From 32b1ea1d051a7af83004ee2a525885a24bc673b9 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 16 Apr 2024 12:31:59 +0000 Subject: [PATCH] Publish Advisories GHSA-frvc-6356-58xm GHSA-4pr9-2v9c-fmpv GHSA-87vx-9472-jjmp GHSA-j273-w4fm-gq4h --- .../GHSA-frvc-6356-58xm.json | 6 ++- .../GHSA-4pr9-2v9c-fmpv.json | 42 +++++++++++++++++++ .../GHSA-87vx-9472-jjmp.json | 38 +++++++++++++++++ .../GHSA-j273-w4fm-gq4h.json | 42 +++++++++++++++++++ 4 files changed, 127 insertions(+), 1 deletion(-) create mode 100644 advisories/unreviewed/2024/04/GHSA-4pr9-2v9c-fmpv/GHSA-4pr9-2v9c-fmpv.json create mode 100644 advisories/unreviewed/2024/04/GHSA-87vx-9472-jjmp/GHSA-87vx-9472-jjmp.json create mode 100644 advisories/unreviewed/2024/04/GHSA-j273-w4fm-gq4h/GHSA-j273-w4fm-gq4h.json diff --git a/advisories/unreviewed/2024/03/GHSA-frvc-6356-58xm/GHSA-frvc-6356-58xm.json b/advisories/unreviewed/2024/03/GHSA-frvc-6356-58xm/GHSA-frvc-6356-58xm.json index 02af9bd7578..47d0ed0983d 100644 --- a/advisories/unreviewed/2024/03/GHSA-frvc-6356-58xm/GHSA-frvc-6356-58xm.json +++ b/advisories/unreviewed/2024/03/GHSA-frvc-6356-58xm/GHSA-frvc-6356-58xm.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-frvc-6356-58xm", - "modified": "2024-04-12T00:30:26Z", + "modified": "2024-04-16T12:30:31Z", "published": "2024-03-21T15:31:51Z", "aliases": [ "CVE-2024-28834" @@ -37,6 +37,10 @@ "type": "WEB", "url": "https://lists.gnupg.org/pipermail/gnutls-help/2024-March/004845.html" }, + { + "type": "WEB", + "url": "https://minerva.crocs.fi.muni.cz" + }, { "type": "WEB", "url": "https://people.redhat.com/~hkario/marvin" diff --git a/advisories/unreviewed/2024/04/GHSA-4pr9-2v9c-fmpv/GHSA-4pr9-2v9c-fmpv.json b/advisories/unreviewed/2024/04/GHSA-4pr9-2v9c-fmpv/GHSA-4pr9-2v9c-fmpv.json new file mode 100644 index 00000000000..1195733ef89 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-4pr9-2v9c-fmpv/GHSA-4pr9-2v9c-fmpv.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4pr9-2v9c-fmpv", + "modified": "2024-04-16T12:30:31Z", + "published": "2024-04-16T12:30:31Z", + "aliases": [ + "CVE-2024-1357" + ], + "details": "The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's aux_timeline shortcode in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping on user supplied attributes such as thumb_mode and date_type. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1357" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/auxin-elements/trunk/includes/general-shortcodes.php#L310" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fe175315-99ef-438a-b5b0-a5f190403116?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-16T10:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-87vx-9472-jjmp/GHSA-87vx-9472-jjmp.json b/advisories/unreviewed/2024/04/GHSA-87vx-9472-jjmp/GHSA-87vx-9472-jjmp.json new file mode 100644 index 00000000000..cfde29bc16a --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-87vx-9472-jjmp/GHSA-87vx-9472-jjmp.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-87vx-9472-jjmp", + "modified": "2024-04-16T12:30:31Z", + "published": "2024-04-16T12:30:31Z", + "aliases": [ + "CVE-2024-3367" + ], + "details": "Argument injection in websphere_mq agent plugin in Checkmk 2.0.0, 2.1.0, <2.2.0p25 and <2.3.0b5 allows local attacker to inject one argument to runmqsc", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3367" + }, + { + "type": "WEB", + "url": "https://checkmk.com/werk/16615" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-349" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-16T12:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-j273-w4fm-gq4h/GHSA-j273-w4fm-gq4h.json b/advisories/unreviewed/2024/04/GHSA-j273-w4fm-gq4h/GHSA-j273-w4fm-gq4h.json new file mode 100644 index 00000000000..b70155dfe4f --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-j273-w4fm-gq4h/GHSA-j273-w4fm-gq4h.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j273-w4fm-gq4h", + "modified": "2024-04-16T12:30:31Z", + "published": "2024-04-16T12:30:31Z", + "aliases": [ + "CVE-2024-3867" + ], + "details": "The archive-tainacan-collection theme for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in version 2.7.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3867" + }, + { + "type": "WEB", + "url": "https://themes.trac.wordpress.org/changeset/224400/tainacan-interface/2.7.2/archive-tainacan-collection.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3ffd63ca-5ea4-451c-aa97-092a754ca79f?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-16T10:15:08Z" + } +} \ No newline at end of file