From 89ebbfea8c5d288b76e6c7f72bac354bb9e1e459 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 4 Dec 2024 12:32:57 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-hjwh-g78g-5xvp.json | 4 +- .../GHSA-7c7g-wccp-rrhj.json | 6 +- .../GHSA-5x39-cc3p-mj36.json | 4 +- .../GHSA-2rgr-w2hf-5v57.json | 36 ++++++++ .../GHSA-3j57-8hvg-f4cv.json | 36 ++++++++ .../GHSA-3j85-7c4g-4f56.json | 36 ++++++++ .../GHSA-4vgc-rwr6-7j6r.json | 36 ++++++++ .../GHSA-54pv-xj9x-h8qj.json | 88 +++++++++++++++++++ .../GHSA-79r7-4mh7-v639.json | 36 ++++++++ .../GHSA-79vx-rgpq-6669.json | 36 ++++++++ .../GHSA-9xwg-hw64-86p3.json | 40 +++++++++ .../GHSA-c453-36cx-pv4g.json | 36 ++++++++ .../GHSA-cf3c-34p8-48wj.json | 40 +++++++++ .../GHSA-frmj-xmrv-cmvv.json | 40 +++++++++ .../GHSA-fwf9-w2jm-q79m.json | 40 +++++++++ .../GHSA-gpr2-ch2p-q476.json | 48 ++++++++++ .../GHSA-gpxh-pmvf-r374.json | 40 +++++++++ .../GHSA-j6g6-p3mj-r2m2.json | 48 ++++++++++ .../GHSA-jv22-j23g-5gfv.json | 36 ++++++++ .../GHSA-m2pc-wfjr-69c4.json | 36 ++++++++ .../GHSA-m7rh-qqjw-9p72.json | 40 +++++++++ .../GHSA-mj26-h3p5-rj2m.json | 36 ++++++++ .../GHSA-p2hx-7wmw-x3vv.json | 36 ++++++++ .../GHSA-p53x-qm8g-2xm3.json | 40 +++++++++ .../GHSA-p752-jcj8-c4m8.json | 40 +++++++++ .../GHSA-phgf-8v5r-r8p3.json | 40 +++++++++ .../GHSA-qppx-vw2p-cwg9.json | 44 ++++++++++ .../GHSA-qxvv-ww3j-hm75.json | 40 +++++++++ .../GHSA-r5q6-3ggj-5g3c.json | 36 ++++++++ .../GHSA-rqjq-956w-gfp8.json | 48 ++++++++++ .../GHSA-rxhm-9gmq-9482.json | 36 ++++++++ .../GHSA-rxxc-45j4-gcc4.json | 36 ++++++++ .../GHSA-wgc9-p78v-h782.json | 40 +++++++++ .../GHSA-wv6h-2w59-v7m9.json | 44 ++++++++++ .../GHSA-x33g-ff5h-73r9.json | 36 ++++++++ .../GHSA-xc6v-jfg5-r2v4.json | 25 ++++++ .../GHSA-xfj9-6vm8-7xwg.json | 36 ++++++++ .../GHSA-xp4h-q65r-x2pm.json | 36 ++++++++ 38 files changed, 1404 insertions(+), 7 deletions(-) create mode 100644 advisories/unreviewed/2024/12/GHSA-2rgr-w2hf-5v57/GHSA-2rgr-w2hf-5v57.json create mode 100644 advisories/unreviewed/2024/12/GHSA-3j57-8hvg-f4cv/GHSA-3j57-8hvg-f4cv.json create mode 100644 advisories/unreviewed/2024/12/GHSA-3j85-7c4g-4f56/GHSA-3j85-7c4g-4f56.json create mode 100644 advisories/unreviewed/2024/12/GHSA-4vgc-rwr6-7j6r/GHSA-4vgc-rwr6-7j6r.json create mode 100644 advisories/unreviewed/2024/12/GHSA-54pv-xj9x-h8qj/GHSA-54pv-xj9x-h8qj.json create mode 100644 advisories/unreviewed/2024/12/GHSA-79r7-4mh7-v639/GHSA-79r7-4mh7-v639.json create mode 100644 advisories/unreviewed/2024/12/GHSA-79vx-rgpq-6669/GHSA-79vx-rgpq-6669.json create mode 100644 advisories/unreviewed/2024/12/GHSA-9xwg-hw64-86p3/GHSA-9xwg-hw64-86p3.json create mode 100644 advisories/unreviewed/2024/12/GHSA-c453-36cx-pv4g/GHSA-c453-36cx-pv4g.json create mode 100644 advisories/unreviewed/2024/12/GHSA-cf3c-34p8-48wj/GHSA-cf3c-34p8-48wj.json create mode 100644 advisories/unreviewed/2024/12/GHSA-frmj-xmrv-cmvv/GHSA-frmj-xmrv-cmvv.json create mode 100644 advisories/unreviewed/2024/12/GHSA-fwf9-w2jm-q79m/GHSA-fwf9-w2jm-q79m.json create mode 100644 advisories/unreviewed/2024/12/GHSA-gpr2-ch2p-q476/GHSA-gpr2-ch2p-q476.json create mode 100644 advisories/unreviewed/2024/12/GHSA-gpxh-pmvf-r374/GHSA-gpxh-pmvf-r374.json create mode 100644 advisories/unreviewed/2024/12/GHSA-j6g6-p3mj-r2m2/GHSA-j6g6-p3mj-r2m2.json create mode 100644 advisories/unreviewed/2024/12/GHSA-jv22-j23g-5gfv/GHSA-jv22-j23g-5gfv.json create mode 100644 advisories/unreviewed/2024/12/GHSA-m2pc-wfjr-69c4/GHSA-m2pc-wfjr-69c4.json create mode 100644 advisories/unreviewed/2024/12/GHSA-m7rh-qqjw-9p72/GHSA-m7rh-qqjw-9p72.json create mode 100644 advisories/unreviewed/2024/12/GHSA-mj26-h3p5-rj2m/GHSA-mj26-h3p5-rj2m.json create mode 100644 advisories/unreviewed/2024/12/GHSA-p2hx-7wmw-x3vv/GHSA-p2hx-7wmw-x3vv.json create mode 100644 advisories/unreviewed/2024/12/GHSA-p53x-qm8g-2xm3/GHSA-p53x-qm8g-2xm3.json create mode 100644 advisories/unreviewed/2024/12/GHSA-p752-jcj8-c4m8/GHSA-p752-jcj8-c4m8.json create mode 100644 advisories/unreviewed/2024/12/GHSA-phgf-8v5r-r8p3/GHSA-phgf-8v5r-r8p3.json create mode 100644 advisories/unreviewed/2024/12/GHSA-qppx-vw2p-cwg9/GHSA-qppx-vw2p-cwg9.json create mode 100644 advisories/unreviewed/2024/12/GHSA-qxvv-ww3j-hm75/GHSA-qxvv-ww3j-hm75.json create mode 100644 advisories/unreviewed/2024/12/GHSA-r5q6-3ggj-5g3c/GHSA-r5q6-3ggj-5g3c.json create mode 100644 advisories/unreviewed/2024/12/GHSA-rqjq-956w-gfp8/GHSA-rqjq-956w-gfp8.json create mode 100644 advisories/unreviewed/2024/12/GHSA-rxhm-9gmq-9482/GHSA-rxhm-9gmq-9482.json create mode 100644 advisories/unreviewed/2024/12/GHSA-rxxc-45j4-gcc4/GHSA-rxxc-45j4-gcc4.json create mode 100644 advisories/unreviewed/2024/12/GHSA-wgc9-p78v-h782/GHSA-wgc9-p78v-h782.json create mode 100644 advisories/unreviewed/2024/12/GHSA-wv6h-2w59-v7m9/GHSA-wv6h-2w59-v7m9.json create mode 100644 advisories/unreviewed/2024/12/GHSA-x33g-ff5h-73r9/GHSA-x33g-ff5h-73r9.json create mode 100644 advisories/unreviewed/2024/12/GHSA-xc6v-jfg5-r2v4/GHSA-xc6v-jfg5-r2v4.json create mode 100644 advisories/unreviewed/2024/12/GHSA-xfj9-6vm8-7xwg/GHSA-xfj9-6vm8-7xwg.json create mode 100644 advisories/unreviewed/2024/12/GHSA-xp4h-q65r-x2pm/GHSA-xp4h-q65r-x2pm.json diff --git a/advisories/unreviewed/2023/10/GHSA-hjwh-g78g-5xvp/GHSA-hjwh-g78g-5xvp.json b/advisories/unreviewed/2023/10/GHSA-hjwh-g78g-5xvp/GHSA-hjwh-g78g-5xvp.json index 22f81cb1b2f..05e3bc5a335 100644 --- a/advisories/unreviewed/2023/10/GHSA-hjwh-g78g-5xvp/GHSA-hjwh-g78g-5xvp.json +++ b/advisories/unreviewed/2023/10/GHSA-hjwh-g78g-5xvp/GHSA-hjwh-g78g-5xvp.