diff --git a/advisories/unreviewed/2024/01/GHSA-2fmx-fw55-g6jg/GHSA-2fmx-fw55-g6jg.json b/advisories/unreviewed/2024/01/GHSA-2fmx-fw55-g6jg/GHSA-2fmx-fw55-g6jg.json index 93d222f51f1..a86c756befc 100644 --- a/advisories/unreviewed/2024/01/GHSA-2fmx-fw55-g6jg/GHSA-2fmx-fw55-g6jg.json +++ b/advisories/unreviewed/2024/01/GHSA-2fmx-fw55-g6jg/GHSA-2fmx-fw55-g6jg.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-2fmx-fw55-g6jg", - "modified": "2024-01-05T09:30:31Z", + "modified": "2024-01-11T15:30:21Z", "published": "2024-01-05T09:30:31Z", "aliases": [ "CVE-2023-52184" diff --git a/advisories/unreviewed/2024/01/GHSA-32v9-4fqf-r943/GHSA-32v9-4fqf-r943.json b/advisories/unreviewed/2024/01/GHSA-32v9-4fqf-r943/GHSA-32v9-4fqf-r943.json index 4639922961f..aac56ffdee7 100644 --- a/advisories/unreviewed/2024/01/GHSA-32v9-4fqf-r943/GHSA-32v9-4fqf-r943.json +++ b/advisories/unreviewed/2024/01/GHSA-32v9-4fqf-r943/GHSA-32v9-4fqf-r943.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-32v9-4fqf-r943", - "modified": "2024-01-05T09:30:32Z", + "modified": "2024-01-11T15:30:21Z", "published": "2024-01-05T09:30:32Z", "aliases": [ "CVE-2023-50027" ], "details": "SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers to escalate privileges and gain sensitive information via BaproductzoommagnifierZoomModuleFrontController::run() method.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-01-05T09:15:08Z" diff --git a/advisories/unreviewed/2024/01/GHSA-3cqq-f797-pvc4/GHSA-3cqq-f797-pvc4.json b/advisories/unreviewed/2024/01/GHSA-3cqq-f797-pvc4/GHSA-3cqq-f797-pvc4.json index 230e189a709..6c0a4adb319 100644 --- a/advisories/unreviewed/2024/01/GHSA-3cqq-f797-pvc4/GHSA-3cqq-f797-pvc4.json +++ b/advisories/unreviewed/2024/01/GHSA-3cqq-f797-pvc4/GHSA-3cqq-f797-pvc4.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-3cqq-f797-pvc4", - "modified": "2024-01-06T06:30:29Z", + "modified": "2024-01-11T15:30:22Z", "published": "2024-01-06T06:30:29Z", "aliases": [ "CVE-2023-50609" ], "details": "Cross Site Scripting (XSS) vulnerability in AVA teaching video application service platform version 3.1, allows remote attackers to execute arbitrary code via a crafted script to ajax.aspx.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-01-06T04:15:08Z" diff --git a/advisories/unreviewed/2024/01/GHSA-3rp5-4w7x-5cpg/GHSA-3rp5-4w7x-5cpg.json b/advisories/unreviewed/2024/01/GHSA-3rp5-4w7x-5cpg/GHSA-3rp5-4w7x-5cpg.json new file mode 100644 index 00000000000..7ed47496111 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-3rp5-4w7x-5cpg/GHSA-3rp5-4w7x-5cpg.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3rp5-4w7x-5cpg", + "modified": "2024-01-11T15:30:27Z", + "published": "2024-01-11T15:30:27Z", + "aliases": [ + "CVE-2023-6242" + ], + "details": "The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (for Pro) & 2.2.7 (for Free). This is due to missing or incorrect nonce validation on the evo_eventpost_update_meta function. This makes it possible for unauthenticated attackers to update arbitrary post metadata via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6242" + }, + { + "type": "WEB", + "url": "https://docs.myeventon.com/documentations/eventon-changelog/" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3017578/eventon-lite/trunk/includes/admin/class-admin-ajax.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c8e9a333-a6b7-4b5e-93c1-b95566e5d6fb?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-11T15:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-5g6p-48pg-5m6f/GHSA-5g6p-48pg-5m6f.json b/advisories/unreviewed/2024/01/GHSA-5g6p-48pg-5m6f/GHSA-5g6p-48pg-5m6f.json new file mode 100644 index 00000000000..0e6a57f7429 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-5g6p-48pg-5m6f/GHSA-5g6p-48pg-5m6f.