diff --git a/2020/11xxx/CVE-2020-11862.json b/2020/11xxx/CVE-2020-11862.json
index 6e5cb0e470a..ff9be6290c2 100644
--- a/2020/11xxx/CVE-2020-11862.json
+++ b/2020/11xxx/CVE-2020-11862.json
@@ -1,17 +1,88 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2020-11862",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@opentext.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Allocation of Resources Without Limits or Throttling vulnerability in OpenText NetIQ Privileged Account Manager on Linux, Windows, 64 bit allows Flooding.This issue affects NetIQ Privileged Account Manager: before 3.7.0.2.\n\n"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-770 Allocation of Resources Without Limits or Throttling",
+ "cweId": "CWE-770"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "OpenText",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "NetIQ Privileged Account Manager",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "3.7.0.2",
+ "version_value": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.netiq.com/documentation/privileged-account-manager-37/npam_3702_releasenotes/data/npam_3702_releasenotes.html",
+ "refsource": "MISC",
+ "name": "https://www.netiq.com/documentation/privileged-account-manager-37/npam_3702_releasenotes/data/npam_3702_releasenotes.html"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 8.6,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
+ "version": "3.1"
}
]
}
diff --git a/2022/42xxx/CVE-2022-42816.json b/2022/42xxx/CVE-2022-42816.json
index 94ff08826fd..991c5ea6f10 100644
--- a/2022/42xxx/CVE-2022-42816.json
+++ b/2022/42xxx/CVE-2022-42816.json
@@ -63,6 +63,11 @@
"url": "https://support.apple.com/kb/HT214084",
"refsource": "MISC",
"name": "https://support.apple.com/kb/HT214084"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/21",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/21"
}
]
}
diff --git a/2022/48xxx/CVE-2022-48554.json b/2022/48xxx/CVE-2022-48554.json
index af969276937..2aff439aea8 100644
--- a/2022/48xxx/CVE-2022-48554.json
+++ b/2022/48xxx/CVE-2022-48554.json
@@ -91,6 +91,11 @@
"refsource": "FULLDISC",
"name": "20240313 APPLE-SA-03-07-2024-2 macOS Sonoma 14.4",
"url": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "refsource": "FULLDISC",
+ "name": "20240313 APPLE-SA-03-07-2024-6 tvOS 17.4",
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2023/34xxx/CVE-2023-34540.json b/2023/34xxx/CVE-2023-34540.json
index 07956a26c56..c79a8d091aa 100644
--- a/2023/34xxx/CVE-2023-34540.json
+++ b/2023/34xxx/CVE-2023-34540.json
@@ -34,7 +34,7 @@
"description_data": [
{
"lang": "eng",
- "value": "Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper(). This vulnerability allows attackers to execute arbitrary code via providing crafted input."
+ "value": "Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRA API wrapper). This vulnerability allows attackers to execute arbitrary code via crafted input. As noted in the \"releases/tag\" reference, a fix is available."
}
]
},
diff --git a/2023/38xxx/CVE-2023-38534.json b/2023/38xxx/CVE-2023-38534.json
index f3fff23d33d..fac69a3ba4b 100644
--- a/2023/38xxx/CVE-2023-38534.json
+++ b/2023/38xxx/CVE-2023-38534.json
@@ -1,17 +1,104 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2023-38534",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@opentext.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Improper authentication vulnerability in\u00a0OpenText\u2122\u00a0Exceed Turbo X affecting versions 12.5.0 and 12.5.1. The vulnerability could allow disclosure of restricted information in unauthenticated RPC.\u00a0"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-287 Improper Authentication",
+ "cweId": "CWE-287"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "OpenText\u2122",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Exceed Turbo X",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "12.5.0"
+ },
+ {
+ "version_affected": "=",
+ "version_value": "12.5.1"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0796609",
+ "refsource": "MISC",
+ "name": "https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0796609"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0796609
"
+ }
+ ],
+ "value": " https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0796609 \n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 8.6,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2023/38xxx/CVE-2023-38535.json b/2023/38xxx/CVE-2023-38535.json
index afe9d351ffe..9a44dc1d106 100644
--- a/2023/38xxx/CVE-2023-38535.json
+++ b/2023/38xxx/CVE-2023-38535.json
@@ -1,17 +1,104 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2023-38535",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@opentext.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Use of Hard-coded Cryptographic Key vulnerability in\u00a0OpenText\u2122\u00a0Exceed Turbo X affecting versions 12.5.1 and 12.5.2. The vulnerability could compromise the cryptographic keys.\u00a0\u00a0"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-321 Use of Hard-coded Cryptographic Key",
+ "cweId": "CWE-321"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "OpenText\u2122",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Exceed Turbo X",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "12.5.1"
+ },
+ {
+ "version_affected": "=",
+ "version_value": "12.5.2"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0801267",
+ "refsource": "MISC",
+ "name": "https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0801267"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0801267
"
+ }
+ ],
+ "value": " https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0801267 \n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "HIGH",
+ "attackVector": "LOCAL",
+ "availabilityImpact": "NONE",
+ "baseScore": 4.7,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2023/38xxx/CVE-2023-38536.json b/2023/38xxx/CVE-2023-38536.json
index 7bfd262d1be..5dbb48aee44 100644
--- a/2023/38xxx/CVE-2023-38536.json
+++ b/2023/38xxx/CVE-2023-38536.json
@@ -1,17 +1,100 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2023-38536",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@opentext.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "HTML injection in\u00a0OpenText\u2122\u00a0Exceed Turbo X affecting version 12.5.1. The vulnerability could result in Cross site scripting.\u00a0\u00a0"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "OpenText\u2122",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Exceed Turbo X",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "12.5.1"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0796182",
+ "refsource": "MISC",
+ "name": "https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0796182"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0796182\n\n\n\n
"
+ }
+ ],
+ "value": " https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0796182 \n\n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "HIGH",
+ "scope": "UNCHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:H",
+ "version": "3.1"
}
]
}
diff --git a/2023/51xxx/CVE-2023-51384.json b/2023/51xxx/CVE-2023-51384.json
index 34afe9425ad..2385e8e2202 100644
--- a/2023/51xxx/CVE-2023-51384.json
+++ b/2023/51xxx/CVE-2023-51384.json
@@ -81,6 +81,11 @@
"refsource": "CONFIRM",
"name": "https://support.apple.com/kb/HT214084",
"url": "https://support.apple.com/kb/HT214084"
+ },
+ {
+ "refsource": "FULLDISC",
+ "name": "20240313 APPLE-SA-03-07-2024-2 macOS Sonoma 14.4",
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/21"
}
]
}
diff --git a/2023/51xxx/CVE-2023-51385.json b/2023/51xxx/CVE-2023-51385.json
index 232f13cbe1e..29605394f46 100644
--- a/2023/51xxx/CVE-2023-51385.json
+++ b/2023/51xxx/CVE-2023-51385.json
@@ -101,6 +101,11 @@
"refsource": "CONFIRM",
"name": "https://support.apple.com/kb/HT214084",
"url": "https://support.apple.com/kb/HT214084"
+ },
+ {
+ "refsource": "FULLDISC",
+ "name": "20240313 APPLE-SA-03-07-2024-2 macOS Sonoma 14.4",
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/21"
}
]
}
diff --git a/2024/0xxx/CVE-2024-0258.json b/2024/0xxx/CVE-2024-0258.json
index 2f543411d04..5df18de6f08 100644
--- a/2024/0xxx/CVE-2024-0258.json
+++ b/2024/0xxx/CVE-2024-0258.json
@@ -114,6 +114,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1176.json b/2024/1xxx/CVE-2024-1176.json
index c6085107ce7..7c3c7426024 100644
--- a/2024/1xxx/CVE-2024-1176.json
+++ b/2024/1xxx/CVE-2024-1176.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1176",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The HT Easy GA4 \u2013 Google Analytics WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the login() function in all versions up to, and including, 1.1.5. This makes it possible for unauthenticated attackers to update the email associated through the plugin with GA4."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-862 Missing Authorization"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "htplugins",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "HT Easy GA4 \u2013 Google Analytics WordPress Plugin",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.1.5"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10e1b3ac-f002-4108-9682-5fe300f07adb?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10e1b3ac-f002-4108-9682-5fe300f07adb?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/ht-easy-google-analytics/trunk/includes/class.ht-easy-ga4.php#L99",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/ht-easy-google-analytics/trunk/includes/class.ht-easy-ga4.php#L99"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Francesco Carlucci"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
+ "baseScore": 5.3,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1203.json b/2024/1xxx/CVE-2024-1203.json
index c88800d52c0..769eb214781 100644
--- a/2024/1xxx/CVE-2024-1203.json
+++ b/2024/1xxx/CVE-2024-1203.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1203",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Conversios \u2013 Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'valueData' parameter in all versions up to, and including, 6.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "tatvic",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Conversios \u2013 Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "6.9.1"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb7d499-28ba-48ef-9798-b7c8cbb7aa3e?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb7d499-28ba-48ef-9798-b7c8cbb7aa3e?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/enhanced-e-commerce-for-woocommerce-store/trunk/includes/data/class-tvc-ajax-file.php#L1850",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/enhanced-e-commerce-for-woocommerce-store/trunk/includes/data/class-tvc-ajax-file.php#L1850"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Krzysztof Zaj\u0105c"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+ "baseScore": 8.8,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1234.json b/2024/1xxx/CVE-2024-1234.json
index 77bc3b3ffd7..2acb9ce1e13 100644
--- a/2024/1xxx/CVE-2024-1234.json
+++ b/2024/1xxx/CVE-2024-1234.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1234",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data attribute in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "timstrifler",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Exclusive Addons for Elementor",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "2.6.9"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1b87fe3d-a88d-477a-8d91-4d7c2dba4a43?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1b87fe3d-a88d-477a-8d91-4d7c2dba4a43?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset/3042217/exclusive-addons-for-elementor",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset/3042217/exclusive-addons-for-elementor"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Craig Smith"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1237.json b/2024/1xxx/CVE-2024-1237.json
