diff --git a/advisories/unreviewed/2024/05/GHSA-26m6-xq66-wqvc/GHSA-26m6-xq66-wqvc.json b/advisories/unreviewed/2024/05/GHSA-26m6-xq66-wqvc/GHSA-26m6-xq66-wqvc.json new file mode 100644 index 00000000000..630d6140e22 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-26m6-xq66-wqvc/GHSA-26m6-xq66-wqvc.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-26m6-xq66-wqvc", + "modified": "2024-05-31T12:30:49Z", + "published": "2024-05-31T12:30:49Z", + "aliases": [ + "CVE-2024-4160" + ], + "details": "The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdm-all-packages' shortcode in all versions up to, and including, 3.2.90 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4160" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/download-manager/trunk/src/Package/views/all-packages-shortcode.php?rev=2996137#L202" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3080781" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/download-manager" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/download-manager/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9f51258a-e228-412f-9d97-28ab679136d7?source=cve" + }, + { + "type": "WEB", + "url": "https://www.wpdownloadmanager.com/doc/short-codes/wpdm_all_packages-list-all-downloads-in-tabular-format-in-a-page" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-31T10:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-8vc8-45wf-73mv/GHSA-8vc8-45wf-73mv.json b/advisories/unreviewed/2024/05/GHSA-8vc8-45wf-73mv/GHSA-8vc8-45wf-73mv.json new file mode 100644 index 00000000000..1013e399607 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-8vc8-45wf-73mv/GHSA-8vc8-45wf-73mv.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8vc8-45wf-73mv", + "modified": "2024-05-31T12:30:49Z", + "published": "2024-05-31T12:30:49Z", + "aliases": [ + "CVE-2024-5041" + ], + "details": "The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ha-ia-content-button’ parameter in all versions up to, and including, 3.10.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5041" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/happy-elementor-addons/trunk/widgets/image-accordion/widget.php#L1462" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3095128" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fb037c9f-5d20-46f6-b1ff-34b9d192bad2?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-31T10:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-cw5c-xm7f-wx63/GHSA-cw5c-xm7f-wx63.json b/advisories/unreviewed/2024/05/GHSA-cw5c-xm7f-wx63/GHSA-cw5c-xm7f-wx63.json new file mode 100644 index 00000000000..fd98276cb06 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-cw5c-xm7f-wx63/GHSA-cw5c-xm7f-wx63.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cw5c-xm7f-wx63", + "modified": "2024-05-31T12:30:49Z", + "published": "2024-05-31T12:30:49Z", + "aliases": [ + "CVE-2024-23692" + ], + "details": "Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23692" + }, + { + "type": "WEB", + "url": "https://mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce" + }, + { + "type": "WEB", + "url": "https://vulncheck.com/advisories/rejetto-unauth-rce" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-1336" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-31T10:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-g86w-vwcj-2p6m/GHSA-g86w-vwcj-2p6m.json b/advisories/unreviewed/2024/05/GHSA-g86w-vwcj-2p6m/GHSA-g86w-vwcj-2p6m.json new file mode 100644 index 00000000000..9d52be365f6 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-g86w-vwcj-2p6m/GHSA-g86w-vwcj-2p6m.json @@ -0,0 +1,31 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g86w-vwcj-2p6m", + "modified": "2024-05-31T12:30:49Z", + "published": "2024-05-31T12:30:49Z", + "aliases": [ + "CVE-2024-5538" + ], + "details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5538" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-31T11:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-hgmh-h7vj-ppm6/GHSA-hgmh-h7vj-ppm6.json b/advisories/unreviewed/2024/05/GHSA-hgmh-h7vj-ppm6/GHSA-hgmh-h7vj-ppm6.json new file mode 100644 index 00000000000..2424545bb36 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-hgmh-h7vj-ppm6/GHSA-hgmh-h7vj-ppm6.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hgmh-h7vj-ppm6", + "modified": "2024-05-31T12:30:49Z", + "published": "2024-05-31T12:30:49Z", + "aliases": [ + "CVE-2024-5347" + ], + "details": "The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'arrow' attribute within the plugin's Post Navigation widget in all versions up to, and including, 3.10.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5347" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/happy-elementor-addons/tags/3.10.9/widgets/post-navigation/widget.php#L588" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3095128/happy-elementor-addons/trunk/widgets/post-navigation/widget.php" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/happy-elementor-addons/#developers" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/415a7201-bdff-4342-9e06-ce0e500cdc7c?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-31T10:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-jgqv-p2mc-mx99/GHSA-jgqv-p2mc-mx99.json b/advisories/unreviewed/2024/05/GHSA-jgqv-p2mc-mx99/GHSA-jgqv-p2mc-mx99.json new file mode 100644 index 00000000000..2107c84c813 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-jgqv-p2mc-mx99/GHSA-jgqv-p2mc-mx99.json @@ -0,0 +1,31 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jgqv-p2mc-mx99", + "modified": "2024-05-31T12:30:49Z", + "published": "2024-05-31T12:30:49Z", + "aliases": [ + "CVE-2024-5484" + ], + "details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5484" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-31T11:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-mxvf-g5w3-jg6g/GHSA-mxvf-g5w3-jg6g.json b/advisories/unreviewed/2024/05/GHSA-mxvf-g5w3-jg6g/GHSA-mxvf-g5w3-jg6g.json new file mode 100644 index 00000000000..7ed5c88826e --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-mxvf-g5w3-jg6g/GHSA-mxvf-g5w3-jg6g.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mxvf-g5w3-jg6g", + "modified": "2024-05-31T12:30:49Z", + "published": "2024-05-31T12:30:49Z", + "aliases": [ + "CVE-2024-22338" + ], + "details": "IBM Security Verify Access OIDC Provider 22.09 through 23.03 could disclose sensitive information to a local user due to hazardous input validation. IBM X-Force ID: 279978.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22338" + }, + { + "type": "WEB", + "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/279978" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7155340" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-31T11:15:09Z" + } +} \ No newline at end of file