From e927d2ec9e6f0ca9eb0284f78014785ea0589918 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Thu, 16 May 2024 03:32:30 +0000 Subject: [PATCH] Publish Advisories GHSA-4cx8-frpf-fjc3 GHSA-6qp6-2ggr-xv6x GHSA-79qq-9x66-f5r5 GHSA-f8fh-g8mv-p7hh GHSA-gj4g-95xx-7pc7 GHSA-hvr3-8pvc-577j GHSA-jf7f-5899-cj5x GHSA-3733-6v6m-39mh GHSA-6xw9-wghr-5p6r GHSA-8q65-g945-2xc2 GHSA-fcgh-hm5r-m53h GHSA-h6hw-6pc7-77rf GHSA-m2gh-p757-6rf2 GHSA-px9h-g363-q9hw GHSA-v8f5-c8jx-hv8g GHSA-xp32-h6c2-42q9 --- .../GHSA-4cx8-frpf-fjc3.json | 1 + .../GHSA-6qp6-2ggr-xv6x.json | 7 ++- .../GHSA-79qq-9x66-f5r5.json | 7 ++- .../GHSA-f8fh-g8mv-p7hh.json | 15 +++++- .../GHSA-gj4g-95xx-7pc7.json | 7 ++- .../GHSA-hvr3-8pvc-577j.json | 6 ++- .../GHSA-jf7f-5899-cj5x.json | 3 +- .../GHSA-3733-6v6m-39mh.json | 50 +++++++++++++++++++ .../GHSA-6xw9-wghr-5p6r.json | 50 +++++++++++++++++++ .../GHSA-8q65-g945-2xc2.json | 50 +++++++++++++++++++ .../GHSA-fcgh-hm5r-m53h.json | 50 +++++++++++++++++++ .../GHSA-h6hw-6pc7-77rf.json | 50 +++++++++++++++++++ .../GHSA-m2gh-p757-6rf2.json | 50 +++++++++++++++++++ .../GHSA-px9h-g363-q9hw.json | 50 +++++++++++++++++++ .../GHSA-v8f5-c8jx-hv8g.json | 50 +++++++++++++++++++ .../GHSA-xp32-h6c2-42q9.json | 50 +++++++++++++++++++ 16 files changed, 486 insertions(+), 10 deletions(-) create mode 100644 advisories/unreviewed/2024/05/GHSA-3733-6v6m-39mh/GHSA-3733-6v6m-39mh.json create mode 100644 advisories/unreviewed/2024/05/GHSA-6xw9-wghr-5p6r/GHSA-6xw9-wghr-5p6r.json create mode 100644 advisories/unreviewed/2024/05/GHSA-8q65-g945-2xc2/GHSA-8q65-g945-2xc2.json create mode 100644 advisories/unreviewed/2024/05/GHSA-fcgh-hm5r-m53h/GHSA-fcgh-hm5r-m53h.json create mode 100644 advisories/unreviewed/2024/05/GHSA-h6hw-6pc7-77rf/GHSA-h6hw-6pc7-77rf.json create mode 100644 advisories/unreviewed/2024/05/GHSA-m2gh-p757-6rf2/GHSA-m2gh-p757-6rf2.json create mode 100644 advisories/unreviewed/2024/05/GHSA-px9h-g363-q9hw/GHSA-px9h-g363-q9hw.json create mode 100644 advisories/unreviewed/2024/05/GHSA-v8f5-c8jx-hv8g/GHSA-v8f5-c8jx-hv8g.json create mode 100644 advisories/unreviewed/2024/05/GHSA-xp32-h6c2-42q9/GHSA-xp32-h6c2-42q9.json diff --git a/advisories/unreviewed/2022/05/GHSA-4cx8-frpf-fjc3/GHSA-4cx8-frpf-fjc3.json b/advisories/unreviewed/2022/05/GHSA-4cx8-frpf-fjc3/GHSA-4cx8-frpf-fjc3.json index c3e69ebed85..b8eb95b0b9b 100644 --- a/advisories/unreviewed/2022/05/GHSA-4cx8-frpf-fjc3/GHSA-4cx8-frpf-fjc3.json +++ b/advisories/unreviewed/2022/05/GHSA-4cx8-frpf-fjc3/GHSA-4cx8-frpf-fjc3.json @@ -28,6 +28,7 @@ ], "database_specific": { "cwe_ids": [ + "CWE-119", "CWE-120" ], "severity": "HIGH", diff --git a/advisories/unreviewed/2022/05/GHSA-6qp6-2ggr-xv6x/GHSA-6qp6-2ggr-xv6x.json b/advisories/unreviewed/2022/05/GHSA-6qp6-2ggr-xv6x/GHSA-6qp6-2ggr-xv6x.json index 26a776767c8..ee13626f021 100644 --- a/advisories/unreviewed/2022/05/GHSA-6qp6-2ggr-xv6x/GHSA-6qp6-2ggr-xv6x.json +++ b/advisories/unreviewed/2022/05/GHSA-6qp6-2ggr-xv6x/GHSA-6qp6-2ggr-xv6x.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-6qp6-2ggr-xv6x", - "modified": "2022-05-24T19:13:46Z", + "modified": "2024-05-16T03:30:44Z", "published": "2022-05-24T19:13:46Z", "aliases": [ "CVE-2021-30761" ], "details": "A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ diff --git a/advisories/unreviewed/2022/05/GHSA-79qq-9x66-f5r5/GHSA-79qq-9x66-f5r5.json b/advisories/unreviewed/2022/05/GHSA-79qq-9x66-f5r5/GHSA-79qq-9x66-f5r5.json index 348ce9b2df0..5276351dd38 100644 --- a/advisories/unreviewed/2022/05/GHSA-79qq-9x66-f5r5/GHSA-79qq-9x66-f5r5.json +++ b/advisories/unreviewed/2022/05/GHSA-79qq-9x66-f5r5/GHSA-79qq-9x66-f5r5.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-79qq-9x66-f5r5", - "modified": "2022-05-24T19:13:29Z", + "modified": "2024-05-16T03:30:44Z", "published": "2022-05-24T19:13:29Z", "aliases": [ "CVE-2021-30661" ], "details": "A use after free issue was addressed with improved memory management. This issue is fixed in Safari 14.1, iOS 12.5.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ diff --git a/advisories/unreviewed/2022/05/GHSA-f8fh-g8mv-p7hh/GHSA-f8fh-g8mv-p7hh.json b/advisories/unreviewed/2022/05/GHSA-f8fh-g8mv-p7hh/GHSA-f8fh-g8mv-p7hh.json index 7ab114b63b1..56f14938024 100644 --- a/advisories/unreviewed/2022/05/GHSA-f8fh-g8mv-p7hh/GHSA-f8fh-g8mv-p7hh.json +++ b/advisories/unreviewed/2022/05/GHSA-f8fh-g8mv-p7hh/GHSA-f8fh-g8mv-p7hh.