Publish Advisories

GHSA-4jfq-rfmm-h3r2 GHSA-8pgc-65mj-53h5 GHSA-cc52-c5qx-vgg7 GHSA-h8w3-xwp6-m9v8 GHSA-w4jg-m5rc-ppx7 GHSA-whg9-chpc-qg83 GHSA-xfx6-r52c-8v32
2026-05-22 18:04:22 -07:00 · 2024-07-19 06:33:03 +00:00
parent 9d4278c654
commit 878898fac1
7 changed files with 318 additions and 0 deletions
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4jfq-rfmm-h3r2",
+  "modified": "2024-07-19T06:31:13Z",
+  "published": "2024-07-19T06:31:13Z",
+  "aliases": [
+    "CVE-2024-6899"
+  ],
+  "details": "A vulnerability was found in SourceCodester Record Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file view_info.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-271924.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6899"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/netmanzhang/VUL/blob/main/Record-Management-System-02.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.271924"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.271924"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.375191"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-19T05:15:10Z"
+  }
+}
@@ -0,0 +1,70 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8pgc-65mj-53h5",
+  "modified": "2024-07-19T06:31:13Z",
+  "published": "2024-07-19T06:31:13Z",
+  "aliases": [
+    "CVE-2024-21583"
+  ],
+  "details": "Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/auth before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/server before main-gha.27122; versions of the package @gitpod/gitpod-protocol before 0.1.5-main-gha.27122 are vulnerable to Cookie Tossing due to a missing __Host- prefix on the _gitpod_io_jwt2_ session cookie. This allows an adversary who controls a subdomain to set the value of the cookie on the Gitpod control plane, which can be assigned to an attacker’s own JWT so that specific actions taken by the victim (such as connecting a new Github organization) are actioned by the attackers session.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21583"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/gitpod-io/gitpod/pull/19973"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/gitpod-io/gitpod/commit/da1053e1013f27a56e6d3533aa251dbd241d0155"
+    },
+    {
+      "type": "WEB",
+      "url": "https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=%5B%E2%80%A6%5D942e-c768d37e9e0c&tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34d"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSSERVERGOPKGLIB-7452074"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSWSPROXYPKGPROXY-7452075"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSAUTH-7452076"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSPUBLICAPISERVER-7452077"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSSERVER-7452078"
+    },
+    {
+      "type": "WEB",
+      "url": "https://security.snyk.io/vuln/SNYK-JS-GITPODGITPODPROTOCOL-7452079"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-15"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-19T05:15:10Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cc52-c5qx-vgg7",
+  "modified": "2024-07-19T06:31:13Z",
+  "published": "2024-07-19T06:31:13Z",
+  "aliases": [
+    "CVE-2023-7268"
+  ],
+  "details": "The ArtPlacer Widget WordPress plugin before 2.21.2 does not have authorisation check in place when deleting widgets,  allowing ay authenticated users, such as subscriber, to delete arbitrary widgets",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7268"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/9ac233dd-e00d-4aee-a41c-0de6e8aaefd7"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-19T06:15:02Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-h8w3-xwp6-m9v8",
+  "modified": "2024-07-19T06:31:13Z",
+  "published": "2024-07-19T06:31:13Z",
+  "aliases": [
+    "CVE-2024-6205"
+  ],
+  "details": "The PayPlus Payment Gateway WordPress plugin before 6.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement via a WooCommerce API route available to unauthenticated users, leading to an SQL injection vulnerability.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6205"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/7e2c5032-2917-418c-aee3-092bdb78a087"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-19T06:15:03Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-w4jg-m5rc-ppx7",
+  "modified": "2024-07-19T06:31:13Z",
+  "published": "2024-07-19T06:31:13Z",
+  "aliases": [
+    "CVE-2023-7269"
+  ],
+  "details": "The ArtPlacer Widget WordPress plugin before 2.21.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7269"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/1e8e1186-323b-473b-a0c4-580dc94020d7"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-19T06:15:03Z"
+  }
+}
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-whg9-chpc-qg83",
+  "modified": "2024-07-19T06:31:13Z",
+  "published": "2024-07-19T06:31:13Z",
+  "aliases": [
+    "CVE-2024-6898"
+  ],
+  "details": "A vulnerability was found in SourceCodester Record Management System 1.0. It has been classified as critical. This affects an unknown part of the file index.php. The manipulation of the argument UserName leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-271923.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6898"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/netmanzhang/VUL/blob/main/Record-Management-System-01.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.271923"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.271923"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.375190"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-19T04:15:05Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xfx6-r52c-8v32",
+  "modified": "2024-07-19T06:31:13Z",
+  "published": "2024-07-19T06:31:13Z",
+  "aliases": [
+    "CVE-2024-5604"
+  ],
+  "details": "The Bug Library WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5604"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/29985150-8d49-4a3f-8411-5d7263b424d8"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-19T06:15:03Z"
+  }
+}