From fa99fb6abb6f3dca100e7f8915e9e7b2d7bc431d Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 2 Aug 2024 15:59:11 +0000 Subject: [PATCH] Publish Advisories GHSA-8m9j-2f32-2vx4 GHSA-p528-3mvf-gr87 GHSA-q623-2j2j-23jj GHSA-r49h-6qxq-624f GHSA-vprp-94p9-5jp8 --- .../GHSA-8m9j-2f32-2vx4.json | 4 ++-- .../GHSA-p528-3mvf-gr87.json | 11 ++++++--- .../GHSA-q623-2j2j-23jj.json | 3 ++- .../GHSA-r49h-6qxq-624f.json | 3 ++- .../GHSA-vprp-94p9-5jp8.json | 23 ++++++++++++------- 5 files changed, 29 insertions(+), 15 deletions(-) diff --git a/advisories/github-reviewed/2024/07/GHSA-8m9j-2f32-2vx4/GHSA-8m9j-2f32-2vx4.json b/advisories/github-reviewed/2024/07/GHSA-8m9j-2f32-2vx4/GHSA-8m9j-2f32-2vx4.json index 6f26fc81aed..243289b9d19 100644 --- a/advisories/github-reviewed/2024/07/GHSA-8m9j-2f32-2vx4/GHSA-8m9j-2f32-2vx4.json +++ b/advisories/github-reviewed/2024/07/GHSA-8m9j-2f32-2vx4/GHSA-8m9j-2f32-2vx4.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-8m9j-2f32-2vx4", - "modified": "2024-07-31T22:03:16Z", + "modified": "2024-08-02T15:58:47Z", "published": "2024-07-31T20:54:08Z", "aliases": [ "CVE-2024-41955" ], "summary": "MobSF vulnerable to Open Redirect in Login Redirect", - "details": "### Impact\nAn open redirect vulnerability exist in MobSF authentication view. \n\nPoC\n1. Go to http://127.0.0.1:8000/login/?next=//afine.com in a web browser.\n2. Enter credentials and press \"Sign In\".\n3. You will be redirected to [afine.com](http://afine.com/)\n\nUsers who are not using authentication are not impacted.\n\n### Patches\nUpdate to MobSF v4.0.5\n\n### Workarounds\nDisable Authentication\n\n### References\nFix: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/fdaad81314f393d324c1ede79627e9d47986c8c8\n\n### Reporter\n Marcin Węgłowski ", + "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nAn open redirect vulnerability exist in MobSF authentication view. \n\nPoC\n1. Go to http://127.0.0.1:8000/login/?next=//afine.com in a web browser.\n2. Enter credentials and press \"Sign In\".\n3. You will be redirected to [afine.com](http://afine.com/)\n\nUsers who are not using authentication are not impacted.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nUpdate to MobSF v4.0.5\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\nDisable Authentication\n\n### References\n_Are there any links users can visit to find out more?_\nFix: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/fdaad81314f393d324c1ede79627e9d47986c8c8\n\n### Reporter\nMarcin Węgłowski (AFINE Team)\n", "severity": [ { "type": "CVSS_V3", diff --git a/advisories/github-reviewed/2024/07/GHSA-p528-3mvf-gr87/GHSA-p528-3mvf-gr87.json b/advisories/github-reviewed/2024/07/GHSA-p528-3mvf-gr87/GHSA-p528-3mvf-gr87.json index 9a640e5a8ac..59596d1cd09 100644 --- a/advisories/github-reviewed/2024/07/GHSA-p528-3mvf-gr87/GHSA-p528-3mvf-gr87.json +++ b/advisories/github-reviewed/2024/07/GHSA-p528-3mvf-gr87/GHSA-p528-3mvf-gr87.json @@ -1,17 +1,21 @@ { "schema_version": "1.4.0", "id": "GHSA-p528-3mvf-gr87", - "modified": "2024-07-25T15:19:46Z", + "modified": "2024-08-02T15:57:02Z", "published": "2024-07-25T12:32:00Z", "aliases": [ "CVE-2024-37084" ], "summary": "Remote code execution in Spring Cloud Data Flow", - "details": "In Spring Cloud Data Flow versions prior to 2.11.4,  a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server", + "details": "In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } ], "affected": [ @@ -51,7 +55,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-22" + "CWE-22", + "CWE-94" ], "severity": "CRITICAL", "github_reviewed": true, diff --git a/advisories/github-reviewed/2024/07/GHSA-q623-2j2j-23jj/GHSA-q623-2j2j-23jj.json b/advisories/github-reviewed/2024/07/GHSA-q623-2j2j-23jj/GHSA-q623-2j2j-23jj.json index e193d498ba2..8ae0e18b8f8 100644 --- a/advisories/github-reviewed/2024/07/GHSA-q623-2j2j-23jj/GHSA-q623-2j2j-23jj.json +++ b/advisories/github-reviewed/2024/07/GHSA-q623-2j2j-23jj/GHSA-q623-2j2j-23jj.json @@ -55,7 +55,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-269" + "CWE-269", + "CWE-77" ], "severity": "CRITICAL", "github_reviewed": true, diff --git a/advisories/github-reviewed/2024/07/GHSA-r49h-6qxq-624f/GHSA-r49h-6qxq-624f.json b/advisories/github-reviewed/2024/07/GHSA-r49h-6qxq-624f/GHSA-r49h-6qxq-624f.json index 21495e112d2..cc3e23527aa 100644 --- a/advisories/github-reviewed/2024/07/GHSA-r49h-6qxq-624f/GHSA-r49h-6qxq-624f.json +++ b/advisories/github-reviewed/2024/07/GHSA-r49h-6qxq-624f/GHSA-r49h-6qxq-624f.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-r49h-6qxq-624f", - "modified": "2024-07-31T20:54:48Z", + "modified": "2024-08-02T15:58:23Z", "published": "2024-07-31T15:31:19Z", "aliases": [ "CVE-2024-7340" @@ -63,6 +63,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-20", "CWE-22" ], "severity": "HIGH", diff --git a/advisories/github-reviewed/2024/07/GHSA-vprp-94p9-5jp8/GHSA-vprp-94p9-5jp8.json b/advisories/github-reviewed/2024/07/GHSA-vprp-94p9-5jp8/GHSA-vprp-94p9-5jp8.json index 127ea341780..182612f25f6 100644 --- a/advisories/github-reviewed/2024/07/GHSA-vprp-94p9-5jp8/GHSA-vprp-94p9-5jp8.json +++ b/advisories/github-reviewed/2024/07/GHSA-vprp-94p9-5jp8/GHSA-vprp-94p9-5jp8.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vprp-94p9-5jp8", - "modified": "2024-07-25T16:44:50Z", + "modified": "2024-08-02T15:56:42Z", "published": "2024-07-24T21:31:30Z", "aliases": [ "CVE-2024-40137" @@ -9,7 +9,14 @@ "summary": "Dolibarr ERP CRM vulnerable to remote code execution (RCE) ", "details": "Dolibarr ERP CRM before 19.0.2 was discovered to contain a remote code execution (RCE) vulnerability via the Computed field parameter under the Users Module Setup function.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ { @@ -23,13 +30,13 @@ "events": [ { "introduced": "0" + }, + { + "fixed": "19.0.2" } ] } - ], - "database_specific": { - "last_known_affected_version_range": "< 19.0.2" - } + ] } ], "references": [ @@ -48,9 +55,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-74" ], - "severity": "HIGH", + "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-07-25T16:44:50Z", "nvd_published_at": "2024-07-24T19:15:04Z"