diff --git a/data/consul/BIT-consul-2024-10005.json b/data/consul/BIT-consul-2024-10005.json index 1ec626f9ba..01e11686c2 100644 --- a/data/consul/BIT-consul-2024-10005.json +++ b/data/consul/BIT-consul-2024-10005.json @@ -15,7 +15,7 @@ "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N" + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], "ranges": [ @@ -58,7 +58,7 @@ } ], "database_specific": { - "severity": "Medium", + "severity": "High", "cpes": [ "cpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:*", "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*", @@ -70,8 +70,12 @@ { "type": "WEB", "url": "https://discuss.hashicorp.com/t/hcsec-2024-22-consul-l7-intentions-vulnerable-to-url-path-bypass" + }, + { + "type": "WEB", + "url": "https://security.netapp.com/advisory/ntap-20250110-0004/" } ], "published": "2024-11-01T07:08:02.109Z", - "modified": "2024-11-09T07:38:29.950Z" + "modified": "2025-01-11T07:38:25.737Z" } \ No newline at end of file diff --git a/data/consul/BIT-consul-2024-10006.json b/data/consul/BIT-consul-2024-10006.json index 3d90d8caf6..a2b3178dca 100644 --- a/data/consul/BIT-consul-2024-10006.json +++ b/data/consul/BIT-consul-2024-10006.json @@ -15,7 +15,7 @@ "severity": [ { "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N" + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L" } ], "ranges": [ @@ -58,7 +58,7 @@ } ], "database_specific": { - "severity": "Medium", + "severity": "High", "cpes": [ "cpe:2.3:a:hashicorp:consul:*:*:*:*:*:*:*:*", "cpe:2.3:a:hashicorp:consul:*:*:*:*:enterprise:*:*:*", @@ -70,8 +70,12 @@ { "type": "WEB", "url": "https://discuss.hashicorp.com/t/hcsec-2024-23-consul-l7-intentions-vulnerable-to-headers-bypass" + }, + { + "type": "WEB", + "url": "https://security.netapp.com/advisory/ntap-20250110-0005/" } ], "published": "2024-11-01T07:07:54.503Z", - "modified": "2024-11-09T07:38:29.950Z" + "modified": "2025-01-11T07:38:25.737Z" } \ No newline at end of file diff --git a/data/consul/BIT-consul-2024-10086.json b/data/consul/BIT-consul-2024-10086.json index 1e09cfe3a1..004bc2a656 100644 --- a/data/consul/BIT-consul-2024-10086.json +++ b/data/consul/BIT-consul-2024-10086.json @@ -64,8 +64,12 @@ { "type": "WEB", "url": "https://discuss.hashicorp.com/t/hcsec-2024-24-consul-vulnerable-to-reflected-xss-on-content-type-error-manipulation" + }, + { + "type": "WEB", + "url": "https://security.netapp.com/advisory/ntap-20250110-0006/" } ], "published": "2024-11-01T07:07:47.800Z", - "modified": "2024-11-02T07:36:38.597Z" + "modified": "2025-01-11T07:38:25.737Z" } \ No newline at end of file diff --git a/data/mattermost/BIT-mattermost-2024-23493.json b/data/mattermost/BIT-mattermost-2024-23493.json new file mode 100644 index 0000000000..135e701d33 --- /dev/null +++ b/data/mattermost/BIT-mattermost-2024-23493.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.5.0", + "id": "BIT-mattermost-2024-23493", + "details": "Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of. ", + "aliases": [ + "CVE-2024-23493" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "mattermost", + "purl": "pkg:bitnami/mattermost" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.1.9" + }, + { + "introduced": "9.0.0" + }, + { + "fixed": "9.2.5" + }, + { + "introduced": "9.4.0" + }, + { + "fixed": "9.4.2" + } + ] + }, + { + "type": "SEMVER", + "events": [ + { + "introduced": "9.3.0" + }, + { + "last_affected": "9.3.0" + }, + { + "introduced": "9.3.0-rc1" + }, + { + "last_affected": "9.3.0-rc1" + }, + { + "introduced": "9.3.0-rc2" + }, + { + "last_affected": "9.3.0-rc2" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", + "cpe:2.3:a:mattermost:mattermost_server:9.3.0:-:*:*:*:*:*:*", + "cpe:2.3:a:mattermost:mattermost_server:9.3.0:rc1:*:*:*:*:*:*", + "cpe:2.3:a:mattermost:mattermost_server:9.3.0:rc2:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "published": "2025-01-11T07:15:39.107Z", + "modified": "2025-01-11T07:38:25.737Z" +} \ No newline at end of file diff --git a/data/mattermost/BIT-mattermost-2024-24988.json b/data/mattermost/BIT-mattermost-2024-24988.json new file mode 100644 index 0000000000..22f3ffc614 --- /dev/null +++ b/data/mattermost/BIT-mattermost-2024-24988.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.5.0", + "id": "BIT-mattermost-2024-24988", + "details": "Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send multiple times a very long string as an emoji value causing high resource consumption and possibly crashing the server.", + "aliases": [ + "CVE-2024-24988" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "mattermost", + "purl": "pkg:bitnami/mattermost" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "8.1.8" + }, + { + "introduced": "9.0.0" + }, + { + "fixed": "9.1.5" + }, + { + "introduced": "9.2.0" + }, + { + "fixed": "9.2.4" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "published": "2025-01-11T07:14:49.615Z", + "modified": "2025-01-11T07:38:25.737Z" +} \ No newline at end of file diff --git a/data/php/BIT-php-2024-8929.json b/data/php/BIT-php-2024-8929.json index 1d3ee870c8..fddf524572 100644 --- a/data/php/BIT-php-2024-8929.json +++ b/data/php/BIT-php-2024-8929.json @@ -55,8 +55,12 @@ { "type": "WEB", "url": "https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678" + }, + { + "type": "WEB", + "url": "https://security.netapp.com/advisory/ntap-20250110-0008/" } ], "published": "2024-11-27T19:18:36.988Z", - "modified": "2024-11-27T19:40:48.342Z" + "modified": "2025-01-11T07:38:25.737Z" } \ No newline at end of file diff --git a/data/php/BIT-php-2024-8932.json b/data/php/BIT-php-2024-8932.json index 8fdd81b851..421d3160fb 100644 --- a/data/php/BIT-php-2024-8932.json +++ b/data/php/BIT-php-2024-8932.json @@ -55,8 +55,12 @@ { "type": "WEB", "url": "https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff" + }, + { + "type": "WEB", + "url": "https://security.netapp.com/advisory/ntap-20250110-0009/" } ], "published": "2024-11-27T19:18:28.985Z", - "modified": "2024-11-27T19:40:48.342Z" + "modified": "2025-01-11T07:38:25.737Z" } \ No newline at end of file diff --git a/data/postgresql/BIT-postgresql-2024-10979.json b/data/postgresql/BIT-postgresql-2024-10979.json index e7a1aedca8..0c69cc0215 100644 --- a/data/postgresql/BIT-postgresql-2024-10979.json +++ b/data/postgresql/BIT-postgresql-2024-10979.json @@ -77,8 +77,12 @@ { "type": "WEB", "url": "https://github.com/fmora50591/postgresql-env-vuln/blob/main/README.md" + }, + { + "type": "WEB", + "url": "https://security.netapp.com/advisory/ntap-20250110-0003/" } ], "published": "2024-11-16T07:16:38.797Z", - "modified": "2024-11-27T19:40:48.342Z" + "modified": "2025-01-11T07:38:25.737Z" } \ No newline at end of file diff --git a/data/vault/BIT-vault-2024-7594.json b/data/vault/BIT-vault-2024-7594.json index a418485335..3d4b7c8393 100644 --- a/data/vault/BIT-vault-2024-7594.json +++ b/data/vault/BIT-vault-2024-7594.json @@ -43,8 +43,12 @@ { "type": "WEB", "url": "https://discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/70251" + }, + { + "type": "WEB", + "url": "https://security.netapp.com/advisory/ntap-20250110-0007/" } ], "published": "2024-09-30T09:10:31.036Z", - "modified": "2024-09-30T09:34:51.259Z" + "modified": "2025-01-11T07:38:25.737Z" } \ No newline at end of file