From 4347e09140767662f639b3b130a835ef902125bd Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 5 Aug 2024 21:20:27 +0000 Subject: [PATCH] Publish Advisories GHSA-mr24-cf69-5chq GHSA-2w4p-2hf7-gh8x GHSA-5fwq-9x7j-2qpg GHSA-6mvj-2569-3mcm GHSA-hf66-xfgj-42g8 GHSA-p78h-m8pv-g9gm GHSA-whr2-9x5f-5c79 GHSA-hf66-xfgj-42g8 --- .../GHSA-mr24-cf69-5chq.json | 39 ++++++--- .../GHSA-2w4p-2hf7-gh8x.json | 85 +++++++++++++++++++ .../GHSA-5fwq-9x7j-2qpg.json | 85 +++++++++++++++++++ .../GHSA-6mvj-2569-3mcm.json | 78 +++++++++++++++++ .../GHSA-hf66-xfgj-42g8.json | 65 ++++++++++++++ .../GHSA-p78h-m8pv-g9gm.json | 82 ++++++++++++++++++ .../GHSA-whr2-9x5f-5c79.json | 78 +++++++++++++++++ .../GHSA-hf66-xfgj-42g8.json | 35 -------- 8 files changed, 502 insertions(+), 45 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/03/GHSA-mr24-cf69-5chq/GHSA-mr24-cf69-5chq.json (57%) create mode 100644 advisories/github-reviewed/2024/08/GHSA-2w4p-2hf7-gh8x/GHSA-2w4p-2hf7-gh8x.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-5fwq-9x7j-2qpg/GHSA-5fwq-9x7j-2qpg.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-6mvj-2569-3mcm/GHSA-6mvj-2569-3mcm.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-hf66-xfgj-42g8/GHSA-hf66-xfgj-42g8.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-p78h-m8pv-g9gm/GHSA-p78h-m8pv-g9gm.json create mode 100644 advisories/github-reviewed/2024/08/GHSA-whr2-9x5f-5c79/GHSA-whr2-9x5f-5c79.json delete mode 100644 advisories/unreviewed/2024/08/GHSA-hf66-xfgj-42g8/GHSA-hf66-xfgj-42g8.json diff --git a/advisories/unreviewed/2024/03/GHSA-mr24-cf69-5chq/GHSA-mr24-cf69-5chq.json b/advisories/github-reviewed/2024/03/GHSA-mr24-cf69-5chq/GHSA-mr24-cf69-5chq.json similarity index 57% rename from advisories/unreviewed/2024/03/GHSA-mr24-cf69-5chq/GHSA-mr24-cf69-5chq.json rename to advisories/github-reviewed/2024/03/GHSA-mr24-cf69-5chq/GHSA-mr24-cf69-5chq.json index 218e2c5c1db..e66f99ca6de 100644 --- a/advisories/unreviewed/2024/03/GHSA-mr24-cf69-5chq/GHSA-mr24-cf69-5chq.json +++ b/advisories/github-reviewed/2024/03/GHSA-mr24-cf69-5chq/GHSA-mr24-cf69-5chq.json @@ -1,20 +1,43 @@ { "schema_version": "1.4.0", "id": "GHSA-mr24-cf69-5chq", - "modified": "2024-08-05T18:31:42Z", + "modified": "2024-08-05T21:19:13Z", "published": "2024-03-26T12:31:28Z", "aliases": [ "CVE-2024-29644" ], + "summary": "dcat-admin Cross Site Scripting vulnerability", "details": "Cross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script to the user login box.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" } ], "affected": [ - + { + "package": { + "ecosystem": "Packagist", + "name": "dcat/laravel-admin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.1.3" + } + ] + } + ] + } ], "references": [ { @@ -22,25 +45,21 @@ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29644" }, { - "type": "WEB", + "type": "PACKAGE", "url": "https://github.com/jqhph/dcat-admin" }, { "type": "WEB", "url": "https://www.yuque.com/yangtu-swjrh/oc6nqi/epcbz5y1grl4il1m" - }, - { - "type": "WEB", - "url": "http://dcat-admin.com" } ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T21:19:13Z", "nvd_published_at": "2024-03-26T12:15:50Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-2w4p-2hf7-gh8x/GHSA-2w4p-2hf7-gh8x.json b/advisories/github-reviewed/2024/08/GHSA-2w4p-2hf7-gh8x/GHSA-2w4p-2hf7-gh8x.json new file mode 100644 index 00000000000..30af5ecf9a4 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-2w4p-2hf7-gh8x/GHSA-2w4p-2hf7-gh8x.json @@ -0,0 +1,85 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2w4p-2hf7-gh8x", + "modified": "2024-08-05T21:18:58Z", + "published": "2024-08-05T21:18:58Z", + "aliases": [ + "CVE-2022-23553" + ], + "summary": "Alpine allows URL access filter bypass", + "details": "Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows URL access filter bypass. This issue has been fixed in version 1.10.4. There are no known workarounds.