From 919afe666605a7cd0a352d3d0c01d6244926893e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 26 Apr 2024 06:31:55 +0000 Subject: [PATCH] Publish Advisories GHSA-27hf-w6wm-652c GHSA-3249-ch6f-5vrf GHSA-3jgv-pfqj-v626 GHSA-55jv-x7fj-7mg4 GHSA-5943-48f3-6wx5 GHSA-5j47-gwc2-fhfc GHSA-6fcx-56j8-8rrw GHSA-6qhv-x9gf-6f6p GHSA-9vvr-3g53-9w72 GHSA-c5pj-mqfh-rvc3 GHSA-h335-p3x8-932g GHSA-h47h-5hqh-63xw GHSA-jgfj-pqpg-7r5f GHSA-jjv2-293m-3wrf GHSA-mppc-j8fq-9mvg GHSA-qx35-w84c-98jc GHSA-v859-v234-c2mg GHSA-vpgr-vqw9-62cw GHSA-w6rp-qpf9-cggq GHSA-x3cc-r2hp-r6x7 --- .../GHSA-27hf-w6wm-652c.json | 35 ++++++++++++ .../GHSA-3249-ch6f-5vrf.json | 35 ++++++++++++ .../GHSA-3jgv-pfqj-v626.json | 35 ++++++++++++ .../GHSA-55jv-x7fj-7mg4.json | 35 ++++++++++++ .../GHSA-5943-48f3-6wx5.json | 38 +++++++++++++ .../GHSA-5j47-gwc2-fhfc.json | 35 ++++++++++++ .../GHSA-6fcx-56j8-8rrw.json | 35 ++++++++++++ .../GHSA-6qhv-x9gf-6f6p.json | 35 ++++++++++++ .../GHSA-9vvr-3g53-9w72.json | 35 ++++++++++++ .../GHSA-c5pj-mqfh-rvc3.json | 54 +++++++++++++++++++ .../GHSA-h335-p3x8-932g.json | 35 ++++++++++++ .../GHSA-h47h-5hqh-63xw.json | 35 ++++++++++++ .../GHSA-jgfj-pqpg-7r5f.json | 35 ++++++++++++ .../GHSA-jjv2-293m-3wrf.json | 35 ++++++++++++ .../GHSA-mppc-j8fq-9mvg.json | 35 ++++++++++++ .../GHSA-qx35-w84c-98jc.json | 35 ++++++++++++ .../GHSA-v859-v234-c2mg.json | 35 ++++++++++++ .../GHSA-vpgr-vqw9-62cw.json | 35 ++++++++++++ .../GHSA-w6rp-qpf9-cggq.json | 35 ++++++++++++ .../GHSA-x3cc-r2hp-r6x7.json | 35 ++++++++++++ 20 files changed, 722 insertions(+) create mode 100644 advisories/unreviewed/2024/04/GHSA-27hf-w6wm-652c/GHSA-27hf-w6wm-652c.json create mode 100644 advisories/unreviewed/2024/04/GHSA-3249-ch6f-5vrf/GHSA-3249-ch6f-5vrf.json create mode 100644 advisories/unreviewed/2024/04/GHSA-3jgv-pfqj-v626/GHSA-3jgv-pfqj-v626.json create mode 100644 advisories/unreviewed/2024/04/GHSA-55jv-x7fj-7mg4/GHSA-55jv-x7fj-7mg4.json create mode 100644 advisories/unreviewed/2024/04/GHSA-5943-48f3-6wx5/GHSA-5943-48f3-6wx5.json create mode 100644 advisories/unreviewed/2024/04/GHSA-5j47-gwc2-fhfc/GHSA-5j47-gwc2-fhfc.json create mode 100644 advisories/unreviewed/2024/04/GHSA-6fcx-56j8-8rrw/GHSA-6fcx-56j8-8rrw.json create mode 100644 advisories/unreviewed/2024/04/GHSA-6qhv-x9gf-6f6p/GHSA-6qhv-x9gf-6f6p.json create mode 100644 advisories/unreviewed/2024/04/GHSA-9vvr-3g53-9w72/GHSA-9vvr-3g53-9w72.json create mode 100644 advisories/unreviewed/2024/04/GHSA-c5pj-mqfh-rvc3/GHSA-c5pj-mqfh-rvc3.json create mode 100644 advisories/unreviewed/2024/04/GHSA-h335-p3x8-932g/GHSA-h335-p3x8-932g.json create mode 100644 advisories/unreviewed/2024/04/GHSA-h47h-5hqh-63xw/GHSA-h47h-5hqh-63xw.json create mode 100644 advisories/unreviewed/2024/04/GHSA-jgfj-pqpg-7r5f/GHSA-jgfj-pqpg-7r5f.json create mode 100644 advisories/unreviewed/2024/04/GHSA-jjv2-293m-3wrf/GHSA-jjv2-293m-3wrf.json create mode 100644 advisories/unreviewed/2024/04/GHSA-mppc-j8fq-9mvg/GHSA-mppc-j8fq-9mvg.json create mode 100644 advisories/unreviewed/2024/04/GHSA-qx35-w84c-98jc/GHSA-qx35-w84c-98jc.json create mode 100644 advisories/unreviewed/2024/04/GHSA-v859-v234-c2mg/GHSA-v859-v234-c2mg.json create mode 100644 advisories/unreviewed/2024/04/GHSA-vpgr-vqw9-62cw/GHSA-vpgr-vqw9-62cw.json create mode 100644 advisories/unreviewed/2024/04/GHSA-w6rp-qpf9-cggq/GHSA-w6rp-qpf9-cggq.json create mode 100644 advisories/unreviewed/2024/04/GHSA-x3cc-r2hp-r6x7/GHSA-x3cc-r2hp-r6x7.json diff --git a/advisories/unreviewed/2024/04/GHSA-27hf-w6wm-652c/GHSA-27hf-w6wm-652c.json b/advisories/unreviewed/2024/04/GHSA-27hf-w6wm-652c/GHSA-27hf-w6wm-652c.json new file mode 100644 index 00000000000..c900f24428f --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-27hf-w6wm-652c/GHSA-27hf-w6wm-652c.