index 1634d44ddf2..8a7533e5ea7 100644
--- a/2024/1xxx/CVE-2024-1237.json
+++ b/2024/1xxx/CVE-2024-1237.json
@@ -1,17 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1237",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the flyout_layout attribute in all versions up to, and including, 1.6.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "brainstormforce",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Elementor Header & Footer Builder",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.6.24"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/82644c46-205b-4005-bba8-6b3e45769639?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/82644c46-205b-4005-bba8-6b3e45769639?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/1.6.24/inc/widgets-manager/widgets/class-navigation-menu.php#L1951",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/header-footer-elementor/tags/1.6.24/inc/widgets-manager/widgets/class-navigation-menu.php#L1951"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034938%40header-footer-elementor&new=3034938%40header-footer-elementor&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3034938%40header-footer-elementor&new=3034938%40header-footer-elementor&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "wesley"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1291.json b/2024/1xxx/CVE-2024-1291.json
index 70fc1ca1876..02510fa9ecd 100644
--- a/2024/1xxx/CVE-2024-1291.json
+++ b/2024/1xxx/CVE-2024-1291.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1291",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Brizy \u2013 Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown URL parameter in all versions up to, and including, 2.4.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "themefusecom",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Brizy \u2013 Page Builder",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "2.4.40"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fb4b5165-35a6-47e9-922e-b244b0d006e4?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fb4b5165-35a6-47e9-922e-b244b0d006e4?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3034945%40brizy%2Ftrunk&old=3032616%40brizy%2Ftrunk&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3034945%40brizy%2Ftrunk&old=3032616%40brizy%2Ftrunk&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Vinicius"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1293.json b/2024/1xxx/CVE-2024-1293.json
index 07a634fb1f2..730eb8792f2 100644
--- a/2024/1xxx/CVE-2024-1293.json
+++ b/2024/1xxx/CVE-2024-1293.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1293",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Brizy \u2013 Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the embedded media custom block in all versions up to, and including, 2.4.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "themefusecom",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Brizy \u2013 Page Builder",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "2.4.40"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/57dac6de-545f-49e5-9f45-d90a48d6b05f?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/57dac6de-545f-49e5-9f45-d90a48d6b05f?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3034945%40brizy%2Ftrunk&old=3032616%40brizy%2Ftrunk&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3034945%40brizy%2Ftrunk&old=3032616%40brizy%2Ftrunk&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Mdr001"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1296.json b/2024/1xxx/CVE-2024-1296.json
index 2fb469cd8de..d425956e82f 100644
--- a/2024/1xxx/CVE-2024-1296.json
+++ b/2024/1xxx/CVE-2024-1296.json
@@ -1,17 +1,94 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1296",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Brizy \u2013 Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block upload in all versions up to, and including, 2.4.40 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "themefusecom",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Brizy \u2013 Page Builder",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "2.4.40"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3e1008ad-daa9-4785-9dd5-4cdeb10d7e59?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3e1008ad-daa9-4785-9dd5-4cdeb10d7e59?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/brizy/trunk/editor/post.php#L529",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/brizy/trunk/editor/post.php#L529"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/brizy/trunk/editor/zip/archiver.php#L196",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/brizy/trunk/editor/zip/archiver.php#L196"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3034945%40brizy%2Ftrunk&old=3032616%40brizy%2Ftrunk&sfp_email=&sfph_mail=#file4",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3034945%40brizy%2Ftrunk&old=3032616%40brizy%2Ftrunk&sfp_email=&sfph_mail=#file4"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Matthew Rollings"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1311.json b/2024/1xxx/CVE-2024-1311.json
index d27a63fc2c3..a5878c8cea1 100644
--- a/2024/1xxx/CVE-2024-1311.json
+++ b/2024/1xxx/CVE-2024-1311.json
@@ -1,17 +1,88 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1311",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Brizy \u2013 Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeImages function in all versions up to, and including, 2.4.40. This makes it possible for authenticated attackers, with contributor access or above, to upload arbitrary files on the affected site's server which may make remote code execution possible."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-434 Unrestricted Upload of File with Dangerous Type"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "themefusecom",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Brizy \u2013 Page Builder",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "2.4.40"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dc023c1b-7ec6-45b6-b50a-f0d823065843?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dc023c1b-7ec6-45b6-b50a-f0d823065843?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/brizy/trunk/editor/zip/archiver.php#L254",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/brizy/trunk/editor/zip/archiver.php#L254"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset/3034945/brizy/tags/2.4.41/editor/zip/archiver.php",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset/3034945/brizy/tags/2.4.41/editor/zip/archiver.php"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Matthew Rollings"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+ "baseScore": 8.8,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1321.json b/2024/1xxx/CVE-2024-1321.json
index a5bec4a4d52..6ea9174433a 100644
--- a/2024/1xxx/CVE-2024-1321.json
+++ b/2024/1xxx/CVE-2024-1321.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1321",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The EventPrime \u2013 Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 3.4.2. This is due to the plugin allowing unauthenticated users to update the status of order payments. This makes it possible for unauthenticated attackers to book events for free."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-345 Insufficient Verification of Data Authenticity"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "metagauss",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "EventPrime \u2013 Events Calendar, Bookings and Tickets",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "3.4.2"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/765d0933-8db2-471c-ad4e-e19d3b4ff015?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/765d0933-8db2-471c-ad4e-e19d3b4ff015?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033882%40eventprime-event-calendar-management&new=3033882%40eventprime-event-calendar-management&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033882%40eventprime-event-calendar-management&new=3033882%40eventprime-event-calendar-management&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Lucio S\u00e1"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
+ "baseScore": 5.3,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1358.json b/2024/1xxx/CVE-2024-1358.json
index 07f69006615..2494e886778 100644
--- a/2024/1xxx/CVE-2024-1358.json
+++ b/2024/1xxx/CVE-2024-1358.json
@@ -1,17 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1358",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Elementor Addon Elements plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.12.12 via the render function. This makes it possible for authenticated attackers, with contributor access or higher, to include the contents of arbitrary PHP files on the server, which may expose sensitive information."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "webtechstreet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Elementor Addon Elements",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.12.12"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/20cd3fff-0488-4bc2-961b-2427925e6a96?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/20cd3fff-0488-4bc2-961b-2427925e6a96?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset/3037925/addon-elements-for-elementor-page-builder/trunk/modules/shape-separator/widgets/shape-separator.php",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset/3037925/addon-elements-for-elementor-page-builder/trunk/modules/shape-separator/widgets/shape-separator.php"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.12.12/modules/shape-separator/widgets/shape-separator.php#L89",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.12.12/modules/shape-separator/widgets/shape-separator.php#L89"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "wesley"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+ "baseScore": 8.8,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1363.json b/2024/1xxx/CVE-2024-1363.json
index 1914bc44e8d..91ea89c2073 100644
--- a/2024/1xxx/CVE-2024-1363.json
+++ b/2024/1xxx/CVE-2024-1363.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1363",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Easy Accordion \u2013 Best Accordion FAQ Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordion_content_source' attribute in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "shapedplugin",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Easy Accordion \u2013 Best Accordion FAQ Plugin for WordPress",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "2.3.4"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88f2fa28-5bb2-4633-b2bc-27cc6a4e304c?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88f2fa28-5bb2-4633-b2bc-27cc6a4e304c?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3044803%40easy-accordion-free&new=3044803%40easy-accordion-free&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3044803%40easy-accordion-free&new=3044803%40easy-accordion-free&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Ng\u00f4 Thi\u00ean An"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1365.json b/2024/1xxx/CVE-2024-1365.json
