From 048d0dd42e84d33a53bde0c67e7f20d8a3368e9c Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 25 Aug 2023 12:32:02 +0000 Subject: [PATCH] Publish Advisories GHSA-65h8-5q72-mrp3 GHSA-7354-cgfm-7j8h GHSA-93jv-v82m-ggm7 GHSA-cprf-jpj6-j9q3 GHSA-g68x-2w79-87x5 GHSA-m22f-g5qg-wxhv GHSA-p8xr-3fgh-5q5f GHSA-q4v4-q7v7-cvq2 GHSA-r4ff-p99m-q3hr GHSA-vh49-4q95-8qg3 --- .../GHSA-65h8-5q72-mrp3.json | 38 +++++++++++++++++++ .../GHSA-7354-cgfm-7j8h.json | 38 +++++++++++++++++++ .../GHSA-93jv-v82m-ggm7.json | 38 +++++++++++++++++++ .../GHSA-cprf-jpj6-j9q3.json | 38 +++++++++++++++++++ .../GHSA-g68x-2w79-87x5.json | 38 +++++++++++++++++++ .../GHSA-m22f-g5qg-wxhv.json | 38 +++++++++++++++++++ .../GHSA-p8xr-3fgh-5q5f.json | 38 +++++++++++++++++++ .../GHSA-q4v4-q7v7-cvq2.json | 38 +++++++++++++++++++ .../GHSA-r4ff-p99m-q3hr.json | 38 +++++++++++++++++++ .../GHSA-vh49-4q95-8qg3.json | 38 +++++++++++++++++++ 10 files changed, 380 insertions(+) create mode 100644 advisories/unreviewed/2023/08/GHSA-65h8-5q72-mrp3/GHSA-65h8-5q72-mrp3.json create mode 100644 advisories/unreviewed/2023/08/GHSA-7354-cgfm-7j8h/GHSA-7354-cgfm-7j8h.json create mode 100644 advisories/unreviewed/2023/08/GHSA-93jv-v82m-ggm7/GHSA-93jv-v82m-ggm7.json create mode 100644 advisories/unreviewed/2023/08/GHSA-cprf-jpj6-j9q3/GHSA-cprf-jpj6-j9q3.json create mode 100644 advisories/unreviewed/2023/08/GHSA-g68x-2w79-87x5/GHSA-g68x-2w79-87x5.json create mode 100644 advisories/unreviewed/2023/08/GHSA-m22f-g5qg-wxhv/GHSA-m22f-g5qg-wxhv.json create mode 100644 advisories/unreviewed/2023/08/GHSA-p8xr-3fgh-5q5f/GHSA-p8xr-3fgh-5q5f.json create mode 100644 advisories/unreviewed/2023/08/GHSA-q4v4-q7v7-cvq2/GHSA-q4v4-q7v7-cvq2.json create mode 100644 advisories/unreviewed/2023/08/GHSA-r4ff-p99m-q3hr/GHSA-r4ff-p99m-q3hr.json create mode 100644 advisories/unreviewed/2023/08/GHSA-vh49-4q95-8qg3/GHSA-vh49-4q95-8qg3.json diff --git a/advisories/unreviewed/2023/08/GHSA-65h8-5q72-mrp3/GHSA-65h8-5q72-mrp3.json b/advisories/unreviewed/2023/08/GHSA-65h8-5q72-mrp3/GHSA-65h8-5q72-mrp3.json new file mode 100644 index 00000000000..5f89e0e316a --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-65h8-5q72-mrp3/GHSA-65h8-5q72-mrp3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-65h8-5q72-mrp3", + "modified": "2023-08-25T12:30:51Z", + "published": "2023-08-25T12:30:51Z", + "aliases": [ + "CVE-2023-4478" + ], + "details": "Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4478" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-7354-cgfm-7j8h/GHSA-7354-cgfm-7j8h.json b/advisories/unreviewed/2023/08/GHSA-7354-cgfm-7j8h/GHSA-7354-cgfm-7j8h.json new file mode 100644 index 00000000000..ebf7bd9ce5b --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-7354-cgfm-7j8h/GHSA-7354-cgfm-7j8h.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7354-cgfm-7j8h", + "modified": "2023-08-25T12:30:52Z", + "published": "2023-08-25T12:30:52Z", + "aliases": [ + "CVE-2023-32598" + ], + "details": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in A. R. Jones Featured Image Pro Post Grid plugin <= 5.14 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32598" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/featured-image-pro/wordpress-featured-image-pro-post-grid-plugin-5-14-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-93jv-v82m-ggm7/GHSA-93jv-v82m-ggm7.json b/advisories/unreviewed/2023/08/GHSA-93jv-v82m-ggm7/GHSA-93jv-v82m-ggm7.json new file mode 100644 index 00000000000..65410f2588a --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-93jv-v82m-ggm7/GHSA-93jv-v82m-ggm7.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-93jv-v82m-ggm7", + "modified": "2023-08-25T12:30:52Z", + "published": "2023-08-25T12:30:52Z", + "aliases": [ + "CVE-2023-32603" + ], + "details": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao Donations Made Easy – Smart Donations plugin <= 4.0.12 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32603" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/smart-donations/wordpress-donations-made-easy-smart-donations-plugin-4-0-12-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-cprf-jpj6-j9q3/GHSA-cprf-jpj6-j9q3.json b/advisories/unreviewed/2023/08/GHSA-cprf-jpj6-j9q3/GHSA-cprf-jpj6-j9q3.json new file mode 100644 index 00000000000..a9eb38c1bfc --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-cprf-jpj6-j9q3/GHSA-cprf-jpj6-j9q3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cprf-jpj6-j9q3", + "modified": "2023-08-25T12:30:52Z", + "published": "2023-08-25T12:30:52Z", + "aliases": [ + "CVE-2023-32575" + ], + "details": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Product page shipping calculator for WooCommerce plugin <= 1.3.25 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32575" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/product-page-shipping-calculator-for-woocommerce/wordpress-product-page-shipping-calculator-for-woocommerce-plugin-1-3-25-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-g68x-2w79-87x5/GHSA-g68x-2w79-87x5.json b/advisories/unreviewed/2023/08/GHSA-g68x-2w79-87x5/GHSA-g68x-2w79-87x5.json new file mode 100644 index 00000000000..06d6584cdea --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-g68x-2w79-87x5/GHSA-g68x-2w79-87x5.