From 8fc5c109159114ff3277dcc5d46bc885444bd1e3 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 20 Nov 2024 12:31:38 +0000 Subject: [PATCH] Advisory Database Sync --- .../GHSA-2gp9-6836-w826.json | 38 +++++++++++++ .../GHSA-2p5q-6jvg-jx9f.json | 46 ++++++++++++++++ .../GHSA-3vrf-pq5w-vhcx.json | 38 +++++++++++++ .../GHSA-72vc-j3q2-j7wq.json | 38 +++++++++++++ .../GHSA-7544-4q6w-5p3x.json | 38 +++++++++++++ .../GHSA-7g95-qrw8-q465.json | 38 +++++++++++++ .../GHSA-9rqc-7fm6-66gj.json | 42 +++++++++++++++ .../GHSA-cr53-8jc5-f689.json | 38 +++++++++++++ .../GHSA-fhg2-r2h9-h7q8.json | 39 ++++++++++++++ .../GHSA-frwj-7q3g-cchh.json | 38 +++++++++++++ .../GHSA-g5ww-fj2f-347h.json | 38 +++++++++++++ .../GHSA-hffh-x89x-2h44.json | 38 +++++++++++++ .../GHSA-hjq2-g54r-cfw9.json | 42 +++++++++++++++ .../GHSA-j4v3-wwwx-5gqv.json | 50 +++++++++++++++++ .../GHSA-j822-x5gg-5r56.json | 35 ++++++++++++ .../GHSA-j9hr-gx6q-5wpj.json | 38 +++++++++++++ .../GHSA-jf68-rmf6-ggpp.json | 38 +++++++++++++ .../GHSA-mgxx-v5wq-f4gr.json | 42 +++++++++++++++ .../GHSA-pq4w-jf35-7pmx.json | 38 +++++++++++++ .../GHSA-r4xr-m393-778m.json | 35 ++++++++++++ .../GHSA-r8j6-4hrp-v4w7.json | 38 +++++++++++++ .../GHSA-rvw7-mm9q-j59m.json | 38 +++++++++++++ .../GHSA-v2jx-72wh-2fm2.json | 38 +++++++++++++ .../GHSA-v86f-5fjh-2hqj.json | 38 +++++++++++++ .../GHSA-vxcv-4xvf-pc22.json | 54 +++++++++++++++++++ .../GHSA-whfg-68fr-cqmm.json | 38 +++++++++++++ .../GHSA-xfv7-h2qg-rjm7.json | 39 ++++++++++++++ .../GHSA-xwgw-3mc5-w4qf.json | 46 ++++++++++++++++ 28 files changed, 1116 insertions(+) create mode 100644 advisories/unreviewed/2024/11/GHSA-2gp9-6836-w826/GHSA-2gp9-6836-w826.json create mode 100644 advisories/unreviewed/2024/11/GHSA-2p5q-6jvg-jx9f/GHSA-2p5q-6jvg-jx9f.json create mode 100644 advisories/unreviewed/2024/11/GHSA-3vrf-pq5w-vhcx/GHSA-3vrf-pq5w-vhcx.json create mode 100644 advisories/unreviewed/2024/11/GHSA-72vc-j3q2-j7wq/GHSA-72vc-j3q2-j7wq.json create mode 100644 advisories/unreviewed/2024/11/GHSA-7544-4q6w-5p3x/GHSA-7544-4q6w-5p3x.json create mode 100644 advisories/unreviewed/2024/11/GHSA-7g95-qrw8-q465/GHSA-7g95-qrw8-q465.json create mode 100644 advisories/unreviewed/2024/11/GHSA-9rqc-7fm6-66gj/GHSA-9rqc-7fm6-66gj.json create mode 100644 advisories/unreviewed/2024/11/GHSA-cr53-8jc5-f689/GHSA-cr53-8jc5-f689.json create mode 100644 advisories/unreviewed/2024/11/GHSA-fhg2-r2h9-h7q8/GHSA-fhg2-r2h9-h7q8.json create mode 100644 advisories/unreviewed/2024/11/GHSA-frwj-7q3g-cchh/GHSA-frwj-7q3g-cchh.json create mode 100644 advisories/unreviewed/2024/11/GHSA-g5ww-fj2f-347h/GHSA-g5ww-fj2f-347h.json create mode 100644 advisories/unreviewed/2024/11/GHSA-hffh-x89x-2h44/GHSA-hffh-x89x-2h44.json create mode 100644 advisories/unreviewed/2024/11/GHSA-hjq2-g54r-cfw9/GHSA-hjq2-g54r-cfw9.json create mode 100644 advisories/unreviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json create mode 100644 advisories/unreviewed/2024/11/GHSA-j822-x5gg-5r56/GHSA-j822-x5gg-5r56.json create mode 100644 advisories/unreviewed/2024/11/GHSA-j9hr-gx6q-5wpj/GHSA-j9hr-gx6q-5wpj.json create mode 100644 advisories/unreviewed/2024/11/GHSA-jf68-rmf6-ggpp/GHSA-jf68-rmf6-ggpp.json create mode 100644 advisories/unreviewed/2024/11/GHSA-mgxx-v5wq-f4gr/GHSA-mgxx-v5wq-f4gr.json create mode 100644 advisories/unreviewed/2024/11/GHSA-pq4w-jf35-7pmx/GHSA-pq4w-jf35-7pmx.json create mode 100644 advisories/unreviewed/2024/11/GHSA-r4xr-m393-778m/GHSA-r4xr-m393-778m.json create mode 100644 advisories/unreviewed/2024/11/GHSA-r8j6-4hrp-v4w7/GHSA-r8j6-4hrp-v4w7.json create mode 100644 advisories/unreviewed/2024/11/GHSA-rvw7-mm9q-j59m/GHSA-rvw7-mm9q-j59m.json create mode 100644 advisories/unreviewed/2024/11/GHSA-v2jx-72wh-2fm2/GHSA-v2jx-72wh-2fm2.json create mode 100644 advisories/unreviewed/2024/11/GHSA-v86f-5fjh-2hqj/GHSA-v86f-5fjh-2hqj.json create mode 100644 