index bde42df83fe..fe2d7126422 100644
--- a/2024/1xxx/CVE-2024-1365.json
+++ b/2024/1xxx/CVE-2024-1365.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1365",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the feed_id parameter in all versions up to, and including, 4.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "icopydoc",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "YML for Yandex Market",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "4.2.3"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c343cee6-909d-4c1a-a6e4-f916a2ae223e?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c343cee6-909d-4c1a-a6e4-f916a2ae223e?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3039876%40yml-for-yandex-market%2Ftrunk&old=3036732%40yml-for-yandex-market%2Ftrunk&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3039876%40yml-for-yandex-market%2Ftrunk&old=3036732%40yml-for-yandex-market%2Ftrunk&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Krzysztof Zaj\u0105c"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+ "baseScore": 6.1,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1370.json b/2024/1xxx/CVE-2024-1370.json
index e36ac81b0f6..55fd561cd9e 100644
--- a/2024/1xxx/CVE-2024-1370.json
+++ b/2024/1xxx/CVE-2024-1370.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1370",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Maintenance Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the subscribe_download function hooked via AJAX action in all versions up to, and including, 1.0.8. This makes it possible for authenticated attackers, with subscriber access or higher, to download a csv containing subscriber emails."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-284 Improper Access Control"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "themegrill",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Maintenance Page",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.0.8"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1fce54b1-e1e6-4742-9eb3-bbfb613ccd70?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1fce54b1-e1e6-4742-9eb3-bbfb613ccd70?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037664%40maintenance-page%2Ftrunk&old=1218033%40maintenance-page%2Ftrunk&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037664%40maintenance-page%2Ftrunk&old=1218033%40maintenance-page%2Ftrunk&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Francesco Carlucci"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+ "baseScore": 5.3,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1380.json b/2024/1xxx/CVE-2024-1380.json
index b0e8b2c4a13..6cdd8922973 100644
--- a/2024/1xxx/CVE-2024-1380.json
+++ b/2024/1xxx/CVE-2024-1380.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1380",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Relevanssi \u2013 A Better Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relevanssi_export_log_check() function in all versions up to, and including, 4.22.0. This makes it possible for unauthenticated attackers to export the query log data. The vendor has indicated that they may look into adding a capability check for proper authorization control, however, this vulnerability is theoretically patched as is."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-862 Missing Authorization"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "msaari",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Relevanssi \u2013 A Better Search",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "4.22.0"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b2a3b17-0551-4e02-8e6a-ae8d46da0ef8?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b2a3b17-0551-4e02-8e6a-ae8d46da0ef8?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033880%40relevanssi&new=3033880%40relevanssi&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3033880%40relevanssi&new=3033880%40relevanssi&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Krzysztof Zaj\u0105c"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+ "baseScore": 5.3,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1383.json b/2024/1xxx/CVE-2024-1383.json
index 57fb26f1ae0..d5234d14c7c 100644
--- a/2024/1xxx/CVE-2024-1383.json
+++ b/2024/1xxx/CVE-2024-1383.json
@@ -1,17 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1383",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The WPvivid Backup for MainWP plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 0.9.32 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "wpvividplugins",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "WPvivid Backup for MainWP",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "0.9.32"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a8430ed-6aeb-46a3-8c42-59646845706e?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a8430ed-6aeb-46a3-8c42-59646845706e?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/wpvivid-backup-mainwp/trunk/wpvivid-backup-mainwp.php#L525",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/wpvivid-backup-mainwp/trunk/wpvivid-backup-mainwp.php#L525"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040939%40wpvivid-backup-mainwp&new=3040939%40wpvivid-backup-mainwp&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040939%40wpvivid-backup-mainwp&new=3040939%40wpvivid-backup-mainwp&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Krzysztof Zaj\u0105c"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+ "baseScore": 6.1,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1391.json b/2024/1xxx/CVE-2024-1391.json
index 19fe9b4f971..2a22690349f 100644
--- a/2024/1xxx/CVE-2024-1391.json
+++ b/2024/1xxx/CVE-2024-1391.json
@@ -1,17 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1391",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018eae_custom_overlay_switcher\u2019 attribute of the Thumbnail Slider widget in all versions up to, and including, 1.12.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "webtechstreet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Elementor Addon Elements",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.12.12"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/977bab12-969d-4b15-9942-2b17c8541f61?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/977bab12-969d-4b15-9942-2b17c8541f61?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.12.12/modules/bg-slider/module.php#L255",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.12.12/modules/bg-slider/module.php#L255"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.13/modules/bg-slider/module.php#L255",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.13/modules/bg-slider/module.php#L255"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "wesley"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1392.json b/2024/1xxx/CVE-2024-1392.json
index 116376a5aa3..7ac0d3f3807 100644
--- a/2024/1xxx/CVE-2024-1392.json
+++ b/2024/1xxx/CVE-2024-1392.json
@@ -1,17 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1392",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button1_icon' attribute of the Dual Button widget in all versions up to, and including, 1.12.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "webtechstreet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Elementor Addon Elements",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.12.12"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33d7dc4d-bb41-456a-bd1a-37d8f2aada30?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/33d7dc4d-bb41-456a-bd1a-37d8f2aada30?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.12.12/modules/dual-button/widgets/dual-button.php#L885",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.12.12/modules/dual-button/widgets/dual-button.php#L885"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.13/modules/dual-button/widgets/dual-button.php#L885",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.13/modules/dual-button/widgets/dual-button.php#L885"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Maxuel"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1393.json b/2024/1xxx/CVE-2024-1393.json
index 1d0421ea569..1ff05959d0e 100644
--- a/2024/1xxx/CVE-2024-1393.json
+++ b/2024/1xxx/CVE-2024-1393.json
@@ -1,17 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1393",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_align' attribute of the Content Switcher widget in all versions up to, and including, 1.12.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "webtechstreet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Elementor Addon Elements",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.12.12"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb0888d6-30e6-4957-b270-1968eace462e?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb0888d6-30e6-4957-b270-1968eace462e?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.12.12/modules/content-switcher/skins/skin-3.php#L39",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.12.12/modules/content-switcher/skins/skin-3.php#L39"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.13/modules/content-switcher/skins/skin-3.php#L39",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/tags/1.13/modules/content-switcher/skins/skin-3.php#L39"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Mdr001"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1409.json b/2024/1xxx/CVE-2024-1409.json
index cef57e8361d..c178f00872e 100644
--- a/2024/1xxx/CVE-2024-1409.json
+++ b/2024/1xxx/CVE-2024-1409.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1409",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [reg-select-role] shortcode in all versions up to, and including, 4.15.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "collizo4sky",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "4.15.0"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53e16bca-7c85-4d56-8233-b3b53f793b39?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/53e16bca-7c85-4d56-8233-b3b53f793b39?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3038677%40wp-user-avatar&new=3038677%40wp-user-avatar&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3038677%40wp-user-avatar&new=3038677%40wp-user-avatar&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Ng\u00f4 Thi\u00ean An"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1413.json b/2024/1xxx/CVE-2024-1413.json
index a83895c0bc6..0c721604b7e 100644
--- a/2024/1xxx/CVE-2024-1413.json
+++ b/2024/1xxx/CVE-2024-1413.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1413",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Timer widget in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "timstrifler",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Exclusive Addons for Elementor",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "2.6.9"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f40956e0-6e5c-4965-84f8-2420ad14a299?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f40956e0-6e5c-4965-84f8-2420ad14a299?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset/3042217/exclusive-addons-for-elementor",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset/3042217/exclusive-addons-for-elementor"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Maxuel"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1414.json b/2024/1xxx/CVE-2024-1414.json
index 18bd60d69e9..f11d81189d2 100644
--- a/2024/1xxx/CVE-2024-1414.json
