netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-q262-3hfr-f5q4
GHSA-2gf4-m97g-cvpw
GHSA-3vq2-9cm2-rhrv
GHSA-562p-f5h4-c4cw
GHSA-592c-fmq9-g63c
GHSA-5ccr-x72v-c947
GHSA-628h-r6p2-r4vv
GHSA-6vg7-562r-mh4w
GHSA-c3qr-8rx9-m6r2
GHSA-g779-vpj7-v6c4
GHSA-jhwr-fg7p-675f
GHSA-m9v7-79rj-pq3w
GHSA-mhww-7h5r-9h8q
GHSA-p7rm-v5xq-5pr9
GHSA-ph5m-227m-fc5g
GHSA-rg42-f9ww-x3w7
GHSA-rpr4-fpwh-9vfr
GHSA-rwxj-58wx-7h6x
This commit is contained in:
advisory-database[bot]
2024-06-21 03:31:58 +00:00
parent db7967be7f
commit b667f5d4db
18 changed files with 610 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/05/GHSA-q262-3hfr-f5q4/GHSA-q262-3hfr-f5q4.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-q262-3hfr-f5q4",
"modified": "2024-06-11T06:31:46Z",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-05-08T03:30:37Z",
"aliases": [
"CVE-2024-4418"
@@ -32,6 +32,10 @@
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4IE44UIIC3QWBFRB4EUSFNLJBU6JLNSD"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4ZQBAJVHIZMCZNTRPUW3ZKXRKLXRQZU"
}
],
"database_specific": {
advisories/unreviewed/2024/06/GHSA-2gf4-m97g-cvpw/GHSA-2gf4-m97g-cvpw.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2gf4-m97g-cvpw",
"modified": "2024-06-20T15:31:18Z",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-20T00:30:46Z",
"aliases": [
"CVE-2024-6102"
@@ -28,6 +28,10 @@
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/339169163"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP"
}
],
"database_specific": {
advisories/unreviewed/2024/06/GHSA-3vq2-9cm2-rhrv/GHSA-3vq2-9cm2-rhrv.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3vq2-9cm2-rhrv",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-21T03:30:33Z",
"aliases": [
"CVE-2024-6216"
],
"details": "A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the file add-users.php. The manipulation of the argument contact leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269280.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6216"
},
{
"type": "WEB",
"url": "https://github.com/jadu101/CVE/blob/main/SourceCodester_Food_Ordering_Management_System_add_users_Sqli.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.269280"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.269280"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.359634"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-21T02:15:12Z"
}
}
advisories/unreviewed/2024/06/GHSA-562p-f5h4-c4cw/GHSA-562p-f5h4-c4cw.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-562p-f5h4-c4cw",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-21T03:30:33Z",
"aliases": [
"CVE-2024-6214"
],
"details": "A vulnerability was found in SourceCodester Food Ordering Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file add-item.php. The manipulation of the argument price leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-269278 is the identifier assigned to this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6214"
},
{
"type": "WEB",
"url": "https://github.com/jadu101/CVE/blob/main/SourceCoderster_Food_Ordering_Management_System_add_item_Sqli.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.269278"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.269278"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.359582"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-21T01:16:04Z"
}
}
advisories/unreviewed/2024/06/GHSA-592c-fmq9-g63c/GHSA-592c-fmq9-g63c.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-592c-fmq9-g63c",
"modified": "2024-06-05T21:31:29Z",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-05T21:31:29Z",
"aliases": [
"CVE-2024-5171"
@@ -21,6 +21,10 @@
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/332382766"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP"
}
],
"database_specific": {
advisories/unreviewed/2024/06/GHSA-5ccr-x72v-c947/GHSA-5ccr-x72v-c947.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5ccr-x72v-c947",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-21T03:30:33Z",
"aliases": [
"CVE-2024-5344"
],
"details": "The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘forgoturl’ attribute within the plugin's WP Login & Register widget in all versions up to, and including, 5.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5344"
},
{
"type": "WEB",
"url": "https://roadmap.theplusaddons.com/updates"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1ac8fb0b-21a9-4b94-bb24-b349a7fe3305?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-21T02:15:11Z"
}
}
advisories/unreviewed/2024/06/GHSA-628h-r6p2-r4vv/GHSA-628h-r6p2-r4vv.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-628h-r6p2-r4vv",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-21T03:30:33Z",
"aliases": [
"CVE-2024-6213"
],