advisories/unreviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json create mode 100644 advisories/unreviewed/2024/11/GHSA-whfg-68fr-cqmm/GHSA-whfg-68fr-cqmm.json create mode 100644 advisories/unreviewed/2024/11/GHSA-xfv7-h2qg-rjm7/GHSA-xfv7-h2qg-rjm7.json create mode 100644 advisories/unreviewed/2024/11/GHSA-xwgw-3mc5-w4qf/GHSA-xwgw-3mc5-w4qf.json diff --git a/advisories/unreviewed/2024/11/GHSA-2gp9-6836-w826/GHSA-2gp9-6836-w826.json b/advisories/unreviewed/2024/11/GHSA-2gp9-6836-w826/GHSA-2gp9-6836-w826.json new file mode 100644 index 00000000000..2c546bef7cf --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-2gp9-6836-w826/GHSA-2gp9-6836-w826.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2gp9-6836-w826", + "modified": "2024-11-20T12:30:36Z", + "published": "2024-11-20T12:30:36Z", + "aliases": [ + "CVE-2024-52449" + ], + "details": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Navneil Naicer Bootscraper allows PHP Local File Inclusion.This issue affects Bootscraper: from n/a through 2.1.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52449" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/wp-bootscraper/wordpress-wordpress-bootscraper-plugin-2-1-0-local-file-inclusion-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-2p5q-6jvg-jx9f/GHSA-2p5q-6jvg-jx9f.json b/advisories/unreviewed/2024/11/GHSA-2p5q-6jvg-jx9f/GHSA-2p5q-6jvg-jx9f.json new file mode 100644 index 00000000000..522cc50a0ca --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-2p5q-6jvg-jx9f/GHSA-2p5q-6jvg-jx9f.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2p5q-6jvg-jx9f", + "modified": "2024-11-20T12:30:35Z", + "published": "2024-11-20T12:30:35Z", + "aliases": [ + "CVE-2024-11179" + ], + "details": "The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' parameter in all versions up to, and including, 4.15.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11179" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.15.5/controllers/helpers/vendor-admin-wcfm-helper.php#L803" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3190678/mstore-api/trunk/controllers/helpers/vendor-admin-wcfm-helper.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b308bddf-a153-4d5b-936f-2170a1a494a5?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T10:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-3vrf-pq5w-vhcx/GHSA-3vrf-pq5w-vhcx.json b/advisories/unreviewed/2024/11/GHSA-3vrf-pq5w-vhcx/GHSA-3vrf-pq5w-vhcx.json new file mode 100644 index 00000000000..940a8cbe304 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-3vrf-pq5w-vhcx/GHSA-3vrf-pq5w-vhcx.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3vrf-pq5w-vhcx", + "modified": "2024-11-20T12:30:36Z", + "published": "2024-11-20T12:30:36Z", + "aliases": [ + "CVE-2024-52443" + ], + "details": "Deserialization of Untrusted Data vulnerability in Nerijus Masikonis Geolocator allows Object Injection.This issue affects Geolocator: from n/a through 1.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52443" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/geolocator/wordpress-geolocator-plugin-1-1-php-object-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-72vc-j3q2-j7wq/GHSA-72vc-j3q2-j7wq.json b/advisories/unreviewed/2024/11/GHSA-72vc-j3q2-j7wq/GHSA-72vc-j3q2-j7wq.json new file mode 100644 index 00000000000..7669f88abb8 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-72vc-j3q2-j7wq/GHSA-72vc-j3q2-j7wq.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-72vc-j3q2-j7wq", + "modified": "2024-11-20T12:30:36Z", + "published": "2024-11-20T12:30:36Z", + "aliases": [ + "CVE-2024-52450" + ], + "details": "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Official pro coders nBlocks allows PHP Local File Inclusion.This issue affects nBlocks: from n/a through 1.0.