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/08/GHSA-7c7g-wccp-rrhj/GHSA-7c7g-wccp-rrhj.json b/advisories/unreviewed/2024/08/GHSA-7c7g-wccp-rrhj/GHSA-7c7g-wccp-rrhj.json index 75bfcc7a6c2..f068e0d7be2 100644 --- a/advisories/unreviewed/2024/08/GHSA-7c7g-wccp-rrhj/GHSA-7c7g-wccp-rrhj.json +++ b/advisories/unreviewed/2024/08/GHSA-7c7g-wccp-rrhj/GHSA-7c7g-wccp-rrhj.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-7c7g-wccp-rrhj", - "modified": "2024-12-03T21:31:21Z", + "modified": "2024-12-04T12:31:44Z", "published": "2024-08-05T15:30:53Z", "aliases": [ "CVE-2024-7409" @@ -23,6 +23,10 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:10518" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:10528" + }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:6811" diff --git a/advisories/unreviewed/2024/10/GHSA-5x39-cc3p-mj36/GHSA-5x39-cc3p-mj36.json b/advisories/unreviewed/2024/10/GHSA-5x39-cc3p-mj36/GHSA-5x39-cc3p-mj36.json index e1f99cf0635..622f07a8e62 100644 --- a/advisories/unreviewed/2024/10/GHSA-5x39-cc3p-mj36/GHSA-5x39-cc3p-mj36.json +++ b/advisories/unreviewed/2024/10/GHSA-5x39-cc3p-mj36/GHSA-5x39-cc3p-mj36.json @@ -13,9 +13,7 @@ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" } ], - "affected": [ - - ], + "affected": [], "references": [ { "type": "ADVISORY", diff --git a/advisories/unreviewed/2024/12/GHSA-2rgr-w2hf-5v57/GHSA-2rgr-w2hf-5v57.json b/advisories/unreviewed/2024/12/GHSA-2rgr-w2hf-5v57/GHSA-2rgr-w2hf-5v57.json new file mode 100644 index 00000000000..dee166a9fc0 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-2rgr-w2hf-5v57/GHSA-2rgr-w2hf-5v57.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2rgr-w2hf-5v57", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-52276" + ], + "details": "** INITIAL LIMITED RELEASE **\n\nUser Interface (UI) Misrepresentation of Critical Information vulnerability in [WITHHELD] allows Content Spoofing.This issue affects [WITHHELD]: through 2024-12-04.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52276" + }, + { + "type": "WEB", + "url": "https://www.vulsec.org/advisories" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-451" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T11:30:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-3j57-8hvg-f4cv/GHSA-3j57-8hvg-f4cv.json b/advisories/unreviewed/2024/12/GHSA-3j57-8hvg-f4cv/GHSA-3j57-8hvg-f4cv.json new file mode 100644 index 00000000000..d5ac53357d0 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-3j57-8hvg-f4cv/GHSA-3j57-8hvg-f4cv.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3j57-8hvg-f4cv", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-54154" + ], + "details": "In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54154" + }, + { + "type": "WEB", + "url": "https://www.jetbrains.com/privacy-security/issues-fixed" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-23" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T12:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-3j85-7c4g-4f56/GHSA-3j85-7c4g-4f56.json b/advisories/unreviewed/2024/12/GHSA-3j85-7c4g-4f56/GHSA-3j85-7c4g-4f56.json new file mode 100644 index 00000000000..18d1968f173 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-3j85-7c4g-4f56/GHSA-3j85-7c4g-4f56.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3j85-7c4g-4f56", + "modified": "2024-12-04T12:31:44Z", + "published": "2024-12-04T12:31:44Z", + "aliases": [ + "CVE-2023-52944" + ], + "details": "Incorrect authorization vulnerability in ActionRule webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to perform limited actions on the set action rules function via unspecified vectors.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52944" + }, + { + "type": "WEB", + "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_24_04" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T07:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-4vgc-rwr6-7j6r/GHSA-4vgc-rwr6-7j6r.json b/advisories/unreviewed/2024/12/GHSA-4vgc-rwr6-7j6r/GHSA-4vgc-rwr6-7j6r.json new file mode 100644 index 00000000000..c8e161a37e3 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-4vgc-rwr6-7j6r/GHSA-4vgc-rwr6-7j6r.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4vgc-rwr6-7j6r", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-54156" + ], + "details": "In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54156" + }, + { + "type": "WEB", + "url": "https://www.jetbrains.com/privacy-security/issues-fixed" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1321" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T12:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-54pv-xj9x-h8qj/GHSA-54pv-xj9x-h8qj.json b/advisories/unreviewed/2024/12/GHSA-54pv-xj9x-h8qj/GHSA-54pv-xj9x-h8qj.json new file mode 100644 index 00000000000..a80a68ef87f --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-54pv-xj9x-h8qj/GHSA-54pv-xj9x-h8qj.