From 34515a728037f43426d35a3a4ee87fa49aea6abb Mon Sep 17 00:00:00 2001 From: CVE Team Date: Sat, 15 Jun 2024 04:00:37 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2024/23xxx/CVE-2024-23120.json | 9 +++- 2024/32xxx/CVE-2024-32052.json | 18 ++++++++ 2024/32xxx/CVE-2024-32054.json | 18 ++++++++ 2024/33xxx/CVE-2024-33607.json | 18 ++++++++ 2024/34xxx/CVE-2024-34170.json | 18 ++++++++ 2024/36xxx/CVE-2024-36256.json | 18 ++++++++ 2024/36xxx/CVE-2024-36274.json | 18 ++++++++ 2024/36xxx/CVE-2024-36482.json | 18 ++++++++ 2024/37xxx/CVE-2024-37024.json | 18 ++++++++ 2024/37xxx/CVE-2024-37025.json | 18 ++++++++ 2024/38xxx/CVE-2024-38310.json | 18 ++++++++ 2024/5xxx/CVE-2024-5868.json | 75 ++++++++++++++++++++++++++++++++-- 2024/5xxx/CVE-2024-5871.json | 75 ++++++++++++++++++++++++++++++++-- 2024/6xxx/CVE-2024-6000.json | 75 ++++++++++++++++++++++++++++++++-- 14 files changed, 400 insertions(+), 14 deletions(-) create mode 100644 2024/32xxx/CVE-2024-32052.json create mode 100644 2024/32xxx/CVE-2024-32054.json create mode 100644 2024/33xxx/CVE-2024-33607.json create mode 100644 2024/34xxx/CVE-2024-34170.json create mode 100644 2024/36xxx/CVE-2024-36256.json create mode 100644 2024/36xxx/CVE-2024-36274.json create mode 100644 2024/36xxx/CVE-2024-36482.json create mode 100644 2024/37xxx/CVE-2024-37024.json create mode 100644 2024/37xxx/CVE-2024-37025.json create mode 100644 2024/38xxx/CVE-2024-38310.json diff --git a/2024/23xxx/CVE-2024-23120.json b/2024/23xxx/CVE-2024-23120.json index 134402f79b6..c2ea2357a60 100644 --- a/2024/23xxx/CVE-2024-23120.json +++ b/2024/23xxx/CVE-2024-23120.json @@ -11,7 +11,7 @@ "description_data": [ { "lang": "eng", - "value": "A maliciously crafted STP file in ASMIMPORT228A.dll when parsed through\nAutodesk AutoCAD can force an Out-of-Bound Write. A malicious actor can\nleverage this vulnerability to cause a crash, write sensitive data, or execute\narbitrary code in the context of the current process.\n\n\n\n\n" + "value": "A maliciously crafted STP and STEP file when parsed in ASMIMPORT228A.dll and ASMIMPORT229A.dll and through Autodesk applications can force an Out-of-Bound Write. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process." } ] }, @@ -36,7 +36,7 @@ "product": { "product_data": [ { - "product_name": "AutoCAD, Advance Steel and Civil 3D", + "product_name": "Autodesk applications", "version": { "version_data": [ { @@ -63,6 +63,11 @@ "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004", "refsource": "MISC", "name": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0004" + }, + { + "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009", + "refsource": "MISC", + "name": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0009" } ] }, diff --git a/2024/32xxx/CVE-2024-32052.json b/2024/32xxx/CVE-2024-32052.json new file mode 100644 index 00000000000..ed2fac90687 --- /dev/null +++ b/2024/32xxx/CVE-2024-32052.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-32052", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/32xxx/CVE-2024-32054.json b/2024/32xxx/CVE-2024-32054.json new file mode 100644 index 00000000000..a01571ae2e8 --- /dev/null +++ b/2024/32xxx/CVE-2024-32054.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-32054", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/33xxx/CVE-2024-33607.json b/2024/33xxx/CVE-2024-33607.json new file mode 100644 index 00000000000..83749157d6e --- /dev/null +++ b/2024/33xxx/CVE-2024-33607.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-33607", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/34xxx/CVE-2024-34170.json b/2024/34xxx/CVE-2024-34170.json new file mode 100644 index 00000000000..2f701e45e46 --- /dev/null +++ b/2024/34xxx/CVE-2024-34170.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-34170", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/36xxx/CVE-2024-36256.json b/2024/36xxx/CVE-2024-36256.json new file mode 100644 index 00000000000..98e580c02c9 --- /dev/null +++ b/2024/36xxx/CVE-2024-36256.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-36256", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/36xxx/CVE-2024-36274.json b/2024/36xxx/CVE-2024-36274.json new file mode 100644 index 00000000000..2c40b1fff7b --- /dev/null +++ b/2024/36xxx/CVE-2024-36274.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-36274", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/36xxx/CVE-2024-36482.json b/2024/36xxx/CVE-2024-36482.json new file mode 100644 index 00000000000..1b0a2e1c0a6 --- /dev/null +++ b/2024/36xxx/CVE-2024-36482.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-36482", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/37xxx/CVE-2024-37024.json b/2024/37xxx/CVE-2024-37024.json new file mode 100644 index 00000000000..92d17a40390 --- /dev/null +++ b/2024/37xxx/CVE-2024-37024.