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-f8fh-g8mv-p7hh", - "modified": "2022-05-24T17:46:24Z", + "modified": "2024-05-16T03:30:44Z", "published": "2022-05-24T17:46:24Z", "aliases": [ "CVE-2021-1870" ], "details": "A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -18,6 +21,14 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1870" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JN6ZOD62CTO54CHTMJTHVEF6R2Y532TJ" diff --git a/advisories/unreviewed/2022/05/GHSA-gj4g-95xx-7pc7/GHSA-gj4g-95xx-7pc7.json b/advisories/unreviewed/2022/05/GHSA-gj4g-95xx-7pc7/GHSA-gj4g-95xx-7pc7.json index a9f9784a027..8ea4676ec2e 100644 --- a/advisories/unreviewed/2022/05/GHSA-gj4g-95xx-7pc7/GHSA-gj4g-95xx-7pc7.json +++ b/advisories/unreviewed/2022/05/GHSA-gj4g-95xx-7pc7/GHSA-gj4g-95xx-7pc7.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-gj4g-95xx-7pc7", - "modified": "2022-05-24T19:13:46Z", + "modified": "2024-05-16T03:30:44Z", "published": "2022-05-24T19:13:46Z", "aliases": [ "CVE-2021-30762" ], "details": "A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ diff --git a/advisories/unreviewed/2022/05/GHSA-hvr3-8pvc-577j/GHSA-hvr3-8pvc-577j.json b/advisories/unreviewed/2022/05/GHSA-hvr3-8pvc-577j/GHSA-hvr3-8pvc-577j.json index 8b69c8e434a..172088afd09 100644 --- a/advisories/unreviewed/2022/05/GHSA-hvr3-8pvc-577j/GHSA-hvr3-8pvc-577j.json +++ b/advisories/unreviewed/2022/05/GHSA-hvr3-8pvc-577j/GHSA-hvr3-8pvc-577j.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-hvr3-8pvc-577j", - "modified": "2022-05-24T17:46:24Z", + "modified": "2024-05-16T03:30:44Z", "published": "2022-05-24T17:46:24Z", "aliases": [ "CVE-2021-1871" @@ -21,6 +21,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-1871" }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU" + }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3L6ZZOU5JS7E3RFYGLP7UFLXCG7TNLU" diff --git a/advisories/unreviewed/2024/04/GHSA-jf7f-5899-cj5x/GHSA-jf7f-5899-cj5x.json b/advisories/unreviewed/2024/04/GHSA-jf7f-5899-cj5x/GHSA-jf7f-5899-cj5x.json index 42051d2f275..6d20704b82b 100644 --- a/advisories/unreviewed/2024/04/GHSA-jf7f-5899-cj5x/GHSA-jf7f-5899-cj5x.json +++ b/advisories/unreviewed/2024/04/GHSA-jf7f-5899-cj5x/GHSA-jf7f-5899-cj5x.json @@ -36,7 +36,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-400" + "CWE-400", + "CWE-770" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2024/05/GHSA-3733-6v6m-39mh/GHSA-3733-6v6m-39mh.json b/advisories/unreviewed/2024/05/GHSA-3733-6v6m-39mh/GHSA-3733-6v6m-39mh.json new file mode 100644 index 00000000000..3e5e4312029 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-3733-6v6m-39mh/GHSA-3733-6v6m-39mh.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3733-6v6m-39mh", + "modified": "2024-05-16T03:30:45Z", + "published": "2024-05-16T03:30:45Z", + "aliases": [ + "CVE-2024-4984" + ], + "details": "The Yoast SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ author meta in all versions up to, and including, 22.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4984" + }, + { + "type": "WEB", + "url": "https://github.com/Yoast/wordpress-seo/pull/21334" + }, + { + "type": "WEB", + "url": "https://developer.yoast.com/changelog/yoast-seo/22.7" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3079234/wordpress-seo/trunk/src/presenters/slack/enhanced-data-presenter.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/59bcd246-ca2f-4336-9a6e-89afe873ed25?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-16T02:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-6xw9-wghr-5p6r/GHSA-6xw9-wghr-5p6r.json b/advisories/unreviewed/2024/05/GHSA-6xw9-wghr-5p6r/GHSA-6xw9-wghr-5p6r.json new file mode 100644 index 00000000000..88c3cf705c6 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-6xw9-wghr-5p6r/GHSA-6xw9-wghr-5p6r.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6xw9-wghr-5p6r", + "modified": "2024-05-16T03:30:45Z", + "published": "2024-05-16T03:30:44Z", + "aliases": [ + "CVE-2024-4926" + ], + "details": "A vulnerability was found in SourceCodester School Intramurals Student Attendance Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /intrams_sams/manage_student.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-264462 is the identifier assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4926" + }, + { + "type": "WEB", + "url": "https://github.com/Hefei-Coffee/cve/blob/main/sql7.