From 0e3918c95bbd48455145dd8755a532e72445e05e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 26 Jul 2024 00:33:42 +0000 Subject: [PATCH] Publish Advisories GHSA-38v3-r7mm-56j2 GHSA-3r6p-fq38-2gpr GHSA-96rx-8rv9-v6vx GHSA-9gvv-47x2-579h GHSA-gm77-v33h-cghm GHSA-m444-vxcc-2cwp GHSA-whww-hhj9-9f35 --- .../GHSA-38v3-r7mm-56j2.json | 38 +++++++++++++++++++ .../GHSA-3r6p-fq38-2gpr.json | 38 +++++++++++++++++++ .../GHSA-96rx-8rv9-v6vx.json | 38 +++++++++++++++++++ .../GHSA-9gvv-47x2-579h.json | 35 +++++++++++++++++ .../GHSA-gm77-v33h-cghm.json | 35 +++++++++++++++++ .../GHSA-m444-vxcc-2cwp.json | 38 +++++++++++++++++++ .../GHSA-whww-hhj9-9f35.json | 38 +++++++++++++++++++ 7 files changed, 260 insertions(+) create mode 100644 advisories/unreviewed/2024/07/GHSA-38v3-r7mm-56j2/GHSA-38v3-r7mm-56j2.json create mode 100644 advisories/unreviewed/2024/07/GHSA-3r6p-fq38-2gpr/GHSA-3r6p-fq38-2gpr.json create mode 100644 advisories/unreviewed/2024/07/GHSA-96rx-8rv9-v6vx/GHSA-96rx-8rv9-v6vx.json create mode 100644 advisories/unreviewed/2024/07/GHSA-9gvv-47x2-579h/GHSA-9gvv-47x2-579h.json create mode 100644 advisories/unreviewed/2024/07/GHSA-gm77-v33h-cghm/GHSA-gm77-v33h-cghm.json create mode 100644 advisories/unreviewed/2024/07/GHSA-m444-vxcc-2cwp/GHSA-m444-vxcc-2cwp.json create mode 100644 advisories/unreviewed/2024/07/GHSA-whww-hhj9-9f35/GHSA-whww-hhj9-9f35.json diff --git a/advisories/unreviewed/2024/07/GHSA-38v3-r7mm-56j2/GHSA-38v3-r7mm-56j2.json b/advisories/unreviewed/2024/07/GHSA-38v3-r7mm-56j2/GHSA-38v3-r7mm-56j2.json new file mode 100644 index 00000000000..e18181f0d50 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-38v3-r7mm-56j2/GHSA-38v3-r7mm-56j2.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-38v3-r7mm-56j2", + "modified": "2024-07-26T00:32:09Z", + "published": "2024-07-26T00:32:09Z", + "aliases": [ + "CVE-2024-24622" + ], + "details": "Softaculous Webuzo contains a command injection in the password reset functionality. A remote, authenticated attacker can exploit this vulnerability to gain code execution on the system.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24622" + }, + { + "type": "WEB", + "url": "https://blog.exodusintel.com/2024/07/24/softaculous-webuzo-password-reset-command-injection" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-25T22:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-3r6p-fq38-2gpr/GHSA-3r6p-fq38-2gpr.json b/advisories/unreviewed/2024/07/GHSA-3r6p-fq38-2gpr/GHSA-3r6p-fq38-2gpr.json new file mode 100644 index 00000000000..8a69d17a726 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-3r6p-fq38-2gpr/GHSA-3r6p-fq38-2gpr.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3r6p-fq38-2gpr", + "modified": "2024-07-26T00:32:09Z", + "published": "2024-07-26T00:32:09Z", + "aliases": [ + "CVE-2024-24621" + ], + "details": "Softaculous Webuzo contains an authentication bypass vulnerability through the password reset functionality. Remote, anonymous attackers can exploit this vulnerability to gain full server access as the root user.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24621" + }, + { + "type": "WEB", + "url": "https://blog.exodusintel.com/2024/07/25/softaculous-webuzo-authentication-bypass" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-697" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-25T22:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-96rx-8rv9-v6vx/GHSA-96rx-8rv9-v6vx.json b/advisories/unreviewed/2024/07/GHSA-96rx-8rv9-v6vx/GHSA-96rx-8rv9-v6vx.json new file mode 100644 index 00000000000..47d1ef42cad --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-96rx-8rv9-v6vx/GHSA-96rx-8rv9-v6vx.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-96rx-8rv9-v6vx", + "modified": "2024-07-26T00:32:10Z", + "published": "2024-07-26T00:32:10Z", + "aliases": [ + "CVE-2024-24623" + ], + "details": "Softaculous Webuzo contains a command injection vulnerability in the FTP management functionality. A remote, authenticated attacker can exploit this vulnerability to gain code execution on the system.