+++ b/2024/1xxx/CVE-2024-1414.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1414",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Call To Action widget in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "timstrifler",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Exclusive Addons for Elementor",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "2.6.9"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6a12acf0-932e-4dff-9da6-9fbace11dbe1?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6a12acf0-932e-4dff-9da6-9fbace11dbe1?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset/3042217/exclusive-addons-for-elementor",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset/3042217/exclusive-addons-for-elementor"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "wesley"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1422.json b/2024/1xxx/CVE-2024-1422.json
index 5db904c5b36..fedc2391a82 100644
--- a/2024/1xxx/CVE-2024-1422.json
+++ b/2024/1xxx/CVE-2024-1422.json
@@ -1,17 +1,94 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1422",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the modal popup widget's effect setting in all versions up to, and including, 1.12.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "webtechstreet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Elementor Addon Elements",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.12.12"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ba28184-b5c3-4a5c-a376-29b3c6a2aa20?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ba28184-b5c3-4a5c-a376-29b3c6a2aa20?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/modal-popup/widgets/modal-popup.php#L1048",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/modal-popup/widgets/modal-popup.php#L1048"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/modal-popup/widgets/modal-popup.php#L1062",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/modules/modal-popup/widgets/modal-popup.php#L1062"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037925%40addon-elements-for-elementor-page-builder%2Ftrunk&old=3031349%40addon-elements-for-elementor-page-builder%2Ftrunk&sfp_email=&sfph_mail=#file26",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037925%40addon-elements-for-elementor-page-builder%2Ftrunk&old=3031349%40addon-elements-for-elementor-page-builder%2Ftrunk&sfp_email=&sfph_mail=#file26"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Craig Smith"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1452.json b/2024/1xxx/CVE-2024-1452.json
index 1dae476da0f..0c3197fa204 100644
--- a/2024/1xxx/CVE-2024-1452.json
+++ b/2024/1xxx/CVE-2024-1452.json
@@ -1,17 +1,94 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1452",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The GenerateBlocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.2 via Query Loop. This makes it possible for authenticated attackers, with contributor access and above, to see contents of posts and pages in draft or private status as well as those with scheduled publication dates."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-863 Incorrect Authorization"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "edge22",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "GenerateBlocks",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.8.2"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/62f19301-2311-4989-a5f2-9f845b72dd54?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/62f19301-2311-4989-a5f2-9f845b72dd54?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/generateblocks/trunk/includes/class-query-loop.php#L70",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/generateblocks/trunk/includes/class-query-loop.php#L70"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/generateblocks/trunk/includes/class-query-loop.php#L140",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/generateblocks/trunk/includes/class-query-loop.php#L140"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041431%40generateblocks%2Ftrunk&old=2995923%40generateblocks%2Ftrunk&sfp_email=&sfph_mail=#file2",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041431%40generateblocks%2Ftrunk&old=2995923%40generateblocks%2Ftrunk&sfp_email=&sfph_mail=#file2"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Craig Smith"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
+ "baseScore": 4.3,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1462.json b/2024/1xxx/CVE-2024-1462.json
index 469fa6f513a..840fe753108 100644
--- a/2024/1xxx/CVE-2024-1462.json
+++ b/2024/1xxx/CVE-2024-1462.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1462",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Maintenance Page plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 1.0.8 via the REST API. This makes it possible for unauthenticated attackers to view post titles and content when the site is in maintenance mode."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-284 Improper Access Control"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "themegrill",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Maintenance Page",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.0.8"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/653bf021-370d-4787-9ded-c5c915aed1d6?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/653bf021-370d-4787-9ded-c5c915aed1d6?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037664%40maintenance-page%2Ftrunk&old=1218033%40maintenance-page%2Ftrunk&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3037664%40maintenance-page%2Ftrunk&old=1218033%40maintenance-page%2Ftrunk&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Francesco Carlucci"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+ "baseScore": 5.3,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1479.json b/2024/1xxx/CVE-2024-1479.json
index 615e3c97a24..2f4080286fb 100644
--- a/2024/1xxx/CVE-2024-1479.json
+++ b/2024/1xxx/CVE-2024-1479.json
@@ -1,17 +1,94 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1479",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The WP Show Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the wpsp_display function. This makes it possible for authenticated attackers with contributor access and above to view the contents of draft, trash, future, private and pending posts and pages."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-863 Incorrect Authorization"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "edge22",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "WP Show Posts",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.1.4"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6788e2ee-ce61-494b-8d7f-6d1144466e58?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6788e2ee-ce61-494b-8d7f-6d1144466e58?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/wp-show-posts/trunk/wp-show-posts.php#L224",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/wp-show-posts/trunk/wp-show-posts.php#L224"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/wp-show-posts/trunk/wp-show-posts.php#L591",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/wp-show-posts/trunk/wp-show-posts.php#L591"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041416%40wp-show-posts%2Ftrunk&old=2846296%40wp-show-posts%2Ftrunk&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041416%40wp-show-posts%2Ftrunk&old=2846296%40wp-show-posts%2Ftrunk&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Craig Smith"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+ "baseScore": 5.3,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1484.json b/2024/1xxx/CVE-2024-1484.json
index 81966549db3..d365a0cc4c1 100644
--- a/2024/1xxx/CVE-2024-1484.json
+++ b/2024/1xxx/CVE-2024-1484.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1484",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Booking for Appointments and Events Calendar \u2013 Amelia plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the date parameters in all versions up to, and including, 1.0.98 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "ameliabooking",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Booking for Appointments and Events Calendar \u2013 Amelia",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.0.98"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3a849ef2-ad0a-45ea-8827-9a7233b1ca30?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3a849ef2-ad0a-45ea-8827-9a7233b1ca30?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041769%40ameliabooking%2Ftrunk&old=3037721%40ameliabooking%2Ftrunk&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041769%40ameliabooking%2Ftrunk&old=3037721%40ameliabooking%2Ftrunk&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Muhammad Hassham Nagori"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+ "baseScore": 6.1,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1489.json b/2024/1xxx/CVE-2024-1489.json
index e698acd8d88..d5d46981d63 100644
--- a/2024/1xxx/CVE-2024-1489.json
+++ b/2024/1xxx/CVE-2024-1489.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1489",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The SMS Alert Order Notifications \u2013 WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.9. This is due to missing or incorrect nonce validation on the processBulkAction function. This makes it possible for unauthenticated attackers to delete pages and posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "cozyvision1",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "SMS Alert Order Notifications \u2013 WooCommerce",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "3.6.9"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e7a28382-facb-43a7-892a-8ca9e7f0f62b?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e7a28382-facb-43a7-892a-8ca9e7f0f62b?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3039989%40sms-alert%2Ftrunk&old=3032487%40sms-alert%2Ftrunk&sfp_email=&sfph_mail=#file19",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3039989%40sms-alert%2Ftrunk&old=3032487%40sms-alert%2Ftrunk&sfp_email=&sfph_mail=#file19"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Krzysztof Zaj\u0105c"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
+ "baseScore": 4.3,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1497.json b/2024/1xxx/CVE-2024-1497.json
index d2d2ca6a583..2d1bafcdeb4 100644
--- a/2024/1xxx/CVE-2024-1497.json
+++ b/2024/1xxx/CVE-2024-1497.json
@@ -1,17 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1497",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form widget addr2_width attribute in all versions up to, and including, 2.10.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "themeisle",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Orbit Fox by ThemeIsle",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "2.10.30"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b4603b58-0972-4e04-91ac-ffc846964722?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b4603b58-0972-4e04-91ac-ffc846964722?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/themeisle-companion/tags/2.10.30/vendor/codeinwp/themeisle-content-forms/includes/widgets-admin/elementor/elementor_widget_base.php#L1219",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/themeisle-companion/tags/2.10.30/vendor/codeinwp/themeisle-content-forms/includes/widgets-admin/elementor/elementor_widget_base.php#L1219"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3038451%40themeisle-companion%2Ftrunk&old=3030173%40themeisle-companion%2Ftrunk&sfp_email=&sfph_mail=#file10",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3038451%40themeisle-companion%2Ftrunk&old=3030173%40themeisle-companion%2Ftrunk&sfp_email=&sfph_mail=#file10"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "wesley"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1499.json b/2024/1xxx/CVE-2024-1499.json
