From fc63bfa3f7fc90a80483492f5f8d43ab5071e093 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 11 Mar 2024 00:32:07 +0000 Subject: [PATCH] Publish Advisories GHSA-82j9-mv5q-rfv9 GHSA-883r-qq2g-w5xj GHSA-cx25-cpw4-c882 GHSA-ph92-w482-m4jj GHSA-r4vh-7vvv-pvqr --- .../GHSA-82j9-mv5q-rfv9.json | 46 +++++++++++++++++++ .../GHSA-883r-qq2g-w5xj.json | 42 +++++++++++++++++ .../GHSA-cx25-cpw4-c882.json | 46 +++++++++++++++++++ .../GHSA-ph92-w482-m4jj.json | 42 +++++++++++++++++ .../GHSA-r4vh-7vvv-pvqr.json | 46 +++++++++++++++++++ 5 files changed, 222 insertions(+) create mode 100644 advisories/unreviewed/2024/03/GHSA-82j9-mv5q-rfv9/GHSA-82j9-mv5q-rfv9.json create mode 100644 advisories/unreviewed/2024/03/GHSA-883r-qq2g-w5xj/GHSA-883r-qq2g-w5xj.json create mode 100644 advisories/unreviewed/2024/03/GHSA-cx25-cpw4-c882/GHSA-cx25-cpw4-c882.json create mode 100644 advisories/unreviewed/2024/03/GHSA-ph92-w482-m4jj/GHSA-ph92-w482-m4jj.json create mode 100644 advisories/unreviewed/2024/03/GHSA-r4vh-7vvv-pvqr/GHSA-r4vh-7vvv-pvqr.json diff --git a/advisories/unreviewed/2024/03/GHSA-82j9-mv5q-rfv9/GHSA-82j9-mv5q-rfv9.json b/advisories/unreviewed/2024/03/GHSA-82j9-mv5q-rfv9/GHSA-82j9-mv5q-rfv9.json new file mode 100644 index 00000000000..77ef4cbb80d --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-82j9-mv5q-rfv9/GHSA-82j9-mv5q-rfv9.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-82j9-mv5q-rfv9", + "modified": "2024-03-11T00:30:45Z", + "published": "2024-03-11T00:30:45Z", + "aliases": [ + "CVE-2024-2364" + ], + "details": "A vulnerability classified as problematic has been found in Musicshelf 1.0/1.1 on Android. Affected is an unknown function of the file androidmanifest.xml of the component Backup Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256320.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2364" + }, + { + "type": "WEB", + "url": "https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Musicshelf_Manifest_issue.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.256320" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.256320" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-530" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-10T23:15:54Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-883r-qq2g-w5xj/GHSA-883r-qq2g-w5xj.json b/advisories/unreviewed/2024/03/GHSA-883r-qq2g-w5xj/GHSA-883r-qq2g-w5xj.json new file mode 100644 index 00000000000..afab9dd6ea6 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-883r-qq2g-w5xj/GHSA-883r-qq2g-w5xj.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-883r-qq2g-w5xj", + "modified": "2024-03-11T00:30:45Z", + "published": "2024-03-11T00:30:45Z", + "aliases": [ + "CVE-2024-2314" + ], + "details": "If kernel headers need to be extracted, bcc will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2314" + }, + { + "type": "WEB", + "url": "https://github.com/iovisor/bcc/commit/008ea09e891194c072f2a9305a3c872a241dc342" + }, + { + "type": "WEB", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2314" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-10T23:15:53Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-cx25-cpw4-c882/GHSA-cx25-cpw4-c882.json b/advisories/unreviewed/2024/03/GHSA-cx25-cpw4-c882/GHSA-cx25-cpw4-c882.json new file mode 100644 index 00000000000..9e5e31c01ee --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-cx25-cpw4-c882/GHSA-cx25-cpw4-c882.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cx25-cpw4-c882", + "modified": "2024-03-11T00:30:45Z", + "published": "2024-03-11T00:30:45Z", + "aliases": [ + "CVE-2024-2365" + ], + "details": "A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by this vulnerability is an unknown functionality of the file io\\fabric\\sdk\\android\\services\\network\\PinningTrustManager.java of the component SHA-1 Handler. The manipulation leads to password hash with insufficient computational effort. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-256321 was assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2365" + }, + { + "type": "WEB", + "url": "https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Weak_Hashing_Algorithms.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.256321" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.256321" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-916" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-11T00:15:17Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-ph92-w482-m4jj/GHSA-ph92-w482-m4jj.json b/advisories/unreviewed/2024/03/GHSA-ph92-w482-m4jj/GHSA-ph92-w482-m4jj.json new file mode 100644 index 00000000000..205ba1b47f9 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-ph92-w482-m4jj/GHSA-ph92-w482-m4jj.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ph92-w482-m4jj", + "modified": "2024-03-11T00:30:45Z", + "published": "2024-03-11T00:30:45Z", + "aliases": [ + "CVE-2024-2313" + ], + "details": "If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. An unprivileged attacker could use this to force bcc to load compromised linux headers. Linux distributions which provide kernel headers by default are not affected by default.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2313" + }, + { + "type": "WEB", + "url": "https://github.com/bpftrace/bpftrace/commit/4be4b7191acb8218240e6b7178c30fa8c9b59998" + }, + { + "type": "WEB", + "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2313" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-10T23:15:53Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-r4vh-7vvv-pvqr/GHSA-r4vh-7vvv-pvqr.json b/advisories/unreviewed/2024/03/GHSA-r4vh-7vvv-pvqr/GHSA-r4vh-7vvv-pvqr.json new file mode 100644 index 00000000000..4d87b186b5e --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-r4vh-7vvv-pvqr/GHSA-r4vh-7vvv-pvqr.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r4vh-7vvv-pvqr", + "modified": "2024-03-11T00:30:45Z", + "published": "2024-03-11T00:30:45Z", + "aliases": [ + "CVE-2024-2363" + ], + "details": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in AOL AIM Triton 1.0.4. It has been declared as problematic. This vulnerability affects unknown code of the component Invite Handler. The manipulation of the argument CSeq leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-256318 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2363" + }, + { + "type": "WEB", + "url": "https://fitoxs.com/vuldb/exploit/exploit_aim_triton.txt" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.256318" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.256318" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-404" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-10T23:15:54Z" + } +} \ No newline at end of file