From d7a39063ed9fb804b972a56dfff0a7487bbbcde9 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 26 Apr 2024 12:32:03 +0000 Subject: [PATCH] Publish Advisories GHSA-c4rr-rjwx-4xwh GHSA-cv8f-mv6h-rf73 GHSA-ffr6-cv7v-5fr9 GHSA-h282-h49g-gvfm GHSA-h9fj-vwxm-9wf4 GHSA-hw63-cg2c-rh7g GHSA-jg9h-x22w-cq68 GHSA-q66w-qfxv-vpx3 GHSA-qr2x-466f-55hc GHSA-v6f7-cqmv-v5gc GHSA-v9pm-5x6v-2p6p GHSA-wv9c-r7wv-3wph GHSA-x8vp-jrrr-mxv3 --- .../GHSA-c4rr-rjwx-4xwh.json | 38 ++++++++++++++ .../GHSA-cv8f-mv6h-rf73.json | 38 ++++++++++++++ .../GHSA-ffr6-cv7v-5fr9.json | 38 ++++++++++++++ .../GHSA-h282-h49g-gvfm.json | 38 ++++++++++++++ .../GHSA-h9fj-vwxm-9wf4.json | 38 ++++++++++++++ .../GHSA-hw63-cg2c-rh7g.json | 38 ++++++++++++++ .../GHSA-jg9h-x22w-cq68.json | 38 ++++++++++++++ .../GHSA-q66w-qfxv-vpx3.json | 50 +++++++++++++++++++ .../GHSA-qr2x-466f-55hc.json | 38 ++++++++++++++ .../GHSA-v6f7-cqmv-v5gc.json | 38 ++++++++++++++ .../GHSA-v9pm-5x6v-2p6p.json | 38 ++++++++++++++ .../GHSA-wv9c-r7wv-3wph.json | 42 ++++++++++++++++ .../GHSA-x8vp-jrrr-mxv3.json | 38 ++++++++++++++ 13 files changed, 510 insertions(+) create mode 100644 advisories/unreviewed/2024/04/GHSA-c4rr-rjwx-4xwh/GHSA-c4rr-rjwx-4xwh.json create mode 100644 advisories/unreviewed/2024/04/GHSA-cv8f-mv6h-rf73/GHSA-cv8f-mv6h-rf73.json create mode 100644 advisories/unreviewed/2024/04/GHSA-ffr6-cv7v-5fr9/GHSA-ffr6-cv7v-5fr9.json create mode 100644 advisories/unreviewed/2024/04/GHSA-h282-h49g-gvfm/GHSA-h282-h49g-gvfm.json create mode 100644 advisories/unreviewed/2024/04/GHSA-h9fj-vwxm-9wf4/GHSA-h9fj-vwxm-9wf4.json create mode 100644 advisories/unreviewed/2024/04/GHSA-hw63-cg2c-rh7g/GHSA-hw63-cg2c-rh7g.json create mode 100644 advisories/unreviewed/2024/04/GHSA-jg9h-x22w-cq68/GHSA-jg9h-x22w-cq68.json create mode 100644 advisories/unreviewed/2024/04/GHSA-q66w-qfxv-vpx3/GHSA-q66w-qfxv-vpx3.json create mode 100644 advisories/unreviewed/2024/04/GHSA-qr2x-466f-55hc/GHSA-qr2x-466f-55hc.json create mode 100644 advisories/unreviewed/2024/04/GHSA-v6f7-cqmv-v5gc/GHSA-v6f7-cqmv-v5gc.json create mode 100644 advisories/unreviewed/2024/04/GHSA-v9pm-5x6v-2p6p/GHSA-v9pm-5x6v-2p6p.json create mode 100644 advisories/unreviewed/2024/04/GHSA-wv9c-r7wv-3wph/GHSA-wv9c-r7wv-3wph.json create mode 100644 advisories/unreviewed/2024/04/GHSA-x8vp-jrrr-mxv3/GHSA-x8vp-jrrr-mxv3.json diff --git a/advisories/unreviewed/2024/04/GHSA-c4rr-rjwx-4xwh/GHSA-c4rr-rjwx-4xwh.json b/advisories/unreviewed/2024/04/GHSA-c4rr-rjwx-4xwh/GHSA-c4rr-rjwx-4xwh.json new file mode 100644 index 00000000000..3f3b848acbc --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-c4rr-rjwx-4xwh/GHSA-c4rr-rjwx-4xwh.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c4rr-rjwx-4xwh", + "modified": "2024-04-26T12:30:29Z", + "published": "2024-04-26T12:30:29Z", + "aliases": [ + "CVE-2024-32829" + ], + "details": "Missing Authorization vulnerability in Supsystic Data Tables Generator by Supsystic.This issue affects Data Tables Generator by Supsystic: from n/a through 1.10.31.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32829" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/data-tables-generator-by-supsystic/wordpress-data-tables-generator-by-supsystic-plugin-1-10-31-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T11:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-cv8f-mv6h-rf73/GHSA-cv8f-mv6h-rf73.json b/advisories/unreviewed/2024/04/GHSA-cv8f-mv6h-rf73/GHSA-cv8f-mv6h-rf73.json new file mode 100644 index 00000000000..68f4c6c1257 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-cv8f-mv6h-rf73/GHSA-cv8f-mv6h-rf73.