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52450" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/nblocks/wordpress-nblocks-plugin-1-0-2-local-file-inclusion-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-98" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-7544-4q6w-5p3x/GHSA-7544-4q6w-5p3x.json b/advisories/unreviewed/2024/11/GHSA-7544-4q6w-5p3x/GHSA-7544-4q6w-5p3x.json new file mode 100644 index 00000000000..2bdcb2edce7 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-7544-4q6w-5p3x/GHSA-7544-4q6w-5p3x.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7544-4q6w-5p3x", + "modified": "2024-11-20T12:30:36Z", + "published": "2024-11-20T12:30:36Z", + "aliases": [ + "CVE-2024-52439" + ], + "details": "Deserialization of Untrusted Data vulnerability in Mark O’Donnell Team Rosters allows Object Injection.This issue affects Team Rosters: from n/a through 4.6.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52439" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/team-rosters/wordpress-team-rosters-plugin-4-6-php-object-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-7g95-qrw8-q465/GHSA-7g95-qrw8-q465.json b/advisories/unreviewed/2024/11/GHSA-7g95-qrw8-q465/GHSA-7g95-qrw8-q465.json new file mode 100644 index 00000000000..4c4bf5b124c --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-7g95-qrw8-q465/GHSA-7g95-qrw8-q465.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7g95-qrw8-q465", + "modified": "2024-11-20T12:30:36Z", + "published": "2024-11-20T12:30:36Z", + "aliases": [ + "CVE-2024-52451" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Aaron Robbins Post Ideas allows SQL Injection.This issue affects Post Ideas: from n/a through 2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52451" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/post-ideas/wordpress-post-ideas-plugin-2-csrf-to-sql-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:22Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-9rqc-7fm6-66gj/GHSA-9rqc-7fm6-66gj.json b/advisories/unreviewed/2024/11/GHSA-9rqc-7fm6-66gj/GHSA-9rqc-7fm6-66gj.json new file mode 100644 index 00000000000..d1a062dda6b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-9rqc-7fm6-66gj/GHSA-9rqc-7fm6-66gj.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9rqc-7fm6-66gj", + "modified": "2024-11-20T12:30:35Z", + "published": "2024-11-20T12:30:35Z", + "aliases": [ + "CVE-2024-10520" + ], + "details": "The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'check' method of the 'Create_Milestone', 'Create_Task_List', 'Create_Task', and 'Delete_Task' classes in version 2.6.14. This makes it possible for unauthenticated attackers to create milestones, create task lists, create tasks, or delete tasks in any project. NOTE: Version 2.6.14 implemented a partial fix for this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10520" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3191204/wedevs-project-manager" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/497760a8-7d4a-45a0-91e4-a8ee27bcdb02?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-cr53-8jc5-f689/GHSA-cr53-8jc5-f689.json b/advisories/unreviewed/2024/11/GHSA-cr53-8jc5-f689/GHSA-cr53-8jc5-f689.json new file mode 100644 index 00000000000..c9797698ae2 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-cr53-8jc5-f689/GHSA-cr53-8jc5-f689.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cr53-8jc5-f689", + "modified": "2024-11-20T12:30:36Z", + "published": "2024-11-20T12:30:36Z", + "aliases": [ + "CVE-2024-52445" + ], + "details": "Deserialization of Untrusted Data vulnerability in Modeltheme QRMenu Restaurant QR Menu Lite allows Object Injection.This issue affects QRMenu Restaurant QR Menu Lite: from n/a through 1.0.