diff --git a/advisories/unreviewed/2024/11/GHSA-3cq2-fh6p-8w28/GHSA-3cq2-fh6p-8w28.json b/advisories/unreviewed/2024/11/GHSA-3cq2-fh6p-8w28/GHSA-3cq2-fh6p-8w28.json new file mode 100644 index 00000000000..a4d70a10534 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-3cq2-fh6p-8w28/GHSA-3cq2-fh6p-8w28.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3cq2-fh6p-8w28", + "modified": "2024-11-28T06:32:42Z", + "published": "2024-11-28T06:32:42Z", + "aliases": [ + "CVE-2024-38389" + ], + "details": "There is an Out-of-bounds read vulnerability in TELLUS (v4.0.19.0 and earlier) and TELLUS Lite (v4.0.19.0 and earlier). If a user opens a specially crafted file, information may be disclosed and/or arbitrary code may be executed.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38389" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/vu/JVNVU97531313" + }, + { + "type": "WEB", + "url": "https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T03:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-5xvj-wwgx-xf7x/GHSA-5xvj-wwgx-xf7x.json b/advisories/unreviewed/2024/11/GHSA-5xvj-wwgx-xf7x/GHSA-5xvj-wwgx-xf7x.json new file mode 100644 index 00000000000..8d1aae646e5 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-5xvj-wwgx-xf7x/GHSA-5xvj-wwgx-xf7x.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5xvj-wwgx-xf7x", + "modified": "2024-11-28T06:32:42Z", + "published": "2024-11-28T06:32:42Z", + "aliases": [ + "CVE-2024-10473" + ], + "details": "The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo Settings when outputing them in pages where the Logo Slider shortcode is embed, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10473" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/7512cbdf-cf27-4a1f-bac8-9fcb14bf463e" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T06:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-7676-xq8c-838g/GHSA-7676-xq8c-838g.json b/advisories/unreviewed/2024/11/GHSA-7676-xq8c-838g/GHSA-7676-xq8c-838g.json new file mode 100644 index 00000000000..30578230fa0 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-7676-xq8c-838g/GHSA-7676-xq8c-838g.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7676-xq8c-838g", + "modified": "2024-11-28T06:32:41Z", + "published": "2024-11-28T06:32:41Z", + "aliases": [ + "CVE-2018-9377" + ], + "details": "In BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9377" + }, + { + "type": "WEB", + "url": "https://source.android.com/docs/security/bulletin/pixel/2018-06-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T01:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-92r7-5f26-m495/GHSA-92r7-5f26-m495.json b/advisories/unreviewed/2024/11/GHSA-92r7-5f26-m495/GHSA-92r7-5f26-m495.json new file mode 100644 index 00000000000..d278e832edd --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-92r7-5f26-m495/GHSA-92r7-5f26-m495.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-92r7-5f26-m495", + "modified": "2024-11-28T06:32:42Z", + "published": "2024-11-28T06:32:42Z", + "aliases": [ + "CVE-2024-46939" + ], + "details": "The game extension engine of versions 1.2.7.0 and earlier exposes some components, and attackers can construct parameters to perform path traversal attacks, which can overwrite local specific files", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46939" + }, + { + "type": "WEB", + "url": "https://www.vivo.com/en/support/security-advisory-detail?id=13" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T04:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-h9fh-gm4r-6cxh/GHSA-h9fh-gm4r-6cxh.json b/advisories/unreviewed/2024/11/GHSA-h9fh-gm4r-6cxh/GHSA-h9fh-gm4r-6cxh.json index ba966c8a594..7f173c78e30 100644 --- a/advisories/unreviewed/2024/11/GHSA-h9fh-gm4r-6cxh/GHSA-h9fh-gm4r-6cxh.json +++ b/advisories/unreviewed/2024/11/GHSA-h9fh-gm4r-6cxh/GHSA-h9fh-gm4r-6cxh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-h9fh-gm4r-6cxh", - "modified": "2024-11-27T12:31:53Z", + "modified": "2024-11-28T06:32:41Z", "published": "2024-11-27T12:31:53Z", "aliases": [ "CVE-2024-11667" @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,6 +22,10 @@ { "type": "WEB", "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024" + }, + { + "type": "WEB", + "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/11/GHSA-qq72-vh82-fwv9/GHSA-qq72-vh82-fwv9.json b/advisories/unreviewed/2024/11/GHSA-qq72-vh82-fwv9/GHSA-qq72-vh82-fwv9.json new file mode 100644 index 00000000000..77e0bc4bdd7 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-qq72-vh82-fwv9/GHSA-qq72-vh82-fwv9.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qq72-vh82-fwv9", + "modified": "2024-11-28T06:32:42Z", + "published": "2024-11-28T06:32:42Z", + "aliases": [ + "CVE-2024-53008" + ], + "details": "Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53008" + }, + { + "type": "WEB", + "url": "https://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=1afca10150ac3e4e2224055cc31b6f1e4a70efe2" + }, + { + "type": "WEB", + "url": "https://git.haproxy.org/?p=haproxy-2.8.git;a=commit;h=01c1056a44823c5ffb8f74660b32c099d9b5355b" + }, + { + "type": "WEB", + "url": "https://git.haproxy.org/?p=haproxy-2.9.git;a=commit;h=4bcaece344c8738dac1ab5bd8cc81e2a22701d71" + }, + { + "type": "WEB", + "url": "https://git.haproxy.org/?p=haproxy-3.0.git;a=commit;h=95a607c4b3af09be2a495b9c2872ea252ccff603" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/jp/JVN88385716" + }, + { + "type": "WEB", + "url": "https://www.haproxy.org" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-444" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T03:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-rcqf-rgp8-qr4j/GHSA-rcqf-rgp8-qr4j.json b/advisories/unreviewed/2024/11/GHSA-rcqf-rgp8-qr4j/GHSA-rcqf-rgp8-qr4j.json new file mode 100644 index 00000000000..e3cf2009283 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-rcqf-rgp8-qr4j/GHSA-rcqf-rgp8-qr4j.