netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2023-11-08 21:31:50 +00:00
parent 3ef3b6a849
commit 7fafdce406
68 changed files with 910 additions and 193 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2023/02/GHSA-9qr8-h5jr-2gmw/GHSA-9qr8-h5jr-2gmw.json
+4
View File
@@ -32,6 +32,10 @@
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/11/08/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/11/08/5"
}
],
"database_specific": {
advisories/unreviewed/2023/10/GHSA-2rrm-7h4w-qg5g/GHSA-2rrm-7h4w-qg5g.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2rrm-7h4w-qg5g",
"modified": "2023-10-31T15:30:24Z",
"modified": "2023-11-08T21:30:34Z",
"published": "2023-10-31T15:30:24Z",
"aliases": [
"CVE-2023-5360"
],
"details": "The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -27,9 +30,9 @@
"cwe_ids": [
"CWE-434"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T14:15:12Z"
}
}
advisories/unreviewed/2023/10/GHSA-3x9m-qxj4-gff3/GHSA-3x9m-qxj4-gff3.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3x9m-qxj4-gff3",
"modified": "2023-10-31T15:30:24Z",
"modified": "2023-11-08T21:30:34Z",
"published": "2023-10-31T15:30:24Z",
"aliases": [
"CVE-2023-31212"
],
"details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Database for Contact Form 7, WPforms, Elementor forms contact-form-entries allows SQL Injection.This issue affects Database for Contact Form 7, WPforms, Elementor forms: from n/a through 1.3.0.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -27,9 +30,9 @@
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T15:15:08Z"
}
}
advisories/unreviewed/2023/10/GHSA-3xwq-m4f9-jf8w/GHSA-3xwq-m4f9-jf8w.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3xwq-m4f9-jf8w",
"modified": "2023-10-31T15:30:24Z",
"modified": "2023-11-08T21:30:34Z",
"published": "2023-10-31T15:30:24Z",
"aliases": [
"CVE-2023-24410"
],
"details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Contact Form - WPManageNinja LLC Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms fluentform allows SQL Injection.This issue affects Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms: from n/a through 4.3.25.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -27,9 +30,9 @@
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T15:15:08Z"
}
}
advisories/unreviewed/2023/10/GHSA-577v-m627-qpf4/GHSA-577v-m627-qpf4.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-577v-m627-qpf4",
"modified": "2023-10-31T15:30:23Z",
"modified": "2023-11-08T21:30:34Z",
"published": "2023-10-31T15:30:23Z",
"aliases": [
"CVE-2023-5211"
],
"details": "The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -27,9 +30,9 @@
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T14:15:12Z"
}
}
advisories/unreviewed/2023/10/GHSA-5vqr-qc3r-pv4r/GHSA-5vqr-qc3r-pv4r.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5vqr-qc3r-pv4r",
"modified": "2023-10-31T15:30:24Z",
"modified": "2023-11-08T21:30:34Z",
"published": "2023-10-31T15:30:24Z",
"aliases": [
"CVE-2023-33927"
],
"details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Multiple Page Generator Plugin – MPG multiple-pages-generator-by-porthas allows SQL Injection.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.3.19.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -27,9 +30,9 @@
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T15:15:08Z"
}
}
advisories/unreviewed/2023/10/GHSA-67p3-vgwg-jfjf/GHSA-67p3-vgwg-jfjf.json
+4 -3
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-67p3-vgwg-jfjf",
"modified": "2023-10-30T00:30:17Z",
"modified": "2023-11-08T21:30:33Z",
"published": "2023-10-30T00:30:17Z",
"aliases": [
"CVE-2023-4393"
@@ -28,9 +28,10 @@
],
"database_specific": {
"cwe_ids": [
"CWE-20"
"CWE-20",
"CWE-74"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-30T00:15:39Z"
advisories/unreviewed/2023/10/GHSA-7rjj-x9r2-43h4/GHSA-7rjj-x9r2-43h4.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7rjj-x9r2-43h4",
"modified": "2023-10-31T15:30:24Z",
"modified": "2023-11-08T21:30:34Z",
"published": "2023-10-31T15:30:24Z",
"aliases": [
"CVE-2023-5243"
],
"details": "The Login Screen Manager WordPress plugin through 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -27,9 +30,9 @@
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T14:15:12Z"
}
}
advisories/unreviewed/2023/10/GHSA-8jvw-g6jp-rqqp/GHSA-8jvw-g6jp-rqqp.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8jvw-g6jp-rqqp",
"modified": "2023-10-31T15:30:23Z",
"modified": "2023-11-08T21:30:34Z",
"published": "2023-10-31T15:30:23Z",
"aliases": [
"CVE-2023-5098"
],
"details": "The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any options on a site with the string \"true\", which could lead to a variety of outcomes, including DoS.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [
@@ -27,9 +30,9 @@
"cwe_ids": [
"CWE-284"
],
"severity": null,
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T14:15:12Z"
}
}
advisories/unreviewed/2023/10/GHSA-8prx-84h6-4fr5/GHSA-8prx-84h6-4fr5.json
+1 -1
View File
@@ -52,7 +52,7 @@
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"severity": "CRITICAL",
"github_reviewed": false,
advisories/unreviewed/2023/10/GHSA-9xjj-cwg3-hjc7/GHSA-9xjj-cwg3-hjc7.json
+8 -5
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9xjj-cwg3-hjc7",
