Publish Advisories

GHSA-65hg-r7rx-55rg
GHSA-3pm3-vpvc-2wpp
GHSA-2vj8-5447-hhff
GHSA-8c66-jhqj-4m8f
GHSA-jxg7-pw76-5mph
GHSA-q67q-rg47-hfhr
GHSA-wgr5-rw77-5f6p
GHSA-x5w3-6gq9-8cw8

advisories/unreviewed/2022/05/GHSA-65hg-r7rx-55rg/GHSA-65hg-r7rx-55rg.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-65hg-r7rx-55rg",
-  "modified": "2022-05-24T17:22:07Z",
+  "modified": "2024-10-01T03:30:33Z",
   "published": "2022-05-24T17:22:07Z",
   "aliases": [
     "CVE-2020-15415"
   ],
   "details": "On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
 
@@ -29,7 +32,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-78"
     ],
     "severity": "HIGH",
     "github_reviewed": false,

advisories/unreviewed/2023/03/GHSA-3pm3-vpvc-2wpp/GHSA-3pm3-vpvc-2wpp.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-3pm3-vpvc-2wpp",
-  "modified": "2023-03-21T18:30:20Z",
+  "modified": "2024-10-01T03:30:33Z",
   "published": "2023-03-16T03:30:17Z",
   "aliases": [
     "CVE-2023-25280"

advisories/unreviewed/2024/10/GHSA-2vj8-5447-hhff/GHSA-2vj8-5447-hhff.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2vj8-5447-hhff",
+  "modified": "2024-10-01T03:30:33Z",
+  "published": "2024-10-01T03:30:33Z",
+  "aliases": [
+    "CVE-2024-47396"
+  ],
+  "details": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in moveaddons Move Addons for Elementor allows Stored XSS.This issue affects Move Addons for Elementor: from n/a through 1.3.3.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47396"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/vulnerability/move-addons/wordpress-move-addons-for-elementor-plugin-1-3-3-cross-site-scripting-xss-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-01T02:15:09Z"
+  }
+}

advisories/unreviewed/2024/10/GHSA-8c66-jhqj-4m8f/GHSA-8c66-jhqj-4m8f.json

@@ -0,0 +1,58 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8c66-jhqj-4m8f",
+  "modified": "2024-10-01T03:30:34Z",
+  "published": "2024-10-01T03:30:34Z",
+  "aliases": [
+    "CVE-2024-9360"
+  ],
+  "details": "A vulnerability was found in code-projects Restaurant Reservation System 1.0. It has been classified as critical. This affects an unknown part of the file /updatebal.php. The manipulation of the argument company leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9360"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/halhalz/-/issues/1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://code-projects.org"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.278889"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.278889"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.416058"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-01T03:15:02Z"
+  }
+}

advisories/unreviewed/2024/10/GHSA-jxg7-pw76-5mph/GHSA-jxg7-pw76-5mph.json

@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jxg7-pw76-5mph",
+  "modified": "2024-10-01T03:30:34Z",
+  "published": "2024-10-01T03:30:34Z",
+  "aliases": [
+    "CVE-2024-8981"
+  ],
+  "details": "The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg in /app/admin-notices/features/class-view.php without appropriate escaping on the URL in all versions up to, and including, 2.4.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8981"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/broken-link-checker/tags/2.4.0/app/admin-notices/features/class-view.php#L43"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3159860/broken-link-checker/trunk/app/admin-notices/features/class-view.php"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/429fe34a-5fa9-4032-9b21-4de114dbc9d1?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-80"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-01T03:15:02Z"
+  }
+}

advisories/unreviewed/2024/10/GHSA-q67q-rg47-hfhr/GHSA-q67q-rg47-hfhr.json

@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-q67q-rg47-hfhr",
+  "modified": "2024-10-01T03:30:33Z",
+  "published": "2024-10-01T03:30:33Z",
+  "aliases": [
+    "CVE-2024-47560"
+  ],
+  "details": "RevoWorks Cloud Client 3.0.91 and earlier contains an incorrect authorization vulnerability. If this vulnerability is exploited, unintended processes may be executed in the sandbox environment. Even if malware is executed in the sandbox environment, it does not compromise the client's local environment. However, information in the sandbox environment may be disclosed to outside or behaviors of the sandbox environment may be violated by tampering registry.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47560"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jscom.jp/news-20240918"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jvn.jp/en/jp/JVN39280069"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-863"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-01T02:15:10Z"
+  }
+}

advisories/unreviewed/2024/10/GHSA-wgr5-rw77-5f6p/GHSA-wgr5-rw77-5f6p.json

@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wgr5-rw77-5f6p",
+  "modified": "2024-10-01T03:30:34Z",
+  "published": "2024-10-01T03:30:34Z",
+  "aliases": [
+    "CVE-2024-9358"
+  ],
+  "details": "A vulnerability has been found in ThingsBoard up to 3.7.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component HTTP RPC API. The manipulation leads to resource consumption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 3.7.1 is able to address this issue. It is recommended to upgrade the affected component. The vendor was informed on 2024-07-24 about this vulnerability and announced the release of 3.7.1 for the second half of September 2024.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9358"
+    },
+    {
+      "type": "WEB",
+      "url": "https://1drv.ms/v/s!AksJ421iyCG-mytAcEUF6WqOTwj2?e=6WAp5G"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.278887"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.278887"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.379486"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-400"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-01T02:15:10Z"
+  }
+}

advisories/unreviewed/2024/10/GHSA-x5w3-6gq9-8cw8/GHSA-x5w3-6gq9-8cw8.json

@@ -0,0 +1,58 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-x5w3-6gq9-8cw8",
+  "modified": "2024-10-01T03:30:34Z",
+  "published": "2024-10-01T03:30:34Z",
+  "aliases": [
+    "CVE-2024-9359"
+  ],
+  "details": "A vulnerability was found in code-projects Restaurant Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /addcompany.php. The manipulation of the argument company leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9359"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ppp-src/a/issues/22"
+    },
+    {
+      "type": "WEB",
+      "url": "https://code-projects.org"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.278888"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.278888"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.416041"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-01T02:15:10Z"
+  }
+}