From 96ae44fdf3327f35d71aa094ff4f03d0a25aa5f2 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 2 Aug 2024 06:32:21 +0000 Subject: [PATCH] Publish Advisories GHSA-cqm6-fcfw-pfm3 GHSA-jxwh-98r5-mx84 GHSA-q46j-26g9-j9w4 GHSA-qv3m-79fc-wfwf GHSA-r786-g2j8-4p9w --- .../GHSA-cqm6-fcfw-pfm3.json | 35 +++++++++++++ .../GHSA-jxwh-98r5-mx84.json | 47 +++++++++++++++++ .../GHSA-q46j-26g9-j9w4.json | 50 +++++++++++++++++++ .../GHSA-qv3m-79fc-wfwf.json | 42 ++++++++++++++++ .../GHSA-r786-g2j8-4p9w.json | 38 ++++++++++++++ 5 files changed, 212 insertions(+) create mode 100644 advisories/unreviewed/2024/08/GHSA-cqm6-fcfw-pfm3/GHSA-cqm6-fcfw-pfm3.json create mode 100644 advisories/unreviewed/2024/08/GHSA-jxwh-98r5-mx84/GHSA-jxwh-98r5-mx84.json create mode 100644 advisories/unreviewed/2024/08/GHSA-q46j-26g9-j9w4/GHSA-q46j-26g9-j9w4.json create mode 100644 advisories/unreviewed/2024/08/GHSA-qv3m-79fc-wfwf/GHSA-qv3m-79fc-wfwf.json create mode 100644 advisories/unreviewed/2024/08/GHSA-r786-g2j8-4p9w/GHSA-r786-g2j8-4p9w.json diff --git a/advisories/unreviewed/2024/08/GHSA-cqm6-fcfw-pfm3/GHSA-cqm6-fcfw-pfm3.json b/advisories/unreviewed/2024/08/GHSA-cqm6-fcfw-pfm3/GHSA-cqm6-fcfw-pfm3.json new file mode 100644 index 00000000000..9e0466668a2 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-cqm6-fcfw-pfm3/GHSA-cqm6-fcfw-pfm3.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cqm6-fcfw-pfm3", + "modified": "2024-08-02T06:30:56Z", + "published": "2024-08-02T06:30:56Z", + "aliases": [ + "CVE-2024-5595" + ], + "details": "The Essential Blocks WordPress plugin before 4.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5595" + }, + { + "type": "WEB", + "url": "https://wpscan.com/vulnerability/f2b8f092-4fc0-4edc-ba0f-d4312c2e5dec" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-02T06:15:54Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-jxwh-98r5-mx84/GHSA-jxwh-98r5-mx84.json b/advisories/unreviewed/2024/08/GHSA-jxwh-98r5-mx84/GHSA-jxwh-98r5-mx84.json new file mode 100644 index 00000000000..ba602dfe395 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-jxwh-98r5-mx84/GHSA-jxwh-98r5-mx84.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jxwh-98r5-mx84", + "modified": "2024-08-02T06:30:56Z", + "published": "2024-08-02T06:30:56Z", + "aliases": [ + "CVE-2024-42458" + ], + "details": "server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42458" + }, + { + "type": "WEB", + "url": "https://github.com/any1/neatvnc/commit/cc71650a69abc2573a0d96d082409d2468802d47" + }, + { + "type": "WEB", + "url": "https://github.com/any1/neatvnc/compare/v0.8.0...v0.8.1" + }, + { + "type": "WEB", + "url": "https://github.com/any1/neatvnc/releases/tag/v0.8.1" + }, + { + "type": "WEB", + "url": "https://www.openwall.com/lists/oss-security/2024/08/02/1" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-02T04:17:30Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-q46j-26g9-j9w4/GHSA-q46j-26g9-j9w4.json b/advisories/unreviewed/2024/08/GHSA-q46j-26g9-j9w4/GHSA-q46j-26g9-j9w4.json new file mode 100644 index 00000000000..94ac33a247c --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-q46j-26g9-j9w4/GHSA-q46j-26g9-j9w4.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q46j-26g9-j9w4", + "modified": "2024-08-02T06:30:56Z", + "published": "2024-08-02T06:30:56Z", + "aliases": [ + "CVE-2024-7389" + ], + "details": "The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make unauthorized changes to the plugin's HubSpot integration or expose personally identifiable information from plugin users using the HubSpot integration.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7389" + }, + { + "type": "WEB", + "url": "https://developers.hubspot.com/docs/api/webhooks#manage-settings-via-api" + }, + { + "type": "WEB", + "url": "https://developers.hubspot.com/docs/api/webhooks#scopes" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3047085/forminator/trunk/addons/pro/hubspot/lib/class-forminator-addon-hubspot-wp-api.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0d04b822-a48a-485e-b9b5-f5a213307c71?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-522" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-02T05:15:51Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-qv3m-79fc-wfwf/GHSA-qv3m-79fc-wfwf.json b/advisories/unreviewed/2024/08/GHSA-qv3m-79fc-wfwf/GHSA-qv3m-79fc-wfwf.json new file mode 100644 index 00000000000..06587d6afc0 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-qv3m-79fc-wfwf/GHSA-qv3m-79fc-wfwf.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qv3m-79fc-wfwf", + "modified": "2024-08-02T06:30:56Z", + "published": "2024-08-02T06:30:56Z", + "aliases": [ + "CVE-2024-3827" + ], + "details": "The Spectra Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block ids in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3827" + }, + { + "type": "WEB", + "url": "https://wpspectra.com/product/spectra-pro/#spectra-pro-1-1-5-released" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3fb6123c-2891-4cfd-8d68-a922c30d7600?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-02T06:15:53Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-r786-g2j8-4p9w/GHSA-r786-g2j8-4p9w.json b/advisories/unreviewed/2024/08/GHSA-r786-g2j8-4p9w/GHSA-r786-g2j8-4p9w.json new file mode 100644 index 00000000000..37334dc478a --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-r786-g2j8-4p9w/GHSA-r786-g2j8-4p9w.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r786-g2j8-4p9w", + "modified": "2024-08-02T06:30:56Z", + "published": "2024-08-02T06:30:56Z", + "aliases": [ + "CVE-2024-38482" + ], + "details": "CloudLink, versions 7.1.x and 8.x, contain an Improper check or handling of Exceptional Conditions Vulnerability in Cluster Component. A highly privileged malicious user with remote access could potentially exploit this vulnerability, leading to execute unauthorized actions and retrieve sensitive information from the database.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38482" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-us/000227493/dsa-2024-343-security-update-for-dell-cloudlink-vulnerability" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-703" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-02T04:17:27Z" + } +} \ No newline at end of file