diff --git a/advisories/unreviewed/2024/10/GHSA-2j74-3g9x-9cw4/GHSA-2j74-3g9x-9cw4.json b/advisories/unreviewed/2024/10/GHSA-2j74-3g9x-9cw4/GHSA-2j74-3g9x-9cw4.json new file mode 100644 index 00000000000..351affc301b --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-2j74-3g9x-9cw4/GHSA-2j74-3g9x-9cw4.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2j74-3g9x-9cw4", + "modified": "2024-10-04T12:31:01Z", + "published": "2024-10-04T12:31:01Z", + "aliases": [ + "CVE-2024-47651" + ], + "details": "This vulnerability exists in Shilpi Client Dashboard due to improper handling of multiple parameters in the API endpoint. An authenticated remote attacker could exploit this vulnerability by including multiple “userid” parameters in the API request body leading to unauthorized access of sensitive information belonging to other users.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47651" + }, + { + "type": "WEB", + "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0313" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-235" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-04T12:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-3cv9-jw4h-8r53/GHSA-3cv9-jw4h-8r53.json b/advisories/unreviewed/2024/10/GHSA-3cv9-jw4h-8r53/GHSA-3cv9-jw4h-8r53.json new file mode 100644 index 00000000000..02fe32b4925 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-3cv9-jw4h-8r53/GHSA-3cv9-jw4h-8r53.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3cv9-jw4h-8r53", + "modified": "2024-10-04T12:31:01Z", + "published": "2024-10-04T12:31:01Z", + "aliases": [ + "CVE-2024-9271" + ], + "details": "The Re:WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9271" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3161983" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/rewp/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a7d340b9-6a77-481c-983c-f4774ecff285?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-04T10:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-hrvv-3gc2-4cqx/GHSA-hrvv-3gc2-4cqx.json b/advisories/unreviewed/2024/10/GHSA-hrvv-3gc2-4cqx/GHSA-hrvv-3gc2-4cqx.json new file mode 100644 index 00000000000..bb1da2a80cb --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-hrvv-3gc2-4cqx/GHSA-hrvv-3gc2-4cqx.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hrvv-3gc2-4cqx", + "modified": "2024-10-04T12:31:02Z", + "published": "2024-10-04T12:31:02Z", + "aliases": [ + "CVE-2024-6400" + ], + "details": "Cleartext Storage of Sensitive Information vulnerability in Finrota Netahsilat allows Retrieve Embedded Sensitive Data.This issue solved in versions 1.21.10, 1.23.01, 1.23.08, 1.23.11 and 1.24.03.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6400" + }, + { + "type": "WEB", + "url": "https://www.usom.gov.tr/bildirim/tr-24-1611" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-202" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-04T12:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-w3gv-3c9r-f8pj/GHSA-w3gv-3c9r-f8pj.json b/advisories/unreviewed/2024/10/GHSA-w3gv-3c9r-f8pj/GHSA-w3gv-3c9r-f8pj.json new file mode 100644 index 00000000000..fff797e6c5c --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-w3gv-3c9r-f8pj/GHSA-w3gv-3c9r-f8pj.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w3gv-3c9r-f8pj", + "modified": "2024-10-04T12:31:01Z", + "published": "2024-10-04T12:31:01Z", + "aliases": [ + "CVE-2024-9071" + ], + "details": "The Easy Demo Importer – A Modern One-Click Demo Import Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9071" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3162305" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/easy-demo-importer/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/27a1f457-6bd9-41eb-83e1-cb9e62950041?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-04T10:15:12Z" + } +} \ No newline at end of file