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "us.springett:alpine" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.10.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23553" + }, + { + "type": "WEB", + "url": "https://github.com/stevespringett/Alpine/commit/a7432184b9137ea095799a77f9ced370553acbd7" + }, + { + "type": "PACKAGE", + "url": "https://github.com/stevespringett/Alpine" + }, + { + "type": "WEB", + "url": "https://github.com/stevespringett/Alpine/blob/alpine-parent-1.10.2/alpine/src/main/java/alpine/filters/BlacklistUrlFilter.java#L107-L121" + }, + { + "type": "WEB", + "url": "https://github.com/stevespringett/Alpine/blob/alpine-parent-1.10.2/alpine/src/main/java/alpine/filters/WhitelistUrlFilter.java#L115-L127" + }, + { + "type": "WEB", + "url": "https://github.com/stevespringett/Alpine/releases/tag/alpine-parent-1.10.4" + }, + { + "type": "WEB", + "url": "https://securitylab.github.com/advisories" + }, + { + "type": "ADVISORY", + "url": "https://securitylab.github.com/advisories/GHSL-2021-1009-Alpine" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T21:18:58Z", + "nvd_published_at": "2022-12-28T19:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-5fwq-9x7j-2qpg/GHSA-5fwq-9x7j-2qpg.json b/advisories/github-reviewed/2024/08/GHSA-5fwq-9x7j-2qpg/GHSA-5fwq-9x7j-2qpg.json new file mode 100644 index 00000000000..9b3482ff8bd --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-5fwq-9x7j-2qpg/GHSA-5fwq-9x7j-2qpg.json @@ -0,0 +1,85 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5fwq-9x7j-2qpg", + "modified": "2024-08-05T21:18:59Z", + "published": "2024-08-05T21:18:58Z", + "aliases": [ + "CVE-2023-26494" + ], + "summary": "lorawan-stack Open Redirect vulnerability", + "details": "lorawan-stack is an open source LoRaWAN network server. Prior to version 3.24.1, an open redirect exists on the login page of the lorawan stack server, allowing an attacker to supply a user controlled redirect upon sign in. This issue may allows malicious actors to phish users, as users assume they were redirected to the homepage on login. Version 3.24.1 contains a fix.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "go.thethings.network/lorawan-stack/v3" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.24.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26494" + }, + { + "type": "WEB", + "url": "https://github.com/TheThingsNetwork/lorawan-stack/commit/f06776028bdb3994847fc6067613dc61a2b3559e" + }, + { + "type": "PACKAGE", + "url": "https://github.com/TheThingsNetwork/lorawan-stack" + }, + { + "type": "WEB", + "url": "https://github.com/TheThingsNetwork/lorawan-stack/blob/ecdef730f176c02f7c9afce98b0457ae64de5bfc/pkg/webui/account/views/login/index.js#L90-L90" + }, + { + "type": "WEB", + "url": "https://github.com/TheThingsNetwork/lorawan-stack/blob/ecdef730f176c02f7c9afce98b0457ae64de5bfc/pkg/webui/account/views/token-login/index.js#L74-L74" + }, + { + "type": "WEB", + "url": "https://github.com/TheThingsNetwork/lorawan-stack/releases/tag/v3.24.1" + }, + { + "type": "WEB", + "url": "https://securitylab.github.com/advisories" + }, + { + "type": "ADVISORY", + "url": "https://securitylab.github.com/advisories/GHSL-2022-138_lorawan-stack" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-601" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T21:18:58Z", + "nvd_published_at": "2023-04-24T17:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-6mvj-2569-3mcm/GHSA-6mvj-2569-3mcm.json b/advisories/github-reviewed/2024/08/GHSA-6mvj-2569-3mcm/GHSA-6mvj-2569-3mcm.json new file mode 100644 index 00000000000..c9cf4b438c3 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-6mvj-2569-3mcm/GHSA-6mvj-2569-3mcm.json @@ -0,0 +1,78 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6mvj-2569-3mcm", + "modified": "2024-08-05T21:18:57Z", + "published": "2024-08-05T21:18:57Z", + "aliases": [ + "CVE-2022-23474" + ], + "summary": "Editor.js vulnerable to Code Injection", + "details": "Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper’s innerHTML. This issue is patched in version 2.26.