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-54pv-xj9x-h8qj", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-5020" + ], + "details": "Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled FancyBox JavaScript library (versions 1.3.4 to 3.5.7) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5020" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3150376/woo-smart-quick-view" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3153081/colibri-page-builder" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3156791/form-maker" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3157076/nextgen-gallery" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3158415/envira-gallery-lite" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3160232/easy-fancybox" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3160432/visual-portfolio" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3161422/fv-wordpress-flowplayer" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3161892/wp-carousel-free" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3169926/accordion-slider" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3173097/responsive-lightbox" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3175577%40getwid%2Ftrunk&old=3119180%40getwid%2Ftrunk&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3186301%40fancybox-for-wordpress%2Ftrunk&old=3058912%40fancybox-for-wordpress%2Ftrunk&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d99d4b9a-aa09-434d-91a8-7afaa0e8b5db?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T09:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-79r7-4mh7-v639/GHSA-79r7-4mh7-v639.json b/advisories/unreviewed/2024/12/GHSA-79r7-4mh7-v639/GHSA-79r7-4mh7-v639.json new file mode 100644 index 00000000000..7f911781d3b --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-79r7-4mh7-v639/GHSA-79r7-4mh7-v639.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-79r7-4mh7-v639", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-52274" + ], + "details": "Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (setDoubleL2tpConfig->guest_ip_check(overflow arg: mask) modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52274" + }, + { + "type": "WEB", + "url": "https://www.vulsec.org/advisories" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-121" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T11:30:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-79vx-rgpq-6669/GHSA-79vx-rgpq-6669.json b/advisories/unreviewed/2024/12/GHSA-79vx-rgpq-6669/GHSA-79vx-rgpq-6669.json new file mode 100644 index 00000000000..5c5877b9aba --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-79vx-rgpq-6669/GHSA-79vx-rgpq-6669.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-79vx-rgpq-6669", + "modified": "2024-12-04T12:31:44Z", + "published": "2024-12-04T12:31:44Z", + "aliases": [ + "CVE-2024-11398" + ], + "details": "Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in OTP reset functionality in Synology Router Manager (SRM) before 1.3.1-9346-9 allows remote authenticated users to delete arbitrary files via unspecified vectors.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11398" + }, + { + "type": "WEB", + "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_24_03" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T07:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-9xwg-hw64-86p3/GHSA-9xwg-hw64-86p3.json b/advisories/unreviewed/2024/12/GHSA-9xwg-hw64-86p3/GHSA-9xwg-hw64-86p3.json new file mode 100644 index 00000000000..c3c1df2d824 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-9xwg-hw64-86p3/GHSA-9xwg-hw64-86p3.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9xwg-hw64-86p3", + "modified": "2024-12-04T12:31:44Z", + "published": "2024-12-04T12:31:44Z", + "aliases": [ + "CVE-2024-10787" + ], + "details": "The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private and draft posts created by Elementor that they should not have access to.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10787" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3198563%40lastudio-element-kit&new=3198563%40lastudio-element-kit&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2e63c0fb-7fe7-42f7-8fa9-ec159d3c8117?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-639" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T09:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-c453-36cx-pv4g/GHSA-c453-36cx-pv4g.json b/advisories/unreviewed/2024/12/GHSA-c453-36cx-pv4g/GHSA-c453-36cx-pv4g.json new file mode 100644 index 00000000000..ca015cf8db2 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-c453-36cx-pv4g/GHSA-c453-36cx-pv4g.