Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-10-28 15:32:08 +00:00
parent 0c64a18ce5
commit d47869c124
45 changed files with 1328 additions and 23 deletions
@@ -32,6 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-276",
      "CWE-277"
    ],
    "severity": "HIGH",
@@ -32,6 +32,7 @@
  ],
  "database_specific": {
    "cwe_ids": [
+      "CWE-276",
      "CWE-277"
    ],
    "severity": "HIGH",
@@ -28,7 +28,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-284"
+      "CWE-284",
+      "CWE-639"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -32,7 +32,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-121"
+      "CWE-121",
+      "CWE-787"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -36,7 +36,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-121"
+      "CWE-121",
+      "CWE-125"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -36,7 +36,8 @@
  ],
  "database_specific": {
    "cwe_ids": [
-      "CWE-121"
+      "CWE-121",
+      "CWE-125"
    ],
    "severity": "CRITICAL",
    "github_reviewed": false,
@@ -0,0 +1,58 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2c45-cjxr-vcxq",
+  "modified": "2024-10-28T15:31:16Z",
+  "published": "2024-10-28T15:31:16Z",
+  "aliases": [
+    "CVE-2024-10450"
+  ],
+  "details": "A vulnerability has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /kortex_lite/control/edit_profile.php of the component POST Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10450"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/Advocate-office-management-system.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.282010"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.282010"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.432614"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.sourcecodester.com"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-28T15:15:04Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2mm8-fp6h-xwmf",
+  "modified": "2024-10-28T15:31:14Z",
+  "published": "2024-10-28T15:31:14Z",
+  "aliases": [
+    "CVE-2024-50479"
+  ],
+  "details": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mansur Ahamed Woocommerce Quote Calculator allows Blind SQL Injection.This issue affects Woocommerce Quote Calculator: from n/a through 1.1.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50479"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/vulnerability/woo-quote-calculator-order/wordpress-woocommerce-quote-calculator-plugin-1-1-sql-injection-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-28T13:15:06Z"
+  }
+}
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-36c4-85vg-5q9w",
+  "modified": "2024-10-28T15:31:13Z",
+  "published": "2024-10-28T15:31:13Z",
+  "aliases": [
+    "CVE-2024-10447"
+  ],
+  "details": "A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. Affected by this vulnerability is an unknown functionality of the file /timetable/staff/staffdashboard.php?info=updateprofile. The manipulation of the argument n leads to sql injection. The attack can be launched remotely.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10447"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/jadu101/CVE/blob/main/project_worlds_online_time_table_generator_update_profile_sqli.md"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.282007"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.282007"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.432372"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-28T13:15:04Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3c3q-vw42-rfc2",
+  "modified": "2024-10-28T15:31:14Z",
+  "published": "2024-10-28T15:31:14Z",
+  "aliases": [
+    "CVE-2024-50488"
+  ],
+  "details": "Authentication Bypass Using an Alternate Path or Channel vulnerability in Priyabrata Sarkar Token Login allows Authentication Bypass.This issue affects Token Login: from n/a through 1.0.3.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50488"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/vulnerability/token-login/wordpress-token-login-plugin-1-0-3-broken-authentication-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-288"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-28T13:15:06Z"
+  }
+}
@@ -0,0 +1,54 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3c96-w4r4-hg26",
+  "modified": "2024-10-28T15:31:16Z",
+  "published": "2024-10-28T15:31:16Z",
+  "aliases": [
+    "CVE-2024-10449"
+  ],
+  "details": "A vulnerability, which was classified as critical, was found in Codezips Hospital Appointment System 1.0. This affects an unknown part of the file /loginAction.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10449"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/ppp-src/CVE/issues/25"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.282009"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.282009"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.432564"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-89"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-28T15:15:04Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3g37-ghfj-6c5g",
