From df39802c62c5e7b984c69613dd77a3122e7a6614 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 25 Oct 2024 00:34:28 +0000 Subject: [PATCH] Publish Advisories GHSA-489g-54j3-q6rq GHSA-4x48-qpw5-qpgr GHSA-52j3-f378-p3cw GHSA-643q-778f-w3wx GHSA-6gp9-mxjv-gqwr GHSA-873w-h9q5-86gx GHSA-crcx-wcr8-prj5 GHSA-f6rp-5fm6-qmhw GHSA-gc3f-r2gj-mhrp GHSA-rgxw-5jvr-8c53 GHSA-wwm6-7f3x-4fmg GHSA-xcwr-rf3v-pxfj --- .../GHSA-489g-54j3-q6rq.json | 2 +- .../GHSA-4x48-qpw5-qpgr.json | 2 +- .../GHSA-52j3-f378-p3cw.json | 11 ++-- .../GHSA-643q-778f-w3wx.json | 47 +++++++++++++++ .../GHSA-6gp9-mxjv-gqwr.json | 58 +++++++++++++++++++ .../GHSA-873w-h9q5-86gx.json | 11 ++-- .../GHSA-crcx-wcr8-prj5.json | 47 +++++++++++++++ .../GHSA-f6rp-5fm6-qmhw.json | 11 ++-- .../GHSA-gc3f-r2gj-mhrp.json | 58 +++++++++++++++++++ .../GHSA-rgxw-5jvr-8c53.json | 58 +++++++++++++++++++ .../GHSA-wwm6-7f3x-4fmg.json | 58 +++++++++++++++++++ .../GHSA-xcwr-rf3v-pxfj.json | 58 +++++++++++++++++++ 12 files changed, 407 insertions(+), 14 deletions(-) create mode 100644 advisories/unreviewed/2024/10/GHSA-643q-778f-w3wx/GHSA-643q-778f-w3wx.json create mode 100644 advisories/unreviewed/2024/10/GHSA-6gp9-mxjv-gqwr/GHSA-6gp9-mxjv-gqwr.json create mode 100644 advisories/unreviewed/2024/10/GHSA-crcx-wcr8-prj5/GHSA-crcx-wcr8-prj5.json create mode 100644 advisories/unreviewed/2024/10/GHSA-gc3f-r2gj-mhrp/GHSA-gc3f-r2gj-mhrp.json create mode 100644 advisories/unreviewed/2024/10/GHSA-rgxw-5jvr-8c53/GHSA-rgxw-5jvr-8c53.json create mode 100644 advisories/unreviewed/2024/10/GHSA-wwm6-7f3x-4fmg/GHSA-wwm6-7f3x-4fmg.json create mode 100644 advisories/unreviewed/2024/10/GHSA-xcwr-rf3v-pxfj/GHSA-xcwr-rf3v-pxfj.json diff --git a/advisories/unreviewed/2023/07/GHSA-489g-54j3-q6rq/GHSA-489g-54j3-q6rq.json b/advisories/unreviewed/2023/07/GHSA-489g-54j3-q6rq/GHSA-489g-54j3-q6rq.json index 44948981640..c4455f1b2a5 100644 --- a/advisories/unreviewed/2023/07/GHSA-489g-54j3-q6rq/GHSA-489g-54j3-q6rq.json +++ b/advisories/unreviewed/2023/07/GHSA-489g-54j3-q6rq/GHSA-489g-54j3-q6rq.json @@ -40,7 +40,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-276" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/07/GHSA-4x48-qpw5-qpgr/GHSA-4x48-qpw5-qpgr.json b/advisories/unreviewed/2023/07/GHSA-4x48-qpw5-qpgr/GHSA-4x48-qpw5-qpgr.json index 6e2bddbab15..057ec6f2da7 100644 --- a/advisories/unreviewed/2023/07/GHSA-4x48-qpw5-qpgr/GHSA-4x48-qpw5-qpgr.json +++ b/advisories/unreviewed/2023/07/GHSA-4x48-qpw5-qpgr/GHSA-4x48-qpw5-qpgr.json @@ -40,7 +40,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-276" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/10/GHSA-52j3-f378-p3cw/GHSA-52j3-f378-p3cw.json b/advisories/unreviewed/2024/10/GHSA-52j3-f378-p3cw/GHSA-52j3-f378-p3cw.json index 511feadc229..ca980a1b738 100644 --- a/advisories/unreviewed/2024/10/GHSA-52j3-f378-p3cw/GHSA-52j3-f378-p3cw.json +++ b/advisories/unreviewed/2024/10/GHSA-52j3-f378-p3cw/GHSA-52j3-f378-p3cw.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-52j3-f378-p3cw", - "modified": "2024-10-24T21:31:03Z", + "modified": "2024-10-25T00:33:06Z", "published": "2024-10-24T21:31:03Z", "aliases": [ "CVE-2024-48454" ], "details": "An issue in SourceCodester Purchase Order Management System v1.0 allows a remote attacker to execute arbitrary code via the /admin?page=user component", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -33,9 +36,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-434" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-24T19:15:15Z" diff --git a/advisories/unreviewed/2024/10/GHSA-643q-778f-w3wx/GHSA-643q-778f-w3wx.json b/advisories/unreviewed/2024/10/GHSA-643q-778f-w3wx/GHSA-643q-778f-w3wx.json new file mode 100644 index 00000000000..7f53e5713d0 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-643q-778f-w3wx/GHSA-643q-778f-w3wx.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-643q-778f-w3wx", + "modified": "2024-10-25T00:33:06Z", + "published": "2024-10-25T00:33:06Z", + "aliases": [ + "CVE-2024-41617" + ], + "details": "Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to Incorrect Access Control. The `redirect_if_not_loggedin` function in `functions_security.php` fails to terminate script execution after redirecting unauthenticated users. This flaw allows an unauthenticated attacker to upload arbitrary files, potentially leading to Remote Code Execution.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41617" + }, + { + "type": "WEB", + "url": "https://github.com/moneymanagerex/web-money-manager-ex/issues/51" + }, + { + "type": "WEB", + "url": "https://github.com/moneymanagerex/web-money-manager-ex/commit/f2850b295ee21bc299799343a3bc4d004d05651d" + }, + { + "type": "WEB", + "url": "https://github.com/moneymanagerex/web-money-manager-ex/releases/tag/v1.2.3" + }, + { + "type": "WEB", + "url": "https://youtu.be/JaOrlT9G3yo?t=88" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-24T22:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-6gp9-mxjv-gqwr/GHSA-6gp9-mxjv-gqwr.json b/advisories/unreviewed/2024/10/GHSA-6gp9-mxjv-gqwr/GHSA-6gp9-mxjv-gqwr.json new file mode 100644 index 00000000000..1fece5ffe69 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-6gp9-mxjv-gqwr/GHSA-6gp9-mxjv-gqwr.