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c453-36cx-pv4g", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-54153" + ], + "details": "In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54153" + }, + { + "type": "WEB", + "url": "https://www.jetbrains.com/privacy-security/issues-fixed" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T12:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-cf3c-34p8-48wj/GHSA-cf3c-34p8-48wj.json b/advisories/unreviewed/2024/12/GHSA-cf3c-34p8-48wj/GHSA-cf3c-34p8-48wj.json new file mode 100644 index 00000000000..e22a326b0fd --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-cf3c-34p8-48wj/GHSA-cf3c-34p8-48wj.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cf3c-34p8-48wj", + "modified": "2024-12-04T12:31:44Z", + "published": "2024-12-04T12:31:44Z", + "aliases": [ + "CVE-2024-10567" + ], + "details": "The TI WooCommerce Wishlist plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wizard' function in all versions up to, and including, 2.9.1. This makes it possible for unauthenticated attackers to create new pages, modify plugin settings, and perform limited options updates.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10567" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3199516/ti-woocommerce-wishlist" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0a5f2e1a-2216-4885-9b74-a08142816f2b?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T09:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-frmj-xmrv-cmvv/GHSA-frmj-xmrv-cmvv.json b/advisories/unreviewed/2024/12/GHSA-frmj-xmrv-cmvv/GHSA-frmj-xmrv-cmvv.json new file mode 100644 index 00000000000..8967a8dfc93 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-frmj-xmrv-cmvv/GHSA-frmj-xmrv-cmvv.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-frmj-xmrv-cmvv", + "modified": "2024-12-04T12:31:44Z", + "published": "2024-12-04T12:31:44Z", + "aliases": [ + "CVE-2024-11293" + ], + "details": "The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Social Sites Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.9. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11293" + }, + { + "type": "WEB", + "url": "https://pieregister.com" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/466ff226-a47e-46f1-a46c-6260208ffd42?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T08:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-fwf9-w2jm-q79m/GHSA-fwf9-w2jm-q79m.json b/advisories/unreviewed/2024/12/GHSA-fwf9-w2jm-q79m/GHSA-fwf9-w2jm-q79m.json new file mode 100644 index 00000000000..715555df476 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-fwf9-w2jm-q79m/GHSA-fwf9-w2jm-q79m.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fwf9-w2jm-q79m", + "modified": "2024-12-04T12:31:44Z", + "published": "2024-12-04T12:31:44Z", + "aliases": [ + "CVE-2024-11903" + ], + "details": "The WP eCards plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ecard' shortcode in all versions up to, and including, 1.3.904 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11903" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3199511%40wp-ecards-invites&new=3199511%40wp-ecards-invites&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fa8e1df5-2e8a-4c84-83f8-6f6d53d00356?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T08:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-gpr2-ch2p-q476/GHSA-gpr2-ch2p-q476.json b/advisories/unreviewed/2024/12/GHSA-gpr2-ch2p-q476/GHSA-gpr2-ch2p-q476.json new file mode 100644 index 00000000000..67eb95b0df0 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-gpr2-ch2p-q476/GHSA-gpr2-ch2p-q476.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gpr2-ch2p-q476", + "modified": "2024-12-04T12:31:46Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-8962" + ], + "details": "The WPBITS Addons For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8962" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wpbits-addons-for-elementor/trunk/includes/elementor-config.php#L721" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3200392" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/wpbits-addons-for-elementor/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f735f05d-8178-46bd-894d-49ccfb31d304?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T12:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-gpxh-pmvf-r374/GHSA-gpxh-pmvf-r374.json b/advisories/unreviewed/2024/12/GHSA-gpxh-pmvf-r374/GHSA-gpxh-pmvf-r374.json new file mode 100644 index 00000000000..74080396178 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-gpxh-pmvf-r374/GHSA-gpxh-pmvf-r374.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gpxh-pmvf-r374", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-11814" + ], + "details": "The Additional Custom Order Status for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the wfwp_wcos_delete_finished, wfwp_wcos_delete_fallback_finished, wfwp_wcos_delete_fallback_orders_updated, and wfwp_wcos_delete_fallback_status parameters in all versions up to, and including, 1.