Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-01-02 21:31:38 +00:00
parent 433cf211c4
commit 6200c3c556
41 changed files with 637 additions and 75 deletions
@@ -44,7 +44,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-203"
+      "CWE-203",
+      "CWE-204"
    ],
    "severity": "MODERATE",
    "github_reviewed": false,
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9c8q-55w7-h67h",
-  "modified": "2023-07-14T00:30:32Z",
+  "modified": "2024-01-02T21:30:23Z",
  "published": "2023-07-10T18:30:47Z",
  "aliases": [
    "CVE-2021-42083"
@@ -42,7 +42,7 @@
    "cwe_ids": [
      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-10T16:15:47Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-9qrw-74hf-7jc5",
-  "modified": "2023-11-07T21:30:24Z",
+  "modified": "2024-01-02T21:30:24Z",
  "published": "2023-11-07T21:30:24Z",
  "aliases": [
    "CVE-2023-46676"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-24wq-mq98-wpxw",
-  "modified": "2023-12-26T09:30:20Z",
+  "modified": "2024-01-02T21:30:25Z",
  "published": "2023-12-26T09:30:20Z",
  "aliases": [
    "CVE-2023-47215"
  ],
  "details": "Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-26T08:15:10Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-28f3-rf96-2vvg",
-  "modified": "2023-12-22T00:30:32Z",
+  "modified": "2024-01-02T21:30:25Z",
  "published": "2023-12-22T00:30:32Z",
  "aliases": [
    "CVE-2023-49687"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-3f78-m5wq-gp55",
-  "modified": "2023-12-22T06:30:26Z",
+  "modified": "2024-01-02T21:30:25Z",
  "published": "2023-12-22T06:30:26Z",
  "aliases": [
    "CVE-2022-47532"
  ],
  "details": "FileRun 20220519 allows SQL Injection via the \"dir\" parameter in a /?module=users&section=cpanel&page=list request.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-89"
    ],
-    "severity": null,
+    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-22T04:15:08Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-454w-g337-r9mr",
-  "modified": "2023-12-22T00:30:32Z",
+  "modified": "2024-01-02T21:30:25Z",
  "published": "2023-12-22T00:30:32Z",
  "aliases": [
    "CVE-2023-49684"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5c4q-4rqx-7fcj",
-  "modified": "2023-12-26T21:30:33Z",
+  "modified": "2024-01-02T21:30:25Z",
  "published": "2023-12-26T21:30:33Z",
  "aliases": [
    "CVE-2023-5991"
  ],
  "details": "The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-22"
    ],
-    "severity": null,
+    "severity": "CRITICAL",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-26T19:15:08Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-5w24-985v-p9c2",
-  "modified": "2023-12-26T09:30:20Z",
+  "modified": "2024-01-02T21:30:25Z",
  "published": "2023-12-26T09:30:20Z",
  "aliases": [
    "CVE-2023-49779"
  ],
  "details": "Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-26T08:15:11Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-6f93-6gw8-j4vp",
-  "modified": "2023-12-26T09:30:20Z",
+  "modified": "2024-01-02T21:30:25Z",
  "published": "2023-12-26T09:30:20Z",
  "aliases": [
    "CVE-2023-50339"
  ],
  "details": "Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-26T08:15:11Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7qcr-xmc4-f534",
-  "modified": "2023-12-26T09:30:20Z",
+  "modified": "2024-01-02T21:30:25Z",
  "published": "2023-12-26T09:30:20Z",
  "aliases": [
    "CVE-2023-49598"
  ],
  "details": "Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-26T08:15:10Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-89ff-5hgp-6w8j",
-  "modified": "2023-12-26T09:30:20Z",
+  "modified": "2024-01-02T21:30:25Z",
  "published": "2023-12-26T09:30:20Z",
  "aliases": [
    "CVE-2023-50294"
  ],
  "details": "The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-312"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-26T08:15:11Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8fxj-9pc3-pv45",
-  "modified": "2023-12-26T21:30:33Z",
+  "modified": "2024-01-02T21:30:25Z",
  "published": "2023-12-26T21:30:33Z",
  "aliases": [
    "CVE-2023-6166"
  ],
  "details": "The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-26T19:15:08Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-8w6w-7w4r-fv62",
-  "modified": "2023-12-26T21:30:33Z",
+  "modified": "2024-01-02T21:30:25Z",
  "published": "2023-12-26T21:30:33Z",
  "aliases": [
    "CVE-2023-6250"
  ],
  "details": "The BestWebSoft's Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-312"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-26T19:15:08Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-92jj-pmcg-vv48",
-  "modified": "2023-12-26T21:30:33Z",
+  "modified": "2024-01-02T21:30:25Z",
  "published": "2023-12-26T21:30:33Z",
  "aliases": [
    "CVE-2023-6155"
  ],
  "details": "The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacker to perform a search for users of the system, ultimately leaking user email addresses.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-287"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-26T19:15:08Z"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-c568-8x7p-64q6",
-  "modified": "2023-12-26T21:30:33Z",
+  "modified": "2024-01-02T21:30:25Z",
  "published": "2023-12-26T21:30:33Z",
  "aliases": [
    "CVE-2023-5203"
  ],
  "details": "The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -25,9 +28,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-89"
    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-26T19:15:07Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-f7j7-68hw-w26q",
-  "modified": "2023-12-21T15:30:32Z",
+  "modified": "2024-01-02T21:30:24Z",
  "published": "2023-12-21T15:30:32Z",
  "aliases": [
    "CVE-2023-50822"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-fmgf-v4r6-qv5c",
-  "modified": "2023-12-22T00:30:31Z",
+  "modified": "2024-01-02T21:30:24Z",
  "published": "2023-12-22T00:30:31Z",
  "aliases": [
    "CVE-2023-49678"
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-g845-grc9-p9qg",
-  "modified": "2023-12-26T09:30:20Z",
+  "modified": "2024-01-02T21:30:25Z",
  "published": "2023-12-26T09:30:20Z",
  "aliases": [
    "CVE-2023-50175"
  ],
  "details": "Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/customize) page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+    }
  ],
  "affected": [

@@ -29,9 +32,9 @@
  ],
  "database_specific": {
    "cwe_ids": [
-
+      "CWE-79"
    ],
-    "severity": null,
+    "severity": "MODERATE",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-26T08:15:11Z"
@@ -1,7 +1,7 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-j7x5-j8m5-25w4",
-  "modified": "2023-12-22T00:30:31Z",
+  "modified": "2024-01-02T21:30:24Z",
  "published": "2023-12-22T00:30:31Z",
  "aliases": [
    "CVE-2023-49680"
--- a/Show More
+++ b/Show More