diff --git a/advisories/unreviewed/2022/08/GHSA-3j9x-j374-vq65/GHSA-3j9x-j374-vq65.json b/advisories/unreviewed/2022/08/GHSA-3j9x-j374-vq65/GHSA-3j9x-j374-vq65.json index 309cc892142..2cc2bac5954 100644 --- a/advisories/unreviewed/2022/08/GHSA-3j9x-j374-vq65/GHSA-3j9x-j374-vq65.json +++ b/advisories/unreviewed/2022/08/GHSA-3j9x-j374-vq65/GHSA-3j9x-j374-vq65.json @@ -25,10 +25,18 @@ "type": "WEB", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1200190" }, + { + "type": "WEB", + "url": "https://lore.kernel.org/connman/20220801080043.4861-1-wagi%40monom.org/" + }, { "type": "WEB", "url": "https://lore.kernel.org/connman/20220801080043.4861-1-wagi@monom.org/" }, + { + "type": "WEB", + "url": "https://lore.kernel.org/connman/20220801080043.4861-3-wagi%40monom.org/" + }, { "type": "WEB", "url": "https://lore.kernel.org/connman/20220801080043.4861-3-wagi@monom.org/" diff --git a/advisories/unreviewed/2022/08/GHSA-vv44-5xgw-mx5v/GHSA-vv44-5xgw-mx5v.json b/advisories/unreviewed/2022/08/GHSA-vv44-5xgw-mx5v/GHSA-vv44-5xgw-mx5v.json index b59fc3493af..7b140d01c3b 100644 --- a/advisories/unreviewed/2022/08/GHSA-vv44-5xgw-mx5v/GHSA-vv44-5xgw-mx5v.json +++ b/advisories/unreviewed/2022/08/GHSA-vv44-5xgw-mx5v/GHSA-vv44-5xgw-mx5v.json @@ -25,6 +25,10 @@ "type": "WEB", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1200189" }, + { + "type": "WEB", + "url": "https://lore.kernel.org/connman/20220801080043.4861-5-wagi%40monom.org/" + }, { "type": "WEB", "url": "https://lore.kernel.org/connman/20220801080043.4861-5-wagi@monom.org/" diff --git a/advisories/unreviewed/2023/12/GHSA-226h-h99r-j24r/GHSA-226h-h99r-j24r.json b/advisories/unreviewed/2023/12/GHSA-226h-h99r-j24r/GHSA-226h-h99r-j24r.json new file mode 100644 index 00000000000..defadd837de --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-226h-h99r-j24r/GHSA-226h-h99r-j24r.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-226h-h99r-j24r", + "modified": "2023-12-21T21:30:32Z", + "published": "2023-12-21T21:30:32Z", + "aliases": [ + "CVE-2023-48722" + ], + "details": "Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter of the add_results.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48722" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/gilels/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-2865-jgr8-fxmw/GHSA-2865-jgr8-fxmw.json b/advisories/unreviewed/2023/12/GHSA-2865-jgr8-fxmw/GHSA-2865-jgr8-fxmw.json new file mode 100644 index 00000000000..cddeca69406 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-2865-jgr8-fxmw/GHSA-2865-jgr8-fxmw.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2865-jgr8-fxmw", + "modified": "2023-12-21T21:30:30Z", + "published": "2023-12-21T21:30:30Z", + "aliases": [ + "CVE-2023-44482" + ], + "details": "Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setsickleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44482" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/martin/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T19:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-29p2-7jvf-2jvf/GHSA-29p2-7jvf-2jvf.json b/advisories/unreviewed/2023/12/GHSA-29p2-7jvf-2jvf/GHSA-29p2-7jvf-2jvf.json new file mode 100644 index 00000000000..1310102d51e --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-29p2-7jvf-2jvf/GHSA-29p2-7jvf-2jvf.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-29p2-7jvf-2jvf", + "modified": "2023-12-21T21:30:32Z", + "published": "2023-12-21T21:30:32Z", + "aliases": [ + "CVE-2023-48719" + ], + "details": "Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'roll_no' parameter of the add_students.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48719" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/gilels/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-2q88-68x3-v4pp/GHSA-2q88-68x3-v4pp.json b/advisories/unreviewed/2023/12/GHSA-2q88-68x3-v4pp/GHSA-2q88-68x3-v4pp.json index 6c5af47b260..645ce90f583 100644 --- a/advisories/unreviewed/2023/12/GHSA-2q88-68x3-v4pp/GHSA-2q88-68x3-v4pp.json +++ b/advisories/unreviewed/2023/12/GHSA-2q88-68x3-v4pp/GHSA-2q88-68x3-v4pp.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-2q88-68x3-v4pp", - "modified": "2023-12-18T21:30:28Z", + "modified": "2023-12-21T21:30:30Z", "published": "2023-12-18T21:30:28Z", "aliases": [ "CVE-2023-6203" ], "details": "The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted request", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-18T20:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-2xj9-j5v2-96c8/GHSA-2xj9-j5v2-96c8.json b/advisories/unreviewed/2023/12/GHSA-2xj9-j5v2-96c8/GHSA-2xj9-j5v2-96c8.json new file mode 100644 index 00000000000..e301393ab5c --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-2xj9-j5v2-96c8/GHSA-2xj9-j5v2-96c8.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2xj9-j5v2-96c8", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-48686" + ], + "details": "Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'user' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48686" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/barenboim/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-33gj-cgfq-5j2j/GHSA-33gj-cgfq-5j2j.json b/advisories/unreviewed/2023/12/GHSA-33gj-cgfq-5j2j/GHSA-33gj-cgfq-5j2j.json new file mode 100644 index 00000000000..6c9e687ff3a --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-33gj-cgfq-5j2j/GHSA-33gj-cgfq-5j2j.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-33gj-cgfq-5j2j", + "modified": "2023-12-21T21:30:30Z", + "published": "2023-12-21T21:30:30Z", + "aliases": [ + "CVE-2023-49765" + ], + "details": "Authorization Bypass Through User-Controlled Key vulnerability in Blaz K. Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.1.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49765" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/rate-my-post/wordpress-rate-my-post-wp-rating-system-plugin-3-4-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-639" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T19:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-33gw-pvgj-248f/GHSA-33gw-pvgj-248f.json b/advisories/unreviewed/2023/12/GHSA-33gw-pvgj-248f/GHSA-33gw-pvgj-248f.json new file mode 100644 index 00000000000..8d2f6235b66 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-33gw-pvgj-248f/GHSA-33gw-pvgj-248f.