From 7be699c01013d31df2e0362b0ad43651a2e2b377 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 28 Nov 2024 06:34:30 +0000 Subject: [PATCH] Publish Advisories GHSA-3cq2-fh6p-8w28 GHSA-5xvj-wwgx-xf7x GHSA-7676-xq8c-838g GHSA-92r7-5f26-m495 GHSA-h9fh-gm4r-6cxh GHSA-qq72-vh82-fwv9 GHSA-rcqf-rgp8-qr4j GHSA-rg9j-w3wr-2gc5 GHSA-rjgc-mwc5-8g7j GHSA-w9mq-3f7x-p532 GHSA-x8c4-4qx3-cf7m GHSA-x944-3w5c-5hcg --- .../GHSA-3cq2-fh6p-8w28.json | 35 ++++++++++++ .../GHSA-5xvj-wwgx-xf7x.json | 29 ++++++++++ .../GHSA-7676-xq8c-838g.json | 29 ++++++++++ .../GHSA-92r7-5f26-m495.json | 36 ++++++++++++ .../GHSA-h9fh-gm4r-6cxh.json | 10 ++-- .../GHSA-qq72-vh82-fwv9.json | 56 +++++++++++++++++++ .../GHSA-rcqf-rgp8-qr4j.json | 40 +++++++++++++ .../GHSA-rg9j-w3wr-2gc5.json | 29 ++++++++++ .../GHSA-rjgc-mwc5-8g7j.json | 35 ++++++++++++ .../GHSA-w9mq-3f7x-p532.json | 35 ++++++++++++ .../GHSA-x8c4-4qx3-cf7m.json | 29 ++++++++++ .../GHSA-x944-3w5c-5hcg.json | 29 ++++++++++ 12 files changed, 388 insertions(+), 4 deletions(-) create mode 100644 advisories/unreviewed/2024/11/GHSA-3cq2-fh6p-8w28/GHSA-3cq2-fh6p-8w28.json create mode 100644 advisories/unreviewed/2024/11/GHSA-5xvj-wwgx-xf7x/GHSA-5xvj-wwgx-xf7x.json create mode 100644 advisories/unreviewed/2024/11/GHSA-7676-xq8c-838g/GHSA-7676-xq8c-838g.json create mode 100644 advisories/unreviewed/2024/11/GHSA-92r7-5f26-m495/GHSA-92r7-5f26-m495.json create mode 100644 advisories/unreviewed/2024/11/GHSA-qq72-vh82-fwv9/GHSA-qq72-vh82-fwv9.json create mode 100644 advisories/unreviewed/2024/11/GHSA-rcqf-rgp8-qr4j/GHSA-rcqf-rgp8-qr4j.json create mode 100644 advisories/unreviewed/2024/11/GHSA-rg9j-w3wr-2gc5/GHSA-rg9j-w3wr-2gc5.json create mode 100644 advisories/unreviewed/2024/11/GHSA-rjgc-mwc5-8g7j/GHSA-rjgc-mwc5-8g7j.json create mode 100644 advisories/unreviewed/2024/11/GHSA-w9mq-3f7x-p532/GHSA-w9mq-3f7x-p532.json create mode 100644 advisories/unreviewed/2024/11/GHSA-x8c4-4qx3-cf7m/GHSA-x8c4-4qx3-cf7m.json create mode 100644 advisories/unreviewed/2024/11/GHSA-x944-3w5c-5hcg/GHSA-x944-3w5c-5hcg.json diff --git a/advisories/unreviewed/2024/11/GHSA-3cq2-fh6p-8w28/GHSA-3cq2-fh6p-8w28.json b/advisories/unreviewed/2024/11/GHSA-3cq2-fh6p-8w28/GHSA-3cq2-fh6p-8w28.json new file mode 100644 index 00000000000..a4d70a10534 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-3cq2-fh6p-8w28/GHSA-3cq2-fh6p-8w28.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3cq2-fh6p-8w28", + "modified": "2024-11-28T06:32:42Z", + "published": "2024-11-28T06:32:42Z", + "aliases": [ + "CVE-2024-38389" + ], + "details": "There is an Out-of-bounds read vulnerability in TELLUS (v4.0.19.0 and earlier) and TELLUS Lite (v4.0.19.0 and earlier). If a user opens a specially crafted file, information may be disclosed and/or arbitrary code may be executed.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38389" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/vu/JVNVU97531313" + }, + { + "type": "WEB", + "url": "https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T03:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-5xvj-wwgx-xf7x/GHSA-5xvj-wwgx-xf7x.json b/advisories/unreviewed/2024/11/GHSA-5xvj-wwgx-xf7x/GHSA-5xvj-wwgx-xf7x.json new file mode 100644 index 00000000000..8d1aae646e5 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-5xvj-wwgx-xf7x/GHSA-5xvj-wwgx-xf7x.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5xvj-wwgx-xf7x", + "modified": "2024-11-28T06:32:42Z", + "published": "2024-11-28T06:32:42Z", + "aliases": [ + "CVE-2024-10473" + ], + "details": "The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo Settings when outputing them in pages where the Logo Slider shortcode is embed, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10473" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/7512cbdf-cf27-4a1f-bac8-9fcb14bf463e" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T06:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-7676-xq8c-838g/GHSA-7676-xq8c-838g.json b/advisories/unreviewed/2024/11/GHSA-7676-xq8c-838g/GHSA-7676-xq8c-838g.json new file mode 100644 index 00000000000..30578230fa0 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-7676-xq8c-838g/GHSA-7676-xq8c-838g.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7676-xq8c-838g", + "modified": "2024-11-28T06:32:41Z", + "published": "2024-11-28T06:32:41Z", + "aliases": [ + "CVE-2018-9377" + ], + "details": "In BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-9377" + }, + { + "type": "WEB", + "url": "https://source.android.com/docs/security/bulletin/pixel/2018-06-01" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T01:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-92r7-5f26-m495/GHSA-92r7-5f26-m495.json b/advisories/unreviewed/2024/11/GHSA-92r7-5f26-m495/GHSA-92r7-5f26-m495.json new file mode 100644 index 00000000000..d278e832edd --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-92r7-5f26-m495/GHSA-92r7-5f26-m495.