netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-78hx-gp6g-7mj6
GHSA-264v-69hm-998m
GHSA-26hr-4x6c-5c7x
GHSA-3wmx-48g3-x66g
GHSA-4gpf-chqm-6xhm
GHSA-4mrc-7pp3-99pr
GHSA-4r8x-26vf-3hx6
GHSA-5c8x-8xxx-22mm
GHSA-ff28-379j-9f2r
GHSA-hhwq-g35f-6pwq
GHSA-rg6c-frmf-w953
GHSA-wqq7-m9hm-p4xw
This commit is contained in:
advisory-database[bot]
2024-07-22 06:32:17 +00:00
parent 9f541b1812
commit 7c5884a017
12 changed files with 440 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/03/GHSA-78hx-gp6g-7mj6/GHSA-78hx-gp6g-7mj6.json
+9 -5
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-78hx-gp6g-7mj6",
"modified": "2024-07-17T18:31:00Z",
"modified": "2024-07-22T06:31:08Z",
"published": "2024-03-20T18:10:36Z",
"aliases": [
"CVE-2024-1394"
@@ -134,10 +134,6 @@
"type": "WEB",
"url": "https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1462"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3265"
@@ -174,6 +170,10 @@
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:4591"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:4672"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-1394"
@@ -202,6 +202,10 @@
"type": "WEB",
"url": "https://vuln.go.dev/ID/GO-2024-2660.json"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1462"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1468"
advisories/unreviewed/2024/07/GHSA-264v-69hm-998m/GHSA-264v-69hm-998m.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-264v-69hm-998m",
"modified": "2024-07-22T06:31:09Z",
"published": "2024-07-22T06:31:09Z",
"aliases": [
"CVE-2024-5973"
],
"details": "The MasterStudy LMS WordPress Plugin WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which could be used to get access to functionalities they shouldn't have.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5973"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/59abfb7c-d5ea-45f2-ab9a-4391978e3805"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T06:15:02Z"
}
}
advisories/unreviewed/2024/07/GHSA-26hr-4x6c-5c7x/GHSA-26hr-4x6c-5c7x.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-26hr-4x6c-5c7x",
"modified": "2024-07-22T06:31:08Z",
"published": "2024-07-22T06:31:08Z",
"aliases": [
"CVE-2024-5004"
],
"details": "The CM Popup Plugin for WordPress WordPress plugin before 1.6.6 does not sanitise and escape some of the campaign settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5004"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/4bea7baa-84a2-4b21-881c-4f17822329e7"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T06:15:02Z"
}
}
advisories/unreviewed/2024/07/GHSA-3wmx-48g3-x66g/GHSA-3wmx-48g3-x66g.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3wmx-48g3-x66g",
"modified": "2024-07-22T06:31:08Z",
"published": "2024-07-22T06:31:08Z",
"aliases": [
"CVE-2024-41709"
],
"details": "Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the \"administer fields\" permission.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41709"
},
{
"type": "WEB",
"url": "https://backdropcms.org/security/backdrop-sa-core-2024-001"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T06:15:02Z"
}
}
advisories/unreviewed/2024/07/GHSA-4gpf-chqm-6xhm/GHSA-4gpf-chqm-6xhm.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4gpf-chqm-6xhm",
"modified": "2024-07-22T06:31:08Z",
"published": "2024-07-22T06:31:08Z",
"aliases": [
"CVE-2024-6969"
],
"details": "A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /ajax/get_patient_history.php. The manipulation of the argument patient_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272123.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6969"
},
{
"type": "WEB",
"url": "https://github.com/Xu-Mingming/cve/blob/main/sql4.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.272123"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.272123"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.378108"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T04:15:01Z"
}
}
advisories/unreviewed/2024/07/GHSA-4mrc-7pp3-99pr/GHSA-4mrc-7pp3-99pr.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4mrc-7pp3-99pr",
"modified": "2024-07-22T06:31:09Z",
"published": "2024-07-22T06:31:09Z",
"aliases": [
"CVE-2024-6271"
],
