netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-11-26 09:32:13 +00:00
parent efb56533b1
commit 7904677194
38 changed files with 1795 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/02/GHSA-gh95-m6w6-g25c/GHSA-gh95-m6w6-g25c.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gh95-m6w6-g25c",
"modified": "2024-02-29T00:30:23Z",
"modified": "2024-11-26T09:30:47Z",
"published": "2024-02-29T00:30:23Z",
"aliases": [
"CVE-2024-21798"
],
"details": "ELECOM wireless LAN routers contain a cross-site scripting vulnerability. Assume that a malicious administrative user configures the affected product with specially crafted content. When another administrative user logs in and operates the product, an arbitrary script may be executed on the web browser. Affected products and versions are as follows: WRC-1167GS2-B v1.67 and earlier, WRC-1167GS2H-B v1.67 and earlier, WRC-2533GS2-B v1.62 and earlier, WRC-2533GS2-W v1.62 and earlier, and WRC-2533GS2V-B v1.62 and earlier.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -29,9 +32,9 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-28T23:15:09Z"
advisories/unreviewed/2024/02/GHSA-x775-35gr-xw72/GHSA-x775-35gr-xw72.json
+1 -1
View File
@@ -32,7 +32,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
advisories/unreviewed/2024/10/GHSA-wq2p-5pc6-wpgf/GHSA-wq2p-5pc6-wpgf.json
+51 -47
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wq2p-5pc6-wpgf",
"modified": "2024-11-24T21:30:46Z",
"modified": "2024-11-26T09:30:48Z",
"published": "2024-10-15T18:30:50Z",
"aliases": [
"CVE-2024-9676"
@@ -22,52 +22,12 @@
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9676"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8418"
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-wq2p-5pc6-wpgf"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8428"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8437"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8686"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8690"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8694"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8700"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8984"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:9051"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:9454"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:9459"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:9926"
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317467"
},
{
"type": "WEB",
@@ -75,11 +35,55 @@
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317467"
"url": "https://access.redhat.com/errata/RHSA-2024:9926"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-wq2p-5pc6-wpgf"
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:9459"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:9454"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:9051"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8984"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8700"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8694"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8690"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8686"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8437"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8428"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:8418"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:10289"
}
],
"database_specific": {
advisories/unreviewed/2024/11/GHSA-27gg-q2pj-f574/GHSA-27gg-q2pj-f574.json
+55
View File
@@ -0,0 +1,55 @@
{
"schema_version": "1.4.0",
"id": "GHSA-27gg-q2pj-f574",
"modified": "2024-11-26T09:30:49Z",
"published": "2024-11-26T09:30:49Z",
"aliases": [
"CVE-2024-32151"
],
"details": "User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32151"
},
{
"type": "WEB",
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"type": "WEB",
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU93051062"
},
{
"type": "WEB",
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
},
{
"type": "WEB",
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"type": "WEB",
"url": "https://www.toshibatec.com/information/20240531_02.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-257"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T08:15:05Z"
}
}
advisories/unreviewed/2024/11/GHSA-2php-gcq2-fxqp/GHSA-2php-gcq2-fxqp.json
+55
View File
@@ -0,0 +1,55 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2php-gcq2-fxqp",
"modified": "2024-11-26T09:30:49Z",
"published": "2024-11-26T09:30:49Z",
"aliases": [
"CVE-2024-33605"
],
"details": "Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33605"
},
{
"type": "WEB",
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"type": "WEB",
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU93051062"
},
{
"type": "WEB",
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
},
{
"type": "WEB",
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"type": "WEB",
"url": "https://www.toshibatec.com/information/20240531_02.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T08:15:05Z"
}
}
advisories/unreviewed/2024/11/GHSA-3chv-hrqx-p726/GHSA-3chv-hrqx-p726.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3chv-hrqx-p726",
"modified": "2024-11-26T09:30:49Z",
"published": "2024-11-26T09:30:49Z",
"aliases": [
"CVE-2017-11076"
],
"details": "On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into the decoder hardware which can lead to an invalid memory access by the decoder.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11076"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2018-bulletin.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-823"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T09:15:04Z"
