From 5e335179880e560ce2d2a16fd28c5aefab60f4e9 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 31 Mar 2023 15:32:28 +0000 Subject: [PATCH] Advisory Database Sync --- .../03/GHSA-2679-jq7r-8cph/GHSA-2679-jq7r-8cph.json | 11 +++++++---- .../03/GHSA-3cw2-x5r6-wgmh/GHSA-3cw2-x5r6-wgmh.json | 9 ++++++--- .../03/GHSA-4f9h-qqq9-757g/GHSA-4f9h-qqq9-757g.json | 9 ++++++--- .../03/GHSA-4gx2-hh4v-ff58/GHSA-4gx2-hh4v-ff58.json | 9 ++++++--- .../03/GHSA-57j4-jv54-9h84/GHSA-57j4-jv54-9h84.json | 9 ++++++--- .../03/GHSA-5fhp-99g6-76w9/GHSA-5fhp-99g6-76w9.json | 9 ++++++--- .../03/GHSA-5q57-qq84-cmrj/GHSA-5q57-qq84-cmrj.json | 9 ++++++--- .../03/GHSA-5v6x-2hpj-c37x/GHSA-5v6x-2hpj-c37x.json | 11 +++++++---- .../03/GHSA-5x5j-jprh-hq79/GHSA-5x5j-jprh-hq79.json | 11 +++++++---- .../03/GHSA-6pwr-5329-9r5x/GHSA-6pwr-5329-9r5x.json | 11 +++++++---- .../03/GHSA-9749-2mfq-hv49/GHSA-9749-2mfq-hv49.json | 11 +++++++---- .../03/GHSA-998w-8vh9-h5jv/GHSA-998w-8vh9-h5jv.json | 9 ++++++--- .../03/GHSA-c856-8gm2-wg44/GHSA-c856-8gm2-wg44.json | 9 ++++++--- .../03/GHSA-cj2f-hw54-fc3w/GHSA-cj2f-hw54-fc3w.json | 9 ++++++--- .../03/GHSA-cjfj-jrww-fxv8/GHSA-cjfj-jrww-fxv8.json | 11 +++++++---- .../03/GHSA-f923-fwmg-rmrc/GHSA-f923-fwmg-rmrc.json | 9 ++++++--- .../03/GHSA-fwx3-rcmm-fw46/GHSA-fwx3-rcmm-fw46.json | 11 +++++++---- .../03/GHSA-g5r6-f9g3-94h7/GHSA-g5r6-f9g3-94h7.json | 9 ++++++--- .../03/GHSA-hmjg-5c65-5xmj/GHSA-hmjg-5c65-5xmj.json | 9 ++++++--- .../03/GHSA-m2q7-9c76-qc45/GHSA-m2q7-9c76-qc45.json | 4 ++++ .../03/GHSA-m5h2-j2j6-cwcw/GHSA-m5h2-j2j6-cwcw.json | 11 +++++++---- .../03/GHSA-m9ch-6hh2-gc9w/GHSA-m9ch-6hh2-gc9w.json | 10 +++++++--- .../03/GHSA-mp9p-qpqf-4w9m/GHSA-mp9p-qpqf-4w9m.json | 9 ++++++--- .../03/GHSA-p59f-7fgp-vr9r/GHSA-p59f-7fgp-vr9r.json | 11 +++++++---- .../03/GHSA-wvv8-m353-pjr5/GHSA-wvv8-m353-pjr5.json | 9 ++++++--- .../03/GHSA-xp2v-4hm2-2465/GHSA-xp2v-4hm2-2465.json | 9 ++++++--- .../03/GHSA-xwgw-v6c7-94g3/GHSA-xwgw-v6c7-94g3.json | 9 ++++++--- .../03/GHSA-xxch-mf4j-qcvj/GHSA-xxch-mf4j-qcvj.json | 11 +++++++---- 28 files changed, 177 insertions(+), 91 deletions(-) diff --git a/advisories/unreviewed/2023/03/GHSA-2679-jq7r-8cph/GHSA-2679-jq7r-8cph.json b/advisories/unreviewed/2023/03/GHSA-2679-jq7r-8cph/GHSA-2679-jq7r-8cph.json index 27aff444245..134da7c70ce 100644 --- a/advisories/unreviewed/2023/03/GHSA-2679-jq7r-8cph/GHSA-2679-jq7r-8cph.json +++ b/advisories/unreviewed/2023/03/GHSA-2679-jq7r-8cph/GHSA-2679-jq7r-8cph.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-2679-jq7r-8cph", - "modified": "2023-03-27T21:30:25Z", + "modified": "2023-03-31T15:30:17Z", "published": "2023-03-27T21:30:25Z", "aliases": [ "CVE-2023-1079" ], "details": "A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious USB device, which advertises itself as an Asus device. Similarly to the previous known CVE-2023-25012, but in asus devices, the work_struct may be scheduled by the LED controller while the device is disconnecting, triggering a use-after-free on the struct asus_kbd_leds *led structure. A malicious USB device may exploit the issue to cause memory corruption with controlled data.