From c3b2e90c990af9dabd26ce3ab7a05855329b87a3 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Wed, 3 Apr 2024 12:32:36 +0000 Subject: [PATCH] Publish Advisories GHSA-7387-h76h-9m29 GHSA-2g7p-7mvp-pw7m GHSA-94xq-wrrp-5jr6 GHSA-9rrq-j2f6-qpvg GHSA-cmmv-w3j8-5hm4 GHSA-gw4j-wq88-96mq GHSA-h2vw-qxx3-m3jv GHSA-mcgw-94j6-6g4q GHSA-mf4j-qfjr-8mhr GHSA-p587-g8pc-4qg6 GHSA-p73x-rpgm-3v56 GHSA-qc38-w33g-cp7m GHSA-rqhw-p5r2-7vq4 GHSA-vxrg-576c-83m9 GHSA-wq2g-ccx9-4w35 GHSA-wvfw-6rv6-rmwc GHSA-xjx3-c2f9-8m6p --- .../GHSA-7387-h76h-9m29.json | 11 +++- .../GHSA-2g7p-7mvp-pw7m.json | 38 ++++++++++++++ .../GHSA-94xq-wrrp-5jr6.json | 50 +++++++++++++++++++ .../GHSA-9rrq-j2f6-qpvg.json | 50 +++++++++++++++++++ .../GHSA-cmmv-w3j8-5hm4.json | 38 ++++++++++++++ .../GHSA-gw4j-wq88-96mq.json | 38 ++++++++++++++ .../GHSA-h2vw-qxx3-m3jv.json | 6 ++- .../GHSA-mcgw-94j6-6g4q.json | 6 ++- .../GHSA-mf4j-qfjr-8mhr.json | 50 +++++++++++++++++++ .../GHSA-p587-g8pc-4qg6.json | 50 +++++++++++++++++++ .../GHSA-p73x-rpgm-3v56.json | 39 +++++++++++++++ .../GHSA-qc38-w33g-cp7m.json | 42 ++++++++++++++++ .../GHSA-rqhw-p5r2-7vq4.json | 42 ++++++++++++++++ .../GHSA-vxrg-576c-83m9.json | 50 +++++++++++++++++++ .../GHSA-wq2g-ccx9-4w35.json | 38 ++++++++++++++ .../GHSA-wvfw-6rv6-rmwc.json | 38 ++++++++++++++ .../GHSA-xjx3-c2f9-8m6p.json | 42 ++++++++++++++++ 17 files changed, 624 insertions(+), 4 deletions(-) create mode 100644 advisories/unreviewed/2024/04/GHSA-2g7p-7mvp-pw7m/GHSA-2g7p-7mvp-pw7m.json create mode 100644 advisories/unreviewed/2024/04/GHSA-94xq-wrrp-5jr6/GHSA-94xq-wrrp-5jr6.json create mode 100644 advisories/unreviewed/2024/04/GHSA-9rrq-j2f6-qpvg/GHSA-9rrq-j2f6-qpvg.json create mode 100644 advisories/unreviewed/2024/04/GHSA-cmmv-w3j8-5hm4/GHSA-cmmv-w3j8-5hm4.json create mode 100644 advisories/unreviewed/2024/04/GHSA-gw4j-wq88-96mq/GHSA-gw4j-wq88-96mq.json create mode 100644 advisories/unreviewed/2024/04/GHSA-mf4j-qfjr-8mhr/GHSA-mf4j-qfjr-8mhr.json create mode 100644 advisories/unreviewed/2024/04/GHSA-p587-g8pc-4qg6/GHSA-p587-g8pc-4qg6.json create mode 100644 advisories/unreviewed/2024/04/GHSA-p73x-rpgm-3v56/GHSA-p73x-rpgm-3v56.json create mode 100644 advisories/unreviewed/2024/04/GHSA-qc38-w33g-cp7m/GHSA-qc38-w33g-cp7m.json create mode 100644 advisories/unreviewed/2024/04/GHSA-rqhw-p5r2-7vq4/GHSA-rqhw-p5r2-7vq4.json create mode 100644 advisories/unreviewed/2024/04/GHSA-vxrg-576c-83m9/GHSA-vxrg-576c-83m9.json create mode 100644 advisories/unreviewed/2024/04/GHSA-wq2g-ccx9-4w35/GHSA-wq2g-ccx9-4w35.json create mode 100644 advisories/unreviewed/2024/04/GHSA-wvfw-6rv6-rmwc/GHSA-wvfw-6rv6-rmwc.json create mode 100644 advisories/unreviewed/2024/04/GHSA-xjx3-c2f9-8m6p/GHSA-xjx3-c2f9-8m6p.json diff --git a/advisories/unreviewed/2022/05/GHSA-7387-h76h-9m29/GHSA-7387-h76h-9m29.json b/advisories/unreviewed/2022/05/GHSA-7387-h76h-9m29/GHSA-7387-h76h-9m29.json index 37991aff3d1..c92e4ac043e 100644 --- a/advisories/unreviewed/2022/05/GHSA-7387-h76h-9m29/GHSA-7387-h76h-9m29.json +++ b/advisories/unreviewed/2022/05/GHSA-7387-h76h-9m29/GHSA-7387-h76h-9m29.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-7387-h76h-9m29", - "modified": "2022-05-24T17:22:04Z", + "modified": "2024-04-03T12:31:05Z", "published": "2022-05-24T17:22:04Z", "aliases": [ "CVE-2020-15368" ], "details": "AsrDrv103.sys in the ASRock RGB Driver does not properly restrict access from user space, as demonstrated by triggering a triple fault via a request to zero CR3.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + } ], "affected": [ @@ -21,6 +24,10 @@ { "type": "WEB", "url": "https://codetector.org/post/asrock_rgb_driver" + }, + { + "type": "WEB", + "url": "https://github.com/stong/CVE-2020-15368?tab=readme-ov-file" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/04/GHSA-2g7p-7mvp-pw7m/GHSA-2g7p-7mvp-pw7m.json b/advisories/unreviewed/2024/04/GHSA-2g7p-7mvp-pw7m/GHSA-2g7p-7mvp-pw7m.json new file mode 100644 index 00000000000..cee08aa2178 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-2g7p-7mvp-pw7m/GHSA-2g7p-7mvp-pw7m.