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11814" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3198852%40order-status-for-woocommerce%2Ftrunk&old=3179390%40order-status-for-woocommerce%2Ftrunk&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28267144-a709-4631-8925-69c6e0aca77c?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T10:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-j6g6-p3mj-r2m2/GHSA-j6g6-p3mj-r2m2.json b/advisories/unreviewed/2024/12/GHSA-j6g6-p3mj-r2m2/GHSA-j6g6-p3mj-r2m2.json new file mode 100644 index 00000000000..c7e402ff411 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-j6g6-p3mj-r2m2/GHSA-j6g6-p3mj-r2m2.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j6g6-p3mj-r2m2", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-11854" + ], + "details": "The Listdom – Business Directory and Classified Ads Listings WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11854" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/listdom/tags/3.6.0/templates/search/tpl.php#L22" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3200502" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/listdom/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9ccb47c2-5f4b-45ea-9c48-0a9042a2fce6?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T12:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-jv22-j23g-5gfv/GHSA-jv22-j23g-5gfv.json b/advisories/unreviewed/2024/12/GHSA-jv22-j23g-5gfv/GHSA-jv22-j23g-5gfv.json new file mode 100644 index 00000000000..5448b1f0fc2 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-jv22-j23g-5gfv/GHSA-jv22-j23g-5gfv.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jv22-j23g-5gfv", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-52273" + ], + "details": "Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (setDoublePppoeConfig->guest_ip_check(overflow arg: mask) modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52273" + }, + { + "type": "WEB", + "url": "https://www.vulsec.org/advisories" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-121" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T11:30:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-m2pc-wfjr-69c4/GHSA-m2pc-wfjr-69c4.json b/advisories/unreviewed/2024/12/GHSA-m2pc-wfjr-69c4/GHSA-m2pc-wfjr-69c4.json new file mode 100644 index 00000000000..b8bdaa5b2aa --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-m2pc-wfjr-69c4/GHSA-m2pc-wfjr-69c4.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m2pc-wfjr-69c4", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-54155" + ], + "details": "In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54155" + }, + { + "type": "WEB", + "url": "https://www.jetbrains.com/privacy-security/issues-fixed" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T12:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-m7rh-qqjw-9p72/GHSA-m7rh-qqjw-9p72.json b/advisories/unreviewed/2024/12/GHSA-m7rh-qqjw-9p72/GHSA-m7rh-qqjw-9p72.json new file mode 100644 index 00000000000..7c211af9b56 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-m7rh-qqjw-9p72/GHSA-m7rh-qqjw-9p72.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m7rh-qqjw-9p72", + "modified": "2024-12-04T12:31:44Z", + "published": "2024-12-04T12:31:44Z", + "aliases": [ + "CVE-2024-11769" + ], + "details": "The Flower Delivery by Florist One plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flower-delivery' shortcode in all versions up to, and including, 3.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11769" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3201180%40flower-delivery-by-florist-one&new=3201180%40flower-delivery-by-florist-one&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/93efae1f-1e4a-48ee-8a69-558c38925250?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T08:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-mj26-h3p5-rj2m/GHSA-mj26-h3p5-rj2m.json b/advisories/unreviewed/2024/12/GHSA-mj26-h3p5-rj2m/GHSA-mj26-h3p5-rj2m.json new file mode 100644 index 00000000000..a4a1f1f0ed6 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-mj26-h3p5-rj2m/GHSA-mj26-h3p5-rj2m.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mj26-h3p5-rj2m", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-54158" + ], + "details": "In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54158" + }, + { + "type": "WEB", + "url": "https://www.jetbrains.com/privacy-security/issues-fixed" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-173" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T12:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-p2hx-7wmw-x3vv/GHSA-p2hx-7wmw-x3vv.json b/advisories/unreviewed/2024/12/GHSA-p2hx-7wmw-x3vv/GHSA-p2hx-7wmw-x3vv.json new file mode 100644 index 00000000000..7cdf3fb8799 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-p2hx-7wmw-x3vv/GHSA-p2hx-7wmw-x3vv.