diff --git a/advisories/unreviewed/2023/08/GHSA-2mmm-qjp3-8j87/GHSA-2mmm-qjp3-8j87.json b/advisories/unreviewed/2023/08/GHSA-2mmm-qjp3-8j87/GHSA-2mmm-qjp3-8j87.json new file mode 100644 index 00000000000..d646d5ed324 --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-2mmm-qjp3-8j87/GHSA-2mmm-qjp3-8j87.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2mmm-qjp3-8j87", + "modified": "2023-08-25T09:30:20Z", + "published": "2023-08-25T09:30:20Z", + "aliases": [ + "CVE-2023-32756" + ], + "details": "\ne-Excellence U-Office Force has a path traversal vulnerability within its file uploading and downloading functions. An unauthenticated remote attacker can exploit this vulnerability to read arbitrary system files, but can’t control system or disrupt service.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32756" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/tw/cp-132-7329-d8e4c-1.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-2vp3-8fjm-gfmm/GHSA-2vp3-8fjm-gfmm.json b/advisories/unreviewed/2023/08/GHSA-2vp3-8fjm-gfmm/GHSA-2vp3-8fjm-gfmm.json new file mode 100644 index 00000000000..660934290a6 --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-2vp3-8fjm-gfmm/GHSA-2vp3-8fjm-gfmm.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2vp3-8fjm-gfmm", + "modified": "2023-08-25T09:30:21Z", + "published": "2023-08-25T09:30:21Z", + "aliases": [ + "CVE-2023-32518" + ], + "details": "Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ono Oogami WP Chinese Conversion plugin <= 1.1.16 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32518" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/wp-chinese-conversion/wordpress-wp-chinese-conversion-plugin-1-1-16-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-3f5r-vp32-5ghx/GHSA-3f5r-vp32-5ghx.json b/advisories/unreviewed/2023/08/GHSA-3f5r-vp32-5ghx/GHSA-3f5r-vp32-5ghx.json new file mode 100644 index 00000000000..f9c098df663 --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-3f5r-vp32-5ghx/GHSA-3f5r-vp32-5ghx.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3f5r-vp32-5ghx", + "modified": "2023-08-25T09:30:21Z", + "published": "2023-08-25T09:30:21Z", + "aliases": [ + "CVE-2023-32576" + ], + "details": "Auth. (subscriber+) Stored Cross-Site Scripting') vulnerability in Plainware Locatoraid Store Locator plugin <= 3.9.18 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32576" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/locatoraid/wordpress-locatoraid-store-locator-plugin-3-9-18-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-3jvx-f94j-g6fh/GHSA-3jvx-f94j-g6fh.json b/advisories/unreviewed/2023/08/GHSA-3jvx-f94j-g6fh/GHSA-3jvx-f94j-g6fh.json new file mode 100644 index 00000000000..f2cb18ac4ce --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-3jvx-f94j-g6fh/GHSA-3jvx-f94j-g6fh.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3jvx-f94j-g6fh", + "modified": "2023-08-25T09:30:20Z", + "published": "2023-08-25T09:30:20Z", + "aliases": [ + "CVE-2023-32757" + ], + "details": "\ne-Excellence U-Office Force file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker without logging the service can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32757" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/tw/cp-132-7330-94442-1.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-3r83-jg3g-rprc/GHSA-3r83-jg3g-rprc.json b/advisories/unreviewed/2023/08/GHSA-3r83-jg3g-rprc/GHSA-3r83-jg3g-rprc.json new file mode 100644 index 00000000000..d0c5ae7146c --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-3r83-jg3g-rprc/GHSA-3r83-jg3g-rprc.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3r83-jg3g-rprc", + "modified": "2023-08-25T09:30:21Z", + "published": "2023-08-25T09:30:21Z", + "aliases": [ + "CVE-2023-32584" + ], + "details": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in John Newcombe eBecas plugin <= 3.1.3 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32584" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/ebecas/wordpress-ebecas-plugin-3-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-9wfm-w69m-rph5/GHSA-9wfm-w69m-rph5.json b/advisories/unreviewed/2023/08/GHSA-9wfm-w69m-rph5/GHSA-9wfm-w69m-rph5.json new file mode 100644 index 00000000000..a3f29e19f8c --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-9wfm-w69m-rph5/GHSA-9wfm-w69m-rph5.