From fd85726f3fb91bef0850e60b9c7bc86cdf1be945 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 14 Oct 2024 21:32:02 +0000 Subject: [PATCH] Publish Advisories GHSA-2q75-f7cp-w86q GHSA-wprr-mc54-c62q GHSA-6p2j-228c-wmvm GHSA-7rc4-v56c-j5pm GHSA-8f5f-8xpp-8qfr GHSA-gq7m-h265-px53 GHSA-pqjf-jm5p-23mq GHSA-v77g-99m4-2vmq --- .../GHSA-2q75-f7cp-w86q.json | 19 +++++++-- .../GHSA-wprr-mc54-c62q.json | 34 ++++++++++++++- .../GHSA-6p2j-228c-wmvm.json | 35 ++++++++++++++++ .../GHSA-7rc4-v56c-j5pm.json | 35 ++++++++++++++++ .../GHSA-8f5f-8xpp-8qfr.json | 35 ++++++++++++++++ .../GHSA-gq7m-h265-px53.json | 42 +++++++++++++++++++ .../GHSA-pqjf-jm5p-23mq.json | 35 ++++++++++++++++ .../GHSA-v77g-99m4-2vmq.json | 35 ++++++++++++++++ 8 files changed, 264 insertions(+), 6 deletions(-) create mode 100644 advisories/unreviewed/2024/10/GHSA-6p2j-228c-wmvm/GHSA-6p2j-228c-wmvm.json create mode 100644 advisories/unreviewed/2024/10/GHSA-7rc4-v56c-j5pm/GHSA-7rc4-v56c-j5pm.json create mode 100644 advisories/unreviewed/2024/10/GHSA-8f5f-8xpp-8qfr/GHSA-8f5f-8xpp-8qfr.json create mode 100644 advisories/unreviewed/2024/10/GHSA-gq7m-h265-px53/GHSA-gq7m-h265-px53.json create mode 100644 advisories/unreviewed/2024/10/GHSA-pqjf-jm5p-23mq/GHSA-pqjf-jm5p-23mq.json create mode 100644 advisories/unreviewed/2024/10/GHSA-v77g-99m4-2vmq/GHSA-v77g-99m4-2vmq.json diff --git a/advisories/github-reviewed/2022/05/GHSA-2q75-f7cp-w86q/GHSA-2q75-f7cp-w86q.json b/advisories/github-reviewed/2022/05/GHSA-2q75-f7cp-w86q/GHSA-2q75-f7cp-w86q.json index a9156b099ee..5fe2da154d1 100644 --- a/advisories/github-reviewed/2022/05/GHSA-2q75-f7cp-w86q/GHSA-2q75-f7cp-w86q.json +++ b/advisories/github-reviewed/2022/05/GHSA-2q75-f7cp-w86q/GHSA-2q75-f7cp-w86q.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-2q75-f7cp-w86q", - "modified": "2023-02-04T00:15:51Z", + "modified": "2024-10-14T21:30:24Z", "published": "2022-05-17T04:30:18Z", "aliases": [ "CVE-2012-5500" @@ -9,13 +9,20 @@ "summary": "Plone contains Cross-site Request Forgery", "details": "The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ { "package": { "ecosystem": "PyPI", - "name": "plone" + "name": "Plone" }, "ranges": [ { @@ -34,7 +41,7 @@ { "package": { "ecosystem": "PyPI", - "name": "plone" + "name": "Plone" }, "ranges": [ { @@ -76,6 +83,10 @@ "type": "PACKAGE", "url": "https://github.com/plone/plone" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-42.yaml" + }, { "type": "WEB", "url": "https://plone.org/products/plone-hotfix/releases/20121106" diff --git a/advisories/github-reviewed/2022/05/GHSA-wprr-mc54-c62q/GHSA-wprr-mc54-c62q.json b/advisories/github-reviewed/2022/05/GHSA-wprr-mc54-c62q/GHSA-wprr-mc54-c62q.json index 8c1f139c752..9bb320045a0 100644 --- a/advisories/github-reviewed/2022/05/GHSA-wprr-mc54-c62q/GHSA-wprr-mc54-c62q.json +++ b/advisories/github-reviewed/2022/05/GHSA-wprr-mc54-c62q/GHSA-wprr-mc54-c62q.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wprr-mc54-c62q", - "modified": "2023-02-14T01:01:02Z", + "modified": "2024-10-14T21:31:16Z", "published": "2022-05-17T04:30:15Z", "aliases": [ "CVE-2012-5508" @@ -9,7 +9,14 @@ "summary": "Exposure of Sensitive Information in Plone", "details": "The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for password resets via unspecified vectors. NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6661 was assigned for the PRNG reseeding issue in Zope.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } ], "affected": [ { @@ -30,6 +37,25 @@ ] } ] + }, + { + "package": { + "ecosystem": "PyPI", + "name": "Plone" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "4.3a0" + }, + { + "fixed": "4.3b1" + } + ] + } + ] } ], "references": [ @@ -49,6 +75,10 @@ "type": "WEB", "url": "https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt" }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-50.yaml" + }, { "type": "WEB", "url": "https://plone.org/products/plone-hotfix/releases/20121124" diff --git a/advisories/unreviewed/2024/10/GHSA-6p2j-228c-wmvm/GHSA-6p2j-228c-wmvm.json b/advisories/unreviewed/2024/10/GHSA-6p2j-228c-wmvm/GHSA-6p2j-228c-wmvm.json new file mode 100644 index 00000000000..4e9b413826f --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-6p2j-228c-wmvm/GHSA-6p2j-228c-wmvm.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6p2j-228c-wmvm", + "modified": "2024-10-14T21:30:26Z", + "published": "2024-10-14T21:30:26Z", + "aliases": [ + "CVE-2023-48082" + ], + "details": "Nagios XI before 5.11.3 2024R1 was discovered to improperly handle API keys generation (randomly-generated), allowing attackers to possibly generate the same set of API keys for all users and utilize them to authenticate.