netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-494h-rf5r-q9v4
GHSA-9576-cchc-4f79
GHSA-qgxc-w9wg-wrgc
GHSA-v5f5-7fmg-8vmh
GHSA-wv8p-qvw7-q865
GHSA-wxv5-cmgq-7856
This commit is contained in:
advisory-database[bot]
2024-04-02 06:31:54 +00:00
parent c3b6f56673
commit 770198661d
6 changed files with 239 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/04/GHSA-494h-rf5r-q9v4/GHSA-494h-rf5r-q9v4.json
+46
View File
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-494h-rf5r-q9v4",
"modified": "2024-04-02T06:30:32Z",
"published": "2024-04-02T06:30:32Z",
"aliases": [
"CVE-2024-1504"
],
"details": "The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5.1. This is due to missing or incorrect nonce validation on the secupress_blackhole_ban_ip() function. This makes it possible for unauthenticated attackers to block a user's IP via a forged request granted they can trick the user into performing an action such as clicking on a link.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1504"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/secupress/tags/2.2.5.1/free/modules/sensitive-data/plugins/blackhole.php#L74"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/secupress/trunk/free/modules/sensitive-data/plugins/blackhole.php#L54"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4243bd6d-34f6-4d29-a333-4499a2e2d2e1?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-02T06:15:12Z"
}
}
advisories/unreviewed/2024/04/GHSA-9576-cchc-4f79/GHSA-9576-cchc-4f79.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9576-cchc-4f79",
"modified": "2024-04-02T06:30:32Z",
"published": "2024-04-02T06:30:32Z",
"aliases": [
"CVE-2024-1274"
],
"details": "The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks (depending on the permissions set by the admin)",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1274"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/91dba45b-9930-4bfb-a7bf-903c46864e9f"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-02T06:15:12Z"
}
}
advisories/unreviewed/2024/04/GHSA-qgxc-w9wg-wrgc/GHSA-qgxc-w9wg-wrgc.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qgxc-w9wg-wrgc",
"modified": "2024-04-02T06:30:32Z",
"published": "2024-04-02T06:30:32Z",
"aliases": [
"CVE-2024-2924"
],
"details": "The Creative Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.5.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2924"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3061567%40creative-addons-for-elementor&new=3061567%40creative-addons-for-elementor&sfp_email=&sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33581898-067b-445c-8ad0-12ff4778a13c?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-02T06:15:16Z"
}
}
advisories/unreviewed/2024/04/GHSA-v5f5-7fmg-8vmh/GHSA-v5f5-7fmg-8vmh.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v5f5-7fmg-8vmh",
"modified": "2024-04-02T06:30:31Z",
"published": "2024-04-02T06:30:31Z",
"aliases": [
"CVE-2024-25187"
],
"details": "Server Side Request Forgery (SSRF) vulnerability in 71cms v1.0.0, allows remote unauthenticated attackers to obtain sensitive information via getweather.html.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25187"
},
{
"type": "WEB",
"url": "https://github.com/xiaocheng-keji/71cms/issues/2"
},
{
"type": "WEB",
"url": "https://gist.github.com/wisejayer/d365e93ce09b8a36641165e1d1a0a06c"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-02T04:15:12Z"
}
}
advisories/unreviewed/2024/04/GHSA-wv8p-qvw7-q865/GHSA-wv8p-qvw7-q865.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wv8p-qvw7-q865",
"modified": "2024-04-02T06:30:31Z",
"published": "2024-04-02T06:30:31Z",
"aliases": [
"CVE-2024-2369"
],
"details": "The Page Builder Gutenberg Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2369"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/252dfc35-4c8c-4304-aa09-73dfe986b10d"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-02T05:15:47Z"
}
}
advisories/unreviewed/2024/04/GHSA-wxv5-cmgq-7856/GHSA-wxv5-cmgq-7856.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wxv5-cmgq-7856",
"modified": "2024-04-02T06:30:32Z",
"published": "2024-04-02T06:30:32Z",
"aliases": [
"CVE-2024-2791"
],
"details": "The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 3.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2791"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3061715/metform/trunk/widgets/file-upload/file-upload.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0dad759d-9b44-47ca-8410-e39f65dc919c?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-02T06:15:15Z"
}
}