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cv8f-mv6h-rf73", + "modified": "2024-04-26T12:30:30Z", + "published": "2024-04-26T12:30:30Z", + "aliases": [ + "CVE-2024-33683" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in WP Republic Hide Dashboard Notifications.This issue affects Hide Dashboard Notifications: from n/a through 1.2.3.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33683" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/wp-hide-backed-notices/wordpress-hide-dashboard-notifications-plugin-1-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T11:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-ffr6-cv7v-5fr9/GHSA-ffr6-cv7v-5fr9.json b/advisories/unreviewed/2024/04/GHSA-ffr6-cv7v-5fr9/GHSA-ffr6-cv7v-5fr9.json new file mode 100644 index 00000000000..16096ed3335 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-ffr6-cv7v-5fr9/GHSA-ffr6-cv7v-5fr9.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ffr6-cv7v-5fr9", + "modified": "2024-04-26T12:30:29Z", + "published": "2024-04-26T12:30:29Z", + "aliases": [ + "CVE-2024-32826" + ], + "details": "Missing Authorization vulnerability in Vektor,Inc. VK Block Patterns.This issue affects VK Block Patterns: from n/a through 1.31.0.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32826" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/vk-block-patterns/wordpress-vk-block-patterns-plugin-1-31-0-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T11:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-h282-h49g-gvfm/GHSA-h282-h49g-gvfm.json b/advisories/unreviewed/2024/04/GHSA-h282-h49g-gvfm/GHSA-h282-h49g-gvfm.json new file mode 100644 index 00000000000..b2a0382d1ca --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-h282-h49g-gvfm/GHSA-h282-h49g-gvfm.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h282-h49g-gvfm", + "modified": "2024-04-26T12:30:29Z", + "published": "2024-04-26T12:30:29Z", + "aliases": [ + "CVE-2024-33679" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in FameThemes FameTheme Demo Importer.This issue affects FameTheme Demo Importer: from n/a through 1.1.5.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33679" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/famethemes-demo-importer/wordpress-fametheme-demo-importer-plugin-1-1-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T11:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-h9fj-vwxm-9wf4/GHSA-h9fj-vwxm-9wf4.json b/advisories/unreviewed/2024/04/GHSA-h9fj-vwxm-9wf4/GHSA-h9fj-vwxm-9wf4.json new file mode 100644 index 00000000000..48a4c49a295 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-h9fj-vwxm-9wf4/GHSA-h9fj-vwxm-9wf4.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h9fj-vwxm-9wf4", + "modified": "2024-04-26T12:30:29Z", + "published": "2024-04-26T12:30:29Z", + "aliases": [ + "CVE-2024-32828" + ], + "details": "Missing Authorization vulnerability in Octolize Flexible Shipping.This issue affects Flexible Shipping: from n/a through 4.24.15.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32828" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/flexible-shipping/wordpress-table-rate-shipping-method-for-woocommerce-by-flexible-shipping-plugin-4-24-15-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T11:15:45Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-hw63-cg2c-rh7g/GHSA-hw63-cg2c-rh7g.json b/advisories/unreviewed/2024/04/GHSA-hw63-cg2c-rh7g/GHSA-hw63-cg2c-rh7g.json new file mode 100644 index 00000000000..a7caa7f1e90 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-hw63-cg2c-rh7g/GHSA-hw63-cg2c-rh7g.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hw63-cg2c-rh7g", + "modified": "2024-04-26T12:30:30Z", + "published": "2024-04-26T12:30:30Z", + "aliases": [ + "CVE-2024-33682" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Cookie Information A/S WP GDPR Compliance.This issue affects WP GDPR Compliance: from n/a through 2.0.23.