From 3831ef2a49688c3dda47f8c59761b351bde7749b Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 16 Jul 2024 09:32:22 +0000 Subject: [PATCH] Publish Advisories GHSA-2r6x-62fv-h4q4 GHSA-4fch-r62j-4r94 GHSA-88c6-6wm4-m6c3 GHSA-8j2w-hc9h-wm6f GHSA-gg88-333c-97wf GHSA-h97v-622h-3hvc GHSA-jx5v-m5q5-f9w9 GHSA-mjq3-v6c5-g93p GHSA-mm3h-cmqv-736j GHSA-pr5p-f64r-45r9 GHSA-x67r-7mr9-vwm2 --- .../GHSA-2r6x-62fv-h4q4.json | 42 ++++++++++++++++ .../GHSA-4fch-r62j-4r94.json | 38 ++++++++++++++ .../GHSA-88c6-6wm4-m6c3.json | 50 +++++++++++++++++++ .../GHSA-8j2w-hc9h-wm6f.json | 42 ++++++++++++++++ .../GHSA-gg88-333c-97wf.json | 42 ++++++++++++++++ .../GHSA-h97v-622h-3hvc.json | 46 +++++++++++++++++ .../GHSA-jx5v-m5q5-f9w9.json | 35 +++++++++++++ .../GHSA-mjq3-v6c5-g93p.json | 50 +++++++++++++++++++ .../GHSA-mm3h-cmqv-736j.json | 46 +++++++++++++++++ .../GHSA-pr5p-f64r-45r9.json | 42 ++++++++++++++++ .../GHSA-x67r-7mr9-vwm2.json | 35 +++++++++++++ 11 files changed, 468 insertions(+) create mode 100644 advisories/unreviewed/2024/07/GHSA-2r6x-62fv-h4q4/GHSA-2r6x-62fv-h4q4.json create mode 100644 advisories/unreviewed/2024/07/GHSA-4fch-r62j-4r94/GHSA-4fch-r62j-4r94.json create mode 100644 advisories/unreviewed/2024/07/GHSA-88c6-6wm4-m6c3/GHSA-88c6-6wm4-m6c3.json create mode 100644 advisories/unreviewed/2024/07/GHSA-8j2w-hc9h-wm6f/GHSA-8j2w-hc9h-wm6f.json create mode 100644 advisories/unreviewed/2024/07/GHSA-gg88-333c-97wf/GHSA-gg88-333c-97wf.json create mode 100644 advisories/unreviewed/2024/07/GHSA-h97v-622h-3hvc/GHSA-h97v-622h-3hvc.json create mode 100644 advisories/unreviewed/2024/07/GHSA-jx5v-m5q5-f9w9/GHSA-jx5v-m5q5-f9w9.json create mode 100644 advisories/unreviewed/2024/07/GHSA-mjq3-v6c5-g93p/GHSA-mjq3-v6c5-g93p.json create mode 100644 advisories/unreviewed/2024/07/GHSA-mm3h-cmqv-736j/GHSA-mm3h-cmqv-736j.json create mode 100644 advisories/unreviewed/2024/07/GHSA-pr5p-f64r-45r9/GHSA-pr5p-f64r-45r9.json create mode 100644 advisories/unreviewed/2024/07/GHSA-x67r-7mr9-vwm2/GHSA-x67r-7mr9-vwm2.json diff --git a/advisories/unreviewed/2024/07/GHSA-2r6x-62fv-h4q4/GHSA-2r6x-62fv-h4q4.json b/advisories/unreviewed/2024/07/GHSA-2r6x-62fv-h4q4/GHSA-2r6x-62fv-h4q4.json new file mode 100644 index 00000000000..f136ff3dd77 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-2r6x-62fv-h4q4/GHSA-2r6x-62fv-h4q4.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2r6x-62fv-h4q4", + "modified": "2024-07-16T09:30:39Z", + "published": "2024-07-16T09:30:39Z", + "aliases": [ + "CVE-2024-1937" + ], + "details": "The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_item' function in all versions up to, and including, 2.4.44. This makes it possible for authenticated attackers, with contributor access and above, to modify the content of arbitrary published posts, which includes the ability to insert malicious JavaScript.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1937" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3112878/brizy/trunk/editor/api.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb5f73c3-f40b-45d5-9947-c1a514d230f7?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-16T09:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-4fch-r62j-4r94/GHSA-4fch-r62j-4r94.json b/advisories/unreviewed/2024/07/GHSA-4fch-r62j-4r94/GHSA-4fch-r62j-4r94.json new file mode 100644 index 00000000000..bd05399ba75 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-4fch-r62j-4r94/GHSA-4fch-r62j-4r94.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4fch-r62j-4r94", + "modified": "2024-07-16T09:30:39Z", + "published": "2024-07-16T09:30:39Z", + "aliases": [ + "CVE-2024-3779" + ], + "details": "Denial of service vulnerability present shortly after product installation or upgrade, potentially allowed an attacker to render ESET’s security product inoperable, provided non-default preconditions were met.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3779" + }, + { + "type": "WEB", + "url": "https://support.eset.com/en/ca8688" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-276" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-16T09:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-88c6-6wm4-m6c3/GHSA-88c6-6wm4-m6c3.json b/advisories/unreviewed/2024/07/GHSA-88c6-6wm4-m6c3/GHSA-88c6-6wm4-m6c3.json new file mode 100644 index 00000000000..778f8ec1587 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-88c6-6wm4-m6c3/GHSA-88c6-6wm4-m6c3.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-88c6-6wm4-m6c3", + "modified": "2024-07-16T09:30:39Z", + "published": "2024-07-16T09:30:39Z", + "aliases": [ + "CVE-2024-6570" + ], + "details": "The Glossary plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.26. This is due the plugin utilizing wpdesk and not preventing direct access to the test files along with display_errors being enabled. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6570" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3116269%40glossary-by-codeat&new=3116269%40glossary-by-codeat&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3116892%40glossary-by-codeat&new=3116892%40glossary-by-codeat&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3118151%40glossary-by-codeat&new=3118151%40glossary-by-codeat&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/593b2ea2-0627-45ce-b672-cc815bff338b?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-16T09:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-8j2w-hc9h-wm6f/GHSA-8j2w-hc9h-wm6f.json b/advisories/unreviewed/2024/07/GHSA-8j2w-hc9h-wm6f/GHSA-8j2w-hc9h-wm6f.json new file mode 100644 index 00000000000..31545163ea7 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-8j2w-hc9h-wm6f/GHSA-8j2w-hc9h-wm6f.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8j2w-hc9h-wm6f", + "modified": "2024-07-16T09:30:39Z", + "published": "2024-07-16T09:30:39Z", + "aliases": [ + "CVE-2024-5852" + ], + "details": "The WordPress File Upload plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.24.7 via the 'uploadpath' parameter of the wordpress_file_upload shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload limited files to arbitrary locations on the web server.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5852" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3118456%40wp-file-upload&new=3118456%40wp-file-upload&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/39bb69e0-fb18-4737-9eb7-bda2b5bc16a2?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-16T09:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-gg88-333c-97wf/GHSA-gg88-333c-97wf.json b/advisories/unreviewed/2024/07/GHSA-gg88-333c-97wf/GHSA-gg88-333c-97wf.json new file mode 100644 index 00000000000..f54631738a1 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-gg88-333c-97wf/GHSA-gg88-333c-97wf.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gg88-333c-97wf", + "modified": "2024-07-16T09:30:38Z", + "published": "2024-07-16T09:30:38Z", + "aliases": [ + "CVE-2024-6559" + ], + "details": "The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.7.3. This is due the plugin utilizing sabre without preventing direct access to the files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6559" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3118643/xcloner-backup-and-restore/trunk/vendor/sabre/vobject/bin/fetch_windows_zones.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0500c57a-3983-46e4-92fa-85f7fd47eba8?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-16T07:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-h97v-622h-3hvc/GHSA-h97v-622h-3hvc.json b/advisories/unreviewed/2024/07/GHSA-h97v-622h-3hvc/GHSA-h97v-622h-3hvc.json new file mode 100644 index 00000000000..6de5e5ca81d --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-h97v-622h-3hvc/GHSA-h97v-622h-3hvc.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h97v-622h-3hvc", + "modified": "2024-07-16T09:30:39Z", + "published": "2024-07-16T09:30:39Z", + "aliases": [ + "CVE-2024-6565" + ], + "details": "The AForms — Form Builder for Price Calculator & Cost Estimation plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.2.6. This is due to the plugin utilizing the aura library and allowing direct access to the phpunit test files. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The information displayed is not useful on its own, and requires another vulnerability to be present for damage to an affected website.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6565" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/aforms-form-builder-for-price-calculator-cost-estimation/trunk/vendor/aura/payload-interface/phpunit.php" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3118052%40aforms-form-builder-for-price-calculator-cost-estimation&new=3118052%40aforms-form-builder-for-price-calculator-cost-estimation&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/702261eb-4f85-4388-9f82-75476640e8ed?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-16T09:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-jx5v-m5q5-f9w9/GHSA-jx5v-m5q5-f9w9.json b/advisories/unreviewed/2024/07/GHSA-jx5v-m5q5-f9w9/GHSA-jx5v-m5q5-f9w9.json new file mode 100644 index 00000000000..2149bab19b7 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-jx5v-m5q5-f9w9/GHSA-jx5v-m5q5-f9w9.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jx5v-m5q5-f9w9", + "modified": "2024-07-16T09:30:38Z", + "published": "2024-07-16T09:30:38Z", + "aliases": [ + "CVE-2023-52290" + ], + "details": "In streampark-console the list pages(e.g: application pages), users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection vulnerability. The attacker must successfully log into the system to launch an attack, which may cause data leakage. Since no data will be written, so this is a low-impact vulnerability.\n\nMitigation:\n\nall users should upgrade to 2.1.4, Such parameters will be blocked.