mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-rx7p-m6c3-777g GHSA-5m73-fvjx-xcxp GHSA-868x-mj3q-c3w4 GHSA-8fq9-7wwx-42v9 GHSA-9333-82cc-qj5r GHSA-9q5f-4c6v-g36c GHSA-c7gc-36xq-m84f GHSA-ggmq-9v8m-wpjv GHSA-p5mm-8cpw-hr23 GHSA-vcqg-q2pp-ch79
This commit is contained in:
advisory-database[bot]
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-rx7p-m6c3-777g",
|
||||
"modified": "2024-05-31T21:30:52Z",
|
||||
"modified": "2024-06-19T21:32:29Z",
|
||||
"published": "2024-05-31T21:30:52Z",
|
||||
"aliases": [
|
||||
"CVE-2024-5564"
|
||||
@@ -28,6 +28,10 @@
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2284122"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00011.html"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-5m73-fvjx-xcxp",
|
||||
"modified": "2024-06-19T21:32:31Z",
|
||||
"published": "2024-06-19T21:32:31Z",
|
||||
"aliases": [
|
||||
"CVE-2024-36678"
|
||||
],
|
||||
"details": "In the module \"Theme settings\" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36678"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.friendsofpresta.org/modules/2024/06/18/pk_themesettings.html"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-06-19T21:15:57Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-868x-mj3q-c3w4",
|
||||
"modified": "2024-06-19T21:32:30Z",
|
||||
"published": "2024-06-19T21:32:30Z",
|
||||
"aliases": [
|
||||
"CVE-2024-36677"
|
||||
],
|
||||
"details": "In the module \"Login as customer PRO\" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to each customer account of the Shop if the module is not installed OR if a secret accessible to administrator is stolen.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36677"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.friendsofpresta.org/modules/2024/06/18/loginascustomerpro.html"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-06-19T21:15:57Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-8fq9-7wwx-42v9",
|
||||
"modified": "2024-06-19T21:32:31Z",
|
||||
"published": "2024-06-19T21:32:31Z",
|
||||
"aliases": [
|
||||
"CVE-2024-36679"
|
||||
],
|
||||
"details": "In the module \"Module Live Chat Pro (All in One Messaging)\" (livechatpro) <=8.4.0, a guest can perform PHP Code injection. Due to a predictable token, the method `Lcp::saveTranslations()` suffer of a white writer that can inject PHP code into a PHP file.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36679"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.friendsofpresta.org/modules/2024/06/18/livechatpro.html"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-06-19T21:15:57Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-9333-82cc-qj5r",
|
||||
"modified": "2024-06-19T21:32:31Z",
|
||||
"published": "2024-06-19T21:32:31Z",
|
||||
"aliases": [
|
||||
"CVE-2024-36684"
|
||||
],
|
||||
"details": "In the module \"Custom links\" (pk_customlinks) <= 2.3 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The script ajax.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36684"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.friendsofpresta.org/modules/2024/06/18/pk_customlinks.html"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-06-19T21:15:57Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-9q5f-4c6v-g36c",
|
||||
"modified": "2024-06-19T21:32:31Z",
|
||||
"published": "2024-06-19T21:32:31Z",
|
||||
"aliases": [
|
||||
"CVE-2024-36680"
|
||||
],
|
||||
"details": "In the module \"Facebook\" (pkfacebook) <=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection. The ajax script facebookConnect.php have a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36680"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://security.friendsofpresta.org/modules/2024/06/18/pkfacebook.html"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-06-19T21:15:57Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-c7gc-36xq-m84f",
|
||||
"modified": "2024-06-19T21:32:29Z",
|
||||
"published": "2024-06-19T21:32:29Z",
|
||||
"aliases": [
|
||||
"CVE-2024-34993"
|
||||
],
|
||||
"details": "In the module \"Bulk Export products to Google Merchant-Google Shopping\" (bagoogleshopping) up to version 1.0.26 from Buy Addons for PrestaShop, a guest can perform SQL injection via`GenerateCategories::renderCategories().",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34993"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-06-18-bagoogleshopping.md"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-06-19T20:15:11Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-ggmq-9v8m-wpjv",
|
||||
"modified": "2024-06-19T21:32:30Z",
|
||||
"published": "2024-06-19T21:32:30Z",
|
||||
"aliases": [
|
||||
"CVE-2024-34994"
|
||||
],
|
||||
"details": "In the module \"Channable\" (channable) up to version 3.2.1 from Channable for PrestaShop, a guest can perform SQL injection via `ChannableFeedModuleFrontController::postProcess()`.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34994"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-06-18-channable.md"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-06-19T21:15:57Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-p5mm-8cpw-hr23",
|
||||
"modified": "2024-06-19T21:32:30Z",
|
||||
"published": "2024-06-19T21:32:30Z",
|
||||
"aliases": [
|
||||
"CVE-2024-33836"
|
||||
],
|
||||
"details": "In the module \"JA Marketplace\" (jamarketplace) up to version 9.0.1 from JA Module for PrestaShop, a guest can upload files with extensions .php. In version 6.X, the method `JmarketplaceproductModuleFrontController::init()` and in version 8.X, the method `JmarketplaceSellerproductModuleFrontController::init()` allow upload of .php files, which will lead to a critical vulnerability.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33836"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-06-18-jamarketplace.md"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-06-19T21:15:56Z"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-vcqg-q2pp-ch79",
|
||||
"modified": "2024-06-19T21:32:30Z",
|
||||
"published": "2024-06-19T21:32:30Z",
|
||||
"aliases": [
|
||||
"CVE-2024-34990"
|
||||
],
|
||||
"details": "In the module \"Help Desk - Customer Support Management System\" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files. Methods `HelpdeskHelpdeskModuleFrontController::submitTicket()` and `HelpdeskHelpdeskModuleFrontController::replyTicket()` allow upload of .php files on a predictable path for connected customers.",
|
||||
"severity": [
|
||||
|
||||
],
|
||||
"affected": [
|
||||
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34990"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-06-18-helpdesk.md"
|
||||
}
|
||||
],
|
||||
"database_specific": {
|
||||
"cwe_ids": [
|
||||
|
||||
],
|
||||
"severity": null,
|
||||
"github_reviewed": false,
|
||||
"github_reviewed_at": null,
|
||||
"nvd_published_at": "2024-06-19T21:15:57Z"
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user