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33682" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/wp-gdpr-compliance/wordpress-wp-gdpr-compliance-plugin-2-0-23-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T11:15:47Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-jg9h-x22w-cq68/GHSA-jg9h-x22w-cq68.json b/advisories/unreviewed/2024/04/GHSA-jg9h-x22w-cq68/GHSA-jg9h-x22w-cq68.json new file mode 100644 index 00000000000..3e02a0e0219 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-jg9h-x22w-cq68/GHSA-jg9h-x22w-cq68.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jg9h-x22w-cq68", + "modified": "2024-04-26T12:30:29Z", + "published": "2024-04-26T12:30:29Z", + "aliases": [ + "CVE-2024-33678" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in ClickCease ClickCease Click Fraud Protection.This issue affects ClickCease Click Fraud Protection: from n/a through 3.2.4.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33678" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/clickcease-click-fraud-protection/wordpress-clickcease-click-fraud-protection-plugin-3-2-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T11:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-q66w-qfxv-vpx3/GHSA-q66w-qfxv-vpx3.json b/advisories/unreviewed/2024/04/GHSA-q66w-qfxv-vpx3/GHSA-q66w-qfxv-vpx3.json new file mode 100644 index 00000000000..ae2699c8f95 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-q66w-qfxv-vpx3/GHSA-q66w-qfxv-vpx3.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-q66w-qfxv-vpx3", + "modified": "2024-04-26T12:30:29Z", + "published": "2024-04-26T12:30:29Z", + "aliases": [ + "CVE-2024-3682" + ], + "details": "The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extract sensitive data from a log file, including system information and (in the Pro version) license keys. Successful exploitation requires an administrator to have used the 'Contact Us' functionality along with the \"Enable this option to automatically submit the log files.\" option.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3682" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3076275/wp-staging" + }, + { + "type": "WEB", + "url": "https://wp-staging.com/wp-staging-changelog" + }, + { + "type": "WEB", + "url": "https://wp-staging.com/wp-staging-pro-changelog" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/75eab54b-dbe0-4440-b4ab-601c5041e180?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T10:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-qr2x-466f-55hc/GHSA-qr2x-466f-55hc.json b/advisories/unreviewed/2024/04/GHSA-qr2x-466f-55hc/GHSA-qr2x-466f-55hc.json new file mode 100644 index 00000000000..f4e87b61722 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-qr2x-466f-55hc/GHSA-qr2x-466f-55hc.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qr2x-466f-55hc", + "modified": "2024-04-26T12:30:30Z", + "published": "2024-04-26T12:30:30Z", + "aliases": [ + "CVE-2024-33680" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in MainWP MainWP Child Reports.This issue affects MainWP Child Reports: from n/a through 2.1.1.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33680" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/mainwp-child-reports/wordpress-mainwp-child-reports-plugin-2-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T11:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-v6f7-cqmv-v5gc/GHSA-v6f7-cqmv-v5gc.json b/advisories/unreviewed/2024/04/GHSA-v6f7-cqmv-v5gc/GHSA-v6f7-cqmv-v5gc.json new file mode 100644 index 00000000000..224ce2575d3 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-v6f7-cqmv-v5gc/GHSA-v6f7-cqmv-v5gc.