\n\n", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52290" + }, + { + "type": "WEB", + "url": "https://lists.apache.org/thread/t3mcm8pb65d9gj3wrgtj9sx9s2pfvvl3" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-16T08:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-mjq3-v6c5-g93p/GHSA-mjq3-v6c5-g93p.json b/advisories/unreviewed/2024/07/GHSA-mjq3-v6c5-g93p/GHSA-mjq3-v6c5-g93p.json new file mode 100644 index 00000000000..ce0d3affbc2 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-mjq3-v6c5-g93p/GHSA-mjq3-v6c5-g93p.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mjq3-v6c5-g93p", + "modified": "2024-07-16T09:30:38Z", + "published": "2024-07-16T09:30:38Z", + "aliases": [ + "CVE-2024-4780" + ], + "details": "The Image Hover Effects – Elementor Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘eihe_link’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4780" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/image-hover-effects-addon-for-elementor/tags/1.4.3/includes/widgets.php#L529" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3117113" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/image-hover-effects-addon-for-elementor/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/637972a3-1936-4add-88a2-3fbafba4b5c8?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-16T07:15:01Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-mm3h-cmqv-736j/GHSA-mm3h-cmqv-736j.json b/advisories/unreviewed/2024/07/GHSA-mm3h-cmqv-736j/GHSA-mm3h-cmqv-736j.json new file mode 100644 index 00000000000..6ab340d6f9b --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-mm3h-cmqv-736j/GHSA-mm3h-cmqv-736j.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mm3h-cmqv-736j", + "modified": "2024-07-16T09:30:39Z", + "published": "2024-07-16T09:30:39Z", + "aliases": [ + "CVE-2024-3587" + ], + "details": "The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Grid Portfolios Widget in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3587" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/auxin-portfolio/tags/2.3.2/public/templates/elements/recent-portfolio.php#L179" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3115537/auxin-portfolio/trunk/public/templates/elements/recent-portfolio.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b0ea041b-f09d-4c62-aada-26afbc60b6f2?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-16T09:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-pr5p-f64r-45r9/GHSA-pr5p-f64r-45r9.json b/advisories/unreviewed/2024/07/GHSA-pr5p-f64r-45r9/GHSA-pr5p-f64r-45r9.json new file mode 100644 index 00000000000..9e9f788cc80 --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-pr5p-f64r-45r9/GHSA-pr5p-f64r-45r9.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pr5p-f64r-45r9", + "modified": "2024-07-16T09:30:39Z", + "published": "2024-07-16T09:30:39Z", + "aliases": [ + "CVE-2024-2691" + ], + "details": "The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events' shortcode in all versions up to, and including, 3.1.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2691" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3116941/wp-event-manager/trunk/shortcodes/wp-event-manager-shortcodes.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/01a6dcf2-6f0b-494b-a18c-04bd9c44e0ce?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-16T09:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/07/GHSA-x67r-7mr9-vwm2/GHSA-x67r-7mr9-vwm2.json b/advisories/unreviewed/2024/07/GHSA-x67r-7mr9-vwm2/GHSA-x67r-7mr9-vwm2.json new file mode 100644 index 00000000000..ef9224c444a --- /dev/null +++ b/advisories/unreviewed/2024/07/GHSA-x67r-7mr9-vwm2/GHSA-x67r-7mr9-vwm2.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x67r-7mr9-vwm2", + "modified": "2024-07-16T09:30:38Z", + "published": "2024-07-16T09:30:38Z", + "aliases": [ + "CVE-2024-41008" + ], + "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: change vm->task_info handling\n\nThis patch changes the handling and lifecycle of vm->task_info object.\nThe major changes are:\n- vm->task_info is a dynamically allocated ptr now, and its uasge is\n reference counted.\n- introducing two new helper funcs for task_info lifecycle management\n - amdgpu_vm_get_task_info: reference counts up task_info before\n returning this info\n - amdgpu_vm_put_task_info: reference counts down task_info\n- last put to task_info() frees task_info from the vm.\n\nThis patch also does logistical changes required for existing usage\nof vm->task_info.\n\nV2: Do not block all the prints when task_info not found (Felix)\n\nV3: Fixed review comments from Felix\n - Fix wrong indentation\n - No debug message for -ENOMEM\n - Add NULL check for task_info\n - Do not duplicate the debug messages (ti vs no ti)\n - Get first reference of task_info in vm_init(), put last\n in vm_fini()\n\nV4: Fixed review comments from Felix\n - fix double reference increment in create_task_info\n - change amdgpu_vm_get_task_info_pasid\n - additional changes in amdgpu_gem.c while porting", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41008" + }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/b8f67b9ddf4f8fe6dd536590712b5912ad78f99c" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-07-16T08:15:02Z" + } +} \ No newline at end of file