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6gp9-mxjv-gqwr", + "modified": "2024-10-25T00:33:06Z", + "published": "2024-10-25T00:33:06Z", + "aliases": [ + "CVE-2024-10351" + ], + "details": "A vulnerability was found in Tenda RX9 Pro 22.03.02.20. It has been rated as critical. This issue affects the function sub_424CE0 of the file /goform/setMacFilterCfg of the component POST Request Handler. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10351" + }, + { + "type": "WEB", + "url": "https://gitee.com/GXB0_0/iot-vul/blob/master/Tenda/RX9/20/setMacFilterCfg.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.281699" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.281699" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.427706" + }, + { + "type": "WEB", + "url": "https://www.tenda.com.cn" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-121" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-25T00:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-873w-h9q5-86gx/GHSA-873w-h9q5-86gx.json b/advisories/unreviewed/2024/10/GHSA-873w-h9q5-86gx/GHSA-873w-h9q5-86gx.json index 1960a4e5d7f..b0be4c2e342 100644 --- a/advisories/unreviewed/2024/10/GHSA-873w-h9q5-86gx/GHSA-873w-h9q5-86gx.json +++ b/advisories/unreviewed/2024/10/GHSA-873w-h9q5-86gx/GHSA-873w-h9q5-86gx.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-873w-h9q5-86gx", - "modified": "2024-10-24T18:30:44Z", + "modified": "2024-10-25T00:33:06Z", "published": "2024-10-24T18:30:44Z", "aliases": [ "CVE-2024-48548" ], "details": "The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. This vulnerability allows attackers to arbitrarily construct a request to use the app to bind to unknown devices by finding a valid serial number via a bruteforce attack.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-863" ], - "severity": null, + "severity": "CRITICAL", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-24T17:15:17Z" diff --git a/advisories/unreviewed/2024/10/GHSA-crcx-wcr8-prj5/GHSA-crcx-wcr8-prj5.json b/advisories/unreviewed/2024/10/GHSA-crcx-wcr8-prj5/GHSA-crcx-wcr8-prj5.json new file mode 100644 index 00000000000..a6b9baeb38d --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-crcx-wcr8-prj5/GHSA-crcx-wcr8-prj5.json @@ -0,0 +1,47 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-crcx-wcr8-prj5", + "modified": "2024-10-25T00:33:06Z", + "published": "2024-10-25T00:33:06Z", + "aliases": [ + "CVE-2024-41618" + ], + "details": "Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to SQL Injection in the `transaction_delete_group` function. The vulnerability is due to improper sanitization of user input in the `TrDeleteArr` parameter, which is directly incorporated into an SQL query.", + "severity": [ + + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41618" + }, + { + "type": "WEB", + "url": "https://github.com/moneymanagerex/web-money-manager-ex/issues/51" + }, + { + "type": "WEB", + "url": "https://github.com/moneymanagerex/web-money-manager-ex/commit/f2850b295ee21bc299799343a3bc4d004d05651d" + }, + { + "type": "WEB", + "url": "https://github.com/moneymanagerex/web-money-manager-ex/releases/tag/v1.2.3" + }, + { + "type": "WEB", + "url": "https://www.youtube.com/watch?v=JaOrlT9G3yo" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": null, + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-24T22:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-f6rp-5fm6-qmhw/GHSA-f6rp-5fm6-qmhw.json b/advisories/unreviewed/2024/10/GHSA-f6rp-5fm6-qmhw/GHSA-f6rp-5fm6-qmhw.json index 8519e2db2ee..6b6b503725a 100644 --- a/advisories/unreviewed/2024/10/GHSA-f6rp-5fm6-qmhw/GHSA-f6rp-5fm6-qmhw.json +++ b/advisories/unreviewed/2024/10/GHSA-f6rp-5fm6-qmhw/GHSA-f6rp-5fm6-qmhw.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-f6rp-5fm6-qmhw", - "modified": "2024-10-24T18:30:43Z", + "modified": "2024-10-25T00:33:06Z", "published": "2024-10-24T18:30:43Z", "aliases": [ "CVE-2024-48544" ], "details": "Incorrect access control in the firmware update and download processes of Sylvania Smart Home v3.0.3 allows attackers to access sensitive information by analyzing the code and data within the APK file.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-863" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2024-10-24T17:15:17Z" diff --git a/advisories/unreviewed/2024/10/GHSA-gc3f-r2gj-mhrp/GHSA-gc3f-r2gj-mhrp.json b/advisories/unreviewed/2024/10/GHSA-gc3f-r2gj-mhrp/GHSA-gc3f-r2gj-mhrp.json new file mode 100644 index 00000000000..6ef6fa76b03 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-gc3f-r2gj-mhrp/GHSA-gc3f-r2gj-mhrp.