Skip to content

Commit 0d218dc

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-244g-mc48-hxgx GHSA-2w64-q994-w6rw GHSA-48qf-jjwf-7c3j GHSA-5mw4-48mm-4hwr GHSA-5xf6-7w2g-9f4w GHSA-62c8-7p5q-m59c GHSA-67xq-pgrv-jjfv GHSA-7rxr-hv3w-h99r GHSA-c8wh-grp4-2gjm GHSA-cx2v-ghwh-m3w7 GHSA-f66r-7mc6-x4rf GHSA-fqq3-cpcq-8fhc GHSA-gphg-348r-v598 GHSA-hg2c-f5rw-v45v GHSA-jcfw-r7j2-hvv7 GHSA-prwf-p7rw-xrr2 GHSA-qj6m-6wr4-jg9x GHSA-qpxm-8xgh-55mq GHSA-qwf8-w2rv-v3j4 GHSA-rpr9-6rwm-4w63 GHSA-v9hf-gmhj-865f
1 parent 7def3cc commit 0d218dc

File tree

21 files changed

+830
-0
lines changed

21 files changed

+830
-0
lines changed

‎advisories/unreviewed/2024/02/GHSA-244g-mc48-hxgx/GHSA-244g-mc48-hxgx.json‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-244g-mc48-hxgx",
4+
"modified": "2024-02-10T09:30:21Z",
5+
"published": "2024-02-10T09:30:21Z",
6+
"aliases": [
7+
"CVE-2024-23517"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Start Booking Scheduling Plugin – Online Booking for WordPress allows Stored XSS.This issue affects Scheduling Plugin – Online Booking for WordPress: from n/a through 3.5.10.\n\n",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [
17+
18+
],
19+
"references": [
20+
{
21+
"type": "ADVISORY",
22+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23517"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://patchstack.com/database/vulnerability/calendar-booking/wordpress-scheduling-plugin-online-booking-for-wordpress-plugin-3-5-10-cross-site-scripting-xss-vulnerability?_s_id=cve"
27+
}
28+
],
29+
"database_specific": {
30+
"cwe_ids": [
31+
"CWE-79"
32+
],
33+
"severity": "MODERATE",
34+
"github_reviewed": false,
35+
"github_reviewed_at": null,
36+
"nvd_published_at": "2024-02-10T09:15:09Z"
37+
}
38+
}

‎advisories/unreviewed/2024/02/GHSA-2w64-q994-w6rw/GHSA-2w64-q994-w6rw.json‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2w64-q994-w6rw",
4+
"modified": "2024-02-10T09:30:20Z",
5+
"published": "2024-02-10T09:30:20Z",
6+
"aliases": [
7+
"CVE-2024-1406"
8+
],
9+
"details": "A vulnerability was found in Linksys WRT54GL 4.30.18. It has been declared as problematic. This vulnerability affects unknown code of the file /SysInfo1.htm of the component Web Management Interface. The manipulation leads to information disclosure. The exploit has been disclosed to the public and may be used. VDB-253330 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
14+
}
15+
],
16+
"affected": [
17+
18+
],
19+
"references": [
20+
{
21+
"type": "ADVISORY",
22+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1406"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://github.com/leetsun/Hints/tree/main/linksys-wrt54gl/3"
27+
},
28+
{
29+
"type": "WEB",
30+
"url": "https://vuldb.com/?ctiid.253330"
31+
},
32+
{
33+
"type": "WEB",
34+
"url": "https://vuldb.com/?id.253330"
35+
}
36+
],
37+
"database_specific": {
38+
"cwe_ids": [
39+
"CWE-200"
40+
],
41+
"severity": "MODERATE",
42+
"github_reviewed": false,
43+
"github_reviewed_at": null,
44+
"nvd_published_at": "2024-02-10T08:15:07Z"
45+
}
46+
}

