diff --git a/advisories/unreviewed/2022/05/GHSA-9cwq-jp7m-xprp/GHSA-9cwq-jp7m-xprp.json b/advisories/unreviewed/2022/05/GHSA-9cwq-jp7m-xprp/GHSA-9cwq-jp7m-xprp.json index c5d542f3891..63316b592b6 100644 --- a/advisories/unreviewed/2022/05/GHSA-9cwq-jp7m-xprp/GHSA-9cwq-jp7m-xprp.json +++ b/advisories/unreviewed/2022/05/GHSA-9cwq-jp7m-xprp/GHSA-9cwq-jp7m-xprp.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9cwq-jp7m-xprp", - "modified": "2022-05-24T19:16:55Z", + "modified": "2023-11-20T15:30:20Z", "published": "2022-05-24T19:16:55Z", "aliases": [ "CVE-2021-3834" ], "details": "Integria IMS in its 5.0.92 version does not filter correctly some fields related to the login.php file. An attacker could exploit this vulnerability in order to perform a cross-site scripting attack (XSS).", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -25,6 +28,10 @@ { "type": "WEB", "url": "https://www.incibe-cert.es/en/early-warning/security-advisories/integria-ims-vulnerable-cross-site-scripting-xss" + }, + { + "type": "WEB", + "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/integria-ims-vulnerable-cross-site-scripting-xss" } ], "database_specific": { diff --git a/advisories/unreviewed/2023/11/GHSA-5wjq-vf48-v99g/GHSA-5wjq-vf48-v99g.json b/advisories/unreviewed/2023/11/GHSA-5wjq-vf48-v99g/GHSA-5wjq-vf48-v99g.json new file mode 100644 index 00000000000..5399f6c2a8f --- /dev/null +++ b/advisories/unreviewed/2023/11/GHSA-5wjq-vf48-v99g/GHSA-5wjq-vf48-v99g.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5wjq-vf48-v99g", + "modified": "2023-11-20T15:30:21Z", + "published": "2023-11-20T15:30:21Z", + "aliases": [ + "CVE-2023-6196" + ], + "details": "The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the function audio_merchant_add_audio_file function. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6196" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/audio-merchant/trunk/audio-merchant.php#L1298" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/06513dfe-f263-48b7-ba01-2c205247095b?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-11-20T15:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/11/GHSA-6mgm-5jqv-4w32/GHSA-6mgm-5jqv-4w32.json b/advisories/unreviewed/2023/11/GHSA-6mgm-5jqv-4w32/GHSA-6mgm-5jqv-4w32.json index e0b56dcef78..b0cf9e67f1e 100644 --- a/advisories/unreviewed/2023/11/GHSA-6mgm-5jqv-4w32/GHSA-6mgm-5jqv-4w32.json +++ b/advisories/unreviewed/2023/11/GHSA-6mgm-5jqv-4w32/GHSA-6mgm-5jqv-4w32.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-6mgm-5jqv-4w32", - "modified": "2023-11-14T18:30:27Z", + "modified": "2023-11-20T15:30:20Z", "published": "2023-11-14T18:30:27Z", "aliases": [ "CVE-2023-47659" diff --git a/advisories/unreviewed/2023/11/GHSA-c54w-7ph9-843g/GHSA-c54w-7ph9-843g.json b/advisories/unreviewed/2023/11/GHSA-c54w-7ph9-843g/GHSA-c54w-7ph9-843g.json new file mode 100644 index 00000000000..a8d9ea20706 --- /dev/null +++ b/advisories/unreviewed/2023/11/GHSA-c54w-7ph9-843g/GHSA-c54w-7ph9-843g.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c54w-7ph9-843g", + "modified": "2023-11-20T15:30:21Z", + "published": "2023-11-20T15:30:21Z", + "aliases": [ + "CVE-2023-48039" + ], + "details": "GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leak in gf_mpd_parse_string media_tools/mpd.c:75.