diff --git a/advisories/unreviewed/2024/05/GHSA-q262-3hfr-f5q4/GHSA-q262-3hfr-f5q4.json b/advisories/unreviewed/2024/05/GHSA-q262-3hfr-f5q4/GHSA-q262-3hfr-f5q4.json index 8d77aa2e047..a6c92c172f4 100644 --- a/advisories/unreviewed/2024/05/GHSA-q262-3hfr-f5q4/GHSA-q262-3hfr-f5q4.json +++ b/advisories/unreviewed/2024/05/GHSA-q262-3hfr-f5q4/GHSA-q262-3hfr-f5q4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-q262-3hfr-f5q4", - "modified": "2024-06-11T06:31:46Z", + "modified": "2024-06-21T03:30:33Z", "published": "2024-05-08T03:30:37Z", "aliases": [ "CVE-2024-4418" @@ -32,6 +32,10 @@ { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4IE44UIIC3QWBFRB4EUSFNLJBU6JLNSD" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Q4ZQBAJVHIZMCZNTRPUW3ZKXRKLXRQZU" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/06/GHSA-2gf4-m97g-cvpw/GHSA-2gf4-m97g-cvpw.json b/advisories/unreviewed/2024/06/GHSA-2gf4-m97g-cvpw/GHSA-2gf4-m97g-cvpw.json index 0fd02ee7170..1f8781a754a 100644 --- a/advisories/unreviewed/2024/06/GHSA-2gf4-m97g-cvpw/GHSA-2gf4-m97g-cvpw.json +++ b/advisories/unreviewed/2024/06/GHSA-2gf4-m97g-cvpw/GHSA-2gf4-m97g-cvpw.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-2gf4-m97g-cvpw", - "modified": "2024-06-20T15:31:18Z", + "modified": "2024-06-21T03:30:33Z", "published": "2024-06-20T00:30:46Z", "aliases": [ "CVE-2024-6102" @@ -28,6 +28,10 @@ { "type": "WEB", "url": "https://issues.chromium.org/issues/339169163" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/06/GHSA-3vq2-9cm2-rhrv/GHSA-3vq2-9cm2-rhrv.json b/advisories/unreviewed/2024/06/GHSA-3vq2-9cm2-rhrv/GHSA-3vq2-9cm2-rhrv.json new file mode 100644 index 00000000000..6f035da26e2 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-3vq2-9cm2-rhrv/GHSA-3vq2-9cm2-rhrv.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3vq2-9cm2-rhrv", + "modified": "2024-06-21T03:30:33Z", + "published": "2024-06-21T03:30:33Z", + "aliases": [ + "CVE-2024-6216" + ], + "details": "A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System 1.0. Affected is an unknown function of the file add-users.php. The manipulation of the argument contact leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-269280.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6216" + }, + { + "type": "WEB", + "url": "https://github.com/jadu101/CVE/blob/main/SourceCodester_Food_Ordering_Management_System_add_users_Sqli.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.269280" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.269280" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.359634" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-21T02:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-562p-f5h4-c4cw/GHSA-562p-f5h4-c4cw.json b/advisories/unreviewed/2024/06/GHSA-562p-f5h4-c4cw/GHSA-562p-f5h4-c4cw.json new file mode 100644 index 00000000000..fc49943bf16 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-562p-f5h4-c4cw/GHSA-562p-f5h4-c4cw.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-562p-f5h4-c4cw", + "modified": "2024-06-21T03:30:33Z", + "published": "2024-06-21T03:30:33Z", + "aliases": [ + "CVE-2024-6214" + ], + "details": "A vulnerability was found in SourceCodester Food Ordering Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file add-item.php. The manipulation of the argument price leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-269278 is the identifier assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6214" + }, + { + "type": "WEB", + "url": "https://github.com/jadu101/CVE/blob/main/SourceCoderster_Food_Ordering_Management_System_add_item_Sqli.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.269278" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.269278" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.359582" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-21T01:16:04Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-592c-fmq9-g63c/GHSA-592c-fmq9-g63c.json b/advisories/unreviewed/2024/06/GHSA-592c-fmq9-g63c/GHSA-592c-fmq9-g63c.json index 160c2039748..971c16147eb 100644 --- a/advisories/unreviewed/2024/06/GHSA-592c-fmq9-g63c/GHSA-592c-fmq9-g63c.json +++ b/advisories/unreviewed/2024/06/GHSA-592c-fmq9-g63c/GHSA-592c-fmq9-g63c.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-592c-fmq9-g63c", - "modified": "2024-06-05T21:31:29Z", + "modified": "2024-06-21T03:30:33Z", "published": "2024-06-05T21:31:29Z", "aliases": [ "CVE-2024-5171" @@ -21,6 +21,10 @@ { "type": "WEB", "url": "https://issues.chromium.org/issues/332382766" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/06/GHSA-5ccr-x72v-c947/GHSA-5ccr-x72v-c947.json b/advisories/unreviewed/2024/06/GHSA-5ccr-x72v-c947/GHSA-5ccr-x72v-c947.json new file mode 100644 index 00000000000..d83e5c7cff6 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-5ccr-x72v-c947/GHSA-5ccr-x72v-c947.