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "npm", + "name": "@editorjs/editorjs" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.26.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23474" + }, + { + "type": "WEB", + "url": "https://github.com/codex-team/editor.js/pull/2100" + }, + { + "type": "WEB", + "url": "https://github.com/codex-team/editor.js/commit/f659015be6de8e6f0c322c5ff4d1a4532d2f29a2" + }, + { + "type": "PACKAGE", + "url": "https://github.com/codex-team/editor.js" + }, + { + "type": "WEB", + "url": "https://securitylab.github.com/advisories" + }, + { + "type": "ADVISORY", + "url": "https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79", + "CWE-94" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T21:18:57Z", + "nvd_published_at": "2022-12-15T19:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-hf66-xfgj-42g8/GHSA-hf66-xfgj-42g8.json b/advisories/github-reviewed/2024/08/GHSA-hf66-xfgj-42g8/GHSA-hf66-xfgj-42g8.json new file mode 100644 index 00000000000..9ee1e47741a --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-hf66-xfgj-42g8/GHSA-hf66-xfgj-42g8.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hf66-xfgj-42g8", + "modified": "2024-08-05T21:19:50Z", + "published": "2024-08-05T18:31:43Z", + "aliases": [ + "CVE-2024-41380" + ], + "summary": "Microweber Cross Site Scripting (XSS) vulnerability", + "details": "Microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\\modules\\tags\\add_tagging_tagged.php.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "microweber/microweber" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.0.16" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41380" + }, + { + "type": "WEB", + "url": "https://github.com/microweber/microweber/issues/1111" + }, + { + "type": "PACKAGE", + "url": "https://github.com/microweber/microweber" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T21:19:50Z", + "nvd_published_at": "2024-08-05T17:15:41Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-p78h-m8pv-g9gm/GHSA-p78h-m8pv-g9gm.json b/advisories/github-reviewed/2024/08/GHSA-p78h-m8pv-g9gm/GHSA-p78h-m8pv-g9gm.json new file mode 100644 index 00000000000..000c6dee7f6 --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-p78h-m8pv-g9gm/GHSA-p78h-m8pv-g9gm.json @@ -0,0 +1,82 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p78h-m8pv-g9gm", + "modified": "2024-08-05T21:18:59Z", + "published": "2024-08-05T21:18:59Z", + "aliases": [ + "CVE-2023-28857" + ], + "summary": "Apereo CAS vulnerable to credential leaks for LDAP authentication", + "details": "Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authentication based on client X509 certificates. These certificates can be provided via TLS handshake or a special HTTP header, such as “ssl_client_cert”. When checking the validity of the provided client certificate, X509CredentialsAuthenticationHandler performs check that this certificate is not revoked. To do so, it fetches URLs provided in the “CRL Distribution Points” extension of the certificate, which are taken from the certificate itself and therefore can be controlled by a malicious user. If the CAS server is configured to use an LDAP server for x509 authentication with a password, for example by setting a “cas.authn.x509.ldap.ldap-url” and “cas.authn.x509.ldap.bind-credential” properties, X509CredentialsAuthenticationHandler fetches revocation URLs from the certificate, which can be LDAP urls. When making requests to this LDAP urls, Apereo CAS uses the same password as for initially configured LDAP server, which can lead to a password leak. An unauthenticated user can leak the password used to LDAP connection configured on server. This issue has been addressed in version 6.6.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.apereo.cas:cas-server-support-x509-core" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "6.5.0" + }, + { + "fixed": "6.6.