Publish Advisories

GHSA-6g47-rggg-cg8v
GHSA-79h8-gxhq-q3jg
GHSA-hp3p-7892-f222
GHSA-pr8c-f372-64ch
GHSA-vxf3-94jj-jhmp

advisories/unreviewed/2024/06/GHSA-6g47-rggg-cg8v/GHSA-6g47-rggg-cg8v.json

@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6g47-rggg-cg8v",
+  "modified": "2024-06-24T00:34:02Z",
+  "published": "2024-06-24T00:34:02Z",
+  "aliases": [
+    "CVE-2024-6273"
+  ],
+  "details": "A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been declared as problematic. Affected by this vulnerability is the function save_patient of the file patient_side.php. The manipulation of the argument Full Name/Contact/Address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269485 was assigned to this vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6273"
+    },
+    {
+      "type": "WEB",
+      "url": "https://docs.google.com/document/d/14ExrgXqPQlgvjw2poqNzYzAOi-C5tda-XBJF513yzag/edit?usp=sharing"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/sgr-xd/CVEs/blob/main/CVE-2024-6273.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.269485"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.269485"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.362873"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-06-23T22:15:09Z"
+  }
+}

advisories/unreviewed/2024/06/GHSA-79h8-gxhq-q3jg/GHSA-79h8-gxhq-q3jg.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-79h8-gxhq-q3jg",
+  "modified": "2024-06-24T00:34:02Z",
+  "published": "2024-06-24T00:34:02Z",
+  "aliases": [
+    "CVE-2024-3121"
+  ],
+  "details": "A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the 'whoami' command among potentially other harmful commands.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3121"
+    },
+    {
+      "type": "WEB",
+      "url": "https://huntr.com/bounties/db57c343-9b80-4c1c-9ab0-9eef92c9b27b"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-94"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-06-24T00:15:09Z"
+  }
+}

advisories/unreviewed/2024/06/GHSA-hp3p-7892-f222/GHSA-hp3p-7892-f222.json

@@ -0,0 +1,59 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hp3p-7892-f222",
+  "modified": "2024-06-24T00:34:02Z",
+  "published": "2024-06-24T00:34:02Z",
+  "aliases": [
+    "CVE-2024-39331"
+  ],
+  "details": "In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39331"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8"
+    },
+    {
+      "type": "WEB",
+      "url": "https://list.orgmode.org/87sex5gdqc.fsf%40localhost"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.html"
+    },
+    {
+      "type": "WEB",
+      "url": "https://news.ycombinator.com/item?id=40768225"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.openwall.com/lists/oss-security/2024/06/23/1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.openwall.com/lists/oss-security/2024/06/23/2"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-06-23T22:15:09Z"
+  }
+}

advisories/unreviewed/2024/06/GHSA-pr8c-f372-64ch/GHSA-pr8c-f372-64ch.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-pr8c-f372-64ch",
+  "modified": "2024-06-24T00:34:02Z",
+  "published": "2024-06-24T00:34:02Z",
+  "aliases": [
+    "CVE-2024-39337"
+  ],
+  "details": "Click Studios Passwordstate Core before 9.8 build 9858 allows Authentication Bypass.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39337"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.clickstudios.com.au/passwordstate-changelog.aspx"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.clickstudios.com.au/security/advisories"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-06-24T00:15:09Z"
+  }
+}

advisories/unreviewed/2024/06/GHSA-vxf3-94jj-jhmp/GHSA-vxf3-94jj-jhmp.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vxf3-94jj-jhmp",
+  "modified": "2024-06-24T00:34:02Z",
+  "published": "2024-06-24T00:34:02Z",
+  "aliases": [
+    "CVE-2024-39334"
+  ],
+  "details": "MENDELSON AS4 before 2024 B376 has a client-side vulnerability when a trading partner provides prepared XML data. When a victim opens the details of this transaction in the client, files can be written to the computer on which the client process is running. (The server process is not affected.)",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39334"
+    },
+    {
+      "type": "WEB",
+      "url": "https://mendelson-e-c.com/node/27845"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-06-23T23:15:09Z"
+  }
+}