}
}
advisories/unreviewed/2024/11/GHSA-3gg9-g25v-rjf5/GHSA-3gg9-g25v-rjf5.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3gg9-g25v-rjf5",
"modified": "2024-11-26T09:30:48Z",
"published": "2024-11-26T09:30:48Z",
"aliases": [
"CVE-2024-10857"
],
"details": "The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9 via the handle_downloads() function due to insufficient file path validation/sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10857"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3195423/product-input-fields-for-woocommerce/trunk?contextall=1&old=3173573&old_path=%2Fproduct-input-fields-for-woocommerce%2Ftrunk"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e45207af-3886-4d95-9cd8-5ecdc683dc58?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T07:15:05Z"
}
}
advisories/unreviewed/2024/11/GHSA-3v44-23hf-q5wp/GHSA-3v44-23hf-q5wp.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3v44-23hf-q5wp",
"modified": "2024-11-26T09:30:49Z",
"published": "2024-11-26T09:30:49Z",
"aliases": [
"CVE-2024-8772"
],
"details": "51l3nc3, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API managedoverlayimages.cgi was vulnerable to a race condition attack allowing for an attacker to block access to the overlay configuration page in the web interface of the Axis device. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8772"
},
{
"type": "WEB",
"url": "https://www.axis.com/dam/public/permalink/231072/cve-2024-8772pdf-en-US_InternalID-231072.pdf"
}
],
"database_specific": {
"cwe_ids": [
"CWE-1286"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T08:15:08Z"
}
}
advisories/unreviewed/2024/11/GHSA-45wv-ch7h-93hx/GHSA-45wv-ch7h-93hx.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-45wv-ch7h-93hx",
"modified": "2024-11-26T09:30:50Z",
"published": "2024-11-26T09:30:49Z",
"aliases": [
"CVE-2017-18153"
],
"details": "A race condition exists in a driver potentially leading to a use-after-free condition.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18153"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2018-bulletin.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-416"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T09:15:04Z"
}
}
advisories/unreviewed/2024/11/GHSA-4f95-7725-5826/GHSA-4f95-7725-5826.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4f95-7725-5826",
"modified": "2024-11-26T09:30:49Z",
"published": "2024-11-26T09:30:49Z",
"aliases": [
"CVE-2024-36254"
],
"details": "Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-service (DoS) condition.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36254"
},
{
"type": "WEB",
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"type": "WEB",
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU93051062"
},
{
"type": "WEB",
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"type": "WEB",
"url": "https://www.toshibatec.com/information/20240531_02.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T08:15:06Z"
}
}
advisories/unreviewed/2024/11/GHSA-5c2r-f52f-mq7p/GHSA-5c2r-f52f-mq7p.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5c2r-f52f-mq7p",
"modified": "2024-11-26T09:30:49Z",
"published": "2024-11-26T09:30:49Z",
"aliases": [
"CVE-2024-29146"
],
"details": "User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29146"
},
{
"type": "WEB",
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"type": "WEB",
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU93051062"
},
{
"type": "WEB",
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
},
{
"type": "WEB",
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"type": "WEB",
"url": "https://www.toshibatec.com/information/20240531_02.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-312"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T08:15:05Z"
}
}
advisories/unreviewed/2024/11/GHSA-5cqj-32fq-vgj6/GHSA-5cqj-32fq-vgj6.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5cqj-32fq-vgj6",
"modified": "2024-11-26T09:30:50Z",
"published": "2024-11-26T09:30:50Z",
"aliases": [
"CVE-2018-11952"
],
"details": "An image with a version lower than the fuse version may potentially be booted lead to improper authentication.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11952"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2018-bulletin.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T09:15:05Z"
}
}
advisories/unreviewed/2024/11/GHSA-62g5-fcg3-v3cp/GHSA-62g5-fcg3-v3cp.json
+46
View File
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-62g5-fcg3-v3cp",
"modified": "2024-11-26T09:30:49Z",
"published": "2024-11-26T09:30:49Z",
"aliases": [
"CVE-2024-9504"
],
"details": "The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.2.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9504"
},
{
"type": "WEB",
"url": "https://hacked.be/posts/CVE-2024-9504"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3195800/booking-calendar"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1fb05281-205f-4d9c-aac9-2b37e069a6fb?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-434"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T08:15:08Z"
}
}
advisories/unreviewed/2024/11/GHSA-6p9j-wxqr-cxf6/GHSA-6p9j-wxqr-cxf6.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6p9j-wxqr-cxf6",
"modified": "2024-11-26T09:30:49Z",
"published": "2024-11-26T09:30:49Z",
"aliases": [
"CVE-2024-34162"
],
