From f2253f9e8ab6bad194a97ba764ce447abc26424e Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 17 Dec 2024 06:32:20 +0000 Subject: [PATCH] Publish Advisories GHSA-3xqq-gq4x-8c9g GHSA-69c6-ccv7-v3g3 GHSA-6wm5-g9m5-854v GHSA-883f-932m-665g GHSA-9pqf-c964-4pgp GHSA-v5j5-586p-q8qm --- .../GHSA-3xqq-gq4x-8c9g.json | 36 +++++++++++++++ .../GHSA-69c6-ccv7-v3g3.json | 40 +++++++++++++++++ .../GHSA-6wm5-g9m5-854v.json | 40 +++++++++++++++++ .../GHSA-883f-932m-665g.json | 36 +++++++++++++++ .../GHSA-9pqf-c964-4pgp.json | 44 +++++++++++++++++++ .../GHSA-v5j5-586p-q8qm.json | 40 +++++++++++++++++ 6 files changed, 236 insertions(+) create mode 100644 advisories/unreviewed/2024/12/GHSA-3xqq-gq4x-8c9g/GHSA-3xqq-gq4x-8c9g.json create mode 100644 advisories/unreviewed/2024/12/GHSA-69c6-ccv7-v3g3/GHSA-69c6-ccv7-v3g3.json create mode 100644 advisories/unreviewed/2024/12/GHSA-6wm5-g9m5-854v/GHSA-6wm5-g9m5-854v.json create mode 100644 advisories/unreviewed/2024/12/GHSA-883f-932m-665g/GHSA-883f-932m-665g.json create mode 100644 advisories/unreviewed/2024/12/GHSA-9pqf-c964-4pgp/GHSA-9pqf-c964-4pgp.json create mode 100644 advisories/unreviewed/2024/12/GHSA-v5j5-586p-q8qm/GHSA-v5j5-586p-q8qm.json diff --git a/advisories/unreviewed/2024/12/GHSA-3xqq-gq4x-8c9g/GHSA-3xqq-gq4x-8c9g.json b/advisories/unreviewed/2024/12/GHSA-3xqq-gq4x-8c9g/GHSA-3xqq-gq4x-8c9g.json new file mode 100644 index 00000000000..9c2b64fe127 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-3xqq-gq4x-8c9g/GHSA-3xqq-gq4x-8c9g.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3xqq-gq4x-8c9g", + "modified": "2024-12-17T06:30:31Z", + "published": "2024-12-17T06:30:31Z", + "aliases": [ + "CVE-2021-26279" + ], + "details": "Some parameters of the weather module are improperly stored, leaking some sensitive information.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26279" + }, + { + "type": "WEB", + "url": "https://www.vivo.com/en/support/security-advisory-detail?id=10" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-17T04:15:05Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-69c6-ccv7-v3g3/GHSA-69c6-ccv7-v3g3.json b/advisories/unreviewed/2024/12/GHSA-69c6-ccv7-v3g3/GHSA-69c6-ccv7-v3g3.json new file mode 100644 index 00000000000..2e5697e9010 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-69c6-ccv7-v3g3/GHSA-69c6-ccv7-v3g3.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-69c6-ccv7-v3g3", + "modified": "2024-12-17T06:30:32Z", + "published": "2024-12-17T06:30:32Z", + "aliases": [ + "CVE-2024-12356" + ], + "details": "A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12356" + }, + { + "type": "WEB", + "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt24-10" + }, + { + "type": "WEB", + "url": "https://www.cve.org/CVERecord?id=CVE-2024-12356" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-77" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-17T05:15:06Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-6wm5-g9m5-854v/GHSA-6wm5-g9m5-854v.json b/advisories/unreviewed/2024/12/GHSA-6wm5-g9m5-854v/GHSA-6wm5-g9m5-854v.json new file mode 100644 index 00000000000..cb0f5c4f106 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-6wm5-g9m5-854v/GHSA-6wm5-g9m5-854v.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-6wm5-g9m5-854v", + "modified": "2024-12-17T06:30:33Z", + "published": "2024-12-17T06:30:33Z", + "aliases": [ + "CVE-2024-54125" + ], + "details": "Improper authorization in handler for custom URL scheme issue in \"Shonen Jump+\" App for Android versions prior to 4.0.0 allows an attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54125" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/jp/JVN08430039" + }, + { + "type": "WEB", + "url": "https://shonenjumpplus.com/article/info20241216" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-939" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-17T06:15:21Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-883f-932m-665g/GHSA-883f-932m-665g.json b/advisories/unreviewed/2024/12/GHSA-883f-932m-665g/GHSA-883f-932m-665g.json new file mode 100644 index 00000000000..6c43f527927 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-883f-932m-665g/GHSA-883f-932m-665g.json @@ -0,0 +1,36 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-883f-932m-665g", + "modified": "2024-12-17T06:30:33Z", + "published": "2024-12-17T06:30:33Z", + "aliases": [ + "CVE-2024-38499" + ], + "details": "CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admin user to access the critical encryption keys which further causes the exploitation of stored credentials. This fix doesn't allow a non-admin/non-root user to execute \"caf encrypt\"/\"sd_acmd encrypt\" commands.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38499" + }, + { + "type": "WEB", + "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25284" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-17T06:15:20Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-9pqf-c964-4pgp/GHSA-9pqf-c964-4pgp.json b/advisories/unreviewed/2024/12/GHSA-9pqf-c964-4pgp/GHSA-9pqf-c964-4pgp.json new file mode 100644 index 00000000000..210f85f690d --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-9pqf-c964-4pgp/GHSA-9pqf-c964-4pgp.json @@ -0,0 +1,44 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9pqf-c964-4pgp", + "modified": "2024-12-17T06:30:32Z", + "published": "2024-12-17T06:30:32Z", + "aliases": [ + "CVE-2024-55864" + ], + "details": "Cross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver 1.24.1. If a malicious administrative user customizes the administrative page with some malicious contents, an arbitrary script may be executed on the web browser of the other users who are accessing the page.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55864" + }, + { + "type": "WEB", + "url": "https://jvn.jp/en/vu/JVNVU90748215" + }, + { + "type": "WEB", + "url": "https://mywpcustomize.com/update-history-my-wp-customize-admin-frontend-1-24-1" + }, + { + "type": "WEB", + "url": "https://wordpress.org/plugins/my-wp/#developers" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-17T05:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/12/GHSA-v5j5-586p-q8qm/GHSA-v5j5-586p-q8qm.json b/advisories/unreviewed/2024/12/GHSA-v5j5-586p-q8qm/GHSA-v5j5-586p-q8qm.json new file mode 100644 index 00000000000..eb7df5a0ca0 --- /dev/null +++ b/advisories/unreviewed/2024/12/GHSA-v5j5-586p-q8qm/GHSA-v5j5-586p-q8qm.json @@ -0,0 +1,40 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v5j5-586p-q8qm", + "modified": "2024-12-17T06:30:34Z", + "published": "2024-12-17T06:30:34Z", + "aliases": [ + "CVE-2024-9624" + ], + "details": "The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxi_curl_download function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On cloud platforms, it might allow attackers to read the Instance metadata.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N" + } + ], + "affected": [], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9624" + }, + { + "type": "WEB", + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eabde2e7-5cd4-4c3e-959a-69e04f6350d3?source=cve" + }, + { + "type": "WEB", + "url": "https://www.wpallimport.com" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2024-12-17T06:15:21Z" + } +} \ No newline at end of file