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5g6p-48pg-5m6f", + "modified": "2024-01-11T15:30:26Z", + "published": "2024-01-11T15:30:26Z", + "aliases": [ + "CVE-2023-50159" + ], + "details": "In ScaleFusion (Windows Desktop App) agent v10.5.2, Kiosk mode application restrictions can be bypassed allowing arbitrary code to be executed.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50159" + }, + { + "type": "WEB", + "url": "https://medium.com/nestedif/vulnerability-disclosure-browser-mode-kiosk-bypass-scalefusion-832f5a18ebb6" + }, + { + "type": "WEB", + "url": "https://medium.com/nestedif/vulnerability-disclosure-kiosk-mode-bypass-scalefusion-4752dfa2dc59" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-11T14:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-5x7g-8gcq-4xxf/GHSA-5x7g-8gcq-4xxf.json b/advisories/unreviewed/2024/01/GHSA-5x7g-8gcq-4xxf/GHSA-5x7g-8gcq-4xxf.json index 49c246f8b54..3406f783cf4 100644 --- a/advisories/unreviewed/2024/01/GHSA-5x7g-8gcq-4xxf/GHSA-5x7g-8gcq-4xxf.json +++ b/advisories/unreviewed/2024/01/GHSA-5x7g-8gcq-4xxf/GHSA-5x7g-8gcq-4xxf.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5x7g-8gcq-4xxf", - "modified": "2024-01-06T06:30:29Z", + "modified": "2024-01-11T15:30:22Z", "published": "2024-01-06T06:30:29Z", "aliases": [ "CVE-2023-39853" ], "details": "SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent parameters in the Network Disk backend module.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-89" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-01-06T04:15:08Z" diff --git a/advisories/unreviewed/2024/01/GHSA-6hrc-q74x-c8g8/GHSA-6hrc-q74x-c8g8.json b/advisories/unreviewed/2024/01/GHSA-6hrc-q74x-c8g8/GHSA-6hrc-q74x-c8g8.json new file mode 100644 index 00000000000..73f865cd596 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-6hrc-q74x-c8g8/GHSA-6hrc-q74x-c8g8.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6hrc-q74x-c8g8", + "modified": "2024-01-11T15:30:26Z", + "published": "2024-01-11T15:30:26Z", + "aliases": [ + "CVE-2023-20573" + ], + "details": "A privileged attacker\ncan prevent delivery of debug exceptions to SEV-SNP guests potentially\nresulting in guests not receiving expected debug information.\n\n\n\n", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20573" + }, + { + "type": "WEB", + "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-3006" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-11T14:15:43Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-8fmw-7mxc-55jq/GHSA-8fmw-7mxc-55jq.json b/advisories/unreviewed/2024/01/GHSA-8fmw-7mxc-55jq/GHSA-8fmw-7mxc-55jq.json new file mode 100644 index 00000000000..aaf8837077d --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-8fmw-7mxc-55jq/GHSA-8fmw-7mxc-55jq.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8fmw-7mxc-55jq", + "modified": "2024-01-11T15:30:27Z", + "published": "2024-01-11T15:30:27Z", + "aliases": [ + "CVE-2023-51750" + ], + "details": "ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51750" + }, + { + "type": "WEB", + "url": "https://medium.com/nestedif/vulnerability-disclosure-browser-mode-kiosk-bypass-scalefusion-832f5a18ebb6" + }, + { + "type": "WEB", + "url": "https://medium.com/nestedif/vulnerability-disclosure-kiosk-mode-bypass-scalefusion-4752dfa2dc59" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-11T14:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-fmvv-rrvc-rh7f/GHSA-fmvv-rrvc-rh7f.json b/advisories/unreviewed/2024/01/GHSA-fmvv-rrvc-rh7f/GHSA-fmvv-rrvc-rh7f.json index f791c2bd2f0..77fae1bcbb2 100644 --- a/advisories/unreviewed/2024/01/GHSA-fmvv-rrvc-rh7f/GHSA-fmvv-rrvc-rh7f.json +++ b/advisories/unreviewed/2024/01/GHSA-fmvv-rrvc-rh7f/GHSA-fmvv-rrvc-rh7f.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-fmvv-rrvc-rh7f", - "modified": "2024-01-05T09:30:33Z", + "modified": "2024-01-11T15:30:21Z", "published": "2024-01-05T09:30:33Z", "aliases": [ "CVE-2023-52136" diff --git a/advisories/unreviewed/2024/01/GHSA-hgx9-j24r-974q/GHSA-hgx9-j24r-974q.json b/advisories/unreviewed/2024/01/GHSA-hgx9-j24r-974q/GHSA-hgx9-j24r-974q.json new file mode 100644 index 00000000000..13bd1b85628 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-hgx9-j24r-974q/GHSA-hgx9-j24r-974q.