Advisory Database Sync

github · Dec 19, 2024 · 982e2b9 · 982e2b9
1 parent 0b0830e
commit 982e2b9
Show file tree

Hide file tree

Showing 26 changed files with 633 additions and 15 deletions.
diff --git a/advisories/github-reviewed/2024/12/GHSA-22c5-cpvr-cfvq/GHSA-22c5-cpvr-cfvq.json b/advisories/github-reviewed/2024/12/GHSA-22c5-cpvr-cfvq/GHSA-22c5-cpvr-cfvq.json
@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-22c5-cpvr-cfvq",
-  "modified": "2024-12-17T12:31:38Z",
+  "modified": "2024-12-19T15:31:11Z",
   "published": "2024-12-12T09:31:36Z",
   "aliases": [
     "CVE-2024-4109"
@@ -56,6 +56,10 @@
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2024:10933"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2024:11559"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/security/cve/CVE-2024-4109"

diff --git a/advisories/unreviewed/2022/05/GHSA-hwvf-grj2-9364/GHSA-hwvf-grj2-9364.json b/advisories/unreviewed/2022/05/GHSA-hwvf-grj2-9364/GHSA-hwvf-grj2-9364.json
@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-hwvf-grj2-9364",
-  "modified": "2022-05-24T17:29:25Z",
+  "modified": "2024-12-19T15:31:07Z",
   "published": "2022-05-24T17:29:25Z",
   "aliases": [
     "CVE-2020-3390"
   ],
   "details": "A vulnerability in Simple Network Management Protocol (SNMP) trap generation for wireless clients of the Cisco IOS XE Wireless Controller Software for the Cisco Catalyst 9000 Family could allow an unauthenticated, adjacent attacker to cause the device to unexpectedly reload, causing a denial of service (DoS) condition on an affected device. The vulnerability is due to the lack of input validation of the information used to generate an SNMP trap in relation to a wireless client connection. An attacker could exploit this vulnerability by sending an 802.1x packet with crafted parameters during the wireless authentication setup phase of a connection. A successful exploit could allow the attacker to cause the device to reload, causing a DoS condition.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {

diff --git a/advisories/unreviewed/2022/05/GHSA-vmh3-rhm9-223f/GHSA-vmh3-rhm9-223f.json b/advisories/unreviewed/2022/05/GHSA-vmh3-rhm9-223f/GHSA-vmh3-rhm9-223f.json
@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-vmh3-rhm9-223f",
-  "modified": "2022-05-24T17:29:25Z",
+  "modified": "2024-12-19T15:31:07Z",
   "published": "2022-05-24T17:29:25Z",
   "aliases": [
     "CVE-2020-3359"
   ],
   "details": "A vulnerability in the multicast DNS (mDNS) feature of Cisco IOS XE Software for Cisco Catalyst 9800 Series Wireless Controllers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to improper validation of mDNS packets. An attacker could exploit this vulnerability by sending a crafted mDNS packet to an affected device. A successful exploit could cause a device to reload, resulting in a DoS condition.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {

diff --git a/advisories/unreviewed/2024/04/GHSA-gxh7-r3qj-jmff/GHSA-gxh7-r3qj-jmff.json b/advisories/unreviewed/2024/04/GHSA-gxh7-r3qj-jmff/GHSA-gxh7-r3qj-jmff.json
@@ -54,7 +54,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-20"
+      "CWE-20",
+      "CWE-79"
     ],
     "severity": "HIGH",
     "github_reviewed": false,

diff --git a/advisories/unreviewed/2024/04/GHSA-jf9g-42gm-v87w/GHSA-jf9g-42gm-v87w.json b/advisories/unreviewed/2024/04/GHSA-jf9g-42gm-v87w/GHSA-jf9g-42gm-v87w.json
@@ -41,7 +41,9 @@
     }
   ],
   "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-787"
+    ],
     "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,

diff --git a/advisories/unreviewed/2024/04/GHSA-r8fc-3gvg-wxxf/GHSA-r8fc-3gvg-wxxf.json b/advisories/unreviewed/2024/04/GHSA-r8fc-3gvg-wxxf/GHSA-r8fc-3gvg-wxxf.json
@@ -54,7 +54,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-305"
+      "CWE-305",
+      "CWE-79"
     ],
     "severity": "CRITICAL",
     "github_reviewed": false,

diff --git a/advisories/unreviewed/2024/12/GHSA-2gmr-g5v4-9cch/GHSA-2gmr-g5v4-9cch.json b/advisories/unreviewed/2024/12/GHSA-2gmr-g5v4-9cch/GHSA-2gmr-g5v4-9cch.json
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2gmr-g5v4-9cch",
+  "modified": "2024-12-19T15:31:11Z",
+  "published": "2024-12-19T15:31:11Z",
+  "aliases": [
+    "CVE-2024-12786"
+  ],
+  "details": "A vulnerability, which was classified as critical, was found in X1a0He Adobe Downloader up to 1.3.1 on macOS. Affected is the function shouldAcceptNewConnection of the file com.x1a0he.macOS.Adobe-Downloader.helper of the component XPC Service. The manipulation leads to improper privilege management. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. This product is not affiliated with the company Adobe.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12786"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.288966"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.288966"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.464685"
+    },
+    {
+      "type": "WEB",
+      "url": "https://winslow1984.com/books/cve-collection/page/adobe-downloader-131-local-privilege-escalation"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-266"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-19T15:15:06Z"
+  }
+}
diff --git a/advisories/unreviewed/2024/12/GHSA-5h2c-fvjp-2wmx/GHSA-5h2c-fvjp-2wmx.json b/advisories/unreviewed/2024/12/GHSA-5h2c-fvjp-2wmx/GHSA-5h2c-fvjp-2wmx.json
@@ -42,7 +42,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-404"
+      "CWE-404",
+      "CWE-476"
     ],
     "severity": "MODERATE",
     "github_reviewed": false,

