From 16d818ea14907c6609820b483c97b625f0cd70f3 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 30 Jan 2024 09:32:03 +0000 Subject: [PATCH] Publish Advisories GHSA-6fjc-2q3r-pj6j GHSA-6p78-f7h9-6838 GHSA-89c9-2mcj-c9gr GHSA-8g5q-mp2w-j766 GHSA-9x52-pxhj-x4j7 GHSA-c5mq-q8c8-ppcw GHSA-c6mx-w98j-fgrj GHSA-fp4h-ppqj-prv5 GHSA-hj6r-9q35-32hf GHSA-px84-gp9q-g6w9 GHSA-v334-55hv-wvc6 GHSA-v89q-c273-3p42 GHSA-w7vr-jmcf-cx4m GHSA-wmcg-jxc8-7m7p GHSA-wx6g-w634-22ph GHSA-xf98-9fph-7hjg --- .../GHSA-6fjc-2q3r-pj6j.json | 35 ++++++++++++++ .../GHSA-6p78-f7h9-6838.json | 39 ++++++++++++++++ .../GHSA-89c9-2mcj-c9gr.json | 38 +++++++++++++++ .../GHSA-8g5q-mp2w-j766.json | 42 +++++++++++++++++ .../GHSA-9x52-pxhj-x4j7.json | 4 ++ .../GHSA-c5mq-q8c8-ppcw.json | 38 +++++++++++++++ .../GHSA-c6mx-w98j-fgrj.json | 39 ++++++++++++++++ .../GHSA-fp4h-ppqj-prv5.json | 4 ++ .../GHSA-hj6r-9q35-32hf.json | 35 ++++++++++++++ .../GHSA-px84-gp9q-g6w9.json | 35 ++++++++++++++ .../GHSA-v334-55hv-wvc6.json | 42 +++++++++++++++++ .../GHSA-v89q-c273-3p42.json | 39 ++++++++++++++++ .../GHSA-w7vr-jmcf-cx4m.json | 42 +++++++++++++++++ .../GHSA-wmcg-jxc8-7m7p.json | 46 +++++++++++++++++++ .../GHSA-wx6g-w634-22ph.json | 35 ++++++++++++++ .../GHSA-xf98-9fph-7hjg.json | 35 ++++++++++++++ 16 files changed, 548 insertions(+) create mode 100644 advisories/unreviewed/2024/01/GHSA-6fjc-2q3r-pj6j/GHSA-6fjc-2q3r-pj6j.json create mode 100644 advisories/unreviewed/2024/01/GHSA-6p78-f7h9-6838/GHSA-6p78-f7h9-6838.json create mode 100644 advisories/unreviewed/2024/01/GHSA-89c9-2mcj-c9gr/GHSA-89c9-2mcj-c9gr.json create mode 100644 advisories/unreviewed/2024/01/GHSA-8g5q-mp2w-j766/GHSA-8g5q-mp2w-j766.json create mode 100644 advisories/unreviewed/2024/01/GHSA-c5mq-q8c8-ppcw/GHSA-c5mq-q8c8-ppcw.json create mode 100644 advisories/unreviewed/2024/01/GHSA-c6mx-w98j-fgrj/GHSA-c6mx-w98j-fgrj.json create mode 100644 advisories/unreviewed/2024/01/GHSA-hj6r-9q35-32hf/GHSA-hj6r-9q35-32hf.json create mode 100644 advisories/unreviewed/2024/01/GHSA-px84-gp9q-g6w9/GHSA-px84-gp9q-g6w9.json create mode 100644 advisories/unreviewed/2024/01/GHSA-v334-55hv-wvc6/GHSA-v334-55hv-wvc6.json create mode 100644 advisories/unreviewed/2024/01/GHSA-v89q-c273-3p42/GHSA-v89q-c273-3p42.json create mode 100644 advisories/unreviewed/2024/01/GHSA-w7vr-jmcf-cx4m/GHSA-w7vr-jmcf-cx4m.json create mode 100644 advisories/unreviewed/2024/01/GHSA-wmcg-jxc8-7m7p/GHSA-wmcg-jxc8-7m7p.json create mode 100644 advisories/unreviewed/2024/01/GHSA-wx6g-w634-22ph/GHSA-wx6g-w634-22ph.json create mode 100644 advisories/unreviewed/2024/01/GHSA-xf98-9fph-7hjg/GHSA-xf98-9fph-7hjg.json diff --git a/advisories/unreviewed/2024/01/GHSA-6fjc-2q3r-pj6j/GHSA-6fjc-2q3r-pj6j.json b/advisories/unreviewed/2024/01/GHSA-6fjc-2q3r-pj6j/GHSA-6fjc-2q3r-pj6j.json new file mode 100644 index 00000000000..8905a16d6a7 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-6fjc-2q3r-pj6j/GHSA-6fjc-2q3r-pj6j.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6fjc-2q3r-pj6j", + "modified": "2024-01-30T09:30:34Z", + "published": "2024-01-30T09:30:34Z", + "aliases": [ + "CVE-2024-22648" + ], + "details": "A Blind SSRF vulnerability exists in the \"Crawl Meta Data\" functionality of SEO Panel version 4.10.0. This makes it possible for remote attackers to scan ports in the local environment.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22648" + }, + { + "type": "WEB", + "url": "https://github.com/cassis-sec/CVE/tree/main/2024/CVE-2024-22648" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-30T07:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-6p78-f7h9-6838/GHSA-6p78-f7h9-6838.json b/advisories/unreviewed/2024/01/GHSA-6p78-f7h9-6838/GHSA-6p78-f7h9-6838.json new file mode 100644 index 00000000000..939afca9ffb --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-6p78-f7h9-6838/GHSA-6p78-f7h9-6838.