netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-97gr-9g44-39q4
GHSA-h38m-mxmf-5c2q
GHSA-m8cg-23fc-95h8
GHSA-qp28-67v3-65qc
GHSA-w8wf-rhcx-wvhg
This commit is contained in:
advisory-database[bot]
2024-06-17 06:31:59 +00:00
parent 7b3cccb374
commit 224cc3f124
5 changed files with 200 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/06/GHSA-97gr-9g44-39q4/GHSA-97gr-9g44-39q4.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-97gr-9g44-39q4",
"modified": "2024-06-17T06:30:35Z",
"published": "2024-06-17T06:30:35Z",
"aliases": [
"CVE-2024-4305"
],
"details": "The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.1.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4305"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/635be98d-4c17-4e75-871f-9794d85a2eb1"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-17T06:15:09Z"
}
}
advisories/unreviewed/2024/06/GHSA-h38m-mxmf-5c2q/GHSA-h38m-mxmf-5c2q.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h38m-mxmf-5c2q",
"modified": "2024-06-17T06:30:34Z",
"published": "2024-06-17T06:30:34Z",
"aliases": [
"CVE-2024-6046"
],
"details": "SECOM WRTR-304GN-304TW-UPSC V02(unsupported-when-assigned) does not properly filter user input in the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6046"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/en/cp-139-7882-998f5-2.html"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-7881-f88ad-1.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-17T04:15:09Z"
}
}
advisories/unreviewed/2024/06/GHSA-m8cg-23fc-95h8/GHSA-m8cg-23fc-95h8.json
+46
View File
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m8cg-23fc-95h8",
"modified": "2024-06-17T06:30:34Z",
"published": "2024-06-17T06:30:34Z",
"aliases": [
"CVE-2024-6045"
],
"details": "Certain models of D-Link wireless routers contain an undisclosed factory testing backdoor. Unauthenticated attackers on the local area network can force the device to enable Telnet service by accessing a specific URL and can log in by using the administrator credentials obtained from analyzing the firmware.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6045"
},
{
"type": "WEB",
"url": "https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10398"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/en/cp-139-7880-629f5-2.html"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-7879-da630-1.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-798"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-17T04:15:09Z"
}
}
advisories/unreviewed/2024/06/GHSA-qp28-67v3-65qc/GHSA-qp28-67v3-65qc.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qp28-67v3-65qc",
"modified": "2024-06-17T06:30:34Z",
"published": "2024-06-17T06:30:34Z",
"aliases": [
"CVE-2024-3236"
],
"details": "The Popup Builder WordPress plugin before 1.1.33 does not sanitise and escape some of its Notification fields, which could allow users such as contributor and above to perform Stored Cross-Site Scripting attacks.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3236"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/a6c2da28-dc03-4bcc-a6c3-ee55a73861db"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-17T06:15:08Z"
}
}
advisories/unreviewed/2024/06/GHSA-w8wf-rhcx-wvhg/GHSA-w8wf-rhcx-wvhg.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w8wf-rhcx-wvhg",
"modified": "2024-06-17T06:30:35Z",
"published": "2024-06-17T06:30:35Z",
"aliases": [
"CVE-2024-6047"
],
"details": "Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6047"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/en/cp-139-7884-c5a8b-2.html"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-7883-f5635-1.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-78"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-17T06:15:09Z"
}
}