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-33gw-pvgj-248f", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-7040" + ], + "details": "A vulnerability classified as problematic was found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this vulnerability is an unknown functionality of the file /file-manager/rename.php. The manipulation of the argument oldName leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248689 was assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7040" + }, + { + "type": "WEB", + "url": "https://github.com/g1an123/POC/blob/main/Unauthorized%20file%20read.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.248689" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.248689" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-24" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T20:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-35r8-c3gc-mfvr/GHSA-35r8-c3gc-mfvr.json b/advisories/unreviewed/2023/12/GHSA-35r8-c3gc-mfvr/GHSA-35r8-c3gc-mfvr.json new file mode 100644 index 00000000000..1afa2f01cb4 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-35r8-c3gc-mfvr/GHSA-35r8-c3gc-mfvr.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-35r8-c3gc-mfvr", + "modified": "2023-12-21T21:30:30Z", + "published": "2023-12-21T21:30:30Z", + "aliases": [ + "CVE-2023-44481" + ], + "details": "Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setearnleave' parameter of the admin/setleaves.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44481" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/martin/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T19:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-35xx-3fgf-hr8m/GHSA-35xx-3fgf-hr8m.json b/advisories/unreviewed/2023/12/GHSA-35xx-3fgf-hr8m/GHSA-35xx-3fgf-hr8m.json index d0841f1dee6..f58ec92ef13 100644 --- a/advisories/unreviewed/2023/12/GHSA-35xx-3fgf-hr8m/GHSA-35xx-3fgf-hr8m.json +++ b/advisories/unreviewed/2023/12/GHSA-35xx-3fgf-hr8m/GHSA-35xx-3fgf-hr8m.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-35xx-3fgf-hr8m", - "modified": "2023-12-18T18:30:21Z", + "modified": "2023-12-21T21:30:29Z", "published": "2023-12-18T18:30:21Z", "aliases": [ "CVE-2023-33214" diff --git a/advisories/unreviewed/2023/12/GHSA-3f35-5jmv-gjvp/GHSA-3f35-5jmv-gjvp.json b/advisories/unreviewed/2023/12/GHSA-3f35-5jmv-gjvp/GHSA-3f35-5jmv-gjvp.json new file mode 100644 index 00000000000..ccc6345a9e5 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-3f35-5jmv-gjvp/GHSA-3f35-5jmv-gjvp.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3f35-5jmv-gjvp", + "modified": "2023-12-21T21:30:30Z", + "published": "2023-12-21T21:30:30Z", + "aliases": [ + "CVE-2023-32747" + ], + "details": "Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1.15.78.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32747" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/woocommerce-bookings/wordpress-woocommerce-bookings-plugin-1-15-78-insecure-direct-object-references-idor-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-639" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T19:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-3vmh-w4rr-25j3/GHSA-3vmh-w4rr-25j3.json b/advisories/unreviewed/2023/12/GHSA-3vmh-w4rr-25j3/GHSA-3vmh-w4rr-25j3.json new file mode 100644 index 00000000000..89792c66178 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-3vmh-w4rr-25j3/GHSA-3vmh-w4rr-25j3.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3vmh-w4rr-25j3", + "modified": "2023-12-21T21:30:32Z", + "published": "2023-12-21T21:30:32Z", + "aliases": [ + "CVE-2023-6802" + ], + "details": "An insertion of sensitive information into the log file in the audit log in GitHub Enterprise Server was identified that could allow an attacker to gain access to the management console. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. ", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6802" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-5fwq-2hqv-g62h/GHSA-5fwq-2hqv-g62h.json b/advisories/unreviewed/2023/12/GHSA-5fwq-2hqv-g62h/GHSA-5fwq-2hqv-g62h.json new file mode 100644 index 00000000000..b8ca6985d73 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-5fwq-2hqv-g62h/GHSA-5fwq-2hqv-g62h.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5fwq-2hqv-g62h", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-46646" + ], + "details": "Improper access control in all versions of GitHub Enterprise Server allows unauthorized users to view private repository names via the \"Get a check run\" API endpoint. This vulnerability did not allow unauthorized access to any repository content besides the name. This vulnerability affected GitHub Enterprise Server version 3.7.0 and above and was fixed in version 3.17.19, 3.8.12, 3.9.7 3.10.4, and 3.11.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46646" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-639" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-5qcg-f6q9-5q2r/GHSA-5qcg-f6q9-5q2r.json b/advisories/unreviewed/2023/12/GHSA-5qcg-f6q9-5q2r/GHSA-5qcg-f6q9-5q2r.json index 2a50e837cb1..9bd1641f2a2 100644 --- a/advisories/unreviewed/2023/12/GHSA-5qcg-f6q9-5q2r/GHSA-5qcg-f6q9-5q2r.json +++ b/advisories/unreviewed/2023/12/GHSA-5qcg-f6q9-5q2r/GHSA-5qcg-f6q9-5q2r.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-121" + "CWE-121", + "CWE-787" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/12/GHSA-62v3-x9j5-g8rj/GHSA-62v3-x9j5-g8rj.json b/advisories/unreviewed/2023/12/GHSA-62v3-x9j5-g8rj/GHSA-62v3-x9j5-g8rj.json new file mode 100644 index 00000000000..415243cc8f5 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-62v3-x9j5-g8rj/GHSA-62v3-x9j5-g8rj.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-62v3-x9j5-g8rj", + "modified": "2023-12-21T21:30:32Z", + "published": "2023-12-21T21:30:32Z", + "aliases": [ + "CVE-2023-48718" + ], + "details": "Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter of the add_students.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48718" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/gilels/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-64q3-rq3x-xvfj/GHSA-64q3-rq3x-xvfj.json b/advisories/unreviewed/2023/12/GHSA-64q3-rq3x-xvfj/GHSA-64q3-rq3x-xvfj.json new file mode 100644 index 00000000000..33379d1d769 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-64q3-rq3x-xvfj/GHSA-64q3-rq3x-xvfj.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-64q3-rq3x-xvfj", + "modified": "2023-12-21T21:30:32Z", + "published": "2023-12-21T21:30:32Z", + "aliases": [ + "CVE-2023-6804" + ], + "details": "Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have already existed in the target repo. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. \n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6804" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-67c4-7f3g-r556/GHSA-67c4-7f3g-r556.json b/advisories/unreviewed/2023/12/GHSA-67c4-7f3g-r556/GHSA-67c4-7f3g-r556.json new file mode 100644 index 00000000000..26170d8489e --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-67c4-7f3g-r556/GHSA-67c4-7f3g-r556.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-67c4-7f3g-r556", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-41097" + ], + "details": "An Observable Timing Discrepancy, Covert Timing Channel vulnerability in Silabs GSDK on ARM potentially allows Padding Oracle Crypto Attack on CBC PKCS7.This issue affects GSDK: through 4.4.0.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41097" + }, + { + "type": "WEB", + "url": "https://github.com/SiliconLabs/gecko_sdk/releases" + }, + { + "type": "WEB", + "url": "https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/069Vm0000007rArIAI?operationContext=S1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-208" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-73xg-5xg9-crjv/GHSA-73xg-5xg9-crjv.json b/advisories/unreviewed/2023/12/GHSA-73xg-5xg9-crjv/GHSA-73xg-5xg9-crjv.json index c3dd74a1dc2..df64c91d92d 100644 --- a/advisories/unreviewed/2023/12/GHSA-73xg-5xg9-crjv/GHSA-73xg-5xg9-crjv.json +++ b/advisories/unreviewed/2023/12/GHSA-73xg-5xg9-crjv/GHSA-73xg-5xg9-crjv.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-73xg-5xg9-crjv", - "modified": "2023-12-18T21:30:27Z", + "modified": "2023-12-21T21:30:30Z", "published": "2023-12-18T21:30:27Z", "aliases": [ "CVE-2023-6077" ], "details": "The Slider WordPress plugin before 3.5.12 does not ensure that posts to be accessed via an AJAX action are slides and can be viewed by the user making the request, allowing any authenticated users, such as subscriber to access the content arbitrary post such as private, draft and password protected", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-18T20:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-7674-425x-p4qw/GHSA-7674-425x-p4qw.json b/advisories/unreviewed/2023/12/GHSA-7674-425x-p4qw/GHSA-7674-425x-p4qw.json new file mode 100644 index 00000000000..f1b2efcb537 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-7674-425x-p4qw/GHSA-7674-425x-p4qw.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7674-425x-p4qw", + "modified": "2023-12-21T21:30:30Z", + "published": "2023-12-21T21:30:30Z", + "aliases": [ + "CVE-2023-7039" + ], + "details": "A vulnerability classified as critical has been found in Beijing Baichuo S210 up to 20231210. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248688.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7039" + }, + { + "type": "WEB", + "url": "https://github.com/Stitch3612/cve/blob/main/rce.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.248688" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.248688" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-74" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T19:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-7cr4-32jg-hwx2/GHSA-7cr4-32jg-hwx2.json b/advisories/unreviewed/2023/12/GHSA-7cr4-32jg-hwx2/GHSA-7cr4-32jg-hwx2.json index bb758bde61d..53977acb05a 100644 --- a/advisories/unreviewed/2023/12/GHSA-7cr4-32jg-hwx2/GHSA-7cr4-32jg-hwx2.json +++ b/advisories/unreviewed/2023/12/GHSA-7cr4-32jg-hwx2/GHSA-7cr4-32jg-hwx2.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-7cr4-32jg-hwx2", - "modified": "2023-12-18T21:30:27Z", + "modified": "2023-12-21T21:30:29Z", "published": "2023-12-18T21:30:27Z", "aliases": [ "CVE-2023-5005" ], "details": "The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-18T20:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-7ff9-r6g6-8956/GHSA-7ff9-r6g6-8956.json b/advisories/unreviewed/2023/12/GHSA-7ff9-r6g6-8956/GHSA-7ff9-r6g6-8956.json new file mode 100644 index 00000000000..a985f0440b3 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-7ff9-r6g6-8956/GHSA-7ff9-r6g6-8956.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7ff9-r6g6-8956", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-48689" + ], + "details": "Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'byname' parameter of the train.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48689" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/barenboim/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-7x7j-52gx-4h55/GHSA-7x7j-52gx-4h55.json b/advisories/unreviewed/2023/12/GHSA-7x7j-52gx-4h55/GHSA-7x7j-52gx-4h55.json index 99012474c5e..fbc0f9506e4 100644 --- a/advisories/unreviewed/2023/12/GHSA-7x7j-52gx-4h55/GHSA-7x7j-52gx-4h55.json +++ b/advisories/unreviewed/2023/12/GHSA-7x7j-52gx-4h55/GHSA-7x7j-52gx-4h55.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-7x7j-52gx-4h55", - "modified": "2023-12-18T21:30:27Z", + "modified": "2023-12-21T21:30:29Z", "published": "2023-12-18T21:30:27Z", "aliases": [ "CVE-2023-4311" ], "details": "The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 is vulnerable to arbitrary file upload due to insufficient checks in a plugin shortcode.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-434" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-18T20:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-7xp2-7hw7-rv8q/GHSA-7xp2-7hw7-rv8q.json b/advisories/unreviewed/2023/12/GHSA-7xp2-7hw7-rv8q/GHSA-7xp2-7hw7-rv8q.json index f367b003684..53ff2133293 100644 --- a/advisories/unreviewed/2023/12/GHSA-7xp2-7hw7-rv8q/GHSA-7xp2-7hw7-rv8q.json +++ b/advisories/unreviewed/2023/12/GHSA-7xp2-7hw7-rv8q/GHSA-7xp2-7hw7-rv8q.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-7xp2-7hw7-rv8q", - "modified": "2023-12-18T21:30:27Z", + "modified": "2023-12-21T21:30:30Z", "published": "2023-12-18T21:30:27Z", "aliases": [ "CVE-2023-5882" ], "details": "The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-18T20:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-84pc-mjpf-2cmc/GHSA-84pc-mjpf-2cmc.json b/advisories/unreviewed/2023/12/GHSA-84pc-mjpf-2cmc/GHSA-84pc-mjpf-2cmc.json new file mode 100644 index 00000000000..af63b569a22 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-84pc-mjpf-2cmc/GHSA-84pc-mjpf-2cmc.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-84pc-mjpf-2cmc", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-7041" + ], + "details": "A vulnerability, which was classified as critical, has been found in codelyfe Stupid Simple CMS up to 1.2.4. Affected by this issue is some unknown functionality of the file /file-manager/rename.php. The manipulation of the argument newName leads to path traversal: '../filedir'. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248690 is the identifier assigned to this vulnerability.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7041" + }, + { + "type": "WEB", + "url": "https://github.com/g1an123/POC/blob/main/Unauthorized%20file%20overwrite.md" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?ctiid.248690" + }, + { + "type": "WEB", + "url": "https://vuldb.com/?id.248690" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-24" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T20:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-8v6c-qh84-8jrv/GHSA-8v6c-qh84-8jrv.json b/advisories/unreviewed/2023/12/GHSA-8v6c-qh84-8jrv/GHSA-8v6c-qh84-8jrv.json new file mode 100644 index 00000000000..01d538e163c --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-8v6c-qh84-8jrv/GHSA-8v6c-qh84-8jrv.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-8v6c-qh84-8jrv", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-46791" + ], + "details": "Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'filename' attribute of the 'pic3' multipart parameter of the functions.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46791" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/ros" + }, + { + "type": "WEB", + "url": "https://projectworlds.in" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T20:15:07Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-9f9g-fjv5-h5g7/GHSA-9f9g-fjv5-h5g7.json b/advisories/unreviewed/2023/12/GHSA-9f9g-fjv5-h5g7/GHSA-9f9g-fjv5-h5g7.json new file mode 100644 index 00000000000..1b175f2582c --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-9f9g-fjv5-h5g7/GHSA-9f9g-fjv5-h5g7.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9f9g-fjv5-h5g7", + "modified": "2023-12-21T21:30:32Z", + "published": "2023-12-21T21:30:32Z", + "aliases": [ + "CVE-2023-51379" + ], + "details": "An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be updated with an improperly scoped token. This vulnerability did not allow unauthorized access to any repository content as it also required contents:write and issues:read permissions. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.17.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. ", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51379" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-9g9p-wc7c-q948/GHSA-9g9p-wc7c-q948.json b/advisories/unreviewed/2023/12/GHSA-9g9p-wc7c-q948/GHSA-9g9p-wc7c-q948.json new file mode 100644 index 00000000000..446a1d06eda --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-9g9p-wc7c-q948/GHSA-9g9p-wc7c-q948.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9g9p-wc7c-q948", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-46647" + ], + "details": "Improper privilege management in all versions of GitHub Enterprise Server allows users with authorized access to the management console with an editor role to escalate their privileges by making requests to the endpoint used for bootstrapping the instance. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.12, 3.9.6, 3.10.3, and 3.11.0.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46647" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.3" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.0" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.6" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-269" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-9q2h-gmqj-3mxj/GHSA-9q2h-gmqj-3mxj.json b/advisories/unreviewed/2023/12/GHSA-9q2h-gmqj-3mxj/GHSA-9q2h-gmqj-3mxj.json index 876a7f0832f..ffaf24f6386 100644 --- a/advisories/unreviewed/2023/12/GHSA-9q2h-gmqj-3mxj/GHSA-9q2h-gmqj-3mxj.json +++ b/advisories/unreviewed/2023/12/GHSA-9q2h-gmqj-3mxj/GHSA-9q2h-gmqj-3mxj.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-121" + "CWE-121", + "CWE-787" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/12/GHSA-9v2j-chw4-v7q3/GHSA-9v2j-chw4-v7q3.json b/advisories/unreviewed/2023/12/GHSA-9v2j-chw4-v7q3/GHSA-9v2j-chw4-v7q3.json new file mode 100644 index 00000000000..c2b8ff30e5c --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-9v2j-chw4-v7q3/GHSA-9v2j-chw4-v7q3.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-9v2j-chw4-v7q3", + "modified": "2023-12-21T21:30:30Z", + "published": "2023-12-21T21:30:30Z", + "aliases": [ + "CVE-2023-50834" + ], + "details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in August Infotech WooCommerce Menu Extension allows Stored XSS.This issue affects WooCommerce Menu Extension: from n/a through 1.6.2.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50834" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/woocommerce-menu-extension/wordpress-woocommerce-menu-extension-plugin-1-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T19:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-c89x-g252-q62w/GHSA-c89x-g252-q62w.json b/advisories/unreviewed/2023/12/GHSA-c89x-g252-q62w/GHSA-c89x-g252-q62w.json new file mode 100644 index 00000000000..06deda72b6e --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-c89x-g252-q62w/GHSA-c89x-g252-q62w.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c89x-g252-q62w", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-48685" + ], + "details": "Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'psd' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48685" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/barenboim/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-cfmj-7rv7-v356/GHSA-cfmj-7rv7-v356.json b/advisories/unreviewed/2023/12/GHSA-cfmj-7rv7-v356/GHSA-cfmj-7rv7-v356.json new file mode 100644 index 00000000000..3fb512cc29b --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-cfmj-7rv7-v356/GHSA-cfmj-7rv7-v356.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-cfmj-7rv7-v356", + "modified": "2023-12-21T21:30:32Z", + "published": "2023-12-21T21:30:32Z", + "aliases": [ + "CVE-2023-6847" + ], + "details": "An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed a bypass of Private Mode by using a specially crafted API request. To exploit this vulnerability, an attacker would need network access to the Enterprise Server appliance configured in Private Mode. This vulnerability affected all versions of GitHub Enterprise Server since 3.9 and was fixed in version 3.9.7, 3.10.4, and 3.11.1. This vulnerability was reported via the GitHub Bug Bounty program.