From c7b89260db4f33794376dac69cef56ef772d80a7 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 23 Aug 2024 00:33:03 +0000 Subject: [PATCH] Publish Advisories GHSA-gqv6-f424-3g7h GHSA-jj3x-6fjg-wcr7 GHSA-mxmg-v768-hh7w GHSA-96p3-v9fq-xhx4 GHSA-5rv7-j5ch-7h56 GHSA-c895-393j-x8fr GHSA-gc66-2jq6-66c6 GHSA-hxqp-3c5h-j6j8 GHSA-jm68-j5fq-xhw2 GHSA-mwp4-784j-f836 GHSA-q42w-3m49-jxcj GHSA-rj5f-gcgp-6867 GHSA-rvqr-jw83-fp2r GHSA-whw7-wrpx-m3gw --- .../GHSA-gqv6-f424-3g7h.json | 11 ++-- .../GHSA-jj3x-6fjg-wcr7.json | 11 ++-- .../GHSA-mxmg-v768-hh7w.json | 11 ++-- .../GHSA-96p3-v9fq-xhx4.json | 11 ++-- .../GHSA-5rv7-j5ch-7h56.json | 58 +++++++++++++++++++ .../GHSA-c895-393j-x8fr.json | 58 +++++++++++++++++++ .../GHSA-gc66-2jq6-66c6.json | 11 ++-- .../GHSA-hxqp-3c5h-j6j8.json | 38 ++++++++++++ .../GHSA-jm68-j5fq-xhw2.json | 38 ++++++++++++ .../GHSA-mwp4-784j-f836.json | 58 +++++++++++++++++++ .../GHSA-q42w-3m49-jxcj.json | 38 ++++++++++++ .../GHSA-rj5f-gcgp-6867.json | 58 +++++++++++++++++++ .../GHSA-rvqr-jw83-fp2r.json | 58 +++++++++++++++++++ .../GHSA-whw7-wrpx-m3gw.json | 58 +++++++++++++++++++ 14 files changed, 497 insertions(+), 20 deletions(-) create mode 100644 advisories/unreviewed/2024/08/GHSA-5rv7-j5ch-7h56/GHSA-5rv7-j5ch-7h56.json create mode 100644 advisories/unreviewed/2024/08/GHSA-c895-393j-x8fr/GHSA-c895-393j-x8fr.json create mode 100644 advisories/unreviewed/2024/08/GHSA-hxqp-3c5h-j6j8/GHSA-hxqp-3c5h-j6j8.json create mode 100644 advisories/unreviewed/2024/08/GHSA-jm68-j5fq-xhw2/GHSA-jm68-j5fq-xhw2.json create mode 100644 advisories/unreviewed/2024/08/GHSA-mwp4-784j-f836/GHSA-mwp4-784j-f836.json create mode 100644 advisories/unreviewed/2024/08/GHSA-q42w-3m49-jxcj/GHSA-q42w-3m49-jxcj.json create mode 100644 advisories/unreviewed/2024/08/GHSA-rj5f-gcgp-6867/GHSA-rj5f-gcgp-6867.json create mode 100644 advisories/unreviewed/2024/08/GHSA-rvqr-jw83-fp2r/GHSA-rvqr-jw83-fp2r.json create mode 100644 advisories/unreviewed/2024/08/GHSA-whw7-wrpx-m3gw/GHSA-whw7-wrpx-m3gw.json diff --git a/advisories/unreviewed/2024/02/GHSA-gqv6-f424-3g7h/GHSA-gqv6-f424-3g7h.json b/advisories/unreviewed/2024/02/GHSA-gqv6-f424-3g7h/GHSA-gqv6-f424-3g7h.json index 195ebe0bd13..85041894b4f 100644 --- a/advisories/unreviewed/2024/02/GHSA-gqv6-f424-3g7h/GHSA-gqv6-f424-3g7h.json +++ b/advisories/unreviewed/2024/02/GHSA-gqv6-f424-3g7h/GHSA-gqv6-f424-3g7h.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-gqv6-f424-3g7h", - "modified": "2024-02-16T09:30:25Z", + "modified": "2024-08-23T00:31:37Z", "published": "2024-02-16T09:30:25Z", "aliases": [ "CVE-2023-51931" ], "details": "An issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-20" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-02-16T09:15:08Z" diff --git a/advisories/unreviewed/2024/03/GHSA-jj3x-6fjg-wcr7/GHSA-jj3x-6fjg-wcr7.json b/advisories/unreviewed/2024/03/GHSA-jj3x-6fjg-wcr7/GHSA-jj3x-6fjg-wcr7.json index 6e36acdfe34..582c284c77d 100644 --- a/advisories/unreviewed/2024/03/GHSA-jj3x-6fjg-wcr7/GHSA-jj3x-6fjg-wcr7.json +++ b/advisories/unreviewed/2024/03/GHSA-jj3x-6fjg-wcr7/GHSA-jj3x-6fjg-wcr7.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-jj3x-6fjg-wcr7", - "modified": "2024-03-14T06:32:00Z", + "modified": "2024-08-23T00:31:38Z", "published": "2024-03-14T06:32:00Z", "aliases": [ "CVE-2024-28390" ], "details": "An issue in Advanced Plugins ultimateimagetool module for PrestaShop before v.2.2.01, allows a remote attacker to escalate privileges and obtain sensitive information via Improper Access Control.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-284" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-14T04:15:09Z" diff --git a/advisories/unreviewed/2024/03/GHSA-mxmg-v768-hh7w/GHSA-mxmg-v768-hh7w.json b/advisories/unreviewed/2024/03/GHSA-mxmg-v768-hh7w/GHSA-mxmg-v768-hh7w.json index 9fc194ed913..de8006cfc18 100644 --- a/advisories/unreviewed/2024/03/GHSA-mxmg-v768-hh7w/GHSA-mxmg-v768-hh7w.json +++ b/advisories/unreviewed/2024/03/GHSA-mxmg-v768-hh7w/GHSA-mxmg-v768-hh7w.