From dcdbbf352d7ce697826d7e1bc418a725262b7482 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 25 Jun 2024 00:36:13 +0000 Subject: [PATCH] Publish Advisories GHSA-5vvj-g783-6xf4 GHSA-4pj4-pm6x-xf9x GHSA-5vq6-44f5-4pc9 GHSA-7gjf-ch6v-37rf GHSA-9f8f-453p-rg87 GHSA-fwjp-fr8h-pc84 GHSA-g8r2-4q75-c55g GHSA-gp6m-m3pw-7m24 GHSA-m848-8f5r-6j4g GHSA-p59q-w6ff-wf6f GHSA-r5mh-qgc2-26p2 GHSA-r6mp-q3jr-f6gv GHSA-rpvg-h6p6-42qj GHSA-vmvr-82pf-3p87 GHSA-xm4w-v978-7gcx --- .../GHSA-5vvj-g783-6xf4.json | 6 ++- .../GHSA-4pj4-pm6x-xf9x.json | 35 +++++++++++++++++ .../GHSA-5vq6-44f5-4pc9.json | 35 +++++++++++++++++ .../GHSA-7gjf-ch6v-37rf.json | 35 +++++++++++++++++ .../GHSA-9f8f-453p-rg87.json | 39 +++++++++++++++++++ .../GHSA-fwjp-fr8h-pc84.json | 35 +++++++++++++++++ .../GHSA-g8r2-4q75-c55g.json | 35 +++++++++++++++++ .../GHSA-gp6m-m3pw-7m24.json | 35 +++++++++++++++++ .../GHSA-m848-8f5r-6j4g.json | 39 +++++++++++++++++++ .../GHSA-p59q-w6ff-wf6f.json | 35 +++++++++++++++++ .../GHSA-r5mh-qgc2-26p2.json | 39 +++++++++++++++++++ .../GHSA-r6mp-q3jr-f6gv.json | 35 +++++++++++++++++ .../GHSA-rpvg-h6p6-42qj.json | 39 +++++++++++++++++++ .../GHSA-vmvr-82pf-3p87.json | 35 +++++++++++++++++ .../GHSA-xm4w-v978-7gcx.json | 35 +++++++++++++++++ 15 files changed, 511 insertions(+), 1 deletion(-) create mode 100644 advisories/unreviewed/2024/06/GHSA-4pj4-pm6x-xf9x/GHSA-4pj4-pm6x-xf9x.json create mode 100644 advisories/unreviewed/2024/06/GHSA-5vq6-44f5-4pc9/GHSA-5vq6-44f5-4pc9.json create mode 100644 advisories/unreviewed/2024/06/GHSA-7gjf-ch6v-37rf/GHSA-7gjf-ch6v-37rf.json create mode 100644 advisories/unreviewed/2024/06/GHSA-9f8f-453p-rg87/GHSA-9f8f-453p-rg87.json create mode 100644 advisories/unreviewed/2024/06/GHSA-fwjp-fr8h-pc84/GHSA-fwjp-fr8h-pc84.json create mode 100644 advisories/unreviewed/2024/06/GHSA-g8r2-4q75-c55g/GHSA-g8r2-4q75-c55g.json create mode 100644 advisories/unreviewed/2024/06/GHSA-gp6m-m3pw-7m24/GHSA-gp6m-m3pw-7m24.json create mode 100644 advisories/unreviewed/2024/06/GHSA-m848-8f5r-6j4g/GHSA-m848-8f5r-6j4g.json create mode 100644 advisories/unreviewed/2024/06/GHSA-p59q-w6ff-wf6f/GHSA-p59q-w6ff-wf6f.json create mode 100644 advisories/unreviewed/2024/06/GHSA-r5mh-qgc2-26p2/GHSA-r5mh-qgc2-26p2.json create mode 100644 advisories/unreviewed/2024/06/GHSA-r6mp-q3jr-f6gv/GHSA-r6mp-q3jr-f6gv.json create mode 100644 advisories/unreviewed/2024/06/GHSA-rpvg-h6p6-42qj/GHSA-rpvg-h6p6-42qj.json create mode 100644 advisories/unreviewed/2024/06/GHSA-vmvr-82pf-3p87/GHSA-vmvr-82pf-3p87.json create mode 100644 advisories/unreviewed/2024/06/GHSA-xm4w-v978-7gcx/GHSA-xm4w-v978-7gcx.json diff --git a/advisories/unreviewed/2024/03/GHSA-5vvj-g783-6xf4/GHSA-5vvj-g783-6xf4.json b/advisories/unreviewed/2024/03/GHSA-5vvj-g783-6xf4/GHSA-5vvj-g783-6xf4.json index af7d154fe41..7eb26dc952f 100644 --- a/advisories/unreviewed/2024/03/GHSA-5vvj-g783-6xf4/GHSA-5vvj-g783-6xf4.json +++ b/advisories/unreviewed/2024/03/GHSA-5vvj-g783-6xf4/GHSA-5vvj-g783-6xf4.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-5vvj-g783-6xf4", - "modified": "2024-03-13T21:31:03Z", + "modified": "2024-06-25T00:34:45Z", "published": "2024-03-13T21:31:02Z", "aliases": [ "CVE-2024-22167" @@ -24,6 +24,10 @@ { "type": "WEB", "url": "https://www.westerndigital.com/support/product-security/wdc-24002-sandisk-privateaccess-desktop-app-v-6-4-10" + }, + { + "type": "WEB", + "url": "https://www.westerndigital.com/support/product-security/wdc-24002-sandisk-privateaccess-desktop-app-v-6-4-11" } ], "database_specific": { diff --git a/advisories/unreviewed/2024/06/GHSA-4pj4-pm6x-xf9x/GHSA-4pj4-pm6x-xf9x.json b/advisories/unreviewed/2024/06/GHSA-4pj4-pm6x-xf9x/GHSA-4pj4-pm6x-xf9x.json new file mode 100644 index 00000000000..c51237506a6 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-4pj4-pm6x-xf9x/GHSA-4pj4-pm6x-xf9x.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-4pj4-pm6x-xf9x", + "modified": "2024-06-25T00:34:46Z", + "published": "2024-06-25T00:34:46Z", + "aliases": [ + "CVE-2023-50029" + ], + "details": "PHP Injection vulnerability in the module \"M4 PDF Extensions\" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the M4PDF::saveTemplate() method.