From 8e9ad64f9779765e5d60291600b2741b700505bd Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 26 Mar 2024 03:33:12 +0000 Subject: [PATCH] Publish Advisories GHSA-7cjq-2rfg-72jf GHSA-85hw-p3wr-87q9 GHSA-ppgm-9w39-cx97 GHSA-qc99-8rmf-q4mv GHSA-xrrw-7rr2-829v --- .../GHSA-7cjq-2rfg-72jf.json | 42 +++++++++++++++++++ .../GHSA-85hw-p3wr-87q9.json | 42 +++++++++++++++++++ .../GHSA-ppgm-9w39-cx97.json | 6 ++- .../GHSA-qc99-8rmf-q4mv.json | 6 ++- .../GHSA-xrrw-7rr2-829v.json | 6 ++- 5 files changed, 99 insertions(+), 3 deletions(-) create mode 100644 advisories/unreviewed/2024/03/GHSA-7cjq-2rfg-72jf/GHSA-7cjq-2rfg-72jf.json create mode 100644 advisories/unreviewed/2024/03/GHSA-85hw-p3wr-87q9/GHSA-85hw-p3wr-87q9.json diff --git a/advisories/unreviewed/2024/03/GHSA-7cjq-2rfg-72jf/GHSA-7cjq-2rfg-72jf.json b/advisories/unreviewed/2024/03/GHSA-7cjq-2rfg-72jf/GHSA-7cjq-2rfg-72jf.json new file mode 100644 index 00000000000..ffdcffc5909 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-7cjq-2rfg-72jf/GHSA-7cjq-2rfg-72jf.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7cjq-2rfg-72jf", + "modified": "2024-03-26T03:31:35Z", + "published": "2024-03-26T03:31:35Z", + "aliases": [ + "CVE-2024-2732" + ], + "details": "The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'themify_post_slider shortcode in all versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2732" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3056453/themify-shortcodes/trunk/includes/themify-shortcodes.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0aeb63e7-a24d-4d76-a8c7-f082dad87a55?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-26T02:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-85hw-p3wr-87q9/GHSA-85hw-p3wr-87q9.json b/advisories/unreviewed/2024/03/GHSA-85hw-p3wr-87q9/GHSA-85hw-p3wr-87q9.json new file mode 100644 index 00000000000..4e2f0835d17 --- /dev/null +++ b/advisories/unreviewed/2024/03/GHSA-85hw-p3wr-87q9/GHSA-85hw-p3wr-87q9.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-85hw-p3wr-87q9", + "modified": "2024-03-26T03:31:35Z", + "published": "2024-03-26T03:31:35Z", + "aliases": [ + "CVE-2024-0866" + ], + "details": "The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0866" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3050794%40check-email&new=3050794%40check-email&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9ae9307c-680c-43c7-8246-a3e6149c1fb6?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-03-26T03:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/03/GHSA-ppgm-9w39-cx97/GHSA-ppgm-9w39-cx97.json b/advisories/unreviewed/2024/03/GHSA-ppgm-9w39-cx97/GHSA-ppgm-9w39-cx97.json index 76a36c71da5..414de446f9e 100644 --- a/advisories/unreviewed/2024/03/GHSA-ppgm-9w39-cx97/GHSA-ppgm-9w39-cx97.json +++ b/advisories/unreviewed/2024/03/GHSA-ppgm-9w39-cx97/GHSA-ppgm-9w39-cx97.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-ppgm-9w39-cx97", - "modified": "2024-03-22T03:30:43Z", + "modified": "2024-03-26T03:31:33Z", "published": "2024-03-08T03:31:25Z", "aliases": [ "CVE-2024-23284" @@ -18,6 +18,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23284" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AO4BNNL5X2LQBJ6WX7VT4SGMA6R7DUU5" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BAIPBVDQV3GHMSNSZNEJCRZEPM7BEYGF" diff --git a/advisories/unreviewed/2024/03/GHSA-qc99-8rmf-q4mv/GHSA-qc99-8rmf-q4mv.json b/advisories/unreviewed/2024/03/GHSA-qc99-8rmf-q4mv/GHSA-qc99-8rmf-q4mv.json index c54bf1447fb..fe8a1563fd6 100644 --- a/advisories/unreviewed/2024/03/GHSA-qc99-8rmf-q4mv/GHSA-qc99-8rmf-q4mv.json +++ b/advisories/unreviewed/2024/03/GHSA-qc99-8rmf-q4mv/GHSA-qc99-8rmf-q4mv.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-qc99-8rmf-q4mv", - "modified": "2024-03-22T03:30:43Z", + "modified": "2024-03-26T03:31:33Z", "published": "2024-03-08T03:31:25Z", "aliases": [ "CVE-2024-23280" @@ -18,6 +18,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23280" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AO4BNNL5X2LQBJ6WX7VT4SGMA6R7DUU5" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BAIPBVDQV3GHMSNSZNEJCRZEPM7BEYGF" diff --git a/advisories/unreviewed/2024/03/GHSA-xrrw-7rr2-829v/GHSA-xrrw-7rr2-829v.json b/advisories/unreviewed/2024/03/GHSA-xrrw-7rr2-829v/GHSA-xrrw-7rr2-829v.json index 82f020f5dfe..85d8a1d2ce8 100644 --- a/advisories/unreviewed/2024/03/GHSA-xrrw-7rr2-829v/GHSA-xrrw-7rr2-829v.json +++ b/advisories/unreviewed/2024/03/GHSA-xrrw-7rr2-829v/GHSA-xrrw-7rr2-829v.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-xrrw-7rr2-829v", - "modified": "2024-03-22T03:30:43Z", + "modified": "2024-03-26T03:31:33Z", "published": "2024-03-08T03:31:25Z", "aliases": [ "CVE-2024-23263" @@ -18,6 +18,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23263" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AO4BNNL5X2LQBJ6WX7VT4SGMA6R7DUU5" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BAIPBVDQV3GHMSNSZNEJCRZEPM7BEYGF"