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v6f7-cqmv-v5gc", + "modified": "2024-04-26T12:30:30Z", + "published": "2024-04-26T12:30:30Z", + "aliases": [ + "CVE-2024-32822" + ], + "details": "Missing Authorization vulnerability in impleCode Reviews Plus.This issue affects Reviews Plus: from n/a through 1.3.4.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32822" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/reviews-plus/wordpress-reviews-plus-plugin-1-3-4-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T12:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-v9pm-5x6v-2p6p/GHSA-v9pm-5x6v-2p6p.json b/advisories/unreviewed/2024/04/GHSA-v9pm-5x6v-2p6p/GHSA-v9pm-5x6v-2p6p.json new file mode 100644 index 00000000000..7a9ec84dd94 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-v9pm-5x6v-2p6p/GHSA-v9pm-5x6v-2p6p.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v9pm-5x6v-2p6p", + "modified": "2024-04-26T12:30:29Z", + "published": "2024-04-26T12:30:29Z", + "aliases": [ + "CVE-2024-33677" + ], + "details": "Cross-Site Request Forgery (CSRF) vulnerability in Renzo Johnson Contact Form 7 Extension For Mailchimp.This issue affects Contact Form 7 Extension For Mailchimp: from n/a through 0.5.70.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33677" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/contact-form-7-mailchimp-extension/wordpress-contact-form-7-extension-for-mailchimp-plugin-0-5-70-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T11:15:46Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-wv9c-r7wv-3wph/GHSA-wv9c-r7wv-3wph.json b/advisories/unreviewed/2024/04/GHSA-wv9c-r7wv-3wph/GHSA-wv9c-r7wv-3wph.json new file mode 100644 index 00000000000..96738931499 --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-wv9c-r7wv-3wph/GHSA-wv9c-r7wv-3wph.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wv9c-r7wv-3wph", + "modified": "2024-04-26T12:30:29Z", + "published": "2024-04-26T12:30:29Z", + "aliases": [ + "CVE-2024-0740" + ], + "details": "Eclipse Target Management: Terminal and Remote System Explorer (RSE) version <= 4.5.400 has a remote code execution vulnerability that does not require authentication. \n\n\n\n\n\nThe fixed version is included in Eclipse IDE 2024-03\n\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0740" + }, + { + "type": "WEB", + "url": "https://git.eclipse.org/r/c/tm/org.eclipse.tm/+/202145" + }, + { + "type": "WEB", + "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/171" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T10:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/04/GHSA-x8vp-jrrr-mxv3/GHSA-x8vp-jrrr-mxv3.json b/advisories/unreviewed/2024/04/GHSA-x8vp-jrrr-mxv3/GHSA-x8vp-jrrr-mxv3.json new file mode 100644 index 00000000000..0e81742917d --- /dev/null +++ b/advisories/unreviewed/2024/04/GHSA-x8vp-jrrr-mxv3/GHSA-x8vp-jrrr-mxv3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-x8vp-jrrr-mxv3", + "modified": "2024-04-26T12:30:29Z", + "published": "2024-04-26T12:30:29Z", + "aliases": [ + "CVE-2024-32957" + ], + "details": "Missing Authorization vulnerability in Live Composer Team Page Builder: Live Composer.This issue affects Page Builder: Live Composer: from n/a through 1.5.38.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32957" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/live-composer-page-builder/wordpress-page-builder-live-composer-plugin-1-5-38-broken-access-control-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-04-26T11:15:46Z" + } +} \ No newline at end of file