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50029" + }, + { + "type": "WEB", + "url": "https://security.friendsofpresta.org/modules/2024/06/20/m4pdf.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T23:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-5vq6-44f5-4pc9/GHSA-5vq6-44f5-4pc9.json b/advisories/unreviewed/2024/06/GHSA-5vq6-44f5-4pc9/GHSA-5vq6-44f5-4pc9.json new file mode 100644 index 00000000000..9527689496f --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-5vq6-44f5-4pc9/GHSA-5vq6-44f5-4pc9.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5vq6-44f5-4pc9", + "modified": "2024-06-25T00:34:46Z", + "published": "2024-06-25T00:34:46Z", + "aliases": [ + "CVE-2024-34991" + ], + "details": "In the module \"Axepta\" (axepta) before 1.3.4 from Quadra Informatique for PrestaShop, a guest can download partial credit card information (expiry date) / postal address / email / etc. without restriction due to a lack of permissions control.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34991" + }, + { + "type": "WEB", + "url": "https://security.friendsofpresta.org/modules/2024/06/20/axepta.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T22:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-7gjf-ch6v-37rf/GHSA-7gjf-ch6v-37rf.json b/advisories/unreviewed/2024/06/GHSA-7gjf-ch6v-37rf/GHSA-7gjf-ch6v-37rf.json new file mode 100644 index 00000000000..b1854ce563f --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-7gjf-ch6v-37rf/GHSA-7gjf-ch6v-37rf.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7gjf-ch6v-37rf", + "modified": "2024-06-25T00:34:45Z", + "published": "2024-06-25T00:34:45Z", + "aliases": [ + "CVE-2024-33898" + ], + "details": "Axiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 has Incorrect Access Control. An authorization bypass allows remote attackers to achieve unauthenticated remote code execution.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33898" + }, + { + "type": "WEB", + "url": "https://www.axiros.com/2024/03/vulnerability-in-axusermanager" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T22:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-9f8f-453p-rg87/GHSA-9f8f-453p-rg87.json b/advisories/unreviewed/2024/06/GHSA-9f8f-453p-rg87/GHSA-9f8f-453p-rg87.json new file mode 100644 index 00000000000..dcfd3983e21 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-9f8f-453p-rg87/GHSA-9f8f-453p-rg87.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9f8f-453p-rg87", + "modified": "2024-06-25T00:34:46Z", + "published": "2024-06-25T00:34:46Z", + "aliases": [ + "CVE-2024-6293" + ], + "details": "Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6293" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_24.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/345993680" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T22:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-fwjp-fr8h-pc84/GHSA-fwjp-fr8h-pc84.json b/advisories/unreviewed/2024/06/GHSA-fwjp-fr8h-pc84/GHSA-fwjp-fr8h-pc84.json new file mode 100644 index 00000000000..5e72a09739d --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-fwjp-fr8h-pc84/GHSA-fwjp-fr8h-pc84.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fwjp-fr8h-pc84", + "modified": "2024-06-25T00:34:47Z", + "published": "2024-06-25T00:34:47Z", + "aliases": [ + "CVE-2024-36681" + ], + "details": "SQL Injection vulnerability in the module \"Isotope\" (pk_isotope) <=1.7.3 from Promokit.eu for PrestaShop allows attackers to obtain sensitive information and cause other impacts via `pk_isotope::saveData` and `pk_isotope::removeData` methods.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36681" + }, + { + "type": "WEB", + "url": "https://security.friendsofpresta.org/modules/2024/06/20/pk_isotope.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T23:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-g8r2-4q75-c55g/GHSA-g8r2-4q75-c55g.json b/advisories/unreviewed/2024/06/GHSA-g8r2-4q75-c55g/GHSA-g8r2-4q75-c55g.json new file mode 100644 index 00000000000..8fd255a57d8 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-g8r2-4q75-c55g/GHSA-g8r2-4q75-c55g.