From 9d1a2d56476c5b187240193ed38167b0b40eb3e3 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 5 Nov 2024 03:32:03 +0000 Subject: [PATCH] Publish Advisories GHSA-x7g6-rwhc-g7mj GHSA-953x-6wwg-wcxg GHSA-cvc7-ww7g-w56m GHSA-hhh3-584m-qjr8 GHSA-pfp9-w5f6-rg7c GHSA-w5jc-xfq4-97p3 GHSA-w6wv-j5pp-v5qx --- .../GHSA-x7g6-rwhc-g7mj.json | 14 ++++- .../GHSA-953x-6wwg-wcxg.json | 58 +++++++++++++++++++ .../GHSA-cvc7-ww7g-w56m.json | 58 +++++++++++++++++++ .../GHSA-hhh3-584m-qjr8.json | 58 +++++++++++++++++++ .../GHSA-pfp9-w5f6-rg7c.json | 58 +++++++++++++++++++ .../GHSA-w5jc-xfq4-97p3.json | 58 +++++++++++++++++++ .../GHSA-w6wv-j5pp-v5qx.json | 46 +++++++++++++++ 7 files changed, 349 insertions(+), 1 deletion(-) create mode 100644 advisories/unreviewed/2024/11/GHSA-953x-6wwg-wcxg/GHSA-953x-6wwg-wcxg.json create mode 100644 advisories/unreviewed/2024/11/GHSA-cvc7-ww7g-w56m/GHSA-cvc7-ww7g-w56m.json create mode 100644 advisories/unreviewed/2024/11/GHSA-hhh3-584m-qjr8/GHSA-hhh3-584m-qjr8.json create mode 100644 advisories/unreviewed/2024/11/GHSA-pfp9-w5f6-rg7c/GHSA-pfp9-w5f6-rg7c.json create mode 100644 advisories/unreviewed/2024/11/GHSA-w5jc-xfq4-97p3/GHSA-w5jc-xfq4-97p3.json create mode 100644 advisories/unreviewed/2024/11/GHSA-w6wv-j5pp-v5qx/GHSA-w6wv-j5pp-v5qx.json diff --git a/advisories/github-reviewed/2024/05/GHSA-x7g6-rwhc-g7mj/GHSA-x7g6-rwhc-g7mj.json b/advisories/github-reviewed/2024/05/GHSA-x7g6-rwhc-g7mj/GHSA-x7g6-rwhc-g7mj.json index 4e4bdf815c4..f20e98d35fd 100644 --- a/advisories/github-reviewed/2024/05/GHSA-x7g6-rwhc-g7mj/GHSA-x7g6-rwhc-g7mj.json +++ b/advisories/github-reviewed/2024/05/GHSA-x7g6-rwhc-g7mj/GHSA-x7g6-rwhc-g7mj.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-x7g6-rwhc-g7mj", - "modified": "2024-10-15T03:30:42Z", + "modified": "2024-11-05T03:30:45Z", "published": "2024-05-02T15:30:35Z", "aliases": [ "CVE-2024-4029" @@ -56,6 +56,18 @@ "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2024:8080" }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8823" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8824" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/errata/RHSA-2024:8826" + }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2024-4029" diff --git a/advisories/unreviewed/2024/11/GHSA-953x-6wwg-wcxg/GHSA-953x-6wwg-wcxg.json b/advisories/unreviewed/2024/11/GHSA-953x-6wwg-wcxg/GHSA-953x-6wwg-wcxg.json new file mode 100644 index 00000000000..50132a2f1f6 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-953x-6wwg-wcxg/GHSA-953x-6wwg-wcxg.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-953x-6wwg-wcxg", + "modified": "2024-11-05T03:30:45Z", + "published": "2024-11-05T03:30:45Z", + "aliases": [ + "CVE-2024-10807" + ], + "details": "A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been rated as problematic. This issue affects some unknown processing of the file hms/doctor/search.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10807" + }, + { + "type": "WEB", + "url": "https://github.com/secuserx/CVE/blob/main/%5BXSS%20vulnerability%5D%20found%20in%20Hospital%20Management%20System%20(HMS)%204.0%20-%20(search.php).md" + }, + { + "type": "WEB", + "url": "https://phpgurukul.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283031" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283031" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.436551" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-707" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T02:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-cvc7-ww7g-w56m/GHSA-cvc7-ww7g-w56m.json b/advisories/unreviewed/2024/11/GHSA-cvc7-ww7g-w56m/GHSA-cvc7-ww7g-w56m.json new file mode 100644 index 00000000000..50d303aecc7 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-cvc7-ww7g-w56m/GHSA-cvc7-ww7g-w56m.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cvc7-ww7g-w56m", + "modified": "2024-11-05T03:30:45Z", + "published": "2024-11-05T03:30:45Z", + "aliases": [ + "CVE-2024-10806" + ], + "details": "A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been declared as problematic. This vulnerability affects unknown code of the file betweendates-detailsreports.php. The manipulation of the argument fromdate/todate leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10806" + }, + { + "type": "WEB", + "url": "https://github.com/secuserx/CVE/blob/main/%5BXSS%20vulnerability%5D%20found%20in%20Hospital%20Management%20System%20(HMS)%204.0%20-%20(betweendates-detailsreports.php).md" + }, + { + "type": "WEB", + "url": "https://phpgurukul.