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24623" + }, + { + "type": "WEB", + "url": "https://blog.exodusintel.com/2024/07/25/softaculous-webuzo-ftp-management-command-injection" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-25T22:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-9gvv-47x2-579h/GHSA-9gvv-47x2-579h.json b/advisories/unreviewed/2024/07/GHSA-9gvv-47x2-579h/GHSA-9gvv-47x2-579h.json new file mode 100644 index 00000000000..dc75dc0710f --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-9gvv-47x2-579h/GHSA-9gvv-47x2-579h.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9gvv-47x2-579h", + "modified": "2024-07-26T00:32:10Z", + "published": "2024-07-26T00:32:10Z", + "aliases": [ + "CVE-2024-41468" + ], + "details": "Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the cmdinput parameter at /goform/exeCommand", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41468" + }, + { + "type": "WEB", + "url": "https://github.com/iotresearch/iot-vuln/blob/main/Tenda/FH1201/exeCommand/README.md" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-25T22:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-gm77-v33h-cghm/GHSA-gm77-v33h-cghm.json b/advisories/unreviewed/2024/07/GHSA-gm77-v33h-cghm/GHSA-gm77-v33h-cghm.json new file mode 100644 index 00000000000..1943f7d8fad --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-gm77-v33h-cghm/GHSA-gm77-v33h-cghm.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gm77-v33h-cghm", + "modified": "2024-07-26T00:32:10Z", + "published": "2024-07-26T00:32:10Z", + "aliases": [ + "CVE-2024-41473" + ], + "details": "Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMac", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41473" + }, + { + "type": "WEB", + "url": "https://github.com/iotresearch/iot-vuln/tree/main/Tenda/FH1201/WriteFacMac" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-25T22:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-m444-vxcc-2cwp/GHSA-m444-vxcc-2cwp.json b/advisories/unreviewed/2024/07/GHSA-m444-vxcc-2cwp/GHSA-m444-vxcc-2cwp.json new file mode 100644 index 00000000000..358a59f9b9b --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-m444-vxcc-2cwp/GHSA-m444-vxcc-2cwp.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m444-vxcc-2cwp", + "modified": "2024-07-26T00:32:10Z", + "published": "2024-07-26T00:32:10Z", + "aliases": [ + "CVE-2024-38103" + ], + "details": "Microsoft Edge (Chromium-based) Information Disclosure Vulnerability", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38103" + }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38103" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-359" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-25T22:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-whww-hhj9-9f35/GHSA-whww-hhj9-9f35.json b/advisories/unreviewed/2024/07/GHSA-whww-hhj9-9f35/GHSA-whww-hhj9-9f35.json new file mode 100644 index 00000000000..cd3a9dd7a59 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-whww-hhj9-9f35/GHSA-whww-hhj9-9f35.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-whww-hhj9-9f35", + "modified": "2024-07-26T00:32:10Z", + "published": "2024-07-26T00:32:10Z", + "aliases": [ + "CVE-2024-3938" + ], + "details": "The \"reset password\" login page accepted an HTML injection via URL parameters.\n\nThis has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a http://localhost:8082/dotAdmin/#/public/login?resetEmailSent=true&resetEmail=%3Ch1%3E%3Ca%20href%3D%22https:%2F%2Fgoogle.com%22%3ECLICK%20ME%3C%2Fa%3E%3C%2Fh1%3E \n\nThis will result in a view along these lines:\n\n\n\n\n\n * OWASP Top 10 - A03: Injection\n * CVSS Score: 5.4\n * AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator \n * https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N&... https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3938" + }, + { + "type": "WEB", + "url": "https://auth.dotcms.com/security/SI-71" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-25T22:15:08Z" + } +} \ No newline at end of file