Publish Advisories

GHSA-2fmx-fw55-g6jg
GHSA-32v9-4fqf-r943
GHSA-3cqq-f797-pvc4
GHSA-3rp5-4w7x-5cpg
GHSA-5g6p-48pg-5m6f
GHSA-5x7g-8gcq-4xxf
GHSA-6hrc-q74x-c8g8
GHSA-8fmw-7mxc-55jq
GHSA-fmvv-rrvc-rh7f
GHSA-hgx9-j24r-974q
GHSA-hp49-c946-wfm3
GHSA-j534-cwfj-5vqc
GHSA-jfch-7m53-3fxv
GHSA-jr6g-cpw8-93hj
GHSA-r5hf-7r8j-j5mf
GHSA-r65x-5fp7-9m76
GHSA-r79x-6p7r-6ghx
GHSA-w5jx-c49w-xmwh
This commit is contained in:
advisory-database[bot]
2024-01-11 15:31:57 +00:00
parent 80ec5c82f1
commit 5a30b70321
18 changed files with 397 additions and 21 deletions
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2fmx-fw55-g6jg",
"modified": "2024-01-05T09:30:31Z",
"modified": "2024-01-11T15:30:21Z",
"published": "2024-01-05T09:30:31Z",
"aliases": [
"CVE-2023-52184"
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-32v9-4fqf-r943",
"modified": "2024-01-05T09:30:32Z",
"modified": "2024-01-11T15:30:21Z",
"published": "2024-01-05T09:30:32Z",
"aliases": [
"CVE-2023-50027"
],
"details": "SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privileges and gain sensitive information via BaproductzoommagnifierZoomModuleFrontController::run() method.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-05T09:15:08Z"
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3cqq-f797-pvc4",
"modified": "2024-01-06T06:30:29Z",
"modified": "2024-01-11T15:30:22Z",
"published": "2024-01-06T06:30:29Z",
"aliases": [
"CVE-2023-50609"
],
"details": "Cross Site Scripting (XSS) vulnerability in AVA teaching video application service platform version 3.1, allows remote attackers to execute arbitrary code via a crafted script to ajax.aspx.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-06T04:15:08Z"
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3rp5-4w7x-5cpg",
"modified": "2024-01-11T15:30:27Z",
"published": "2024-01-11T15:30:27Z",
"aliases": [
"CVE-2023-6242"
],
"details": "The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (for Pro) & 2.2.7 (for Free). This is due to missing or incorrect nonce validation on the evo_eventpost_update_meta function. This makes it possible for unauthenticated attackers to update arbitrary post metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6242"
},
{
"type": "WEB",
"url": "https://docs.myeventon.com/documentations/eventon-changelog/"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3017578/eventon-lite/trunk/includes/admin/class-admin-ajax.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c8e9a333-a6b7-4b5e-93c1-b95566e5d6fb?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-11T15:15:08Z"
}
}
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5g6p-48pg-5m6f",
"modified": "2024-01-11T15:30:26Z",
"published": "2024-01-11T15:30:26Z",
"aliases": [
"CVE-2023-50159"
],
"details": "In ScaleFusion (Windows Desktop App) agent v10.5.2, Kiosk mode application restrictions can be bypassed allowing arbitrary code to be executed.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50159"
},
{
"type": "WEB",
"url": "https://medium.com/nestedif/vulnerability-disclosure-browser-mode-kiosk-bypass-scalefusion-832f5a18ebb6"
},
{
"type": "WEB",
"url": "https://medium.com/nestedif/vulnerability-disclosure-kiosk-mode-bypass-scalefusion-4752dfa2dc59"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-11T14:15:44Z"
}
}
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5x7g-8gcq-4xxf",
"modified": "2024-01-06T06:30:29Z",
"modified": "2024-01-11T15:30:22Z",
"published": "2024-01-06T06:30:29Z",
"aliases": [
"CVE-2023-39853"
],
"details": "SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent parameters in the Network Disk backend module.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-06T04:15:08Z"
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6hrc-q74x-c8g8",
"modified": "2024-01-11T15:30:26Z",
"published": "2024-01-11T15:30:26Z",
"aliases": [
"CVE-2023-20573"
],
"details": "A privileged attacker\ncan prevent delivery of debug exceptions to SEV-SNP guests potentially\nresulting in guests not receiving expected debug information.\n\n\n\n",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20573"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3006"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-11T14:15:43Z"
}
}
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8fmw-7mxc-55jq",
"modified": "2024-01-11T15:30:27Z",
"published": "2024-01-11T15:30:27Z",
"aliases": [
"CVE-2023-51750"
],
"details": "ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51750"
},
{
"type": "WEB",
"url": "https://medium.com/nestedif/vulnerability-disclosure-browser-mode-kiosk-bypass-scalefusion-832f5a18ebb6"
},
{
"type": "WEB",
"url": "https://medium.com/nestedif/vulnerability-disclosure-kiosk-mode-bypass-scalefusion-4752dfa2dc59"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-11T14:15:44Z"
}
}
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fmvv-rrvc-rh7f",
"modified": "2024-01-05T09:30:33Z",
"modified": "2024-01-11T15:30:21Z",