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T21:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-3cw2-x5r6-wgmh/GHSA-3cw2-x5r6-wgmh.json b/advisories/unreviewed/2023/03/GHSA-3cw2-x5r6-wgmh/GHSA-3cw2-x5r6-wgmh.json index 4bfc1d3ad6c..452d27d79d1 100644 --- a/advisories/unreviewed/2023/03/GHSA-3cw2-x5r6-wgmh/GHSA-3cw2-x5r6-wgmh.json +++ b/advisories/unreviewed/2023/03/GHSA-3cw2-x5r6-wgmh/GHSA-3cw2-x5r6-wgmh.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-3cw2-x5r6-wgmh", - "modified": "2023-03-27T18:30:26Z", + "modified": "2023-03-31T15:30:18Z", "published": "2023-03-27T18:30:26Z", "aliases": [ "CVE-2023-1400" ], "details": "The Modern Events Calendar Lite WordPress plugin through 5.16.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T16:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-4f9h-qqq9-757g/GHSA-4f9h-qqq9-757g.json b/advisories/unreviewed/2023/03/GHSA-4f9h-qqq9-757g/GHSA-4f9h-qqq9-757g.json index 114ceab05f9..2ed239c3724 100644 --- a/advisories/unreviewed/2023/03/GHSA-4f9h-qqq9-757g/GHSA-4f9h-qqq9-757g.json +++ b/advisories/unreviewed/2023/03/GHSA-4f9h-qqq9-757g/GHSA-4f9h-qqq9-757g.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-4f9h-qqq9-757g", - "modified": "2023-03-28T12:30:19Z", + "modified": "2023-03-31T15:30:18Z", "published": "2023-03-28T12:30:19Z", "aliases": [ "CVE-2023-25197" ], "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation apache fineract. Authorized users may be able to exploit this for limited impact on components. This issue affects apache fineract: from 1.4 through 1.8.2.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ "CWE-89" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-28T12:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-4gx2-hh4v-ff58/GHSA-4gx2-hh4v-ff58.json b/advisories/unreviewed/2023/03/GHSA-4gx2-hh4v-ff58/GHSA-4gx2-hh4v-ff58.json index 64b0abecca0..97e32ea0d84 100644 --- a/advisories/unreviewed/2023/03/GHSA-4gx2-hh4v-ff58/GHSA-4gx2-hh4v-ff58.json +++ b/advisories/unreviewed/2023/03/GHSA-4gx2-hh4v-ff58/GHSA-4gx2-hh4v-ff58.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-4gx2-hh4v-ff58", - "modified": "2023-03-27T18:30:25Z", + "modified": "2023-03-31T15:30:18Z", "published": "2023-03-27T18:30:25Z", "aliases": [ "CVE-2023-0495" ], "details": "The HT Slider For Elementor WordPress plugin before 1.4.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ "CWE-352" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T16:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-57j4-jv54-9h84/GHSA-57j4-jv54-9h84.json b/advisories/unreviewed/2023/03/GHSA-57j4-jv54-9h84/GHSA-57j4-jv54-9h84.json index 3441af69044..6860ce77cf1 100644 --- a/advisories/unreviewed/2023/03/GHSA-57j4-jv54-9h84/GHSA-57j4-jv54-9h84.json +++ b/advisories/unreviewed/2023/03/GHSA-57j4-jv54-9h84/GHSA-57j4-jv54-9h84.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-57j4-jv54-9h84", - "modified": "2023-03-23T18:30:19Z", + "modified": "2023-03-31T15:30:17Z", "published": "2023-03-23T18:30:19Z", "aliases": [ "CVE-2023-20072" ], "details": "A vulnerability in the fragmentation handling code of tunnel protocol packets in Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected system to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to the improper handling of large fragmented tunnel protocol packets. One example of a tunnel protocol is Generic Routing Encapsulation (GRE). An attacker could exploit this vulnerability by sending crafted fragmented packets to an affected system. A successful exploit could allow the attacker to cause the affected system to reload, resulting in a DoS condition. Note: Only traffic directed to the affected system can be used to exploit this vulnerability.