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48082" + }, + { + "type": "WEB", + "url": "https://www.nagios.com/change-log" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-14T19:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-7rc4-v56c-j5pm/GHSA-7rc4-v56c-j5pm.json b/advisories/unreviewed/2024/10/GHSA-7rc4-v56c-j5pm/GHSA-7rc4-v56c-j5pm.json new file mode 100644 index 00000000000..87b04b3f9f6 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-7rc4-v56c-j5pm/GHSA-7rc4-v56c-j5pm.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7rc4-v56c-j5pm", + "modified": "2024-10-14T21:30:26Z", + "published": "2024-10-14T21:30:26Z", + "aliases": [ + "CVE-2024-48822" + ], + "details": "Privilege escalation in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges via the FtpConfig.php page.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48822" + }, + { + "type": "WEB", + "url": "https://daly.wtf/multiple-vulnerabilities-discovered-in-automatic-systems-software" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-14T21:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-8f5f-8xpp-8qfr/GHSA-8f5f-8xpp-8qfr.json b/advisories/unreviewed/2024/10/GHSA-8f5f-8xpp-8qfr/GHSA-8f5f-8xpp-8qfr.json new file mode 100644 index 00000000000..6cb95b623ba --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-8f5f-8xpp-8qfr/GHSA-8f5f-8xpp-8qfr.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8f5f-8xpp-8qfr", + "modified": "2024-10-14T21:30:27Z", + "published": "2024-10-14T21:30:26Z", + "aliases": [ + "CVE-2024-48821" + ], + "details": "Cross Site Scripting vulnerability in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges via the FtpConfig.php component.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48821" + }, + { + "type": "WEB", + "url": "https://daly.wtf/multiple-vulnerabilities-discovered-in-automatic-systems-software" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-14T21:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-gq7m-h265-px53/GHSA-gq7m-h265-px53.json b/advisories/unreviewed/2024/10/GHSA-gq7m-h265-px53/GHSA-gq7m-h265-px53.json new file mode 100644 index 00000000000..0543ceadb28 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-gq7m-h265-px53/GHSA-gq7m-h265-px53.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gq7m-h265-px53", + "modified": "2024-10-14T21:30:27Z", + "published": "2024-10-14T21:30:27Z", + "aliases": [ + "CVE-2024-6207" + ], + "details": "CVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html  and send a specially crafted CIP message to the device. If exploited, a threat actor could help prevent access to the legitimate user and end connections to connected devices including the workstation. To recover the controllers, a download is required which ends any process that the controller is running.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6207" + }, + { + "type": "WEB", + "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1707.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-14T21:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-pqjf-jm5p-23mq/GHSA-pqjf-jm5p-23mq.json b/advisories/unreviewed/2024/10/GHSA-pqjf-jm5p-23mq/GHSA-pqjf-jm5p-23mq.json new file mode 100644 index 00000000000..514218a28c3 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-pqjf-jm5p-23mq/GHSA-pqjf-jm5p-23mq.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pqjf-jm5p-23mq", + "modified": "2024-10-14T21:30:26Z", + "published": "2024-10-14T21:30:26Z", + "aliases": [ + "CVE-2024-48823" + ], + "details": "Local file inclusion in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to escalate privileges via the PassageAutoServer.php page.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48823" + }, + { + "type": "WEB", + "url": "https://daly.wtf/multiple-vulnerabilities-discovered-in-automatic-systems-software" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-14T21:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-v77g-99m4-2vmq/GHSA-v77g-99m4-2vmq.json b/advisories/unreviewed/2024/10/GHSA-v77g-99m4-2vmq/GHSA-v77g-99m4-2vmq.json new file mode 100644 index 00000000000..bd2a9680062 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-v77g-99m4-2vmq/GHSA-v77g-99m4-2vmq.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v77g-99m4-2vmq", + "modified": "2024-10-14T21:30:27Z", + "published": "2024-10-14T21:30:27Z", + "aliases": [ + "CVE-2024-48824" + ], + "details": "An issue in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to obtain sensitive information via the Racine & FileName parameters in the download-file.php component.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48824" + }, + { + "type": "WEB", + "url": "https://daly.wtf/multiple-vulnerabilities-discovered-in-automatic-systems-software" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-14T21:15:11Z" + } +} \ No newline at end of file