From 89972f89fc44d0aac548531d031836925ebd9b4f Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 30 Jul 2024 12:32:45 +0000
Subject: [PATCH] Publish Advisories

GHSA-526p-w8j5-8c86
GHSA-fm3g-m5v8-xw6m
GHSA-mrf5-g9rq-vqv9
---
 .../GHSA-526p-w8j5-8c86.json                  | 38 ++++++++++++++
 .../GHSA-fm3g-m5v8-xw6m.json                  | 38 ++++++++++++++
 .../GHSA-mrf5-g9rq-vqv9.json                  | 50 +++++++++++++++++++
 3 files changed, 126 insertions(+)
 create mode 100644 advisories/unreviewed/2024/07/GHSA-526p-w8j5-8c86/GHSA-526p-w8j5-8c86.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-fm3g-m5v8-xw6m/GHSA-fm3g-m5v8-xw6m.json
 create mode 100644 advisories/unreviewed/2024/07/GHSA-mrf5-g9rq-vqv9/GHSA-mrf5-g9rq-vqv9.json

diff --git a/advisories/unreviewed/2024/07/GHSA-526p-w8j5-8c86/GHSA-526p-w8j5-8c86.json b/advisories/unreviewed/2024/07/GHSA-526p-w8j5-8c86/GHSA-526p-w8j5-8c86.json
new file mode 100644
index 00000000000..628fec0ec74
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-526p-w8j5-8c86/GHSA-526p-w8j5-8c86.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-526p-w8j5-8c86",
+  "modified": "2024-07-30T12:31:17Z",
+  "published": "2024-07-30T12:31:17Z",
+  "aliases": [
+    "CVE-2024-41701"
+  ],
+  "details": "AccuPOS - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41701"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-200"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T10:15:01Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-fm3g-m5v8-xw6m/GHSA-fm3g-m5v8-xw6m.json b/advisories/unreviewed/2024/07/GHSA-fm3g-m5v8-xw6m/GHSA-fm3g-m5v8-xw6m.json
new file mode 100644
index 00000000000..d4c0bad2e97
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-fm3g-m5v8-xw6m/GHSA-fm3g-m5v8-xw6m.json
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-fm3g-m5v8-xw6m",
+  "modified": "2024-07-30T12:31:17Z",
+  "published": "2024-07-30T12:31:17Z",
+  "aliases": [
+    "CVE-2024-41702"
+  ],
+  "details": "SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41702"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.gov.il/en/Departments/faq/cve_advisories"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T10:15:02Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/07/GHSA-mrf5-g9rq-vqv9/GHSA-mrf5-g9rq-vqv9.json b/advisories/unreviewed/2024/07/GHSA-mrf5-g9rq-vqv9/GHSA-mrf5-g9rq-vqv9.json
new file mode 100644
index 00000000000..ad9f4ce8f72
--- /dev/null
+++ b/advisories/unreviewed/2024/07/GHSA-mrf5-g9rq-vqv9/GHSA-mrf5-g9rq-vqv9.json
@@ -0,0 +1,50 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mrf5-g9rq-vqv9",
+  "modified": "2024-07-30T12:31:18Z",
+  "published": "2024-07-30T12:31:18Z",
+  "aliases": [
+    "CVE-2024-7127"
+  ],
+  "details": "Improper Neutralization of Input During Web Page Generation vulnerability in Stackposts Social Marketing Tool allows Cross-site Scripting (XSS) attack. By submitting the payload in the username during registration, it can be executed later in the application panel. This could lead to the unauthorised acquisition of information (e.g. cookies from a logged-in user). After multiple attempts to contact the vendor we did not receive any answer. Our team has confirmed the existence of this vulnerability. We suppose this issue affects Social Marketing Tool in all versions.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:L/U:Green"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7127"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cert.pl/en/posts/2024/07/CVE-2024-7127"
+    },
+    {
+      "type": "WEB",
+      "url": "https://cert.pl/posts/2024/07/CVE-2024-7127"
+    },
+    {
+      "type": "WEB",
+      "url": "https://codecanyon.net/comments/30802802"
+    },
+    {
+      "type": "WEB",
+      "url": "https://stackposts.com/product/stackposts-social-marketing-tool-1"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-07-30T12:15:09Z"
+  }
+}
\ No newline at end of file