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-27hf-w6wm-652c", + "modified": "2024-04-26T06:30:35Z", + "published": "2024-04-26T06:30:35Z", + "aliases": [ + "CVE-2024-3188" + ], + "details": "The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3188" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/bc273e75-7faf-4eaf-8ebd-efc5d6e9261f" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T05:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-3249-ch6f-5vrf/GHSA-3249-ch6f-5vrf.json b/advisories/unreviewed/2024/04/GHSA-3249-ch6f-5vrf/GHSA-3249-ch6f-5vrf.json new file mode 100644 index 00000000000..958af937ac2 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-3249-ch6f-5vrf/GHSA-3249-ch6f-5vrf.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3249-ch6f-5vrf", + "modified": "2024-04-26T06:30:35Z", + "published": "2024-04-26T06:30:35Z", + "aliases": [ + "CVE-2024-3058" + ], + "details": "The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3058" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/fc33c79d-ad24-4d55-973a-25280995a2ab" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T05:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-3jgv-pfqj-v626/GHSA-3jgv-pfqj-v626.json b/advisories/unreviewed/2024/04/GHSA-3jgv-pfqj-v626/GHSA-3jgv-pfqj-v626.json new file mode 100644 index 00000000000..599de99ee43 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-3jgv-pfqj-v626/GHSA-3jgv-pfqj-v626.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3jgv-pfqj-v626", + "modified": "2024-04-26T06:30:34Z", + "published": "2024-04-26T06:30:34Z", + "aliases": [ + "CVE-2024-32406" + ], + "details": "Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1 allows a remote attacker to execute arbitrary code via a crafted payload to the Batch-Issue Exam Tickets function.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32406" + }, + { + "type": "WEB", + "url": "https://packetstormsecurity.com/files/178251/Relate-Learning-And-Teaching-System-SSTI-Remote-Code-Execution.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T04:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-55jv-x7fj-7mg4/GHSA-55jv-x7fj-7mg4.json b/advisories/unreviewed/2024/04/GHSA-55jv-x7fj-7mg4/GHSA-55jv-x7fj-7mg4.json new file mode 100644 index 00000000000..d7342735790 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-55jv-x7fj-7mg4/GHSA-55jv-x7fj-7mg4.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-55jv-x7fj-7mg4", + "modified": "2024-04-26T06:30:34Z", + "published": "2024-04-26T06:30:34Z", + "aliases": [ + "CVE-2024-2159" + ], + "details": "The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2159" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/d7fa9849-c82a-4efd-84b6-9245053975ba" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T05:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-5943-48f3-6wx5/GHSA-5943-48f3-6wx5.json b/advisories/unreviewed/2024/04/GHSA-5943-48f3-6wx5/GHSA-5943-48f3-6wx5.json new file mode 100644 index 00000000000..4ca7ddc900a --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-5943-48f3-6wx5/GHSA-5943-48f3-6wx5.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5943-48f3-6wx5", + "modified": "2024-04-26T06:30:35Z", + "published": "2024-04-26T06:30:35Z", + "aliases": [ + "CVE-2024-4056" + ], + "details": "\nDenial of service condition in M-Files Server in versions before 24.4.13592.4 and after 23.11 (excluding 24.2 LTS) allows unauthenticated user to consume computing resources.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4056" + }, + { + "type": "WEB", + "url": "https://www.m-files.com/about/trust-center/security-advisories/cve-2024-4056" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-400" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T06:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-5j47-gwc2-fhfc/GHSA-5j47-gwc2-fhfc.json b/advisories/unreviewed/2024/04/GHSA-5j47-gwc2-fhfc/GHSA-5j47-gwc2-fhfc.json new file mode 100644 index 00000000000..df60cda6afb --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-5j47-gwc2-fhfc/GHSA-5j47-gwc2-fhfc.