diff --git a/advisories/unreviewed/2025/01/GHSA-fh7x-2848-jmpf/GHSA-fh7x-2848-jmpf.json b/advisories/unreviewed/2025/01/GHSA-fh7x-2848-jmpf/GHSA-fh7x-2848-jmpf.json new file mode 100644 index 00000000000..829221c3cf9 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-fh7x-2848-jmpf/GHSA-fh7x-2848-jmpf.json @@ -0,0 +1,41 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fh7x-2848-jmpf", + "modified": "2025-01-29T09:31:42Z", + "published": "2025-01-29T09:31:42Z", + "aliases": [ + "CVE-2024-57965" + ], + "details": "In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57965" + }, + { + "type": "WEB", + "url": "https://github.com/axios/axios/issues/6351" + }, + { + "type": "WEB", + "url": "https://github.com/axios/axios/pull/6714" + }, + { + "type": "WEB", + "url": "https://github.com/axios/axios/commit/0a8d6e19da5b9899a2abafaaa06a75ee548597db" + }, + { + "type": "WEB", + "url": "https://github.com/axios/axios/releases/tag/v1.7.8" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T09:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-qvmx-hr48-4rxp/GHSA-qvmx-hr48-4rxp.json b/advisories/unreviewed/2025/01/GHSA-qvmx-hr48-4rxp/GHSA-qvmx-hr48-4rxp.json new file mode 100644 index 00000000000..21131efd38f --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-qvmx-hr48-4rxp/GHSA-qvmx-hr48-4rxp.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qvmx-hr48-4rxp", + "modified": "2025-01-29T09:31:43Z", + "published": "2025-01-29T09:31:42Z", + "aliases": [ + "CVE-2024-7695" + ], + "details": "Multiple switches are affected by an out-of-bounds write vulnerability. This vulnerability is caused by insufficient input validation, which allows data to be written to memory outside the bounds of the buffer. Successful exploitation of this vulnerability could result in a denial-of-service attack. \n\nThis vulnerability poses a significant remote threat if the affected products are exposed to publicly accessible networks. Attackers could potentially disrupt operations by shutting down the affected systems. Due to the critical nature of this security risk, we strongly recommend taking immediate action to prevent its potential exploitation.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7695" + }, + { + "type": "WEB", + "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-240162-cve-2024-7695-out-of-bounds-write-vulnerability-identified-in-multiple-pt-switches" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T08:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-xc84-x7qm-x975/GHSA-xc84-x7qm-x975.json b/advisories/unreviewed/2025/01/GHSA-xc84-x7qm-x975/GHSA-xc84-x7qm-x975.json new file mode 100644 index 00000000000..c467e5e4231 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-xc84-x7qm-x975/GHSA-xc84-x7qm-x975.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xc84-x7qm-x975", + "modified": "2025-01-29T09:31:42Z", + "published": "2025-01-29T09:31:42Z", + "aliases": [ + "CVE-2024-13696" + ], + "details": "The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wishlist_name’ parameter in all versions up to, and including, 1.2.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13696" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/flexible-wishlist/trunk/assets/js/front.js" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3230370" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/flexible-wishlist/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/112456a9-8bb6-4007-87da-6d0fba912498?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T08:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-xh5q-pch5-g3xq/GHSA-xh5q-pch5-g3xq.json b/advisories/unreviewed/2025/01/GHSA-xh5q-pch5-g3xq/GHSA-xh5q-pch5-g3xq.json index bd6c015d2ad..e2106083b28 100644 --- a/advisories/unreviewed/2025/01/GHSA-xh5q-pch5-g3xq/GHSA-xh5q-pch5-g3xq.json +++ b/advisories/unreviewed/2025/01/GHSA-xh5q-pch5-g3xq/GHSA-xh5q-pch5-g3xq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xh5q-pch5-g3xq", - "modified": "2025-01-28T21:31:01Z", + "modified": "2025-01-29T09:31:42Z", "published": "2025-01-14T18:32:00Z", "aliases": [ "CVE-2024-12085" @@ -43,6 +43,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:0774" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0787" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-12085"