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28857" + }, + { + "type": "WEB", + "url": "https://apereo.github.io/2023/02/20/x509-vuln" + }, + { + "type": "PACKAGE", + "url": "https://github.com/apereo/cas" + }, + { + "type": "WEB", + "url": "https://github.com/apereo/cas/releases/tag/v6.6.6" + }, + { + "type": "WEB", + "url": "https://github.com/graciantrivino/cas/blob/b90003f43a8ac0382d5416ceb01074feb936bf24/cas-server-support-x509/src/main/java/org/jasig/cas/adaptors/x509/authentication/handler/support/X509CredentialsAuthenticationHandler.java#L231" + }, + { + "type": "WEB", + "url": "https://securitylab.github.com/advisories" + }, + { + "type": "ADVISORY", + "url": "https://securitylab.github.com/advisories/GHSL-2023-009_Apereo_CAS" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200", + "CWE-522" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T21:18:59Z", + "nvd_published_at": "2023-06-27T18:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/08/GHSA-whr2-9x5f-5c79/GHSA-whr2-9x5f-5c79.json b/advisories/github-reviewed/2024/08/GHSA-whr2-9x5f-5c79/GHSA-whr2-9x5f-5c79.json new file mode 100644 index 00000000000..c79f6198bda --- /dev/null +++ b/advisories/github-reviewed/2024/08/GHSA-whr2-9x5f-5c79/GHSA-whr2-9x5f-5c79.json @@ -0,0 +1,78 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-whr2-9x5f-5c79", + "modified": "2024-08-05T21:18:58Z", + "published": "2024-08-05T21:18:58Z", + "aliases": [ + "CVE-2022-23554" + ], + "summary": "Alpine allows Authentication Filter bypass", + "details": "Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows Authentication Filter bypass. The AuthenticationFilter relies on the request URI to evaluate if the user is accessing the swagger endpoint. By accessing a URL with a path such as /api/foo;%2fapi%2fswagger the contains condition will hold and will return from the authentication filter without aborting the request. Note that the principal object will not be assigned and therefore the issue wont allow user impersonation. This issue has been fixed in version 1.10.4. There are no known workarounds.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "us.springett:alpine" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.10.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23554" + }, + { + "type": "PACKAGE", + "url": "https://github.com/stevespringett/Alpine" + }, + { + "type": "WEB", + "url": "https://github.com/stevespringett/Alpine/blob/f03dbda46229c26145a5f9f7f2660cc2c386be02/alpine/src/main/java/alpine/filters/AuthenticationFilter.java#L58-L60" + }, + { + "type": "WEB", + "url": "https://github.com/stevespringett/Alpine/releases/tag/alpine-parent-1.10.4" + }, + { + "type": "WEB", + "url": "https://securitylab.github.com/advisories" + }, + { + "type": "ADVISORY", + "url": "https://securitylab.github.com/advisories/GHSL-2021-1010-Alpine" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287", + "CWE-697" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-08-05T21:18:58Z", + "nvd_published_at": "2022-12-28T19:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-hf66-xfgj-42g8/GHSA-hf66-xfgj-42g8.json b/advisories/unreviewed/2024/08/GHSA-hf66-xfgj-42g8/GHSA-hf66-xfgj-42g8.json deleted file mode 100644 index dc220f8f7cd..00000000000 --- a/advisories/unreviewed/2024/08/GHSA-hf66-xfgj-42g8/GHSA-hf66-xfgj-42g8.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-hf66-xfgj-42g8", - "modified": "2024-08-05T18:31:43Z", - "published": "2024-08-05T18:31:43Z", - "aliases": [ - "CVE-2024-41380" - ], - "details": "microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\\modules\\tags\\add_tagging_tagged.php.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41380" - }, - { - "type": "WEB", - "url": "https://github.com/microweber/microweber/issues/1111" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-08-05T17:15:41Z" - } -} \ No newline at end of file