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52445" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/qrmenu-lite/wordpress-qrmenu-restaurant-qr-menu-lite-plugin-1-0-3-php-object-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-fhg2-r2h9-h7q8/GHSA-fhg2-r2h9-h7q8.json b/advisories/unreviewed/2024/11/GHSA-fhg2-r2h9-h7q8/GHSA-fhg2-r2h9-h7q8.json new file mode 100644 index 00000000000..d65852bef1f --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-fhg2-r2h9-h7q8/GHSA-fhg2-r2h9-h7q8.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fhg2-r2h9-h7q8", + "modified": "2024-11-20T12:30:35Z", + "published": "2024-11-20T12:30:35Z", + "aliases": [ + "CVE-2024-45690" + ], + "details": "A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45690" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309939" + }, + { + "type": "WEB", + "url": "https://moodle.org/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T11:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-frwj-7q3g-cchh/GHSA-frwj-7q3g-cchh.json b/advisories/unreviewed/2024/11/GHSA-frwj-7q3g-cchh/GHSA-frwj-7q3g-cchh.json new file mode 100644 index 00000000000..0937fa235f6 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-frwj-7q3g-cchh/GHSA-frwj-7q3g-cchh.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-frwj-7q3g-cchh", + "modified": "2024-11-20T12:30:36Z", + "published": "2024-11-20T12:30:36Z", + "aliases": [ + "CVE-2024-52448" + ], + "details": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebCodingPlace Ultimate Classified Listings allows PHP Local File Inclusion.This issue affects Ultimate Classified Listings: from n/a through 1.4.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52448" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/ultimate-classified-listings/wordpress-ultimate-classified-listings-plugin-1-4-local-file-inclusion-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-g5ww-fj2f-347h/GHSA-g5ww-fj2f-347h.json b/advisories/unreviewed/2024/11/GHSA-g5ww-fj2f-347h/GHSA-g5ww-fj2f-347h.json new file mode 100644 index 00000000000..673bea17a76 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-g5ww-fj2f-347h/GHSA-g5ww-fj2f-347h.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g5ww-fj2f-347h", + "modified": "2024-11-20T12:30:35Z", + "published": "2024-11-20T12:30:35Z", + "aliases": [ + "CVE-2024-52437" + ], + "details": "Missing Authentication for Critical Function vulnerability in Saul Morales Pacheco Banner System allows Privilege Escalation.This issue affects Banner System: from n/a through 1.0.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52437" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/banner-system/wordpress-banner-system-plugin-1-0-0-privilege-escalation-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-306" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hffh-x89x-2h44/GHSA-hffh-x89x-2h44.json b/advisories/unreviewed/2024/11/GHSA-hffh-x89x-2h44/GHSA-hffh-x89x-2h44.json new file mode 100644 index 00000000000..0f4eb27c79f --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-hffh-x89x-2h44/GHSA-hffh-x89x-2h44.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hffh-x89x-2h44", + "modified": "2024-11-20T12:30:34Z", + "published": "2024-11-20T12:30:34Z", + "aliases": [ + "CVE-2024-11494" + ], + "details": "**UNSUPPORTED WHEN ASSIGNED** The improper authentication vulnerability in the Zyxel P-6101C ADSL modem firmware version P-6101CSA6AP_20140331 could allow an unauthenticated attacker to read some device information via a crafted HTTP HEAD method.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11494" + }, + { + "type": "WEB", + "url": "https://gist.github.com/stevenyu113228/78e0169d2ff110e9a65539eb29660d25" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T10:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hjq2-g54r-cfw9/GHSA-hjq2-g54r-cfw9.json b/advisories/unreviewed/2024/11/GHSA-hjq2-g54r-cfw9/GHSA-hjq2-g54r-cfw9.json new file mode 100644 index 00000000000..a4ac00451b2 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-hjq2-g54r-cfw9/GHSA-hjq2-g54r-cfw9.