netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-457w-p2rx-36qq
GHSA-cf65-84fr-hwv4
GHSA-m3qq-5j3g-rq9q
GHSA-mqgc-wwff-qc9q
GHSA-mqmq-vr52-c53r
GHSA-p7p2-vf3x-m7fp
GHSA-pq5j-cmm3-64mg
GHSA-w6gp-8v4q-c8g7
This commit is contained in:
advisory-database[bot]
2024-05-07 09:32:07 +00:00
parent aac23600b1
commit 1501569111
8 changed files with 320 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/05/GHSA-457w-p2rx-36qq/GHSA-457w-p2rx-36qq.json
+46
View File
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-457w-p2rx-36qq",
"modified": "2024-05-07T09:30:32Z",
"published": "2024-05-07T09:30:32Z",
"aliases": [
"CVE-2024-4346"
],
"details": "The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. This is due to the plugin not properly validating the path of an uploaded file prior to deleting it. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4346"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/startklar-elmentor-forms-extwidgets/trunk/startklarDropZoneUploadProcess.php?rev=3061298#L7"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3081987/startklar-elmentor-forms-extwidgets"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a125bbf1-8ff6-4f3d-a4fb-caaaefe1df2a?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T09:15:39Z"
}
}
advisories/unreviewed/2024/05/GHSA-cf65-84fr-hwv4/GHSA-cf65-84fr-hwv4.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cf65-84fr-hwv4",
"modified": "2024-05-07T09:30:32Z",
"published": "2024-05-07T09:30:32Z",
"aliases": [
"CVE-2024-23808"
],
"details": "in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free or cause DOS through NULL pointer dereference.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23808"
},
{
"type": "WEB",
"url": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-05.md"
}
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T07:15:48Z"
}
}
advisories/unreviewed/2024/05/GHSA-m3qq-5j3g-rq9q/GHSA-m3qq-5j3g-rq9q.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m3qq-5j3g-rq9q",
"modified": "2024-05-07T09:30:32Z",
"published": "2024-05-07T09:30:32Z",
"aliases": [
"CVE-2024-3759"
],
"details": "in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in TCB through use after free.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3759"
},
{
"type": "WEB",
"url": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-05.md"
}
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T07:15:50Z"
}
}
advisories/unreviewed/2024/05/GHSA-mqgc-wwff-qc9q/GHSA-mqgc-wwff-qc9q.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mqgc-wwff-qc9q",
"modified": "2024-05-07T09:30:32Z",
"published": "2024-05-07T09:30:32Z",
"aliases": [
"CVE-2024-31078"
],
"details": "in OpenHarmony v4.0.0 and prior versions allow a local attacker cause service crash through NULL pointer dereference.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31078"
},
{
"type": "WEB",
"url": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-05.md"
}
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T07:15:48Z"
}
}
advisories/unreviewed/2024/05/GHSA-mqmq-vr52-c53r/GHSA-mqmq-vr52-c53r.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mqmq-vr52-c53r",
"modified": "2024-05-07T09:30:32Z",
"published": "2024-05-07T09:30:32Z",
"aliases": [
"CVE-2024-3758"
],
"details": "in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in TCB through heap buffer overflow.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3758"
},
{
"type": "WEB",
"url": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-05.md"
}
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T07:15:49Z"
}
}
advisories/unreviewed/2024/05/GHSA-p7p2-vf3x-m7fp/GHSA-p7p2-vf3x-m7fp.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p7p2-vf3x-m7fp",
"modified": "2024-05-07T09:30:32Z",
"published": "2024-05-07T09:30:32Z",
"aliases": [
"CVE-2024-3757"
],
"details": "in OpenHarmony v4.0.0 and prior versions allow a local attacker cause service crash through integer overflow.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3757"
},
{
"type": "WEB",
"url": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-05.md"
}
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T07:15:49Z"
}
}
advisories/unreviewed/2024/05/GHSA-pq5j-cmm3-64mg/GHSA-pq5j-cmm3-64mg.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pq5j-cmm3-64mg",
"modified": "2024-05-07T09:30:32Z",
"published": "2024-05-07T09:30:32Z",
"aliases": [
"CVE-2024-27217"
],
"details": "in OpenHarmony v4.0.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27217"
},
{
"type": "WEB",
"url": "https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2024/2024-05.md"
}
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T07:15:48Z"
}
}
advisories/unreviewed/2024/05/GHSA-w6gp-8v4q-c8g7/GHSA-w6gp-8v4q-c8g7.json
+46
View File
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w6gp-8v4q-c8g7",
"modified": "2024-05-07T09:30:32Z",
"published": "2024-05-07T09:30:32Z",
"aliases": [
"CVE-2024-4345"
],
"details": "The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'process' function in the 'startklarDropZoneUploadProcess' class in versions up to, and including, 1.7.13. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4345"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/startklar-elmentor-forms-extwidgets/trunk/startklarDropZoneUploadProcess.php?rev=3061298#L7"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3081987/startklar-elmentor-forms-extwidgets"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4221b33c-5cfa-48db-92bf-bf25ff3c5a5f?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-07T09:15:38Z"
}
}