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-23T17:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-5fhp-99g6-76w9/GHSA-5fhp-99g6-76w9.json b/advisories/unreviewed/2023/03/GHSA-5fhp-99g6-76w9/GHSA-5fhp-99g6-76w9.json index 3e02e5bd73d..b1a69316e9a 100644 --- a/advisories/unreviewed/2023/03/GHSA-5fhp-99g6-76w9/GHSA-5fhp-99g6-76w9.json +++ b/advisories/unreviewed/2023/03/GHSA-5fhp-99g6-76w9/GHSA-5fhp-99g6-76w9.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5fhp-99g6-76w9", - "modified": "2023-03-27T18:30:26Z", + "modified": "2023-03-31T15:30:17Z", "published": "2023-03-27T18:30:26Z", "aliases": [ "CVE-2023-0504" ], "details": "The HT Politic WordPress plugin before 2.3.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ "CWE-352" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T16:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-5q57-qq84-cmrj/GHSA-5q57-qq84-cmrj.json b/advisories/unreviewed/2023/03/GHSA-5q57-qq84-cmrj/GHSA-5q57-qq84-cmrj.json index 4c1c5a81bbb..5dcec223168 100644 --- a/advisories/unreviewed/2023/03/GHSA-5q57-qq84-cmrj/GHSA-5q57-qq84-cmrj.json +++ b/advisories/unreviewed/2023/03/GHSA-5q57-qq84-cmrj/GHSA-5q57-qq84-cmrj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5q57-qq84-cmrj", - "modified": "2023-03-27T18:30:26Z", + "modified": "2023-03-31T15:30:17Z", "published": "2023-03-27T18:30:26Z", "aliases": [ "CVE-2023-0503" ], "details": "The Free WooCommerce Theme 99fy Extension WordPress plugin before 1.2.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ "CWE-352" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T16:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-5v6x-2hpj-c37x/GHSA-5v6x-2hpj-c37x.json b/advisories/unreviewed/2023/03/GHSA-5v6x-2hpj-c37x/GHSA-5v6x-2hpj-c37x.json index 5cba10dc015..be19e19c513 100644 --- a/advisories/unreviewed/2023/03/GHSA-5v6x-2hpj-c37x/GHSA-5v6x-2hpj-c37x.json +++ b/advisories/unreviewed/2023/03/GHSA-5v6x-2hpj-c37x/GHSA-5v6x-2hpj-c37x.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5v6x-2hpj-c37x", - "modified": "2023-03-27T21:30:26Z", + "modified": "2023-03-31T15:30:17Z", "published": "2023-03-27T21:30:26Z", "aliases": [ "CVE-2023-0494" ], "details": "A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-416" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T21:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-5x5j-jprh-hq79/GHSA-5x5j-jprh-hq79.json b/advisories/unreviewed/2023/03/GHSA-5x5j-jprh-hq79/GHSA-5x5j-jprh-hq79.json index 68b29a1e607..a664e6eb56c 100644 --- a/advisories/unreviewed/2023/03/GHSA-5x5j-jprh-hq79/GHSA-5x5j-jprh-hq79.json +++ b/advisories/unreviewed/2023/03/GHSA-5x5j-jprh-hq79/GHSA-5x5j-jprh-hq79.