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5ccr-x72v-c947", + "modified": "2024-06-21T03:30:33Z", + "published": "2024-06-21T03:30:33Z", + "aliases": [ + "CVE-2024-5344" + ], + "details": "The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘forgoturl’ attribute within the plugin's WP Login & Register widget in all versions up to, and including, 5.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5344" + }, + { + "type": "WEB", + "url": "https://roadmap.theplusaddons.com/updates" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1ac8fb0b-21a9-4b94-bb24-b349a7fe3305?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-21T02:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-628h-r6p2-r4vv/GHSA-628h-r6p2-r4vv.json b/advisories/unreviewed/2024/06/GHSA-628h-r6p2-r4vv/GHSA-628h-r6p2-r4vv.json new file mode 100644 index 00000000000..afe87709101 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-628h-r6p2-r4vv/GHSA-628h-r6p2-r4vv.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-628h-r6p2-r4vv", + "modified": "2024-06-21T03:30:33Z", + "published": "2024-06-21T03:30:33Z", + "aliases": [ + "CVE-2024-6213" + ], + "details": "A vulnerability was found in SourceCodester Food Ordering Management System up to 1.0. It has been classified as critical. This affects an unknown part of the file login.php of the component Login Panel. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269277 was assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6213" + }, + { + "type": "WEB", + "url": "https://github.com/jadu101/CVE/blob/main/SourceCodester_Food_Ordering_Management_System_Sqli.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.269277" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.269277" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.359574" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-21T01:16:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-6vg7-562r-mh4w/GHSA-6vg7-562r-mh4w.json b/advisories/unreviewed/2024/06/GHSA-6vg7-562r-mh4w/GHSA-6vg7-562r-mh4w.json new file mode 100644 index 00000000000..03571c7dfc0 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-6vg7-562r-mh4w/GHSA-6vg7-562r-mh4w.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6vg7-562r-mh4w", + "modified": "2024-06-21T03:30:33Z", + "published": "2024-06-21T03:30:33Z", + "aliases": [ + "CVE-2024-3610" + ], + "details": "The WP Child Theme Generator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wctg_easy_child_theme() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to create a blank child theme and activate it cause the site to whitescreen.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3610" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-child-theme-generator/trunk/wp-easy-child/wp-easy-child.php#L60" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?old_path=/wp-child-theme-generator/tags/1.1.1&new_path=/wp-child-theme-generator/tags/1.1.2&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/581e6686-a103-43f6-aa99-6a9862d98837?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-21T02:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-c3qr-8rx9-m6r2/GHSA-c3qr-8rx9-m6r2.json b/advisories/unreviewed/2024/06/GHSA-c3qr-8rx9-m6r2/GHSA-c3qr-8rx9-m6r2.json new file mode 100644 index 00000000000..a04ddda7ef1 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-c3qr-8rx9-m6r2/GHSA-c3qr-8rx9-m6r2.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c3qr-8rx9-m6r2", + "modified": "2024-06-21T03:30:33Z", + "published": "2024-06-21T03:30:33Z", + "aliases": [ + "CVE-2024-6215" + ], + "details": "A vulnerability was found in SourceCodester Food Ordering Management System up to 1.0. It has been rated as critical. This issue affects some unknown processing of the file view-ticket-admin.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-269279.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6215" + }, + { + "type": "WEB", + "url": "https://github.com/jadu101/CVE/blob/main/SourceCodester_Food_Ordering_Management_System_view_ticket_admin_Sqli.