Publish Advisories

GHSA-x3c8-vcr7-5m4v
GHSA-2382-xh76-j493
GHSA-3j56-rc6g-pp7q
GHSA-f7pg-xgpm-7pv6
GHSA-rxqj-frff-8mf2

advisories/unreviewed/2023/10/GHSA-x3c8-vcr7-5m4v/GHSA-x3c8-vcr7-5m4v.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-x3c8-vcr7-5m4v",
-  "modified": "2023-11-01T21:30:18Z",
+  "modified": "2024-09-18T06:30:45Z",
   "published": "2023-10-25T18:32:26Z",
   "aliases": [
     "CVE-2023-5568"

advisories/unreviewed/2024/09/GHSA-2382-xh76-j493/GHSA-2382-xh76-j493.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2382-xh76-j493",
+  "modified": "2024-09-18T06:30:46Z",
+  "published": "2024-09-18T06:30:46Z",
+  "aliases": [
+    "CVE-2024-45366"
+  ],
+  "details": "Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the user's web browser.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45366"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jvn.jp/en/jp/JVN19766555"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.welcart.com/archives/22581.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-18T06:15:02Z"
+  }
+}

advisories/unreviewed/2024/09/GHSA-3j56-rc6g-pp7q/GHSA-3j56-rc6g-pp7q.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-3j56-rc6g-pp7q",
+  "modified": "2024-09-18T06:30:46Z",
+  "published": "2024-09-18T06:30:46Z",
+  "aliases": [
+    "CVE-2024-45679"
+  ],
+  "details": "Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.3 allows a local attacker to execute arbitrary code by importing a specially crafted file into the product.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45679"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/assimp/assimp/releases/tag/v5.4.3"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jvn.jp/en/jp/JVN42386607"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-18T04:15:42Z"
+  }
+}

advisories/unreviewed/2024/09/GHSA-f7pg-xgpm-7pv6/GHSA-f7pg-xgpm-7pv6.json

@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-f7pg-xgpm-7pv6",
+  "modified": "2024-09-18T06:30:46Z",
+  "published": "2024-09-18T06:30:46Z",
+  "aliases": [
+    "CVE-2024-42404"
+  ],
+  "details": "SQL injection vulnerability in Welcart e-Commerce prior to 2.11.2 allows an attacker who can login to the product to obtain or alter the information stored in the database.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42404"
+    },
+    {
+      "type": "WEB",
+      "url": "https://jvn.jp/en/jp/JVN19766555"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.welcart.com/archives/22581.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-18T06:15:02Z"
+  }
+}

advisories/unreviewed/2024/09/GHSA-rxqj-frff-8mf2/GHSA-rxqj-frff-8mf2.json

@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rxqj-frff-8mf2",
+  "modified": "2024-09-18T06:30:46Z",
+  "published": "2024-09-18T06:30:46Z",
+  "aliases": [
+    "CVE-2024-6641"
+  ],
+  "details": "The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 1.2.6. This is due to use of an incorrect regular expression within the \"Stop User Enumeration\" feature. This makes it possible for unauthenticated attackers to bypass intended security restrictions and expose site usernames.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6641"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3151308/wp-security-hardening"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a52a278-1729-4027-8a00-e9804fa6698b?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-185"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-18T06:15:02Z"
+  }
+}