diff --git a/advisories/unreviewed/2023/11/GHSA-wh4j-r7mv-vjg8/GHSA-wh4j-r7mv-vjg8.json b/advisories/unreviewed/2023/11/GHSA-wh4j-r7mv-vjg8/GHSA-wh4j-r7mv-vjg8.json index 5f212974108..e94007f9ae3 100644 --- a/advisories/unreviewed/2023/11/GHSA-wh4j-r7mv-vjg8/GHSA-wh4j-r7mv-vjg8.json +++ b/advisories/unreviewed/2023/11/GHSA-wh4j-r7mv-vjg8/GHSA-wh4j-r7mv-vjg8.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-269", "CWE-665" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2023/11/GHSA-x45c-39pv-5956/GHSA-x45c-39pv-5956.json b/advisories/unreviewed/2023/11/GHSA-x45c-39pv-5956/GHSA-x45c-39pv-5956.json index 41575489b41..c8ff25987cc 100644 --- a/advisories/unreviewed/2023/11/GHSA-x45c-39pv-5956/GHSA-x45c-39pv-5956.json +++ b/advisories/unreviewed/2023/11/GHSA-x45c-39pv-5956/GHSA-x45c-39pv-5956.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-269", "CWE-277", "CWE-732" ], diff --git a/advisories/unreviewed/2024/03/GHSA-7hff-rf7r-cq99/GHSA-7hff-rf7r-cq99.json b/advisories/unreviewed/2024/03/GHSA-7hff-rf7r-cq99/GHSA-7hff-rf7r-cq99.json index 312e2c9b5d4..232c58f89a0 100644 --- a/advisories/unreviewed/2024/03/GHSA-7hff-rf7r-cq99/GHSA-7hff-rf7r-cq99.json +++ b/advisories/unreviewed/2024/03/GHSA-7hff-rf7r-cq99/GHSA-7hff-rf7r-cq99.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-7hff-rf7r-cq99", - "modified": "2024-03-11T21:31:24Z", + "modified": "2024-08-15T00:30:59Z", "published": "2024-03-11T21:31:24Z", "aliases": [ "CVE-2024-22009" ], "details": "In init_data of TBD, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-787" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-11T19:15:47Z" diff --git a/advisories/unreviewed/2024/04/GHSA-238g-wwhc-fr8p/GHSA-238g-wwhc-fr8p.json b/advisories/unreviewed/2024/04/GHSA-238g-wwhc-fr8p/GHSA-238g-wwhc-fr8p.json index 3cb4b63feb6..46232ff6a47 100644 --- a/advisories/unreviewed/2024/04/GHSA-238g-wwhc-fr8p/GHSA-238g-wwhc-fr8p.json +++ b/advisories/unreviewed/2024/04/GHSA-238g-wwhc-fr8p/GHSA-238g-wwhc-fr8p.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-238g-wwhc-fr8p", - "modified": "2024-04-17T21:30:49Z", + "modified": "2024-08-15T00:30:59Z", "published": "2024-04-17T21:30:49Z", "aliases": [ "CVE-2024-32340" ], "details": "A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the WEBSITE TITLE parameter under the Menu module.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-17T21:15:09Z" diff --git a/advisories/unreviewed/2024/08/GHSA-2497-m587-h6c8/GHSA-2497-m587-h6c8.json b/advisories/unreviewed/2024/08/GHSA-2497-m587-h6c8/GHSA-2497-m587-h6c8.json new file mode 100644 index 00000000000..86b8d1329d7 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-2497-m587-h6c8/GHSA-2497-m587-h6c8.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2497-m587-h6c8", + "modified": "2024-08-15T00:30:59Z", + "published": "2024-08-15T00:30:59Z", + "aliases": [ + "CVE-2024-7797" + ], + "details": "A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. Affected is an unknown function of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=login. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7797" + }, + { + "type": "WEB", + "url": "https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.274650" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.274650" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.390290" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-15T00:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-25qx-vfw2-fw8r/GHSA-25qx-vfw2-fw8r.json b/advisories/unreviewed/2024/08/GHSA-25qx-vfw2-fw8r/GHSA-25qx-vfw2-fw8r.json new file mode 100644 index 00000000000..2f896951d62 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-25qx-vfw2-fw8r/GHSA-25qx-vfw2-fw8r.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-25qx-vfw2-fw8r", + "modified": "2024-08-15T00:30:59Z", + "published": "2024-08-15T00:30:59Z", + "aliases": [ + "CVE-2024-7625" + ], + "details": "In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.16.