diff --git a/advisories/github-reviewed/2022/01/GHSA-r58x-wjg8-63m9/GHSA-r58x-wjg8-63m9.json b/advisories/github-reviewed/2022/01/GHSA-r58x-wjg8-63m9/GHSA-r58x-wjg8-63m9.json index b6ddd7e6b4d..e891767b332 100644 --- a/advisories/github-reviewed/2022/01/GHSA-r58x-wjg8-63m9/GHSA-r58x-wjg8-63m9.json +++ b/advisories/github-reviewed/2022/01/GHSA-r58x-wjg8-63m9/GHSA-r58x-wjg8-63m9.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-r58x-wjg8-63m9", - "modified": "2022-01-13T18:33:25Z", + "modified": "2024-05-15T06:30:04Z", "published": "2022-01-08T00:40:30Z", "aliases": [ "CVE-2021-40110" @@ -22,7 +22,7 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "3.1.0" }, { "fixed": "3.6.1" diff --git a/advisories/github-reviewed/2024/02/GHSA-v76w-3ph8-vm66/GHSA-v76w-3ph8-vm66.json b/advisories/github-reviewed/2024/02/GHSA-v76w-3ph8-vm66/GHSA-v76w-3ph8-vm66.json index 2f68ddf6786..da1f0fb752f 100644 --- a/advisories/github-reviewed/2024/02/GHSA-v76w-3ph8-vm66/GHSA-v76w-3ph8-vm66.json +++ b/advisories/github-reviewed/2024/02/GHSA-v76w-3ph8-vm66/GHSA-v76w-3ph8-vm66.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-v76w-3ph8-vm66", - "modified": "2024-05-08T18:30:48Z", + "modified": "2024-05-15T06:30:44Z", "published": "2024-02-12T21:30:55Z", "aliases": [ "CVE-2024-1459" @@ -71,6 +71,10 @@ "type": "WEB", "url": "https://github.com/undertow-io/undertow/commit/54f3e4325425c472f5af5fc973e02df83d7a711a" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:1677" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:2763" diff --git a/advisories/unreviewed/2024/05/GHSA-53j6-rqp4-4h6m/GHSA-53j6-rqp4-4h6m.json b/advisories/unreviewed/2024/05/GHSA-53j6-rqp4-4h6m/GHSA-53j6-rqp4-4h6m.json new file mode 100644 index 00000000000..aad6bc55012 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-53j6-rqp4-4h6m/GHSA-53j6-rqp4-4h6m.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-53j6-rqp4-4h6m", + "modified": "2024-05-15T06:30:44Z", + "published": "2024-05-15T06:30:44Z", + "aliases": [ + "CVE-2024-3407" + ], + "details": "The WP Prayer WordPress plugin through 2.0.9 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3407" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/262348ab-a335-4acf-8e4d-229fc0b4972f" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-15T06:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-56m5-6v25-whgm/GHSA-56m5-6v25-whgm.json b/advisories/unreviewed/2024/05/GHSA-56m5-6v25-whgm/GHSA-56m5-6v25-whgm.json new file mode 100644 index 00000000000..e88f6bcb2f1 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-56m5-6v25-whgm/GHSA-56m5-6v25-whgm.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-56m5-6v25-whgm", + "modified": "2024-05-15T06:30:44Z", + "published": "2024-05-15T06:30:44Z", + "aliases": [ + "CVE-2024-3822" + ], + "details": "The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3822" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/ff5411b1-9e04-4e72-a502-e431d774642a" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-15T06:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-5wq8-45w5-cxgr/GHSA-5wq8-45w5-cxgr.json b/advisories/unreviewed/2024/05/GHSA-5wq8-45w5-cxgr/GHSA-5wq8-45w5-cxgr.json new file mode 100644 index 00000000000..4c7db26c1af --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-5wq8-45w5-cxgr/GHSA-5wq8-45w5-cxgr.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5wq8-45w5-cxgr", + "modified": "2024-05-15T06:30:44Z", + "published": "2024-05-15T06:30:44Z", + "aliases": [ + "CVE-2024-3631" + ], + "details": "The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check when unlinking twitter accounts, which could allow attackers to make logged in admins perform such actions via a CSRF attack", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3631" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/c59a8b49-6f3e-452b-ba9b-50b80c522ee9" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-15T06:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-7gh2-59h4-gcm3/GHSA-7gh2-59h4-gcm3.json b/advisories/unreviewed/2024/05/GHSA-7gh2-59h4-gcm3/GHSA-7gh2-59h4-gcm3.json new file mode 100644 index 00000000000..507862656fb --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-7gh2-59h4-gcm3/GHSA-7gh2-59h4-gcm3.