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hjq2-g54r-cfw9", + "modified": "2024-11-20T12:30:34Z", + "published": "2024-11-20T12:30:34Z", + "aliases": [ + "CVE-2024-10665" + ], + "details": "The Yaad Sarig Payment Gateway For WC plugin for WordPress is vulnerable to unauthorized modification & access of data due to a missing capability check on the yaadpay_view_log_callback() and yaadpay_delete_log_callback() functions in all versions up to, and including, 2.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and delete logs.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10665" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/yaad-sarig-payment-gateway-for-wc/trunk/classes/class-wc-gateway-yaadpay.php#L2518" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10409673-43dc-4c05-a996-120d753ebd6d?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T10:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json b/advisories/unreviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json new file mode 100644 index 00000000000..2650cf7021f --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-j4v3-wwwx-5gqv/GHSA-j4v3-wwwx-5gqv.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j4v3-wwwx-5gqv", + "modified": "2024-11-20T12:30:35Z", + "published": "2024-11-20T12:30:35Z", + "aliases": [ + "CVE-2024-11404" + ], + "details": "Unrestricted Upload of File with Dangerous Type, Improper Input Validation, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS.This issue affects django Filer: from 3 before 3.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11404" + }, + { + "type": "WEB", + "url": "https://iltosec.com/blog/post/djangocms-attributes-field-300-stored-xss-vulnerability" + }, + { + "type": "WEB", + "url": "https://pypi.org/project/django-filer" + }, + { + "type": "WEB", + "url": "https://www.django-cms.org/en/blog/2024/11/19/security-updates-for-django-filer-and-django-cms-attributes-field" + }, + { + "type": "WEB", + "url": "https://www.usom.gov.tr/bildirim/tr-24-1864" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-j822-x5gg-5r56/GHSA-j822-x5gg-5r56.json b/advisories/unreviewed/2024/11/GHSA-j822-x5gg-5r56/GHSA-j822-x5gg-5r56.json new file mode 100644 index 00000000000..9b62a206bad --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-j822-x5gg-5r56/GHSA-j822-x5gg-5r56.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j822-x5gg-5r56", + "modified": "2024-11-20T12:30:35Z", + "published": "2024-11-20T12:30:35Z", + "aliases": [ + "CVE-2024-45689" + ], + "details": "A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45689" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309941" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T11:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-j9hr-gx6q-5wpj/GHSA-j9hr-gx6q-5wpj.json b/advisories/unreviewed/2024/11/GHSA-j9hr-gx6q-5wpj/GHSA-j9hr-gx6q-5wpj.json new file mode 100644 index 00000000000..c007d888266 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-j9hr-gx6q-5wpj/GHSA-j9hr-gx6q-5wpj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j9hr-gx6q-5wpj", + "modified": "2024-11-20T12:30:36Z", + "published": "2024-11-20T12:30:36Z", + "aliases": [ + "CVE-2024-52441" + ], + "details": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Rajesh Thanoch Quick Learn allows Object Injection.This issue affects Quick Learn: from n/a through 1.0.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52441" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/quick-learn/wordpress-quick-learn-plugin-1-0-1-php-object-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1321" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-jf68-rmf6-ggpp/GHSA-jf68-rmf6-ggpp.json b/advisories/unreviewed/2024/11/GHSA-jf68-rmf6-ggpp/GHSA-jf68-rmf6-ggpp.json new file mode 100644 index 00000000000..a2dba5042b3 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-jf68-rmf6-ggpp/GHSA-jf68-rmf6-ggpp.