index e4c7c309ee0..023e898986d 100644
--- a/2024/1xxx/CVE-2024-1499.json
+++ b/2024/1xxx/CVE-2024-1499.json
@@ -1,17 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1499",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Table widget in the $settings['title_tags'] parameter in all versions up to, and including, 2.10.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "themeisle",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Orbit Fox by ThemeIsle",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "2.10.30"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/df40eb21-2080-4de5-9055-09246a8a275e?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/df40eb21-2080-4de5-9055-09246a8a275e?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/themeisle-companion/tags/2.10.30/vendor/codeinwp/elementor-extra-widgets/widgets/elementor/pricing-table.php#L1037",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/themeisle-companion/tags/2.10.30/vendor/codeinwp/elementor-extra-widgets/widgets/elementor/pricing-table.php#L1037"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3038451%40themeisle-companion%2Ftrunk&old=3030173%40themeisle-companion%2Ftrunk&sfp_email=&sfph_mail=#file10",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3038451%40themeisle-companion%2Ftrunk&old=3030173%40themeisle-companion%2Ftrunk&sfp_email=&sfph_mail=#file10"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Maxuel"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1505.json b/2024/1xxx/CVE-2024-1505.json
index 0a51de0a0aa..9389dca3c25 100644
--- a/2024/1xxx/CVE-2024-1505.json
+++ b/2024/1xxx/CVE-2024-1505.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1505",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Academy LMS \u2013 eLearning and online course solution for WordPress plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.9.19. This is due to plugin allowing arbitrary user meta updates through the saved_user_info() function. This makes it possible for authenticated attackers, with minimal permissions such as students, to elevate their user role to that of an administrator."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-269 Improper Privilege Management"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "academylms",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Academy LMS \u2013 eLearning and online course solution for WordPress",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.9.19"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b150f90a-ccb7-4c19-a4b3-eaf9ec264ba8?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b150f90a-ccb7-4c19-a4b3-eaf9ec264ba8?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset/3037880/academy#file473",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset/3037880/academy#file473"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Lucio S\u00e1"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+ "baseScore": 8.8,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1535.json b/2024/1xxx/CVE-2024-1535.json
index c88a7138109..43d54780583 100644
--- a/2024/1xxx/CVE-2024-1535.json
+++ b/2024/1xxx/CVE-2024-1535.json
@@ -1,17 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1535",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.15.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "collizo4sky",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "4.15.2"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38ec1a6b-f5ee-446a-9e6c-3485dafb85ac?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38ec1a6b-f5ee-446a-9e6c-3485dafb85ac?source=cve"
+ },
+ {
+ "url": "https://github.com/WordpressPluginDirectory/wp-user-avatar/blob/fde360946c86d67610d8f95a82752199ce25b39a/wp-user-avatar/src/ShortcodeParser/Builder/FieldsShortcodeCallback.php#L952",
+ "refsource": "MISC",
+ "name": "https://github.com/WordpressPluginDirectory/wp-user-avatar/blob/fde360946c86d67610d8f95a82752199ce25b39a/wp-user-avatar/src/ShortcodeParser/Builder/FieldsShortcodeCallback.php#L952"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset/3047008/wp-user-avatar/trunk/src/ShortcodeParser/Builder/FieldsShortcodeCallback.php",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset/3047008/wp-user-avatar/trunk/src/ShortcodeParser/Builder/FieldsShortcodeCallback.php"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Arkadiusz Hydzik"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1536.json b/2024/1xxx/CVE-2024-1536.json
index 1d789007186..3ae11d00971 100644
--- a/2024/1xxx/CVE-2024-1536.json
+++ b/2024/1xxx/CVE-2024-1536.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1536",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's event calendar widget in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "wpdevteam",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "5.9.9"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/12dc9e63-17bb-4755-be3c-ae8b26edd3cd?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/12dc9e63-17bb-4755-be3c-ae8b26edd3cd?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset/3037755/essential-addons-for-elementor-lite/tags/5.9.10/includes/Elements/Event_Calendar.php",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset/3037755/essential-addons-for-elementor-lite/tags/5.9.10/includes/Elements/Event_Calendar.php"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Craig Smith"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
+ "baseScore": 7.4,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1537.json b/2024/1xxx/CVE-2024-1537.json
index 9818743ebec..b9021dd0764 100644
--- a/2024/1xxx/CVE-2024-1537.json
+++ b/2024/1xxx/CVE-2024-1537.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1537",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Data Table widget in all versions up to, and including, 5.9.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "wpdevteam",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Essential Addons for Elementor \u2013 Best Elementor Templates, Widgets, Kits & WooCommerce Builders",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "5.9.9"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/81a48c61-4191-4252-9230-9df8fc5e3443?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/81a48c61-4191-4252-9230-9df8fc5e3443?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset/3037755/essential-addons-for-elementor-lite/tags/5.9.10/includes/Elements/Data_Table.php",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset/3037755/essential-addons-for-elementor-lite/tags/5.9.10/includes/Elements/Data_Table.php"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "wesley"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1541.json b/2024/1xxx/CVE-2024-1541.json
index df8e00f6712..f77f2c98397 100644
--- a/2024/1xxx/CVE-2024-1541.json
+++ b/2024/1xxx/CVE-2024-1541.json
@@ -1,17 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1541",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Gutenberg Blocks by Kadence Blocks \u2013 Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the htmlTag attribute in all versions up to, and including, 3.2.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "britner",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Gutenberg Blocks by Kadence Blocks \u2013 Page Builder Features",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "3.2.23"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d0913632-85c5-4835-b606-4eca51df2496?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d0913632-85c5-4835-b606-4eca51df2496?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.2.21/includes/blocks/class-kadence-blocks-advanced-heading-block.php#L418",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/kadence-blocks/tags/3.2.21/includes/blocks/class-kadence-blocks-advanced-heading-block.php#L418"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041366%40kadence-blocks%2Ftrunk&old=3036979%40kadence-blocks%2Ftrunk&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041366%40kadence-blocks%2Ftrunk&old=3036979%40kadence-blocks%2Ftrunk&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "wesley"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1585.json b/2024/1xxx/CVE-2024-1585.json
index 3b69da694ed..47e742bd19c 100644
--- a/2024/1xxx/CVE-2024-1585.json
+++ b/2024/1xxx/CVE-2024-1585.json
@@ -1,17 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1585",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "xpeedstudio",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Metform Elementor Contact Form Builder",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "3.8.3"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/342d6941-6987-4756-b554-1699128b9108?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/342d6941-6987-4756-b554-1699128b9108?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/metform/trunk/utils/util.php#L555",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/metform/trunk/utils/util.php#L555"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?old_path=/metform/tags/3.8.3&old=3047398&new_path=/metform/tags/3.8.4&new=3047398&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?old_path=/metform/tags/3.8.3&old=3047398&new_path=/metform/tags/3.8.4&new=3047398&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Bassem Essam"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1640.json b/2024/1xxx/CVE-2024-1640.json
index faf096c2e29..8b90162114c 100644
--- a/2024/1xxx/CVE-2024-1640.json
+++ b/2024/1xxx/CVE-2024-1640.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1640",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient user validation on the bitforms_update_form_entry AJAX action in all versions up to, and including, 2.10.1. This makes it possible for unauthenticated attackers to modify form submissions."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-639 Authorization Bypass Through User-Controlled Key"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "bitpressadmin",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Contact Form Builder by Bit Form: Create Contact Form, Multi Step Form, Conversational Form",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "2.10.1"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/49ed7d6a-4a65-4efc-90e5-ffa5470d4011?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/49ed7d6a-4a65-4efc-90e5-ffa5470d4011?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset/3048523/bit-form/trunk/includes/Frontend/Ajax/FrontendAjax.php",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset/3048523/bit-form/trunk/includes/Frontend/Ajax/FrontendAjax.php"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Lucio S\u00e1"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
+ "baseScore": 5.3,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1642.json b/2024/1xxx/CVE-2024-1642.json
index 7e2f6c3db50..8b7012b0e76 100644
--- a/2024/1xxx/CVE-2024-1642.json
+++ b/2024/1xxx/CVE-2024-1642.json