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7gh2-59h4-gcm3", + "modified": "2024-05-15T06:30:44Z", + "published": "2024-05-15T06:30:44Z", + "aliases": [ + "CVE-2024-3823" + ], + "details": "The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3823" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/a138215c-4b8c-4182-978f-d21ce25070d3" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-15T06:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-chc5-gj7v-7hf9/GHSA-chc5-gj7v-7hf9.json b/advisories/unreviewed/2024/05/GHSA-chc5-gj7v-7hf9/GHSA-chc5-gj7v-7hf9.json new file mode 100644 index 00000000000..bea26053770 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-chc5-gj7v-7hf9/GHSA-chc5-gj7v-7hf9.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-chc5-gj7v-7hf9", + "modified": "2024-05-15T06:30:44Z", + "published": "2024-05-15T06:30:44Z", + "aliases": [ + "CVE-2024-3634" + ], + "details": "The month name translation benaceur WordPress plugin before 2.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3634" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/76e000e0-314f-4e39-8871-68bf8cc95b22" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-15T06:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-fgjm-9hpr-9w7r/GHSA-fgjm-9hpr-9w7r.json b/advisories/unreviewed/2024/05/GHSA-fgjm-9hpr-9w7r/GHSA-fgjm-9hpr-9w7r.json new file mode 100644 index 00000000000..1a844f7c8bc --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-fgjm-9hpr-9w7r/GHSA-fgjm-9hpr-9w7r.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fgjm-9hpr-9w7r", + "modified": "2024-05-15T06:30:44Z", + "published": "2024-05-15T06:30:44Z", + "aliases": [ + "CVE-2024-3548" + ], + "details": "The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3548" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/9eef8b29-2c62-4daa-ae90-467ff9be18d8" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-15T06:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-p3vp-jg8v-gfmh/GHSA-p3vp-jg8v-gfmh.json b/advisories/unreviewed/2024/05/GHSA-p3vp-jg8v-gfmh/GHSA-p3vp-jg8v-gfmh.json new file mode 100644 index 00000000000..9eb83d733b0 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-p3vp-jg8v-gfmh/GHSA-p3vp-jg8v-gfmh.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p3vp-jg8v-gfmh", + "modified": "2024-05-15T06:30:44Z", + "published": "2024-05-15T06:30:44Z", + "aliases": [ + "CVE-2024-3629" + ], + "details": "The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3629" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/c1f6ed2c-0f84-4b13-b39e-5cb91443c2b1" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-15T06:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-qfmw-8q7m-gxm5/GHSA-qfmw-8q7m-gxm5.json b/advisories/unreviewed/2024/05/GHSA-qfmw-8q7m-gxm5/GHSA-qfmw-8q7m-gxm5.json new file mode 100644 index 00000000000..a86e8aed6cc --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-qfmw-8q7m-gxm5/GHSA-qfmw-8q7m-gxm5.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qfmw-8q7m-gxm5", + "modified": "2024-05-15T06:30:44Z", + "published": "2024-05-15T06:30:44Z", + "aliases": [ + "CVE-2024-3749" + ], + "details": "The SP Project & Document Manager WordPress plugin through 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3749" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/d14bb16e-ce1d-4c31-8791-bc63174897c0" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-15T06:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-qvgf-wgjr-g932/GHSA-qvgf-wgjr-g932.json b/advisories/unreviewed/2024/05/GHSA-qvgf-wgjr-g932/GHSA-qvgf-wgjr-g932.json new file mode 100644 index 00000000000..e9ff3943076 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-qvgf-wgjr-g932/GHSA-qvgf-wgjr-g932.