Publish Advisories

GHSA-362g-36hp-r4hp GHSA-4fc6-x85v-hj7r GHSA-cwwg-j94x-j72r GHSA-g7xw-3x5x-249w GHSA-p8w2-9cmv-c9gc GHSA-vv57-3j5w-fc23
github · Nov 16, 2024 · 80bcd6f · 80bcd6f
1 parent 2d4a3b2
commit 80bcd6f
Show file tree

Hide file tree

Showing 6 changed files with 140 additions and 3 deletions.
diff --git a/advisories/unreviewed/2024/11/GHSA-362g-36hp-r4hp/GHSA-362g-36hp-r4hp.json b/advisories/unreviewed/2024/11/GHSA-362g-36hp-r4hp/GHSA-362g-36hp-r4hp.json
@@ -28,7 +28,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-122"
+      "CWE-122",
+      "CWE-787"
     ],
     "severity": "HIGH",
     "github_reviewed": false,

diff --git a/advisories/unreviewed/2024/11/GHSA-4fc6-x85v-hj7r/GHSA-4fc6-x85v-hj7r.json b/advisories/unreviewed/2024/11/GHSA-4fc6-x85v-hj7r/GHSA-4fc6-x85v-hj7r.json
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-4fc6-x85v-hj7r",
+  "modified": "2024-11-16T03:30:32Z",
+  "published": "2024-11-16T03:30:31Z",
+  "aliases": [
+    "CVE-2024-10861"
+  ],
+  "details": "The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() function in all versions up to, and including, 4.9.7. This makes it possible for unauthenticated attackers to update the 'ays_pb_upgrade_plugin' option with arbitrary data.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10861"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/ays-popup-box/tags/4.9.2/admin/class-ays-pb-admin.php#L609"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3188357/ays-popup-box/tags/4.9.8/admin/class-ays-pb-admin.php?old=3186262&old_path=ays-popup-box%2Ftags%2F4.9.7%2Fadmin%2Fclass-ays-pb-admin.php"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c3717e03-9a18-48a1-97d3-1d41c7f93261?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-862"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-16T03:15:14Z"
+  }
+}
diff --git a/advisories/unreviewed/2024/11/GHSA-cwwg-j94x-j72r/GHSA-cwwg-j94x-j72r.json b/advisories/unreviewed/2024/11/GHSA-cwwg-j94x-j72r/GHSA-cwwg-j94x-j72r.json
@@ -0,0 +1,42 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-cwwg-j94x-j72r",
+  "modified": "2024-11-16T03:30:31Z",
+  "published": "2024-11-16T03:30:31Z",
+  "aliases": [
+    "CVE-2024-10795"
+  ],
+  "details": "The Popularis Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.7 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created via Elementor that they should not have access to.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10795"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3185542%40popularis-extra&new=3185542%40popularis-extra&sfp_email=&sfph_mail="
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1b5de554-1d2f-4932-9f93-1333b07edeba?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-639"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-16T03:15:14Z"
+  }
+}
diff --git a/advisories/unreviewed/2024/11/GHSA-g7xw-3x5x-249w/GHSA-g7xw-3x5x-249w.json b/advisories/unreviewed/2024/11/GHSA-g7xw-3x5x-249w/GHSA-g7xw-3x5x-249w.json
@@ -28,7 +28,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-122"
+      "CWE-122",
+      "CWE-787"
     ],
     "severity": "HIGH",
     "github_reviewed": false,

diff --git a/advisories/unreviewed/2024/11/GHSA-p8w2-9cmv-c9gc/GHSA-p8w2-9cmv-c9gc.json b/advisories/unreviewed/2024/11/GHSA-p8w2-9cmv-c9gc/GHSA-p8w2-9cmv-c9gc.json
@@ -28,7 +28,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-122"
+      "CWE-122",
+      "CWE-787"
     ],
     "severity": "HIGH",
     "github_reviewed": false,

diff --git a/advisories/unreviewed/2024/11/GHSA-vv57-3j5w-fc23/GHSA-vv57-3j5w-fc23.json b/advisories/unreviewed/2024/11/GHSA-vv57-3j5w-fc23/GHSA-vv57-3j5w-fc23.json
@@ -0,0 +1,46 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vv57-3j5w-fc23",
+  "modified": "2024-11-16T03:30:31Z",
+  "published": "2024-11-16T03:30:31Z",
+  "aliases": [
+    "CVE-2024-10786"
+  ],
+  "details": "The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of datadue to a missing capability check on the sla_clear_user_cache function in all versions up to, and including, 2.7.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to clear user caches.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [
+
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10786"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/browser/simple-local-avatars/tags/2.7.11/includes/class-simple-local-avatars.php#L1374"
+    },
+    {
+      "type": "WEB",
+      "url": "https://plugins.trac.wordpress.org/changeset/3186674/simple-local-avatars/tags/2.8.0/includes/class-simple-local-avatars.php"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e2619d50-e295-4e13-91d4-f998b8aa5be4?source=cve"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-862"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2024-11-16T03:15:14Z"
+  }
+}