Update security advisories with recently assigned CVE IDs

[darosior]

Only the inv-to-send advisory doesn't have one because there is a misunderstanding who claims it should be CVE-2023-33297. I explained it is an ID which was claimed by a troll on behalf of the project and i'm now awaiting their response. I don't think it should be a blocker to publish the other 13 IDs.

[0xB10C]

I think it might be better to leave the title and just add the CVE number to the end

Suggested change

	title: Disclosure of CVE-2024-52918
	title: Disclosure of crash using malicious BIP72 URI (CVE-2024-52918)

[darosior]

I agree but i chose to be consistent with previous advisories. If we want to change the existing format let's do it in another PR?

[murchandamus]

I would also prefer if the titles continued to contain the gist of the vulnerability as the CVE ID provides zero context unless you know about the CVE in advance.

[BrunoSampaioDev]

I also agree that the CVE ID does not provide any context, I believe that titles containing the essence of the vulnerability are more useful

[murchandamus]

This approach reduces the information content of the titles and I would consider it a disimprovement.

How about replacing the word "Disclosure" with the CVE ID? E.g.

-title: Disclosure of crash using malicious BIP72 URI
+title: CVE-2024-52918: Crash using malicious BIP72 URI

Or what @0xB10C said.