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g8r2-4q75-c55g", + "modified": "2024-06-25T00:34:46Z", + "published": "2024-06-25T00:34:46Z", + "aliases": [ + "CVE-2024-22168" + ], + "details": "A Cross-Site Scripting (XSS) vulnerability on the My Cloud, My Cloud Home, SanDisk ibi, and WD Cloud web apps was found which could allow an attacker to redirect the user to a crafted domain and reset their credentials, or to execute arbitrary client-side code in the user’s browser session to carry out malicious activities.The web apps for these devices have been automatically updated to resolve this vulnerability and improve the security of your devices and data.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22168" + }, + { + "type": "WEB", + "url": "https://www.westerndigital.com/support/product-security/wdc-24003-western-digital-my-cloud-os-5-my-cloud-home-sandisk-ibi-and-wd-cloud-web-app-update" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T23:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-gp6m-m3pw-7m24/GHSA-gp6m-m3pw-7m24.json b/advisories/unreviewed/2024/06/GHSA-gp6m-m3pw-7m24/GHSA-gp6m-m3pw-7m24.json new file mode 100644 index 00000000000..88c81b11f01 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-gp6m-m3pw-7m24/GHSA-gp6m-m3pw-7m24.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gp6m-m3pw-7m24", + "modified": "2024-06-25T00:34:47Z", + "published": "2024-06-25T00:34:47Z", + "aliases": [ + "CVE-2024-34992" + ], + "details": "SQL Injection vulnerability in the module \"Help Desk - Customer Support Management System\" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop allows attackers to obtain sensitive information and cause other impacts via 'Tickets::getsearchedtickets()'", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34992" + }, + { + "type": "WEB", + "url": "https://security.friendsofpresta.org/modules/2024/06/20/helpdesk.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T23:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-m848-8f5r-6j4g/GHSA-m848-8f5r-6j4g.json b/advisories/unreviewed/2024/06/GHSA-m848-8f5r-6j4g/GHSA-m848-8f5r-6j4g.json new file mode 100644 index 00000000000..f6f9021d9e0 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-m848-8f5r-6j4g/GHSA-m848-8f5r-6j4g.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m848-8f5r-6j4g", + "modified": "2024-06-25T00:34:46Z", + "published": "2024-06-25T00:34:46Z", + "aliases": [ + "CVE-2024-6292" + ], + "details": "Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6292" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_24.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/342545100" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T22:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-p59q-w6ff-wf6f/GHSA-p59q-w6ff-wf6f.json b/advisories/unreviewed/2024/06/GHSA-p59q-w6ff-wf6f/GHSA-p59q-w6ff-wf6f.json new file mode 100644 index 00000000000..5758b309234 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-p59q-w6ff-wf6f/GHSA-p59q-w6ff-wf6f.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-p59q-w6ff-wf6f", + "modified": "2024-06-25T00:34:45Z", + "published": "2024-06-25T00:34:45Z", + "aliases": [ + "CVE-2023-45195" + ], + "details": "Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45195" + }, + { + "type": "WEB", + "url": "https://github.com/adminerevo/adminerevo/pull/102/commits/18f3167bbcbec3bc746f62db72e016aa99144efc" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T22:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-r5mh-qgc2-26p2/GHSA-r5mh-qgc2-26p2.json b/advisories/unreviewed/2024/06/GHSA-r5mh-qgc2-26p2/GHSA-r5mh-qgc2-26p2.json new file mode 100644 index 00000000000..179b61fccee --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-r5mh-qgc2-26p2/GHSA-r5mh-qgc2-26p2.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r5mh-qgc2-26p2", + "modified": "2024-06-25T00:34:46Z", + "published": "2024-06-25T00:34:46Z", + "aliases": [ + "CVE-2024-6290" + ], + "details": "Use after free in Dawn in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6290" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_24.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/342428008" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T22:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-r6mp-q3jr-f6gv/GHSA-r6mp-q3jr-f6gv.json b/advisories/unreviewed/2024/06/GHSA-r6mp-q3jr-f6gv/GHSA-r6mp-q3jr-f6gv.json new file mode 100644 index 00000000000..7345c4cec5d --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-r6mp-q3jr-f6gv/GHSA-r6mp-q3jr-f6gv.