‎advisories/unreviewed/2024/02/GHSA-48qf-jjwf-7c3j/GHSA-48qf-jjwf-7c3j.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-48qf-jjwf-7c3j",
4+
"modified": "2024-02-10T09:30:19Z",
5+
"published": "2024-02-10T09:30:19Z",
6+
"aliases": [
7+
"CVE-2024-0594"
8+
],
9+
"details": "The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to union-based SQL Injection via the 'q' parameter of the wpas_get_users action in all versions up to, and including, 6.1.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
16+
"affected": [
17+
18+
],
19+
"references": [
20+
{
21+
"type": "ADVISORY",
22+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0594"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://plugins.trac.wordpress.org/browser/awesome-support/trunk/includes/functions-user.php#L1279"
27+
},
28+
{
29+
"type": "WEB",
30+
"url": "https://plugins.trac.wordpress.org/browser/awesome-support/trunk/includes/functions-user.php#L765"
31+
},
32+
{
33+
"type": "WEB",
34+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033134%40awesome-support&new=3033134%40awesome-support&sfp_email=&sfph_mail="
35+
},
36+
{
37+
"type": "WEB",
38+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8494a0f6-7079-4fba-9901-76932b002c5a?source=cve"
39+
}
40+
],
41+
"database_specific": {
42+
"cwe_ids": [
43+
44+
],
45+
"severity": "HIGH",
46+
"github_reviewed": false,
47+
"github_reviewed_at": null,
48+
"nvd_published_at": "2024-02-10T07:15:07Z"
49+
}
50+
}

‎advisories/unreviewed/2024/02/GHSA-5mw4-48mm-4hwr/GHSA-5mw4-48mm-4hwr.json‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5mw4-48mm-4hwr",
4+
"modified": "2024-02-10T09:30:20Z",
5+
"published": "2024-02-10T09:30:20Z",
6+
"aliases": [
7+
"CVE-2024-24717"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Kinchin Beds24 Online Booking allows Stored XSS.This issue affects Beds24 Online Booking: from n/a through 2.0.23.\n\n",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [
17+
18+
],
19+
"references": [
20+
{
21+
"type": "ADVISORY",
22+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24717"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://patchstack.com/database/vulnerability/beds24-online-booking/wordpress-beds24-online-booking-plugin-2-0-23-admin-cross-site-scripting-xss-vulnerability?_s_id=cve"
27+
}
28+
],
29+
"database_specific": {
30+
"cwe_ids": [
31+
"CWE-79"
32+
],
33+
"severity": "MODERATE",
34+
"github_reviewed": false,
35+
"github_reviewed_at": null,
36+
"nvd_published_at": "2024-02-10T08:15:08Z"
37+
}
38+
}

‎advisories/unreviewed/2024/02/GHSA-5xf6-7w2g-9f4w/GHSA-5xf6-7w2g-9f4w.json‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5xf6-7w2g-9f4w",
4+
"modified": "2024-02-10T09:30:21Z",
5+
"published": "2024-02-10T09:30:21Z",
6+
"aliases": [
7+
"CVE-2024-23516"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Calculators World CC BMI Calculator allows Stored XSS.This issue affects CC BMI Calculator: from n/a through 2.0.1.\n\n",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [
17+
18+
],
19+
"references": [
20+
{
21+
"type": "ADVISORY",
22+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23516"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://patchstack.com/database/vulnerability/cc-bmi-calculator/wordpress-cc-bmi-calculator-plugin-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve"
27+
}
28+
],
29+
"database_specific": {
30+
"cwe_ids": [
31+
"CWE-79"
32+
],
33+
"severity": "MODERATE",
34+
"github_reviewed": false,
35+
"github_reviewed_at": null,
36+
"nvd_published_at": "2024-02-10T09:15:09Z"
37+
}
38+
}

‎advisories/unreviewed/2024/02/GHSA-62c8-7p5q-m59c/GHSA-62c8-7p5q-m59c.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-62c8-7p5q-m59c",
4+
"modified": "2024-02-10T09:30:19Z",
5+
"published": "2024-02-10T09:30:19Z",
6+
"aliases": [
7+
"CVE-2024-0596"
8+
],
9+
"details": "The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the editor_html() function in all versions up to, and including, 6.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to view password protected and draft posts.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [
17+
18+
],
19+
"references": [
20+
{
21+
"type": "ADVISORY",
22+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0596"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033134%40awesome-support&new=3033134%40awesome-support&sfp_email=&sfph_mail="
27+
},
28+
{
29+
"type": "WEB",
30+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e4358e2a-b7f6-44b6-a38a-5b27cb15e1cd?source=cve"
31+
}
32+
],
33+
"database_specific": {
34+
"cwe_ids": [
35+
36+
],
37+
"severity": "MODERATE",
38+
"github_reviewed": false,
39+
"github_reviewed_at": null,
40+
"nvd_published_at": "2024-02-10T07:15:08Z"
41+
}
42+
}

