Publish Advisories

GHSA-3x3j-vpj2-43h2
GHSA-hff3-p4h7-f98r
GHSA-jvr7-jmp5-9485
GHSA-w4qw-whg8-4fjc
GHSA-xq7r-x85c-27jm
GHSA-xv98-fj8w-837g

advisories/unreviewed/2024/08/GHSA-3x3j-vpj2-43h2/GHSA-3x3j-vpj2-43h2.json

@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3x3j-vpj2-43h2",
+  "modified": "2024-08-30T09:31:17Z",
+  "published": "2024-08-30T09:31:17Z",
+  "aliases": [
+    "CVE-2024-8016"
+  ],
+  "details": "The Events Calendar Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.0.2 via deserialization of untrusted input from the 'filters' parameter in widgets. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute code remotely. In certain configurations, this can be exploitable by lower level users. We confirmed that this plugin installed with Elementor makes it possible for users with contributor-level access and above to exploit this issue.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8016"
+    },
+    {
+      "type": "WEB",
+      "url": "https://theeventscalendar.com/blog/news/important-security-update-for-the-events-calendar-pro"
+    },
+    {
+      "type": "WEB",
+      "url": "https://theeventscalendar.com/release-notes/events-calendar-pro/events-calendar-pro-7-0-2-1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/34f0e5a6-0bd3-4734-b7e0-27dc825d193f?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-502"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-08-30T07:15:12Z"
+  }
+}

advisories/unreviewed/2024/08/GHSA-hff3-p4h7-f98r/GHSA-hff3-p4h7-f98r.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hff3-p4h7-f98r",
+  "modified": "2024-08-30T09:31:17Z",
+  "published": "2024-08-30T09:31:17Z",
+  "aliases": [
+    "CVE-2024-42412"
+  ],
+  "details": "Cross-site scripting vulnerability exists in WAB-I1750-PS and WAB-S1167-PS due to improper processing of input values in menu.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42412"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jvn.jp/en/jp/JVN24885537"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.elecom.co.jp/news/security/20240827-01"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-08-30T07:15:12Z"
+  }
+}

advisories/unreviewed/2024/08/GHSA-jvr7-jmp5-9485/GHSA-jvr7-jmp5-9485.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jvr7-jmp5-9485",
+  "modified": "2024-08-30T09:31:17Z",
+  "published": "2024-08-30T09:31:17Z",
+  "aliases": [
+    "CVE-2024-34577"
+  ],
+  "details": "Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, and WRC-X3000GS2A-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34577"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jvn.jp/en/jp/JVN24885537"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.elecom.co.jp/news/security/20240827-01"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-08-30T07:15:11Z"
+  }
+}

advisories/unreviewed/2024/08/GHSA-w4qw-whg8-4fjc/GHSA-w4qw-whg8-4fjc.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-w4qw-whg8-4fjc",
+  "modified": "2024-08-30T09:31:17Z",
+  "published": "2024-08-30T09:31:17Z",
+  "aliases": [
+    "CVE-2024-39300"
+  ],
+  "details": "Missing authentication vulnerability exists in Telnet function of WAB-I1750-PS v1.5.10 and earlier. When Telnet function of the product is enabled, a remote attacker may login to the product without authentication and alter the product's settings.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39300"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jvn.jp/en/jp/JVN24885537"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.elecom.co.jp/news/security/20240827-01"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-08-30T07:15:11Z"
+  }
+}

advisories/unreviewed/2024/08/GHSA-xq7r-x85c-27jm/GHSA-xq7r-x85c-27jm.json

@@ -0,0 +1,63 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xq7r-x85c-27jm",
+  "modified": "2024-08-30T09:31:17Z",
+  "published": "2024-08-30T09:31:17Z",
+  "aliases": [
+    "CVE-2024-44944"
+  ],
+  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ctnetlink: use helper function to calculate expect ID\n\nDelete expectation path is missing a call to the nf_expect_get_id()\nhelper function to calculate the expectation ID, otherwise LSB of the\nexpectation object address is leaked to userspace.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44944"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/24f407042cf90b0872de667460230d8d50c06c39"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/27662b46f2adaa52c1665a82af4b21c42c4337fd"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/5e2c24f7b0911b15c29aefce760bcf770542fb61"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/64c0b8e64be8368617ef08dfc59a3160563a1435"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/66e7650dbbb8e236e781c670b167edc81e771450"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/74de442b8e12a207c07953ee068009a7701aff8f"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/782161895eb4ac45cf7cfa8db375bd4766cb8299"
+    },
+    {
+      "type": "WEB",
+      "url": "https://git.kernel.org/stable/c/eb4ca1a97e08ff5b920664ba292e576257e2d184"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-08-30T08:15:04Z"
+  }
+}

advisories/unreviewed/2024/08/GHSA-xv98-fj8w-837g/GHSA-xv98-fj8w-837g.json

@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-xv98-fj8w-837g",
+  "modified": "2024-08-30T09:31:17Z",
+  "published": "2024-08-30T09:31:17Z",
+  "aliases": [
+    "CVE-2024-8319"
+  ],
+  "details": "The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect nonce validation on the tf_order_status_email_resend_function,  tf_visitor_details_edit_function, tf_checkinout_details_edit_function, tf_order_status_edit_function, tf_order_bulk_action_edit_function, tf_remove_room_order_ids, and tf_delete_old_review_fields functions. This makes it possible for unauthenticated attackers to resend order status emails, update visitor/order details, edit check-in/out details, edit order status, perform bulk order status updates, remove room order IDs, and delete old review fields, respectively, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8319"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3054266/tourfic"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/07fa7b1a-9137-4049-a20a-8eb6df7ca578?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-352"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-08-30T08:15:04Z"
+  }
+}