diff --git a/advisories/unreviewed/2023/08/GHSA-65h8-5q72-mrp3/GHSA-65h8-5q72-mrp3.json b/advisories/unreviewed/2023/08/GHSA-65h8-5q72-mrp3/GHSA-65h8-5q72-mrp3.json new file mode 100644 index 00000000000..5f89e0e316a --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-65h8-5q72-mrp3/GHSA-65h8-5q72-mrp3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-65h8-5q72-mrp3", + "modified": "2023-08-25T12:30:51Z", + "published": "2023-08-25T12:30:51Z", + "aliases": [ + "CVE-2023-4478" + ], + "details": "Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4478" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-7354-cgfm-7j8h/GHSA-7354-cgfm-7j8h.json b/advisories/unreviewed/2023/08/GHSA-7354-cgfm-7j8h/GHSA-7354-cgfm-7j8h.json new file mode 100644 index 00000000000..ebf7bd9ce5b --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-7354-cgfm-7j8h/GHSA-7354-cgfm-7j8h.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7354-cgfm-7j8h", + "modified": "2023-08-25T12:30:52Z", + "published": "2023-08-25T12:30:52Z", + "aliases": [ + "CVE-2023-32598" + ], + "details": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in A. R. Jones Featured Image Pro Post Grid plugin <= 5.14 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32598" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/featured-image-pro/wordpress-featured-image-pro-post-grid-plugin-5-14-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-93jv-v82m-ggm7/GHSA-93jv-v82m-ggm7.json b/advisories/unreviewed/2023/08/GHSA-93jv-v82m-ggm7/GHSA-93jv-v82m-ggm7.json new file mode 100644 index 00000000000..65410f2588a --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-93jv-v82m-ggm7/GHSA-93jv-v82m-ggm7.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-93jv-v82m-ggm7", + "modified": "2023-08-25T12:30:52Z", + "published": "2023-08-25T12:30:52Z", + "aliases": [ + "CVE-2023-32603" + ], + "details": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao Donations Made Easy – Smart Donations plugin <= 4.0.12 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32603" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/smart-donations/wordpress-donations-made-easy-smart-donations-plugin-4-0-12-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-cprf-jpj6-j9q3/GHSA-cprf-jpj6-j9q3.json b/advisories/unreviewed/2023/08/GHSA-cprf-jpj6-j9q3/GHSA-cprf-jpj6-j9q3.json new file mode 100644 index 00000000000..a9eb38c1bfc --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-cprf-jpj6-j9q3/GHSA-cprf-jpj6-j9q3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cprf-jpj6-j9q3", + "modified": "2023-08-25T12:30:52Z", + "published": "2023-08-25T12:30:52Z", + "aliases": [ + "CVE-2023-32575" + ], + "details": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin <= 1.3.25 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32575" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/product-page-shipping-calculator-for-woocommerce/wordpress-product-page-shipping-calculator-for-woocommerce-plugin-1-3-25-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-g68x-2w79-87x5/GHSA-g68x-2w79-87x5.json b/advisories/unreviewed/2023/08/GHSA-g68x-2w79-87x5/GHSA-g68x-2w79-87x5.json new file mode 100644 index 00000000000..06d6584cdea --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-g68x-2w79-87x5/GHSA-g68x-2w79-87x5.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g68x-2w79-87x5", + "modified": "2023-08-25T12:30:51Z", + "published": "2023-08-25T12:30:51Z", + "aliases": [ + "CVE-2023-25649" + ], + "details": "\nThere is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25649" + }, + { + "type": "WEB", + "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032544" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-77" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-m22f-g5qg-wxhv/GHSA-m22f-g5qg-wxhv.json b/advisories/unreviewed/2023/08/GHSA-m22f-g5qg-wxhv/GHSA-m22f-g5qg-wxhv.json new file mode 100644 index 00000000000..18dc32c4329 --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-m22f-g5qg-wxhv/GHSA-m22f-g5qg-wxhv.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m22f-g5qg-wxhv", + "modified": "2023-08-25T12:30:52Z", + "published": "2023-08-25T12:30:52Z", + "aliases": [ + "CVE-2023-32595" + ], + "details": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Palasthotel by Edward Bock, Katharina Rompf Sunny Search plugin <= 1.0.2 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32595" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/fast-search-powered-by-solr/wordpress-sunny-search-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-p8xr-3fgh-5q5f/GHSA-p8xr-3fgh-5q5f.json b/advisories/unreviewed/2023/08/GHSA-p8xr-3fgh-5q5f/GHSA-p8xr-3fgh-5q5f.json new file mode 100644 index 00000000000..20debb231c4 --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-p8xr-3fgh-5q5f/GHSA-p8xr-3fgh-5q5f.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p8xr-3fgh-5q5f", + "modified": "2023-08-25T12:30:52Z", + "published": "2023-08-25T12:30:52Z", + "aliases": [ + "CVE-2023-24394" + ], + "details": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy iframe popup plugin <= 3.3 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24394" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/iframe-popup/wordpress-iframe-popup-plugin-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-q4v4-q7v7-cvq2/GHSA-q4v4-q7v7-cvq2.json b/advisories/unreviewed/2023/08/GHSA-q4v4-q7v7-cvq2/GHSA-q4v4-q7v7-cvq2.json new file mode 100644 index 00000000000..8bb8c488c39 --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-q4v4-q7v7-cvq2/GHSA-q4v4-q7v7-cvq2.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q4v4-q7v7-cvq2", + "modified": "2023-08-25T12:30:52Z", + "published": "2023-08-25T12:30:52Z", + "aliases": [ + "CVE-2023-32596" + ], + "details": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wolfgang Ertl weebotLite plugin <= 1.0.0 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32596" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/weebotlite/wordpress-weebotlite-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-r4ff-p99m-q3hr/GHSA-r4ff-p99m-q3hr.json b/advisories/unreviewed/2023/08/GHSA-r4ff-p99m-q3hr/GHSA-r4ff-p99m-q3hr.json new file mode 100644 index 00000000000..eb805a5919c --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-r4ff-p99m-q3hr/GHSA-r4ff-p99m-q3hr.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r4ff-p99m-q3hr", + "modified": "2023-08-25T12:30:53Z", + "published": "2023-08-25T12:30:53Z", + "aliases": [ + "CVE-2023-32797" + ], + "details": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution video carousel slider with lightbox plugin <= 1.0.22 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32797" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/wp-responsive-video-gallery-with-lightbox/wordpress-video-carousel-slider-with-lightbox-plugin-1-0-22-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-vh49-4q95-8qg3/GHSA-vh49-4q95-8qg3.json b/advisories/unreviewed/2023/08/GHSA-vh49-4q95-8qg3/GHSA-vh49-4q95-8qg3.json new file mode 100644 index 00000000000..1ed022800d6 --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-vh49-4q95-8qg3/GHSA-vh49-4q95-8qg3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vh49-4q95-8qg3", + "modified": "2023-08-25T12:30:51Z", + "published": "2023-08-25T12:30:51Z", + "aliases": [ + "CVE-2023-25981" + ], + "details": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form plugin <= 2.8.1 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25981" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/buddyforms/wordpress-buddyforms-plugin-2-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file