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6847" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-f275-pcv5-ch9x/GHSA-f275-pcv5-ch9x.json b/advisories/unreviewed/2023/12/GHSA-f275-pcv5-ch9x/GHSA-f275-pcv5-ch9x.json index 37a1de0b1a9..7924d3d0759 100644 --- a/advisories/unreviewed/2023/12/GHSA-f275-pcv5-ch9x/GHSA-f275-pcv5-ch9x.json +++ b/advisories/unreviewed/2023/12/GHSA-f275-pcv5-ch9x/GHSA-f275-pcv5-ch9x.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-122" + "CWE-122", + "CWE-787" ], "severity": "MODERATE", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/12/GHSA-f2p7-3jq8-v8ph/GHSA-f2p7-3jq8-v8ph.json b/advisories/unreviewed/2023/12/GHSA-f2p7-3jq8-v8ph/GHSA-f2p7-3jq8-v8ph.json new file mode 100644 index 00000000000..e0d1f9a657a --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-f2p7-3jq8-v8ph/GHSA-f2p7-3jq8-v8ph.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f2p7-3jq8-v8ph", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-48690" + ], + "details": "Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'bynum' parameter of the train.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48690" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/barenboim/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-fc6j-9f2x-v9w8/GHSA-fc6j-9f2x-v9w8.json b/advisories/unreviewed/2023/12/GHSA-fc6j-9f2x-v9w8/GHSA-fc6j-9f2x-v9w8.json new file mode 100644 index 00000000000..754c3efccf5 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-fc6j-9f2x-v9w8/GHSA-fc6j-9f2x-v9w8.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fc6j-9f2x-v9w8", + "modified": "2023-12-21T21:30:32Z", + "published": "2023-12-21T21:30:32Z", + "aliases": [ + "CVE-2023-6746" + ], + "details": "An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end service that could permit an `adversary in the middle attack` when combined with other phishing techniques. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.17.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. ", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6746" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-532" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-g77w-7799-j8hq/GHSA-g77w-7799-j8hq.json b/advisories/unreviewed/2023/12/GHSA-g77w-7799-j8hq/GHSA-g77w-7799-j8hq.json new file mode 100644 index 00000000000..a4cd20ed973 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-g77w-7799-j8hq/GHSA-g77w-7799-j8hq.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-g77w-7799-j8hq", + "modified": "2023-12-21T21:30:33Z", + "published": "2023-12-21T21:30:33Z", + "aliases": [ + "CVE-2023-6803" + ], + "details": "A race condition in GitHub Enterprise Server allows an outside collaborator to be added while a repository is being transferred. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. \n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6803" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-367" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-g9xh-cc3h-8ghx/GHSA-g9xh-cc3h-8ghx.json b/advisories/unreviewed/2023/12/GHSA-g9xh-cc3h-8ghx/GHSA-g9xh-cc3h-8ghx.json index 3eb70fd8e31..319021eb436 100644 --- a/advisories/unreviewed/2023/12/GHSA-g9xh-cc3h-8ghx/GHSA-g9xh-cc3h-8ghx.json +++ b/advisories/unreviewed/2023/12/GHSA-g9xh-cc3h-8ghx/GHSA-g9xh-cc3h-8ghx.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-g9xh-cc3h-8ghx", - "modified": "2023-12-18T21:30:27Z", + "modified": "2023-12-21T21:30:30Z", "published": "2023-12-18T21:30:27Z", "aliases": [ "CVE-2023-6065" ], "details": "The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } ], "affected": [ @@ -31,7 +34,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-18T20:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-gj3x-fvqg-gcjm/GHSA-gj3x-fvqg-gcjm.json b/advisories/unreviewed/2023/12/GHSA-gj3x-fvqg-gcjm/GHSA-gj3x-fvqg-gcjm.json index 88ed37aa412..879fd61e48d 100644 --- a/advisories/unreviewed/2023/12/GHSA-gj3x-fvqg-gcjm/GHSA-gj3x-fvqg-gcjm.json +++ b/advisories/unreviewed/2023/12/GHSA-gj3x-fvqg-gcjm/GHSA-gj3x-fvqg-gcjm.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-gj3x-fvqg-gcjm", - "modified": "2023-12-18T21:30:27Z", + "modified": "2023-12-21T21:30:29Z", "published": "2023-12-18T21:30:27Z", "aliases": [ "CVE-2023-4724" ], "details": "The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-18T20:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-gwr3-fqch-h32r/GHSA-gwr3-fqch-h32r.json b/advisories/unreviewed/2023/12/GHSA-gwr3-fqch-h32r/GHSA-gwr3-fqch-h32r.json index 9319c401463..94e76cb6b28 100644 --- a/advisories/unreviewed/2023/12/GHSA-gwr3-fqch-h32r/GHSA-gwr3-fqch-h32r.json +++ b/advisories/unreviewed/2023/12/GHSA-gwr3-fqch-h32r/GHSA-gwr3-fqch-h32r.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-gwr3-fqch-h32r", - "modified": "2023-12-19T00:30:20Z", + "modified": "2023-12-21T21:30:30Z", "published": "2023-12-19T00:30:20Z", "aliases": [ "CVE-2023-49155" diff --git a/advisories/unreviewed/2023/12/GHSA-gwvq-pm88-g84j/GHSA-gwvq-pm88-g84j.json b/advisories/unreviewed/2023/12/GHSA-gwvq-pm88-g84j/GHSA-gwvq-pm88-g84j.json index a7dd299af78..d31e0b5292b 100644 --- a/advisories/unreviewed/2023/12/GHSA-gwvq-pm88-g84j/GHSA-gwvq-pm88-g84j.json +++ b/advisories/unreviewed/2023/12/GHSA-gwvq-pm88-g84j/GHSA-gwvq-pm88-g84j.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-gwvq-pm88-g84j", - "modified": "2023-12-18T21:30:28Z", + "modified": "2023-12-21T21:30:30Z", "published": "2023-12-18T21:30:28Z", "aliases": [ "CVE-2023-6295" ], "details": "The SiteOrigin Widgets Bundle WordPress plugin before 1.51.0 does not validate user input before using it to generate paths passed to include function/s, allowing users with the administrator role to perform LFI attacks in the context of Multisite WordPress sites.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-18T20:15:09Z" diff --git a/advisories/unreviewed/2023/12/GHSA-hjjg-h2xg-wpg8/GHSA-hjjg-h2xg-wpg8.json b/advisories/unreviewed/2023/12/GHSA-hjjg-h2xg-wpg8/GHSA-hjjg-h2xg-wpg8.json new file mode 100644 index 00000000000..fb3160a5655 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-hjjg-h2xg-wpg8/GHSA-hjjg-h2xg-wpg8.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hjjg-h2xg-wpg8", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-46649" + ], + "details": "A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be converted from a user. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. ", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46649" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-367" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-jgjj-g58w-4hp3/GHSA-jgjj-g58w-4hp3.json b/advisories/unreviewed/2023/12/GHSA-jgjj-g58w-4hp3/GHSA-jgjj-g58w-4hp3.json index 5f923724d76..96486a1f088 100644 --- a/advisories/unreviewed/2023/12/GHSA-jgjj-g58w-4hp3/GHSA-jgjj-g58w-4hp3.json +++ b/advisories/unreviewed/2023/12/GHSA-jgjj-g58w-4hp3/GHSA-jgjj-g58w-4hp3.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-jgjj-g58w-4hp3", - "modified": "2023-12-18T21:30:28Z", + "modified": "2023-12-21T21:30:30Z", "published": "2023-12-18T21:30:28Z", "aliases": [ "CVE-2023-6222" ], "details": "IThe Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 does not validate user input used in a path, which could allow users with an admin role to perform path traversal attacks", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -29,9 +32,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-22" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-18T20:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-jp67-5wh7-6mjx/GHSA-jp67-5wh7-6mjx.json b/advisories/unreviewed/2023/12/GHSA-jp67-5wh7-6mjx/GHSA-jp67-5wh7-6mjx.json new file mode 100644 index 00000000000..e2c8d4aa48a --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-jp67-5wh7-6mjx/GHSA-jp67-5wh7-6mjx.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jp67-5wh7-6mjx", + "modified": "2023-12-21T21:30:32Z", + "published": "2023-12-21T21:30:32Z", + "aliases": [ + "CVE-2023-6690" + ], + "details": "A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a GraphQL mutation to alter repository permissions during the transfer. This vulnerability affected GitHub Enterprise Server version 3.8.0 and above and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6690" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-367" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-jxww-33mj-j76w/GHSA-jxww-33mj-j76w.json b/advisories/unreviewed/2023/12/GHSA-jxww-33mj-j76w/GHSA-jxww-33mj-j76w.json new file mode 100644 index 00000000000..b6f8a6475d7 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-jxww-33mj-j76w/GHSA-jxww-33mj-j76w.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jxww-33mj-j76w", + "modified": "2023-12-21T21:30:32Z", + "published": "2023-12-21T21:30:32Z", + "aliases": [ + "CVE-2023-48717" + ], + "details": "Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter of the add_classes.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48717" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/gilels/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-m246-64qf-m83c/GHSA-m246-64qf-m83c.json b/advisories/unreviewed/2023/12/GHSA-m246-64qf-m83c/GHSA-m246-64qf-m83c.json new file mode 100644 index 00000000000..11104822c6f --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-m246-64qf-m83c/GHSA-m246-64qf-m83c.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m246-64qf-m83c", + "modified": "2023-12-21T21:30:30Z", + "published": "2023-12-21T21:30:30Z", + "aliases": [ + "CVE-2023-32799" + ], + "details": "Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.This issue affects Shipping Multiple Addresses: from n/a through 3.8.3.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32799" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/woocommerce-shipping-multiple-addresses/wordpress-woocommerce-ship-to-multiple-addresses-plugin-3-8-3-insecure-direct-object-references-idor-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-639" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T19:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-m4q3-p5v6-4g9f/GHSA-m4q3-p5v6-4g9f.json b/advisories/unreviewed/2023/12/GHSA-m4q3-p5v6-4g9f/GHSA-m4q3-p5v6-4g9f.json new file mode 100644 index 00000000000..2fbf198abc7 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-m4q3-p5v6-4g9f/GHSA-m4q3-p5v6-4g9f.json @@ -0,0 +1,38 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m4q3-p5v6-4g9f", + "modified": "2023-12-21T21:30:30Z", + "published": "2023-12-21T21:30:30Z", + "aliases": [ + "CVE-2023-47191" + ], + "details": "Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress.This issue affects Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress: from n/a through 1.2.2.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47191" + }, + { + "type": "WEB", + "url": "https://patchstack.com/database/vulnerability/youzify/wordpress-youzify-plugin-1-2-2-insecure-direct-object-reference-idor-vulnerability?_s_id=cve" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-639" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T19:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-m8qq-8w2q-vhxg/GHSA-m8qq-8w2q-vhxg.json b/advisories/unreviewed/2023/12/GHSA-m8qq-8w2q-vhxg/GHSA-m8qq-8w2q-vhxg.json index 25ec62dc135..bdfba5449bd 100644 --- a/advisories/unreviewed/2023/12/GHSA-m8qq-8w2q-vhxg/GHSA-m8qq-8w2q-vhxg.json +++ b/advisories/unreviewed/2023/12/GHSA-m8qq-8w2q-vhxg/GHSA-m8qq-8w2q-vhxg.json @@ -28,7 +28,8 @@ ], "database_specific": { "cwe_ids": [ - "CWE-121" + "CWE-121", + "CWE-787" ], "severity": "CRITICAL", "github_reviewed": false, diff --git a/advisories/unreviewed/2023/12/GHSA-m8vj-88wq-7chf/GHSA-m8vj-88wq-7chf.json b/advisories/unreviewed/2023/12/GHSA-m8vj-88wq-7chf/GHSA-m8vj-88wq-7chf.json new file mode 100644 index 00000000000..8d18fcff549 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-m8vj-88wq-7chf/GHSA-m8vj-88wq-7chf.json @@ -0,0 +1,50 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m8vj-88wq-7chf", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-46648" + ], + "details": "An insufficient entropy vulnerability was identified in GitHub Enterprise Server (GHES) that allowed an attacker to brute force a user invitation to the GHES Management Console. To exploit this vulnerability, an attacker would need knowledge that a user invitation was pending. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.12, 3.9.7, 3.10.4, and 3.11.1. This vulnerability was reported via the GitHub Bug Bounty program.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46648" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-331" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-mh5h-4v4h-vcvq/GHSA-mh5h-4v4h-vcvq.json b/advisories/unreviewed/2023/12/GHSA-mh5h-4v4h-vcvq/GHSA-mh5h-4v4h-vcvq.json new file mode 100644 index 00000000000..d9529fcb052 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-mh5h-4v4h-vcvq/GHSA-mh5h-4v4h-vcvq.