"details": "A vulnerability was found in SourceCodester Food Ordering Management System up to 1.0. It has been classified as critical. This affects an unknown part of the file login.php of the component Login Panel. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269277 was assigned to this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6213"
},
{
"type": "WEB",
"url": "https://github.com/jadu101/CVE/blob/main/SourceCodester_Food_Ordering_Management_System_Sqli.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.269277"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.269277"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.359574"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-21T01:16:02Z"
}
}
advisories/unreviewed/2024/06/GHSA-6vg7-562r-mh4w/GHSA-6vg7-562r-mh4w.json
+46
View File
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6vg7-562r-mh4w",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-21T03:30:33Z",
"aliases": [
"CVE-2024-3610"
],
"details": "The WP Child Theme Generator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wctg_easy_child_theme() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to create a blank child theme and activate it cause the site to whitescreen.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3610"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wp-child-theme-generator/trunk/wp-easy-child/wp-easy-child.php#L60"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?old_path=/wp-child-theme-generator/tags/1.1.1&new_path=/wp-child-theme-generator/tags/1.1.2&sfp_email=&sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/581e6686-a103-43f6-aa99-6a9862d98837?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-21T02:15:10Z"
}
}
advisories/unreviewed/2024/06/GHSA-c3qr-8rx9-m6r2/GHSA-c3qr-8rx9-m6r2.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c3qr-8rx9-m6r2",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-21T03:30:33Z",
"aliases": [
"CVE-2024-6215"
],
"details": "A vulnerability was found in SourceCodester Food Ordering Management System up to 1.0. It has been rated as critical. This issue affects some unknown processing of the file view-ticket-admin.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269279.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6215"
},
{
"type": "WEB",
"url": "https://github.com/jadu101/CVE/blob/main/SourceCodester_Food_Ordering_Management_System_view_ticket_admin_Sqli.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.269279"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.269279"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.359595"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-21T02:15:11Z"
}
}
advisories/unreviewed/2024/06/GHSA-g779-vpj7-v6c4/GHSA-g779-vpj7-v6c4.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g779-vpj7-v6c4",
"modified": "2024-06-20T15:31:18Z",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-20T00:30:46Z",
"aliases": [
"CVE-2024-6100"
@@ -28,6 +28,10 @@
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/344608204"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP"
}
],
"database_specific": {
advisories/unreviewed/2024/06/GHSA-jhwr-fg7p-675f/GHSA-jhwr-fg7p-675f.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jhwr-fg7p-675f",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-21T03:30:33Z",
"aliases": [
"CVE-2023-3352"
],
"details": "The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen or the Media Library.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3352"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3105107/wp-smushit/trunk/app/class-ajax.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dfbaa3e4-40c2-41d8-996c-232e27a04b73?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-21T02:15:09Z"
}
}
advisories/unreviewed/2024/06/GHSA-m9v7-79rj-pq3w/GHSA-m9v7-79rj-pq3w.json
+42
View File
@@ -0,0 +1,42 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m9v7-79rj-pq3w",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-21T03:30:33Z",
"aliases": [
"CVE-2024-1639"
],
"details": "The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey() and showAllLicenseKeys() functions in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with admin dashboard access (contributors by default due to WooCommerce) to view arbitrary decrypted license keys. The functions contain a referrer nonce check. However, these can be retrieved via the dashboard through the \"license\" JS variable.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1639"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/license-manager-for-woocommerce/tags/3.0.5/includes/Controllers/License.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/92e444db-72d5-444f-811e-ade0bc097769?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-21T02:15:10Z"
}
}
advisories/unreviewed/2024/06/GHSA-mhww-7h5r-9h8q/GHSA-mhww-7h5r-9h8q.json
+46
View File
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mhww-7h5r-9h8q",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-21T03:30:33Z",