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5j47-gwc2-fhfc", + "modified": "2024-04-26T06:30:35Z", + "published": "2024-04-26T06:30:35Z", + "aliases": [ + "CVE-2024-2603" + ], + "details": "The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin (or editor depending on Salon booking system WordPress plugin through 9.6.5 configuration) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2603" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/b4186c03-99ee-4297-85c0-83b7053afc1c" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T05:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-6fcx-56j8-8rrw/GHSA-6fcx-56j8-8rrw.json b/advisories/unreviewed/2024/04/GHSA-6fcx-56j8-8rrw/GHSA-6fcx-56j8-8rrw.json new file mode 100644 index 00000000000..6e48df6d77f --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-6fcx-56j8-8rrw/GHSA-6fcx-56j8-8rrw.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6fcx-56j8-8rrw", + "modified": "2024-04-26T06:30:35Z", + "published": "2024-04-26T06:30:35Z", + "aliases": [ + "CVE-2024-2310" + ], + "details": "The WP Google Review Slider WordPress plugin before 13.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2310" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/7a2c173c-19e3-4f48-b3af-14790b5b8e94" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T05:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-6qhv-x9gf-6f6p/GHSA-6qhv-x9gf-6f6p.json b/advisories/unreviewed/2024/04/GHSA-6qhv-x9gf-6f6p/GHSA-6qhv-x9gf-6f6p.json new file mode 100644 index 00000000000..53d26e1df63 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-6qhv-x9gf-6f6p/GHSA-6qhv-x9gf-6f6p.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6qhv-x9gf-6f6p", + "modified": "2024-04-26T06:30:35Z", + "published": "2024-04-26T06:30:35Z", + "aliases": [ + "CVE-2024-3059" + ], + "details": "The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3059" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/e154096d-e9b7-43ba-9a34-81a6c431025c" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T05:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-9vvr-3g53-9w72/GHSA-9vvr-3g53-9w72.json b/advisories/unreviewed/2024/04/GHSA-9vvr-3g53-9w72/GHSA-9vvr-3g53-9w72.json new file mode 100644 index 00000000000..06a45176313 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-9vvr-3g53-9w72/GHSA-9vvr-3g53-9w72.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9vvr-3g53-9w72", + "modified": "2024-04-26T06:30:35Z", + "published": "2024-04-26T06:30:35Z", + "aliases": [ + "CVE-2024-3048" + ], + "details": "The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3048" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/e179ff7d-137c-48bf-8b18-e874e3f876f4" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T05:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-c5pj-mqfh-rvc3/GHSA-c5pj-mqfh-rvc3.json b/advisories/unreviewed/2024/04/GHSA-c5pj-mqfh-rvc3/GHSA-c5pj-mqfh-rvc3.json new file mode 100644 index 00000000000..07eb4245073 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-c5pj-mqfh-rvc3/GHSA-c5pj-mqfh-rvc3.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c5pj-mqfh-rvc3", + "modified": "2024-04-26T06:30:34Z", + "published": "2024-04-26T06:30:34Z", + "aliases": [ + "CVE-2024-3154" + ], + "details": "A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/cri-o/cri-o/security/advisories/GHSA-2cgq-h8xw-2v5j" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3154" + }, + { + "type": "WEB", + "url": "https://github.com/opencontainers/runc/pull/4217" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2024-3154" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272532" + }, + { + "type": "WEB", + "url": "https://github.com/opencontainers/runtime-spec/blob/main/features.md#unsafe-annotations-in-configjson" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-77" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T04:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-h335-p3x8-932g/GHSA-h335-p3x8-932g.json b/advisories/unreviewed/2024/04/GHSA-h335-p3x8-932g/GHSA-h335-p3x8-932g.json new file mode 100644 index 00000000000..90cef86629a --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-h335-p3x8-932g/GHSA-h335-p3x8-932g.