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-mxmg-v768-hh7w", - "modified": "2024-03-25T09:32:35Z", + "modified": "2024-08-23T00:31:38Z", "published": "2024-03-25T09:32:35Z", "aliases": [ "CVE-2024-30187" ], "details": "Anope before 2.0.15 does not prevent resetting the password of a suspended account.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-281" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-03-25T08:15:36Z" diff --git a/advisories/unreviewed/2024/04/GHSA-96p3-v9fq-xhx4/GHSA-96p3-v9fq-xhx4.json b/advisories/unreviewed/2024/04/GHSA-96p3-v9fq-xhx4/GHSA-96p3-v9fq-xhx4.json index e48469c3478..e371e353dc2 100644 --- a/advisories/unreviewed/2024/04/GHSA-96p3-v9fq-xhx4/GHSA-96p3-v9fq-xhx4.json +++ b/advisories/unreviewed/2024/04/GHSA-96p3-v9fq-xhx4/GHSA-96p3-v9fq-xhx4.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-96p3-v9fq-xhx4", - "modified": "2024-04-15T18:30:51Z", + "modified": "2024-08-23T00:31:39Z", "published": "2024-04-15T18:30:51Z", "aliases": [ "CVE-2024-22014" ], "details": "An issue discovered in 360 Total Security Antivirus through 11.0.0.1061 for Windows allows attackers to gain escalated privileges via Symbolic Link Follow to Arbitrary File Delete.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-61" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-04-15T18:15:10Z" diff --git a/advisories/unreviewed/2024/08/GHSA-5rv7-j5ch-7h56/GHSA-5rv7-j5ch-7h56.json b/advisories/unreviewed/2024/08/GHSA-5rv7-j5ch-7h56/GHSA-5rv7-j5ch-7h56.json new file mode 100644 index 00000000000..fa0883880b1 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-5rv7-j5ch-7h56/GHSA-5rv7-j5ch-7h56.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5rv7-j5ch-7h56", + "modified": "2024-08-23T00:31:39Z", + "published": "2024-08-23T00:31:39Z", + "aliases": [ + "CVE-2024-8081" + ], + "details": "A vulnerability classified as critical was found in itsourcecode Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of the file login.php. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8081" + }, + { + "type": "WEB", + "url": "https://github.com/ppp-src/ha/issues/6" + }, + { + "type": "WEB", + "url": "https://itsourcecode.com" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.275563" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.275563" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.396110" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-22T22:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-c895-393j-x8fr/GHSA-c895-393j-x8fr.json b/advisories/unreviewed/2024/08/GHSA-c895-393j-x8fr/GHSA-c895-393j-x8fr.json new file mode 100644 index 00000000000..a16ee79d4ce --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-c895-393j-x8fr/GHSA-c895-393j-x8fr.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c895-393j-x8fr", + "modified": "2024-08-23T00:31:39Z", + "published": "2024-08-23T00:31:39Z", + "aliases": [ + "CVE-2024-8083" + ], + "details": "A vulnerability, which was classified as critical, has been found in SourceCodester Online Computer and Laptop Store 1.0. Affected by this issue is some unknown functionality of the file /php-ocls/classes/Master.php?f=pay_order. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8083" + }, + { + "type": "WEB", + "url": "https://github.com/0xffaaa/cve/blob/main/php-ocls-Arbitrary%20Sqli.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.275564" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.275564" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.396315" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-22T22:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-gc66-2jq6-66c6/GHSA-gc66-2jq6-66c6.json b/advisories/unreviewed/2024/08/GHSA-gc66-2jq6-66c6/GHSA-gc66-2jq6-66c6.json index d7bb0e38e57..4ca8ce7f773 100644 --- a/advisories/unreviewed/2024/08/GHSA-gc66-2jq6-66c6/GHSA-gc66-2jq6-66c6.json +++ b/advisories/unreviewed/2024/08/GHSA-gc66-2jq6-66c6/GHSA-gc66-2jq6-66c6.