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2g7p-7mvp-pw7m", + "modified": "2024-04-03T12:31:06Z", + "published": "2024-04-03T12:31:06Z", + "aliases": [ + "CVE-2024-27191" + ], + "details": "Improper Control of Generation of Code ('Code Injection') vulnerability in Inpersttion Slivery Extender allows Code Injection.This issue affects Slivery Extender: from n/a through 1.0.2.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27191" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/slivery-extender/wordpress-slivery-extender-plugin-1-0-2-remote-code-execution-rce-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-03T12:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-94xq-wrrp-5jr6/GHSA-94xq-wrrp-5jr6.json b/advisories/unreviewed/2024/04/GHSA-94xq-wrrp-5jr6/GHSA-94xq-wrrp-5jr6.json new file mode 100644 index 00000000000..c718838b240 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-94xq-wrrp-5jr6/GHSA-94xq-wrrp-5jr6.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-94xq-wrrp-5jr6", + "modified": "2024-04-03T12:31:06Z", + "published": "2024-04-03T12:31:06Z", + "aliases": [ + "CVE-2024-3255" + ], + "details": "A vulnerability, which was classified as critical, was found in SourceCodester Internship Portal Management System 1.0. Affected is an unknown function of the file admin/edit_admin_query.php. The manipulation of the argument username/password/name/admin_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259104.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3255" + }, + { + "type": "WEB", + "url": "https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-05" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.259104" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.259104" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.309216" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-03T12:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-9rrq-j2f6-qpvg/GHSA-9rrq-j2f6-qpvg.json b/advisories/unreviewed/2024/04/GHSA-9rrq-j2f6-qpvg/GHSA-9rrq-j2f6-qpvg.json new file mode 100644 index 00000000000..3c2cd5ae6d0 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-9rrq-j2f6-qpvg/GHSA-9rrq-j2f6-qpvg.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9rrq-j2f6-qpvg", + "modified": "2024-04-03T12:31:06Z", + "published": "2024-04-03T12:31:06Z", + "aliases": [ + "CVE-2024-3253" + ], + "details": "A vulnerability classified as critical was found in SourceCodester Internship Portal Management System 1.0. This vulnerability affects unknown code of the file admin/add_admin.php. The manipulation of the argument name/username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259102 is the identifier assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3253" + }, + { + "type": "WEB", + "url": "https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-03" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.259102" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.259102" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.309214" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-03T11:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-cmmv-w3j8-5hm4/GHSA-cmmv-w3j8-5hm4.json b/advisories/unreviewed/2024/04/GHSA-cmmv-w3j8-5hm4/GHSA-cmmv-w3j8-5hm4.json new file mode 100644 index 00000000000..293c06e923c --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-cmmv-w3j8-5hm4/GHSA-cmmv-w3j8-5hm4.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cmmv-w3j8-5hm4", + "modified": "2024-04-03T12:31:06Z", + "published": "2024-04-03T12:31:06Z", + "aliases": [ + "CVE-2024-25918" + ], + "details": "Unrestricted Upload of File with Dangerous Type vulnerability in InstaWP Team InstaWP Connect allows Code Injection.This issue affects InstaWP Connect: from n/a through 0.1.0.8.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25918" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/instawp-connect/wordpress-instawp-connect-plugin-0-1-0-8-remote-code-execution-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-03T12:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-gw4j-wq88-96mq/GHSA-gw4j-wq88-96mq.json b/advisories/unreviewed/2024/04/GHSA-gw4j-wq88-96mq/GHSA-gw4j-wq88-96mq.json new file mode 100644 index 00000000000..756ccd3eec8 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-gw4j-wq88-96mq/GHSA-gw4j-wq88-96mq.