diff --git a/advisories/unreviewed/2024/06/GHSA-6g47-rggg-cg8v/GHSA-6g47-rggg-cg8v.json b/advisories/unreviewed/2024/06/GHSA-6g47-rggg-cg8v/GHSA-6g47-rggg-cg8v.json new file mode 100644 index 00000000000..e7c65c10c53 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-6g47-rggg-cg8v/GHSA-6g47-rggg-cg8v.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6g47-rggg-cg8v", + "modified": "2024-06-24T00:34:02Z", + "published": "2024-06-24T00:34:02Z", + "aliases": [ + "CVE-2024-6273" + ], + "details": "A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been declared as problematic. Affected by this vulnerability is the function save_patient of the file patient_side.php. The manipulation of the argument Full Name/Contact/Address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269485 was assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6273" + }, + { + "type": "WEB", + "url": "https://docs.google.com/document/d/14ExrgXqPQlgvjw2poqNzYzAOi-C5tda-XBJF513yzag/edit?usp=sharing" + }, + { + "type": "WEB", + "url": "https://github.com/sgr-xd/CVEs/blob/main/CVE-2024-6273.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.269485" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.269485" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.362873" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-23T22:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-79h8-gxhq-q3jg/GHSA-79h8-gxhq-q3jg.json b/advisories/unreviewed/2024/06/GHSA-79h8-gxhq-q3jg/GHSA-79h8-gxhq-q3jg.json new file mode 100644 index 00000000000..ed5ae97a0d7 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-79h8-gxhq-q3jg/GHSA-79h8-gxhq-q3jg.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-79h8-gxhq-q3jg", + "modified": "2024-06-24T00:34:02Z", + "published": "2024-06-24T00:34:02Z", + "aliases": [ + "CVE-2024-3121" + ], + "details": "A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the 'whoami' command among potentially other harmful commands.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3121" + }, + { + "type": "WEB", + "url": "https://huntr.com/bounties/db57c343-9b80-4c1c-9ab0-9eef92c9b27b" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T00:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-hp3p-7892-f222/GHSA-hp3p-7892-f222.json b/advisories/unreviewed/2024/06/GHSA-hp3p-7892-f222/GHSA-hp3p-7892-f222.json new file mode 100644 index 00000000000..baba723f3c8 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-hp3p-7892-f222/GHSA-hp3p-7892-f222.json @@ -0,0 +1,59 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hp3p-7892-f222", + "modified": "2024-06-24T00:34:02Z", + "published": "2024-06-24T00:34:02Z", + "aliases": [ + "CVE-2024-39331" + ], + "details": "In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39331" + }, + { + "type": "WEB", + "url": "https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29" + }, + { + "type": "WEB", + "url": "https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8" + }, + { + "type": "WEB", + "url": "https://list.orgmode.org/87sex5gdqc.fsf%40localhost" + }, + { + "type": "WEB", + "url": "https://lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.html" + }, + { + "type": "WEB", + "url": "https://news.ycombinator.com/item?id=40768225" + }, + { + "type": "WEB", + "url": "https://www.openwall.com/lists/oss-security/2024/06/23/1" + }, + { + "type": "WEB", + "url": "https://www.openwall.com/lists/oss-security/2024/06/23/2" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-23T22:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-pr8c-f372-64ch/GHSA-pr8c-f372-64ch.json b/advisories/unreviewed/2024/06/GHSA-pr8c-f372-64ch/GHSA-pr8c-f372-64ch.json new file mode 100644 index 00000000000..37f9ecadfa4 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-pr8c-f372-64ch/GHSA-pr8c-f372-64ch.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pr8c-f372-64ch", + "modified": "2024-06-24T00:34:02Z", + "published": "2024-06-24T00:34:02Z", + "aliases": [ + "CVE-2024-39337" + ], + "details": "Click Studios Passwordstate Core before 9.8 build 9858 allows Authentication Bypass.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39337" + }, + { + "type": "WEB", + "url": "https://www.clickstudios.com.au/passwordstate-changelog.aspx" + }, + { + "type": "WEB", + "url": "https://www.clickstudios.com.au/security/advisories" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T00:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-vxf3-94jj-jhmp/GHSA-vxf3-94jj-jhmp.json b/advisories/unreviewed/2024/06/GHSA-vxf3-94jj-jhmp/GHSA-vxf3-94jj-jhmp.json new file mode 100644 index 00000000000..dd28e53b6a8 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-vxf3-94jj-jhmp/GHSA-vxf3-94jj-jhmp.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vxf3-94jj-jhmp", + "modified": "2024-06-24T00:34:02Z", + "published": "2024-06-24T00:34:02Z", + "aliases": [ + "CVE-2024-39334" + ], + "details": "MENDELSON AS4 before 2024 B376 has a client-side vulnerability when a trading partner provides prepared XML data. When a victim opens the details of this transaction in the client, files can be written to the computer on which the client process is running. (The server process is not affected.)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39334" + }, + { + "type": "WEB", + "url": "https://mendelson-e-c.com/node/27845" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-23T23:15:09Z" + } +} \ No newline at end of file