diff --git a/advisories/unreviewed/2024/12/GHSA-5mvx-j4j8-xv4p/GHSA-5mvx-j4j8-xv4p.json b/advisories/unreviewed/2024/12/GHSA-5mvx-j4j8-xv4p/GHSA-5mvx-j4j8-xv4p.json
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5mvx-j4j8-xv4p",
+  "modified": "2024-12-19T15:31:11Z",
+  "published": "2024-12-19T15:31:11Z",
+  "aliases": [
+    "CVE-2021-32589"
+  ],
+  "details": "A use after free in Fortinet FortiManager, FortiAnalyzer allows attacker to execute unauthorized code or commands via <insert attack vector here>",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32589"
+    },
+    {
+      "type": "WEB",
+      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-21-067"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-416"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-19T13:15:05Z"
+  }
+}
diff --git a/advisories/unreviewed/2024/12/GHSA-5pvq-85hg-5rww/GHSA-5pvq-85hg-5rww.json b/advisories/unreviewed/2024/12/GHSA-5pvq-85hg-5rww/GHSA-5pvq-85hg-5rww.json
@@ -0,0 +1,56 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5pvq-85hg-5rww",
+  "modified": "2024-12-19T15:31:11Z",
+  "published": "2024-12-19T15:31:11Z",
+  "aliases": [
+    "CVE-2024-12784"
+  ],
+  "details": "A vulnerability was found in itsourcecode Vehicle Management System 1.0. It has been classified as critical. Affected is an unknown function of the file editbill.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12784"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/FinleyTang/Vehicle-Management-System/blob/main/Vehicle%20Management%20System%20editbill.php%20has%20Sqlinjection.pdf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://itsourcecode.com"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.288960"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.288960"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.462629"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-19T14:15:05Z"
+  }
+}
diff --git a/advisories/unreviewed/2024/12/GHSA-62jh-qwjh-cgr7/GHSA-62jh-qwjh-cgr7.json b/advisories/unreviewed/2024/12/GHSA-62jh-qwjh-cgr7/GHSA-62jh-qwjh-cgr7.json
@@ -42,7 +42,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-404"
+      "CWE-404",
+      "CWE-476"
     ],
     "severity": "MODERATE",
     "github_reviewed": false,

diff --git a/advisories/unreviewed/2024/12/GHSA-6mpf-h5jc-fvrw/GHSA-6mpf-h5jc-fvrw.json b/advisories/unreviewed/2024/12/GHSA-6mpf-h5jc-fvrw/GHSA-6mpf-h5jc-fvrw.json
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6mpf-h5jc-fvrw",
+  "modified": "2024-12-19T15:31:11Z",
+  "published": "2024-12-19T15:31:11Z",
+  "aliases": [
+    "CVE-2024-9101"
+  ],
+  "details": "A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via the 'element' parameter, which is unsafely passed to the JavaScript 'eval' function. However, exploitation is limited to specific conditions where 'opener' is correctly set.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9101"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/leenooks/phpLDAPadmin/commit/f713afc8d164169516c91b0988531f2accb9bce6#diff-c2d6d7678ada004e704ee055169395a58227aaec86a6f75fa74ca18ff49bca44R27"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/leenooks/phpLDAPadmin/blob/master/htdocs/entry_chooser.php"
+    },
+    {
+      "type": "WEB",
+      "url": "https://sourceforge.net/projects/phpldapadmin/files/phpldapadmin-php5/1.2.1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.redguard.ch/blog/2024/12/19/security-advisory-phpldapadmin"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "LOW",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-19T14:15:06Z"
+  }
+}
diff --git a/advisories/unreviewed/2024/12/GHSA-77c2-c35q-254w/GHSA-77c2-c35q-254w.json b/advisories/unreviewed/2024/12/GHSA-77c2-c35q-254w/GHSA-77c2-c35q-254w.json
@@ -0,0 +1,48 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-77c2-c35q-254w",
+  "modified": "2024-12-19T15:31:11Z",
+  "published": "2024-12-19T15:31:11Z",
+  "aliases": [
+    "CVE-2024-25131"
+  ],
+  "details": "A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource (CRD) of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged service account to run the job. This can allow a standard developer user to escalate their privileges to a cluster administrator and pivot to the AWS environment.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25131"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/openshift/must-gather-operator/pull/135"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/openshift/must-gather-operator/pull/138"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/security/cve/CVE-2024-25131"
+    },
+    {
+      "type": "WEB",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258856"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-20"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-12-19T15:15:07Z"
+  }
+}
diff --git a/advisories/unreviewed/2024/12/GHSA-g2mr-f5hm-6x69/GHSA-g2mr-f5hm-6x69.json b/advisories/unreviewed/2024/12/GHSA-g2mr-f5hm-6x69/GHSA-g2mr-f5hm-6x69.json
@@ -42,7 +42,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-404"
+      "CWE-404",
+      "CWE-476"
     ],
     "severity": "MODERATE",
     "github_reviewed": false,

diff --git a/advisories/unreviewed/2024/12/GHSA-hjr5-pr64-8mc2/GHSA-hjr5-pr64-8mc2.json b/advisories/unreviewed/2024/12/GHSA-hjr5-pr64-8mc2/GHSA-hjr5-pr64-8mc2.json
@@ -42,7 +42,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-404"
+      "CWE-404",
+      "CWE-476"
     ],
     "severity": "MODERATE",
     "github_reviewed": false,