From 49bb230e0e47aca069f98b24b7d5e6cbdee303ce Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 5 Jan 2024 03:31:52 +0000 Subject: [PATCH] Publish Advisories GHSA-f92h-rw3f-8j92 GHSA-fvcr-3mhq-rw2x GHSA-826f-v6w3-63vg GHSA-83wx-v283-85g9 GHSA-9cfx-4h8h-hg54 GHSA-c87c-56pw-mwgh GHSA-gqr9-4fcc-c9jq GHSA-vwv2-9wcj-64vx GHSA-w8x8-g534-x4rp --- .../GHSA-f92h-rw3f-8j92.json | 4 ++ .../GHSA-fvcr-3mhq-rw2x.json | 4 ++ .../GHSA-826f-v6w3-63vg.json | 38 +++++++++++++++++ .../GHSA-83wx-v283-85g9.json | 4 ++ .../GHSA-9cfx-4h8h-hg54.json | 42 +++++++++++++++++++ .../GHSA-c87c-56pw-mwgh.json | 4 ++ .../GHSA-gqr9-4fcc-c9jq.json | 4 ++ .../GHSA-vwv2-9wcj-64vx.json | 35 ++++++++++++++++ .../GHSA-w8x8-g534-x4rp.json | 4 ++ 9 files changed, 139 insertions(+) create mode 100644 advisories/unreviewed/2024/01/GHSA-826f-v6w3-63vg/GHSA-826f-v6w3-63vg.json create mode 100644 advisories/unreviewed/2024/01/GHSA-9cfx-4h8h-hg54/GHSA-9cfx-4h8h-hg54.json create mode 100644 advisories/unreviewed/2024/01/GHSA-vwv2-9wcj-64vx/GHSA-vwv2-9wcj-64vx.json diff --git a/advisories/unreviewed/2023/12/GHSA-f92h-rw3f-8j92/GHSA-f92h-rw3f-8j92.json b/advisories/unreviewed/2023/12/GHSA-f92h-rw3f-8j92/GHSA-f92h-rw3f-8j92.json index 414f7171a87..32699847ec9 100644 --- a/advisories/unreviewed/2023/12/GHSA-f92h-rw3f-8j92/GHSA-f92h-rw3f-8j92.json +++ b/advisories/unreviewed/2023/12/GHSA-f92h-rw3f-8j92/GHSA-f92h-rw3f-8j92.json @@ -21,6 +21,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7104" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/" + }, { "type": "WEB", "url": "https://sqlite.org/forum/forumpost/5bcbf4571c" diff --git a/advisories/unreviewed/2023/12/GHSA-fvcr-3mhq-rw2x/GHSA-fvcr-3mhq-rw2x.json b/advisories/unreviewed/2023/12/GHSA-fvcr-3mhq-rw2x/GHSA-fvcr-3mhq-rw2x.json index 9c8b39847bd..5b9dd944d7b 100644 --- a/advisories/unreviewed/2023/12/GHSA-fvcr-3mhq-rw2x/GHSA-fvcr-3mhq-rw2x.json +++ b/advisories/unreviewed/2023/12/GHSA-fvcr-3mhq-rw2x/GHSA-fvcr-3mhq-rw2x.json @@ -28,6 +28,10 @@ { "type": "WEB", "url": "https://crbug.com/aomedia/3491" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/01/GHSA-826f-v6w3-63vg/GHSA-826f-v6w3-63vg.json b/advisories/unreviewed/2024/01/GHSA-826f-v6w3-63vg/GHSA-826f-v6w3-63vg.json new file mode 100644 index 00000000000..cb44329d32f --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-826f-v6w3-63vg/GHSA-826f-v6w3-63vg.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-826f-v6w3-63vg", + "modified": "2024-01-05T03:30:37Z", + "published": "2024-01-05T03:30:37Z", + "aliases": [ + "CVE-2023-41782" + ], + "details": "\nThere is a DLL hijacking vulnerability in ZTE ZXCLOUD iRAI, an attacker could place a fake DLL file in a specific directory and successfully exploit this vulnerability to execute malicious code.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41782" + }, + { + "type": "WEB", + "url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1032984" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-05T02:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-83wx-v283-85g9/GHSA-83wx-v283-85g9.json b/advisories/unreviewed/2024/01/GHSA-83wx-v283-85g9/GHSA-83wx-v283-85g9.json index 4f0abe457f3..62ba13d6e4f 100644 --- a/advisories/unreviewed/2024/01/GHSA-83wx-v283-85g9/GHSA-83wx-v283-85g9.json +++ b/advisories/unreviewed/2024/01/GHSA-83wx-v283-85g9/GHSA-83wx-v283-85g9.json @@ -25,6 +25,10 @@ { "type": "WEB", "url": "https://crbug.com/1505086" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/01/GHSA-9cfx-4h8h-hg54/GHSA-9cfx-4h8h-hg54.json b/advisories/unreviewed/2024/01/GHSA-9cfx-4h8h-hg54/GHSA-9cfx-4h8h-hg54.json new file mode 100644 index 00000000000..0a88689c5c7 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-9cfx-4h8h-hg54/GHSA-9cfx-4h8h-hg54.