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-5x5j-jprh-hq79", - "modified": "2023-03-27T21:30:26Z", + "modified": "2023-03-31T15:30:18Z", "published": "2023-03-27T21:30:26Z", "aliases": [ "CVE-2023-22300" ], "details": "An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unauthorized actions by viewing the logs. This action would also grant the attacker privilege escalation.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T20:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-6pwr-5329-9r5x/GHSA-6pwr-5329-9r5x.json b/advisories/unreviewed/2023/03/GHSA-6pwr-5329-9r5x/GHSA-6pwr-5329-9r5x.json index ae055e0855a..0dc68b83583 100644 --- a/advisories/unreviewed/2023/03/GHSA-6pwr-5329-9r5x/GHSA-6pwr-5329-9r5x.json +++ b/advisories/unreviewed/2023/03/GHSA-6pwr-5329-9r5x/GHSA-6pwr-5329-9r5x.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-6pwr-5329-9r5x", - "modified": "2023-03-24T21:30:53Z", + "modified": "2023-03-31T15:30:20Z", "published": "2023-03-24T21:30:53Z", "aliases": [ "CVE-2023-21062" ], "details": "In DoSetTempEcc of imsservice.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-243376770References: N/A", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-125" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-24T20:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-9749-2mfq-hv49/GHSA-9749-2mfq-hv49.json b/advisories/unreviewed/2023/03/GHSA-9749-2mfq-hv49/GHSA-9749-2mfq-hv49.json index 316225a32a0..54fa906e78b 100644 --- a/advisories/unreviewed/2023/03/GHSA-9749-2mfq-hv49/GHSA-9749-2mfq-hv49.json +++ b/advisories/unreviewed/2023/03/GHSA-9749-2mfq-hv49/GHSA-9749-2mfq-hv49.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9749-2mfq-hv49", - "modified": "2023-03-24T06:30:16Z", + "modified": "2023-03-31T15:30:19Z", "published": "2023-03-24T06:30:16Z", "aliases": [ "CVE-2023-28818" ], "details": "An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and result in a customer installing unauthentic components. A malicious actor could install rogue Collector executable files (aptare.jar or upgrademanager.zip) on the Portal server, which might then be downloaded and installed on collectors.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-347" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-24T04:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-998w-8vh9-h5jv/GHSA-998w-8vh9-h5jv.json b/advisories/unreviewed/2023/03/GHSA-998w-8vh9-h5jv/GHSA-998w-8vh9-h5jv.json index 05bd675a90d..6e39d6eb125 100644 --- a/advisories/unreviewed/2023/03/GHSA-998w-8vh9-h5jv/GHSA-998w-8vh9-h5jv.json +++ b/advisories/unreviewed/2023/03/GHSA-998w-8vh9-h5jv/GHSA-998w-8vh9-h5jv.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-998w-8vh9-h5jv", - "modified": "2023-03-28T00:34:28Z", + "modified": "2023-03-31T15:30:18Z", "published": "2023-03-28T00:34:28Z", "aliases": [ "CVE-2022-48357" ], "details": "Some products have the double fetch vulnerability. Successful exploitation of this vulnerability may cause denial of service (DoS) attacks to the kernel.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T22:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-c856-8gm2-wg44/GHSA-c856-8gm2-wg44.json b/advisories/unreviewed/2023/03/GHSA-c856-8gm2-wg44/GHSA-c856-8gm2-wg44.json index a01739971e2..f41a3f07160 100644 --- a/advisories/unreviewed/2023/03/GHSA-c856-8gm2-wg44/GHSA-c856-8gm2-wg44.json +++ b/advisories/unreviewed/2023/03/GHSA-c856-8gm2-wg44/GHSA-c856-8gm2-wg44.