@@ -1,17 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1642",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The MainWP Dashboard \u2013 WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is due to missing or incorrect nonce validation on the 'posting_bulk' function. This makes it possible for unauthenticated attackers to delete arbitrary posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-352 Cross-Site Request Forgery (CSRF)"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "mainwp",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "MainWP Dashboard \u2013 WordPress Manager for Multiple Websites Maintenance",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "4.6.0.1"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2c2d9569-a551-46f5-8581-464b9f35b71c?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2c2d9569-a551-46f5-8581-464b9f35b71c?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/mainwp/tags/4.6.0.1/pages/page-mainwp-post-page-handler.php",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/mainwp/tags/4.6.0.1/pages/page-mainwp-post-page-handler.php"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset/3042125/mainwp/trunk/pages/page-mainwp-post-page-handler.php?old=3017011&old_path=mainwp/trunk/pages/page-mainwp-post-page-handler.php",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset/3042125/mainwp/trunk/pages/page-mainwp-post-page-handler.php?old=3017011&old_path=mainwp/trunk/pages/page-mainwp-post-page-handler.php"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Krzysztof Zaj\u0105c"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
+ "baseScore": 4.3,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1680.json b/2024/1xxx/CVE-2024-1680.json
index 7bbaa3acf7d..2db0e0bc74b 100644
--- a/2024/1xxx/CVE-2024-1680.json
+++ b/2024/1xxx/CVE-2024-1680.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1680",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Settings URL of the Banner, Team Members, and Image Scroll widgets in all versions up to, and including, 4.10.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "leap13",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Premium Addons for Elementor",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "4.10.21"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6e2d0b38-8241-456f-a79b-5d31132b3233?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6e2d0b38-8241-456f-a79b-5d31132b3233?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset/3041548/premium-addons-for-elementor",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset/3041548/premium-addons-for-elementor"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Craig Smith"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1684.json b/2024/1xxx/CVE-2024-1684.json
index 32ef3d6aad3..a2111e81e93 100644
--- a/2024/1xxx/CVE-2024-1684.json
+++ b/2024/1xxx/CVE-2024-1684.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1684",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contact form file field CSS metabox in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Themisle",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Otter Blocks PRO \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "2.6.3"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/934bf839-152d-4d10-9ac8-c64cf042dc18?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/934bf839-152d-4d10-9ac8-c64cf042dc18?source=cve"
+ },
+ {
+ "url": "https://store.themeisle.com/?edd_action=view_changelog&name=Otter%20Pro",
+ "refsource": "MISC",
+ "name": "https://store.themeisle.com/?edd_action=view_changelog&name=Otter%20Pro"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "wesley"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1690.json b/2024/1xxx/CVE-2024-1690.json
index cb87daeea64..43bcaf7b910 100644
--- a/2024/1xxx/CVE-2024-1690.json
+++ b/2024/1xxx/CVE-2024-1690.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1690",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The TeraWallet \u2013 Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the terawallet_export_user_search() function in all versions up to, and including, 1.4.10. This makes it possible for authenticated attackers, with subscriber-level access and above, to export a list of registered users and their emails."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-862 Missing Authorization"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "subratamal",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "TeraWallet \u2013 Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.4.10"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/18e24a2e-cbc6-4285-b846-bea513b6ff69?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/18e24a2e-cbc6-4285-b846-bea513b6ff69?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset/3043412/woo-wallet/trunk/includes/class-woo-wallet-ajax.php",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset/3043412/woo-wallet/trunk/includes/class-woo-wallet-ajax.php"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Lucio S\u00e1"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
+ "baseScore": 4.3,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1691.json b/2024/1xxx/CVE-2024-1691.json
index 3b7c08ab3af..5f8f9e3b575 100644
--- a/2024/1xxx/CVE-2024-1691.json
+++ b/2024/1xxx/CVE-2024-1691.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1691",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Otter Blocks \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via file upload form, which allows SVG uploads, in all versions up to, and including, 2.6.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note that the patch in 2.6.4 allows SVG uploads but the uploaded SVG files are sanitized."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Themisle",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Otter Blocks PRO \u2013 Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "2.6.3"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/77838bf8-7809-4dd6-87f1-a9bda40275a6?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/77838bf8-7809-4dd6-87f1-a9bda40275a6?source=cve"
+ },
+ {
+ "url": "https://store.themeisle.com/?edd_action=view_changelog&name=Otter%20Pro",
+ "refsource": "MISC",
+ "name": "https://store.themeisle.com/?edd_action=view_changelog&name=Otter%20Pro"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "wesley"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+ "baseScore": 6.1,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1723.json b/2024/1xxx/CVE-2024-1723.json
index 95bc3a9cb1e..bbb8c31bfe2 100644
--- a/2024/1xxx/CVE-2024-1723.json
+++ b/2024/1xxx/CVE-2024-1723.json
@@ -1,17 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1723",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.58.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Affected parameters include: $instance['fonts']['title_options']['tag'], $headline_tag, $sub_headline_tag, $feature['icon']."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "gpriday",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "SiteOrigin Widgets Bundle",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "1.58.7"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e63c566d-744b-42f5-9ba6-9007cc60313a?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e63c566d-744b-42f5-9ba6-9007cc60313a?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.58.6/widgets/features/tpl/default.php#L90",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/so-widgets-bundle/tags/1.58.6/widgets/features/tpl/default.php#L90"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3044174%40so-widgets-bundle%2Ftrunk&old=3040814%40so-widgets-bundle%2Ftrunk&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3044174%40so-widgets-bundle%2Ftrunk&old=3040814%40so-widgets-bundle%2Ftrunk&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "wesley"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1751.json b/2024/1xxx/CVE-2024-1751.json
index 5e65723d567..1e1e4499454 100644
--- a/2024/1xxx/CVE-2024-1751.json
+++ b/2024/1xxx/CVE-2024-1751.json
@@ -1,17 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1751",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Tutor LMS \u2013 eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and including, 2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber/student access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "themeum",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Tutor LMS \u2013 eLearning and online course solution",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "2.6.1"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f9cee379-79f8-4a60-b1bb-ccab1e954512?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f9cee379-79f8-4a60-b1bb-ccab1e954512?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/tutor/tags/2.6.1/classes/Utils.php#L4555",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/tutor/tags/2.6.1/classes/Utils.php#L4555"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3049105%40tutor&new=3049105%40tutor&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3049105%40tutor&new=3049105%40tutor&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Muhammad Hassham Nagori"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+ "baseScore": 8.8,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1763.json b/2024/1xxx/CVE-2024-1763.json
index 90ed185ae32..70f34e4ec0b 100644
--- a/2024/1xxx/CVE-2024-1763.json
+++ b/2024/1xxx/CVE-2024-1763.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1763",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp_social/v1/ REST API endpoint in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to enable and disable certain providers for the social share and login features."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-862 Missing Authorization"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "xpeedstudio",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Wp Social Login and Register Social Counter",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "3.0.0"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4f145c85-f3c6-46a7-b8ae-d486dd23087d?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4f145c85-f3c6-46a7-b8ae-d486dd23087d?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042283%40wp-social&new=3042283%40wp-social&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042283%40wp-social&new=3042283%40wp-social&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Krzysztof Zaj\u0105c"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
+ "baseScore": 6.5,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1772.json b/2024/1xxx/CVE-2024-1772.json
index 9f39f5e90e5..ef25c93c7f3 100644
--- a/2024/1xxx/CVE-2024-1772.json
+++ b/2024/1xxx/CVE-2024-1772.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1772",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Play.ht \u2013 Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.4 via deserialization of untrusted input from the play_podcast_data post meta. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-502 Deserialization of Untrusted Data"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "hammadh",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Play.ht \u2013 Make Your Blog Posts Accessible With Text to Speech Audio",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "3.6.4"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83a595b7-379c-4202-abdd-d8ba4a30c6a4?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/83a595b7-379c-4202-abdd-d8ba4a30c6a4?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/play-ht/trunk/includes/class-ajax-handler.php#L138",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/play-ht/trunk/includes/class-ajax-handler.php#L138"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Francesco Carlucci"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+ "baseScore": 8.8,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1793.json b/2024/1xxx/CVE-2024-1793.json