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-92r7-5f26-m495", + "modified": "2024-11-28T06:32:42Z", + "published": "2024-11-28T06:32:42Z", + "aliases": [ + "CVE-2024-46939" + ], + "details": "The game extension engine of versions 1.2.7.0 and earlier exposes some components, and attackers can construct parameters to perform path traversal attacks, which can overwrite local specific files", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46939" + }, + { + "type": "WEB", + "url": "https://www.vivo.com/en/support/security-advisory-detail?id=13" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T04:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-h9fh-gm4r-6cxh/GHSA-h9fh-gm4r-6cxh.json b/advisories/unreviewed/2024/11/GHSA-h9fh-gm4r-6cxh/GHSA-h9fh-gm4r-6cxh.json index ba966c8a594..7f173c78e30 100644 --- a/advisories/unreviewed/2024/11/GHSA-h9fh-gm4r-6cxh/GHSA-h9fh-gm4r-6cxh.json +++ b/advisories/unreviewed/2024/11/GHSA-h9fh-gm4r-6cxh/GHSA-h9fh-gm4r-6cxh.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-h9fh-gm4r-6cxh", - "modified": "2024-11-27T12:31:53Z", + "modified": "2024-11-28T06:32:41Z", "published": "2024-11-27T12:31:53Z", "aliases": [ "CVE-2024-11667" @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", @@ -24,6 +22,10 @@ { "type": "WEB", "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-21-2024" + }, + { + "type": "WEB", + "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-protecting-against-recent-firewall-threats-11-27-2024" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/11/GHSA-qq72-vh82-fwv9/GHSA-qq72-vh82-fwv9.json b/advisories/unreviewed/2024/11/GHSA-qq72-vh82-fwv9/GHSA-qq72-vh82-fwv9.json new file mode 100644 index 00000000000..77e0bc4bdd7 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-qq72-vh82-fwv9/GHSA-qq72-vh82-fwv9.json @@ -0,0 +1,56 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qq72-vh82-fwv9", + "modified": "2024-11-28T06:32:42Z", + "published": "2024-11-28T06:32:42Z", + "aliases": [ + "CVE-2024-53008" + ], + "details": "Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the product. As a result, the attacker may obtain sensitive information.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53008" + }, + { + "type": "WEB", + "url": "https://git.haproxy.org/?p=haproxy-2.6.git;a=commit;h=1afca10150ac3e4e2224055cc31b6f1e4a70efe2" + }, + { + "type": "WEB", + "url": "https://git.haproxy.org/?p=haproxy-2.8.git;a=commit;h=01c1056a44823c5ffb8f74660b32c099d9b5355b" + }, + { + "type": "WEB", + "url": "https://git.haproxy.org/?p=haproxy-2.9.git;a=commit;h=4bcaece344c8738dac1ab5bd8cc81e2a22701d71" + }, + { + "type": "WEB", + "url": "https://git.haproxy.org/?p=haproxy-3.0.git;a=commit;h=95a607c4b3af09be2a495b9c2872ea252ccff603" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/jp/JVN88385716" + }, + { + "type": "WEB", + "url": "https://www.haproxy.org" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-444" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T03:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-rcqf-rgp8-qr4j/GHSA-rcqf-rgp8-qr4j.json b/advisories/unreviewed/2024/11/GHSA-rcqf-rgp8-qr4j/GHSA-rcqf-rgp8-qr4j.json new file mode 100644 index 00000000000..e3cf2009283 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-rcqf-rgp8-qr4j/GHSA-rcqf-rgp8-qr4j.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rcqf-rgp8-qr4j", + "modified": "2024-11-28T06:32:43Z", + "published": "2024-11-28T06:32:43Z", + "aliases": [ + "CVE-2024-11918" + ], + "details": "The Image Alt Text plugin for WordPress is vulnerable to unauthorized modification of data| due to a missing capability check on the iat_add_alt_txt_action and iat_update_alt_txt_action AJAX actions in all versions up to, and including, 2.0.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update the alt text on arbitrary images.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11918" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3188755%40image-alt-text&new=3188755%40image-alt-text&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/22143fe3-e599-4b44-99c0-ba66d88ff5d6?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T06:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-rg9j-w3wr-2gc5/GHSA-rg9j-w3wr-2gc5.json b/advisories/unreviewed/2024/11/GHSA-rg9j-w3wr-2gc5/GHSA-rg9j-w3wr-2gc5.json new file mode 100644 index 00000000000..908f068aed4 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-rg9j-w3wr-2gc5/GHSA-rg9j-w3wr-2gc5.