diff --git a/data/osv/GO-2024-3260.json b/data/osv/GO-2024-3260.json new file mode 100644 index 00000000..9288f859 --- /dev/null +++ b/data/osv/GO-2024-3260.json @@ -0,0 +1,52 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2024-3260", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2024-45794", + "GHSA-q78v-cv36-8fxj" + ], + "summary": "Devtron has SQL Injection in CreateUser API in github.com/devtron-labs/devtron", + "details": "Devtron has SQL Injection in CreateUser API in github.com/devtron-labs/devtron", + "affected": [ + { + "package": { + "name": "github.com/devtron-labs/devtron", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.7.2" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/devtron-labs/devtron/security/advisories/GHSA-q78v-cv36-8fxj" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45794" + }, + { + "type": "FIX", + "url": "https://github.com/devtron-labs/devtron/commit/1540271bd777b6bccd288e513a9070d8f04b6056" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2024-3260", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file diff --git a/data/osv/GO-2024-3262.json b/data/osv/GO-2024-3262.json new file mode 100644 index 00000000..b53a1def --- /dev/null +++ b/data/osv/GO-2024-3262.json @@ -0,0 +1,53 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2024-3262", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2024-10975", + "GHSA-2w5v-x29g-jw7j" + ], + "summary": "Hashicorp Nomad Incorrect Authorization vulnerability in github.com/hashicorp/nomad", + "details": "Hashicorp Nomad Incorrect Authorization vulnerability in github.com/hashicorp/nomad", + "affected": [ + { + "package": { + "name": "github.com/hashicorp/nomad", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": {} + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/advisories/GHSA-2w5v-x29g-jw7j" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10975" + }, + { + "type": "FIX", + "url": "https://github.com/hashicorp/nomad/commit/30849c518e16647a4f698e5f5cc82bef2bf40e4d" + }, + { + "type": "WEB", + "url": "https://discuss.hashicorp.com/t/hcsec-2024-27-nomad-vulnerable-to-cross-namespace-volume-creation-abusing-csi-write-permission" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2024-3262", + "review_status": "UNREVIEWED" + } +} \ No newline at end of file diff --git a/data/reports/GO-2024-3260.yaml b/data/reports/GO-2024-3260.yaml new file mode 100644 index 00000000..b4cfc796 --- /dev/null +++ b/data/reports/GO-2024-3260.yaml @@ -0,0 +1,19 @@ +id: GO-2024-3260 +modules: + - module: github.com/devtron-labs/devtron + versions: + - fixed: 0.7.2 + vulnerable_at: 0.7.2-rc.0 +summary: Devtron has SQL Injection in CreateUser API in github.com/devtron-labs/devtron +cves: + - CVE-2024-45794 +ghsas: + - GHSA-q78v-cv36-8fxj +references: + - advisory: https://github.com/devtron-labs/devtron/security/advisories/GHSA-q78v-cv36-8fxj + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-45794 + - fix: https://github.com/devtron-labs/devtron/commit/1540271bd777b6bccd288e513a9070d8f04b6056 +source: + id: GHSA-q78v-cv36-8fxj + created: 2024-11-08T12:15:13.627476-05:00 +review_status: UNREVIEWED diff --git a/data/reports/GO-2024-3262.yaml b/data/reports/GO-2024-3262.yaml new file mode 100644 index 00000000..a0f201a7 --- /dev/null +++ b/data/reports/GO-2024-3262.yaml @@ -0,0 +1,20 @@ +id: GO-2024-3262 +modules: + - module: github.com/hashicorp/nomad + unsupported_versions: + - last_affected: 1.9.1 + vulnerable_at: 1.9.2 +summary: Hashicorp Nomad Incorrect Authorization vulnerability in github.com/hashicorp/nomad +cves: + - CVE-2024-10975 +ghsas: + - GHSA-2w5v-x29g-jw7j +references: + - advisory: https://github.com/advisories/GHSA-2w5v-x29g-jw7j + - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-10975 + - fix: https://github.com/hashicorp/nomad/commit/30849c518e16647a4f698e5f5cc82bef2bf40e4d + - web: https://discuss.hashicorp.com/t/hcsec-2024-27-nomad-vulnerable-to-cross-namespace-volume-creation-abusing-csi-write-permission +source: + id: GHSA-2w5v-x29g-jw7j + created: 2024-11-08T12:15:08.376448-05:00 +review_status: UNREVIEWED