"modified": "2023-10-31T21:32:35Z",
"modified": "2023-11-08T21:30:34Z",
"published": "2023-10-31T21:32:35Z",
"aliases": [
"CVE-2023-46484"
],
"details": "An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setLedCfg function.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,11 +28,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T21:15:08Z"
}
}
advisories/unreviewed/2023/10/GHSA-g468-f3m4-727c/GHSA-g468-f3m4-727c.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g468-f3m4-727c",
"modified": "2023-10-31T15:30:24Z",
"modified": "2023-11-08T21:30:34Z",
"published": "2023-10-31T15:30:24Z",
"aliases": [
"CVE-2023-5519"
],
"details": "The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwanted bookings via CSRF attacks.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [
@@ -27,9 +30,9 @@
"cwe_ids": [
"CWE-352"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T14:15:12Z"
}
}
advisories/unreviewed/2023/10/GHSA-g5gm-qgrx-3h7c/GHSA-g5gm-qgrx-3h7c.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g5gm-qgrx-3h7c",
"modified": "2023-10-31T15:30:24Z",
"modified": "2023-11-08T21:30:34Z",
"published": "2023-10-31T15:30:24Z",
"aliases": [
"CVE-2023-5238"
],
"details": "The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -27,9 +30,9 @@
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T14:15:12Z"
}
}
advisories/unreviewed/2023/10/GHSA-hmf3-8cx7-g4jw/GHSA-hmf3-8cx7-g4jw.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hmf3-8cx7-g4jw",
"modified": "2023-10-31T15:30:24Z",
"modified": "2023-11-08T21:30:34Z",
"published": "2023-10-31T15:30:24Z",
"aliases": [
"CVE-2023-5307"
],
"details": "The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks via certain headers.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -31,9 +34,9 @@
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T14:15:12Z"
}
}
advisories/unreviewed/2023/10/GHSA-jmvp-hm64-wcvc/GHSA-jmvp-hm64-wcvc.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jmvp-hm64-wcvc",
"modified": "2023-10-31T15:30:24Z",
"modified": "2023-11-08T21:30:34Z",
"published": "2023-10-31T15:30:24Z",
"aliases": [
"CVE-2023-5237"
],
"details": "The Memberlite Shortcodes WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -31,9 +34,9 @@
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T14:15:12Z"
}
}
advisories/unreviewed/2023/10/GHSA-m9r2-v6px-98w2/GHSA-m9r2-v6px-98w2.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m9r2-v6px-98w2",
"modified": "2023-10-31T15:30:23Z",
"modified": "2023-11-08T21:30:34Z",
"published": "2023-10-31T15:30:23Z",
"aliases": [
"CVE-2023-5229"
],
"details": "The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -27,9 +30,9 @@
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T14:15:12Z"
}
}
advisories/unreviewed/2023/10/GHSA-mfm9-gf89-rmqf/GHSA-mfm9-gf89-rmqf.json
+8 -5
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mfm9-gf89-rmqf",
"modified": "2023-10-31T21:32:36Z",
"modified": "2023-11-08T21:30:35Z",
"published": "2023-10-31T21:32:36Z",
"aliases": [
"CVE-2023-46485"
],
"details": "An issue in TOTOlink X6000R V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the setTracerouteCfg function of the stecgi.cgi component.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -25,11 +28,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-77"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T21:15:08Z"
}
}
advisories/unreviewed/2023/10/GHSA-mph8-5cmm-748x/GHSA-mph8-5cmm-748x.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mph8-5cmm-748x",
"modified": "2023-10-31T15:30:24Z",
"modified": "2023-11-08T21:30:34Z",
"published": "2023-10-31T15:30:24Z",
"aliases": [
"CVE-2023-36508"
],
"details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress contact-form-to-db allows SQL Injection.This issue affects Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress: from n/a through 1.7.1.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -27,9 +30,9 @@
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T15:15:08Z"
}
}
advisories/unreviewed/2023/10/GHSA-p649-773m-qr8x/GHSA-p649-773m-qr8x.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p649-773m-qr8x",
"modified": "2023-10-31T15:30:24Z",
"modified": "2023-11-08T21:30:34Z",
"published": "2023-10-31T15:30:24Z",
"aliases": [
"CVE-2023-5458"
],
"details": "The CITS Support svg, webp Media and TTF,OTF File Upload WordPress plugin before 3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
@@ -27,9 +30,9 @@
"cwe_ids": [
"CWE-79"
],
"severity": null,
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T14:15:12Z"
}
}
advisories/unreviewed/2023/10/GHSA-qgfp-cppw-mc67/GHSA-qgfp-cppw-mc67.json
+7 -4
View File
@@ -1,14 +1,17 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qgfp-cppw-mc67",
"modified": "2023-10-31T15:30:24Z",
"modified": "2023-11-08T21:30:34Z",
"published": "2023-10-31T15:30:24Z",
"aliases": [
"CVE-2023-35879"
],
"details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.78.\n\n",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
@@ -27,9 +30,9 @@
"cwe_ids": [
"CWE-89"
],
"severity": null,
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": null
"nvd_published_at": "2023-10-31T15:15:08Z"
}
}

Some files were not shown because too many files have changed in this diff Show More