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9wfm-w69m-rph5", + "modified": "2023-08-25T09:30:21Z", + "published": "2023-08-25T09:30:21Z", + "aliases": [ + "CVE-2023-32577" + ], + "details": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eji Osigwe DevBuddy Twitter Feed plugin <= 4.0.0 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32577" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/devbuddy-twitter-feed/wordpress-devbuddy-twitter-feed-plugin-4-0-0-cross-site-scripting-xss?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-c6rg-c3x6-pm3m/GHSA-c6rg-c3x6-pm3m.json b/advisories/unreviewed/2023/08/GHSA-c6rg-c3x6-pm3m/GHSA-c6rg-c3x6-pm3m.json new file mode 100644 index 00000000000..bed7b7303e3 --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-c6rg-c3x6-pm3m/GHSA-c6rg-c3x6-pm3m.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c6rg-c3x6-pm3m", + "modified": "2023-08-25T09:30:21Z", + "published": "2023-08-25T09:30:21Z", + "aliases": [ + "CVE-2023-32591" + ], + "details": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Cloud Primero B.V DBargain plugin <= 3.0.0 versions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32591" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/d-bargain/wordpress-dbargain-plugin-3-0-0-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-fx24-f32v-56xf/GHSA-fx24-f32v-56xf.json b/advisories/unreviewed/2023/08/GHSA-fx24-f32v-56xf/GHSA-fx24-f32v-56xf.json new file mode 100644 index 00000000000..4462974f2c3 --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-fx24-f32v-56xf/GHSA-fx24-f32v-56xf.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fx24-f32v-56xf", + "modified": "2023-08-25T09:30:21Z", + "published": "2023-08-25T09:30:21Z", + "aliases": [ + "CVE-2023-3425" + ], + "details": "Out-of-bounds read issue in M-Files Server versions below 23.8.12892.6 and LTS Service Release Versions before 23.2 LTS SR3 allows unauthenticated user to read restricted amount of bytes from memory.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3425" + }, + { + "type": "WEB", + "url": "https://www.m-files.com/about/trust-center/security-advisories/cve-2023-3425" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-g25q-jw4h-pppq/GHSA-g25q-jw4h-pppq.json b/advisories/unreviewed/2023/08/GHSA-g25q-jw4h-pppq/GHSA-g25q-jw4h-pppq.json new file mode 100644 index 00000000000..3c01e5aecd0 --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-g25q-jw4h-pppq/GHSA-g25q-jw4h-pppq.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g25q-jw4h-pppq", + "modified": "2023-08-25T09:30:21Z", + "published": "2023-08-25T09:30:21Z", + "aliases": [ + "CVE-2023-3406" + ], + "details": "Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read some restricted files on the web server", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3406" + }, + { + "type": "WEB", + "url": "https://www.m-files.com/about/trust-center/security-advisories/cve-2023-3406" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-mx95-7g4v-pppj/GHSA-mx95-7g4v-pppj.json b/advisories/unreviewed/2023/08/GHSA-mx95-7g4v-pppj/GHSA-mx95-7g4v-pppj.json new file mode 100644 index 00000000000..f2f47089444 --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-mx95-7g4v-pppj/GHSA-mx95-7g4v-pppj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mx95-7g4v-pppj", + "modified": "2023-08-25T09:30:20Z", + "published": "2023-08-25T09:30:20Z", + "aliases": [ + "CVE-2023-32755" + ], + "details": "\ne-Excellence U-Office Force generates an error message in webiste service. An unauthenticated remote attacker can obtain partial sensitive system information from error message by sending a crafted command.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32755" + }, + { + "type": "WEB", + "url": "https://www.twcert.org.tw/tw/cp-132-7328-d4112-1.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-209" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/08/GHSA-r9gm-88g3-6g68/GHSA-r9gm-88g3-6g68.json b/advisories/unreviewed/2023/08/GHSA-r9gm-88g3-6g68/GHSA-r9gm-88g3-6g68.json new file mode 100644 index 00000000000..883c1b11f30 --- /dev/null +++ b/advisories/unreviewed/2023/08/GHSA-r9gm-88g3-6g68/GHSA-r9gm-88g3-6g68.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r9gm-88g3-6g68", + "modified": "2023-08-25T09:30:20Z", + "published": "2023-08-25T09:30:20Z", + "aliases": [ + "CVE-2023-41173" + ], + "details": "AdGuard DNS before 2.2 allows remote attackers to cause a denial of service via malformed UDP packets.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41173" + }, + { + "type": "WEB", + "url": "https://adguard-dns.io/en/versions.html#2.2" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": null + } +} \ No newline at end of file