+  "modified": "2024-10-28T15:31:15Z",
+  "published": "2024-10-28T15:31:15Z",
+  "aliases": [
+    "CVE-2024-50576"
+  ],
+  "details": "In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50576"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.jetbrains.com/privacy-security/issues-fixed"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-28T13:15:08Z"
+  }
+}
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-45g4-3pq8-625w",
+  "modified": "2024-10-28T15:31:16Z",
+  "published": "2024-10-28T15:31:16Z",
+  "aliases": [
+    "CVE-2024-48291"
+  ],
+  "details": "dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=editAdmin&id=17",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48291"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/Gxxxxxxxxxxxxxxxxxx/cms/tree/main/4/readme.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-28T15:15:05Z"
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-4fc9-vhvw-cw2f",
-  "modified": "2024-10-25T12:31:33Z",
+  "modified": "2024-10-28T15:31:10Z",
  "published": "2024-10-25T12:31:33Z",
  "aliases": [
    "CVE-2024-47022"
  ],
  "details": "N/A",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-25T11:15:16Z"
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4pm8-rxv6-frfv",
+  "modified": "2024-10-28T15:31:15Z",
+  "published": "2024-10-28T15:31:15Z",
+  "aliases": [
+    "CVE-2024-50574"
+  ],
+  "details": "In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50574"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.jetbrains.com/privacy-security/issues-fixed"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-1333"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-28T13:15:08Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-65xw-vg7q-v4cg",
+  "modified": "2024-10-28T15:31:15Z",
+  "published": "2024-10-28T15:31:15Z",
+  "aliases": [
+    "CVE-2024-50582"
+  ],
+  "details": "In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50582"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.jetbrains.com/privacy-security/issues-fixed"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-28T13:15:09Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6h38-5xh4-ghc6",
+  "modified": "2024-10-28T15:31:14Z",
+  "published": "2024-10-28T15:31:14Z",
+  "aliases": [
+    "CVE-2024-50478"
+  ],
+  "details": "Authentication Bypass by Primary Weakness vulnerability in Swoop 1-Click Login: Passwordless Authentication allows Authentication Bypass.This issue affects 1-Click Login: Passwordless Authentication: 1.4.5.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50478"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/vulnerability/swoop-password-free-authentication/wordpress-1-click-login-passwordless-authentication-plugin-1-4-5-broken-authentication-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-305"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-28T13:15:05Z"
+  }
+}
@@ -1,14 +1,17 @@
 {
  "schema_version": "1.4.0",
  "id": "GHSA-7pcw-338g-2xgr",
-  "modified": "2024-10-25T12:31:33Z",
+  "modified": "2024-10-28T15:31:10Z",
  "published": "2024-10-25T12:31:33Z",
  "aliases": [
    "CVE-2024-47023"
  ],
  "details": "there is a possible man-in-the-middle attack due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.",
  "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
+    }
  ],
  "affected": [

@@ -27,7 +30,7 @@
    "cwe_ids": [

    ],
-    "severity": null,
+    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-25T11:15:17Z"
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-843w-q978-4f26",
+  "modified": "2024-10-28T15:31:14Z",
+  "published": "2024-10-28T15:31:14Z",
+  "aliases": [
+    "CVE-2024-50472"
+  ],
+  "details": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Martin Drapeau Amilia Store allows Stored XSS.This issue affects Amilia Store: from n/a through 2.9.8.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50472"
+    },
+    {
+      "type": "WEB",
+      "url": "https://patchstack.com/database/vulnerability/amilia-store/wordpress-amilia-store-plugin-2-9-8-stored-cross-site-scripting-xss-vulnerability?_s_id=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-28T13:15:05Z"
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-84f5-47c9-mwpg",
+  "modified": "2024-10-28T15:31:15Z",
+  "published": "2024-10-28T15:31:15Z",
+  "aliases": [
+    "CVE-2024-50578"
+  ],
+  "details": "In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50578"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.jetbrains.com/privacy-security/issues-fixed"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-10-28T13:15:09Z"
+  }
+}
--- a/Show More
+++ b/Show More