netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-c5c8-vqpp-hm75
GHSA-765q-773v-w2f8
GHSA-h4m2-x7c7-9j2j
GHSA-jv6q-m92f-5fmr
GHSA-2vfh-6ppw-453g
GHSA-6573-9ww9-37v2
GHSA-7vg8-pfw4-vmjp
GHSA-f7wp-vx7r-p4vf
GHSA-gm9c-2h9v-jgp5
GHSA-r768-6rj3-3r5q
GHSA-v66f-7gx8-r3w3
GHSA-w6wr-vw8p-992f
This commit is contained in:
advisory-database[bot]
2024-07-24 03:33:46 +00:00
parent 9b3eff4c71
commit 28ad86300a
12 changed files with 352 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-c5c8-vqpp-hm75/GHSA-c5c8-vqpp-hm75.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c5c8-vqpp-hm75",
"modified": "2022-05-13T01:15:43Z",
"modified": "2024-07-24T03:32:20Z",
"published": "2022-05-13T01:15:43Z",
"aliases": [
"CVE-2012-4792"
advisories/unreviewed/2024/06/GHSA-765q-773v-w2f8/GHSA-765q-773v-w2f8.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-765q-773v-w2f8",
"modified": "2024-06-14T03:31:19Z",
"modified": "2024-07-24T03:32:20Z",
"published": "2024-06-14T03:31:19Z",
"aliases": [
"CVE-2024-5985"
@@ -11,6 +11,10 @@
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
advisories/unreviewed/2024/06/GHSA-h4m2-x7c7-9j2j/GHSA-h4m2-x7c7-9j2j.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h4m2-x7c7-9j2j",
"modified": "2024-06-14T03:31:19Z",
"modified": "2024-07-24T03:32:20Z",
"published": "2024-06-14T03:31:19Z",
"aliases": [
"CVE-2024-5984"
@@ -11,6 +11,10 @@
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
advisories/unreviewed/2024/06/GHSA-jv6q-m92f-5fmr/GHSA-jv6q-m92f-5fmr.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jv6q-m92f-5fmr",
"modified": "2024-06-14T03:31:19Z",
"modified": "2024-07-24T03:32:19Z",
"published": "2024-06-14T03:31:19Z",
"aliases": [
"CVE-2024-5983"
@@ -11,6 +11,10 @@
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
advisories/unreviewed/2024/07/GHSA-2vfh-6ppw-453g/GHSA-2vfh-6ppw-453g.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2vfh-6ppw-453g",
"modified": "2024-07-24T03:32:20Z",
"published": "2024-07-24T03:32:20Z",
"aliases": [
"CVE-2024-6753"
],
"details": "The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mapTypes’ parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6753"
},
{
"type": "WEB",
"url": "https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3c268a6d-dfb4-4a9d-802e-80e5c1c53ca2?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-24T03:15:04Z"
}
}
advisories/unreviewed/2024/07/GHSA-6573-9ww9-37v2/GHSA-6573-9ww9-37v2.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6573-9ww9-37v2",
"modified": "2024-07-24T03:32:20Z",
"published": "2024-07-24T03:32:20Z",
"aliases": [
"CVE-2024-7027"
],
"details": "The WooCommerce - PDF Vouchers plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.9.3. This is due to insufficient verification on the user being supplied during a QR code login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing Voucher Vendor user on the site, if they have access to the user id.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7027"
},
{
"type": "WEB",
"url": "https://codecanyon.net/item/woocommerce-pdf-vouchers-ultimate-gift-cards-wordpress-plugin/7392046"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b6cf27d9-c0be-4cff-8867-19297f6d79d7?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-288"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-24T03:15:05Z"
}
}
advisories/unreviewed/2024/07/GHSA-7vg8-pfw4-vmjp/GHSA-7vg8-pfw4-vmjp.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7vg8-pfw4-vmjp",
"modified": "2024-07-24T03:32:20Z",
"published": "2024-07-24T03:32:20Z",
"aliases": [
"CVE-2024-6756"
],
"details": "The Social Auto Poster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpw_auto_poster_get_image_path' function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible. An attacker can use CVE-2024-6754 to exploit with subscriber-level access.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6756"
},
{
"type": "WEB",