"aliases": [
"CVE-2024-1955"
],
"details": "The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warning_notices_settings' function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with contributor access and above, to modify the plugin's settings.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1955"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wp-hide-backed-notices/tags/1.3/admin/class-wp-hide-backed-notices-admin.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3104675%40wp-hide-backed-notices&new=3104675%40wp-hide-backed-notices&sfp_email=&sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d4655236-7dfe-40ae-9d0c-6eacc59af13d?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-21T02:15:10Z"
}
}
advisories/unreviewed/2024/06/GHSA-p7rm-v5xq-5pr9/GHSA-p7rm-v5xq-5pr9.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p7rm-v5xq-5pr9",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-21T03:30:33Z",
"aliases": [
"CVE-2024-6218"
],
"details": "A vulnerability, which was classified as critical, has been found in itsourcecode Vehicle Management System 1.0. Affected by this issue is some unknown functionality of the file busprofile.php. The manipulation of the argument busid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-269282 is the identifier assigned to this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6218"
},
{
"type": "WEB",
"url": "https://github.com/HryspaHodor/CVE/issues/7"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.269282"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.269282"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.360697"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-21T02:15:13Z"
}
}
advisories/unreviewed/2024/06/GHSA-ph5m-227m-fc5g/GHSA-ph5m-227m-fc5g.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-ph5m-227m-fc5g",
"modified": "2024-06-20T15:31:18Z",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-20T00:30:47Z",
"aliases": [
"CVE-2024-6103"
@@ -28,6 +28,10 @@
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/344639860"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP"
}
],
"database_specific": {
advisories/unreviewed/2024/06/GHSA-rg42-f9ww-x3w7/GHSA-rg42-f9ww-x3w7.json
+5 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rg42-f9ww-x3w7",
"modified": "2024-06-20T15:31:18Z",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-20T00:30:46Z",
"aliases": [
"CVE-2024-6101"
@@ -28,6 +28,10 @@
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/343748812"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP"
}
],
"database_specific": {
advisories/unreviewed/2024/06/GHSA-rpr4-fpwh-9vfr/GHSA-rpr4-fpwh-9vfr.json
+62
View File
@@ -0,0 +1,62 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rpr4-fpwh-9vfr",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-21T03:30:33Z",
"aliases": [
"CVE-2024-5503"
],
"details": "The WP Blog Post Layouts plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5503"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wp-blog-post-layouts/trunk/includes/gutenberg.php#L883"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wp-blog-post-layouts/trunk/includes/gutenberg.php#L900"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wp-blog-post-layouts/trunk/includes/gutenberg.php#L917"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wp-blog-post-layouts/trunk/includes/src/grid/element.php#L1146"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wp-blog-post-layouts/trunk/includes/src/list/element.php#L1136"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wp-blog-post-layouts/trunk/includes/src/masonry/element.php#L1134"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5205cc95-06d1-4bc6-a9ea-082df9566935?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-21T02:15:11Z"
}
}
advisories/unreviewed/2024/06/GHSA-rwxj-58wx-7h6x/GHSA-rwxj-58wx-7h6x.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rwxj-58wx-7h6x",
"modified": "2024-06-21T03:30:33Z",
"published": "2024-06-21T03:30:33Z",
"aliases": [
"CVE-2024-6217"
],
"details": "A vulnerability classified as critical was found in SourceCodester Food Ordering Management System 1.0. Affected by this vulnerability is an unknown functionality of the file user-router.php. The manipulation of the argument 1_verified leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269281 was assigned to this vulnerability.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6217"
},
{
"type": "WEB",
"url": "https://github.com/jadu101/CVE/blob/main/SourceCodester_Food_Ordering_Management_System_user_router_Sqli.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.269281"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.269281"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.359644"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-21T02:15:12Z"
}
}