generated content from 2024-11-18

mapping.csv

@@ -256480,3 +256480,14 @@ vulnerability,CVE-2024-11085,vulnerability--a034ef7e-5ae3-47ad-a39e-28390b880056
 vulnerability,CVE-2024-8873,vulnerability--8797c43e-767e-4411-9615-828d9ac6da28
 vulnerability,CVE-2024-8856,vulnerability--c6a326b4-e03a-4681-aca0-b58d21c962ce
 vulnerability,CVE-2024-6628,vulnerability--8cf5aba6-648a-44aa-b4d9-472087c2755f
+vulnerability,CVE-2024-52872,vulnerability--c983f7d7-4b73-438e-bba3-ce12c15fc5b9
+vulnerability,CVE-2024-52871,vulnerability--d32c39cd-ac32-4bde-8aa1-95ed9e1faaaf
+vulnerability,CVE-2024-52876,vulnerability--0b540ea9-3029-44e8-a863-f619edc3d214
+vulnerability,CVE-2024-52867,vulnerability--4886dc49-421d-4c70-8509-5781b729810b
+vulnerability,CVE-2024-0793,vulnerability--9bb10a08-2e40-438d-be5b-6f85676d2450
+vulnerability,CVE-2023-0657,vulnerability--4953cae5-6000-4dfd-90eb-3781cab4b8cb
+vulnerability,CVE-2023-1419,vulnerability--64c3cccc-f73d-4a23-928e-29f7011f0cae
+vulnerability,CVE-2023-4639,vulnerability--28b334bd-c095-4277-bc6f-3869e3108b3a
+vulnerability,CVE-2023-43091,vulnerability--ea709db1-75c3-4459-aacb-942a6c82b92d
+vulnerability,CVE-2023-6110,vulnerability--53675ea0-cc5e-48d3-a49e-2077a8b68c27
+vulnerability,CVE-2020-25720,vulnerability--f1fe8241-0240-4c6f-8ba3-f4e27d09d280

objects/vulnerability/vulnerability--0b540ea9-3029-44e8-a863-f619edc3d214.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--ccfcdf65-87c2-458f-8b89-0c2f76bb7164",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0b540ea9-3029-44e8-a863-f619edc3d214",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-18T00:40:20.779762Z",
+            "modified": "2024-11-18T00:40:20.779762Z",
+            "name": "CVE-2024-52876",
+            "description": "Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated \"remote power off\" actions (in broadcast mode) via multiple read operations on the ASTM Remote ID (0xFFFA) GATT.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-52876"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--28b334bd-c095-4277-bc6f-3869e3108b3a.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--ca68b225-0f25-4058-8ff4-a14589c9ce86",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--28b334bd-c095-4277-bc6f-3869e3108b3a",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-18T00:40:32.310309Z",
+            "modified": "2024-11-18T00:40:32.310309Z",
+            "name": "CVE-2023-4639",
+            "description": "A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-4639"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--4886dc49-421d-4c70-8509-5781b729810b.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--7eca8c35-7a07-4947-a201-465443944fb8",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--4886dc49-421d-4c70-8509-5781b729810b",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-18T00:40:20.782276Z",
+            "modified": "2024-11-18T00:40:20.782276Z",
+            "name": "CVE-2024-52867",
+            "description": "guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata concerns (e.g., for setuid and setgid programs) are properly addressed. The vulnerability can be remediated within the product via certain pull, reconfigure, and restart actions. Both 5ab3c4c and 5582241 are needed to resolve the vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-52867"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--4953cae5-6000-4dfd-90eb-3781cab4b8cb.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--8c0a61fa-385c-48b9-9748-86cca39445e5",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--4953cae5-6000-4dfd-90eb-3781cab4b8cb",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-18T00:40:31.931304Z",
+            "modified": "2024-11-18T00:40:31.931304Z",
+            "name": "CVE-2023-0657",
+            "description": "A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-0657"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--53675ea0-cc5e-48d3-a49e-2077a8b68c27.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--bd4d8f48-fc4f-4bcb-9093-dbf4532bd488",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--53675ea0-cc5e-48d3-a49e-2077a8b68c27",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-18T00:40:32.590334Z",
+            "modified": "2024-11-18T00:40:32.590334Z",
+            "name": "CVE-2023-6110",
+            "description": "A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in it's scope, it deletes other existing access rules which are not associated with any application credentials.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-6110"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--64c3cccc-f73d-4a23-928e-29f7011f0cae.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b9071c46-8571-499b-81eb-fb415d525b8c",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--64c3cccc-f73d-4a23-928e-29f7011f0cae",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-18T00:40:32.169001Z",
+            "modified": "2024-11-18T00:40:32.169001Z",
+            "name": "CVE-2023-1419",
+            "description": "A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-1419"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--9bb10a08-2e40-438d-be5b-6f85676d2450.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--34384c5a-aabb-45f1-af0c-414d3f106ce5",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--9bb10a08-2e40-438d-be5b-6f85676d2450",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-18T00:40:22.629762Z",
+            "modified": "2024-11-18T00:40:22.629762Z",
+            "name": "CVE-2024-0793",
+            "description": "A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-0793"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--c983f7d7-4b73-438e-bba3-ce12c15fc5b9.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--804246e8-f026-4c1f-9328-032d64cf29e2",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--c983f7d7-4b73-438e-bba3-ce12c15fc5b9",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-18T00:40:20.708499Z",
+            "modified": "2024-11-18T00:40:20.708499Z",
+            "name": "CVE-2024-52872",
+            "description": "In Flagsmith before 2.134.1, the get_document endpoint is not correctly protected by permissions.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-52872"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--d32c39cd-ac32-4bde-8aa1-95ed9e1faaaf.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--6eb6f74a-4adf-447a-904b-84549aaaa710",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--d32c39cd-ac32-4bde-8aa1-95ed9e1faaaf",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-18T00:40:20.749307Z",
+            "modified": "2024-11-18T00:40:20.749307Z",
+            "name": "CVE-2024-52871",
+            "description": "In Flagsmith before 2.134.1, it is possible to bypass the ALLOW_REGISTRATION_WITHOUT_INVITE setting.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-52871"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--ea709db1-75c3-4459-aacb-942a6c82b92d.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--156f01e6-93c1-4ce6-91cc-0d2fb5b5cc6e",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--ea709db1-75c3-4459-aacb-942a6c82b92d",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-18T00:40:32.520035Z",
+            "modified": "2024-11-18T00:40:32.520035Z",
+            "name": "CVE-2023-43091",
+            "description": "A flaw was found in GNOME Maps, which is vulnerable to a code injection attack via its service.json configuration file. If the configuration file is malicious, it may execute arbitrary code.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-43091"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--f1fe8241-0240-4c6f-8ba3-f4e27d09d280.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--f965378b-71a9-4c6a-8eb9-66ea25ef8a55",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--f1fe8241-0240-4c6f-8ba3-f4e27d09d280",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-11-18T00:40:36.05169Z",
+            "modified": "2024-11-18T00:40:36.05169Z",
+            "name": "CVE-2020-25720",
+            "description": "A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2020-25720"
+                }
+            ]
+        }
+    ]
+}