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p2hx-7wmw-x3vv", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-52272" + ], + "details": "Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (fromAdvSetLanip(overflow arg:lanMask) modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52272" + }, + { + "type": "WEB", + "url": "https://www.vulsec.org/advisories" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-121" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T11:30:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-p53x-qm8g-2xm3/GHSA-p53x-qm8g-2xm3.json b/advisories/unreviewed/2024/12/GHSA-p53x-qm8g-2xm3/GHSA-p53x-qm8g-2xm3.json new file mode 100644 index 00000000000..8f8d10a6ef1 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-p53x-qm8g-2xm3/GHSA-p53x-qm8g-2xm3.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p53x-qm8g-2xm3", + "modified": "2024-12-04T12:31:44Z", + "published": "2024-12-04T12:31:44Z", + "aliases": [ + "CVE-2024-45717" + ], + "details": "The SolarWinds Platform was susceptible to a XSS vulnerability that affects the search and node information section of the user interface. This vulnerability requires authentication and requires user interaction.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45717" + }, + { + "type": "WEB", + "url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2024-4-1_release_notes.htm" + }, + { + "type": "WEB", + "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45717" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T07:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-p752-jcj8-c4m8/GHSA-p752-jcj8-c4m8.json b/advisories/unreviewed/2024/12/GHSA-p752-jcj8-c4m8/GHSA-p752-jcj8-c4m8.json new file mode 100644 index 00000000000..4f533345a5d --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-p752-jcj8-c4m8/GHSA-p752-jcj8-c4m8.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p752-jcj8-c4m8", + "modified": "2024-12-04T12:31:44Z", + "published": "2024-12-04T12:31:44Z", + "aliases": [ + "CVE-2023-6978" + ], + "details": "The WP Job Manager – Company Profiles plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'company' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6978" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3198763%40wp-job-manager-companies&new=3198763%40wp-job-manager-companies&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c8edba5b-9bce-4a93-86a6-bb6dcb30fa60?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T08:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-phgf-8v5r-r8p3/GHSA-phgf-8v5r-r8p3.json b/advisories/unreviewed/2024/12/GHSA-phgf-8v5r-r8p3/GHSA-phgf-8v5r-r8p3.json new file mode 100644 index 00000000000..97aa963edbc --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-phgf-8v5r-r8p3/GHSA-phgf-8v5r-r8p3.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-phgf-8v5r-r8p3", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-10576" + ], + "details": "Infinix devices contain a pre-loaded \"com.transsion.agingfunction\" application, that exposes an unsecured broadcast receiver. An attacker can communicate with the receiver and force the device to perform a factory reset without any Android system permissions. \n\nAfter multiple attempts to contact the vendor we did not receive any answer. We suppose this issue affects all Infinix Mobile devices.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:I/V:D/RE:X/U:Amber" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10576" + }, + { + "type": "WEB", + "url": "https://cert.pl/en/posts/2024/12/CVE-2024-10576" + }, + { + "type": "WEB", + "url": "https://cert.pl/posts/2024/12/CVE-2024-10576" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-925" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T12:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-qppx-vw2p-cwg9/GHSA-qppx-vw2p-cwg9.json b/advisories/unreviewed/2024/12/GHSA-qppx-vw2p-cwg9/GHSA-qppx-vw2p-cwg9.json new file mode 100644 index 00000000000..1a3a5fc0550 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-qppx-vw2p-cwg9/GHSA-qppx-vw2p-cwg9.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qppx-vw2p-cwg9", + "modified": "2024-12-04T12:31:44Z", + "published": "2024-12-04T12:31:44Z", + "aliases": [ + "CVE-2024-11466" + ], + "details": "The Intro Tour Tutorial DeepPresentation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11466" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/dp-intro-tours/tags/6.5.2/admin/class-dp-intro-tours-admin-settings.php#L125" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3198780%40dp-intro-tours&new=3198780%40dp-intro-tours&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1fe082a7-3d36-48b4-b81f-1e65e5ea430d?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T08:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-qxvv-ww3j-hm75/GHSA-qxvv-ww3j-hm75.json b/advisories/unreviewed/2024/12/GHSA-qxvv-ww3j-hm75/GHSA-qxvv-ww3j-hm75.json new file mode 100644 index 00000000000..d674f08a9ac --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-qxvv-ww3j-hm75/GHSA-qxvv-ww3j-hm75.