diff --git a/advisories/unreviewed/2024/01/GHSA-9w3h-593p-q56r/GHSA-9w3h-593p-q56r.json b/advisories/unreviewed/2024/01/GHSA-9w3h-593p-q56r/GHSA-9w3h-593p-q56r.json index f2fbf562159..8ad65bb3e23 100644 --- a/advisories/unreviewed/2024/01/GHSA-9w3h-593p-q56r/GHSA-9w3h-593p-q56r.json +++ b/advisories/unreviewed/2024/01/GHSA-9w3h-593p-q56r/GHSA-9w3h-593p-q56r.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9w3h-593p-q56r", - "modified": "2024-01-29T12:30:20Z", + "modified": "2024-02-19T12:30:37Z", "published": "2024-01-29T12:30:20Z", "aliases": [ "CVE-2023-5378" @@ -31,11 +31,11 @@ }, { "type": "WEB", - "url": "https://megabip.pl/" + "url": "https://megabip.pl" }, { "type": "WEB", - "url": "https://smod.pl/" + "url": "https://smod.pl" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/01/GHSA-jjr8-97p7-vmmg/GHSA-jjr8-97p7-vmmg.json b/advisories/unreviewed/2024/01/GHSA-jjr8-97p7-vmmg/GHSA-jjr8-97p7-vmmg.json index 3b46eac7e96..4315a006fc0 100644 --- a/advisories/unreviewed/2024/01/GHSA-jjr8-97p7-vmmg/GHSA-jjr8-97p7-vmmg.json +++ b/advisories/unreviewed/2024/01/GHSA-jjr8-97p7-vmmg/GHSA-jjr8-97p7-vmmg.json @@ -60,7 +60,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-131" + "CWE-131", + "CWE-190" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/02/GHSA-3p7f-4r2q-wxmm/GHSA-3p7f-4r2q-wxmm.json b/advisories/unreviewed/2024/02/GHSA-3p7f-4r2q-wxmm/GHSA-3p7f-4r2q-wxmm.json new file mode 100644 index 00000000000..1b95c248f13 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-3p7f-4r2q-wxmm/GHSA-3p7f-4r2q-wxmm.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3p7f-4r2q-wxmm", + "modified": "2024-02-19T12:30:37Z", + "published": "2024-02-19T12:30:37Z", + "aliases": [ + "CVE-2024-1580" + ], + "details": "An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.\n\n\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1580" + }, + { + "type": "WEB", + "url": "https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS" + }, + { + "type": "WEB", + "url": "https://code.videolan.org/videolan/dav1d/-/releases/1.4.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-19T11:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-4265-ccf5-phj5/GHSA-4265-ccf5-phj5.json b/advisories/unreviewed/2024/02/GHSA-4265-ccf5-phj5/GHSA-4265-ccf5-phj5.json index cb4d8a6e161..1ad890b67a9 100644 --- a/advisories/unreviewed/2024/02/GHSA-4265-ccf5-phj5/GHSA-4265-ccf5-phj5.json +++ b/advisories/unreviewed/2024/02/GHSA-4265-ccf5-phj5/GHSA-4265-ccf5-phj5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4265-ccf5-phj5", - "modified": "2024-02-19T09:30:52Z", + "modified": "2024-02-19T12:30:37Z", "published": "2024-02-19T09:30:52Z", "aliases": [ "CVE-2024-26308" @@ -21,6 +21,10 @@ { "type": "WEB", "url": "https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/02/19/2" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/02/GHSA-4g9r-vxhx-9pgx/GHSA-4g9r-vxhx-9pgx.json b/advisories/unreviewed/2024/02/GHSA-4g9r-vxhx-9pgx/GHSA-4g9r-vxhx-9pgx.json index dcf54861f34..936afd76d65 100644 --- a/advisories/unreviewed/2024/02/GHSA-4g9r-vxhx-9pgx/GHSA-4g9r-vxhx-9pgx.json +++ b/advisories/unreviewed/2024/02/GHSA-4g9r-vxhx-9pgx/GHSA-4g9r-vxhx-9pgx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4g9r-vxhx-9pgx", - "modified": "2024-02-19T09:30:50Z", + "modified": "2024-02-19T12:30:37Z", "published": "2024-02-19T09:30:50Z", "aliases": [ "CVE-2024-25710" @@ -24,6 +24,10 @@ { "type": "WEB", "url": "https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/02/19/1" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/02/GHSA-6fvm-72pg-5mvv/GHSA-6fvm-72pg-5mvv.json b/advisories/unreviewed/2024/02/GHSA-6fvm-72pg-5mvv/GHSA-6fvm-72pg-5mvv.json new file mode 100644 index 00000000000..bd4d5250994 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-6fvm-72pg-5mvv/GHSA-6fvm-72pg-5mvv.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6fvm-72pg-5mvv", + "modified": "2024-02-19T12:30:37Z", + "published": "2024-02-19T12:30:37Z", + "aliases": [ + "CVE-2024-1346" + ], + "details": "Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to calculate the root password of the MySQL database used by LaborOfficeFree using two constants.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1346" + }, + { + "type": "WEB", + "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-521" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-19T12:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-jg62-3p5c-pg7j/GHSA-jg62-3p5c-pg7j.json b/advisories/unreviewed/2024/02/GHSA-jg62-3p5c-pg7j/GHSA-jg62-3p5c-pg7j.json new file mode 100644 index 00000000000..7b3c510a544 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-jg62-3p5c-pg7j/GHSA-jg62-3p5c-pg7j.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jg62-3p5c-pg7j", + "modified": "2024-02-19T12:30:37Z", + "published": "2024-02-19T12:30:37Z", + "aliases": [ + "CVE-2024-1343" + ], + "details": "A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfiles(x86)% LaborOfficeFree BackUp'.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1343" + }, + { + "type": "WEB", + "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-19T12:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-qg8q-74vc-qfgq/GHSA-qg8q-74vc-qfgq.json b/advisories/unreviewed/2024/02/GHSA-qg8q-74vc-qfgq/GHSA-qg8q-74vc-qfgq.json new file mode 100644 index 00000000000..e5ffadb4be1 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-qg8q-74vc-qfgq/GHSA-qg8q-74vc-qfgq.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qg8q-74vc-qfgq", + "modified": "2024-02-19T12:30:37Z", + "published": "2024-02-19T12:30:37Z", + "aliases": [ + "CVE-2024-1344" + ], + "details": "Encrypted database credentials in LaborOfficeFree affecting version 19.10. This vulnerability allows an attacker to read and extract the username and password from the database of 'LOF_service.exe' and 'LaborOfficeFree.exe' located in the '%programfiles(x86)%\\LaborOfficeFree\\' directory. This user can log in remotely and has root-like privileges.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1344" + }, + { + "type": "WEB", + "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-798" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-19T12:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-vcv5-7xr7-wf5f/GHSA-vcv5-7xr7-wf5f.json b/advisories/unreviewed/2024/02/GHSA-vcv5-7xr7-wf5f/GHSA-vcv5-7xr7-wf5f.json new file mode 100644 index 00000000000..ca75d4e59f2 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-vcv5-7xr7-wf5f/GHSA-vcv5-7xr7-wf5f.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vcv5-7xr7-wf5f", + "modified": "2024-02-19T12:30:37Z", + "published": "2024-02-19T12:30:37Z", + "aliases": [ + "CVE-2024-1345" + ], + "details": "Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to perform a brute force attack and easily discover the root password.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1345" + }, + { + "type": "WEB", + "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-521" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-19T12:15:44Z" + } +} \ No newline at end of file