Publish Advisories

GHSA-wh4j-r7mv-vjg8
GHSA-x45c-39pv-5956
GHSA-7hff-rf7r-cq99
GHSA-238g-wwhc-fr8p
GHSA-2497-m587-h6c8
GHSA-25qx-vfw2-fw8r
GHSA-8rm8-w795-ff7r
GHSA-9f68-5hcg-8ww5
GHSA-g773-pwrm-8hmq
GHSA-jpv8-jjh5-pvv6

advisories/unreviewed/2023/11/GHSA-wh4j-r7mv-vjg8/GHSA-wh4j-r7mv-vjg8.json

@@ -28,6 +28,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
+      "CWE-269",
       "CWE-665"
     ],
     "severity": "HIGH",

advisories/unreviewed/2023/11/GHSA-x45c-39pv-5956/GHSA-x45c-39pv-5956.json

@@ -28,6 +28,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
+      "CWE-269",
       "CWE-277",
       "CWE-732"
     ],

advisories/unreviewed/2024/03/GHSA-7hff-rf7r-cq99/GHSA-7hff-rf7r-cq99.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7hff-rf7r-cq99",
-  "modified": "2024-03-11T21:31:24Z",
+  "modified": "2024-08-15T00:30:59Z",
   "published": "2024-03-11T21:31:24Z",
   "aliases": [
     "CVE-2024-22009"
   ],
   "details": "In init_data of TBD, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-787"
     ],
-    "severity": null,
+    "severity": "HIGH",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-03-11T19:15:47Z"

advisories/unreviewed/2024/04/GHSA-238g-wwhc-fr8p/GHSA-238g-wwhc-fr8p.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-238g-wwhc-fr8p",
-  "modified": "2024-04-17T21:30:49Z",
+  "modified": "2024-08-15T00:30:59Z",
   "published": "2024-04-17T21:30:49Z",
   "aliases": [
     "CVE-2024-32340"
   ],
   "details": "A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the WEBSITE TITLE parameter under the Menu module.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-79"
     ],
-    "severity": null,
+    "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-04-17T21:15:09Z"

advisories/unreviewed/2024/08/GHSA-2497-m587-h6c8/GHSA-2497-m587-h6c8.json

@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2497-m587-h6c8",
+  "modified": "2024-08-15T00:30:59Z",
+  "published": "2024-08-15T00:30:59Z",
+  "aliases": [
+    "CVE-2024-7797"
+  ],
+  "details": "A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. Affected is an unknown function of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=login. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7797"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.274650"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.274650"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.390290"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-08-15T00:15:13Z"
+  }
+}

advisories/unreviewed/2024/08/GHSA-25qx-vfw2-fw8r/GHSA-25qx-vfw2-fw8r.json

@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-25qx-vfw2-fw8r",
+  "modified": "2024-08-15T00:30:59Z",
+  "published": "2024-08-15T00:30:59Z",
+  "aliases": [
+    "CVE-2024-7625"
+  ],
+  "details": "In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.16.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7625"
+    },
+    {
+      "type": "WEB",
+      "url": "https://discuss.hashicorp.com/t/hcsec-2024-17-nomad-vulnerable-to-allocation-directory-escape-on-non-existing-file-paths-through-archive-unpacking/69293"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-610"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-08-15T00:15:13Z"
+  }
+}

advisories/unreviewed/2024/08/GHSA-8rm8-w795-ff7r/GHSA-8rm8-w795-ff7r.json

@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8rm8-w795-ff7r",
+  "modified": "2024-08-15T00:30:59Z",
+  "published": "2024-08-15T00:30:59Z",
+  "aliases": [
+    "CVE-2024-7799"
+  ],
+  "details": "A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /simple-online-bidding-system/bidding/admin/users.php. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7799"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Wsstiger/cve/blob/main/Sourcecoster_unauthorized.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.274652"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.274652"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.390302"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-285"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-08-15T00:15:14Z"
+  }
+}

advisories/unreviewed/2024/08/GHSA-9f68-5hcg-8ww5/GHSA-9f68-5hcg-8ww5.json

@@ -1,14 +1,17 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9f68-5hcg-8ww5",
-  "modified": "2024-08-12T18:30:48Z",
+  "modified": "2024-08-15T00:30:59Z",
   "published": "2024-08-12T18:30:48Z",
   "aliases": [
     "CVE-2024-41651"
   ],
   "details": "An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
   ],
   "affected": [
 
@@ -25,9 +28,9 @@
   ],
   "database_specific": {
     "cwe_ids": [
-
+      "CWE-94"
     ],
-    "severity": null,
+    "severity": "CRITICAL",
     "github_reviewed": false,
     "github_reviewed_at": null,
     "nvd_published_at": "2024-08-12T17:15:17Z"

advisories/unreviewed/2024/08/GHSA-g773-pwrm-8hmq/GHSA-g773-pwrm-8hmq.json

@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-g773-pwrm-8hmq",
+  "modified": "2024-08-15T00:31:00Z",
+  "published": "2024-08-15T00:31:00Z",
+  "aliases": [
+    "CVE-2024-7800"
+  ],
+  "details": "A vulnerability classified as critical has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=delete_product. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7800"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql3.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.274653"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.274653"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.390773"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-08-15T00:15:14Z"
+  }
+}

advisories/unreviewed/2024/08/GHSA-jpv8-jjh5-pvv6/GHSA-jpv8-jjh5-pvv6.json

@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jpv8-jjh5-pvv6",
+  "modified": "2024-08-15T00:30:59Z",
+  "published": "2024-08-15T00:30:59Z",
+  "aliases": [
+    "CVE-2024-7798"
+  ],
+  "details": "A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=login2. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7798"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql2.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.274651"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.274651"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.390297"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-08-15T00:15:13Z"
+  }
+}