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48039" + }, + { + "type": "WEB", + "url": "https://github.com/gpac/gpac/issues/2679" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-11-20T15:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/11/GHSA-j8h9-q858-c787/GHSA-j8h9-q858-c787.json b/advisories/unreviewed/2023/11/GHSA-j8h9-q858-c787/GHSA-j8h9-q858-c787.json index 005d6fd79bb..3622368b15b 100644 --- a/advisories/unreviewed/2023/11/GHSA-j8h9-q858-c787/GHSA-j8h9-q858-c787.json +++ b/advisories/unreviewed/2023/11/GHSA-j8h9-q858-c787/GHSA-j8h9-q858-c787.json @@ -29,6 +29,10 @@ "type": "WEB", "url": "https://plugins.trac.wordpress.org/browser/featured-image-caption/trunk/classes/MetaBox.php?rev=2300545#L92" }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2998182%40featured-image-caption%2Ftrunk&old=2486227%40featured-image-caption%2Ftrunk&sfp_email=&sfph_mail=" + }, { "type": "WEB", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0c43a88c-6374-414f-97ae-26ba15d75cdc?source=cve" diff --git a/advisories/unreviewed/2023/11/GHSA-r4qj-chpj-4jhw/GHSA-r4qj-chpj-4jhw.json b/advisories/unreviewed/2023/11/GHSA-r4qj-chpj-4jhw/GHSA-r4qj-chpj-4jhw.json new file mode 100644 index 00000000000..f99c2040c5c --- /dev/null +++ b/advisories/unreviewed/2023/11/GHSA-r4qj-chpj-4jhw/GHSA-r4qj-chpj-4jhw.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r4qj-chpj-4jhw", + "modified": "2023-11-20T15:30:21Z", + "published": "2023-11-20T15:30:21Z", + "aliases": [ + "CVE-2023-6197" + ], + "details": "The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the audio_merchant_save_settings function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6197" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/audio-merchant/trunk/audio-merchant.php#L951" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d7911337-57fa-4268-8366-d37ff13fae86?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-11-20T15:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/11/GHSA-vghr-g64f-9ffh/GHSA-vghr-g64f-9ffh.json b/advisories/unreviewed/2023/11/GHSA-vghr-g64f-9ffh/GHSA-vghr-g64f-9ffh.json new file mode 100644 index 00000000000..c643e846b87 --- /dev/null +++ b/advisories/unreviewed/2023/11/GHSA-vghr-g64f-9ffh/GHSA-vghr-g64f-9ffh.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vghr-g64f-9ffh", + "modified": "2023-11-20T15:30:20Z", + "published": "2023-11-20T15:30:20Z", + "aliases": [ + "CVE-2023-47772" + ], + "details": "Contributor+ Stored Cross-Site Scripting (XSS) vulnerability in Slider Revolution <= 6.6.14.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47772" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/revslider/wordpress-slider-revolution-plugin-6-6-14-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-11-20T15:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/11/GHSA-xrmf-4mwm-vr8j/GHSA-xrmf-4mwm-vr8j.json b/advisories/unreviewed/2023/11/GHSA-xrmf-4mwm-vr8j/GHSA-xrmf-4mwm-vr8j.json new file mode 100644 index 00000000000..4764c88aad5 --- /dev/null +++ b/advisories/unreviewed/2023/11/GHSA-xrmf-4mwm-vr8j/GHSA-xrmf-4mwm-vr8j.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xrmf-4mwm-vr8j", + "modified": "2023-11-20T15:30:21Z", + "published": "2023-11-20T15:30:21Z", + "aliases": [ + "CVE-2023-48090" + ], + "details": "GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extract_attributes media_tools/m3u8.c:329.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48090" + }, + { + "type": "WEB", + "url": "https://github.com/gpac/gpac/issues/2680" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-11-20T15:15:09Z" + } +} \ No newline at end of file