Publish Advisories

GHSA-874v-pj72-92f3 GHSA-2ggw-fmhw-m4pr GHSA-2w45-gphx-5gj8 GHSA-39fv-p94v-rg6c GHSA-44wm-f244-xhp3 GHSA-669x-xjh2-j5gc GHSA-8qpg-h99j-c4j3 GHSA-9w5c-29mx-552c GHSA-fgmh-2jhg-vq8c GHSA-fwx9-j2j6-84w3 GHSA-jc6v-5cmr-j9pj GHSA-jqcx-vw98-5q84 GHSA-pqm8-8qjv-37cq GHSA-pvxx-5f8c-q7f2 GHSA-xr49-qh48-cff9
2026-05-22 18:04:22 -07:00 · 2024-04-03 03:31:53 +00:00
parent d31d8a0f8d
commit 236a794dff
15 changed files with 615 additions and 1 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-874v-pj72-92f3",
-  "modified": "2024-03-28T17:53:52Z",
+  "modified": "2024-04-03T03:30:29Z",
  "published": "2024-03-28T17:53:52Z",
  "aliases": [
    "CVE-2024-1753"
@@ -79,6 +79,14 @@
      "type": "PACKAGE",
      "url": "https://github.com/containers/podman"
    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCRZVUDOFM5CPREQKBEU2VK2QK62PSBP"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYMVMQ7RWMDTSKQTBO734BE3WQPI2AJ"
+    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVBSVZGVABPYIHK5HZM472NPGWMI7WXH"
@@ -0,0 +1,50 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2ggw-fmhw-m4pr",
+  "modified": "2024-04-03T03:30:30Z",
+  "published": "2024-04-03T03:30:30Z",
+  "aliases": [
+    "CVE-2024-3223"
+  ],
+  "details": "A vulnerability, which was classified as critical, was found in SourceCodester PHP Task Management System 1.0. Affected is an unknown function of the file admin-manage-user.php. The manipulation of the argument admin_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259068.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3223"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/SLthendieck/cve-report/blob/main/3.pdf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.259068"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.259068"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.308628"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-03T01:16:05Z"
+  }
+}
@@ -0,0 +1,50 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2w45-gphx-5gj8",
+  "modified": "2024-04-03T03:30:30Z",
+  "published": "2024-04-03T03:30:30Z",
+  "aliases": [
+    "CVE-2024-3225"
+  ],
+  "details": "A vulnerability was found in SourceCodester PHP Task Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file edit-task.php. The manipulation of the argument task_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259070 is the identifier assigned to this vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3225"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/E1CHO/cve_hub/blob/main/php%20task%20management%20system/php%20task%20management%20system%20-%20vuln%204.pdf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.259070"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.259070"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.308642"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-03T02:15:08Z"
+  }
+}
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-39fv-p94v-rg6c",
+  "modified": "2024-04-03T03:30:30Z",
+  "published": "2024-04-03T03:30:30Z",
+  "aliases": [
+    "CVE-2024-28836"
+  ],
+  "details": "An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When negotiating the TLS version on the server side, it can fall back to the TLS 1.2 implementation of the protocol if it is disabled. If the TLS 1.2 implementation was disabled at build time, a TLS 1.2 client could put a TLS 1.3-only server into an infinite loop processing a TLS 1.2 ClientHello, resulting in a denial of service. If the TLS 1.2 implementation was disabled at runtime, a TLS 1.2 client can successfully establish a TLS 1.2 connection with the server.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28836"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-03T03:15:10Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-44wm-f244-xhp3",
+  "modified": "2024-04-03T03:30:30Z",
+  "published": "2024-04-03T03:30:30Z",
+  "aliases": [
+    "CVE-2024-28219"
+  ],
+  "details": "In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28219"
+    },
+    {
+      "type": "WEB",
+      "url": "https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-03T03:15:09Z"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-669x-xjh2-j5gc",
+  "modified": "2024-04-03T03:30:30Z",
+  "published": "2024-04-03T03:30:30Z",
+  "aliases": [
+    "CVE-2024-1327"
+  ],
+  "details": "The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image box widget in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1327"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/jeg-elementor-kit/tags/2.6.2/class/elements/views/class-view-abstract.php#L123"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/34a42180-9d08-4049-8da8-27ee1f64600a?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-03T03:15:08Z"
+  }
+}
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8qpg-h99j-c4j3",
+  "modified": "2024-04-03T03:30:30Z",
+  "published": "2024-04-03T03:30:30Z",
+  "aliases": [
+    "CVE-2024-24724"
+  ],
+  "details": "Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24724"
+    },
+    {
+      "type": "WEB",
+      "url": "https://gibbonedu.org/download"
+    },
+    {
+      "type": "WEB",
+      "url": "https://packetstormsecurity.com/files/177857"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-03T03:15:09Z"
+  }
+}
@@ -0,0 +1,47 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9w5c-29mx-552c",
+  "modified": "2024-04-03T03:30:30Z",
+  "published": "2024-04-03T03:30:30Z",
+  "aliases": [
+    "CVE-2024-28755"
+  ],