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.264462" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.264462" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.333879" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-16T02:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-8q65-g945-2xc2/GHSA-8q65-g945-2xc2.json b/advisories/unreviewed/2024/05/GHSA-8q65-g945-2xc2/GHSA-8q65-g945-2xc2.json new file mode 100644 index 00000000000..e899fcc28eb --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-8q65-g945-2xc2/GHSA-8q65-g945-2xc2.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8q65-g945-2xc2", + "modified": "2024-05-16T03:30:45Z", + "published": "2024-05-16T03:30:45Z", + "aliases": [ + "CVE-2024-3750" + ], + "details": "The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on the getQueryData() function in all versions up to, and including, 3.10.15. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform arbitrary SQL queries that can be leveraged for privilege escalation among many other actions.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3750" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/browser/visualizer/trunk/classes/Visualizer/Module/Chart.php#L1421" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3086048/visualizer/tags/3.11.0/classes/Visualizer/Module/Chart.php" + }, + { + "type": "WEB", + "url": "https://plugins.trac.wordpress.org/changeset/3086048/visualizer/tags/3.11.0/classes/Visualizer/Source/Query.php" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6d27544c-97a5-42cd-ab07-358f819acbc4?source=cve" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-16T03:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-fcgh-hm5r-m53h/GHSA-fcgh-hm5r-m53h.json b/advisories/unreviewed/2024/05/GHSA-fcgh-hm5r-m53h/GHSA-fcgh-hm5r-m53h.json new file mode 100644 index 00000000000..4ad21c0e43f --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-fcgh-hm5r-m53h/GHSA-fcgh-hm5r-m53h.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fcgh-hm5r-m53h", + "modified": "2024-05-16T03:30:45Z", + "published": "2024-05-16T03:30:45Z", + "aliases": [ + "CVE-2024-4927" + ], + "details": "A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /simple-online-bidding-system/admin/ajax.php?action=save_product. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264463.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4927" + }, + { + "type": "WEB", + "url": "https://github.com/Hefei-Coffee/cve/blob/main/upload2.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.264463" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.264463" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.333891" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-16T03:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-h6hw-6pc7-77rf/GHSA-h6hw-6pc7-77rf.json b/advisories/unreviewed/2024/05/GHSA-h6hw-6pc7-77rf/GHSA-h6hw-6pc7-77rf.json new file mode 100644 index 00000000000..7b0df4cd6a4 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-h6hw-6pc7-77rf/GHSA-h6hw-6pc7-77rf.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h6hw-6pc7-77rf", + "modified": "2024-05-16T03:30:45Z", + "published": "2024-05-16T03:30:45Z", + "aliases": [ + "CVE-2024-4928" + ], + "details": "A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /simple-online-bidding-system/admin/ajax.php?action=delete_category. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264464.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4928" + }, + { + "type": "WEB", + "url": "https://github.com/Hefei-Coffee/cve/blob/main/sql8.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.264464" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.264464" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.333893" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-16T03:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-m2gh-p757-6rf2/GHSA-m2gh-p757-6rf2.json b/advisories/unreviewed/2024/05/GHSA-m2gh-p757-6rf2/GHSA-m2gh-p757-6rf2.json new file mode 100644 index 00000000000..c6a49f8e5c2 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-m2gh-p757-6rf2/GHSA-m2gh-p757-6rf2.