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-37024", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/37xxx/CVE-2024-37025.json b/2024/37xxx/CVE-2024-37025.json new file mode 100644 index 00000000000..afdbc3ea07f --- /dev/null +++ b/2024/37xxx/CVE-2024-37025.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-37025", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/38xxx/CVE-2024-38310.json b/2024/38xxx/CVE-2024-38310.json new file mode 100644 index 00000000000..cb016e47432 --- /dev/null +++ b/2024/38xxx/CVE-2024-38310.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-38310", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/5xxx/CVE-2024-5868.json b/2024/5xxx/CVE-2024-5868.json index 35c0a2de9bc..bd420934597 100644 --- a/2024/5xxx/CVE-2024-5868.json +++ b/2024/5xxx/CVE-2024-5868.json @@ -1,17 +1,84 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-5868", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@wordfence.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The WooCommerce - Social Login plugin for WordPress is vulnerable to Email Verification in all versions up to, and including, 2.6.2 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-330 Use of Insufficiently Random Values" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "WPWeb", + "product": { + "product_data": [ + { + "product_name": "WooCommerce - Social Login", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "*", + "version_value": "2.6.2" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/97fbbf5b-d3c7-47ce-b251-ce1fe38af152?source=cve", + "refsource": "MISC", + "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/97fbbf5b-d3c7-47ce-b251-ce1fe38af152?source=cve" + }, + { + "url": "https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883", + "refsource": "MISC", + "name": "https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Istv\u00e1n M\u00e1rton" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", + "baseScore": 6.5, + "baseSeverity": "MEDIUM" } ] } diff --git a/2024/5xxx/CVE-2024-5871.json b/2024/5xxx/CVE-2024-5871.json index d4edfad1ef3..4e2c474e1fe 100644 --- a/2024/5xxx/CVE-2024-5871.json +++ b/2024/5xxx/CVE-2024-5871.json @@ -1,17 +1,84 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-5871", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@wordfence.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The WooCommerce - Social Login plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'woo_slg_verify' vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-502 Deserialization of Untrusted Data" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "WPWeb", + "product": { + "product_data": [ + { + "product_name": "WooCommerce - Social Login", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "*", + "version_value": "2.6.2" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ffd592e6-2ac4-4af4-bfc0-d4f834157d71?source=cve", + "refsource": "MISC", + "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ffd592e6-2ac4-4af4-bfc0-d4f834157d71?source=cve" + }, + { + "url": "https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883", + "refsource": "MISC", + "name": "https://codecanyon.net/item/social-login-wordpress-woocommerce-plugin/8495883" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Istv\u00e1n M\u00e1rton" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "baseScore": 9.8, + "baseSeverity": "CRITICAL" } ] } diff --git a/2024/6xxx/CVE-2024-6000.json b/2024/6xxx/CVE-2024-6000.json index 2a0596d5fbf..1618cd4af6b 100644 --- a/2024/6xxx/CVE-2024-6000.json +++ b/2024/6xxx/CVE-2024-6000.json @@ -1,17 +1,84 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-6000", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@wordfence.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability setting on the 'display_ticket_themes_page' function in versions up to, and including, 1.19.20. This makes it possible for authenticated attackers with contributor-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This was partially patched in 1.19.20, and fully patched in 1.19.21." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-285 Improper Authorization" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "FooEvents", + "product": { + "product_data": [ + { + "product_name": "FooEvents for WooCommerce", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "*", + "version_value": "1.19.20" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1080810b-ec9a-44fb-b4da-49b28646a441?source=cve", + "refsource": "MISC", + "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1080810b-ec9a-44fb-b4da-49b28646a441?source=cve" + }, + { + "url": "https://help.fooevents.com/docs/topics/changelogs/fooevents-for-woocommerce/", + "refsource": "MISC", + "name": "https://help.fooevents.com/docs/topics/changelogs/fooevents-for-woocommerce/" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Istv\u00e1n M\u00e1rton" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", + "baseScore": 7.1, + "baseSeverity": "HIGH" } ] }