Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2025-01-30 15:32:40 +00:00
parent 9175fc4819
commit 2b42e16a45
66 changed files with 1833 additions and 35 deletions
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-200"
+      "CWE-200",
+      "CWE-276"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3fw4-qprq-cph8",
-  "modified": "2024-03-30T09:30:41Z",
+  "modified": "2025-01-30T15:31:35Z",
  "published": "2024-03-30T09:30:41Z",
  "aliases": [
    "CVE-2024-2140"
@@ -29,7 +29,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3jwv-cj2j-h5c7",
-  "modified": "2024-03-04T03:30:26Z",
+  "modified": "2025-01-30T15:31:35Z",
  "published": "2024-03-04T03:30:26Z",
  "aliases": [
    "CVE-2024-20020"
  ],
  "details": "In OPTEE, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08522504; Issue ID: ALPS08522504.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -20,8 +25,10 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
+    "cwe_ids": [
+      "CWE-787"
+    ],
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-04T03:15:07Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4r36-x7px-386g",
-  "modified": "2024-03-30T09:30:41Z",
+  "modified": "2025-01-30T15:31:36Z",
  "published": "2024-03-30T09:30:41Z",
  "aliases": [
    "CVE-2024-2144"
@@ -33,7 +33,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5h5v-qgm5-g5m6",
-  "modified": "2024-03-30T09:30:41Z",
+  "modified": "2025-01-30T15:31:36Z",
  "published": "2024-03-30T09:30:41Z",
  "aliases": [
    "CVE-2024-2142"
@@ -33,7 +33,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9986-pcpw-cpf6",
-  "modified": "2024-03-30T09:30:41Z",
+  "modified": "2025-01-30T15:31:35Z",
  "published": "2024-03-30T09:30:41Z",
  "aliases": [
    "CVE-2024-2141"
@@ -33,7 +33,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -34,7 +34,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-643"
+      "CWE-643",
+      "CWE-91"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-f9wv-mpx9-2hqq",
-  "modified": "2024-03-30T09:30:41Z",
+  "modified": "2025-01-30T15:31:36Z",
  "published": "2024-03-30T09:30:41Z",
  "aliases": [
    "CVE-2024-2143"
@@ -29,7 +29,9 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [],
+    "cwe_ids": [
+      "CWE-79"
+    ],
    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
@@ -1,13 +1,18 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-w6rw-5fh3-46gp",
-  "modified": "2024-03-04T03:30:26Z",
+  "modified": "2025-01-30T15:31:35Z",
  "published": "2024-03-04T03:30:26Z",
  "aliases": [
    "CVE-2024-20022"
  ],
  "details": "In lk, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08528255; Issue ID: ALPS08528255.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
  "affected": [],
  "references": [
    {
@@ -21,7 +26,7 @@
  ],
  "database_specific": {
    "cwe_ids": [],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-04T03:15:07Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-j448-jqj7-gh7x",
-  "modified": "2024-05-14T18:30:56Z",
+  "modified": "2025-01-30T15:31:36Z",
  "published": "2024-05-14T18:30:56Z",
  "aliases": [
    "CVE-2024-4712"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-hcq4-pvmg-m2gp",
-  "modified": "2024-06-01T18:30:46Z",
+  "modified": "2025-01-30T15:31:36Z",
  "published": "2024-06-01T18:30:46Z",
  "aliases": [
    "CVE-2024-4148"
@@ -19,6 +19,10 @@
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4148"
    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/lunary-ai/lunary/commit/1e8a3d941ba5cfef2c478dd5bac4e4a4b4d67830"
+    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/eca4ad45-2a38-4f3c-9ec1-8205cd51be31"
@@ -34,7 +34,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-121"
+      "CWE-121",
+      "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -34,7 +34,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-121"
+      "CWE-121",
+      "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -34,7 +34,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-121"
+      "CWE-121",
+      "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -1,13 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-q234-cxpj-mgpq",
-  "modified": "2024-12-10T00:31:27Z",
+  "modified": "2025-01-30T15:31:36Z",
  "published": "2024-12-10T00:31:27Z",
  "aliases": [
    "CVE-2024-9672"
  ],
  "details": "A reflected cross-site scripting (XSS) vulnerability exists in PaperCut NG/MF. This issue can be used to execute specially created JavaScript payloads in the browser. A user must click on a malicious link for this issue to occur.",
  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    },
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
@@ -26,6 +30,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-79",
      "CWE-917"
    ],
    "severity": "MODERATE",
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2282-4ccr-wfvx",
+  "modified": "2025-01-30T15:31:39Z",
+  "published": "2025-01-30T15:31:38Z",
+  "aliases": [
+    "CVE-2024-13549"
+  ],
+  "details": "The All Bootstrap Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \"Accordion\" widget in all versions up to, and including, 1.3.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13549"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3228370/all-bootstrap-blocks/trunk/blocks/accordion-item.php"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/786e16be-dee9-43de-afe3-dcc0d17bc92b?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T14:15:34Z"
+  }
+}
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-26mp-7jg9-5q47",
-  "modified": "2025-01-14T06:32:01Z",
+  "modified": "2025-01-30T15:31:36Z",
  "published": "2025-01-14T06:32:00Z",
  "aliases": [
    "CVE-2024-13348"
@@ -26,7 +26,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-284"
+      "CWE-284",
+      "CWE-863"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -0,0 +1,44 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2gf3-m6c4-6gx9",
+  "modified": "2025-01-30T15:31:39Z",
+  "published": "2025-01-30T15:31:39Z",
+  "aliases": [
+    "CVE-2024-13742"
+  ],
+  "details": "The iControlWP – Multiple WordPress Site Manager plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.5 via deserialization of untrusted input from the reqpars parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13742"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/worpit-admin-dashboard-plugin/tags/4.4.5/lib/src/LegacyApi/RequestParameters.php#L42"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/worpit-admin-dashboard-plugin/tags/4.4.5/src/api/RequestParameters.php#L14"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6f25b0cc-60ec-49a0-8356-fd3fba97e987?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-502"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T14:15:36Z"
+  }
+}
@@ -0,0 +1,40 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2h8h-53wp-5m9q",
+  "modified": "2025-01-30T15:31:39Z",
+  "published": "2025-01-30T15:31:39Z",
+  "aliases": [
+    "CVE-2024-13652"
+  ],
+  "details": "The ECPay Ecommerce for WooCommerce plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'clear_ecpay_debug_log' AJAX action in all versions up to, and including, 1.1.2411060. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear the plugin's log files.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13652"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wordpress.org/plugins/ecpay-ecommerce-for-woocommerce"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5ae08e0b-ea17-46c1-aad3-4ecea69c1bdc?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-862"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-01-30T14:15:35Z"
+  }
+}
--- a/Show More
+++ b/Show More