Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-11-04 15:33:52 +00:00
parent a0d8ef97ee
commit 365191a128
56 changed files with 1613 additions and 25 deletions
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-268r-8rwm-mqq9",
-  "modified": "2024-06-27T12:30:43Z",
+  "modified": "2024-11-04T15:31:51Z",
  "published": "2024-02-22T18:30:29Z",
  "aliases": [
    "CVE-2023-52449"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-25m9-3j97-v6cg",
-  "modified": "2024-06-27T15:30:38Z",
+  "modified": "2024-11-04T15:31:53Z",
  "published": "2024-03-26T18:32:06Z",
  "aliases": [
    "CVE-2023-52622"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8jm2-4r4f-748v",
-  "modified": "2024-03-25T06:30:23Z",
+  "modified": "2024-11-04T15:31:53Z",
  "published": "2024-03-25T06:30:23Z",
  "aliases": [
    "CVE-2024-29071"
  ],
  "details": "HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue. A network-adjacent unauthenticated attacker may change the system settings.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-522"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-25T04:15:09Z"
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-284"
+      "CWE-284",
+      "CWE-639"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4vhv-rmg8-wc9v",
-  "modified": "2024-10-30T15:30:44Z",
+  "modified": "2024-11-04T15:31:54Z",
  "published": "2024-10-11T15:30:33Z",
  "aliases": [
    "CVE-2024-6657"
@@ -25,6 +25,10 @@
      "type": "WEB",
      "url": "https://community.silabs.com/068Vm00000FPVg0"
    },
+    {
+      "type": "WEB",
+      "url": "https://community.silabs.com/068Vm00000FfVNN"
+    },
    {
      "type": "WEB",
      "url": "https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm00000E9IIbIAN?operationContext=S1"
@@ -44,7 +44,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-120"
+      "CWE-120",
+      "CWE-787"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -36,6 +36,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-362",
      "CWE-770"
    ],
    "severity": "CRITICAL",
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-287m-m4rw-v572",
+  "modified": "2024-11-04T15:31:58Z",
+  "published": "2024-11-04T15:31:58Z",
+  "aliases": [
+    "CVE-2024-51246"
+  ],
+  "details": "In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPTP function.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51246"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-04T14:15:16Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2h8f-5758-wfx8",
+  "modified": "2024-11-04T15:31:59Z",
+  "published": "2024-11-04T15:31:59Z",
+  "aliases": [
+    "CVE-2024-51681"
+  ],
+  "details": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CodeRevolution WP Pocket URLs allows Stored XSS.This issue affects WP Pocket URLs: from n/a through 1.0.3.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51681"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/vulnerability/wp-pocket-urls/wordpress-wp-pocket-urls-plugin-1-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-04T15:15:23Z"
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-2hx5-4rrf-crcp",
-  "modified": "2024-11-01T21:31:51Z",
+  "modified": "2024-11-04T15:31:56Z",
  "published": "2024-11-01T21:31:51Z",
  "aliases": [
    "CVE-2024-44234"
  ],
  "details": "The issue was addressed with improved bounds checks. This issue is fixed in macOS Sonoma 14.7.1, macOS Ventura 13.7.1, visionOS 2.1, watchOS 11.1, tvOS 18.1, iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1. Parsing a maliciously crafted video file may lead to unexpected system termination.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
+    }
  ],
  "affected": [

@@ -51,7 +54,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-01T21:15:14Z"
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2php-rv2v-c3w8",
+  "modified": "2024-11-04T15:31:59Z",
+  "published": "2024-11-04T15:31:59Z",
+  "aliases": [
+    "CVE-2024-51683"
+  ],
+  "details": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Gangolf Custom post type templates for Elementor allows Stored XSS.This issue affects Custom post type templates for Elementor: from n/a through 1.10.1.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51683"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/vulnerability/custom-post-type-templates-for-elementor/wordpress-custom-post-type-templates-for-elementor-plugin-1-10-1-stored-cross-site-scripting-xss-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-04T15:15:24Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2qxr-7mvv-54x4",
+  "modified": "2024-11-04T15:31:58Z",
+  "published": "2024-11-04T15:31:58Z",
+  "aliases": [
+    "CVE-2024-51251"
+  ],
+  "details": "In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the backup function.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51251"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-04T14:15:16Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2r6v-v2j7-w3xh",
+  "modified": "2024-11-04T15:31:58Z",
+  "published": "2024-11-04T15:31:58Z",
+  "aliases": [
+    "CVE-2024-51672"
+  ],
+  "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPDeveloper BetterLinks allows SQL Injection.This issue affects BetterLinks: from n/a through 2.1.7.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51672"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/vulnerability/betterlinks/wordpress-betterlinks-plugin-2-1-7-sql-injection-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-04T14:15:17Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-32h9-hqhx-9j29",
+  "modified": "2024-11-04T15:31:57Z",
+  "published": "2024-11-04T15:31:57Z",
+  "aliases": [
+    "CVE-2024-51560"
+  ],
+  "details": "This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated remote attacker could exploit this vulnerability by providing invalid inputs for “userId” parameter in the API request leading to generation of error message containing sensitive information on the targeted system.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51560"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-209"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-04T13:17:05Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-45f9-c4pq-qxgq",
+  "modified": "2024-11-04T15:31:58Z",
+  "published": "2024-11-04T15:31:58Z",
+  "aliases": [
+    "CVE-2024-50530"
+  ],
+  "details": "Unrestricted Upload of File with Dangerous Type vulnerability in Myriad Solutionz Stars SMTP Mailer allows Upload a Web Shell to a Web Server.This issue affects Stars SMTP Mailer: from n/a through 1.7.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50530"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/vulnerability/stars-smtp-mailer/wordpress-stars-smtp-mailer-plugin-1-7-arbitrary-file-upload-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-434"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-04T14:15:15Z"
+  }
+}
@@ -48,7 +48,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-121"
+      "CWE-121",
+      "CWE-787"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4j38-c7m4-7f9g",
+  "modified": "2024-11-04T15:31:58Z",
+  "published": "2024-11-04T15:31:58Z",
+  "aliases": [
+    "CVE-2024-45882"
+  ],
+  "details": "DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `delete_map_profile.`",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45882"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/N1nEmAn/wp/blob/main/test_v.zip"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/fu37kola/cve/blob/main/DrayTek/Vigor3900/1.5.1.3/DrayTek_Vigor_3900_1.5.1.3.pdf"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-04T15:15:21Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5g37-4gxg-27m8",
+  "modified": "2024-11-04T15:31:56Z",
+  "published": "2024-11-04T15:31:56Z",
+  "aliases": [
+    "CVE-2024-51557"
+  ],
+  "details": "This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51557"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-799"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-04T13:17:05Z"
+  }
+}
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5ghj-4886-p5v8",
-  "modified": "2024-11-02T09:32:25Z",
+  "modified": "2024-11-04T15:31:56Z",
  "published": "2024-11-02T09:32:25Z",
  "aliases": [
    "CVE-2024-9896"
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-5h53-fxq2-2832",
+  "modified": "2024-11-04T15:31:59Z",
+  "published": "2024-11-04T15:31:59Z",
+  "aliases": [
+    "CVE-2024-51685"
+  ],
+  "details": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Gangolf Accordion title for Elementor allows Stored XSS.This issue affects Accordion title for Elementor: from n/a through 1.2.1.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51685"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/vulnerability/accordion-title-for-elementor/wordpress-accordion-title-for-elementor-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-04T15:15:24Z"
+  }
+}
--- a/Show More
+++ b/Show More