From adbbf4b28ee69b42abc7a38489ee693eeabdb592 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 20 Feb 2025 06:32:35 +0000 Subject: [PATCH] Publish Advisories GHSA-7m8c-9m95-h39f GHSA-c5cj-hmh6-45pv GHSA-cq9g-38fc-j53v GHSA-jr7q-wmwf-2vf7 GHSA-jx5r-cxfc-c638 GHSA-p9q9-h36m-37f9 GHSA-qj8v-rq4h-7fwh --- .../GHSA-7m8c-9m95-h39f.json | 36 +++++++++++++++++ .../GHSA-c5cj-hmh6-45pv.json | 36 +++++++++++++++++ .../GHSA-cq9g-38fc-j53v.json | 40 +++++++++++++++++++ .../GHSA-jr7q-wmwf-2vf7.json | 36 +++++++++++++++++ .../GHSA-jx5r-cxfc-c638.json | 29 ++++++++++++++ .../GHSA-p9q9-h36m-37f9.json | 40 +++++++++++++++++++ .../GHSA-qj8v-rq4h-7fwh.json | 36 +++++++++++++++++ 7 files changed, 253 insertions(+) create mode 100644 advisories/unreviewed/2025/02/GHSA-7m8c-9m95-h39f/GHSA-7m8c-9m95-h39f.json create mode 100644 advisories/unreviewed/2025/02/GHSA-c5cj-hmh6-45pv/GHSA-c5cj-hmh6-45pv.json create mode 100644 advisories/unreviewed/2025/02/GHSA-cq9g-38fc-j53v/GHSA-cq9g-38fc-j53v.json create mode 100644 advisories/unreviewed/2025/02/GHSA-jr7q-wmwf-2vf7/GHSA-jr7q-wmwf-2vf7.json create mode 100644 advisories/unreviewed/2025/02/GHSA-jx5r-cxfc-c638/GHSA-jx5r-cxfc-c638.json create mode 100644 advisories/unreviewed/2025/02/GHSA-p9q9-h36m-37f9/GHSA-p9q9-h36m-37f9.json create mode 100644 advisories/unreviewed/2025/02/GHSA-qj8v-rq4h-7fwh/GHSA-qj8v-rq4h-7fwh.json diff --git a/advisories/unreviewed/2025/02/GHSA-7m8c-9m95-h39f/GHSA-7m8c-9m95-h39f.json b/advisories/unreviewed/2025/02/GHSA-7m8c-9m95-h39f/GHSA-7m8c-9m95-h39f.json new file mode 100644 index 00000000000..2e9ff99b057 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-7m8c-9m95-h39f/GHSA-7m8c-9m95-h39f.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7m8c-9m95-h39f", + "modified": "2025-02-20T06:31:03Z", + "published": "2025-02-20T06:31:03Z", + "aliases": [ + "CVE-2024-49355" + ], + "details": "IBM OpenPages with Watson 8.3 and 9.0 may write improperly neutralized data to server log files when the tracing is enabled per the System Tracing feature.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49355" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7183541" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-117" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-20T04:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-c5cj-hmh6-45pv/GHSA-c5cj-hmh6-45pv.json b/advisories/unreviewed/2025/02/GHSA-c5cj-hmh6-45pv/GHSA-c5cj-hmh6-45pv.json new file mode 100644 index 00000000000..f049b88f3cc --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-c5cj-hmh6-45pv/GHSA-c5cj-hmh6-45pv.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c5cj-hmh6-45pv", + "modified": "2025-02-20T06:31:03Z", + "published": "2025-02-20T06:31:03Z", + "aliases": [ + "CVE-2024-49782" + ], + "details": "IBM OpenPages with Watson 8.3 and 9.0 \n\n\n\ncould allow a remote attacker to spoof mail server identity when using SSL/TLS security. An attacker could exploit this vulnerability to gain access to sensitive information disclosed through email notifications generated by OpenPages or disrupt notification delivery.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49782" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7183541" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-297" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-20T04:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-cq9g-38fc-j53v/GHSA-cq9g-38fc-j53v.json b/advisories/unreviewed/2025/02/GHSA-cq9g-38fc-j53v/GHSA-cq9g-38fc-j53v.json new file mode 100644 index 00000000000..fc50916dede --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-cq9g-38fc-j53v/GHSA-cq9g-38fc-j53v.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cq9g-38fc-j53v", + "modified": "2025-02-20T06:31:03Z", + "published": "2025-02-20T06:31:03Z", + "aliases": [ + "CVE-2024-13445" + ], + "details": "The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the border, margin and gap parameters in all versions up to, and including, 3.27.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13445" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3241278%40elementor%2Ftrunk&old=3239949%40elementor%2Ftrunk&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8a11e702-34d2-49ee-8762-cc3614a7950a?