"details": "The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to \"SIMPLE\", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text communication. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34162"
},
{
"type": "WEB",
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"type": "WEB",
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU93051062"
},
{
"type": "WEB",
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
},
{
"type": "WEB",
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"type": "WEB",
"url": "https://www.toshibatec.com/information/20240531_02.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-767"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T08:15:06Z"
}
}
advisories/unreviewed/2024/11/GHSA-6rr7-f623-4g74/GHSA-6rr7-f623-4g74.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6rr7-f623-4g74",
"modified": "2024-11-26T09:30:50Z",
"published": "2024-11-26T09:30:50Z",
"aliases": [
"CVE-2024-11119"
],
"details": "The BNE Gallery Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gallery' shortcode in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11119"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/bne-gallery-extended/trunk/bne-gallery-extended.php#L178"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3191705"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/bne-gallery-extended/#developers"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1f9277d8-ac81-4950-a1e5-4e6c6b042f84?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T09:15:05Z"
}
}
advisories/unreviewed/2024/11/GHSA-7p2j-6vvg-vfq9/GHSA-7p2j-6vvg-vfq9.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7p2j-6vvg-vfq9",
"modified": "2024-11-26T09:30:49Z",
"published": "2024-11-26T09:30:49Z",
"aliases": [
"CVE-2024-29978"
],
"details": "User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29978"
},
{
"type": "WEB",
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"type": "WEB",
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU93051062"
},
{
"type": "WEB",
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
},
{
"type": "WEB",
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"type": "WEB",
"url": "https://www.toshibatec.com/information/20240531_02.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T08:15:05Z"
}
}
advisories/unreviewed/2024/11/GHSA-92v2-fpqg-mwfv/GHSA-92v2-fpqg-mwfv.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-92v2-fpqg-mwfv",
"modified": "2024-11-26T09:30:50Z",
"published": "2024-11-26T09:30:50Z",
"aliases": [
"CVE-2018-11922"
],
"details": "Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11922"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/may-2018-bulletin.html"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T09:15:04Z"
}
}
advisories/unreviewed/2024/11/GHSA-97w9-7qcx-qc77/GHSA-97w9-7qcx-qc77.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-97w9-7qcx-qc77",
"modified": "2024-11-26T09:30:49Z",
"published": "2024-11-26T09:30:49Z",
"aliases": [
"CVE-2024-36249"
],
"details": "Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is exploited, an arbitrary script may be executed on the administrative page of the affected MFPs. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36249"
},
{
"type": "WEB",
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"type": "WEB",
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU93051062"
},
{
"type": "WEB",
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"type": "WEB",
"url": "https://www.toshibatec.com/information/20240531_02.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T08:15:06Z"
}
}
advisories/unreviewed/2024/11/GHSA-cjjx-vgmp-vf5g/GHSA-cjjx-vgmp-vf5g.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cjjx-vgmp-vf5g",
"modified": "2024-11-26T09:30:48Z",
"published": "2024-11-26T09:30:48Z",
"aliases": [
"CVE-2024-11002"
],
"details": "The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpost_gallery_get_shortcode_template AJAX action in all versions up to, and including, 2.1.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11002"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/inpost-gallery/trunk/index.php#L323"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3192113"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/inpost-gallery/#developers"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5fbb2dcf-38b8-4ef1-bfea-bf5872cc7e37?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T07:15:05Z"
}
}
advisories/unreviewed/2024/11/GHSA-cmfc-j23h-6h8c/GHSA-cmfc-j23h-6h8c.json
+58
View File
@@ -0,0 +1,58 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cmfc-j23h-6h8c",
"modified": "2024-11-26T09:30:49Z",
"published": "2024-11-26T09:30:48Z",
"aliases": [
"CVE-2024-28038"
],
"details": "The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character string to MFPSESSIONID parameter results in a stack buffer overflow. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28038"
},
{
"type": "WEB",
"url": "https://global.sharp/products/copier/info/info_security_2024-05.html"
},
{
"type": "WEB",
"url": "https://jp.sharp/business/print/information/info_security_2024-05.html"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/vu/JVNVU93051062"
},
{
"type": "WEB",
"url": "https://pierrekim.github.io/blog/2024-06-27-sharp-mfp-17-vulnerabilities.html"
},
{
"type": "WEB",
"url": "https://www.toshibatec.co.jp/information/20240531_02.html"
},
{
"type": "WEB",
"url": "https://www.toshibatec.com/information/20240531_02.html"
}
],
"database_specific": {
"cwe_ids": [
"CWE-121"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-26T08:15:04Z"
}
}

Some files were not shown because too many files have changed in this diff Show More