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qxvv-ww3j-hm75", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-11952" + ], + "details": "The Classic Addons – WPBakery Page Builder plugin for WordPress is vulnerable to Limited Local PHP File Inclusion in all versions up to, and including, 3.0 via the 'style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, and permissions granted by an Administrator, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. The vulnerability is limited to PHP files in a Windows environment.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11952" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/classic-addons-wpbakery-page-builder-addons/tags/3.1/addons/testimonial-slider-item/testimonial-slider-item.php#L28" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9645b17e-6a7c-4cdd-ae43-7d2c84b624cc?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T09:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-r5q6-3ggj-5g3c/GHSA-r5q6-3ggj-5g3c.json b/advisories/unreviewed/2024/12/GHSA-r5q6-3ggj-5g3c/GHSA-r5q6-3ggj-5g3c.json new file mode 100644 index 00000000000..39b0522a523 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-r5q6-3ggj-5g3c/GHSA-r5q6-3ggj-5g3c.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r5q6-3ggj-5g3c", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-54157" + ], + "details": "In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54157" + }, + { + "type": "WEB", + "url": "https://www.jetbrains.com/privacy-security/issues-fixed" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1333" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T12:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-rqjq-956w-gfp8/GHSA-rqjq-956w-gfp8.json b/advisories/unreviewed/2024/12/GHSA-rqjq-956w-gfp8/GHSA-rqjq-956w-gfp8.json new file mode 100644 index 00000000000..197d19c4543 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-rqjq-956w-gfp8/GHSA-rqjq-956w-gfp8.json @@ -0,0 +1,48 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rqjq-956w-gfp8", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-11880" + ], + "details": "The B Testimonial – testimonial plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'b_testimonial' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11880" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/b-testimonial/tags/1.2.2/inc/theme/one.php#L18" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3200155/b-testimonial/trunk/inc/theme/one.php" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3200155%40b-testimonial&new=3200155%40b-testimonial&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ea251110-02fa-4f4e-a578-855d3331b200?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T09:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-rxhm-9gmq-9482/GHSA-rxhm-9gmq-9482.json b/advisories/unreviewed/2024/12/GHSA-rxhm-9gmq-9482/GHSA-rxhm-9gmq-9482.json new file mode 100644 index 00000000000..2d9c26fd50d --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-rxhm-9gmq-9482/GHSA-rxhm-9gmq-9482.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rxhm-9gmq-9482", + "modified": "2024-12-04T12:31:44Z", + "published": "2024-12-04T12:31:44Z", + "aliases": [ + "CVE-2023-52943" + ], + "details": "Incorrect authorization vulnerability in Alert.Setting webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to to perform limited actions on the alerting function via unspecified vectors.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52943" + }, + { + "type": "WEB", + "url": "https://www.synology.com/en-global/security/advisory/Synology_SA_24_04" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T07:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-rxxc-45j4-gcc4/GHSA-rxxc-45j4-gcc4.json b/advisories/unreviewed/2024/12/GHSA-rxxc-45j4-gcc4/GHSA-rxxc-45j4-gcc4.json new file mode 100644 index 00000000000..3428420ab76 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-rxxc-45j4-gcc4/GHSA-rxxc-45j4-gcc4.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rxxc-45j4-gcc4", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-8894" + ], + "details": "Out-of-bounds Write vulnerability was discovered in Open Design Alliance Drawings SDK before 2025.10. Reading crafted DWF file and missing proper checks on received SectionIterator data can trigger an unhandled exception. This can allow attackers to cause a crash, potentially enabling a denial-of-service attack (Crash, Exit, or Restart) or possible code execution.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8894" + }, + { + "type": "WEB", + "url": "https://www.opendesign.com/security-advisories" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-787" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T12:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-wgc9-p78v-h782/GHSA-wgc9-p78v-h782.json b/advisories/unreviewed/2024/12/GHSA-wgc9-p78v-h782/GHSA-wgc9-p78v-h782.json new file mode 100644 index 00000000000..23f21400906 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-wgc9-p78v-h782/GHSA-wgc9-p78v-h782.