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-c856-8gm2-wg44", - "modified": "2023-03-28T12:30:19Z", + "modified": "2023-03-31T15:30:18Z", "published": "2023-03-28T12:30:19Z", "aliases": [ "CVE-2023-25195" ], "details": "Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract. Authorized users with limited permissions can gain access to server and may be able to use server for any outbound traffic. This issue affects Apache Fineract: from 1.4 through 1.8.3.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ "CWE-918" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-28T12:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-cj2f-hw54-fc3w/GHSA-cj2f-hw54-fc3w.json b/advisories/unreviewed/2023/03/GHSA-cj2f-hw54-fc3w/GHSA-cj2f-hw54-fc3w.json index 5e89e0d2535..b50775c762d 100644 --- a/advisories/unreviewed/2023/03/GHSA-cj2f-hw54-fc3w/GHSA-cj2f-hw54-fc3w.json +++ b/advisories/unreviewed/2023/03/GHSA-cj2f-hw54-fc3w/GHSA-cj2f-hw54-fc3w.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-cj2f-hw54-fc3w", - "modified": "2023-03-27T18:30:26Z", + "modified": "2023-03-31T15:30:16Z", "published": "2023-03-27T18:30:26Z", "aliases": [ "CVE-2023-0589" ], "details": "The WP Image Carousel WordPress plugin through 1.0.2 does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T16:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-cjfj-jrww-fxv8/GHSA-cjfj-jrww-fxv8.json b/advisories/unreviewed/2023/03/GHSA-cjfj-jrww-fxv8/GHSA-cjfj-jrww-fxv8.json index 17b7d3018f2..1e2cd1660c0 100644 --- a/advisories/unreviewed/2023/03/GHSA-cjfj-jrww-fxv8/GHSA-cjfj-jrww-fxv8.json +++ b/advisories/unreviewed/2023/03/GHSA-cjfj-jrww-fxv8/GHSA-cjfj-jrww-fxv8.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-cjfj-jrww-fxv8", - "modified": "2023-03-27T21:30:26Z", + "modified": "2023-03-31T15:30:18Z", "published": "2023-03-27T21:30:26Z", "aliases": [ "CVE-2023-27927" ], "details": "An authenticated malicious user could acquire the simple mail transfer protocol (SMTP) Password in cleartext format, despite it being protected and hidden behind asterisks. The attacker could then perform further attacks using the SMTP credentials.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-319" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T20:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-f923-fwmg-rmrc/GHSA-f923-fwmg-rmrc.json b/advisories/unreviewed/2023/03/GHSA-f923-fwmg-rmrc/GHSA-f923-fwmg-rmrc.json index 65a981b1d51..745720ec0f6 100644 --- a/advisories/unreviewed/2023/03/GHSA-f923-fwmg-rmrc/GHSA-f923-fwmg-rmrc.json +++ b/advisories/unreviewed/2023/03/GHSA-f923-fwmg-rmrc/GHSA-f923-fwmg-rmrc.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-f923-fwmg-rmrc", - "modified": "2023-03-27T18:30:26Z", + "modified": "2023-03-31T15:30:18Z", "published": "2023-03-27T18:30:26Z", "aliases": [ "CVE-2023-0823" ], "details": "The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.4.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T16:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-fwx3-rcmm-fw46/GHSA-fwx3-rcmm-fw46.json b/advisories/unreviewed/2023/03/GHSA-fwx3-rcmm-fw46/GHSA-fwx3-rcmm-fw46.json index b334cdac465..9f07b13489d 100644 --- a/advisories/unreviewed/2023/03/GHSA-fwx3-rcmm-fw46/GHSA-fwx3-rcmm-fw46.json +++ b/advisories/unreviewed/2023/03/GHSA-fwx3-rcmm-fw46/GHSA-fwx3-rcmm-fw46.