From 28260932c0b894e9644227de1c1dad547201969b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 29 Jan 2025 09:33:45 +0000 Subject: [PATCH] Publish Advisories GHSA-fh7x-2848-jmpf GHSA-qvmx-hr48-4rxp GHSA-xc84-x7qm-x975 GHSA-xh5q-pch5-g3xq --- .../GHSA-fh7x-2848-jmpf.json | 41 ++++++++++++++++ .../GHSA-qvmx-hr48-4rxp.json | 40 ++++++++++++++++ .../GHSA-xc84-x7qm-x975.json | 48 +++++++++++++++++++ .../GHSA-xh5q-pch5-g3xq.json | 6 ++- 4 files changed, 134 insertions(+), 1 deletion(-) create mode 100644 advisories/unreviewed/2025/01/GHSA-fh7x-2848-jmpf/GHSA-fh7x-2848-jmpf.json create mode 100644 advisories/unreviewed/2025/01/GHSA-qvmx-hr48-4rxp/GHSA-qvmx-hr48-4rxp.json create mode 100644 advisories/unreviewed/2025/01/GHSA-xc84-x7qm-x975/GHSA-xc84-x7qm-x975.json diff --git a/advisories/unreviewed/2025/01/GHSA-fh7x-2848-jmpf/GHSA-fh7x-2848-jmpf.json b/advisories/unreviewed/2025/01/GHSA-fh7x-2848-jmpf/GHSA-fh7x-2848-jmpf.json new file mode 100644 index 00000000000..829221c3cf9 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-fh7x-2848-jmpf/GHSA-fh7x-2848-jmpf.json @@ -0,0 +1,41 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fh7x-2848-jmpf", + "modified": "2025-01-29T09:31:42Z", + "published": "2025-01-29T09:31:42Z", + "aliases": [ + "CVE-2024-57965" + ], + "details": "In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute('href',href) call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57965" + }, + { + "type": "WEB", + "url": "https://github.com/axios/axios/issues/6351" + }, + { + "type": "WEB", + "url": "https://github.com/axios/axios/pull/6714" + }, + { + "type": "WEB", + "url": "https://github.com/axios/axios/commit/0a8d6e19da5b9899a2abafaaa06a75ee548597db" + }, + { + "type": "WEB", + "url": "https://github.com/axios/axios/releases/tag/v1.7.8" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T09:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-qvmx-hr48-4rxp/GHSA-qvmx-hr48-4rxp.json b/advisories/unreviewed/2025/01/GHSA-qvmx-hr48-4rxp/GHSA-qvmx-hr48-4rxp.json new file mode 100644 index 00000000000..21131efd38f --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-qvmx-hr48-4rxp/GHSA-qvmx-hr48-4rxp.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qvmx-hr48-4rxp", + "modified": "2025-01-29T09:31:43Z", + "published": "2025-01-29T09:31:42Z", + "aliases": [ + "CVE-2024-7695" + ], + "details": "Multiple switches are affected by an out-of-bounds write vulnerability. This vulnerability is caused by insufficient input validation, which allows data to be written to memory outside the bounds of the buffer. Successful exploitation of this vulnerability could result in a denial-of-service attack. \n\nThis vulnerability poses a significant remote threat if the affected products are exposed to publicly accessible networks. Attackers could potentially disrupt operations by shutting down the affected systems. Due to the critical nature of this security risk, we strongly recommend taking immediate action to prevent its potential exploitation.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7695" + }, + { + "type": "WEB", + "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-240162-cve-2024-7695-out-of-bounds-write-vulnerability-identified-in-multiple-pt-switches" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T08:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-xc84-x7qm-x975/GHSA-xc84-x7qm-x975.json b/advisories/unreviewed/2025/01/GHSA-xc84-x7qm-x975/GHSA-xc84-x7qm-x975.json new file mode 100644 index 00000000000..c467e5e4231 --- /dev/null +++ b/advisories/unreviewed/2025/01/GHSA-xc84-x7qm-x975/GHSA-xc84-x7qm-x975.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xc84-x7qm-x975", + "modified": "2025-01-29T09:31:42Z", + "published": "2025-01-29T09:31:42Z", + "aliases": [ + "CVE-2024-13696" + ], + "details": "The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wishlist_name’ parameter in all versions up to, and including, 1.2.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13696" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/flexible-wishlist/trunk/assets/js/front.js" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3230370" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/flexible-wishlist/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/112456a9-8bb6-4007-87da-6d0fba912498?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-01-29T08:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/01/GHSA-xh5q-pch5-g3xq/GHSA-xh5q-pch5-g3xq.json b/advisories/unreviewed/2025/01/GHSA-xh5q-pch5-g3xq/GHSA-xh5q-pch5-g3xq.json index bd6c015d2ad..e2106083b28 100644 --- a/advisories/unreviewed/2025/01/GHSA-xh5q-pch5-g3xq/GHSA-xh5q-pch5-g3xq.json +++ b/advisories/unreviewed/2025/01/GHSA-xh5q-pch5-g3xq/GHSA-xh5q-pch5-g3xq.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xh5q-pch5-g3xq", - "modified": "2025-01-28T21:31:01Z", + "modified": "2025-01-29T09:31:42Z", "published": "2025-01-14T18:32:00Z", "aliases": [ "CVE-2024-12085" @@ -43,6 +43,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2025:0774" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2025:0787" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-12085"