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-gc66-2jq6-66c6", - "modified": "2024-08-22T18:31:22Z", + "modified": "2024-08-23T00:31:39Z", "published": "2024-08-22T18:31:22Z", "aliases": [ "CVE-2024-45191" ], "details": "An issue was discovered in Matrix libolm (aka Olm) through 3.2.16. The AES implementation is vulnerable to cache-timing attacks due to use of S-boxes. This is related to software that uses a lookup table for the SubWord step. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -37,9 +40,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-208" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-08-22T16:15:10Z" diff --git a/advisories/unreviewed/2024/08/GHSA-hxqp-3c5h-j6j8/GHSA-hxqp-3c5h-j6j8.json b/advisories/unreviewed/2024/08/GHSA-hxqp-3c5h-j6j8/GHSA-hxqp-3c5h-j6j8.json new file mode 100644 index 00000000000..d4e6ae5b5dd --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-hxqp-3c5h-j6j8/GHSA-hxqp-3c5h-j6j8.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hxqp-3c5h-j6j8", + "modified": "2024-08-23T00:31:39Z", + "published": "2024-08-23T00:31:39Z", + "aliases": [ + "CVE-2024-38210" + ], + "details": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38210" + }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38210" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-22T23:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-jm68-j5fq-xhw2/GHSA-jm68-j5fq-xhw2.json b/advisories/unreviewed/2024/08/GHSA-jm68-j5fq-xhw2/GHSA-jm68-j5fq-xhw2.json new file mode 100644 index 00000000000..80026644263 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-jm68-j5fq-xhw2/GHSA-jm68-j5fq-xhw2.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jm68-j5fq-xhw2", + "modified": "2024-08-23T00:31:39Z", + "published": "2024-08-23T00:31:39Z", + "aliases": [ + "CVE-2024-38208" + ], + "details": "Microsoft Edge for Android Spoofing Vulnerability", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38208" + }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38208" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-22T23:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-mwp4-784j-f836/GHSA-mwp4-784j-f836.json b/advisories/unreviewed/2024/08/GHSA-mwp4-784j-f836/GHSA-mwp4-784j-f836.json new file mode 100644 index 00000000000..10364caf421 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-mwp4-784j-f836/GHSA-mwp4-784j-f836.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mwp4-784j-f836", + "modified": "2024-08-23T00:31:39Z", + "published": "2024-08-23T00:31:39Z", + "aliases": [ + "CVE-2024-8087" + ], + "details": "A vulnerability was found in SourceCodester E-Commerce System 1.0 and classified as critical. This issue affects some unknown processing of the file /ecommerce/popup_Item.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8087" + }, + { + "type": "WEB", + "url": "https://github.com/0xffaaa/cve/blob/main/ecommerce-Unauthorized%20sql%20union%20injection.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.275567" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.275567" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.396321" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-22T23:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-q42w-3m49-jxcj/GHSA-q42w-3m49-jxcj.json b/advisories/unreviewed/2024/08/GHSA-q42w-3m49-jxcj/GHSA-q42w-3m49-jxcj.json new file mode 100644 index 00000000000..b2bad06a4bb --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-q42w-3m49-jxcj/GHSA-q42w-3m49-jxcj.