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h335-p3x8-932g", + "modified": "2024-04-26T06:30:35Z", + "published": "2024-04-26T06:30:35Z", + "aliases": [ + "CVE-2024-2439" + ], + "details": "The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2439" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/7a375077-fc70-4389-b109-28fce3db2aef" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T05:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-h47h-5hqh-63xw/GHSA-h47h-5hqh-63xw.json b/advisories/unreviewed/2024/04/GHSA-h47h-5hqh-63xw/GHSA-h47h-5hqh-63xw.json new file mode 100644 index 00000000000..1094c0403fa --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-h47h-5hqh-63xw/GHSA-h47h-5hqh-63xw.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h47h-5hqh-63xw", + "modified": "2024-04-26T06:30:32Z", + "published": "2024-04-26T06:30:32Z", + "aliases": [ + "CVE-2024-22633" + ], + "details": "Setor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (RCE) vulnerability via the hprinter parameter. This vulnerability is triggered via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22633" + }, + { + "type": "WEB", + "url": "https://tomiodarim.io/posts/cve-2024-22632-3" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T04:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-jgfj-pqpg-7r5f/GHSA-jgfj-pqpg-7r5f.json b/advisories/unreviewed/2024/04/GHSA-jgfj-pqpg-7r5f/GHSA-jgfj-pqpg-7r5f.json new file mode 100644 index 00000000000..dc4410f757f --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-jgfj-pqpg-7r5f/GHSA-jgfj-pqpg-7r5f.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jgfj-pqpg-7r5f", + "modified": "2024-04-26T06:30:35Z", + "published": "2024-04-26T06:30:35Z", + "aliases": [ + "CVE-2024-3075" + ], + "details": "The MM-email2image WordPress plugin through 0.2.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3075" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/450375f6-a9d4-49f6-8bab-867774372795" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T05:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-jjv2-293m-3wrf/GHSA-jjv2-293m-3wrf.json b/advisories/unreviewed/2024/04/GHSA-jjv2-293m-3wrf/GHSA-jjv2-293m-3wrf.json new file mode 100644 index 00000000000..26c2cdb7665 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-jjv2-293m-3wrf/GHSA-jjv2-293m-3wrf.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jjv2-293m-3wrf", + "modified": "2024-04-26T06:30:35Z", + "published": "2024-04-26T06:30:35Z", + "aliases": [ + "CVE-2024-2429" + ], + "details": "The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2429" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/1c6812d8-a218-4c15-9e2d-d43f3f3b0e78" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T05:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-mppc-j8fq-9mvg/GHSA-mppc-j8fq-9mvg.json b/advisories/unreviewed/2024/04/GHSA-mppc-j8fq-9mvg/GHSA-mppc-j8fq-9mvg.json new file mode 100644 index 00000000000..b2ba8b16b9f --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-mppc-j8fq-9mvg/GHSA-mppc-j8fq-9mvg.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mppc-j8fq-9mvg", + "modified": "2024-04-26T06:30:32Z", + "published": "2024-04-26T06:30:32Z", + "aliases": [ + "CVE-2024-22632" + ], + "details": "Setor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (RCE) vulnerability via the hmsg parameter. This vulnerability is triggered via a crafted POST request.