index 005a3a36107..af3abd2bfbf 100644
--- a/2024/1xxx/CVE-2024-1793.json
+++ b/2024/1xxx/CVE-2024-1793.json
@@ -1,17 +1,108 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1793",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The AWeber \u2013 Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth plugin for WordPress is vulnerable to SQL Injection via the 'post_id' parameter in all versions up to, and including, 7.3.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "aweber",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "AWeber \u2013 Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "7.3.14"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f3ae3bca-d363-4c4b-809f-0625385bc9a6?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f3ae3bca-d363-4c4b-809f-0625385bc9a6?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/aweber-web-form-widget/tags/7.3.12/php/aweber_webform_plugin.php#L962",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/aweber-web-form-widget/tags/7.3.12/php/aweber_webform_plugin.php#L962"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/aweber-web-form-widget/tags/7.3.12/php/aweber_webform_plugin.php#L970",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/aweber-web-form-widget/tags/7.3.12/php/aweber_webform_plugin.php#L970"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/aweber-web-form-widget/tags/7.3.12/php/aweber_webform_plugin.php#L972",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/aweber-web-form-widget/tags/7.3.12/php/aweber_webform_plugin.php#L972"
+ },
+ {
+ "url": "https://glimmer-handball-dae.notion.site/AWeber-Authenticated-SQLi-Admin-6e0d31c4a14c42f4996f9e201482d4cc?pvs=4",
+ "refsource": "MISC",
+ "name": "https://glimmer-handball-dae.notion.site/AWeber-Authenticated-SQLi-Admin-6e0d31c4a14c42f4996f9e201482d4cc?pvs=4"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042751%40aweber-web-form-widget&new=3042751%40aweber-web-form-widget&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3042751%40aweber-web-form-widget&new=3042751%40aweber-web-form-widget&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Kunal Sharma"
+ },
+ {
+ "lang": "en",
+ "value": "Akshay Kumar"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
+ "baseScore": 7.2,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1806.json b/2024/1xxx/CVE-2024-1806.json
index 5c8309de7eb..259e45cc150 100644
--- a/2024/1xxx/CVE-2024-1806.json
+++ b/2024/1xxx/CVE-2024-1806.json
@@ -1,17 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1806",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 4.15.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "collizo4sky",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content \u2013 ProfilePress",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "4.15.1"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d3b9d0ab-d785-4e93-9ab8-f75673a27334?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d3b9d0ab-d785-4e93-9ab8-f75673a27334?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.15.0/src/ShortcodeParser/EditProfileTag.php#L76",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/wp-user-avatar/tags/4.15.0/src/ShortcodeParser/EditProfileTag.php#L76"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3040292%40wp-user-avatar%2Ftrunk&old=3038677%40wp-user-avatar%2Ftrunk&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3040292%40wp-user-avatar%2Ftrunk&old=3038677%40wp-user-avatar%2Ftrunk&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "wesley"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1843.json b/2024/1xxx/CVE-2024-1843.json
index 8320d44be97..de14d1c95ed 100644
--- a/2024/1xxx/CVE-2024-1843.json
+++ b/2024/1xxx/CVE-2024-1843.json
@@ -1,17 +1,89 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1843",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Auto Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the aalAddLink function in all versions up to, and including, 6.4.3. This makes it possible for authenticated attackers, with subscriber access or higher, to add arbitrary links to posts."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-862 Missing Authorization"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "thedark",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Auto Affiliate Links",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "6.4.3"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/09e5aa34-ab28-4349-ac5f-6a0479e641e5?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/09e5aa34-ab28-4349-ac5f-6a0479e641e5?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/browser/wp-auto-affiliate-links/trunk/aal_ajax.php#L79",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/browser/wp-auto-affiliate-links/trunk/aal_ajax.php#L79"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3044067%40wp-auto-affiliate-links&new=3044067%40wp-auto-affiliate-links&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3044067%40wp-auto-affiliate-links&new=3044067%40wp-auto-affiliate-links&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Lucio S\u00e1"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
+ "baseScore": 4.3,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/1xxx/CVE-2024-1854.json b/2024/1xxx/CVE-2024-1854.json
index 844a2d77bfd..b919429ab57 100644
--- a/2024/1xxx/CVE-2024-1854.json
+++ b/2024/1xxx/CVE-2024-1854.json
@@ -1,17 +1,88 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-1854",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Essential Blocks \u2013 Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blockId parameter in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-20 Improper Input Validation"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "wpdevteam",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Essential Blocks \u2013 Page Builder Gutenberg Blocks, Patterns & Templates",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "4.5.1"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/86364b6f-dec8-48d8-9d2d-de1ee4901872?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/86364b6f-dec8-48d8-9d2d-de1ee4901872?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041859%40essential-blocks%2Ftrunk&old=3036273%40essential-blocks%2Ftrunk&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3041859%40essential-blocks%2Ftrunk&old=3036273%40essential-blocks%2Ftrunk&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Ng\u00f4 Thi\u00ean An"
+ },
+ {
+ "lang": "en",
+ "value": "Dau Hoang Tai"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23225.json b/2024/23xxx/CVE-2024-23225.json
index cecbc087928..7592df91071 100644
--- a/2024/23xxx/CVE-2024-23225.json
+++ b/2024/23xxx/CVE-2024-23225.json
@@ -108,6 +108,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23226.json b/2024/23xxx/CVE-2024-23226.json
index 7c0c2422f44..1889fe89c4b 100644
--- a/2024/23xxx/CVE-2024-23226.json
+++ b/2024/23xxx/CVE-2024-23226.json
@@ -131,6 +131,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23230.json b/2024/23xxx/CVE-2024-23230.json
index d61ae23d05e..1f2ebac251d 100644
--- a/2024/23xxx/CVE-2024-23230.json
+++ b/2024/23xxx/CVE-2024-23230.json
@@ -73,16 +73,6 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
- },
- {
- "url": "http://seclists.org/fulldisclosure/2024/Mar/22",
- "refsource": "MISC",
- "name": "http://seclists.org/fulldisclosure/2024/Mar/22"
- },
- {
- "url": "http://seclists.org/fulldisclosure/2024/Mar/23",
- "refsource": "MISC",
- "name": "http://seclists.org/fulldisclosure/2024/Mar/23"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23232.json b/2024/23xxx/CVE-2024-23232.json
index d28b91f4ad8..419cf260607 100644
--- a/2024/23xxx/CVE-2024-23232.json
+++ b/2024/23xxx/CVE-2024-23232.json
@@ -58,6 +58,11 @@
"url": "https://support.apple.com/en-us/HT214084",
"refsource": "MISC",
"name": "https://support.apple.com/en-us/HT214084"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/21",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/21"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23233.json b/2024/23xxx/CVE-2024-23233.json
index 6582e6e1ddf..fdc705b6537 100644
--- a/2024/23xxx/CVE-2024-23233.json
+++ b/2024/23xxx/CVE-2024-23233.json
@@ -58,6 +58,11 @@
"url": "https://support.apple.com/en-us/HT214084",
"refsource": "MISC",
"name": "https://support.apple.com/en-us/HT214084"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/21",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/21"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23239.json b/2024/23xxx/CVE-2024-23239.json
index b37387d2c17..eaf8681ddf3 100644
--- a/2024/23xxx/CVE-2024-23239.json
+++ b/2024/23xxx/CVE-2024-23239.json
@@ -114,6 +114,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23241.json b/2024/23xxx/CVE-2024-23241.json
index 53d623052da..8e8f4efbf72 100644
--- a/2024/23xxx/CVE-2024-23241.json
+++ b/2024/23xxx/CVE-2024-23241.json
@@ -97,6 +97,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23244.json b/2024/23xxx/CVE-2024-23244.json
index 9b00db414ca..8ce0ddf280a 100644
--- a/2024/23xxx/CVE-2024-23244.json
+++ b/2024/23xxx/CVE-2024-23244.json
@@ -68,11 +68,6 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
- },
- {
- "url": "http://seclists.org/fulldisclosure/2024/Mar/23",
- "refsource": "MISC",
- "name": "http://seclists.org/fulldisclosure/2024/Mar/23"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23246.json b/2024/23xxx/CVE-2024-23246.json
index b54e850a873..8812f91441e 100644
--- a/2024/23xxx/CVE-2024-23246.json
+++ b/2024/23xxx/CVE-2024-23246.json
@@ -141,16 +141,6 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/25",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/25"
- },
- {
- "url": "http://seclists.org/fulldisclosure/2024/Mar/24",
- "refsource": "MISC",
- "name": "http://seclists.org/fulldisclosure/2024/Mar/24"
- },
- {
- "url": "http://seclists.org/fulldisclosure/2024/Mar/26",
- "refsource": "MISC",
- "name": "http://seclists.org/fulldisclosure/2024/Mar/26"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23249.json b/2024/23xxx/CVE-2024-23249.json
index c0915dbd0f2..5834ceac545 100644
--- a/2024/23xxx/CVE-2024-23249.json
+++ b/2024/23xxx/CVE-2024-23249.json
@@ -58,6 +58,11 @@
"url": "https://support.apple.com/en-us/HT214084",
"refsource": "MISC",
"name": "https://support.apple.com/en-us/HT214084"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/21",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/21"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23250.json b/2024/23xxx/CVE-2024-23250.json
index dedccb41ffc..87cdbc1c637 100644
--- a/2024/23xxx/CVE-2024-23250.json
+++ b/2024/23xxx/CVE-2024-23250.json
@@ -109,6 +109,16 @@
"url": "https://support.apple.com/en-us/HT214088",
"refsource": "MISC",
"name": "https://support.apple.com/en-us/HT214088"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/21",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23254.json b/2024/23xxx/CVE-2024-23254.json
index 7523885283c..6357d4f8733 100644
--- a/2024/23xxx/CVE-2024-23254.json
+++ b/2024/23xxx/CVE-2024-23254.json
@@ -153,6 +153,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23263.json b/2024/23xxx/CVE-2024-23263.json
index 94a66ace581..3cc26ebd2f8 100644
--- a/2024/23xxx/CVE-2024-23263.json
+++ b/2024/23xxx/CVE-2024-23263.json
@@ -158,6 +158,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23264.json b/2024/23xxx/CVE-2024-23264.json
index 1471a4b6cb1..27e024998fc 100644
--- a/2024/23xxx/CVE-2024-23264.json
