Publish Advisories

GHSA-h5qj-jjhh-95x5
GHSA-wj7r-74h6-3r6w
GHSA-wx2w-96rx-h8gc

advisories/unreviewed/2024/09/GHSA-h5qj-jjhh-95x5/GHSA-h5qj-jjhh-95x5.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-h5qj-jjhh-95x5",
+  "modified": "2024-09-23T06:30:41Z",
+  "published": "2024-09-23T06:30:41Z",
+  "aliases": [
+    "CVE-2024-7846"
+  ],
+  "details": "YITH WooCommerce Ajax Search is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes. This makes it possible for Contributors+ attackers to inject arbitrary scripts.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7846"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/86f7a136-d09b-4637-97ae-2cdaaff172a3"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-23T06:15:04Z"
+  }
+}

advisories/unreviewed/2024/09/GHSA-wj7r-74h6-3r6w/GHSA-wj7r-74h6-3r6w.json

@@ -0,0 +1,51 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wj7r-74h6-3r6w",
+  "modified": "2024-09-23T06:30:41Z",
+  "published": "2024-09-23T06:30:41Z",
+  "aliases": [
+    "CVE-2024-47227"
+  ],
+  "details": "iRedAdmin before 2.6 allows XSS, e.g., via order_name.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47227"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/iredmail/iRedAdmin/commit/3c72b438d412ea3ee0270f6956e19b1098c19191"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/iredmail/iRedAdmin/commit/b537e71ecf522d7f10180f5f0aab4a98a881893a"
+    },
+    {
+      "type": "WEB",
+      "url": "https://docs.iredmail.org/upgrade.iredmail.1.6.8-1.7.0.html#upgrade-iredadmin-open-source-edition-to-the-latest-stable-release-26"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/iredmail/iRedAdmin/compare/2.5...2.6"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.iredmail.org"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-23T04:15:03Z"
+  }
+}

advisories/unreviewed/2024/09/GHSA-wx2w-96rx-h8gc/GHSA-wx2w-96rx-h8gc.json

@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wx2w-96rx-h8gc",
+  "modified": "2024-09-23T06:30:41Z",
+  "published": "2024-09-23T06:30:41Z",
+  "aliases": [
+    "CVE-2024-8758"
+  ],
+  "details": "The Quiz and Survey Master (QSM)  WordPress plugin before 9.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8758"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/d74ecae2-3a1e-4fc7-9dd3-04cef631ecd9"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-23T06:15:04Z"
+  }
+}