diff --git a/advisories/unreviewed/2024/03/GHSA-82j9-mv5q-rfv9/GHSA-82j9-mv5q-rfv9.json b/advisories/unreviewed/2024/03/GHSA-82j9-mv5q-rfv9/GHSA-82j9-mv5q-rfv9.json new file mode 100644 index 00000000000..77ef4cbb80d --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-82j9-mv5q-rfv9/GHSA-82j9-mv5q-rfv9.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-82j9-mv5q-rfv9", + "modified": "2024-03-11T00:30:45Z", + "published": "2024-03-11T00:30:45Z", + "aliases": [ + "CVE-2024-2364" + ], + "details": "A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android. Affected is an unknown function of the file androidmanifest.xml of the component Backup Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256320.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2364" + }, + { + "type": "WEB", + "url": "https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Musicshelf_Manifest_issue.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.256320" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.256320" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-530" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-10T23:15:54Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-883r-qq2g-w5xj/GHSA-883r-qq2g-w5xj.json b/advisories/unreviewed/2024/03/GHSA-883r-qq2g-w5xj/GHSA-883r-qq2g-w5xj.json new file mode 100644 index 00000000000..afab9dd6ea6 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-883r-qq2g-w5xj/GHSA-883r-qq2g-w5xj.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-883r-qq2g-w5xj", + "modified": "2024-03-11T00:30:45Z", + "published": "2024-03-11T00:30:45Z", + "aliases": [ + "CVE-2024-2314" + ], + "details": "If kernel headers need to be extracted, bcc will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2314" + }, + { + "type": "WEB", + "url": "https://github.com/iovisor/bcc/commit/008ea09e891194c072f2a9305a3c872a241dc342" + }, + { + "type": "WEB", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2314" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-10T23:15:53Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-cx25-cpw4-c882/GHSA-cx25-cpw4-c882.json b/advisories/unreviewed/2024/03/GHSA-cx25-cpw4-c882/GHSA-cx25-cpw4-c882.json new file mode 100644 index 00000000000..9e5e31c01ee --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-cx25-cpw4-c882/GHSA-cx25-cpw4-c882.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cx25-cpw4-c882", + "modified": "2024-03-11T00:30:45Z", + "published": "2024-03-11T00:30:45Z", + "aliases": [ + "CVE-2024-2365" + ], + "details": "A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by this vulnerability is an unknown functionality of the file io\\fabric\\sdk\\android\\services\\network\\PinningTrustManager.java of the component SHA-1 Handler. The manipulation leads to password hash with insufficient computational effort. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-256321 was assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2365" + }, + { + "type": "WEB", + "url": "https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Weak_Hashing_Algorithms.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.256321" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.256321" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-916" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-11T00:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-ph92-w482-m4jj/GHSA-ph92-w482-m4jj.json b/advisories/unreviewed/2024/03/GHSA-ph92-w482-m4jj/GHSA-ph92-w482-m4jj.json new file mode 100644 index 00000000000..205ba1b47f9 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-ph92-w482-m4jj/GHSA-ph92-w482-m4jj.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ph92-w482-m4jj", + "modified": "2024-03-11T00:30:45Z", + "published": "2024-03-11T00:30:45Z", + "aliases": [ + "CVE-2024-2313" + ], + "details": "If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2313" + }, + { + "type": "WEB", + "url": "https://github.com/bpftrace/bpftrace/commit/4be4b7191acb8218240e6b7178c30fa8c9b59998" + }, + { + "type": "WEB", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2313" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-10T23:15:53Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-r4vh-7vvv-pvqr/GHSA-r4vh-7vvv-pvqr.json b/advisories/unreviewed/2024/03/GHSA-r4vh-7vvv-pvqr/GHSA-r4vh-7vvv-pvqr.json new file mode 100644 index 00000000000..4d87b186b5e --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-r4vh-7vvv-pvqr/GHSA-r4vh-7vvv-pvqr.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r4vh-7vvv-pvqr", + "modified": "2024-03-11T00:30:45Z", + "published": "2024-03-11T00:30:45Z", + "aliases": [ + "CVE-2024-2363" + ], + "details": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in AOL AIM Triton 1.0.4. It has been declared as problematic. This vulnerability affects unknown code of the component Invite Handler. The manipulation of the argument CSeq leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256318 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2363" + }, + { + "type": "WEB", + "url": "https://fitoxs.com/vuldb/exploit/exploit_aim_triton.txt" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.256318" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.256318" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-404" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-10T23:15:54Z" + } +} \ No newline at end of file