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-20T05:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-jr7q-wmwf-2vf7/GHSA-jr7q-wmwf-2vf7.json b/advisories/unreviewed/2025/02/GHSA-jr7q-wmwf-2vf7/GHSA-jr7q-wmwf-2vf7.json new file mode 100644 index 00000000000..c5810ee58b8 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-jr7q-wmwf-2vf7/GHSA-jr7q-wmwf-2vf7.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jr7q-wmwf-2vf7", + "modified": "2025-02-20T06:31:03Z", + "published": "2025-02-20T06:31:03Z", + "aliases": [ + "CVE-2024-43196" + ], + "details": "IBM OpenPages with Watson 8.3 and 9.0 \n\napplication could allow an authenticated user to manipulate data in the Questionnaires application allowing the user to spoof other users' responses.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43196" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7183541" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-296" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-20T04:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-jx5r-cxfc-c638/GHSA-jx5r-cxfc-c638.json b/advisories/unreviewed/2025/02/GHSA-jx5r-cxfc-c638/GHSA-jx5r-cxfc-c638.json new file mode 100644 index 00000000000..a6590ae4ddd --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-jx5r-cxfc-c638/GHSA-jx5r-cxfc-c638.json @@ -0,0 +1,29 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jx5r-cxfc-c638", + "modified": "2025-02-20T06:31:04Z", + "published": "2025-02-20T06:31:04Z", + "aliases": [ + "CVE-2025-27218" + ], + "details": "Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.", + "severity": [], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27218" + }, + { + "type": "WEB", + "url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003535" + } + ], + "database_specific": { + "cwe_ids": [], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-20T05:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-p9q9-h36m-37f9/GHSA-p9q9-h36m-37f9.json b/advisories/unreviewed/2025/02/GHSA-p9q9-h36m-37f9/GHSA-p9q9-h36m-37f9.json new file mode 100644 index 00000000000..76c0582b470 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-p9q9-h36m-37f9/GHSA-p9q9-h36m-37f9.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p9q9-h36m-37f9", + "modified": "2025-02-20T06:31:04Z", + "published": "2025-02-20T06:31:04Z", + "aliases": [ + "CVE-2025-26856" + ], + "details": "Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an attacker logs in to the affected product with an administrative account and manipulates requests for a certain screen operation, an arbitrary OS command may be executed. This vulnerability was reported on a different screen operation from CVE-2025-20617.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26856" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/jp/JVN15293958" + }, + { + "type": "WEB", + "url": "https://www.iodata.jp/support/information/2025/01_ud-lt2" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-20T06:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/02/GHSA-qj8v-rq4h-7fwh/GHSA-qj8v-rq4h-7fwh.json b/advisories/unreviewed/2025/02/GHSA-qj8v-rq4h-7fwh/GHSA-qj8v-rq4h-7fwh.json new file mode 100644 index 00000000000..55fbd2a4414 --- /dev/null +++ b/advisories/unreviewed/2025/02/GHSA-qj8v-rq4h-7fwh/GHSA-qj8v-rq4h-7fwh.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qj8v-rq4h-7fwh", + "modified": "2025-02-20T06:31:03Z", + "published": "2025-02-20T06:31:03Z", + "aliases": [ + "CVE-2024-49780" + ], + "details": "IBM OpenPages with Watson 8.3 and 9.0 \n\nIBM OpenPages could allow a remote attacker to traverse directories on the system. An attacker with privileges to perform Import Configuration could send a specially crafted http request containing \"dot dot\" sequences (/../) in the file name parameter used in Import Configuration to write files to arbitrary locations outside of the specified directory and possibly overwrite arbitrary files.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49780" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7183541" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2025-02-20T04:15:10Z" + } +} \ No newline at end of file