"details": "The Community Events WordPress plugin before 1.5 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete arbitrary events via a CSRF attack",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6271"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/44d9d085-34cb-490f-a3f5-f9eafae85ab8"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T06:15:02Z"
}
}
advisories/unreviewed/2024/07/GHSA-4r8x-26vf-3hx6/GHSA-4r8x-26vf-3hx6.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4r8x-26vf-3hx6",
"modified": "2024-07-22T06:31:09Z",
"published": "2024-07-22T06:31:09Z",
"aliases": [
"CVE-2024-6243"
],
"details": "The HTML Forms WordPress plugin before 1.3.33 does not sanitize and escape the form message inputs, allowing high-privilege users, such as administrators, to perform Stored Cross-Site Scripting (XSS) attacks even when the unfiltered_html capability is disabled.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6243"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/f4097877-ba19-4738-a994-9593b9a5a635"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T06:15:02Z"
}
}
advisories/unreviewed/2024/07/GHSA-5c8x-8xxx-22mm/GHSA-5c8x-8xxx-22mm.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5c8x-8xxx-22mm",
"modified": "2024-07-22T06:31:08Z",
"published": "2024-07-22T06:31:08Z",
"aliases": [
"CVE-2024-5529"
],
"details": "The WP QuickLaTeX WordPress plugin before 3.8.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5529"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/66d0b4b7-cd4b-4ec4-95c0-d50773cb0b8f"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T06:15:02Z"
}
}
advisories/unreviewed/2024/07/GHSA-ff28-379j-9f2r/GHSA-ff28-379j-9f2r.json
+54
View File
@@ -0,0 +1,54 @@
{
"schema_version": "1.4.0",
"id": "GHSA-ff28-379j-9f2r",
"modified": "2024-07-22T06:31:08Z",
"published": "2024-07-22T06:31:08Z",
"aliases": [
"CVE-2024-6970"
],
"details": "A vulnerability classified as critical has been found in itsourcecode Tailoring Management System 1.0. Affected is an unknown function of the file /staffcatadd.php. The manipulation of the argument title leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-272124.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6970"
},
{
"type": "WEB",
"url": "https://github.com/nosaltsea/cve/issues/1"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.272124"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.272124"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.378239"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T04:15:02Z"
}
}
advisories/unreviewed/2024/07/GHSA-hhwq-g35f-6pwq/GHSA-hhwq-g35f-6pwq.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hhwq-g35f-6pwq",
"modified": "2024-07-22T06:31:08Z",
"published": "2024-07-22T06:31:08Z",
"aliases": [
"CVE-2024-41704"
],
"details": "LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images. (Work on a fixed version release has started in PR 3363.)",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41704"
},
{
"type": "WEB",
"url": "https://github.com/danny-avila/LibreChat/pull/3363"
},
{
"type": "WEB",
"url": "https://github.com/danny-avila/LibreChat/discussions/3315#discussioncomment-10074284"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T05:15:03Z"
}
}
advisories/unreviewed/2024/07/GHSA-rg6c-frmf-w953/GHSA-rg6c-frmf-w953.json
+39
View File
@@ -0,0 +1,39 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rg6c-frmf-w953",
"modified": "2024-07-22T06:31:08Z",
"published": "2024-07-22T06:31:08Z",
"aliases": [
"CVE-2024-41703"
],
"details": "LibreChat through 0.7.4-rc1 has incorrect access control for message updates. (Work on a fixed version release has started in PR 3363.)",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41703"
},
{
"type": "WEB",
"url": "https://github.com/danny-avila/LibreChat/pull/3363"
},
{
"type": "WEB",
"url": "https://github.com/danny-avila/LibreChat/discussions/3315#discussioncomment-10074284"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T05:15:03Z"
}
}
advisories/unreviewed/2024/07/GHSA-wqq7-m9hm-p4xw/GHSA-wqq7-m9hm-p4xw.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-wqq7-m9hm-p4xw",
"modified": "2024-07-22T06:31:09Z",
"published": "2024-07-22T06:31:09Z",
"aliases": [
"CVE-2024-6244"
],
"details": "The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6244"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/73ba55a5-6cff-40fc-9686-30c50f060732"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T06:15:02Z"
}
}