From 107856237ede83d68d9afbced2002e3b299499ba Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 6 Nov 2024 12:32:51 +0000 Subject: [PATCH] Publish Advisories GHSA-586p-749j-fhwp GHSA-r7x8-hv2q-v9r7 GHSA-wq2p-5pc6-wpgf GHSA-32p4-gm2c-wmch GHSA-38hm-287h-q3wv GHSA-fjxm-f2p4-c85h GHSA-fwmf-6rqq-97g9 --- .../GHSA-586p-749j-fhwp.json | 6 ++- .../GHSA-r7x8-hv2q-v9r7.json | 6 ++- .../GHSA-wq2p-5pc6-wpgf.json | 6 ++- .../GHSA-32p4-gm2c-wmch.json | 42 ++++++++++++++++ .../GHSA-38hm-287h-q3wv.json | 46 +++++++++++++++++ .../GHSA-fjxm-f2p4-c85h.json | 42 ++++++++++++++++ .../GHSA-fwmf-6rqq-97g9.json | 50 +++++++++++++++++++ 7 files changed, 195 insertions(+), 3 deletions(-) create mode 100644 advisories/unreviewed/2024/11/GHSA-32p4-gm2c-wmch/GHSA-32p4-gm2c-wmch.json create mode 100644 advisories/unreviewed/2024/11/GHSA-38hm-287h-q3wv/GHSA-38hm-287h-q3wv.json create mode 100644 advisories/unreviewed/2024/11/GHSA-fjxm-f2p4-c85h/GHSA-fjxm-f2p4-c85h.json create mode 100644 advisories/unreviewed/2024/11/GHSA-fwmf-6rqq-97g9/GHSA-fwmf-6rqq-97g9.json diff --git a/advisories/github-reviewed/2024/10/GHSA-586p-749j-fhwp/GHSA-586p-749j-fhwp.json b/advisories/github-reviewed/2024/10/GHSA-586p-749j-fhwp/GHSA-586p-749j-fhwp.json index dd0401afba1..ed96f058fe7 100644 --- a/advisories/github-reviewed/2024/10/GHSA-586p-749j-fhwp/GHSA-586p-749j-fhwp.json +++ b/advisories/github-reviewed/2024/10/GHSA-586p-749j-fhwp/GHSA-586p-749j-fhwp.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-586p-749j-fhwp", - "modified": "2024-11-05T09:30:37Z", + "modified": "2024-11-06T12:31:32Z", "published": "2024-10-09T15:32:21Z", "aliases": [ "CVE-2024-9675" @@ -60,6 +60,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:8679" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8686" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:8703" diff --git a/advisories/unreviewed/2024/08/GHSA-r7x8-hv2q-v9r7/GHSA-r7x8-hv2q-v9r7.json b/advisories/unreviewed/2024/08/GHSA-r7x8-hv2q-v9r7/GHSA-r7x8-hv2q-v9r7.json index b805dc8335a..20725ac7849 100644 --- a/advisories/unreviewed/2024/08/GHSA-r7x8-hv2q-v9r7/GHSA-r7x8-hv2q-v9r7.json +++ b/advisories/unreviewed/2024/08/GHSA-r7x8-hv2q-v9r7/GHSA-r7x8-hv2q-v9r7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-r7x8-hv2q-v9r7", - "modified": "2024-11-05T09:30:36Z", + "modified": "2024-11-06T12:31:31Z", "published": "2024-08-12T15:30:51Z", "aliases": [ "CVE-2024-7006" @@ -29,6 +29,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:8833" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8914" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-7006" diff --git a/advisories/unreviewed/2024/10/GHSA-wq2p-5pc6-wpgf/GHSA-wq2p-5pc6-wpgf.json b/advisories/unreviewed/2024/10/GHSA-wq2p-5pc6-wpgf/GHSA-wq2p-5pc6-wpgf.json index 049c3ee5bb5..97f09f1a4e9 100644 --- a/advisories/unreviewed/2024/10/GHSA-wq2p-5pc6-wpgf/GHSA-wq2p-5pc6-wpgf.json +++ b/advisories/unreviewed/2024/10/GHSA-wq2p-5pc6-wpgf/GHSA-wq2p-5pc6-wpgf.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-wq2p-5pc6-wpgf", - "modified": "2024-10-31T06:30:45Z", + "modified": "2024-11-06T12:31:32Z", "published": "2024-10-15T18:30:50Z", "aliases": [ "CVE-2024-9676" @@ -33,6 +33,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:8437" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8686" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-9676" diff --git a/advisories/unreviewed/2024/11/GHSA-32p4-gm2c-wmch/GHSA-32p4-gm2c-wmch.json b/advisories/unreviewed/2024/11/GHSA-32p4-gm2c-wmch/GHSA-32p4-gm2c-wmch.json new file mode 100644 index 00000000000..c059b8fb1cb --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-32p4-gm2c-wmch/GHSA-32p4-gm2c-wmch.