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rg9j-w3wr-2gc5", + "modified": "2024-11-28T06:32:43Z", + "published": "2024-11-28T06:32:43Z", + "aliases": [ + "CVE-2024-10510" + ], + "details": "The adBuddy+ (AdBlocker Detection) by NetfunkDesign WordPress plugin through 1.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10510" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/ca499752-b516-42e7-8c2f-18e4428a92c7" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T06:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-rjgc-mwc5-8g7j/GHSA-rjgc-mwc5-8g7j.json b/advisories/unreviewed/2024/11/GHSA-rjgc-mwc5-8g7j/GHSA-rjgc-mwc5-8g7j.json new file mode 100644 index 00000000000..80c4f051471 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-rjgc-mwc5-8g7j/GHSA-rjgc-mwc5-8g7j.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rjgc-mwc5-8g7j", + "modified": "2024-11-28T06:32:42Z", + "published": "2024-11-28T06:32:42Z", + "aliases": [ + "CVE-2024-38658" + ], + "details": "There is an Out-of-bounds read vulnerability in V-Server (v4.0.19.0 and earlier) and V-Server Lite (v4.0.19.0 and earlier). If a user opens a specially crafted file, information may be disclosed and/or arbitrary code may be executed.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38658" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/vu/JVNVU97531313" + }, + { + "type": "WEB", + "url": "https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-125" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T03:15:16Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w9mq-3f7x-p532/GHSA-w9mq-3f7x-p532.json b/advisories/unreviewed/2024/11/GHSA-w9mq-3f7x-p532/GHSA-w9mq-3f7x-p532.json new file mode 100644 index 00000000000..a268c7936b8 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w9mq-3f7x-p532/GHSA-w9mq-3f7x-p532.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w9mq-3f7x-p532", + "modified": "2024-11-28T06:32:41Z", + "published": "2024-11-28T06:32:41Z", + "aliases": [ + "CVE-2024-38309" + ], + "details": "There are multiple stack-based buffer overflow vulnerabilities in V-SFT (v6.2.2.0 and earlier), TELLUS (v4.0.19.0 and earlier), and TELLUS Lite (v4.0.19.0 and earlier).\nIf a user opens a specially crafted file, information may be disclosed and/or arbitrary code may be executed.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38309" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/vu/JVNVU97531313" + }, + { + "type": "WEB", + "url": "https://monitouch.fujielectric.com/site/download-e/03tellus_inf/index.php" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-121" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T03:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-x8c4-4qx3-cf7m/GHSA-x8c4-4qx3-cf7m.json b/advisories/unreviewed/2024/11/GHSA-x8c4-4qx3-cf7m/GHSA-x8c4-4qx3-cf7m.json new file mode 100644 index 00000000000..afa3593a4ed --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-x8c4-4qx3-cf7m/GHSA-x8c4-4qx3-cf7m.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x8c4-4qx3-cf7m", + "modified": "2024-11-28T06:32:43Z", + "published": "2024-11-28T06:32:43Z", + "aliases": [ + "CVE-2024-10896" + ], + "details": "The Logo Slider WordPress plugin before 4.5.0 does not sanitise and escape some of its Logo and Slider settings, which could allow high privilege users such as Contributor to perform Stored Cross-Site Scripting", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10896" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/1304c2b6-922d-455e-bae8-d6bf855eddd9" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T06:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-x944-3w5c-5hcg/GHSA-x944-3w5c-5hcg.json b/advisories/unreviewed/2024/11/GHSA-x944-3w5c-5hcg/GHSA-x944-3w5c-5hcg.json new file mode 100644 index 00000000000..bbe47fd8cfb --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-x944-3w5c-5hcg/GHSA-x944-3w5c-5hcg.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x944-3w5c-5hcg", + "modified": "2024-11-28T06:32:42Z", + "published": "2024-11-28T06:32:42Z", + "aliases": [ + "CVE-2024-10493" + ], + "details": "The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) WordPress plugin before 5.10.3 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10493" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/2e7f7196-054b-4cfd-9219-c60bb8275e8d" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-28T06:15:08Z" + } +} \ No newline at end of file