"url": "https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/24e00c0d-08ff-4c68-a1dd-77b513545efd?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-24T03:15:04Z"
}
}
advisories/unreviewed/2024/07/GHSA-f7wp-vx7r-p4vf/GHSA-f7wp-vx7r-p4vf.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f7wp-vx7r-p4vf",
"modified": "2024-07-24T03:32:20Z",
"published": "2024-07-24T03:32:20Z",
"aliases": [
"CVE-2024-6755"
],
"details": "The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the ‘wpw_auto_poster_quick_delete_multiple’ function in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to delete arbitrary posts.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6755"
},
{
"type": "WEB",
"url": "https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d9b1044d-6858-498f-9b89-352650061858?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-24T03:15:04Z"
}
}
advisories/unreviewed/2024/07/GHSA-gm9c-2h9v-jgp5/GHSA-gm9c-2h9v-jgp5.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gm9c-2h9v-jgp5",
"modified": "2024-07-24T03:32:20Z",
"published": "2024-07-24T03:32:20Z",
"aliases": [
"CVE-2024-6754"
],
"details": "The Social Auto Poster plugin for WordPress is vulnerable to unauthorized modification of data to a missing capability check on the ‘wpw_auto_poster_update_tweet_template’ function in all versions up to, and including, 5.3.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary post metadata.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6754"
},
{
"type": "WEB",
"url": "https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72934d2f-fd52-46d1-8cf9-9a20968899f7?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-24T03:15:04Z"
}
}
advisories/unreviewed/2024/07/GHSA-r768-6rj3-3r5q/GHSA-r768-6rj3-3r5q.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r768-6rj3-3r5q",
"modified": "2024-07-24T03:32:20Z",
"published": "2024-07-24T03:32:20Z",
"aliases": [
"CVE-2024-6750"
],
"details": "The Social Auto Poster plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 5.3.14. This makes it possible for unauthenticated attackers to add, modify, or delete post meta and plugin options.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6750"
},
{
"type": "WEB",
"url": "https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/36b58a4f-0761-4775-9010-9c77d4019c44?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-24T03:15:03Z"
}
}
advisories/unreviewed/2024/07/GHSA-v66f-7gx8-r3w3/GHSA-v66f-7gx8-r3w3.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v66f-7gx8-r3w3",
"modified": "2024-07-24T03:32:20Z",
"published": "2024-07-24T03:32:20Z",
"aliases": [
"CVE-2024-6751"
],
"details": "The Social Auto Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.3.14. This is due to missing or incorrect nonce validation on multiple functions. This makes it possible for unauthenticated attackers to add, modify, or delete post meta and plugin options.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6751"
},
{
"type": "WEB",
"url": "https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d7aceccc-7004-42f2-b085-eade9c45141c?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-24T03:15:03Z"
}
}
advisories/unreviewed/2024/07/GHSA-w6wr-vw8p-992f/GHSA-w6wr-vw8p-992f.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w6wr-vw8p-992f",
"modified": "2024-07-24T03:32:20Z",
"published": "2024-07-24T03:32:20Z",
"aliases": [
"CVE-2024-6752"
],
"details": "The Social Auto Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_name’ parameter in the 'wpw_auto_poster_map_wordpress_post_type' AJAX function in all versions up to, and including, 5.3.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6752"
},
{
"type": "WEB",
"url": "https://codecanyon.net/item/social-auto-poster-wordpress-scheduler-marketing-plugin/5754169"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/39b9e8a0-96bb-4b36-b4e8-ec9e3f137835?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-24T03:15:04Z"
}
}