Publish Advisories

GHSA-frvc-6356-58xm
GHSA-4pr9-2v9c-fmpv
GHSA-87vx-9472-jjmp
GHSA-j273-w4fm-gq4h

advisories/unreviewed/2024/03/GHSA-frvc-6356-58xm/GHSA-frvc-6356-58xm.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-frvc-6356-58xm",
-  "modified": "2024-04-12T00:30:26Z",
+  "modified": "2024-04-16T12:30:31Z",
   "published": "2024-03-21T15:31:51Z",
   "aliases": [
     "CVE-2024-28834"
@@ -37,6 +37,10 @@
       "type": "WEB",
       "url": "https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html"
     },
+    {
+      "type": "WEB",
+      "url": "https://minerva.crocs.fi.muni.cz"
+    },
     {
       "type": "WEB",
       "url": "https://people.redhat.com/~hkario/marvin"

advisories/unreviewed/2024/04/GHSA-4pr9-2v9c-fmpv/GHSA-4pr9-2v9c-fmpv.json

@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4pr9-2v9c-fmpv",
+  "modified": "2024-04-16T12:30:31Z",
+  "published": "2024-04-16T12:30:31Z",
+  "aliases": [
+    "CVE-2024-1357"
+  ],
+  "details": "The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_timeline shortcode in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping on user supplied attributes such as thumb_mode and date_type. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1357"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/auxin-elements/trunk/includes/general-shortcodes.php#L310"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fe175315-99ef-438a-b5b0-a5f190403116?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-16T10:15:07Z"
+  }
+}

advisories/unreviewed/2024/04/GHSA-87vx-9472-jjmp/GHSA-87vx-9472-jjmp.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-87vx-9472-jjmp",
+  "modified": "2024-04-16T12:30:31Z",
+  "published": "2024-04-16T12:30:31Z",
+  "aliases": [
+    "CVE-2024-3367"
+  ],
+  "details": "Argument injection in websphere_mq agent plugin in Checkmk 2.0.0, 2.1.0, <2.2.0p25 and <2.3.0b5 allows local attacker to inject one argument to runmqsc",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3367"
+    },
+    {
+      "type": "WEB",
+      "url": "https://checkmk.com/werk/16615"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-349"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-16T12:15:10Z"
+  }
+}

advisories/unreviewed/2024/04/GHSA-j273-w4fm-gq4h/GHSA-j273-w4fm-gq4h.json

@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-j273-w4fm-gq4h",
+  "modified": "2024-04-16T12:30:31Z",
+  "published": "2024-04-16T12:30:31Z",
+  "aliases": [
+    "CVE-2024-3867"
+  ],
+  "details": "The archive-tainacan-collection theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in version 2.7.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3867"
+    },
+    {
+      "type": "WEB",
+      "url": "https://themes.trac.wordpress.org/changeset/224400/tainacan-interface/2.7.2/archive-tainacan-collection.php"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3ffd63ca-5ea4-451c-aa97-092a754ca79f?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-04-16T10:15:08Z"
+  }
+}