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9cfx-4h8h-hg54", + "modified": "2024-01-05T03:30:37Z", + "published": "2024-01-05T03:30:37Z", + "aliases": [ + "CVE-2023-6493" + ], + "details": "The Depicter Slider – Responsive Image Slider, Video Slider & Post Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2023-51491 appears to be a duplicate of this issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6493" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3013596/depicter/trunk/app/src/WordPress/Settings/Settings.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c9c907ea-3ab4-4674-8945-ade4f6ff2679?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-05T02:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-c87c-56pw-mwgh/GHSA-c87c-56pw-mwgh.json b/advisories/unreviewed/2024/01/GHSA-c87c-56pw-mwgh/GHSA-c87c-56pw-mwgh.json index afcdc50a1ad..fdaf71ca177 100644 --- a/advisories/unreviewed/2024/01/GHSA-c87c-56pw-mwgh/GHSA-c87c-56pw-mwgh.json +++ b/advisories/unreviewed/2024/01/GHSA-c87c-56pw-mwgh/GHSA-c87c-56pw-mwgh.json @@ -25,6 +25,10 @@ { "type": "WEB", "url": "https://crbug.com/1501798" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/01/GHSA-gqr9-4fcc-c9jq/GHSA-gqr9-4fcc-c9jq.json b/advisories/unreviewed/2024/01/GHSA-gqr9-4fcc-c9jq/GHSA-gqr9-4fcc-c9jq.json index 7225f2dd098..bce6e8f1ba9 100644 --- a/advisories/unreviewed/2024/01/GHSA-gqr9-4fcc-c9jq/GHSA-gqr9-4fcc-c9jq.json +++ b/advisories/unreviewed/2024/01/GHSA-gqr9-4fcc-c9jq/GHSA-gqr9-4fcc-c9jq.json @@ -25,6 +25,10 @@ { "type": "WEB", "url": "https://crbug.com/1506923" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/01/GHSA-vwv2-9wcj-64vx/GHSA-vwv2-9wcj-64vx.json b/advisories/unreviewed/2024/01/GHSA-vwv2-9wcj-64vx/GHSA-vwv2-9wcj-64vx.json new file mode 100644 index 00000000000..5e99f9c6004 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-vwv2-9wcj-64vx/GHSA-vwv2-9wcj-64vx.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vwv2-9wcj-64vx", + "modified": "2024-01-05T03:30:37Z", + "published": "2024-01-05T03:30:37Z", + "aliases": [ + "CVE-2024-22075" + ], + "details": "Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22075" + }, + { + "type": "WEB", + "url": "https://github.com/firefly-iii/firefly-iii/releases/tag/v6.1.1" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-05T03:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-w8x8-g534-x4rp/GHSA-w8x8-g534-x4rp.json b/advisories/unreviewed/2024/01/GHSA-w8x8-g534-x4rp/GHSA-w8x8-g534-x4rp.json index 5e9a78e6625..31b8569a64b 100644 --- a/advisories/unreviewed/2024/01/GHSA-w8x8-g534-x4rp/GHSA-w8x8-g534-x4rp.json +++ b/advisories/unreviewed/2024/01/GHSA-w8x8-g534-x4rp/GHSA-w8x8-g534-x4rp.json @@ -25,6 +25,10 @@ { "type": "WEB", "url": "https://crbug.com/1505009" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D6C2HN4T2S6GYNTAUXLH45LQZHK7QPHP/" } ], "database_specific": {