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jf68-rmf6-ggpp", + "modified": "2024-11-20T12:30:36Z", + "published": "2024-11-20T12:30:36Z", + "aliases": [ + "CVE-2024-52446" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Buying Buddy Buying Buddy IDX CRM allows Object Injection.This issue affects Buying Buddy IDX CRM: from n/a through 1.1.12.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52446" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/buying-buddy-idx-crm/wordpress-buying-buddy-idx-crm-plugin-1-1-12-csrf-to-php-object-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-mgxx-v5wq-f4gr/GHSA-mgxx-v5wq-f4gr.json b/advisories/unreviewed/2024/11/GHSA-mgxx-v5wq-f4gr/GHSA-mgxx-v5wq-f4gr.json new file mode 100644 index 00000000000..fdc4da7379b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-mgxx-v5wq-f4gr/GHSA-mgxx-v5wq-f4gr.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mgxx-v5wq-f4gr", + "modified": "2024-11-20T12:30:34Z", + "published": "2024-11-20T12:30:34Z", + "aliases": [ + "CVE-2024-10891" + ], + "details": "The Save as PDF Plugin by Pdfcrowd plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'save_as_pdf_pdfcrowd' shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10891" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/save-as-pdf-by-pdfcrowd/trunk/public/class-save-as-pdf-pdfcrowd-public.php#L586" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3763d893-83a0-4b6a-9c21-34a69313d555?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T10:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-pq4w-jf35-7pmx/GHSA-pq4w-jf35-7pmx.json b/advisories/unreviewed/2024/11/GHSA-pq4w-jf35-7pmx/GHSA-pq4w-jf35-7pmx.json new file mode 100644 index 00000000000..07b4d7eb476 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-pq4w-jf35-7pmx/GHSA-pq4w-jf35-7pmx.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pq4w-jf35-7pmx", + "modified": "2024-11-20T12:30:35Z", + "published": "2024-11-20T12:30:35Z", + "aliases": [ + "CVE-2024-10382" + ], + "details": "There exists a code execution vulnerability in the Car App Android Jetpack Library. In the CarAppService desrialization logic is used that allows for arbitrary java classes to be constructed. In combination with other gadgets, this can lead to arbitrary code execution. An attacker needs to have an app on a victims Android device that uses the CarAppService Class and the victim would need to install a malicious app alongside it. We recommend upgrading the library past version 1.7.0-beta02", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:M/U:Amber" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10382" + }, + { + "type": "WEB", + "url": "https://developer.android.com/jetpack/androidx/releases/car-app#1.7.0-beta03" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T11:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-r4xr-m393-778m/GHSA-r4xr-m393-778m.json b/advisories/unreviewed/2024/11/GHSA-r4xr-m393-778m/GHSA-r4xr-m393-778m.json new file mode 100644 index 00000000000..8431ed04368 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-r4xr-m393-778m/GHSA-r4xr-m393-778m.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r4xr-m393-778m", + "modified": "2024-11-20T12:30:35Z", + "published": "2024-11-20T12:30:35Z", + "aliases": [ + "CVE-2024-48899" + ], + "details": "A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48899" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318819" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T11:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-r8j6-4hrp-v4w7/GHSA-r8j6-4hrp-v4w7.json b/advisories/unreviewed/2024/11/GHSA-r8j6-4hrp-v4w7/GHSA-r8j6-4hrp-v4w7.json new file mode 100644 index 00000000000..94ff951a968 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-r8j6-4hrp-v4w7/GHSA-r8j6-4hrp-v4w7.