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hgx9-j24r-974q", + "modified": "2024-01-11T15:30:27Z", + "published": "2024-01-11T15:30:27Z", + "aliases": [ + "CVE-2023-51748" + ], + "details": "ScaleFusion 10.5.2 does not properly limit users to the Edge application because Ctrl-O and Ctrl-S can be used.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51748" + }, + { + "type": "WEB", + "url": "https://medium.com/nestedif/vulnerability-disclosure-browser-mode-kiosk-bypass-scalefusion-832f5a18ebb6" + }, + { + "type": "WEB", + "url": "https://medium.com/nestedif/vulnerability-disclosure-kiosk-mode-bypass-scalefusion-4752dfa2dc59" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-11T14:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-hp49-c946-wfm3/GHSA-hp49-c946-wfm3.json b/advisories/unreviewed/2024/01/GHSA-hp49-c946-wfm3/GHSA-hp49-c946-wfm3.json index 5cb01956642..fc4b1b6a745 100644 --- a/advisories/unreviewed/2024/01/GHSA-hp49-c946-wfm3/GHSA-hp49-c946-wfm3.json +++ b/advisories/unreviewed/2024/01/GHSA-hp49-c946-wfm3/GHSA-hp49-c946-wfm3.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hp49-c946-wfm3", - "modified": "2024-01-05T09:30:33Z", + "modified": "2024-01-11T15:30:21Z", "published": "2024-01-05T09:30:33Z", "aliases": [ "CVE-2023-52128" diff --git a/advisories/unreviewed/2024/01/GHSA-j534-cwfj-5vqc/GHSA-j534-cwfj-5vqc.json b/advisories/unreviewed/2024/01/GHSA-j534-cwfj-5vqc/GHSA-j534-cwfj-5vqc.json index df831dd3826..471bf330775 100644 --- a/advisories/unreviewed/2024/01/GHSA-j534-cwfj-5vqc/GHSA-j534-cwfj-5vqc.json +++ b/advisories/unreviewed/2024/01/GHSA-j534-cwfj-5vqc/GHSA-j534-cwfj-5vqc.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j534-cwfj-5vqc", - "modified": "2024-01-05T12:30:25Z", + "modified": "2024-01-11T15:30:21Z", "published": "2024-01-05T12:30:25Z", "aliases": [ "CVE-2023-52120" diff --git a/advisories/unreviewed/2024/01/GHSA-jfch-7m53-3fxv/GHSA-jfch-7m53-3fxv.json b/advisories/unreviewed/2024/01/GHSA-jfch-7m53-3fxv/GHSA-jfch-7m53-3fxv.json index a6757ca776e..043b1fc2d99 100644 --- a/advisories/unreviewed/2024/01/GHSA-jfch-7m53-3fxv/GHSA-jfch-7m53-3fxv.json +++ b/advisories/unreviewed/2024/01/GHSA-jfch-7m53-3fxv/GHSA-jfch-7m53-3fxv.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-jfch-7m53-3fxv", - "modified": "2024-01-05T12:30:25Z", + "modified": "2024-01-11T15:30:21Z", "published": "2024-01-05T12:30:25Z", "aliases": [ "CVE-2023-52119" diff --git a/advisories/unreviewed/2024/01/GHSA-jr6g-cpw8-93hj/GHSA-jr6g-cpw8-93hj.json b/advisories/unreviewed/2024/01/GHSA-jr6g-cpw8-93hj/GHSA-jr6g-cpw8-93hj.json new file mode 100644 index 00000000000..01650f22fd0 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-jr6g-cpw8-93hj/GHSA-jr6g-cpw8-93hj.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jr6g-cpw8-93hj", + "modified": "2024-01-11T15:30:27Z", + "published": "2024-01-11T15:30:27Z", + "aliases": [ + "CVE-2023-6938" + ], + "details": "The Oxygen Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a custom field in all versions up to, and including, 4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: Version 4.8.1 of the Oxygen Builder plugin for WordPress addresses this vulnerability by implementing an optional filter to provide output escaping for dynamic data. Please see https://oxygenbuilder.com/documentation/other/security/#filtering-dynamic-data for more details.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6938" + }, + { + "type": "WEB", + "url": "https://oxygenbuilder.com/oxygen-4-8-1-now-available/" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ee069cb3-370e-48ea-aa35-c30fe83c2498?