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q42w-3m49-jxcj", + "modified": "2024-08-23T00:31:39Z", + "published": "2024-08-23T00:31:39Z", + "aliases": [ + "CVE-2024-38209" + ], + "details": "Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38209" + }, + { + "type": "WEB", + "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38209" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-22T23:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-rj5f-gcgp-6867/GHSA-rj5f-gcgp-6867.json b/advisories/unreviewed/2024/08/GHSA-rj5f-gcgp-6867/GHSA-rj5f-gcgp-6867.json new file mode 100644 index 00000000000..9323c8689e7 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-rj5f-gcgp-6867/GHSA-rj5f-gcgp-6867.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rj5f-gcgp-6867", + "modified": "2024-08-23T00:31:39Z", + "published": "2024-08-23T00:31:39Z", + "aliases": [ + "CVE-2024-8084" + ], + "details": "A vulnerability, which was classified as problematic, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the file /php-ocls/classes/SystemSettings.php?f=update_settings of the component Setting Handler. The manipulation of the argument System Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8084" + }, + { + "type": "WEB", + "url": "https://github.com/0xffaaa/cve/blob/main/php-ocls-Arbitrary%20Stored%20Cross-Site%20Scripting(XSS).md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.275565" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.275565" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.396318" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-22T22:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-rvqr-jw83-fp2r/GHSA-rvqr-jw83-fp2r.json b/advisories/unreviewed/2024/08/GHSA-rvqr-jw83-fp2r/GHSA-rvqr-jw83-fp2r.json new file mode 100644 index 00000000000..9993b9bdba9 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-rvqr-jw83-fp2r/GHSA-rvqr-jw83-fp2r.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rvqr-jw83-fp2r", + "modified": "2024-08-23T00:31:40Z", + "published": "2024-08-23T00:31:39Z", + "aliases": [ + "CVE-2024-8089" + ], + "details": "A vulnerability was found in SourceCodester E-Commerce System 1.0. It has been classified as critical. Affected is an unknown function of the file /ecommerce/admin/products/controller.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8089" + }, + { + "type": "WEB", + "url": "https://github.com/0xffaaa/cve/blob/main/ecommerce-Unauthorized%20arbitrary%20file%20upload%20vulnerability.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.275568" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.275568" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.396324" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-23T00:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/08/GHSA-whw7-wrpx-m3gw/GHSA-whw7-wrpx-m3gw.json b/advisories/unreviewed/2024/08/GHSA-whw7-wrpx-m3gw/GHSA-whw7-wrpx-m3gw.json new file mode 100644 index 00000000000..1fa76420fc5 --- /dev/null +++ b/advisories/unreviewed/2024/08/GHSA-whw7-wrpx-m3gw/GHSA-whw7-wrpx-m3gw.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-whw7-wrpx-m3gw", + "modified": "2024-08-23T00:31:40Z", + "published": "2024-08-23T00:31:39Z", + "aliases": [ + "CVE-2024-8086" + ], + "details": "A vulnerability has been found in SourceCodester E-Commerce System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ecommerce/admin/login.php of the component Admin Login. The manipulation of the argument user_email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8086" + }, + { + "type": "WEB", + "url": "https://github.com/0xffaaa/cve/blob/main/ecommerce-Universal%20password%20bypasses%20login%20verification.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.275566" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.275566" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.396320" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-08-22T23:15:08Z" + } +} \ No newline at end of file