diff --git a/advisories/github-reviewed/2024/05/GHSA-x7g6-rwhc-g7mj/GHSA-x7g6-rwhc-g7mj.json b/advisories/github-reviewed/2024/05/GHSA-x7g6-rwhc-g7mj/GHSA-x7g6-rwhc-g7mj.json index 4e4bdf815c4..f20e98d35fd 100644 --- a/advisories/github-reviewed/2024/05/GHSA-x7g6-rwhc-g7mj/GHSA-x7g6-rwhc-g7mj.json +++ b/advisories/github-reviewed/2024/05/GHSA-x7g6-rwhc-g7mj/GHSA-x7g6-rwhc-g7mj.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-x7g6-rwhc-g7mj", - "modified": "2024-10-15T03:30:42Z", + "modified": "2024-11-05T03:30:45Z", "published": "2024-05-02T15:30:35Z", "aliases": [ "CVE-2024-4029" @@ -56,6 +56,18 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:8080" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8823" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8824" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8826" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-4029" diff --git a/advisories/unreviewed/2024/11/GHSA-953x-6wwg-wcxg/GHSA-953x-6wwg-wcxg.json b/advisories/unreviewed/2024/11/GHSA-953x-6wwg-wcxg/GHSA-953x-6wwg-wcxg.json new file mode 100644 index 00000000000..50132a2f1f6 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-953x-6wwg-wcxg/GHSA-953x-6wwg-wcxg.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-953x-6wwg-wcxg", + "modified": "2024-11-05T03:30:45Z", + "published": "2024-11-05T03:30:45Z", + "aliases": [ + "CVE-2024-10807" + ], + "details": "A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been rated as problematic. This issue affects some unknown processing of the file hms/doctor/search.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10807" + }, + { + "type": "WEB", + "url": "https://github.com/secuserx/CVE/blob/main/%5BXSS%20vulnerability%5D%20found%20in%20Hospital%20Management%20System%20(HMS)%204.0%20-%20(search.php).md" + }, + { + "type": "WEB", + "url": "https://phpgurukul.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283031" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283031" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.436551" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-707" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T02:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-cvc7-ww7g-w56m/GHSA-cvc7-ww7g-w56m.json b/advisories/unreviewed/2024/11/GHSA-cvc7-ww7g-w56m/GHSA-cvc7-ww7g-w56m.json new file mode 100644 index 00000000000..50d303aecc7 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-cvc7-ww7g-w56m/GHSA-cvc7-ww7g-w56m.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cvc7-ww7g-w56m", + "modified": "2024-11-05T03:30:45Z", + "published": "2024-11-05T03:30:45Z", + "aliases": [ + "CVE-2024-10806" + ], + "details": "A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been declared as problematic. This vulnerability affects unknown code of the file betweendates-detailsreports.php. The manipulation of the argument fromdate/todate leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10806" + }, + { + "type": "WEB", + "url": "https://github.com/secuserx/CVE/blob/main/%5BXSS%20vulnerability%5D%20found%20in%20Hospital%20Management%20System%20(HMS)%204.0%20-%20(betweendates-detailsreports.php).md" + }, + { + "type": "WEB", + "url": "https://phpgurukul.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283030" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283030" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.436547" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-707" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T01:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hhh3-584m-qjr8/GHSA-hhh3-584m-qjr8.json b/advisories/unreviewed/2024/11/GHSA-hhh3-584m-qjr8/GHSA-hhh3-584m-qjr8.json new file mode 100644 index 00000000000..cb77349b46e --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-hhh3-584m-qjr8/GHSA-hhh3-584m-qjr8.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hhh3-584m-qjr8", + "modified": "2024-11-05T03:30:45Z", + "published": "2024-11-05T03:30:45Z", + "aliases": [ + "CVE-2024-10810" + ], + "details": "A vulnerability was found in code-projects E-Health Care System 1.0. It has been classified as critical. Affected is an unknown function of the file Doctor/app_request.php. The manipulation of the argument app_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10810" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/wsy149433/cve/blob/main/sql19.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283038" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283038" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.437018" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-707" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T02:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-pfp9-w5f6-rg7c/GHSA-pfp9-w5f6-rg7c.json b/advisories/unreviewed/2024/11/GHSA-pfp9-w5f6-rg7c/GHSA-pfp9-w5f6-rg7c.json new file mode 100644 index 00000000000..629d2cc610b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-pfp9-w5f6-rg7c/GHSA-pfp9-w5f6-rg7c.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pfp9-w5f6-rg7c", + "modified": "2024-11-05T03:30:45Z", + "published": "2024-11-05T03:30:45Z", + "aliases": [ + "CVE-2024-10808" + ], + "details": "A vulnerability has been found in code-projects E-Health Care System 1.0 and classified as critical. This vulnerability affects unknown code of the file Admin/req_detail.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10808" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/koevas257/cve/blob/main/sql.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283036" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283036" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.436566" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-707" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T02:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w5jc-xfq4-97p3/GHSA-w5jc-xfq4-97p3.json b/advisories/unreviewed/2024/11/GHSA-w5jc-xfq4-97p3/GHSA-w5jc-xfq4-97p3.json new file mode 100644 index 00000000000..90c90172136 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w5jc-xfq4-97p3/GHSA-w5jc-xfq4-97p3.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w5jc-xfq4-97p3", + "modified": "2024-11-05T03:30:45Z", + "published": "2024-11-05T03:30:45Z", + "aliases": [ + "CVE-2024-10809" + ], + "details": "A vulnerability was found in code-projects E-Health Care System 1.0 and classified as critical. This issue affects some unknown processing of the file /Doctor/chat.php. The manipulation of the argument name/message leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter \"name\" to be affected. But it must be assumed that the parameter \"message\" is affected as well.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10809" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/Xueweian/cve/blob/main/sql18.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283037" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283037" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.436759" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-707" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T02:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w6wv-j5pp-v5qx/GHSA-w6wv-j5pp-v5qx.json b/advisories/unreviewed/2024/11/GHSA-w6wv-j5pp-v5qx/GHSA-w6wv-j5pp-v5qx.json new file mode 100644 index 00000000000..f0bb169eb3d --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w6wv-j5pp-v5qx/GHSA-w6wv-j5pp-v5qx.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w6wv-j5pp-v5qx", + "modified": "2024-11-05T03:30:45Z", + "published": "2024-11-05T03:30:45Z", + "aliases": [ + "CVE-2024-10340" + ], + "details": "The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'scu' shortcode in versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10340" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/ultimate-shortcodes-creator/trunk/frontend/class-frontend.php?rev=2338595#L163" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3181163/ultimate-shortcodes-creator#file0" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9a9d6c71-98ce-4fa7-817a-43e4f3dc0602?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T02:15:03Z" + } +} \ No newline at end of file