From fd79cc9f0c640feaffa3e35f810a88161564e5a3 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 19 Feb 2024 12:31:54 +0000 Subject: [PATCH] Publish Advisories GHSA-9w3h-593p-q56r GHSA-jjr8-97p7-vmmg GHSA-3p7f-4r2q-wxmm GHSA-4265-ccf5-phj5 GHSA-4g9r-vxhx-9pgx GHSA-6fvm-72pg-5mvv GHSA-jg62-3p5c-pg7j GHSA-qg8q-74vc-qfgq GHSA-vcv5-7xr7-wf5f --- .../GHSA-9w3h-593p-q56r.json | 6 +-- .../GHSA-jjr8-97p7-vmmg.json | 3 +- .../GHSA-3p7f-4r2q-wxmm.json | 42 +++++++++++++++++++ .../GHSA-4265-ccf5-phj5.json | 6 ++- .../GHSA-4g9r-vxhx-9pgx.json | 6 ++- .../GHSA-6fvm-72pg-5mvv.json | 38 +++++++++++++++++ .../GHSA-jg62-3p5c-pg7j.json | 38 +++++++++++++++++ .../GHSA-qg8q-74vc-qfgq.json | 38 +++++++++++++++++ .../GHSA-vcv5-7xr7-wf5f.json | 38 +++++++++++++++++ 9 files changed, 209 insertions(+), 6 deletions(-) create mode 100644 advisories/unreviewed/2024/02/GHSA-3p7f-4r2q-wxmm/GHSA-3p7f-4r2q-wxmm.json create mode 100644 advisories/unreviewed/2024/02/GHSA-6fvm-72pg-5mvv/GHSA-6fvm-72pg-5mvv.json create mode 100644 advisories/unreviewed/2024/02/GHSA-jg62-3p5c-pg7j/GHSA-jg62-3p5c-pg7j.json create mode 100644 advisories/unreviewed/2024/02/GHSA-qg8q-74vc-qfgq/GHSA-qg8q-74vc-qfgq.json create mode 100644 advisories/unreviewed/2024/02/GHSA-vcv5-7xr7-wf5f/GHSA-vcv5-7xr7-wf5f.json diff --git a/advisories/unreviewed/2024/01/GHSA-9w3h-593p-q56r/GHSA-9w3h-593p-q56r.json b/advisories/unreviewed/2024/01/GHSA-9w3h-593p-q56r/GHSA-9w3h-593p-q56r.json index f2fbf562159..8ad65bb3e23 100644 --- a/advisories/unreviewed/2024/01/GHSA-9w3h-593p-q56r/GHSA-9w3h-593p-q56r.json +++ b/advisories/unreviewed/2024/01/GHSA-9w3h-593p-q56r/GHSA-9w3h-593p-q56r.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-9w3h-593p-q56r", - "modified": "2024-01-29T12:30:20Z", + "modified": "2024-02-19T12:30:37Z", "published": "2024-01-29T12:30:20Z", "aliases": [ "CVE-2023-5378" @@ -31,11 +31,11 @@ }, { "type": "WEB", - "url": "https://megabip.pl/" + "url": "https://megabip.pl" }, { "type": "WEB", - "url": "https://smod.pl/" + "url": "https://smod.pl" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/01/GHSA-jjr8-97p7-vmmg/GHSA-jjr8-97p7-vmmg.json b/advisories/unreviewed/2024/01/GHSA-jjr8-97p7-vmmg/GHSA-jjr8-97p7-vmmg.json index 3b46eac7e96..4315a006fc0 100644 --- a/advisories/unreviewed/2024/01/GHSA-jjr8-97p7-vmmg/GHSA-jjr8-97p7-vmmg.json +++ b/advisories/unreviewed/2024/01/GHSA-jjr8-97p7-vmmg/GHSA-jjr8-97p7-vmmg.json @@ -60,7 +60,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-131" + "CWE-131", + "CWE-190" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/02/GHSA-3p7f-4r2q-wxmm/GHSA-3p7f-4r2q-wxmm.json b/advisories/unreviewed/2024/02/GHSA-3p7f-4r2q-wxmm/GHSA-3p7f-4r2q-wxmm.json new file mode 100644 index 00000000000..1b95c248f13 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-3p7f-4r2q-wxmm/GHSA-3p7f-4r2q-wxmm.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3p7f-4r2q-wxmm", + "modified": "2024-02-19T12:30:37Z", + "published": "2024-02-19T12:30:37Z", + "aliases": [ + "CVE-2024-1580" + ], + "details": "An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.\n\n\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1580" + }, + { + "type": "WEB", + "url": "https://code.videolan.org/videolan/dav1d/-/blob/master/NEWS" + }, + { + "type": "WEB", + "url": "https://code.videolan.org/videolan/dav1d/-/releases/1.4.0" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-190" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-19T11:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-4265-ccf5-phj5/GHSA-4265-ccf5-phj5.json b/advisories/unreviewed/2024/02/GHSA-4265-ccf5-phj5/GHSA-4265-ccf5-phj5.json index cb4d8a6e161..1ad890b67a9 100644 --- a/advisories/unreviewed/2024/02/GHSA-4265-ccf5-phj5/GHSA-4265-ccf5-phj5.json +++ b/advisories/unreviewed/2024/02/GHSA-4265-ccf5-phj5/GHSA-4265-ccf5-phj5.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4265-ccf5-phj5", - "modified": "2024-02-19T09:30:52Z", + "modified": "2024-02-19T12:30:37Z", "published": "2024-02-19T09:30:52Z", "aliases": [ "CVE-2024-26308" @@ -21,6 +21,10 @@ { "type": "WEB", "url": "https://lists.apache.org/thread/ch5yo2d21p7vlqrhll9b17otbyq4npfg" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/02/19/2" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/02/GHSA-4g9r-vxhx-9pgx/GHSA-4g9r-vxhx-9pgx.json b/advisories/unreviewed/2024/02/GHSA-4g9r-vxhx-9pgx/GHSA-4g9r-vxhx-9pgx.json index dcf54861f34..936afd76d65 100644 --- a/advisories/unreviewed/2024/02/GHSA-4g9r-vxhx-9pgx/GHSA-4g9r-vxhx-9pgx.json +++ b/advisories/unreviewed/2024/02/GHSA-4g9r-vxhx-9pgx/GHSA-4g9r-vxhx-9pgx.