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7625" + }, + { + "type": "WEB", + "url": "https://discuss.hashicorp.com/t/hcsec-2024-17-nomad-vulnerable-to-allocation-directory-escape-on-non-existing-file-paths-through-archive-unpacking/69293" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-610" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-15T00:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-8rm8-w795-ff7r/GHSA-8rm8-w795-ff7r.json b/advisories/unreviewed/2024/08/GHSA-8rm8-w795-ff7r/GHSA-8rm8-w795-ff7r.json new file mode 100644 index 00000000000..bfb874a0b2a --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-8rm8-w795-ff7r/GHSA-8rm8-w795-ff7r.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8rm8-w795-ff7r", + "modified": "2024-08-15T00:30:59Z", + "published": "2024-08-15T00:30:59Z", + "aliases": [ + "CVE-2024-7799" + ], + "details": "A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /simple-online-bidding-system/bidding/admin/users.php. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7799" + }, + { + "type": "WEB", + "url": "https://github.com/Wsstiger/cve/blob/main/Sourcecoster_unauthorized.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.274652" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.274652" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.390302" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-285" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-15T00:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-9f68-5hcg-8ww5/GHSA-9f68-5hcg-8ww5.json b/advisories/unreviewed/2024/08/GHSA-9f68-5hcg-8ww5/GHSA-9f68-5hcg-8ww5.json index 823a497c7ea..75f7c914d28 100644 --- a/advisories/unreviewed/2024/08/GHSA-9f68-5hcg-8ww5/GHSA-9f68-5hcg-8ww5.json +++ b/advisories/unreviewed/2024/08/GHSA-9f68-5hcg-8ww5/GHSA-9f68-5hcg-8ww5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-9f68-5hcg-8ww5", - "modified": "2024-08-12T18:30:48Z", + "modified": "2024-08-15T00:30:59Z", "published": "2024-08-12T18:30:48Z", "aliases": [ "CVE-2024-41651" ], "details": "An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary code via the module upgrade functionality.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-94" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-12T17:15:17Z" diff --git a/advisories/unreviewed/2024/08/GHSA-g773-pwrm-8hmq/GHSA-g773-pwrm-8hmq.json b/advisories/unreviewed/2024/08/GHSA-g773-pwrm-8hmq/GHSA-g773-pwrm-8hmq.json new file mode 100644 index 00000000000..671c789ef04 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-g773-pwrm-8hmq/GHSA-g773-pwrm-8hmq.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g773-pwrm-8hmq", + "modified": "2024-08-15T00:31:00Z", + "published": "2024-08-15T00:31:00Z", + "aliases": [ + "CVE-2024-7800" + ], + "details": "A vulnerability classified as critical has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=delete_product. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7800" + }, + { + "type": "WEB", + "url": "https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql3.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.274653" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.274653" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.390773" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-15T00:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-jpv8-jjh5-pvv6/GHSA-jpv8-jjh5-pvv6.json b/advisories/unreviewed/2024/08/GHSA-jpv8-jjh5-pvv6/GHSA-jpv8-jjh5-pvv6.json new file mode 100644 index 00000000000..8cf7675bab9 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-jpv8-jjh5-pvv6/GHSA-jpv8-jjh5-pvv6.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jpv8-jjh5-pvv6", + "modified": "2024-08-15T00:30:59Z", + "published": "2024-08-15T00:30:59Z", + "aliases": [ + "CVE-2024-7798" + ], + "details": "A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=login2. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7798" + }, + { + "type": "WEB", + "url": "https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql2.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.274651" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.274651" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.390297" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-15T00:15:13Z" + } +} \ No newline at end of file