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r8j6-4hrp-v4w7", + "modified": "2024-11-20T12:30:35Z", + "published": "2024-11-20T12:30:35Z", + "aliases": [ + "CVE-2024-52438" + ], + "details": "Missing Authentication for Critical Function vulnerability in deco.Agency de:branding allows Privilege Escalation.This issue affects de:branding: from n/a through 1.0.2.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52438" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/debranding/wordpress-de-branding-plugin-1-0-2-privilege-escalation-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-306" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-rvw7-mm9q-j59m/GHSA-rvw7-mm9q-j59m.json b/advisories/unreviewed/2024/11/GHSA-rvw7-mm9q-j59m/GHSA-rvw7-mm9q-j59m.json new file mode 100644 index 00000000000..d31b4a606f4 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-rvw7-mm9q-j59m/GHSA-rvw7-mm9q-j59m.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rvw7-mm9q-j59m", + "modified": "2024-11-20T12:30:36Z", + "published": "2024-11-20T12:30:36Z", + "aliases": [ + "CVE-2024-52440" + ], + "details": "Deserialization of Untrusted Data vulnerability in Bueno Labs Pvt. Ltd. Xpresslane Fast Checkout allows Object Injection.This issue affects Xpresslane Fast Checkout: from n/a through 1.0.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52440" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/xpresslane-integration-for-woocommerce/wordpress-xpresslane-fast-checkout-plugin-1-0-0-php-object-injection-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-v2jx-72wh-2fm2/GHSA-v2jx-72wh-2fm2.json b/advisories/unreviewed/2024/11/GHSA-v2jx-72wh-2fm2/GHSA-v2jx-72wh-2fm2.json new file mode 100644 index 00000000000..97e94c44230 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-v2jx-72wh-2fm2/GHSA-v2jx-72wh-2fm2.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v2jx-72wh-2fm2", + "modified": "2024-11-20T12:30:36Z", + "published": "2024-11-20T12:30:36Z", + "aliases": [ + "CVE-2024-52444" + ], + "details": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPOPAL Opal Woo Custom Product Variation allows Path Traversal.This issue affects Opal Woo Custom Product Variation: from n/a through 1.1.3.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52444" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/opal-woo-custom-product-variation/wordpress-opal-woo-custom-product-variation-plugin-1-1-3-arbitrary-file-deletion-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-v86f-5fjh-2hqj/GHSA-v86f-5fjh-2hqj.json b/advisories/unreviewed/2024/11/GHSA-v86f-5fjh-2hqj/GHSA-v86f-5fjh-2hqj.json new file mode 100644 index 00000000000..987a4f7ca6b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-v86f-5fjh-2hqj/GHSA-v86f-5fjh-2hqj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v86f-5fjh-2hqj", + "modified": "2024-11-20T12:30:36Z", + "published": "2024-11-20T12:30:36Z", + "aliases": [ + "CVE-2024-52447" + ], + "details": "Path Traversal: '.../...//' vulnerability in Corporate Zen Contact Page With Google Map allows Path Traversal.This issue affects Contact Page With Google Map: from n/a through 1.6.1.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52447" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/contact-page-with-google-map/wordpress-contact-page-with-google-map-plugin-1-6-1-arbitrary-file-deletion-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-35" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json b/advisories/unreviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json new file mode 100644 index 00000000000..cd90b02d1f7 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-vxcv-4xvf-pc22/GHSA-vxcv-4xvf-pc22.