Publish Advisories

GHSA-6m6j-6mf3-699f
GHSA-6qmr-x8pc-q3r8
GHSA-cmx2-vf3h-cg9p
GHSA-fr2x-v6g7-3mwv

advisories/unreviewed/2024/03/GHSA-6m6j-6mf3-699f/GHSA-6m6j-6mf3-699f.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6m6j-6mf3-699f",
+  "modified": "2024-03-13T09:31:21Z",
+  "published": "2024-03-13T09:31:21Z",
+  "aliases": [
+    "CVE-2024-26529"
+  ],
+  "details": "An issue in mz-automation libiec61850 v.1.5.3 and before, allows a remote attacker to cause a denial of service (DoS) via the mmsServer_handleDeleteNamedVariableListRequest function of src/mms/iso_mms/server/mms_named_variable_list_service.c.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26529"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mz-automation/libiec61850/issues/492"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/mz-automation/libiec61850/issues/495"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-03-13T08:15:43Z"
+  }
+}

advisories/unreviewed/2024/03/GHSA-6qmr-x8pc-q3r8/GHSA-6qmr-x8pc-q3r8.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6qmr-x8pc-q3r8",
+  "modified": "2024-03-13T09:31:22Z",
+  "published": "2024-03-13T09:31:22Z",
+  "aliases": [
+    "CVE-2015-10123"
+  ],
+  "details": "An unautheticated remote attacker could send specifically crafted packets to a affected device. If an authenticated user then views that data in a specific page of the web-based management a buffer overflow will be triggered to gain full access of the device.\n",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-10123"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cert.vde.com/en/advisories/VDE-2023-039"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-120"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-03-13T09:15:06Z"
+  }
+}

advisories/unreviewed/2024/03/GHSA-cmx2-vf3h-cg9p/GHSA-cmx2-vf3h-cg9p.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cmx2-vf3h-cg9p",
+  "modified": "2024-03-13T09:31:22Z",
+  "published": "2024-03-13T09:31:22Z",
+  "aliases": [
+    "CVE-2024-28623"
+  ],
+  "details": "RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_section.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28623"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/GURJOTEXPERT/ritecms"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-03-13T08:15:43Z"
+  }
+}

advisories/unreviewed/2024/03/GHSA-fr2x-v6g7-3mwv/GHSA-fr2x-v6g7-3mwv.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-fr2x-v6g7-3mwv",
+  "modified": "2024-03-13T09:31:22Z",
+  "published": "2024-03-13T09:31:22Z",
+  "aliases": [
+    "CVE-2018-25090"
+  ],
+  "details": "An unauthenticated remote attacker can use an XSS attack due to improper neutralization of input during web page generation. User interaction is required. This leads to a limited impact of confidentiality and integrity but no impact of availability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-25090"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cert.vde.com/en/advisories/VDE-2023-039"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-03-13T09:15:07Z"
+  }
+}