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m2gh-p757-6rf2", + "modified": "2024-05-16T03:30:44Z", + "published": "2024-05-16T03:30:44Z", + "aliases": [ + "CVE-2024-4922" + ], + "details": "A vulnerability, which was classified as problematic, was found in SourceCodester Simple Image Stack Website 1.0. This affects an unknown part. The manipulation of the argument page leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264459.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4922" + }, + { + "type": "WEB", + "url": "https://github.com/HuoMingZ/aoligei/blob/main/ceshi.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.264459" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.264459" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.333760" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-16T01:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-px9h-g363-q9hw/GHSA-px9h-g363-q9hw.json b/advisories/unreviewed/2024/05/GHSA-px9h-g363-q9hw/GHSA-px9h-g363-q9hw.json new file mode 100644 index 00000000000..e8cab7d89fd --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-px9h-g363-q9hw/GHSA-px9h-g363-q9hw.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-px9h-g363-q9hw", + "modified": "2024-05-16T03:30:44Z", + "published": "2024-05-16T03:30:44Z", + "aliases": [ + "CVE-2024-4921" + ], + "details": "A vulnerability classified as critical has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Affected is an unknown function of the file /employee_gatepass/classes/Users.php?f=ssave. The manipulation of the argument img leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264456.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4921" + }, + { + "type": "WEB", + "url": "https://github.com/I-Schnee-I/cev/blob/main/upload.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.264456" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.264456" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.333662" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-16T01:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-v8f5-c8jx-hv8g/GHSA-v8f5-c8jx-hv8g.json b/advisories/unreviewed/2024/05/GHSA-v8f5-c8jx-hv8g/GHSA-v8f5-c8jx-hv8g.json new file mode 100644 index 00000000000..8d48f08dc96 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-v8f5-c8jx-hv8g/GHSA-v8f5-c8jx-hv8g.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v8f5-c8jx-hv8g", + "modified": "2024-05-16T03:30:45Z", + "published": "2024-05-16T03:30:44Z", + "aliases": [ + "CVE-2024-4923" + ], + "details": "A vulnerability has been found in Codezips E-Commerce Site 1.0 and classified as critical. This vulnerability affects unknown code of the file admin/addproduct.php. The manipulation of the argument profilepic leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264460.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4923" + }, + { + "type": "WEB", + "url": "https://github.com/polaris0x1/CVE/issues/1" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.264460" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.264460" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.333874" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-434" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-16T02:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/05/GHSA-xp32-h6c2-42q9/GHSA-xp32-h6c2-42q9.json b/advisories/unreviewed/2024/05/GHSA-xp32-h6c2-42q9/GHSA-xp32-h6c2-42q9.json new file mode 100644 index 00000000000..ca28dbc6e28 --- /dev/null +++ b/advisories/unreviewed/2024/05/GHSA-xp32-h6c2-42q9/GHSA-xp32-h6c2-42q9.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-xp32-h6c2-42q9", + "modified": "2024-05-16T03:30:45Z", + "published": "2024-05-16T03:30:45Z", + "aliases": [ + "CVE-2024-4925" + ], + "details": "A vulnerability was found in SourceCodester School Intramurals Student Attendance Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /intrams_sams/manage_course.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264461 was assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4925" + }, + { + "type": "WEB", + "url": "https://github.com/Hefei-Coffee/cve/blob/main/sql6.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.264461" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.264461" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?submit.333875" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-05-16T02:15:08Z" + } +} \ No newline at end of file