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6p78-f7h9-6838", + "modified": "2024-01-30T09:30:34Z", + "published": "2024-01-30T09:30:34Z", + "aliases": [ + "CVE-2023-36260" + ], + "details": "An issue discovered in Craft CMS version 4.6.1. allows remote attackers to cause a denial of service (DoS) via crafted string to Feed-Me Name and Feed-Me URL fields due to saving a feed using an Asset element type with no volume selected.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36260" + }, + { + "type": "WEB", + "url": "https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28%29" + }, + { + "type": "WEB", + "url": "https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-30T09:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-89c9-2mcj-c9gr/GHSA-89c9-2mcj-c9gr.json b/advisories/unreviewed/2024/01/GHSA-89c9-2mcj-c9gr/GHSA-89c9-2mcj-c9gr.json new file mode 100644 index 00000000000..b0184c95f52 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-89c9-2mcj-c9gr/GHSA-89c9-2mcj-c9gr.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-89c9-2mcj-c9gr", + "modified": "2024-01-30T09:30:34Z", + "published": "2024-01-30T09:30:34Z", + "aliases": [ + "CVE-2024-1061" + ], + "details": "The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the  'get_view' function.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1061" + }, + { + "type": "WEB", + "url": "https://www.tenable.com/security/research/tra-2024-02" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-30T09:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-8g5q-mp2w-j766/GHSA-8g5q-mp2w-j766.json b/advisories/unreviewed/2024/01/GHSA-8g5q-mp2w-j766/GHSA-8g5q-mp2w-j766.json new file mode 100644 index 00000000000..73c2b190be5 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-8g5q-mp2w-j766/GHSA-8g5q-mp2w-j766.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8g5q-mp2w-j766", + "modified": "2024-01-30T09:30:34Z", + "published": "2024-01-30T09:30:34Z", + "aliases": [ + "CVE-2023-6943" + ], + "details": "Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 and later, FR Configurator2 all versions, GT Designer3 Version1(GOT1000) all versions, GT Designer3 Version1(GOT2000) all versions, GX Works2 versions 1.11M and later, GX Works3 all versions, MELSOFT Navigator versions 1.04E and later, MT Works2 all versions, MX Component versions 4.00A and later and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to execute a malicious code by RPC with a path to a malicious library while connected to the products.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6943" + }, + { + "type": "WEB", + "url": "https://jvn.jp/vu/JVNVU95103362" + }, + { + "type": "WEB", + "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-020_en.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-470" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-30T09:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-9x52-pxhj-x4j7/GHSA-9x52-pxhj-x4j7.json b/advisories/unreviewed/2024/01/GHSA-9x52-pxhj-x4j7/GHSA-9x52-pxhj-x4j7.json index 02e05126379..0a2bf3b81d6 100644 --- a/advisories/unreviewed/2024/01/GHSA-9x52-pxhj-x4j7/GHSA-9x52-pxhj-x4j7.json +++ b/advisories/unreviewed/2024/01/GHSA-9x52-pxhj-x4j7/GHSA-9x52-pxhj-x4j7.json @@ -21,6 +21,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1015" }, + { + "type": "WEB", + "url": "https://www.hackplayers.com/2024/01/cve-2024-1014-and-cve-2024-1015.html" + }, { "type": "WEB", "url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-se-elektronic-gmbh-products" diff --git a/advisories/unreviewed/2024/01/GHSA-c5mq-q8c8-ppcw/GHSA-c5mq-q8c8-ppcw.json b/advisories/unreviewed/2024/01/GHSA-c5mq-q8c8-ppcw/GHSA-c5mq-q8c8-ppcw.json new file mode 100644 index 00000000000..293139ad6e1 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-c5mq-q8c8-ppcw/GHSA-c5mq-q8c8-ppcw.