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-fwx3-rcmm-fw46", - "modified": "2023-03-27T21:30:26Z", + "modified": "2023-03-31T15:30:18Z", "published": "2023-03-27T21:30:26Z", "aliases": [ "CVE-2023-28655" ], "details": "A malicious user could leverage this vulnerability to escalate privileges or perform unauthorized actions in the context of the targeted privileged users.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T20:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-g5r6-f9g3-94h7/GHSA-g5r6-f9g3-94h7.json b/advisories/unreviewed/2023/03/GHSA-g5r6-f9g3-94h7/GHSA-g5r6-f9g3-94h7.json index fcf03ba86d3..8478867d149 100644 --- a/advisories/unreviewed/2023/03/GHSA-g5r6-f9g3-94h7/GHSA-g5r6-f9g3-94h7.json +++ b/advisories/unreviewed/2023/03/GHSA-g5r6-f9g3-94h7/GHSA-g5r6-f9g3-94h7.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-g5r6-f9g3-94h7", - "modified": "2023-03-27T18:30:25Z", + "modified": "2023-03-31T15:30:18Z", "published": "2023-03-27T18:30:25Z", "aliases": [ "CVE-2023-0497" ], "details": "The HT Portfolio WordPress plugin before 1.1.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ "CWE-352" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T16:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-hmjg-5c65-5xmj/GHSA-hmjg-5c65-5xmj.json b/advisories/unreviewed/2023/03/GHSA-hmjg-5c65-5xmj/GHSA-hmjg-5c65-5xmj.json index ffc03fc9451..be4c8265c35 100644 --- a/advisories/unreviewed/2023/03/GHSA-hmjg-5c65-5xmj/GHSA-hmjg-5c65-5xmj.json +++ b/advisories/unreviewed/2023/03/GHSA-hmjg-5c65-5xmj/GHSA-hmjg-5c65-5xmj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-hmjg-5c65-5xmj", - "modified": "2023-03-27T18:30:25Z", + "modified": "2023-03-31T15:30:18Z", "published": "2023-03-27T18:30:25Z", "aliases": [ "CVE-2023-0499" ], "details": "The QuickSwish WordPress plugin before 1.1.0 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ "CWE-352" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T16:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-m2q7-9c76-qc45/GHSA-m2q7-9c76-qc45.json b/advisories/unreviewed/2023/03/GHSA-m2q7-9c76-qc45/GHSA-m2q7-9c76-qc45.json index ee58f6bca34..965799d0972 100644 --- a/advisories/unreviewed/2023/03/GHSA-m2q7-9c76-qc45/GHSA-m2q7-9c76-qc45.json +++ b/advisories/unreviewed/2023/03/GHSA-m2q7-9c76-qc45/GHSA-m2q7-9c76-qc45.json @@ -29,6 +29,10 @@ { "type": "WEB", "url": "https://www.fortinet.com/blog/threat-research/3cx-desktop-app-compromised" + }, + { + "type": "WEB", + "url": "https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats" } ], "database_specific": { diff --git a/advisories/unreviewed/2023/03/GHSA-m5h2-j2j6-cwcw/GHSA-m5h2-j2j6-cwcw.json b/advisories/unreviewed/2023/03/GHSA-m5h2-j2j6-cwcw/GHSA-m5h2-j2j6-cwcw.json index f523ef9216b..a62e41cc573 100644 --- a/advisories/unreviewed/2023/03/GHSA-m5h2-j2j6-cwcw/GHSA-m5h2-j2j6-cwcw.json +++ b/advisories/unreviewed/2023/03/GHSA-m5h2-j2j6-cwcw/GHSA-m5h2-j2j6-cwcw.