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-11T15:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-r5hf-7r8j-j5mf/GHSA-r5hf-7r8j-j5mf.json b/advisories/unreviewed/2024/01/GHSA-r5hf-7r8j-j5mf/GHSA-r5hf-7r8j-j5mf.json index 568d18264f5..705fe247d5a 100644 --- a/advisories/unreviewed/2024/01/GHSA-r5hf-7r8j-j5mf/GHSA-r5hf-7r8j-j5mf.json +++ b/advisories/unreviewed/2024/01/GHSA-r5hf-7r8j-j5mf/GHSA-r5hf-7r8j-j5mf.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-r5hf-7r8j-j5mf", - "modified": "2024-01-06T03:31:03Z", + "modified": "2024-01-11T15:30:22Z", "published": "2024-01-06T03:31:03Z", "aliases": [ "CVE-2023-50612" ], "details": "Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-276" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-01-06T03:15:43Z" diff --git a/advisories/unreviewed/2024/01/GHSA-r65x-5fp7-9m76/GHSA-r65x-5fp7-9m76.json b/advisories/unreviewed/2024/01/GHSA-r65x-5fp7-9m76/GHSA-r65x-5fp7-9m76.json new file mode 100644 index 00000000000..19a4a17cdc9 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-r65x-5fp7-9m76/GHSA-r65x-5fp7-9m76.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r65x-5fp7-9m76", + "modified": "2024-01-11T15:30:27Z", + "published": "2024-01-11T15:30:27Z", + "aliases": [ + "CVE-2023-51749" + ], + "details": "ScaleFusion 10.5.2 does not properly limit users to the Edge application because a search can be made from a tooltip.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51749" + }, + { + "type": "WEB", + "url": "https://medium.com/nestedif/vulnerability-disclosure-browser-mode-kiosk-bypass-scalefusion-832f5a18ebb6" + }, + { + "type": "WEB", + "url": "https://medium.com/nestedif/vulnerability-disclosure-kiosk-mode-bypass-scalefusion-4752dfa2dc59" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-11T14:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-r79x-6p7r-6ghx/GHSA-r79x-6p7r-6ghx.json b/advisories/unreviewed/2024/01/GHSA-r79x-6p7r-6ghx/GHSA-r79x-6p7r-6ghx.json new file mode 100644 index 00000000000..8c176ff2771 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-r79x-6p7r-6ghx/GHSA-r79x-6p7r-6ghx.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r79x-6p7r-6ghx", + "modified": "2024-01-11T15:30:27Z", + "published": "2024-01-11T15:30:27Z", + "aliases": [ + "CVE-2023-51751" + ], + "details": "ScaleFusion 10.5.2 does not properly limit users to the Edge application because Alt-F4 can be used.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51751" + }, + { + "type": "WEB", + "url": "https://medium.com/nestedif/vulnerability-disclosure-browser-mode-kiosk-bypass-scalefusion-832f5a18ebb6" + }, + { + "type": "WEB", + "url": "https://medium.com/nestedif/vulnerability-disclosure-kiosk-mode-bypass-scalefusion-4752dfa2dc59" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-11T14:15:44Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-w5jx-c49w-xmwh/GHSA-w5jx-c49w-xmwh.json b/advisories/unreviewed/2024/01/GHSA-w5jx-c49w-xmwh/GHSA-w5jx-c49w-xmwh.json new file mode 100644 index 00000000000..d5df5784287 --- /dev/null +++ b/advisories/unreviewed/2024/01/GHSA-w5jx-c49w-xmwh/GHSA-w5jx-c49w-xmwh.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w5jx-c49w-xmwh", + "modified": "2024-01-11T15:30:27Z", + "published": "2024-01-11T15:30:27Z", + "aliases": [ + "CVE-2023-6244" + ], + "details": "The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 (Pro) & 2.2.8 (Free). This is due to missing or incorrect nonce validation on the save_virtual_event_settings function. This makes it possible for unauthenticated attackers to modify virtual event settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6244" + }, + { + "type": "WEB", + "url": "https://docs.myeventon.com/documentations/eventon-changelog/" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3017939%40eventon-lite&new=3017939%40eventon-lite&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6fcc3a82-f116-446e-9e5f-4f074e20403b?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-01-11T15:15:08Z" + } +} \ No newline at end of file