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g68x-2w79-87x5", + "modified": "2023-08-25T12:30:51Z", + "published": "2023-08-25T12:30:51Z", + "aliases": [ + "CVE-2023-25649" + ], + "details": "\nThere is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SET_DEVICE_LED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25649" + }, + { + "type": "WEB", + "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032544" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-77" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-m22f-g5qg-wxhv/GHSA-m22f-g5qg-wxhv.json b/advisories/unreviewed/2023/08/GHSA-m22f-g5qg-wxhv/GHSA-m22f-g5qg-wxhv.json new file mode 100644 index 00000000000..18dc32c4329 --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-m22f-g5qg-wxhv/GHSA-m22f-g5qg-wxhv.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m22f-g5qg-wxhv", + "modified": "2023-08-25T12:30:52Z", + "published": "2023-08-25T12:30:52Z", + "aliases": [ + "CVE-2023-32595" + ], + "details": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Palasthotel by Edward Bock, Katharina Rompf Sunny Search plugin <= 1.0.2 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32595" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/fast-search-powered-by-solr/wordpress-sunny-search-plugin-1-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-p8xr-3fgh-5q5f/GHSA-p8xr-3fgh-5q5f.json b/advisories/unreviewed/2023/08/GHSA-p8xr-3fgh-5q5f/GHSA-p8xr-3fgh-5q5f.json new file mode 100644 index 00000000000..20debb231c4 --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-p8xr-3fgh-5q5f/GHSA-p8xr-3fgh-5q5f.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p8xr-3fgh-5q5f", + "modified": "2023-08-25T12:30:52Z", + "published": "2023-08-25T12:30:52Z", + "aliases": [ + "CVE-2023-24394" + ], + "details": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy iframe popup plugin <= 3.3 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24394" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/iframe-popup/wordpress-iframe-popup-plugin-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-q4v4-q7v7-cvq2/GHSA-q4v4-q7v7-cvq2.json b/advisories/unreviewed/2023/08/GHSA-q4v4-q7v7-cvq2/GHSA-q4v4-q7v7-cvq2.json new file mode 100644 index 00000000000..8bb8c488c39 --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-q4v4-q7v7-cvq2/GHSA-q4v4-q7v7-cvq2.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q4v4-q7v7-cvq2", + "modified": "2023-08-25T12:30:52Z", + "published": "2023-08-25T12:30:52Z", + "aliases": [ + "CVE-2023-32596" + ], + "details": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wolfgang Ertl weebotLite plugin <= 1.0.0 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32596" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/weebotlite/wordpress-weebotlite-plugin-1-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-r4ff-p99m-q3hr/GHSA-r4ff-p99m-q3hr.json b/advisories/unreviewed/2023/08/GHSA-r4ff-p99m-q3hr/GHSA-r4ff-p99m-q3hr.json new file mode 100644 index 00000000000..eb805a5919c --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-r4ff-p99m-q3hr/GHSA-r4ff-p99m-q3hr.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r4ff-p99m-q3hr", + "modified": "2023-08-25T12:30:53Z", + "published": "2023-08-25T12:30:53Z", + "aliases": [ + "CVE-2023-32797" + ], + "details": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution video carousel slider with lightbox plugin <= 1.0.22 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32797" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/wp-responsive-video-gallery-with-lightbox/wordpress-video-carousel-slider-with-lightbox-plugin-1-0-22-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-vh49-4q95-8qg3/GHSA-vh49-4q95-8qg3.json b/advisories/unreviewed/2023/08/GHSA-vh49-4q95-8qg3/GHSA-vh49-4q95-8qg3.json new file mode 100644 index 00000000000..1ed022800d6 --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-vh49-4q95-8qg3/GHSA-vh49-4q95-8qg3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vh49-4q95-8qg3", + "modified": "2023-08-25T12:30:51Z", + "published": "2023-08-25T12:30:51Z", + "aliases": [ + "CVE-2023-25981" + ], + "details": "Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form plugin <= 2.8.1 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25981" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/buddyforms/wordpress-buddyforms-plugin-2-8-1-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file