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-32p4-gm2c-wmch", + "modified": "2024-11-06T12:31:32Z", + "published": "2024-11-06T12:31:32Z", + "aliases": [ + "CVE-2024-9902" + ], + "details": "A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9902" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-9902" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318271" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-06T10:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-38hm-287h-q3wv/GHSA-38hm-287h-q3wv.json b/advisories/unreviewed/2024/11/GHSA-38hm-287h-q3wv/GHSA-38hm-287h-q3wv.json new file mode 100644 index 00000000000..c9c475cbb06 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-38hm-287h-q3wv/GHSA-38hm-287h-q3wv.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-38hm-287h-q3wv", + "modified": "2024-11-06T12:31:32Z", + "published": "2024-11-06T12:31:32Z", + "aliases": [ + "CVE-2024-10168" + ], + "details": "The Active Products Tables for WooCommerce. Use constructor to create tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woot_button shortcode in all versions up to, and including, 1.0.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10168" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3182136" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/profit-products-tables-for-woocommerce/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4a13b13e-72d3-43c9-b5ec-d499f3b22091?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-06T12:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-fjxm-f2p4-c85h/GHSA-fjxm-f2p4-c85h.json b/advisories/unreviewed/2024/11/GHSA-fjxm-f2p4-c85h/GHSA-fjxm-f2p4-c85h.json new file mode 100644 index 00000000000..4782c7a5e25 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-fjxm-f2p4-c85h/GHSA-fjxm-f2p4-c85h.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fjxm-f2p4-c85h", + "modified": "2024-11-06T12:31:32Z", + "published": "2024-11-06T12:31:32Z", + "aliases": [ + "CVE-2024-10715" + ], + "details": "The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Map block in all versions up to, and including, 2.94.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10715" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3180900/mappress-google-maps-for-wordpress" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8d966924-aeab-4397-9555-78291af70efe?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-06T11:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-fwmf-6rqq-97g9/GHSA-fwmf-6rqq-97g9.json b/advisories/unreviewed/2024/11/GHSA-fwmf-6rqq-97g9/GHSA-fwmf-6rqq-97g9.json new file mode 100644 index 00000000000..e8d7d311bd9 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-fwmf-6rqq-97g9/GHSA-fwmf-6rqq-97g9.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fwmf-6rqq-97g9", + "modified": "2024-11-06T12:31:32Z", + "published": "2024-11-06T12:31:32Z", + "aliases": [ + "CVE-2024-8323" + ], + "details": "The Pricing Tables WordPress Plugin – Easy Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fontFamily’ attribute in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8323" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/easy-pricing-tables/trunk/includes/ept-block.php#L18" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3181961" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/easy-pricing-tables/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/68fb1fd3-16aa-467f-b5f6-a6126b05e088?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-06T12:15:03Z" + } +} \ No newline at end of file