netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-cqm6-fcfw-pfm3
GHSA-jxwh-98r5-mx84
GHSA-q46j-26g9-j9w4
GHSA-qv3m-79fc-wfwf
GHSA-r786-g2j8-4p9w
This commit is contained in:
advisory-database[bot]
2024-08-02 06:32:21 +00:00
parent 4f0724d03c
commit 96ae44fdf3
5 changed files with 212 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/08/GHSA-cqm6-fcfw-pfm3/GHSA-cqm6-fcfw-pfm3.json
+35
View File
@@ -0,0 +1,35 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cqm6-fcfw-pfm3",
"modified": "2024-08-02T06:30:56Z",
"published": "2024-08-02T06:30:56Z",
"aliases": [
"CVE-2024-5595"
],
"details": "The Essential Blocks WordPress plugin before 4.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5595"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/f2b8f092-4fc0-4edc-ba0f-d4312c2e5dec"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-02T06:15:54Z"
}
}
advisories/unreviewed/2024/08/GHSA-jxwh-98r5-mx84/GHSA-jxwh-98r5-mx84.json
+47
View File
@@ -0,0 +1,47 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jxwh-98r5-mx84",
"modified": "2024-08-02T06:30:56Z",
"published": "2024-08-02T06:30:56Z",
"aliases": [
"CVE-2024-42458"
],
"details": "server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type.",
"severity": [
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42458"
},
{
"type": "WEB",
"url": "https://github.com/any1/neatvnc/commit/cc71650a69abc2573a0d96d082409d2468802d47"
},
{
"type": "WEB",
"url": "https://github.com/any1/neatvnc/compare/v0.8.0...v0.8.1"
},
{
"type": "WEB",
"url": "https://github.com/any1/neatvnc/releases/tag/v0.8.1"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2024/08/02/1"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": null,
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-02T04:17:30Z"
}
}
advisories/unreviewed/2024/08/GHSA-q46j-26g9-j9w4/GHSA-q46j-26g9-j9w4.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q46j-26g9-j9w4",
"modified": "2024-08-02T06:30:56Z",
"published": "2024-08-02T06:30:56Z",
"aliases": [
"CVE-2024-7389"
],
"details": "The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make unauthorized changes to the plugin's HubSpot integration or expose personally identifiable information from plugin users using the HubSpot integration.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7389"
},
{
"type": "WEB",
"url": "https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api"
},
{
"type": "WEB",
"url": "https://developers.hubspot.com/docs/api/webhooks#scopes"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3047085/forminator/trunk/addons/pro/hubspot/lib/class-forminator-addon-hubspot-wp-api.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0d04b822-a48a-485e-b9b5-f5a213307c71?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-02T05:15:51Z"
}
}
advisories/unreviewed/2024/08/GHSA-qv3m-79fc-wfwf/GHSA-qv3m-79fc-wfwf.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qv3m-79fc-wfwf",
"modified": "2024-08-02T06:30:56Z",
"published": "2024-08-02T06:30:56Z",
"aliases": [
"CVE-2024-3827"
],
"details": "The Spectra Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block ids in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3827"
},
{
"type": "WEB",
"url": "https://wpspectra.com/product/spectra-pro/#spectra-pro-1-1-5-released"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3fb6123c-2891-4cfd-8d68-a922c30d7600?source=cve"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-02T06:15:53Z"
}
}
advisories/unreviewed/2024/08/GHSA-r786-g2j8-4p9w/GHSA-r786-g2j8-4p9w.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r786-g2j8-4p9w",
"modified": "2024-08-02T06:30:56Z",
"published": "2024-08-02T06:30:56Z",
"aliases": [
"CVE-2024-38482"
],
"details": "CloudLink, versions 7.1.x and 8.x, contain an Improper check or handling of Exceptional Conditions Vulnerability in Cluster Component. A highly privileged malicious user with remote access could potentially exploit this vulnerability, leading to execute unauthorized actions and retrieve sensitive information from the database.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38482"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000227493/dsa-2024-343-security-update-for-dell-cloudlink-vulnerability"
}
],
"database_specific": {
"cwe_ids": [
"CWE-703"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-02T04:17:27Z"
}
}