diff --git a/advisories/unreviewed/2024/08/GHSA-7cj3-x93g-gj76/GHSA-7cj3-x93g-gj76.json b/advisories/unreviewed/2024/08/GHSA-7cj3-x93g-gj76/GHSA-7cj3-x93g-gj76.json new file mode 100644 index 00000000000..38dfbb8fa72 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-7cj3-x93g-gj76/GHSA-7cj3-x93g-gj76.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7cj3-x93g-gj76", + "modified": "2024-08-23T09:30:35Z", + "published": "2024-08-23T09:30:35Z", + "aliases": [ + "CVE-2024-38807" + ], + "details": "Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38807" + }, + { + "type": "WEB", + "url": "https://spring.io/security/cve-2024-38807" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-23T09:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-864x-rm29-vj33/GHSA-864x-rm29-vj33.json b/advisories/unreviewed/2024/08/GHSA-864x-rm29-vj33/GHSA-864x-rm29-vj33.json new file mode 100644 index 00000000000..741a7ffbc7c --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-864x-rm29-vj33/GHSA-864x-rm29-vj33.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-864x-rm29-vj33", + "modified": "2024-08-23T09:30:36Z", + "published": "2024-08-23T09:30:36Z", + "aliases": [ + "CVE-2024-5502" + ], + "details": "The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Accordion, Dual Heading, and Vertical Timeline widgets in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5502" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/piotnet-addons-for-elementor/trunk/widgets/pafe-dual-color-headline.php#L392" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/piotnet-addons-for-elementor/trunk/widgets/pafe-image-accordion.php#L627" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/piotnet-addons-for-elementor/trunk/widgets/pafe-vertical-timeline.php#L622" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3138599" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/921616e4-2b66-4847-869a-90c1c459685f?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-23T09:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-869f-px86-vj84/GHSA-869f-px86-vj84.json b/advisories/unreviewed/2024/08/GHSA-869f-px86-vj84/GHSA-869f-px86-vj84.json new file mode 100644 index 00000000000..9a88b436af4 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-869f-px86-vj84/GHSA-869f-px86-vj84.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-869f-px86-vj84", + "modified": "2024-08-23T09:30:35Z", + "published": "2024-08-23T09:30:35Z", + "aliases": [ + "CVE-2024-43105" + ], + "details": "Mattermost Plugin Channel Export versions <=1.0.0 fail to restrict concurrent runs of the /export command which allows a user to consume excessive resource by running the /export command multiple times at once.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43105" + }, + { + "type": "WEB", + "url": "https://mattermost.com/security-updates" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-23T08:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-8736-pr6r-r9hr/GHSA-8736-pr6r-r9hr.json b/advisories/unreviewed/2024/08/GHSA-8736-pr6r-r9hr/GHSA-8736-pr6r-r9hr.json new file mode 100644 index 00000000000..92cac1c9f44 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-8736-pr6r-r9hr/GHSA-8736-pr6r-r9hr.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8736-pr6r-r9hr", + "modified": "2024-08-23T09:30:35Z", + "published": "2024-08-23T09:30:35Z", + "aliases": [ + "CVE-2024-40766" + ], + "details": "An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40766" + }, + { + "type": "WEB", + "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0015" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-23T07:15:03Z" + } +} \ No newline at end of file