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vxcv-4xvf-pc22", + "modified": "2024-11-20T12:30:35Z", + "published": "2024-11-20T12:30:35Z", + "aliases": [ + "CVE-2024-11406" + ], + "details": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS.This issue affects django CMS Attributes Fields: before 4.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11406" + }, + { + "type": "WEB", + "url": "https://github.com/django-cms/djangocms-attributes-field/commit/fe68d29ab78db5885bc31b67cf0537f1f02b33ad" + }, + { + "type": "WEB", + "url": "https://iltosec.com/blog/post/djangocms-attributes-field-300-stored-xss-vulnerability" + }, + { + "type": "WEB", + "url": "https://pypi.org/project/djangocms-attributes-field/#history" + }, + { + "type": "WEB", + "url": "https://www.django-cms.org/en/blog/2024/11/19/security-updates-for-django-filer-and-django-cms-attributes-field" + }, + { + "type": "WEB", + "url": "https://www.usom.gov.tr/bildirim/tr-24-1864" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:18Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-whfg-68fr-cqmm/GHSA-whfg-68fr-cqmm.json b/advisories/unreviewed/2024/11/GHSA-whfg-68fr-cqmm/GHSA-whfg-68fr-cqmm.json new file mode 100644 index 00000000000..efb8ac2b384 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-whfg-68fr-cqmm/GHSA-whfg-68fr-cqmm.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-whfg-68fr-cqmm", + "modified": "2024-11-20T12:30:36Z", + "published": "2024-11-20T12:30:36Z", + "aliases": [ + "CVE-2024-52442" + ], + "details": "Incorrect Privilege Assignment vulnerability in Userplus UserPlus allows Privilege Escalation.This issue affects UserPlus: from n/a through 2.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52442" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/userplus/wordpress-userplus-plugin-2-0-privilege-escalation-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-266" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T12:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-xfv7-h2qg-rjm7/GHSA-xfv7-h2qg-rjm7.json b/advisories/unreviewed/2024/11/GHSA-xfv7-h2qg-rjm7/GHSA-xfv7-h2qg-rjm7.json new file mode 100644 index 00000000000..ca2a76f18eb --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-xfv7-h2qg-rjm7/GHSA-xfv7-h2qg-rjm7.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xfv7-h2qg-rjm7", + "modified": "2024-11-20T12:30:35Z", + "published": "2024-11-20T12:30:35Z", + "aliases": [ + "CVE-2024-45691" + ], + "details": "A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to \"magic hash\" values.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45691" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309940" + }, + { + "type": "WEB", + "url": "https://moodle.org/security" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T11:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-xwgw-3mc5-w4qf/GHSA-xwgw-3mc5-w4qf.json b/advisories/unreviewed/2024/11/GHSA-xwgw-3mc5-w4qf/GHSA-xwgw-3mc5-w4qf.json new file mode 100644 index 00000000000..a108f2fbdbc --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-xwgw-3mc5-w4qf/GHSA-xwgw-3mc5-w4qf.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xwgw-3mc5-w4qf", + "modified": "2024-11-20T12:30:35Z", + "published": "2024-11-20T12:30:35Z", + "aliases": [ + "CVE-2024-10872" + ], + "details": "The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `template-post-custom-field` block in all versions up to, and including, 2.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10872" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/getwid/trunk/includes/templates/template-parts/post-custom-field.php#L9" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3188812#file1" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8ae0030f-af21-43fb-959a-8da04cab05bb?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-20T11:15:04Z" + } +} \ No newline at end of file