netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-3p4x-grpm-xw58
GHSA-529f-v746-9vhc
GHSA-6889-wccr-m7x3
GHSA-96qm-hwhp-2rm8
GHSA-99gj-25m6-38xr
GHSA-f7wm-449v-gc59
GHSA-g9vh-rmj6-m6r2
GHSA-gqh6-f673-ccgc
GHSA-xj8x-rm7w-xfh4
This commit is contained in:
advisory-database[bot]
2024-06-06 12:32:26 +00:00
parent d04ea08d16
commit d05aaeddf6
9 changed files with 389 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/06/GHSA-3p4x-grpm-xw58/GHSA-3p4x-grpm-xw58.json
+46
View File
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3p4x-grpm-xw58",
"modified": "2024-06-06T12:30:36Z",
"published": "2024-06-06T12:30:36Z",
"aliases": [
"CVE-2024-5657"
],
"details": "The CraftCMS plugin Two-Factor Authentication in versions 3.3.1, 3.3.2 and 3.3.3 discloses the password hash of the currently authenticated user after submitting a valid TOTP.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5657"
},
{
"type": "WEB",
"url": "https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4"
},
{
"type": "WEB",
"url": "https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-01_CraftCMS_Plugin_Two-Factor_Authentication_Password_Hash_Disclosure"
},
{
"type": "WEB",
"url": "https://plugins.craftcms.com/two-factor-authentication?craft4"
}
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-06T11:15:49Z"
}
}
advisories/unreviewed/2024/06/GHSA-529f-v746-9vhc/GHSA-529f-v746-9vhc.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-529f-v746-9vhc",
"modified": "2024-06-06T12:30:36Z",
"published": "2024-06-06T12:30:36Z",
"aliases": [
"CVE-2024-5259"
],
"details": "The MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hover_animation’ parameter in all versions up to, and including, 4.1.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5259"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/dc-woocommerce-multi-vendor/trunk/packages/mvx-elementor/widgets/class-mvx-widget-storesocial.php#L150"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3097002"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/dc-woocommerce-multi-vendor/#developers"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/59a349f2-048d-49a5-92ea-c19f1d1cd45e?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-06T10:15:09Z"
}
}
advisories/unreviewed/2024/06/GHSA-6889-wccr-m7x3/GHSA-6889-wccr-m7x3.json
+38
View File
@@ -0,0 +1,38 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6889-wccr-m7x3",
"modified": "2024-06-06T12:30:36Z",
"published": "2024-06-06T12:30:36Z",
"aliases": [
"CVE-2024-5673"
],
"details": "Vulnerability in Dulldusk's PHP File Manager affecting version 1.7.8. This vulnerability consists of an XSS through the fm_current_dir parameter of index.php. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5673"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-php-file-manager-dulldusk"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-06T11:15:49Z"
}
}
advisories/unreviewed/2024/06/GHSA-96qm-hwhp-2rm8/GHSA-96qm-hwhp-2rm8.json
+46
View File
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-96qm-hwhp-2rm8",
"modified": "2024-06-06T12:30:36Z",
"published": "2024-06-06T12:30:36Z",
"aliases": [
"CVE-2024-5658"
],
"details": "The CraftCMS plugin Two-Factor Authentication through 3.3.3 allows reuse of TOTP tokens multiple times within the validity period.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5658"
},
{
"type": "WEB",
"url": "https://github.com/born05/craft-twofactorauthentication/releases/tag/3.3.4"
},
{
"type": "WEB",
"url": "https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240202-02_CraftCMS_Plugin_Two-Factor_Authentication_TOTP_Valid_After_Use"
},
{
"type": "WEB",
"url": "https://plugins.craftcms.com/two-factor-authentication?craft4"
}
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-06T11:15:49Z"
}
}
advisories/unreviewed/2024/06/GHSA-99gj-25m6-38xr/GHSA-99gj-25m6-38xr.json
+46
View File
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-99gj-25m6-38xr",
"modified": "2024-06-06T12:30:36Z",
"published": "2024-06-06T12:30:36Z",
"aliases": [
"CVE-2024-5038"
],
"details": "The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.276 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5038"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/colibri-page-builder/trunk/extend-builder/shortcodes/blog/post-item.php#L132"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3097694"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/08159865-1411-4a07-b5db-f4ba5bf2d633?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-06T11:15:48Z"
}
}
advisories/unreviewed/2024/06/GHSA-f7wm-449v-gc59/GHSA-f7wm-449v-gc59.json
+50
View File
@@ -0,0 +1,50 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f7wm-449v-gc59",
"modified": "2024-06-06T12:30:36Z",
"published": "2024-06-06T12:30:36Z",
"aliases": [
"CVE-2024-5329"
],
"details": "The Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin for WordPress is vulnerable to blind SQL Injection via the ‘data[addonID]’ parameter in all versions up to, and including, 1.5.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5329"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_addons.class.php#L999"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3097249/#file6"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/unlimited-elements-for-elementor/#developers"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f33d77b7-5412-47bf-9bed-8617151723c9?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-06T10:15:10Z"
}
}
advisories/unreviewed/2024/06/GHSA-g9vh-rmj6-m6r2/GHSA-g9vh-rmj6-m6r2.json
+46
View File
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g9vh-rmj6-m6r2",
"modified": "2024-06-06T12:30:36Z",
"published": "2024-06-06T12:30:36Z",
"aliases": [
"CVE-2024-5489"
],
"details": "The Wbcom Designs – Custom Font Uploader plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'cfu_delete_customfont' function in all versions up to, and including, 2.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete any custom font.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5489"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/custom-font-uploader/trunk/inc/cfup-functions.php#L20"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3097373"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2339ebbf-2302-4e83-9743-ca79fda20f05?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-06T12:15:09Z"
}
}
advisories/unreviewed/2024/06/GHSA-gqh6-f673-ccgc/GHSA-gqh6-f673-ccgc.json
+21 -1
View File
@@ -1,7 +1,7 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gqh6-f673-ccgc",
"modified": "2024-06-06T06:30:30Z",
"modified": "2024-06-06T12:30:36Z",
"published": "2024-06-06T06:30:30Z",
"aliases": [
"CVE-2024-3049"
@@ -21,6 +21,26 @@
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3049"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3657"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3658"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3659"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3660"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3661"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2024-3049"
advisories/unreviewed/2024/06/GHSA-xj8x-rm7w-xfh4/GHSA-xj8x-rm7w-xfh4.json
+46
View File
@@ -0,0 +1,46 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xj8x-rm7w-xfh4",
"modified": "2024-06-06T12:30:36Z",
"published": "2024-06-06T12:30:36Z",
"aliases": [
"CVE-2024-5188"
],
"details": "The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'get_manual_calendar_events' function in all versions up to, and including, 5.9.22 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5188"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/essential-addons-for-elementor-lite/trunk/includes/Elements/Event_Calendar.php#L3255"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3097900"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5a1d5fd1-80b6-4d62-9837-59ee1e020373?source=cve"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-06T11:15:49Z"
}
}