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.269279" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.269279" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.359595" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-21T02:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-g779-vpj7-v6c4/GHSA-g779-vpj7-v6c4.json b/advisories/unreviewed/2024/06/GHSA-g779-vpj7-v6c4/GHSA-g779-vpj7-v6c4.json index 172cf3e850e..96ceca9077a 100644 --- a/advisories/unreviewed/2024/06/GHSA-g779-vpj7-v6c4/GHSA-g779-vpj7-v6c4.json +++ b/advisories/unreviewed/2024/06/GHSA-g779-vpj7-v6c4/GHSA-g779-vpj7-v6c4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-g779-vpj7-v6c4", - "modified": "2024-06-20T15:31:18Z", + "modified": "2024-06-21T03:30:33Z", "published": "2024-06-20T00:30:46Z", "aliases": [ "CVE-2024-6100" @@ -28,6 +28,10 @@ { "type": "WEB", "url": "https://issues.chromium.org/issues/344608204" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/06/GHSA-jhwr-fg7p-675f/GHSA-jhwr-fg7p-675f.json b/advisories/unreviewed/2024/06/GHSA-jhwr-fg7p-675f/GHSA-jhwr-fg7p-675f.json new file mode 100644 index 00000000000..a29524ecd0c --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-jhwr-fg7p-675f/GHSA-jhwr-fg7p-675f.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jhwr-fg7p-675f", + "modified": "2024-06-21T03:30:33Z", + "published": "2024-06-21T03:30:33Z", + "aliases": [ + "CVE-2023-3352" + ], + "details": "The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen or the Media Library.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3352" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3105107/wp-smushit/trunk/app/class-ajax.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dfbaa3e4-40c2-41d8-996c-232e27a04b73?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-21T02:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-m9v7-79rj-pq3w/GHSA-m9v7-79rj-pq3w.json b/advisories/unreviewed/2024/06/GHSA-m9v7-79rj-pq3w/GHSA-m9v7-79rj-pq3w.json new file mode 100644 index 00000000000..19eee055288 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-m9v7-79rj-pq3w/GHSA-m9v7-79rj-pq3w.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m9v7-79rj-pq3w", + "modified": "2024-06-21T03:30:33Z", + "published": "2024-06-21T03:30:33Z", + "aliases": [ + "CVE-2024-1639" + ], + "details": "The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey() and showAllLicenseKeys() functions in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, with admin dashboard access (contributors by default due to WooCommerce) to view arbitrary decrypted license keys. The functions contain a referrer nonce check. However, these can be retrieved via the dashboard through the \"license\" JS variable.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1639" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/license-manager-for-woocommerce/tags/3.0.5/includes/Controllers/License.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/92e444db-72d5-444f-811e-ade0bc097769?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-21T02:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-mhww-7h5r-9h8q/GHSA-mhww-7h5r-9h8q.json b/advisories/unreviewed/2024/06/GHSA-mhww-7h5r-9h8q/GHSA-mhww-7h5r-9h8q.json new file mode 100644 index 00000000000..462cdcd9be4 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-mhww-7h5r-9h8q/GHSA-mhww-7h5r-9h8q.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mhww-7h5r-9h8q", + "modified": "2024-06-21T03:30:33Z", + "published": "2024-06-21T03:30:33Z", + "aliases": [ + "CVE-2024-1955" + ], + "details": "The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warning_notices_settings' function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with contributor access and above, to modify the plugin's settings.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1955" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-hide-backed-notices/tags/1.3/admin/class-wp-hide-backed-notices-admin.php" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3104675%40wp-hide-backed-notices&new=3104675%40wp-hide-backed-notices&sfp_email=&sfph_mail=" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d4655236-7dfe-40ae-9d0c-6eacc59af13d?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-21T02:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-p7rm-v5xq-5pr9/GHSA-p7rm-v5xq-5pr9.json b/advisories/unreviewed/2024/06/GHSA-p7rm-v5xq-5pr9/GHSA-p7rm-v5xq-5pr9.json new file mode 100644 index 00000000000..b23ed474db3 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-p7rm-v5xq-5pr9/GHSA-p7rm-v5xq-5pr9.