\nPoC\n1. Go to http://127.0.0.1:8000/login/?next=//afine.com in a web browser.\n2. Enter credentials and press \"Sign In\".\n3. You will be redirected to [afine.com](http://afine.com/)\n\nUsers who are not using authentication are not impacted.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nUpdate to MobSF v4.0.5\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\nDisable Authentication\n\n### References\n_Are there any links users can visit to find out more?_\nFix: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/fdaad81314f393d324c1ede79627e9d47986c8c8\n\n### Reporter\nMarcin Węgłowski (AFINE Team)\n",
   "severity": [
     {
       "type": "CVSS_V3",

advisories/github-reviewed/2024/07/GHSA-p528-3mvf-gr87/GHSA-p528-3mvf-gr87.json

@@ -1,17 +1,21 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-p528-3mvf-gr87",
-  "modified": "2024-07-25T15:19:46Z",
+  "modified": "2024-08-02T15:57:02Z",
   "published": "2024-07-25T12:32:00Z",
   "aliases": [
     "CVE-2024-37084"
   ],
   "summary": "Remote code execution in Spring Cloud Data Flow",
-  "details": "In Spring Cloud Data Flow versions prior to 2.11.4,  a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server",
+  "details": "In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
     }
   ],
   "affected": [
@@ -51,7 +55,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-22"
+      "CWE-22",
+      "CWE-94"
     ],
     "severity": "CRITICAL",
     "github_reviewed": true,

advisories/github-reviewed/2024/07/GHSA-q623-2j2j-23jj/GHSA-q623-2j2j-23jj.json

@@ -55,7 +55,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-269"
+      "CWE-269",
+      "CWE-77"
     ],
     "severity": "CRITICAL",
     "github_reviewed": true,

advisories/github-reviewed/2024/07/GHSA-r49h-6qxq-624f/GHSA-r49h-6qxq-624f.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-r49h-6qxq-624f",
-  "modified": "2024-07-31T20:54:48Z",
+  "modified": "2024-08-02T15:58:23Z",
   "published": "2024-07-31T15:31:19Z",
   "aliases": [
     "CVE-2024-7340"
@@ -63,6 +63,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
+      "CWE-20",
       "CWE-22"
     ],
     "severity": "HIGH",

advisories/github-reviewed/2024/07/GHSA-vprp-94p9-5jp8/GHSA-vprp-94p9-5jp8.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vprp-94p9-5jp8",
-  "modified": "2024-07-25T16:44:50Z",
+  "modified": "2024-08-02T15:56:42Z",
   "published": "2024-07-24T21:31:30Z",
   "aliases": [
     "CVE-2024-40137"
@@ -9,7 +9,14 @@
   "summary": "Dolibarr ERP CRM vulnerable to remote code execution (RCE) ",
   "details": "Dolibarr ERP CRM before 19.0.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameter under the Users Module Setup function.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
   ],
   "affected": [
     {
@@ -23,13 +30,13 @@
           "events": [
             {
               "introduced": "0"
+            },
+            {
+              "fixed": "19.0.2"
             }
           ]
         }
-      ],
-      "database_specific": {
-        "last_known_affected_version_range": "< 19.0.2"
-      }
+      ]
     }
   ],
   "references": [
@@ -48,9 +55,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-74"
     ],
-    "severity": "HIGH",
+    "severity": "MODERATE",
     "github_reviewed": true,
     "github_reviewed_at": "2024-07-25T16:44:50Z",
     "nvd_published_at": "2024-07-24T19:15:04Z"