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-4g9r-vxhx-9pgx", - "modified": "2024-02-19T09:30:50Z", + "modified": "2024-02-19T12:30:37Z", "published": "2024-02-19T09:30:50Z", "aliases": [ "CVE-2024-25710" @@ -24,6 +24,10 @@ { "type": "WEB", "url": "https://lists.apache.org/thread/cz8qkcwphy4cx8gltn932ln51cbtq6kf" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/02/19/1" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/02/GHSA-6fvm-72pg-5mvv/GHSA-6fvm-72pg-5mvv.json b/advisories/unreviewed/2024/02/GHSA-6fvm-72pg-5mvv/GHSA-6fvm-72pg-5mvv.json new file mode 100644 index 00000000000..bd4d5250994 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-6fvm-72pg-5mvv/GHSA-6fvm-72pg-5mvv.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6fvm-72pg-5mvv", + "modified": "2024-02-19T12:30:37Z", + "published": "2024-02-19T12:30:37Z", + "aliases": [ + "CVE-2024-1346" + ], + "details": "Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to calculate the root password of the MySQL database used by LaborOfficeFree using two constants.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1346" + }, + { + "type": "WEB", + "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-521" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-19T12:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-jg62-3p5c-pg7j/GHSA-jg62-3p5c-pg7j.json b/advisories/unreviewed/2024/02/GHSA-jg62-3p5c-pg7j/GHSA-jg62-3p5c-pg7j.json new file mode 100644 index 00000000000..7b3c510a544 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-jg62-3p5c-pg7j/GHSA-jg62-3p5c-pg7j.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jg62-3p5c-pg7j", + "modified": "2024-02-19T12:30:37Z", + "published": "2024-02-19T12:30:37Z", + "aliases": [ + "CVE-2024-1343" + ], + "details": "A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfiles(x86)% LaborOfficeFree BackUp'.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1343" + }, + { + "type": "WEB", + "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-19T12:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-qg8q-74vc-qfgq/GHSA-qg8q-74vc-qfgq.json b/advisories/unreviewed/2024/02/GHSA-qg8q-74vc-qfgq/GHSA-qg8q-74vc-qfgq.json new file mode 100644 index 00000000000..e5ffadb4be1 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-qg8q-74vc-qfgq/GHSA-qg8q-74vc-qfgq.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qg8q-74vc-qfgq", + "modified": "2024-02-19T12:30:37Z", + "published": "2024-02-19T12:30:37Z", + "aliases": [ + "CVE-2024-1344" + ], + "details": "Encrypted database credentials in LaborOfficeFree affecting version 19.10. This vulnerability allows an attacker to read and extract the username and password from the database of 'LOF_service.exe' and 'LaborOfficeFree.exe' located in the '%programfiles(x86)%\\LaborOfficeFree\\' directory. This user can log in remotely and has root-like privileges.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1344" + }, + { + "type": "WEB", + "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-798" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-19T12:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-vcv5-7xr7-wf5f/GHSA-vcv5-7xr7-wf5f.json b/advisories/unreviewed/2024/02/GHSA-vcv5-7xr7-wf5f/GHSA-vcv5-7xr7-wf5f.json new file mode 100644 index 00000000000..ca75d4e59f2 --- /dev/null +++ b/advisories/unreviewed/2024/02/GHSA-vcv5-7xr7-wf5f/GHSA-vcv5-7xr7-wf5f.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vcv5-7xr7-wf5f", + "modified": "2024-02-19T12:30:37Z", + "published": "2024-02-19T12:30:37Z", + "aliases": [ + "CVE-2024-1345" + ], + "details": "Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to perform a brute force attack and easily discover the root password.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1345" + }, + { + "type": "WEB", + "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-laborofficefree" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-521" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-02-19T12:15:44Z" + } +} \ No newline at end of file