diff --git a/advisories/unreviewed/2024/04/GHSA-494h-rf5r-q9v4/GHSA-494h-rf5r-q9v4.json b/advisories/unreviewed/2024/04/GHSA-494h-rf5r-q9v4/GHSA-494h-rf5r-q9v4.json new file mode 100644 index 00000000000..37b69d5b3d0 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-494h-rf5r-q9v4/GHSA-494h-rf5r-q9v4.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-494h-rf5r-q9v4", + "modified": "2024-04-02T06:30:32Z", + "published": "2024-04-02T06:30:32Z", + "aliases": [ + "CVE-2024-1504" + ], + "details": "The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5.1. This is due to missing or incorrect nonce validation on the secupress_blackhole_ban_ip() function. This makes it possible for unauthenticated attackers to block a user's IP via a forged request granted they can trick the user into performing an action such as clicking on a link.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1504" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/secupress/tags/2.2.5.1/free/modules/sensitive-data/plugins/blackhole.php#L74" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/secupress/trunk/free/modules/sensitive-data/plugins/blackhole.php#L54" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4243bd6d-34f6-4d29-a333-4499a2e2d2e1?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T06:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-9576-cchc-4f79/GHSA-9576-cchc-4f79.json b/advisories/unreviewed/2024/04/GHSA-9576-cchc-4f79/GHSA-9576-cchc-4f79.json new file mode 100644 index 00000000000..75838ef700c --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-9576-cchc-4f79/GHSA-9576-cchc-4f79.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9576-cchc-4f79", + "modified": "2024-04-02T06:30:32Z", + "published": "2024-04-02T06:30:32Z", + "aliases": [ + "CVE-2024-1274" + ], + "details": "The My Calendar WordPress plugin before 3.4.24 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks (depending on the permissions set by the admin)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1274" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/91dba45b-9930-4bfb-a7bf-903c46864e9f" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T06:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-qgxc-w9wg-wrgc/GHSA-qgxc-w9wg-wrgc.json b/advisories/unreviewed/2024/04/GHSA-qgxc-w9wg-wrgc/GHSA-qgxc-w9wg-wrgc.json new file mode 100644 index 00000000000..8fb2fff61f5 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-qgxc-w9wg-wrgc/GHSA-qgxc-w9wg-wrgc.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qgxc-w9wg-wrgc", + "modified": "2024-04-02T06:30:32Z", + "published": "2024-04-02T06:30:32Z", + "aliases": [ + "CVE-2024-2924" + ], + "details": "The Creative Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.5.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2924" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3061567%40creative-addons-for-elementor&new=3061567%40creative-addons-for-elementor&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33581898-067b-445c-8ad0-12ff4778a13c?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T06:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-v5f5-7fmg-8vmh/GHSA-v5f5-7fmg-8vmh.json b/advisories/unreviewed/2024/04/GHSA-v5f5-7fmg-8vmh/GHSA-v5f5-7fmg-8vmh.json new file mode 100644 index 00000000000..a51dd8bd65d --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-v5f5-7fmg-8vmh/GHSA-v5f5-7fmg-8vmh.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v5f5-7fmg-8vmh", + "modified": "2024-04-02T06:30:31Z", + "published": "2024-04-02T06:30:31Z", + "aliases": [ + "CVE-2024-25187" + ], + "details": "Server Side Request Forgery (SSRF) vulnerability in 71cms v1.0.0, allows remote unauthenticated attackers to obtain sensitive information via getweather.html.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25187" + }, + { + "type": "WEB", + "url": "https://github.com/xiaocheng-keji/71cms/issues/2" + }, + { + "type": "WEB", + "url": "https://gist.github.com/wisejayer/d365e93ce09b8a36641165e1d1a0a06c" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T04:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-wv8p-qvw7-q865/GHSA-wv8p-qvw7-q865.json b/advisories/unreviewed/2024/04/GHSA-wv8p-qvw7-q865/GHSA-wv8p-qvw7-q865.json new file mode 100644 index 00000000000..63b21e428ee --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-wv8p-qvw7-q865/GHSA-wv8p-qvw7-q865.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wv8p-qvw7-q865", + "modified": "2024-04-02T06:30:31Z", + "published": "2024-04-02T06:30:31Z", + "aliases": [ + "CVE-2024-2369" + ], + "details": "The Page Builder Gutenberg Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2369" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/252dfc35-4c8c-4304-aa09-73dfe986b10d" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T05:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-wxv5-cmgq-7856/GHSA-wxv5-cmgq-7856.json b/advisories/unreviewed/2024/04/GHSA-wxv5-cmgq-7856/GHSA-wxv5-cmgq-7856.json new file mode 100644 index 00000000000..06882ebd6c3 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-wxv5-cmgq-7856/GHSA-wxv5-cmgq-7856.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wxv5-cmgq-7856", + "modified": "2024-04-02T06:30:32Z", + "published": "2024-04-02T06:30:32Z", + "aliases": [ + "CVE-2024-2791" + ], + "details": "The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 3.8.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2791" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3061715/metform/trunk/widgets/file-upload/file-upload.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0dad759d-9b44-47ca-8410-e39f65dc919c?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-02T06:15:15Z" + } +} \ No newline at end of file