From 2b201267d5b3bebe56f535a9960284ece501c3f5 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Tue, 27 Aug 2024 11:00:34 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2024/0xxx/CVE-2024-0563.json | 12 ++--- 2024/45xxx/CVE-2024-45062.json | 18 +++++++ 2024/4xxx/CVE-2024-4056.json | 10 ++-- 2024/5xxx/CVE-2024-5142.json | 2 +- 2024/6xxx/CVE-2024-6124.json | 4 +- 2024/6xxx/CVE-2024-6881.json | 4 +- 2024/7xxx/CVE-2024-7791.json | 95 ++++++++++++++++++++++++++++++++-- 2024/8xxx/CVE-2024-8197.json | 76 +++++++++++++++++++++++++-- 8 files changed, 197 insertions(+), 24 deletions(-) create mode 100644 2024/45xxx/CVE-2024-45062.json diff --git a/2024/0xxx/CVE-2024-0563.json b/2024/0xxx/CVE-2024-0563.json index 4407b76712b..521e90fe3db 100644 --- a/2024/0xxx/CVE-2024-0563.json +++ b/2024/0xxx/CVE-2024-0563.json @@ -21,8 +21,8 @@ "description": [ { "lang": "eng", - "value": "CWE-400 Uncontrolled Resource Consumption", - "cweId": "CWE-400" + "value": "CWE-770 Allocation of Resources Without Limits or Throttling", + "cweId": "CWE-770" } ] } @@ -73,9 +73,9 @@ "references": { "reference_data": [ { - "url": "https://www.m-files.com/about/trust-center/security-advisories/cve-2024-0563/", + "url": "https://product.m-files.com/security-advisories/cve-2024-0563/", "refsource": "MISC", - "name": "https://www.m-files.com/about/trust-center/security-advisories/cve-2024-0563/" + "name": "https://product.m-files.com/security-advisories/cve-2024-0563/" } ] }, @@ -92,10 +92,10 @@ { "base64": false, "type": "text/html", - "value": "\n\nUpdate to patched version.\n\n" + "value": "Update to patched version." } ], - "value": "\nUpdate to patched version.\n\n" + "value": "Update to patched version." } ], "impact": { diff --git a/2024/45xxx/CVE-2024-45062.json b/2024/45xxx/CVE-2024-45062.json new file mode 100644 index 00000000000..80c606c720f --- /dev/null +++ b/2024/45xxx/CVE-2024-45062.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-45062", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/4xxx/CVE-2024-4056.json b/2024/4xxx/CVE-2024-4056.json index 2a4fc6e2116..e6fdb537523 100644 --- a/2024/4xxx/CVE-2024-4056.json +++ b/2024/4xxx/CVE-2024-4056.json @@ -11,7 +11,7 @@ "description_data": [ { "lang": "eng", - "value": "\nDenial of service condition in M-Files Server in versions before 24.4.13592.4\u00a0and after 23.11 (excluding 24.2 LTS) allows unauthenticated user to consume computing resources.\n\n" + "value": "Denial of service condition in M-Files Server in versions before 24.4.13592.4\u00a0and after 23.11 (excluding 24.2 LTS) allows unauthenticated user to consume computing resources." } ] }, @@ -21,8 +21,8 @@ "description": [ { "lang": "eng", - "value": "CWE-400 Uncontrolled Resource Consumption", - "cweId": "CWE-400" + "value": "CWE-1333: Inefficient Regular Expression Complexity", + "cweId": "CWE-1333" } ] } @@ -69,9 +69,9 @@ "references": { "reference_data": [ { - "url": "https://www.m-files.com/about/trust-center/security-advisories/cve-2024-4056/", + "url": "https://product.m-files.com/security-advisories/cve-2024-4056/", "refsource": "MISC", - "name": "https://www.m-files.com/about/trust-center/security-advisories/cve-2024-4056/" + "name": "https://product.m-files.com/security-advisories/cve-2024-4056/" } ] }, diff --git a/2024/5xxx/CVE-2024-5142.json b/2024/5xxx/CVE-2024-5142.json index c712facad76..d83ba87f5ae 100644 --- a/2024/5xxx/CVE-2024-5142.json +++ b/2024/5xxx/CVE-2024-5142.json @@ -11,7 +11,7 @@ "description_data": [ { "lang": "eng", - "value": "Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.3.8 allows authenticated attacker to run scripts in other users browser" + "value": "Stored Cross-Site Scripting vulnerability in Social Module in M-Files Hubshare before version 5.0.6.0 allows authenticated attacker to run scripts in other users browser" } ] }, diff --git a/2024/6xxx/CVE-2024-6124.json b/2024/6xxx/CVE-2024-6124.json index 9d8fa303e08..9a4ff654805 100644 --- a/2024/6xxx/CVE-2024-6124.json +++ b/2024/6xxx/CVE-2024-6124.json @@ -56,9 +56,9 @@ "references": { "reference_data": [ { - "url": "https://www.m-files.com/about/trust-center/security-advisories/cve-2024-6124/", + "url": "https://product.m-files.com/security-advisories/cve-2024-6124/", "refsource": "MISC", - "name": "https://www.m-files.com/about/trust-center/security-advisories/cve-2024-6124/" + "name": "https://product.m-files.com/security-advisories/cve-2024-6124/" } ] }, diff --git a/2024/6xxx/CVE-2024-6881.json b/2024/6xxx/CVE-2024-6881.json index da19f17e227..9bd5a4ba6c1 100644 --- a/2024/6xxx/CVE-2024-6881.json +++ b/2024/6xxx/CVE-2024-6881.json @@ -56,9 +56,9 @@ "references": { "reference_data": [ { - "url": "https://www.m-files.com/about/trust-center/security-advisories/cve-2024-6881/", + "url": "https://product.m-files.com/security-advisories/cve-2024-6881/", "refsource": "MISC", - "name": "https://www.m-files.com/about/trust-center/security-advisories/cve-2024-6881/" + "name": "https://product.m-files.com/security-advisories/cve-2024-6881/" } ] }, diff --git a/2024/7xxx/CVE-2024-7791.json b/2024/7xxx/CVE-2024-7791.json index 649a35ceff5..103dd4e72ce 100644 --- a/2024/7xxx/CVE-2024-7791.json +++ b/2024/7xxx/CVE-2024-7791.json @@ -1,17 +1,104 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-7791", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@wordfence.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The 140+ Widgets | Xpro Addons For Elementor \u2013 FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018arrow\u2019 parameter within the Post Grid widget in all versions up to, and including, 1.4.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "xpro", + "product": { + "product_data": [ + { + "product_name": "140+ Widgets | Xpro Addons For Elementor \u2013 FREE", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "*", + "version_value": "1.4.4.3" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c6025dd5-a1d7-48cc-90b3-f020d3d2298b?source=cve", + "refsource": "MISC", + "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c6025dd5-a1d7-48cc-90b3-f020d3d2298b?source=cve" + }, + { + "url": "https://plugins.trac.wordpress.org/browser/xpro-elementor-addons/trunk/widgets/post-grid/post-grid.php#L1891", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/browser/xpro-elementor-addons/trunk/widgets/post-grid/post-grid.php#L1891" + }, + { + "url": "https://wordpress.org/plugins/xpro-elementor-addons/#developers", + "refsource": "MISC", + "name": "https://wordpress.org/plugins/xpro-elementor-addons/#developers" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset/3141892/#file2", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/changeset/3141892/#file2" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset/3141892/", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/changeset/3141892/" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Maxuel" + }, + { + "lang": "en", + "value": "Bruno Vilela" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", + "baseScore": 6.4, + "baseSeverity": "MEDIUM" } ] } diff --git a/2024/8xxx/CVE-2024-8197.json b/2024/8xxx/CVE-2024-8197.json index bd0734eced8..9381c0eaf7f 100644 --- a/2024/8xxx/CVE-2024-8197.json +++ b/2024/8xxx/CVE-2024-8197.json @@ -1,17 +1,85 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-8197", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@wordfence.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The Visual Sound plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.03. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-352 Cross-Site Request Forgery (CSRF)", + "cweId": "CWE-352" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "freakingwildchild", + "product": { + "product_data": [ + { + "product_name": "Visual Sound", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "*", + "version_value": "1.03" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/48d6d4c1-cc87-4c2c-9fbb-90af62f576aa?source=cve", + "refsource": "MISC", + "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/48d6d4c1-cc87-4c2c-9fbb-90af62f576aa?source=cve" + }, + { + "url": "https://wpscan.com/vulnerability/88cacd47-d900-478c-b833-c6c55fd4b082/", + "refsource": "MISC", + "name": "https://wpscan.com/vulnerability/88cacd47-d900-478c-b833-c6c55fd4b082/" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Daniel Ruf" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", + "baseScore": 4.3, + "baseSeverity": "MEDIUM" } ] }