+  "details": "An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28755"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hey3e"
+    },
+    {
+      "type": "WEB",
+      "url": "https://hey3e.github.io"
+    },
+    {
+      "type": "WEB",
+      "url": "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-03T03:15:10Z"
+  }
+}
@@ -0,0 +1,50 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-fgmh-2jhg-vq8c",
+  "modified": "2024-04-03T03:30:30Z",
+  "published": "2024-04-03T03:30:30Z",
+  "aliases": [
+    "CVE-2024-3227"
+  ],
+  "details": "A vulnerability was found in Panwei eoffice OA up to 9.5. It has been declared as critical. This vulnerability affects unknown code of the file /general/system/interface/theme_set/save_image.php of the component Backend. The manipulation of the argument image_type leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259072.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3227"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/garboa/cve_3/blob/main/upload.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.259072"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.259072"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.308750"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-24"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-03T03:15:11Z"
+  }
+}
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-fwx9-j2j6-84w3",
+  "modified": "2024-04-03T03:30:30Z",
+  "published": "2024-04-03T03:30:30Z",
+  "aliases": [
+    "CVE-2024-3162"
+  ],
+  "details": "The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget Attributes in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3162"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3062484"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d54c7623-25af-4bf1-a6e0-9022ec26f391?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-03T03:15:10Z"
+  }
+}
@@ -0,0 +1,50 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jc6v-5cmr-j9pj",
+  "modified": "2024-04-03T03:30:30Z",
+  "published": "2024-04-03T03:30:30Z",
+  "aliases": [
+    "CVE-2024-3224"
+  ],
+  "details": "A vulnerability has been found in SourceCodester PHP Task Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file task-details.php. The manipulation of the argument task_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259069 was assigned to this vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3224"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/E1CHO/cve_hub/blob/main/php%20task%20management%20system/php%20task%20management%20system%20-%20vuln%203.pdf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.259069"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.259069"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.308631"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-03T02:15:08Z"
+  }
+}
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jqcx-vw98-5q84",
+  "modified": "2024-04-03T03:30:30Z",
+  "published": "2024-04-03T03:30:30Z",
+  "aliases": [
+    "CVE-2024-30166"
+  ],
+  "details": "In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a stack buffer over-read (of less than 256 bytes) in a TLS 1.3 server via a TLS 3.1 ClientHello.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30166"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0"
+    },
+    {
+      "type": "WEB",
+      "url": "https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-03T03:15:10Z"
+  }
+}
@@ -0,0 +1,50 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-pqm8-8qjv-37cq",
+  "modified": "2024-04-03T03:30:30Z",
+  "published": "2024-04-03T03:30:30Z",
+  "aliases": [
+    "CVE-2024-3226"
+  ],
+  "details": "A vulnerability was found in Campcodes Online Patient Record Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/login.php. The manipulation of the argument password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259071.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3226"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/E1CHO/cve_hub/blob/main/Online%20Patient%20Record%20Management%20System%20-%20vuln%201.pdf"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.259071"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.259071"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.308644"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-03T02:15:08Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-pvxx-5f8c-q7f2",
+  "modified": "2024-04-03T03:30:30Z",
+  "published": "2024-04-03T03:30:30Z",
+  "aliases": [
+    "CVE-2024-26495"
+  ],
+  "details": "Cross Site Scripting (XSS) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and obtain sensitive information via the BBCode tags in the post content and post comments function.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26495"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/friendica/friendica/issues/13884"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-03T03:15:09Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xr49-qh48-cff9",
+  "modified": "2024-04-03T03:30:30Z",
+  "published": "2024-04-03T03:30:30Z",
+  "aliases": [
+    "CVE-2024-25864"
+  ],
+  "details": "Server Side Request Forgery (SSRF) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and obtain sensitive information via the fpostit.php component.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25864"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/friendica/friendica/issues/13877"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-03T03:15:09Z"
+  }
+}