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283030" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283030" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.436547" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-707" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T01:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-hhh3-584m-qjr8/GHSA-hhh3-584m-qjr8.json b/advisories/unreviewed/2024/11/GHSA-hhh3-584m-qjr8/GHSA-hhh3-584m-qjr8.json new file mode 100644 index 00000000000..cb77349b46e --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-hhh3-584m-qjr8/GHSA-hhh3-584m-qjr8.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hhh3-584m-qjr8", + "modified": "2024-11-05T03:30:45Z", + "published": "2024-11-05T03:30:45Z", + "aliases": [ + "CVE-2024-10810" + ], + "details": "A vulnerability was found in code-projects E-Health Care System 1.0. It has been classified as critical. Affected is an unknown function of the file Doctor/app_request.php. The manipulation of the argument app_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10810" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/wsy149433/cve/blob/main/sql19.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283038" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283038" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.437018" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-707" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T02:15:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-pfp9-w5f6-rg7c/GHSA-pfp9-w5f6-rg7c.json b/advisories/unreviewed/2024/11/GHSA-pfp9-w5f6-rg7c/GHSA-pfp9-w5f6-rg7c.json new file mode 100644 index 00000000000..629d2cc610b --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-pfp9-w5f6-rg7c/GHSA-pfp9-w5f6-rg7c.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pfp9-w5f6-rg7c", + "modified": "2024-11-05T03:30:45Z", + "published": "2024-11-05T03:30:45Z", + "aliases": [ + "CVE-2024-10808" + ], + "details": "A vulnerability has been found in code-projects E-Health Care System 1.0 and classified as critical. This vulnerability affects unknown code of the file Admin/req_detail.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10808" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/koevas257/cve/blob/main/sql.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283036" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283036" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.436566" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-707" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T02:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w5jc-xfq4-97p3/GHSA-w5jc-xfq4-97p3.json b/advisories/unreviewed/2024/11/GHSA-w5jc-xfq4-97p3/GHSA-w5jc-xfq4-97p3.json new file mode 100644 index 00000000000..90c90172136 --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w5jc-xfq4-97p3/GHSA-w5jc-xfq4-97p3.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w5jc-xfq4-97p3", + "modified": "2024-11-05T03:30:45Z", + "published": "2024-11-05T03:30:45Z", + "aliases": [ + "CVE-2024-10809" + ], + "details": "A vulnerability was found in code-projects E-Health Care System 1.0 and classified as critical. This issue affects some unknown processing of the file /Doctor/chat.php. The manipulation of the argument name/message leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter \"name\" to be affected. But it must be assumed that the parameter \"message\" is affected as well.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10809" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://github.com/Xueweian/cve/blob/main/sql18.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.283037" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.283037" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.436759" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-707" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T02:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/11/GHSA-w6wv-j5pp-v5qx/GHSA-w6wv-j5pp-v5qx.json b/advisories/unreviewed/2024/11/GHSA-w6wv-j5pp-v5qx/GHSA-w6wv-j5pp-v5qx.json new file mode 100644 index 00000000000..f0bb169eb3d --- /dev/null +++ b/advisories/unreviewed/2024/11/GHSA-w6wv-j5pp-v5qx/GHSA-w6wv-j5pp-v5qx.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w6wv-j5pp-v5qx", + "modified": "2024-11-05T03:30:45Z", + "published": "2024-11-05T03:30:45Z", + "aliases": [ + "CVE-2024-10340" + ], + "details": "The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'scu' shortcode in versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10340" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/ultimate-shortcodes-creator/trunk/frontend/class-frontend.php?rev=2338595#L163" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3181163/ultimate-shortcodes-creator#file0" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9a9d6c71-98ce-4fa7-817a-43e4f3dc0602?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-11-05T02:15:03Z" + } +} \ No newline at end of file