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mh5h-4v4h-vcvq", + "modified": "2023-12-21T21:30:30Z", + "published": "2023-12-21T21:30:30Z", + "aliases": [ + "CVE-2023-45124" + ], + "details": "Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'tag' parameter of the update.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45124" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/argerich/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T19:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-pcm9-gv4v-rfw2/GHSA-pcm9-gv4v-rfw2.json b/advisories/unreviewed/2023/12/GHSA-pcm9-gv4v-rfw2/GHSA-pcm9-gv4v-rfw2.json new file mode 100644 index 00000000000..5a943bf465f --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-pcm9-gv4v-rfw2/GHSA-pcm9-gv4v-rfw2.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pcm9-gv4v-rfw2", + "modified": "2023-12-21T21:30:30Z", + "published": "2023-12-21T21:30:30Z", + "aliases": [ + "CVE-2023-45125" + ], + "details": "Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'time' parameter of the update.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45125" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/argerich/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T19:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-pmf2-6gj8-f3p8/GHSA-pmf2-6gj8-f3p8.json b/advisories/unreviewed/2023/12/GHSA-pmf2-6gj8-f3p8/GHSA-pmf2-6gj8-f3p8.json new file mode 100644 index 00000000000..1283e993061 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-pmf2-6gj8-f3p8/GHSA-pmf2-6gj8-f3p8.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pmf2-6gj8-f3p8", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-48687" + ], + "details": "Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'from' parameter of the reservation.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48687" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/barenboim/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-pr5v-xq9x-gp8m/GHSA-pr5v-xq9x-gp8m.json b/advisories/unreviewed/2023/12/GHSA-pr5v-xq9x-gp8m/GHSA-pr5v-xq9x-gp8m.json index 475a22b3ac8..282611436cc 100644 --- a/advisories/unreviewed/2023/12/GHSA-pr5v-xq9x-gp8m/GHSA-pr5v-xq9x-gp8m.json +++ b/advisories/unreviewed/2023/12/GHSA-pr5v-xq9x-gp8m/GHSA-pr5v-xq9x-gp8m.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-pr5v-xq9x-gp8m", - "modified": "2023-12-18T21:30:28Z", + "modified": "2023-12-21T21:30:30Z", "published": "2023-12-18T21:30:28Z", "aliases": [ "CVE-2023-6289" ], "details": "The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } ], "affected": [ @@ -27,7 +30,7 @@ "cwe_ids": [ ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-18T20:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-pxgf-7mqc-v7vx/GHSA-pxgf-7mqc-v7vx.json b/advisories/unreviewed/2023/12/GHSA-pxgf-7mqc-v7vx/GHSA-pxgf-7mqc-v7vx.json new file mode 100644 index 00000000000..bf7afb68769 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-pxgf-7mqc-v7vx/GHSA-pxgf-7mqc-v7vx.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-pxgf-7mqc-v7vx", + "modified": "2023-12-21T21:30:30Z", + "published": "2023-12-21T21:30:30Z", + "aliases": [ + "CVE-2023-45127" + ], + "details": "Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'wrong' parameter of the update.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45127" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/argerich/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T19:15:11Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-qfq7-6m5h-vcmw/GHSA-qfq7-6m5h-vcmw.json b/advisories/unreviewed/2023/12/GHSA-qfq7-6m5h-vcmw/GHSA-qfq7-6m5h-vcmw.json new file mode 100644 index 00000000000..656ec4d0ab2 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-qfq7-6m5h-vcmw/GHSA-qfq7-6m5h-vcmw.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qfq7-6m5h-vcmw", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-48688" + ], + "details": "Railway Reservation System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'to' parameter of the reservation.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48688" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/barenboim/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-qgv4-xfrj-hvp7/GHSA-qgv4-xfrj-hvp7.json b/advisories/unreviewed/2023/12/GHSA-qgv4-xfrj-hvp7/GHSA-qgv4-xfrj-hvp7.json index ec0085fc309..8d867171c21 100644 --- a/advisories/unreviewed/2023/12/GHSA-qgv4-xfrj-hvp7/GHSA-qgv4-xfrj-hvp7.json +++ b/advisories/unreviewed/2023/12/GHSA-qgv4-xfrj-hvp7/GHSA-qgv4-xfrj-hvp7.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-qgv4-xfrj-hvp7", - "modified": "2023-12-18T21:30:27Z", + "modified": "2023-12-21T21:30:30Z", "published": "2023-12-18T21:30:27Z", "aliases": [ "CVE-2023-5886" ], "details": "The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-352" ], - "severity": null, + "severity": "HIGH", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-18T20:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-qp7j-9526-r655/GHSA-qp7j-9526-r655.json b/advisories/unreviewed/2023/12/GHSA-qp7j-9526-r655/GHSA-qp7j-9526-r655.json new file mode 100644 index 00000000000..11abcb8b3cc --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-qp7j-9526-r655/GHSA-qp7j-9526-r655.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-qp7j-9526-r655", + "modified": "2023-12-21T21:30:30Z", + "published": "2023-12-21T21:30:30Z", + "aliases": [ + "CVE-2023-45126" + ], + "details": "Online Examination System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'total' parameter of the update.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45126" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/argerich/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T19:15:10Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-r664-26m8-f6h9/GHSA-r664-26m8-f6h9.json b/advisories/unreviewed/2023/12/GHSA-r664-26m8-f6h9/GHSA-r664-26m8-f6h9.json new file mode 100644 index 00000000000..9a41dccc2ac --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-r664-26m8-f6h9/GHSA-r664-26m8-f6h9.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r664-26m8-f6h9", + "modified": "2023-12-21T21:30:32Z", + "published": "2023-12-21T21:30:32Z", + "aliases": [ + "CVE-2023-48720" + ], + "details": "Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48720" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/gilels/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:12Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-rqgv-j8f8-5q7x/GHSA-rqgv-j8f8-5q7x.json b/advisories/unreviewed/2023/12/GHSA-rqgv-j8f8-5q7x/GHSA-rqgv-j8f8-5q7x.json new file mode 100644 index 00000000000..66cca54fda0 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-rqgv-j8f8-5q7x/GHSA-rqgv-j8f8-5q7x.