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c5mq-q8c8-ppcw", + "modified": "2024-01-30T09:30:34Z", + "published": "2024-01-30T09:30:34Z", + "aliases": [ + "CVE-2024-21803" + ], + "details": "Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth modules) allows Local Execution of Code. This vulnerability is associated with program files https://gitee.Com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/af_bluetooth.C.\n\nThis issue affects Linux kernel: from v2.6.12-rc2 before v6.8-rc1.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21803" + }, + { + "type": "WEB", + "url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=8081" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-30T08:15:41Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-c6mx-w98j-fgrj/GHSA-c6mx-w98j-fgrj.json b/advisories/unreviewed/2024/01/GHSA-c6mx-w98j-fgrj/GHSA-c6mx-w98j-fgrj.json new file mode 100644 index 00000000000..85feb217f8b --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-c6mx-w98j-fgrj/GHSA-c6mx-w98j-fgrj.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c6mx-w98j-fgrj", + "modified": "2024-01-30T09:30:33Z", + "published": "2024-01-30T09:30:33Z", + "aliases": [ + "CVE-2023-52071" + ], + "details": "tiny-curl-8_4_0 , curl-8_4_0 and curl-8_5_0 were discovered to contain an off-by-one out-of-bounds array index via the component tool_cb_wrt.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52071" + }, + { + "type": "WEB", + "url": "https://github.com/curl/curl/commit/73980f9ace6c7577e7fcab8008bbde8a0a231692" + }, + { + "type": "WEB", + "url": "https://github.com/curl/curl/commit/af3f4e41#r127212213" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-30T07:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-fp4h-ppqj-prv5/GHSA-fp4h-ppqj-prv5.json b/advisories/unreviewed/2024/01/GHSA-fp4h-ppqj-prv5/GHSA-fp4h-ppqj-prv5.json index 06e40156015..90df1f76dbd 100644 --- a/advisories/unreviewed/2024/01/GHSA-fp4h-ppqj-prv5/GHSA-fp4h-ppqj-prv5.json +++ b/advisories/unreviewed/2024/01/GHSA-fp4h-ppqj-prv5/GHSA-fp4h-ppqj-prv5.json @@ -21,6 +21,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1014" }, + { + "type": "WEB", + "url": "https://www.hackplayers.com/2024/01/cve-2024-1014-and-cve-2024-1015.html" + }, { "type": "WEB", "url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-se-elektronic-gmbh-products" diff --git a/advisories/unreviewed/2024/01/GHSA-hj6r-9q35-32hf/GHSA-hj6r-9q35-32hf.json b/advisories/unreviewed/2024/01/GHSA-hj6r-9q35-32hf/GHSA-hj6r-9q35-32hf.json new file mode 100644 index 00000000000..df90a8de501 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-hj6r-9q35-32hf/GHSA-hj6r-9q35-32hf.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hj6r-9q35-32hf", + "modified": "2024-01-30T09:30:34Z", + "published": "2024-01-30T09:30:34Z", + "aliases": [ + "CVE-2024-22647" + ], + "details": "An user enumeration vulnerability was found in SEO Panel 4.10.0. This issue occurs during user authentication, where a difference in error messages could allow an attacker to determine if a username is valid or not, enabling a brute-force attack with valid usernames.