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r6mp-q3jr-f6gv", + "modified": "2024-06-25T00:34:46Z", + "published": "2024-06-25T00:34:46Z", + "aliases": [ + "CVE-2024-34988" + ], + "details": "SQL injection vulnerability in the module \"Complete for Create a Quote in Frontend + Backend Pro\" (askforaquotemodul) <= 1.0.51 from Buy Addons for PrestaShop allows attackers to view sensitive information and cause other impacts via methods `AskforaquotemodulcustomernewquoteModuleFrontController::run()`, `AskforaquotemoduladdproductnewquoteModuleFrontController::run()`, `AskforaquotemodulCouponcodeModuleFrontController::run()`, `AskforaquotemodulgetshippingcostModuleFrontController::run()`, `AskforaquotemodulgetstateModuleFrontController::run().`", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34988" + }, + { + "type": "WEB", + "url": "https://security.friendsofpresta.org/modules/2024/06/20/askforaquotemodul.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T23:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-rpvg-h6p6-42qj/GHSA-rpvg-h6p6-42qj.json b/advisories/unreviewed/2024/06/GHSA-rpvg-h6p6-42qj/GHSA-rpvg-h6p6-42qj.json new file mode 100644 index 00000000000..12ece05eff4 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-rpvg-h6p6-42qj/GHSA-rpvg-h6p6-42qj.json @@ -0,0 +1,39 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rpvg-h6p6-42qj", + "modified": "2024-06-25T00:34:46Z", + "published": "2024-06-25T00:34:46Z", + "aliases": [ + "CVE-2024-6291" + ], + "details": "Use after free in Swiftshader in Google Chrome prior to 126.0.6478.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6291" + }, + { + "type": "WEB", + "url": "https://chromereleases.googleblog.com/2024/06/stable-channel-update-for-desktop_24.html" + }, + { + "type": "WEB", + "url": "https://issues.chromium.org/issues/40942995" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T22:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-vmvr-82pf-3p87/GHSA-vmvr-82pf-3p87.json b/advisories/unreviewed/2024/06/GHSA-vmvr-82pf-3p87/GHSA-vmvr-82pf-3p87.json new file mode 100644 index 00000000000..09a164833c2 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-vmvr-82pf-3p87/GHSA-vmvr-82pf-3p87.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vmvr-82pf-3p87", + "modified": "2024-06-25T00:34:47Z", + "published": "2024-06-25T00:34:47Z", + "aliases": [ + "CVE-2024-36683" + ], + "details": "SQL injection vulnerability in the module \"Products Alert\" (productsalert) before 1.7.4 from Smart Modules for PrestaShop allows attackers to obtain sensitive information and cause other impacts via the ProductsAlertAjaxProcessModuleFrontController::initContent method.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36683" + }, + { + "type": "WEB", + "url": "https://security.friendsofpresta.org/modules/2024/06/20/productsalert.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T23:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/06/GHSA-xm4w-v978-7gcx/GHSA-xm4w-v978-7gcx.json b/advisories/unreviewed/2024/06/GHSA-xm4w-v978-7gcx/GHSA-xm4w-v978-7gcx.json new file mode 100644 index 00000000000..3385a61bc35 --- /dev/null +++ b/advisories/unreviewed/2024/06/GHSA-xm4w-v978-7gcx/GHSA-xm4w-v978-7gcx.json @@ -0,0 +1,35 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xm4w-v978-7gcx", + "modified": "2024-06-25T00:34:46Z", + "published": "2024-06-25T00:34:46Z", + "aliases": [ + "CVE-2024-36682" + ], + "details": "In the module \"Theme settings\" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while SHOP is in maintenance mode. Due to a lack of permissions control, a guest can access the txt file which collect email when maintenance is enable which can lead to leak of personal information.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36682" + }, + { + "type": "WEB", + "url": "https://security.friendsofpresta.org/modules/2024/06/20/pk_themesettings.html" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-06-24T22:15:10Z" + } +} \ No newline at end of file