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gw4j-wq88-96mq", + "modified": "2024-04-03T12:31:06Z", + "published": "2024-04-03T12:31:06Z", + "aliases": [ + "CVE-2024-27951" + ], + "details": "Unrestricted Upload of File with Dangerous Type vulnerability in Themeisle Multiple Page Generator Plugin – MPG allows Upload a Web Shell to a Web Server.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.0.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27951" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/multiple-pages-generator-by-porthas/wordpress-multiple-page-generator-plugin-3-4-0-remote-code-execution-rce-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-03T12:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-h2vw-qxx3-m3jv/GHSA-h2vw-qxx3-m3jv.json b/advisories/unreviewed/2024/04/GHSA-h2vw-qxx3-m3jv/GHSA-h2vw-qxx3-m3jv.json index ee1f7391d47..f64c7883446 100644 --- a/advisories/unreviewed/2024/04/GHSA-h2vw-qxx3-m3jv/GHSA-h2vw-qxx3-m3jv.json +++ b/advisories/unreviewed/2024/04/GHSA-h2vw-qxx3-m3jv/GHSA-h2vw-qxx3-m3jv.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-h2vw-qxx3-m3jv", - "modified": "2024-04-02T00:30:47Z", + "modified": "2024-04-03T12:31:05Z", "published": "2024-04-02T00:30:47Z", "aliases": [ "CVE-2024-3141" @@ -21,6 +21,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3141" }, + { + "type": "WEB", + "url": "https://docs.clavister.com/repo/cos-core-release-notes/doc/index.html#d0e2260" + }, { "type": "WEB", "url": "https://github.com/strik3r0x1/Vulns/blob/main/Clavister_E80-RXSS.md" diff --git a/advisories/unreviewed/2024/04/GHSA-mcgw-94j6-6g4q/GHSA-mcgw-94j6-6g4q.json b/advisories/unreviewed/2024/04/GHSA-mcgw-94j6-6g4q/GHSA-mcgw-94j6-6g4q.json index a39fe0a96a4..2f281a3e888 100644 --- a/advisories/unreviewed/2024/04/GHSA-mcgw-94j6-6g4q/GHSA-mcgw-94j6-6g4q.json +++ b/advisories/unreviewed/2024/04/GHSA-mcgw-94j6-6g4q/GHSA-mcgw-94j6-6g4q.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-mcgw-94j6-6g4q", - "modified": "2024-04-02T03:30:43Z", + "modified": "2024-04-03T12:31:06Z", "published": "2024-04-02T03:30:43Z", "aliases": [ "CVE-2024-3142" @@ -21,6 +21,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3142" }, + { + "type": "WEB", + "url": "https://docs.clavister.com/repo/cos-core-release-notes/doc/index.html#d0e2260" + }, { "type": "WEB", "url": "https://github.com/strik3r0x1/Vulns/blob/main/CSRF_Clavister-E80,E10.md" diff --git a/advisories/unreviewed/2024/04/GHSA-mf4j-qfjr-8mhr/GHSA-mf4j-qfjr-8mhr.json b/advisories/unreviewed/2024/04/GHSA-mf4j-qfjr-8mhr/GHSA-mf4j-qfjr-8mhr.json new file mode 100644 index 00000000000..2ddf7d6f1da --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-mf4j-qfjr-8mhr/GHSA-mf4j-qfjr-8mhr.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mf4j-qfjr-8mhr", + "modified": "2024-04-03T12:31:06Z", + "published": "2024-04-03T12:31:06Z", + "aliases": [ + "CVE-2024-3251" + ], + "details": "A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/?page=borrow/view_borrow. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259100.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3251" + }, + { + "type": "WEB", + "url": "https://github.com/0xAlmighty/Vulnerability-Research/blob/main/SourceCodester/CLMS/SourceCodester-CLMS-SQLi.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.259100" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.259100" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.309091" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-03T10:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-p587-g8pc-4qg6/GHSA-p587-g8pc-4qg6.json b/advisories/unreviewed/2024/04/GHSA-p587-g8pc-4qg6/GHSA-p587-g8pc-4qg6.json new file mode 100644 index 00000000000..889a72b4200 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-p587-g8pc-4qg6/GHSA-p587-g8pc-4qg6.