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22632" + }, + { + "type": "WEB", + "url": "https://tomiodarim.io/posts/cve-2024-22632-3" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T04:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-qx35-w84c-98jc/GHSA-qx35-w84c-98jc.json b/advisories/unreviewed/2024/04/GHSA-qx35-w84c-98jc/GHSA-qx35-w84c-98jc.json new file mode 100644 index 00000000000..2dac35fe8a1 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-qx35-w84c-98jc/GHSA-qx35-w84c-98jc.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qx35-w84c-98jc", + "modified": "2024-04-26T06:30:35Z", + "published": "2024-04-26T06:30:35Z", + "aliases": [ + "CVE-2024-2837" + ], + "details": "The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2837" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/91058c48-f262-4fcc-9390-472d59d61115" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T05:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-v859-v234-c2mg/GHSA-v859-v234-c2mg.json b/advisories/unreviewed/2024/04/GHSA-v859-v234-c2mg/GHSA-v859-v234-c2mg.json new file mode 100644 index 00000000000..e905eafdb57 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-v859-v234-c2mg/GHSA-v859-v234-c2mg.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v859-v234-c2mg", + "modified": "2024-04-26T06:30:34Z", + "published": "2024-04-26T06:30:34Z", + "aliases": [ + "CVE-2024-0905" + ], + "details": "The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against unauthenticated and admin-level users", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0905" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/3b9eba0d-29aa-47e4-b17f-4cf4bbf8b690" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T05:15:49Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-vpgr-vqw9-62cw/GHSA-vpgr-vqw9-62cw.json b/advisories/unreviewed/2024/04/GHSA-vpgr-vqw9-62cw/GHSA-vpgr-vqw9-62cw.json new file mode 100644 index 00000000000..a35513903ab --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-vpgr-vqw9-62cw/GHSA-vpgr-vqw9-62cw.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vpgr-vqw9-62cw", + "modified": "2024-04-26T06:30:34Z", + "published": "2024-04-26T06:30:34Z", + "aliases": [ + "CVE-2024-32404" + ], + "details": "Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1, allows remote attackers to execute arbitrary code via a crafted payload to the Markup Sandbox feature.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32404" + }, + { + "type": "WEB", + "url": "https://packetstormsecurity.com/2404-exploits/rlts-sstexec.txt" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T04:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-w6rp-qpf9-cggq/GHSA-w6rp-qpf9-cggq.json b/advisories/unreviewed/2024/04/GHSA-w6rp-qpf9-cggq/GHSA-w6rp-qpf9-cggq.json new file mode 100644 index 00000000000..44d0f8ddfdd --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-w6rp-qpf9-cggq/GHSA-w6rp-qpf9-cggq.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w6rp-qpf9-cggq", + "modified": "2024-04-26T06:30:35Z", + "published": "2024-04-26T06:30:35Z", + "aliases": [ + "CVE-2024-3060" + ], + "details": "The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3060" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/7740646d-f3ea-4fc7-b35e-8b4a6821e178" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T05:15:50Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-x3cc-r2hp-r6x7/GHSA-x3cc-r2hp-r6x7.json b/advisories/unreviewed/2024/04/GHSA-x3cc-r2hp-r6x7/GHSA-x3cc-r2hp-r6x7.json new file mode 100644 index 00000000000..37df27199bd --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-x3cc-r2hp-r6x7/GHSA-x3cc-r2hp-r6x7.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x3cc-r2hp-r6x7", + "modified": "2024-04-26T06:30:35Z", + "published": "2024-04-26T06:30:35Z", + "aliases": [ + "CVE-2024-2908" + ], + "details": "The Call Now Button WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2908" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/58c9e088-ed74-461a-b305-e217679f26c1" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T05:15:50Z" + } +} \ No newline at end of file