"published": "2024-01-05T09:30:33Z",
"aliases": [
"CVE-2023-52136"
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hgx9-j24r-974q",
"modified": "2024-01-11T15:30:27Z",
"published": "2024-01-11T15:30:27Z",
"aliases": [
"CVE-2023-51748"
],
"details": "ScaleFusion 10.5.2 does not properly limit users to the Edge application because Ctrl-O and Ctrl-S can be used.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51748"
},
{
"type": "WEB",
"url": "https://medium.com/nestedif/vulnerability-disclosure-browser-mode-kiosk-bypass-scalefusion-832f5a18ebb6"
},
{
"type": "WEB",
"url": "https://medium.com/nestedif/vulnerability-disclosure-kiosk-mode-bypass-scalefusion-4752dfa2dc59"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-11T14:15:44Z"
}
}
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hp49-c946-wfm3",
"modified": "2024-01-05T09:30:33Z",
"modified": "2024-01-11T15:30:21Z",
"published": "2024-01-05T09:30:33Z",
"aliases": [
"CVE-2023-52128"
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-j534-cwfj-5vqc",
"modified": "2024-01-05T12:30:25Z",
"modified": "2024-01-11T15:30:21Z",
"published": "2024-01-05T12:30:25Z",
"aliases": [
"CVE-2023-52120"
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jfch-7m53-3fxv",
"modified": "2024-01-05T12:30:25Z",
"modified": "2024-01-11T15:30:21Z",
"published": "2024-01-05T12:30:25Z",
"aliases": [
"CVE-2023-52119"
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jr6g-cpw8-93hj",
"modified": "2024-01-11T15:30:27Z",
"published": "2024-01-11T15:30:27Z",
"aliases": [
"CVE-2023-6938"
],
"details": "The Oxygen Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom field in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Version 4.8.1 of the Oxygen Builder plugin for WordPress addresses this vulnerability by implementing an optional filter to provide output escaping for dynamic data. Please see https://oxygenbuilder.com/documentation/other/security/#filtering-dynamic-data for more details.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6938"
},
{
"type": "WEB",
"url": "https://oxygenbuilder.com/oxygen-4-8-1-now-available/"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ee069cb3-370e-48ea-aa35-c30fe83c2498?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-11T15:15:08Z"
}
}
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r5hf-7r8j-j5mf",
"modified": "2024-01-06T03:31:03Z",
"modified": "2024-01-11T15:30:22Z",
"published": "2024-01-06T03:31:03Z",
"aliases": [
"CVE-2023-50612"
],
"details": "Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,9 +28,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-276"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-06T03:15:43Z"
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r65x-5fp7-9m76",
"modified": "2024-01-11T15:30:27Z",
"published": "2024-01-11T15:30:27Z",
"aliases": [
"CVE-2023-51749"
],
"details": "ScaleFusion 10.5.2 does not properly limit users to the Edge application because a search can be made from a tooltip.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51749"
},
{
"type": "WEB",
"url": "https://medium.com/nestedif/vulnerability-disclosure-browser-mode-kiosk-bypass-scalefusion-832f5a18ebb6"
},
{
"type": "WEB",
"url": "https://medium.com/nestedif/vulnerability-disclosure-kiosk-mode-bypass-scalefusion-4752dfa2dc59"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-11T14:15:44Z"
}
}
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r79x-6p7r-6ghx",
"modified": "2024-01-11T15:30:27Z",
"published": "2024-01-11T15:30:27Z",
"aliases": [
"CVE-2023-51751"
],
"details": "ScaleFusion 10.5.2 does not properly limit users to the Edge application because Alt-F4 can be used.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51751"
},
{
"type": "WEB",
"url": "https://medium.com/nestedif/vulnerability-disclosure-browser-mode-kiosk-bypass-scalefusion-832f5a18ebb6"
},
{
"type": "WEB",
"url": "https://medium.com/nestedif/vulnerability-disclosure-kiosk-mode-bypass-scalefusion-4752dfa2dc59"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-11T14:15:44Z"
}
}
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w5jx-c49w-xmwh",
"modified": "2024-01-11T15:30:27Z",
"published": "2024-01-11T15:30:27Z",
"aliases": [
"CVE-2023-6244"
],
"details": "The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (Pro) & 2.2.8 (Free). This is due to missing or incorrect nonce validation on the save_virtual_event_settings function. This makes it possible for unauthenticated attackers to modify virtual event settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6244"
},
{
"type": "WEB",
"url": "https://docs.myeventon.com/documentations/eventon-changelog/"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3017939%40eventon-lite&new=3017939%40eventon-lite&sfp_email=&sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6fcc3a82-f116-446e-9e5f-4f074e20403b?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-11T15:15:08Z"
}
}