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p587-g8pc-4qg6", + "modified": "2024-04-03T12:31:06Z", + "published": "2024-04-03T12:31:06Z", + "aliases": [ + "CVE-2024-3252" + ], + "details": "A vulnerability classified as critical has been found in SourceCodester Internship Portal Management System 1.0. This affects an unknown part of the file admin/check_admin.php. The manipulation of the argument username/password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259101 was assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3252" + }, + { + "type": "WEB", + "url": "https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-01" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.259101" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.259101" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.309212" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-03T10:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-p73x-rpgm-3v56/GHSA-p73x-rpgm-3v56.json b/advisories/unreviewed/2024/04/GHSA-p73x-rpgm-3v56/GHSA-p73x-rpgm-3v56.json new file mode 100644 index 00000000000..7747c20dc22 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-p73x-rpgm-3v56/GHSA-p73x-rpgm-3v56.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p73x-rpgm-3v56", + "modified": "2024-04-03T12:31:06Z", + "published": "2024-04-03T12:31:06Z", + "aliases": [ + "CVE-2024-29477" + ], + "details": "Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29477" + }, + { + "type": "WEB", + "url": "https://github.com/alexbsec/CVEs/blob/master/2024/CVE-2024-29477.md" + }, + { + "type": "WEB", + "url": "http://dolibarr.com" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-03T12:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-qc38-w33g-cp7m/GHSA-qc38-w33g-cp7m.json b/advisories/unreviewed/2024/04/GHSA-qc38-w33g-cp7m/GHSA-qc38-w33g-cp7m.json new file mode 100644 index 00000000000..79c310b5fcf --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-qc38-w33g-cp7m/GHSA-qc38-w33g-cp7m.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qc38-w33g-cp7m", + "modified": "2024-04-03T12:31:06Z", + "published": "2024-04-03T12:31:06Z", + "aliases": [ + "CVE-2024-28782" + ], + "details": "IBM QRadar Suite Software 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 285698.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28782" + }, + { + "type": "WEB", + "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/285698" + }, + { + "type": "WEB", + "url": "https://www.ibm.com/support/pages/node/7145683" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-256" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-03T12:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-rqhw-p5r2-7vq4/GHSA-rqhw-p5r2-7vq4.json b/advisories/unreviewed/2024/04/GHSA-rqhw-p5r2-7vq4/GHSA-rqhw-p5r2-7vq4.json new file mode 100644 index 00000000000..0a303d3f04d --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-rqhw-p5r2-7vq4/GHSA-rqhw-p5r2-7vq4.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rqhw-p5r2-7vq4", + "modified": "2024-04-03T12:31:06Z", + "published": "2024-04-03T12:31:06Z", + "aliases": [ + "CVE-2024-31390" + ], + "details": "Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Breakdance allows Code Injection.This issue affects Breakdance: from n/a through 1.7.0.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31390" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/breakdance/wordpress-breakdance-plugin-1-7-0-authenticated-remote-code-execution-rce-vulnerability?_s_id=cve" + }, + { + "type": "WEB", + "url": "https://snicco.io/vulnerability-disclosure/breakdance/client-mode-remote-code-execution-breakdance-1-7-0?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-03T12:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-vxrg-576c-83m9/GHSA-vxrg-576c-83m9.json b/advisories/unreviewed/2024/04/GHSA-vxrg-576c-83m9/GHSA-vxrg-576c-83m9.json new file mode 100644 index 00000000000..b1a26f96579 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-vxrg-576c-83m9/GHSA-vxrg-576c-83m9.