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-m5h2-j2j6-cwcw", - "modified": "2023-03-23T18:30:18Z", + "modified": "2023-03-31T15:30:19Z", "published": "2023-03-23T18:30:18Z", "aliases": [ "CVE-2023-20080" ], "details": "A vulnerability in the IPv6 DHCP version 6 (DHCPv6) relay and server features of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to trigger a denial of service (DoS) condition. This vulnerability is due to insufficient validation of data boundaries. An attacker could exploit this vulnerability by sending crafted DHCPv6 messages to an affected device. A successful exploit could allow the attacker to cause the device to reload unexpectedly.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-129" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-23T17:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-m9ch-6hh2-gc9w/GHSA-m9ch-6hh2-gc9w.json b/advisories/unreviewed/2023/03/GHSA-m9ch-6hh2-gc9w/GHSA-m9ch-6hh2-gc9w.json index 2a727c221c9..faf80418680 100644 --- a/advisories/unreviewed/2023/03/GHSA-m9ch-6hh2-gc9w/GHSA-m9ch-6hh2-gc9w.json +++ b/advisories/unreviewed/2023/03/GHSA-m9ch-6hh2-gc9w/GHSA-m9ch-6hh2-gc9w.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-m9ch-6hh2-gc9w", - "modified": "2023-03-27T18:30:26Z", + "modified": "2023-03-31T15:30:18Z", "published": "2023-03-27T18:30:26Z", "aliases": [ "CVE-2023-0816" ], "details": "The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" + } ], "affected": [ @@ -25,9 +28,10 @@ ], "database_specific": { "cwe_ids": [ + "CWE-290", "CWE-639" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T16:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-mp9p-qpqf-4w9m/GHSA-mp9p-qpqf-4w9m.json b/advisories/unreviewed/2023/03/GHSA-mp9p-qpqf-4w9m/GHSA-mp9p-qpqf-4w9m.json index 6b829da97dc..20dd7227185 100644 --- a/advisories/unreviewed/2023/03/GHSA-mp9p-qpqf-4w9m/GHSA-mp9p-qpqf-4w9m.json +++ b/advisories/unreviewed/2023/03/GHSA-mp9p-qpqf-4w9m/GHSA-mp9p-qpqf-4w9m.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mp9p-qpqf-4w9m", - "modified": "2023-03-27T18:30:25Z", + "modified": "2023-03-31T15:30:18Z", "published": "2023-03-27T18:30:25Z", "aliases": [ "CVE-2023-0498" ], "details": "The WP Education WordPress plugin before 1.2.7 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ "CWE-352" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T16:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-p59f-7fgp-vr9r/GHSA-p59f-7fgp-vr9r.json b/advisories/unreviewed/2023/03/GHSA-p59f-7fgp-vr9r/GHSA-p59f-7fgp-vr9r.json index 9eb98d9138c..959a1cdeab0 100644 --- a/advisories/unreviewed/2023/03/GHSA-p59f-7fgp-vr9r/GHSA-p59f-7fgp-vr9r.json +++ b/advisories/unreviewed/2023/03/GHSA-p59f-7fgp-vr9r/GHSA-p59f-7fgp-vr9r.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-p59f-7fgp-vr9r", - "modified": "2023-03-27T21:30:26Z", + "modified": "2023-03-31T15:30:18Z", "published": "2023-03-27T21:30:26Z", "aliases": [ "CVE-2023-28652" ], "details": "An authenticated malicious user could successfully upload a malicious image could lead to a denial-of-service condition.