+++ b/2024/23xxx/CVE-2024-23264.json
@@ -129,6 +129,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23265.json b/2024/23xxx/CVE-2024-23265.json
index f34949b03e3..025b106b87a 100644
--- a/2024/23xxx/CVE-2024-23265.json
+++ b/2024/23xxx/CVE-2024-23265.json
@@ -146,6 +146,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23266.json b/2024/23xxx/CVE-2024-23266.json
index 2aaff25eda3..eca13f08220 100644
--- a/2024/23xxx/CVE-2024-23266.json
+++ b/2024/23xxx/CVE-2024-23266.json
@@ -73,16 +73,6 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
- },
- {
- "url": "http://seclists.org/fulldisclosure/2024/Mar/22",
- "refsource": "MISC",
- "name": "http://seclists.org/fulldisclosure/2024/Mar/22"
- },
- {
- "url": "http://seclists.org/fulldisclosure/2024/Mar/23",
- "refsource": "MISC",
- "name": "http://seclists.org/fulldisclosure/2024/Mar/23"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23269.json b/2024/23xxx/CVE-2024-23269.json
index 6a1514bc464..faf13edfafb 100644
--- a/2024/23xxx/CVE-2024-23269.json
+++ b/2024/23xxx/CVE-2024-23269.json
@@ -73,16 +73,6 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
- },
- {
- "url": "http://seclists.org/fulldisclosure/2024/Mar/22",
- "refsource": "MISC",
- "name": "http://seclists.org/fulldisclosure/2024/Mar/22"
- },
- {
- "url": "http://seclists.org/fulldisclosure/2024/Mar/23",
- "refsource": "MISC",
- "name": "http://seclists.org/fulldisclosure/2024/Mar/23"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23270.json b/2024/23xxx/CVE-2024-23270.json
index 0024dbd0fb0..2b3541fdc3c 100644
--- a/2024/23xxx/CVE-2024-23270.json
+++ b/2024/23xxx/CVE-2024-23270.json
@@ -107,6 +107,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23274.json b/2024/23xxx/CVE-2024-23274.json
index a732a752d0b..0c18e608b0e 100644
--- a/2024/23xxx/CVE-2024-23274.json
+++ b/2024/23xxx/CVE-2024-23274.json
@@ -73,16 +73,6 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
- },
- {
- "url": "http://seclists.org/fulldisclosure/2024/Mar/22",
- "refsource": "MISC",
- "name": "http://seclists.org/fulldisclosure/2024/Mar/22"
- },
- {
- "url": "http://seclists.org/fulldisclosure/2024/Mar/23",
- "refsource": "MISC",
- "name": "http://seclists.org/fulldisclosure/2024/Mar/23"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23278.json b/2024/23xxx/CVE-2024-23278.json
index dc97f0c6212..1876168700b 100644
--- a/2024/23xxx/CVE-2024-23278.json
+++ b/2024/23xxx/CVE-2024-23278.json
@@ -129,6 +129,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23280.json b/2024/23xxx/CVE-2024-23280.json
index 4051b507c91..3502e8f35ea 100644
--- a/2024/23xxx/CVE-2024-23280.json
+++ b/2024/23xxx/CVE-2024-23280.json
@@ -136,6 +136,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23283.json b/2024/23xxx/CVE-2024-23283.json
index c95a7bfc8ba..d57da3c2a76 100644
--- a/2024/23xxx/CVE-2024-23283.json
+++ b/2024/23xxx/CVE-2024-23283.json
@@ -90,16 +90,6 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
- },
- {
- "url": "http://seclists.org/fulldisclosure/2024/Mar/22",
- "refsource": "MISC",
- "name": "http://seclists.org/fulldisclosure/2024/Mar/22"
- },
- {
- "url": "http://seclists.org/fulldisclosure/2024/Mar/23",
- "refsource": "MISC",
- "name": "http://seclists.org/fulldisclosure/2024/Mar/23"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23286.json b/2024/23xxx/CVE-2024-23286.json
index bbc0a562b33..0cdf120db81 100644
--- a/2024/23xxx/CVE-2024-23286.json
+++ b/2024/23xxx/CVE-2024-23286.json
@@ -146,6 +146,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23288.json b/2024/23xxx/CVE-2024-23288.json
index 23e8373207e..9d7c022b120 100644
--- a/2024/23xxx/CVE-2024-23288.json
+++ b/2024/23xxx/CVE-2024-23288.json
@@ -109,6 +109,16 @@
"url": "https://support.apple.com/en-us/HT214088",
"refsource": "MISC",
"name": "https://support.apple.com/en-us/HT214088"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/21",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23290.json b/2024/23xxx/CVE-2024-23290.json
index c7f773e67e9..88bc4c72fe8 100644
--- a/2024/23xxx/CVE-2024-23290.json
+++ b/2024/23xxx/CVE-2024-23290.json
@@ -114,6 +114,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23291.json b/2024/23xxx/CVE-2024-23291.json
index b479a669731..fcf586ec44e 100644
--- a/2024/23xxx/CVE-2024-23291.json
+++ b/2024/23xxx/CVE-2024-23291.json
@@ -114,6 +114,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23293.json b/2024/23xxx/CVE-2024-23293.json
index 9b4bdef29ec..774d8068626 100644
--- a/2024/23xxx/CVE-2024-23293.json
+++ b/2024/23xxx/CVE-2024-23293.json
@@ -114,6 +114,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23296.json b/2024/23xxx/CVE-2024-23296.json
index 77936c1f1cb..cb6a62fc9eb 100644
--- a/2024/23xxx/CVE-2024-23296.json
+++ b/2024/23xxx/CVE-2024-23296.json
@@ -88,6 +88,11 @@
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23297.json b/2024/23xxx/CVE-2024-23297.json
index 86792117ad9..3df6e925ac2 100644
--- a/2024/23xxx/CVE-2024-23297.json
+++ b/2024/23xxx/CVE-2024-23297.json
@@ -92,6 +92,11 @@
"url": "https://support.apple.com/en-us/HT214088",
"refsource": "MISC",
"name": "https://support.apple.com/en-us/HT214088"
+ },
+ {
+ "url": "http://seclists.org/fulldisclosure/2024/Mar/25",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2024/Mar/25"
}
]
}
diff --git a/2024/23xxx/CVE-2024-23745.json b/2024/23xxx/CVE-2024-23745.json
index 1133960b853..0ee3cd8237e 100644
--- a/2024/23xxx/CVE-2024-23745.json
+++ b/2024/23xxx/CVE-2024-23745.json
@@ -34,7 +34,7 @@
"description_data": [
{
"lang": "eng",
- "value": "In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context."
+ "value": "** DISPUTED ** In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context. NOTE: the vendor's perspective is that this is simply an instance of CVE-2022-48505, cannot properly be categorized as a product-level vulnerability, and cannot have a product-level fix because it is about incorrect caching of file signatures on macOS."
}
]
},
@@ -56,6 +56,16 @@
"refsource": "MISC",
"name": "https://github.com/louiselalanne/CVE-2024-23745",
"url": "https://github.com/louiselalanne/CVE-2024-23745"
+ },
+ {
+ "refsource": "MISC",
+ "name": "https://blog.xpnsec.com/dirtynib/",
+ "url": "https://blog.xpnsec.com/dirtynib/"
+ },
+ {
+ "refsource": "MISC",
+ "name": "https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-physically_local-attacks-in-Chromes-threat-model",
+ "url": "https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-physically_local-attacks-in-Chromes-threat-model"
}
]
}
diff --git a/2024/27xxx/CVE-2024-27703.json b/2024/27xxx/CVE-2024-27703.json
index 6997f92a674..627c972dbc7 100644
--- a/2024/27xxx/CVE-2024-27703.json
+++ b/2024/27xxx/CVE-2024-27703.json
@@ -1,17 +1,61 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
- "ID": "CVE-2024-27703",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ID": "CVE-2024-27703",
+ "STATE": "PUBLIC"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "n/a"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do title parameter."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://github.com/b-hermes/vulnerability-research/blob/main/CVE-2024-27703/README.md",
+ "url": "https://github.com/b-hermes/vulnerability-research/blob/main/CVE-2024-27703/README.md"
}
]
}
diff --git a/2024/28xxx/CVE-2024-28682.json b/2024/28xxx/CVE-2024-28682.json
index 4d5fd1fbb03..fb7064bd794 100644
--- a/2024/28xxx/CVE-2024-28682.json
+++ b/2024/28xxx/CVE-2024-28682.json
@@ -1,17 +1,61 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
- "ID": "CVE-2024-28682",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ID": "CVE-2024-28682",
+ "STATE": "PUBLIC"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "n/a"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/sys_cache_up.php."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/777erp/cms/blob/main/13.md",
+ "refsource": "MISC",
+ "name": "https://github.com/777erp/cms/blob/main/13.md"
}
]
}
diff --git a/2024/2xxx/CVE-2024-2079.json b/2024/2xxx/CVE-2024-2079.json
index ac1505637db..78bc9349d6b 100644
--- a/2024/2xxx/CVE-2024-2079.json
+++ b/2024/2xxx/CVE-2024-2079.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-2079",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The WPBakery Page Builder Addons by Livemesh plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'per_line_mobile' shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "livemesh",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "WPBakery Page Builder Addons by Livemesh",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "3.8.1"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2c07b5c8-7fae-499d-9f6c-9392166f74b8?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2c07b5c8-7fae-499d-9f6c-9392166f74b8?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3048239%40addons-for-visual-composer&new=3048239%40addons-for-visual-composer&sfp_email=&sfph_mail=",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3048239%40addons-for-visual-composer&new=3048239%40addons-for-visual-composer&sfp_email=&sfph_mail="
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Krzysztof Zaj\u0105c"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/2xxx/CVE-2024-2242.json b/2024/2xxx/CVE-2024-2242.json
index 4cfb3098301..08b62c6ab37 100644
--- a/2024/2xxx/CVE-2024-2242.json
+++ b/2024/2xxx/CVE-2024-2242.json
@@ -1,17 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-2242",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@wordfence.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018active-tab\u2019 parameter in all versions up to, and including, 5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "takayukister",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Contact Form 7",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "*",
+ "version_value": "5.9"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d5bf4972-424a-4470-a0bc-7dcc95378e0e?source=cve",
+ "refsource": "MISC",
+ "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d5bf4972-424a-4470-a0bc-7dcc95378e0e?source=cve"
+ },
+ {
+ "url": "https://plugins.trac.wordpress.org/changeset/3049594/contact-form-7/trunk/admin/edit-contact-form.php",
+ "refsource": "MISC",
+ "name": "https://plugins.trac.wordpress.org/changeset/3049594/contact-form-7/trunk/admin/edit-contact-form.php"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Asaf Mozes"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+ "baseScore": 6.1,
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2024/2xxx/CVE-2024-2439.json b/2024/2xxx/CVE-2024-2439.json
new file mode 100644
index 00000000000..717d9184279
--- /dev/null
+++ b/2024/2xxx/CVE-2024-2439.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2024-2439",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2024/2xxx/CVE-2024-2440.json b/2024/2xxx/CVE-2024-2440.json
new file mode 100644
index 00000000000..f34cf05adcd
--- /dev/null
+++ b/2024/2xxx/CVE-2024-2440.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2024-2440",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2024/2xxx/CVE-2024-2441.json b/2024/2xxx/CVE-2024-2441.json
new file mode 100644
index 00000000000..5c8414279dd
--- /dev/null
+++ b/2024/2xxx/CVE-2024-2441.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2024-2441",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2024/2xxx/CVE-2024-2442.json b/2024/2xxx/CVE-2024-2442.json
new file mode 100644
index 00000000000..440c48e975b
--- /dev/null
+++ b/2024/2xxx/CVE-2024-2442.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2024-2442",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file