diff --git a/data/gitlab/BIT-gitlab-2024-4278.json b/data/gitlab/BIT-gitlab-2024-4278.json new file mode 100644 index 000000000..cdbf614d0 --- /dev/null +++ b/data/gitlab/BIT-gitlab-2024-4278.json @@ -0,0 +1,72 @@ +{ + "schema_version": "1.5.0", + "id": "BIT-gitlab-2024-4278", + "details": "An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain Dependency Proxy setting.", + "aliases": [ + "CVE-2024-4278" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "gitlab", + "purl": "pkg:bitnami/gitlab" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "16.5.0" + }, + { + "fixed": "17.2.8" + }, + { + "introduced": "17.3.0" + }, + { + "fixed": "17.3.4" + } + ] + }, + { + "type": "SEMVER", + "events": [ + { + "introduced": "17.4.0" + }, + { + "last_affected": "17.4.0" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Low", + "cpes": [ + "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", + "cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:enterprise:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/458484" + }, + { + "type": "WEB", + "url": "https://hackerone.com/reports/2466205" + } + ], + "published": "2024-09-27T07:24:05.639Z", + "modified": "2024-09-27T07:55:22.197Z" +} \ No newline at end of file diff --git a/data/mattermost/BIT-mattermost-2024-45843.json b/data/mattermost/BIT-mattermost-2024-45843.json new file mode 100644 index 000000000..b0c0cdeaa --- /dev/null +++ b/data/mattermost/BIT-mattermost-2024-45843.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.5.0", + "id": "BIT-mattermost-2024-45843", + "details": "Mattermost versions 9.5.x <= 9.5.8 fail to include the metadata endpoints of Oracle Cloud and Alibaba in the SSRF denylist, which allows an attacker to possibly cause an SSRF if Mattermost was deployed in Oracle Cloud or Alibaba.", + "aliases": [ + "CVE-2024-45843" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "mattermost", + "purl": "pkg:bitnami/mattermost" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "9.5.0" + }, + { + "fixed": "9.5.9" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "published": "2024-09-27T07:20:06.325Z", + "modified": "2024-09-27T07:55:22.197Z" +} \ No newline at end of file diff --git a/data/mattermost/BIT-mattermost-2024-47003.json b/data/mattermost/BIT-mattermost-2024-47003.json new file mode 100644 index 000000000..d3ccd79ce --- /dev/null +++ b/data/mattermost/BIT-mattermost-2024-47003.json @@ -0,0 +1,83 @@ +{ + "schema_version": "1.5.0", + "id": "BIT-mattermost-2024-47003", + "details": "Mattermost versions 9.11.x <= 9.11.0 and 9.5.x <= 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend.", + "aliases": [ + "CVE-2024-47003" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "mattermost", + "purl": "pkg:bitnami/mattermost" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "9.5.0" + }, + { + "fixed": "9.5.9" + } + ] + }, + { + "type": "SEMVER", + "events": [ + { + "introduced": "9.11.0" + }, + { + "last_affected": "9.11.0" + }, + { + "introduced": "9.11.0-rc1" + }, + { + "last_affected": "9.11.0-rc1" + }, + { + "introduced": "9.11.0-rc2" + }, + { + "last_affected": "9.11.0-rc2" + }, + { + "introduced": "9.11.0-rc3" + }, + { + "last_affected": "9.11.0-rc3" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*", + "cpe:2.3:a:mattermost:mattermost_server:9.11.0:-:*:*:*:*:*:*", + "cpe:2.3:a:mattermost:mattermost_server:9.11.0:rc1:*:*:*:*:*:*", + "cpe:2.3:a:mattermost:mattermost_server:9.11.0:rc2:*:*:*:*:*:*", + "cpe:2.3:a:mattermost:mattermost_server:9.11.0:rc3:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "published": "2024-09-27T07:19:54.937Z", + "modified": "2024-09-27T07:55:22.197Z" +} \ No newline at end of file diff --git a/data/mattermost/BIT-mattermost-2024-47145.json b/data/mattermost/BIT-mattermost-2024-47145.json new file mode 100644 index 000000000..afc13e3d0 --- /dev/null +++ b/data/mattermost/BIT-mattermost-2024-47145.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.5.0", + "id": "BIT-mattermost-2024-47145", + "details": "Mattermost versions 9.5.x <= 9.5.8 fail to properly authorize access to archived channels when viewing archived channels is disabled, which allows an attacker to view posts and files of archived channels via file links.", + "aliases": [ + "CVE-2024-47145" + ], + "affected": [ + { + "package": { + "ecosystem": "Bitnami", + "name": "mattermost", + "purl": "pkg:bitnami/mattermost" + }, + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "9.5.0" + }, + { + "fixed": "9.5.9" + } + ] + } + ] + } + ], + "database_specific": { + "severity": "Medium", + "cpes": [ + "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*" + ] + }, + "references": [ + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "published": "2024-09-27T07:19:43.531Z", + "modified": "2024-09-27T07:55:22.197Z" +} \ No newline at end of file