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-434" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T20:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-wvv8-m353-pjr5/GHSA-wvv8-m353-pjr5.json b/advisories/unreviewed/2023/03/GHSA-wvv8-m353-pjr5/GHSA-wvv8-m353-pjr5.json index c24826d9316..dd5eed43571 100644 --- a/advisories/unreviewed/2023/03/GHSA-wvv8-m353-pjr5/GHSA-wvv8-m353-pjr5.json +++ b/advisories/unreviewed/2023/03/GHSA-wvv8-m353-pjr5/GHSA-wvv8-m353-pjr5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-wvv8-m353-pjr5", - "modified": "2023-03-28T12:30:19Z", + "modified": "2023-03-31T15:30:18Z", "published": "2023-03-28T12:30:19Z", "aliases": [ "CVE-2023-25196" ], "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache Fineract. Authorized users may be able to change or add data in certain components. This issue affects Apache Fineract: from 1.4 through 1.8.2.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ "CWE-89" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-28T12:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-xp2v-4hm2-2465/GHSA-xp2v-4hm2-2465.json b/advisories/unreviewed/2023/03/GHSA-xp2v-4hm2-2465/GHSA-xp2v-4hm2-2465.json index f6322385acb..1ba35a12e33 100644 --- a/advisories/unreviewed/2023/03/GHSA-xp2v-4hm2-2465/GHSA-xp2v-4hm2-2465.json +++ b/advisories/unreviewed/2023/03/GHSA-xp2v-4hm2-2465/GHSA-xp2v-4hm2-2465.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-xp2v-4hm2-2465", - "modified": "2023-03-27T18:30:26Z", + "modified": "2023-03-31T15:30:16Z", "published": "2023-03-27T18:30:26Z", "aliases": [ "CVE-2023-0505" ], "details": "The Ever Compare WordPress plugin through 1.2.3 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ "CWE-352" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T16:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-xwgw-v6c7-94g3/GHSA-xwgw-v6c7-94g3.json b/advisories/unreviewed/2023/03/GHSA-xwgw-v6c7-94g3/GHSA-xwgw-v6c7-94g3.json index a84c152d426..5fd7c42a38c 100644 --- a/advisories/unreviewed/2023/03/GHSA-xwgw-v6c7-94g3/GHSA-xwgw-v6c7-94g3.json +++ b/advisories/unreviewed/2023/03/GHSA-xwgw-v6c7-94g3/GHSA-xwgw-v6c7-94g3.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-xwgw-v6c7-94g3", - "modified": "2023-03-27T18:30:25Z", + "modified": "2023-03-31T15:30:18Z", "published": "2023-03-27T18:30:25Z", "aliases": [ "CVE-2023-0496" ], "details": "The HT Event WordPress plugin before 1.4.6 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ "CWE-352" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-27T16:15:00Z" diff --git a/advisories/unreviewed/2023/03/GHSA-xxch-mf4j-qcvj/GHSA-xxch-mf4j-qcvj.json b/advisories/unreviewed/2023/03/GHSA-xxch-mf4j-qcvj/GHSA-xxch-mf4j-qcvj.json index 44e20a14960..45fc5bf81f7 100644 --- a/advisories/unreviewed/2023/03/GHSA-xxch-mf4j-qcvj/GHSA-xxch-mf4j-qcvj.json +++ b/advisories/unreviewed/2023/03/GHSA-xxch-mf4j-qcvj/GHSA-xxch-mf4j-qcvj.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-xxch-mf4j-qcvj", - "modified": "2023-03-24T06:30:16Z", + "modified": "2023-03-31T15:30:19Z", "published": "2023-03-24T06:30:16Z", "aliases": [ "CVE-2023-28686" ], "details": "Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 allows attackers to modify the personal bookmark store via a crafted message. The attacker can change the display of group chats or force a victim to join a group chat; the victim may then be tricked into disclosing sensitive information.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-639" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-03-24T04:15:00Z"