From f9ecf71cf52b16a241b416f1d25189ce7b8d230b Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Mon, 23 Sep 2024 06:32:09 +0000
Subject: [PATCH] Publish Advisories

GHSA-h5qj-jjhh-95x5
GHSA-wj7r-74h6-3r6w
GHSA-wx2w-96rx-h8gc
---
 .../GHSA-h5qj-jjhh-95x5.json                  | 35 +++++++++++++
 .../GHSA-wj7r-74h6-3r6w.json                  | 51 +++++++++++++++++++
 .../GHSA-wx2w-96rx-h8gc.json                  | 35 +++++++++++++
 3 files changed, 121 insertions(+)
 create mode 100644 advisories/unreviewed/2024/09/GHSA-h5qj-jjhh-95x5/GHSA-h5qj-jjhh-95x5.json
 create mode 100644 advisories/unreviewed/2024/09/GHSA-wj7r-74h6-3r6w/GHSA-wj7r-74h6-3r6w.json
 create mode 100644 advisories/unreviewed/2024/09/GHSA-wx2w-96rx-h8gc/GHSA-wx2w-96rx-h8gc.json

diff --git a/advisories/unreviewed/2024/09/GHSA-h5qj-jjhh-95x5/GHSA-h5qj-jjhh-95x5.json b/advisories/unreviewed/2024/09/GHSA-h5qj-jjhh-95x5/GHSA-h5qj-jjhh-95x5.json
new file mode 100644
index 00000000000..36fcb331f28
--- /dev/null
+++ b/advisories/unreviewed/2024/09/GHSA-h5qj-jjhh-95x5/GHSA-h5qj-jjhh-95x5.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-h5qj-jjhh-95x5",
+  "modified": "2024-09-23T06:30:41Z",
+  "published": "2024-09-23T06:30:41Z",
+  "aliases": [
+    "CVE-2024-7846"
+  ],
+  "details": "YITH WooCommerce Ajax Search is vulnerable to a XSS vulnerability due to insufficient sanitization of user supplied block attributes. This makes it possible for Contributors+ attackers to inject arbitrary scripts.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7846"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/86f7a136-d09b-4637-97ae-2cdaaff172a3"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-23T06:15:04Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/09/GHSA-wj7r-74h6-3r6w/GHSA-wj7r-74h6-3r6w.json b/advisories/unreviewed/2024/09/GHSA-wj7r-74h6-3r6w/GHSA-wj7r-74h6-3r6w.json
new file mode 100644
index 00000000000..2610851bb5f
--- /dev/null
+++ b/advisories/unreviewed/2024/09/GHSA-wj7r-74h6-3r6w/GHSA-wj7r-74h6-3r6w.json
@@ -0,0 +1,51 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wj7r-74h6-3r6w",
+  "modified": "2024-09-23T06:30:41Z",
+  "published": "2024-09-23T06:30:41Z",
+  "aliases": [
+    "CVE-2024-47227"
+  ],
+  "details": "iRedAdmin before 2.6 allows XSS, e.g., via order_name.",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47227"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/iredmail/iRedAdmin/commit/3c72b438d412ea3ee0270f6956e19b1098c19191"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/iredmail/iRedAdmin/commit/b537e71ecf522d7f10180f5f0aab4a98a881893a"
+    },
+    {
+      "type": "WEB",
+      "url": "https://docs.iredmail.org/upgrade.iredmail.1.6.8-1.7.0.html#upgrade-iredadmin-open-source-edition-to-the-latest-stable-release-26"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/iredmail/iRedAdmin/compare/2.5...2.6"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.iredmail.org"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-23T04:15:03Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/09/GHSA-wx2w-96rx-h8gc/GHSA-wx2w-96rx-h8gc.json b/advisories/unreviewed/2024/09/GHSA-wx2w-96rx-h8gc/GHSA-wx2w-96rx-h8gc.json
new file mode 100644
index 00000000000..c9d6dad1252
--- /dev/null
+++ b/advisories/unreviewed/2024/09/GHSA-wx2w-96rx-h8gc/GHSA-wx2w-96rx-h8gc.json
@@ -0,0 +1,35 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wx2w-96rx-h8gc",
+  "modified": "2024-09-23T06:30:41Z",
+  "published": "2024-09-23T06:30:41Z",
+  "aliases": [
+    "CVE-2024-8758"
+  ],
+  "details": "The Quiz and Survey Master (QSM)  WordPress plugin before 9.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
+  "severity": [
+
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8758"
+    },
+    {
+      "type": "WEB",
+      "url": "https://wpscan.com/vulnerability/d74ecae2-3a1e-4fc7-9dd3-04cef631ecd9"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-09-23T06:15:04Z"
+  }
+}
\ No newline at end of file