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22647" + }, + { + "type": "WEB", + "url": "https://github.com/cassis-sec/CVE/tree/main/2024/CVE-2024-22647" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-30T07:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-px84-gp9q-g6w9/GHSA-px84-gp9q-g6w9.json b/advisories/unreviewed/2024/01/GHSA-px84-gp9q-g6w9/GHSA-px84-gp9q-g6w9.json new file mode 100644 index 00000000000..96886981eea --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-px84-gp9q-g6w9/GHSA-px84-gp9q-g6w9.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-px84-gp9q-g6w9", + "modified": "2024-01-30T09:30:34Z", + "published": "2024-01-30T09:30:34Z", + "aliases": [ + "CVE-2024-22523" + ], + "details": "Directory Traversal vulnerability in Qiyu iFair version 23.8_ad0 and before, allows remote attackers to obtain sensitive information via uploadimage component.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22523" + }, + { + "type": "WEB", + "url": "https://www.yuque.com/for82/vdzwqe/sc8ictw8poo8v5gl" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-30T09:15:48Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-v334-55hv-wvc6/GHSA-v334-55hv-wvc6.json b/advisories/unreviewed/2024/01/GHSA-v334-55hv-wvc6/GHSA-v334-55hv-wvc6.json new file mode 100644 index 00000000000..15694a0fdd1 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-v334-55hv-wvc6/GHSA-v334-55hv-wvc6.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v334-55hv-wvc6", + "modified": "2024-01-30T09:30:34Z", + "published": "2024-01-30T09:30:34Z", + "aliases": [ + "CVE-2023-6374" + ], + "details": "Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unauthenticated attacker to bypass authentication by capture-replay attack and illegally login to the affected module. As a result, the remote attacker who has logged in illegally may be able to disclose or tamper with the programs and parameters in the modules.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6374" + }, + { + "type": "WEB", + "url": "https://jvn.jp/vu/JVNVU99497477" + }, + { + "type": "WEB", + "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-019_en.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-294" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-30T09:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-v89q-c273-3p42/GHSA-v89q-c273-3p42.json b/advisories/unreviewed/2024/01/GHSA-v89q-c273-3p42/GHSA-v89q-c273-3p42.json new file mode 100644 index 00000000000..bc77d45b452 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-v89q-c273-3p42/GHSA-v89q-c273-3p42.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v89q-c273-3p42", + "modified": "2024-01-30T09:30:34Z", + "published": "2024-01-30T09:30:34Z", + "aliases": [ + "CVE-2023-36259" + ], + "details": "Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36259" + }, + { + "type": "WEB", + "url": "https://github.com/sjelfull/craft-audit/pull/73" + }, + { + "type": "WEB", + "url": "https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-30T09:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-w7vr-jmcf-cx4m/GHSA-w7vr-jmcf-cx4m.json b/advisories/unreviewed/2024/01/GHSA-w7vr-jmcf-cx4m/GHSA-w7vr-jmcf-cx4m.json new file mode 100644 index 00000000000..0ff08e52123 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-w7vr-jmcf-cx4m/GHSA-w7vr-jmcf-cx4m.