‎advisories/unreviewed/2024/02/GHSA-67xq-pgrv-jjfv/GHSA-67xq-pgrv-jjfv.json‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-67xq-pgrv-jjfv",
4+
"modified": "2024-02-10T09:30:20Z",
5+
"published": "2024-02-10T09:30:20Z",
6+
"aliases": [
7+
"CVE-2024-24801"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LogicHunt OWL Carousel – WordPress Owl Carousel Slider allows Stored XSS.This issue affects OWL Carousel – WordPress Owl Carousel Slider: from n/a through 1.4.0.\n\n",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [
17+
18+
],
19+
"references": [
20+
{
21+
"type": "ADVISORY",
22+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24801"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://patchstack.com/database/vulnerability/lgx-owl-carousel/wordpress-owl-carousel-plugin-1-4-0-cross-site-scripting-xss-vulnerability?_s_id=cve"
27+
}
28+
],
29+
"database_specific": {
30+
"cwe_ids": [
31+
"CWE-79"
32+
],
33+
"severity": "MODERATE",
34+
"github_reviewed": false,
35+
"github_reviewed_at": null,
36+
"nvd_published_at": "2024-02-10T08:15:08Z"
37+
}
38+
}

‎advisories/unreviewed/2024/02/GHSA-7rxr-hv3w-h99r/GHSA-7rxr-hv3w-h99r.json‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-7rxr-hv3w-h99r",
4+
"modified": "2024-02-10T09:30:21Z",
5+
"published": "2024-02-10T09:30:21Z",
6+
"aliases": [
7+
"CVE-2023-51492"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If So Plugin If-So Dynamic Content Personalization allows Stored XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.6.3.1.\n\n",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [
17+
18+
],
19+
"references": [
20+
{
21+
"type": "ADVISORY",
22+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51492"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://patchstack.com/database/vulnerability/if-so/wordpress-if-so-dynamic-content-personalization-plugin-1-6-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve"
27+
}
28+
],
29+
"database_specific": {
30+
"cwe_ids": [
31+
"CWE-79"
32+
],
33+
"severity": "MODERATE",
34+
"github_reviewed": false,
35+
"github_reviewed_at": null,
36+
"nvd_published_at": "2024-02-10T09:15:08Z"
37+
}
38+
}

‎advisories/unreviewed/2024/02/GHSA-c8wh-grp4-2gjm/GHSA-c8wh-grp4-2gjm.json‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c8wh-grp4-2gjm",
4+
"modified": "2024-02-10T09:30:20Z",
5+
"published": "2024-02-10T09:30:20Z",
6+
"aliases": [
7+
"CVE-2024-24803"
8+
],
9+
"details": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPoperation Ultra Companion – Companion plugin for WPoperation Themes allows Stored XSS.This issue affects Ultra Companion – Companion plugin for WPoperation Themes: from n/a through 1.1.9.\n\n",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L"
14+
}
15+
],
16+
"affected": [
17+
18+
],
19+
"references": [
20+
{
21+
"type": "ADVISORY",
22+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24803"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://patchstack.com/database/vulnerability/ultra-companion/wordpress-ultra-companion-plugin-1-1-9-cross-site-scripting-xss-vulnerability?_s_id=cve"
27+
}
28+
],
29+
"database_specific": {
30+
"cwe_ids": [
31+
"CWE-79"
32+
],
33+
"severity": "MODERATE",
34+
"github_reviewed": false,
35+
"github_reviewed_at": null,
36+
"nvd_published_at": "2024-02-10T08:15:08Z"
37+
}
38+
}

0 commit comments

Comments
 (0)