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rcqf-rgp8-qr4j", + "modified": "2024-11-28T06:32:43Z", + "published": "2024-11-28T06:32:43Z", + "aliases": [ + "CVE-2024-11918" + ], + "details": "The Image Alt Text plugin for WordPress is vulnerable to unauthorized modification of data| due to a missing capability check on the iat_add_alt_txt_action and iat_update_alt_txt_action AJAX actions in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the alt text on arbitrary images.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11918" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3188755%40image-alt-text&new=3188755%40image-alt-text&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/22143fe3-e599-4b44-99c0-ba66d88ff5d6?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T06:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-rg9j-w3wr-2gc5/GHSA-rg9j-w3wr-2gc5.json b/advisories/unreviewed/2024/11/GHSA-rg9j-w3wr-2gc5/GHSA-rg9j-w3wr-2gc5.json new file mode 100644 index 00000000000..908f068aed4 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-rg9j-w3wr-2gc5/GHSA-rg9j-w3wr-2gc5.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rg9j-w3wr-2gc5", + "modified": "2024-11-28T06:32:43Z", + "published": "2024-11-28T06:32:43Z", + "aliases": [ + "CVE-2024-10510" + ], + "details": "The adBuddy+ (AdBlocker Detection) by NetfunkDesign WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10510" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/ca499752-b516-42e7-8c2f-18e4428a92c7" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T06:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-rjgc-mwc5-8g7j/GHSA-rjgc-mwc5-8g7j.json b/advisories/unreviewed/2024/11/GHSA-rjgc-mwc5-8g7j/GHSA-rjgc-mwc5-8g7j.json new file mode 100644 index 00000000000..80c4f051471 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-rjgc-mwc5-8g7j/GHSA-rjgc-mwc5-8g7j.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rjgc-mwc5-8g7j", + "modified": "2024-11-28T06:32:42Z", + "published": "2024-11-28T06:32:42Z", + "aliases": [ + "CVE-2024-38658" + ], + "details": "There is an Out-of-bounds read vulnerability in V-Server (v4.0.19.0 and earlier) and V-Server Lite (v4.0.19.0 and earlier). If a user opens a specially crafted file, information may be disclosed and/or arbitrary code may be executed.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38658" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/vu/JVNVU97531313" + }, + { + "type": "WEB", + "url": "https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T03:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w9mq-3f7x-p532/GHSA-w9mq-3f7x-p532.json b/advisories/unreviewed/2024/11/GHSA-w9mq-3f7x-p532/GHSA-w9mq-3f7x-p532.json new file mode 100644 index 00000000000..a268c7936b8 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w9mq-3f7x-p532/GHSA-w9mq-3f7x-p532.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w9mq-3f7x-p532", + "modified": "2024-11-28T06:32:41Z", + "published": "2024-11-28T06:32:41Z", + "aliases": [ + "CVE-2024-38309" + ], + "details": "There are multiple stack-based buffer overflow vulnerabilities in V-SFT (v6.2.2.0 and earlier), TELLUS (v4.0.19.0 and earlier), and TELLUS Lite (v4.0.19.0 and earlier).\nIf a user opens a specially crafted file, information may be disclosed and/or arbitrary code may be executed.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38309" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/vu/JVNVU97531313" + }, + { + "type": "WEB", + "url": "https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-121" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T03:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-x8c4-4qx3-cf7m/GHSA-x8c4-4qx3-cf7m.json b/advisories/unreviewed/2024/11/GHSA-x8c4-4qx3-cf7m/GHSA-x8c4-4qx3-cf7m.json new file mode 100644 index 00000000000..afa3593a4ed --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-x8c4-4qx3-cf7m/GHSA-x8c4-4qx3-cf7m.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x8c4-4qx3-cf7m", + "modified": "2024-11-28T06:32:43Z", + "published": "2024-11-28T06:32:43Z", + "aliases": [ + "CVE-2024-10896" + ], + "details": "The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo and Slider settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10896" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/1304c2b6-922d-455e-bae8-d6bf855eddd9" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T06:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-x944-3w5c-5hcg/GHSA-x944-3w5c-5hcg.json b/advisories/unreviewed/2024/11/GHSA-x944-3w5c-5hcg/GHSA-x944-3w5c-5hcg.json new file mode 100644 index 00000000000..bbe47fd8cfb --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-x944-3w5c-5hcg/GHSA-x944-3w5c-5hcg.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x944-3w5c-5hcg", + "modified": "2024-11-28T06:32:42Z", + "published": "2024-11-28T06:32:42Z", + "aliases": [ + "CVE-2024-10493" + ], + "details": "The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) WordPress plugin before 5.10.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10493" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/2e7f7196-054b-4cfd-9219-c60bb8275e8d" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T06:15:08Z" + } +} \ No newline at end of file