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wgc9-p78v-h782", + "modified": "2024-12-04T12:31:44Z", + "published": "2024-12-04T12:31:44Z", + "aliases": [ + "CVE-2024-10664" + ], + "details": "The Knowledge Base documentation & wiki plugin – BasePress Docs plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the basepress_db_posts_update() function in all versions up to, and including, 2.16.3.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the database.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10664" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3201489%40basepress&new=3201489%40basepress&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3aa6f3c2-0e45-4243-a26d-ba1c702fbe11?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T08:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-wv6h-2w59-v7m9/GHSA-wv6h-2w59-v7m9.json b/advisories/unreviewed/2024/12/GHSA-wv6h-2w59-v7m9/GHSA-wv6h-2w59-v7m9.json new file mode 100644 index 00000000000..0df87c1d5af --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-wv6h-2w59-v7m9/GHSA-wv6h-2w59-v7m9.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wv6h-2w59-v7m9", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-52275" + ], + "details": "Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (fromWizardHandle modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52275" + }, + { + "type": "WEB", + "url": "https://www.tendacn.com/download/detail-3316.html" + }, + { + "type": "WEB", + "url": "https://www.tendacn.com/download/detail-3794.html" + }, + { + "type": "WEB", + "url": "https://www.vulsec.org/advisories" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-121" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T11:30:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-x33g-ff5h-73r9/GHSA-x33g-ff5h-73r9.json b/advisories/unreviewed/2024/12/GHSA-x33g-ff5h-73r9/GHSA-x33g-ff5h-73r9.json new file mode 100644 index 00000000000..6af9c9f2941 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-x33g-ff5h-73r9/GHSA-x33g-ff5h-73r9.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x33g-ff5h-73r9", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-52277" + ], + "details": "User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSeal allows Content Spoofing.This issue affects DocuSeal: through 1.8.1, >1.8.1.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52277" + }, + { + "type": "WEB", + "url": "https://www.vulsec.org/advisories" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-451" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T11:30:51Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-xc6v-jfg5-r2v4/GHSA-xc6v-jfg5-r2v4.json b/advisories/unreviewed/2024/12/GHSA-xc6v-jfg5-r2v4/GHSA-xc6v-jfg5-r2v4.json new file mode 100644 index 00000000000..a332833a4d6 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-xc6v-jfg5-r2v4/GHSA-xc6v-jfg5-r2v4.json @@ -0,0 +1,25 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xc6v-jfg5-r2v4", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-52278" + ], + "details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52278" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T12:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-xfj9-6vm8-7xwg/GHSA-xfj9-6vm8-7xwg.json b/advisories/unreviewed/2024/12/GHSA-xfj9-6vm8-7xwg/GHSA-xfj9-6vm8-7xwg.json new file mode 100644 index 00000000000..76db0f3a785 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-xfj9-6vm8-7xwg/GHSA-xfj9-6vm8-7xwg.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xfj9-6vm8-7xwg", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-52269" + ], + "details": "** INITIAL LIMITED RELEASE **\n\nUser Interface (UI) Misrepresentation of Critical Information vulnerability in [WITHHELD] allows Content Spoofing.\nThe SaaS AI assistant ignores hidden content that is rendered after signing, misleading the user.\nThis issue affects [WITHHELD]: through 2024-12-04.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Red" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52269" + }, + { + "type": "WEB", + "url": "https://www.vulsec.org/advisories" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-451" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T12:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-xp4h-q65r-x2pm/GHSA-xp4h-q65r-x2pm.json b/advisories/unreviewed/2024/12/GHSA-xp4h-q65r-x2pm/GHSA-xp4h-q65r-x2pm.json new file mode 100644 index 00000000000..69f7a6fc0cb --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-xp4h-q65r-x2pm/GHSA-xp4h-q65r-x2pm.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xp4h-q65r-x2pm", + "modified": "2024-12-04T12:31:45Z", + "published": "2024-12-04T12:31:45Z", + "aliases": [ + "CVE-2024-12107" + ], + "details": "Double-Free Vulnerability in uD3TN BPv7 Caused by Malformed Endpoint Identifier allows remote attacker to reliably cause DoS", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12107" + }, + { + "type": "WEB", + "url": "https://gitlab.com/d3tn/ud3tn/-/issues/233" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-415" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-04T11:15:05Z" + } +} \ No newline at end of file