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p7rm-v5xq-5pr9", + "modified": "2024-06-21T03:30:33Z", + "published": "2024-06-21T03:30:33Z", + "aliases": [ + "CVE-2024-6218" + ], + "details": "A vulnerability, which was classified as critical, has been found in itsourcecode Vehicle Management System 1.0. Affected by this issue is some unknown functionality of the file busprofile.php. The manipulation of the argument busid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-269282 is the identifier assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6218" + }, + { + "type": "WEB", + "url": "https://github.com/HryspaHodor/CVE/issues/7" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.269282" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.269282" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.360697" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-21T02:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-ph5m-227m-fc5g/GHSA-ph5m-227m-fc5g.json b/advisories/unreviewed/2024/06/GHSA-ph5m-227m-fc5g/GHSA-ph5m-227m-fc5g.json index 1d1ebbf88e7..faab95d69bd 100644 --- a/advisories/unreviewed/2024/06/GHSA-ph5m-227m-fc5g/GHSA-ph5m-227m-fc5g.json +++ b/advisories/unreviewed/2024/06/GHSA-ph5m-227m-fc5g/GHSA-ph5m-227m-fc5g.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-ph5m-227m-fc5g", - "modified": "2024-06-20T15:31:18Z", + "modified": "2024-06-21T03:30:33Z", "published": "2024-06-20T00:30:47Z", "aliases": [ "CVE-2024-6103" @@ -28,6 +28,10 @@ { "type": "WEB", "url": "https://issues.chromium.org/issues/344639860" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/06/GHSA-rg42-f9ww-x3w7/GHSA-rg42-f9ww-x3w7.json b/advisories/unreviewed/2024/06/GHSA-rg42-f9ww-x3w7/GHSA-rg42-f9ww-x3w7.json index 5496821888f..32a81a77c19 100644 --- a/advisories/unreviewed/2024/06/GHSA-rg42-f9ww-x3w7/GHSA-rg42-f9ww-x3w7.json +++ b/advisories/unreviewed/2024/06/GHSA-rg42-f9ww-x3w7/GHSA-rg42-f9ww-x3w7.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-rg42-f9ww-x3w7", - "modified": "2024-06-20T15:31:18Z", + "modified": "2024-06-21T03:30:33Z", "published": "2024-06-20T00:30:46Z", "aliases": [ "CVE-2024-6101" @@ -28,6 +28,10 @@ { "type": "WEB", "url": "https://issues.chromium.org/issues/343748812" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6HYUEHZ35ZPY2EONVZCGO6LPT3AMLZCP" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/06/GHSA-rpr4-fpwh-9vfr/GHSA-rpr4-fpwh-9vfr.json b/advisories/unreviewed/2024/06/GHSA-rpr4-fpwh-9vfr/GHSA-rpr4-fpwh-9vfr.json new file mode 100644 index 00000000000..78f099c149a --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-rpr4-fpwh-9vfr/GHSA-rpr4-fpwh-9vfr.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rpr4-fpwh-9vfr", + "modified": "2024-06-21T03:30:33Z", + "published": "2024-06-21T03:30:33Z", + "aliases": [ + "CVE-2024-5503" + ], + "details": "The WP Blog Post Layouts plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.3. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5503" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-blog-post-layouts/trunk/includes/gutenberg.php#L883" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-blog-post-layouts/trunk/includes/gutenberg.php#L900" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-blog-post-layouts/trunk/includes/gutenberg.php#L917" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-blog-post-layouts/trunk/includes/src/grid/element.php#L1146" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-blog-post-layouts/trunk/includes/src/list/element.php#L1136" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/wp-blog-post-layouts/trunk/includes/src/masonry/element.php#L1134" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5205cc95-06d1-4bc6-a9ea-082df9566935?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-21T02:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-rwxj-58wx-7h6x/GHSA-rwxj-58wx-7h6x.json b/advisories/unreviewed/2024/06/GHSA-rwxj-58wx-7h6x/GHSA-rwxj-58wx-7h6x.json new file mode 100644 index 00000000000..ed6ec0433bd --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-rwxj-58wx-7h6x/GHSA-rwxj-58wx-7h6x.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rwxj-58wx-7h6x", + "modified": "2024-06-21T03:30:33Z", + "published": "2024-06-21T03:30:33Z", + "aliases": [ + "CVE-2024-6217" + ], + "details": "A vulnerability classified as critical was found in SourceCodester Food Ordering Management System 1.0. Affected by this vulnerability is an unknown functionality of the file user-router.php. The manipulation of the argument 1_verified leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-269281 was assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6217" + }, + { + "type": "WEB", + "url": "https://github.com/jadu101/CVE/blob/main/SourceCodester_Food_Ordering_Management_System_user_router_Sqli.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.269281" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.269281" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.359644" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-21T02:15:12Z" + } +} \ No newline at end of file