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qvgf-wgjr-g932", + "modified": "2024-05-15T06:30:44Z", + "published": "2024-05-15T06:30:44Z", + "aliases": [ + "CVE-2024-3748" + ], + "details": "The SP Project & Document Manager WordPress plugin through 4.71 is missing validation in its upload function, allowing a user to manipulate the `user_id` to make it appear that a file was uploaded by another user", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3748" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/01427cfb-5c51-4524-9b9d-e09a603bc34c" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-15T06:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-rm3h-m7rx-3jrq/GHSA-rm3h-m7rx-3jrq.json b/advisories/unreviewed/2024/05/GHSA-rm3h-m7rx-3jrq/GHSA-rm3h-m7rx-3jrq.json new file mode 100644 index 00000000000..56b8d1ebc8b --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-rm3h-m7rx-3jrq/GHSA-rm3h-m7rx-3jrq.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rm3h-m7rx-3jrq", + "modified": "2024-05-15T06:30:44Z", + "published": "2024-05-15T06:30:44Z", + "aliases": [ + "CVE-2024-3405" + ], + "details": "The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3405" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/6968d43c-16ff-43a9-8451-71aabbe69014" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-15T06:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-vvgm-85j8-2648/GHSA-vvgm-85j8-2648.json b/advisories/unreviewed/2024/05/GHSA-vvgm-85j8-2648/GHSA-vvgm-85j8-2648.json new file mode 100644 index 00000000000..6bcc4fa44bd --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-vvgm-85j8-2648/GHSA-vvgm-85j8-2648.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vvgm-85j8-2648", + "modified": "2024-05-15T06:30:44Z", + "published": "2024-05-15T06:30:44Z", + "aliases": [ + "CVE-2024-3630" + ], + "details": "The HL Twitter WordPress plugin through 2014.1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3630" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/cbab7639-fdb2-4ee5-b5ca-9e30701a63b7" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-15T06:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-w682-79hv-gcr8/GHSA-w682-79hv-gcr8.json b/advisories/unreviewed/2024/05/GHSA-w682-79hv-gcr8/GHSA-w682-79hv-gcr8.json new file mode 100644 index 00000000000..8ca289c97ee --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-w682-79hv-gcr8/GHSA-w682-79hv-gcr8.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w682-79hv-gcr8", + "modified": "2024-05-15T06:30:45Z", + "published": "2024-05-15T06:30:44Z", + "aliases": [ + "CVE-2024-3824" + ], + "details": "The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin reset them via a CSRF attack", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3824" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/749ae334-b1d1-421e-a04c-35464c961a4a" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-15T06:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-x989-xh8p-mqvh/GHSA-x989-xh8p-mqvh.json b/advisories/unreviewed/2024/05/GHSA-x989-xh8p-mqvh/GHSA-x989-xh8p-mqvh.json new file mode 100644 index 00000000000..f5d7ccde914 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-x989-xh8p-mqvh/GHSA-x989-xh8p-mqvh.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x989-xh8p-mqvh", + "modified": "2024-05-15T06:30:44Z", + "published": "2024-05-15T06:30:44Z", + "aliases": [ + "CVE-2024-3406" + ], + "details": "The WP Prayer WordPress plugin through 2.0.9 does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3406" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/1bfab060-64d2-4c38-8bc8-a8f81c5a6e0d" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-15T06:15:11Z" + } +} \ No newline at end of file