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vxrg-576c-83m9", + "modified": "2024-04-03T12:31:06Z", + "published": "2024-04-03T12:31:06Z", + "aliases": [ + "CVE-2024-3254" + ], + "details": "A vulnerability, which was classified as critical, has been found in SourceCodester Internship Portal Management System 1.0. This issue affects some unknown processing of the file admin/edit_admin.php. The manipulation of the argument admin_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259103.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3254" + }, + { + "type": "WEB", + "url": "https://github.com/thisissuperann/Vul/blob/main/Internship-Portal-Management-System-04" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.259103" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.259103" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.309215" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-03T12:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-wq2g-ccx9-4w35/GHSA-wq2g-ccx9-4w35.json b/advisories/unreviewed/2024/04/GHSA-wq2g-ccx9-4w35/GHSA-wq2g-ccx9-4w35.json new file mode 100644 index 00000000000..20bf52dff52 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-wq2g-ccx9-4w35/GHSA-wq2g-ccx9-4w35.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wq2g-ccx9-4w35", + "modified": "2024-04-03T12:31:06Z", + "published": "2024-04-03T12:31:06Z", + "aliases": [ + "CVE-2024-0172" + ], + "details": "Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability. An unauthenticated local attacker could potentially exploit this vulnerability, leading to privilege escalation.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0172" + }, + { + "type": "WEB", + "url": "https://www.dell.com/support/kbdoc/en-us/000223727/dsa-2024-035-security-update-for-dell-poweredge-server-bios-for-an-improper-privilege-management-security-vulnerability" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-03T10:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-wvfw-6rv6-rmwc/GHSA-wvfw-6rv6-rmwc.json b/advisories/unreviewed/2024/04/GHSA-wvfw-6rv6-rmwc/GHSA-wvfw-6rv6-rmwc.json new file mode 100644 index 00000000000..bd2051f1e95 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-wvfw-6rv6-rmwc/GHSA-wvfw-6rv6-rmwc.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wvfw-6rv6-rmwc", + "modified": "2024-04-03T12:31:06Z", + "published": "2024-04-03T12:31:06Z", + "aliases": [ + "CVE-2024-27972" + ], + "details": "Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Very Good Plugins WP Fusion Lite allows Command Injection.This issue affects WP Fusion Lite: from n/a through 3.41.24.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27972" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/wp-fusion-lite/wordpress-wp-fusion-lite-plugin-3-41-24-remote-code-execution-rce-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-77" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-03T12:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-xjx3-c2f9-8m6p/GHSA-xjx3-c2f9-8m6p.json b/advisories/unreviewed/2024/04/GHSA-xjx3-c2f9-8m6p/GHSA-xjx3-c2f9-8m6p.json new file mode 100644 index 00000000000..bdf792b0a6d --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-xjx3-c2f9-8m6p/GHSA-xjx3-c2f9-8m6p.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xjx3-c2f9-8m6p", + "modified": "2024-04-03T12:31:06Z", + "published": "2024-04-03T12:31:06Z", + "aliases": [ + "CVE-2024-31380" + ], + "details": "Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Oxygen Builder allows Code Injection.This issue affects Oxygen Builder: from n/a through 4.8.1.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31380" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/oxygen/wordpress-oxygen-plugin-4-8-1-auth-remote-code-execution-rce-vulnerability?_s_id=cve" + }, + { + "type": "WEB", + "url": "https://snicco.io/vulnerability-disclosure/oxygen/client-control-remote-code-execution-oxygen-4-8-1?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-03T12:15:13Z" + } +} \ No newline at end of file