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rqgv-j8f8-5q7x", + "modified": "2023-12-21T21:30:32Z", + "published": "2023-12-21T21:30:32Z", + "aliases": [ + "CVE-2023-51380" + ], + "details": "An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be read with an improperly scoped token. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.17.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. ", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51380" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "LOW", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:13Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-v6cw-g4v9-gjmf/GHSA-v6cw-g4v9-gjmf.json b/advisories/unreviewed/2023/12/GHSA-v6cw-g4v9-gjmf/GHSA-v6cw-g4v9-gjmf.json index e2026fb462f..5f98272fb32 100644 --- a/advisories/unreviewed/2023/12/GHSA-v6cw-g4v9-gjmf/GHSA-v6cw-g4v9-gjmf.json +++ b/advisories/unreviewed/2023/12/GHSA-v6cw-g4v9-gjmf/GHSA-v6cw-g4v9-gjmf.json @@ -1,14 +1,17 @@ { "schema_version": "1.4.0", "id": "GHSA-v6cw-g4v9-gjmf", - "modified": "2023-12-18T21:30:27Z", + "modified": "2023-12-21T21:30:30Z", "published": "2023-12-18T21:30:27Z", "aliases": [ "CVE-2023-5348" ], "details": "The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.", "severity": [ - + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } ], "affected": [ @@ -25,9 +28,9 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-79" ], - "severity": null, + "severity": "MODERATE", "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2023-12-18T20:15:08Z" diff --git a/advisories/unreviewed/2023/12/GHSA-v727-f437-6cxx/GHSA-v727-f437-6cxx.json b/advisories/unreviewed/2023/12/GHSA-v727-f437-6cxx/GHSA-v727-f437-6cxx.json new file mode 100644 index 00000000000..68a5da7184d --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-v727-f437-6cxx/GHSA-v727-f437-6cxx.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v727-f437-6cxx", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-6546" + ], + "details": "A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This could allow a local unprivileged user to escalate their privileges on the system.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6546" + }, + { + "type": "WEB", + "url": "https://github.com/torvalds/linux/commit/3c4f8333b582487a2d1e02171f1465531cde53e3" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2023-6546" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255498" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "HIGH", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T20:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-vcf9-7qjv-g6q4/GHSA-vcf9-7qjv-g6q4.json b/advisories/unreviewed/2023/12/GHSA-vcf9-7qjv-g6q4/GHSA-vcf9-7qjv-g6q4.json new file mode 100644 index 00000000000..8902e557fac --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-vcf9-7qjv-g6q4/GHSA-vcf9-7qjv-g6q4.json @@ -0,0 +1,46 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-vcf9-7qjv-g6q4", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-7042" + ], + "details": "A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kernel. This issue could be exploited to trigger a denial of service.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-7042" + }, + { + "type": "WEB", + "url": "https://access.redhat.com/security/cve/CVE-2023-7042" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255497" + }, + { + "type": "WEB", + "url": "https://patchwork.kernel.org/project/linux-wireless/patch/20231208043433.271449-1-hdthky0@gmail.com/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-476" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T20:15:09Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-vx34-745v-7g3g/GHSA-vx34-745v-7g3g.json b/advisories/unreviewed/2023/12/GHSA-vx34-745v-7g3g/GHSA-vx34-745v-7g3g.json index 3a778566ab1..349d2d182bd 100644 --- a/advisories/unreviewed/2023/12/GHSA-vx34-745v-7g3g/GHSA-vx34-745v-7g3g.json +++ b/advisories/unreviewed/2023/12/GHSA-vx34-745v-7g3g/GHSA-vx34-745v-7g3g.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-vx34-745v-7g3g", - "modified": "2023-12-18T18:30:20Z", + "modified": "2023-12-21T21:30:29Z", "published": "2023-12-18T18:30:20Z", "aliases": [ "CVE-2022-40312" diff --git a/advisories/unreviewed/2023/12/GHSA-w6rg-549q-6qp2/GHSA-w6rg-549q-6qp2.json b/advisories/unreviewed/2023/12/GHSA-w6rg-549q-6qp2/GHSA-w6rg-549q-6qp2.json new file mode 100644 index 00000000000..b08a3af2fc6 --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-w6rg-549q-6qp2/GHSA-w6rg-549q-6qp2.json @@ -0,0 +1,54 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-w6rg-549q-6qp2", + "modified": "2023-12-21T21:30:31Z", + "published": "2023-12-21T21:30:31Z", + "aliases": [ + "CVE-2023-46645" + ], + "details": "A path traversal vulnerability was identified in GitHub Enterprise Server that allowed arbitrary file reading when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.7.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1. This vulnerability was reported via the GitHub Bug Bounty program.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46645" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12" + }, + { + "type": "WEB", + "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-22" + ], + "severity": "MODERATE", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2023/12/GHSA-ww4c-6492-r3w3/GHSA-ww4c-6492-r3w3.json b/advisories/unreviewed/2023/12/GHSA-ww4c-6492-r3w3/GHSA-ww4c-6492-r3w3.json new file mode 100644 index 00000000000..7cd67e1952b --- /dev/null +++ b/advisories/unreviewed/2023/12/GHSA-ww4c-6492-r3w3/GHSA-ww4c-6492-r3w3.json @@ -0,0 +1,42 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-ww4c-6492-r3w3", + "modified": "2023-12-21T21:30:32Z", + "published": "2023-12-21T21:30:32Z", + "aliases": [ + "CVE-2023-48716" + ], + "details": "Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_id' parameter of the add_classes.php resource does not validate the characters received and they are sent unfiltered to the database.\n\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48716" + }, + { + "type": "WEB", + "url": "https://fluidattacks.com/advisories/gilels/" + }, + { + "type": "WEB", + "url": "https://projectworlds.in/" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "CRITICAL", + "github_reviewed": false, + "github_reviewed_at": null, + "nvd_published_at": "2023-12-21T21:15:11Z" + } +} \ No newline at end of file