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w7vr-jmcf-cx4m", + "modified": "2024-01-30T09:30:34Z", + "published": "2024-01-30T09:30:34Z", + "aliases": [ + "CVE-2023-6942" + ], + "details": "Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 and later, FR Configurator2 all versions, GT Designer3 Version1(GOT1000) all versions, GT Designer3 Version1(GOT2000) all versions, GX Works2 versions 1.11M and later, GX Works3 all versions, MELSOFT Navigator versions 1.04E and later, MT Works2 all versions, MX Component versions 4.00A and later and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to bypass authentication by sending specially crafted packets and connect to the products illegally.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6942" + }, + { + "type": "WEB", + "url": "https://jvn.jp/vu/JVNVU95103362" + }, + { + "type": "WEB", + "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-020_en.pdf" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-306" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-30T09:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-wmcg-jxc8-7m7p/GHSA-wmcg-jxc8-7m7p.json b/advisories/unreviewed/2024/01/GHSA-wmcg-jxc8-7m7p/GHSA-wmcg-jxc8-7m7p.json new file mode 100644 index 00000000000..e46f2373380 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-wmcg-jxc8-7m7p/GHSA-wmcg-jxc8-7m7p.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wmcg-jxc8-7m7p", + "modified": "2024-01-30T09:30:34Z", + "published": "2024-01-30T09:30:34Z", + "aliases": [ + "CVE-2023-7225" + ], + "details": "The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width and height parameters in all versions up to, and including, 2.88.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7225" + }, + { + "type": "WEB", + "url": "https://advisory.abay.sh/cve-2023-7225/" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3023266%40mappress-google-maps-for-wordpress%2Ftrunk&old=3022439%40mappress-google-maps-for-wordpress%2Ftrunk&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fce76126-0cfd-464f-b644-45d4301e958d?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-30T08:15:40Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-wx6g-w634-22ph/GHSA-wx6g-w634-22ph.json b/advisories/unreviewed/2024/01/GHSA-wx6g-w634-22ph/GHSA-wx6g-w634-22ph.json new file mode 100644 index 00000000000..5d1f37d3824 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-wx6g-w634-22ph/GHSA-wx6g-w634-22ph.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wx6g-w634-22ph", + "modified": "2024-01-30T09:30:33Z", + "published": "2024-01-30T09:30:33Z", + "aliases": [ + "CVE-2024-22646" + ], + "details": "An email address enumeration vulnerability exists in the password reset function of SEO Panel version 4.10.0. This allows an attacker to guess which emails exist on the system.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22646" + }, + { + "type": "WEB", + "url": "https://github.com/cassis-sec/CVE/tree/main/2024/CVE-2024-22646" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-30T07:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-xf98-9fph-7hjg/GHSA-xf98-9fph-7hjg.json b/advisories/unreviewed/2024/01/GHSA-xf98-9fph-7hjg/GHSA-xf98-9fph-7hjg.json new file mode 100644 index 00000000000..25346f10a92 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-xf98-9fph-7hjg/GHSA-xf98-9fph-7hjg.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xf98-9fph-7hjg", + "modified": "2024-01-30T09:30:33Z", + "published": "2024-01-30T09:30:33Z", + "aliases": [ + "CVE-2024-22643" + ], + "details": "A Cross-Site Request Forgery (CSRF) vulnerability in SEO Panel version 4.10.0 allows remote attackers to perform unauthorized user password resets.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22643" + }, + { + "type": "WEB", + "url": "https://github.com/cassis-sec/CVE/tree/main/2024/CVE-2024-22643" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-30T07:15:07Z" + } +} \ No newline at end of file