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-gc3f-r2gj-mhrp", + "modified": "2024-10-25T00:33:06Z", + "published": "2024-10-25T00:33:06Z", + "aliases": [ + "CVE-2024-10348" + ], + "details": "A vulnerability was found in SourceCodester Best House Rental Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php?page=tenants of the component Manage Tenant Details. The manipulation of the argument Last Name/First Name/Middle Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only shows the field \"Last Name\" to be affected. Other fields might be affected as well.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10348" + }, + { + "type": "WEB", + "url": "https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/house-rental-management-system.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.281697" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.281697" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.427471" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-24T22:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-rgxw-5jvr-8c53/GHSA-rgxw-5jvr-8c53.json b/advisories/unreviewed/2024/10/GHSA-rgxw-5jvr-8c53/GHSA-rgxw-5jvr-8c53.json new file mode 100644 index 00000000000..f5ec7046569 --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-rgxw-5jvr-8c53/GHSA-rgxw-5jvr-8c53.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rgxw-5jvr-8c53", + "modified": "2024-10-25T00:33:06Z", + "published": "2024-10-25T00:33:06Z", + "aliases": [ + "CVE-2024-10353" + ], + "details": "A vulnerability classified as critical has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file /admin-dashboard. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This affects a different product and is a different issue than CVE-2024-40480.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10353" + }, + { + "type": "WEB", + "url": "https://drive.google.com/file/d/1hEXfbOOkWdYzaSI6ORQvPGBtn09R12Ui/view?usp=drive_link" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.281700" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.281700" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.427957" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-25T00:15:02Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-wwm6-7f3x-4fmg/GHSA-wwm6-7f3x-4fmg.json b/advisories/unreviewed/2024/10/GHSA-wwm6-7f3x-4fmg/GHSA-wwm6-7f3x-4fmg.json new file mode 100644 index 00000000000..1f8b61e4b7a --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-wwm6-7f3x-4fmg/GHSA-wwm6-7f3x-4fmg.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wwm6-7f3x-4fmg", + "modified": "2024-10-25T00:33:06Z", + "published": "2024-10-25T00:33:06Z", + "aliases": [ + "CVE-2024-10349" + ], + "details": "A vulnerability was found in SourceCodester Best House Rental Management System 1.0 and classified as critical. Affected by this issue is the function delete_tenant of the file /ajax.php?action=delete_tenant. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10349" + }, + { + "type": "WEB", + "url": "https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/house-rentalmanagement-system1.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.281696" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.281696" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.427472" + }, + { + "type": "WEB", + "url": "https://www.sourcecodester.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-24T22:15:03Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/10/GHSA-xcwr-rf3v-pxfj/GHSA-xcwr-rf3v-pxfj.json b/advisories/unreviewed/2024/10/GHSA-xcwr-rf3v-pxfj/GHSA-xcwr-rf3v-pxfj.json new file mode 100644 index 00000000000..a83b221de0d --- /dev/null +++ b/advisories/unreviewed/2024/10/GHSA-xcwr-rf3v-pxfj/GHSA-xcwr-rf3v-pxfj.json @@ -0,0 +1,58 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xcwr-rf3v-pxfj", + "modified": "2024-10-25T00:33:06Z", + "published": "2024-10-25T00:33:06Z", + "aliases": [ + "CVE-2024-10350" + ], + "details": "A vulnerability was found in code-projects Hospital Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/add-doctor.php. The manipulation of the argument docname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10350" + }, + { + "type": "WEB", + "url": "https://github.com/RTio7/cve/issues/1" + }, + { + "type": "WEB", + "url": "https://code-projects.org" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.281698" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.281698" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.427705" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-10-24T23:15:13Z" + } +} \ No newline at end of file