From 75e61619cae1bbc15531054717d863284fb238c6 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Fri, 21 Jun 2024 05:00:32 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2023/4xxx/CVE-2023-4012.json | 10 ----- 2024/5xxx/CVE-2024-5756.json | 80 ++++++++++++++++++++++++++++++++++-- 2024/6xxx/CVE-2024-6218.json | 16 ++++---- 2024/6xxx/CVE-2024-6239.json | 18 ++++++++ 4 files changed, 102 insertions(+), 22 deletions(-) create mode 100644 2024/6xxx/CVE-2024-6239.json diff --git a/2023/4xxx/CVE-2023-4012.json b/2023/4xxx/CVE-2023-4012.json index 9b8e7821250..2094ad98cad 100644 --- a/2023/4xxx/CVE-2023-4012.json +++ b/2023/4xxx/CVE-2023-4012.json @@ -63,16 +63,6 @@ "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1038422", "refsource": "MISC", "name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1038422" - }, - { - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VQDOZSTH2AZXBO2QAVR2SZEMK2A7WBRB/", - "refsource": "MISC", - "name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VQDOZSTH2AZXBO2QAVR2SZEMK2A7WBRB/" - }, - { - "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OC2KDNL4GO7MDAFSNWBQA4T2Q2VNPUJD/", - "refsource": "MISC", - "name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OC2KDNL4GO7MDAFSNWBQA4T2Q2VNPUJD/" } ] }, diff --git a/2024/5xxx/CVE-2024-5756.json b/2024/5xxx/CVE-2024-5756.json index 64971a02c6f..8bbc3cc5624 100644 --- a/2024/5xxx/CVE-2024-5756.json +++ b/2024/5xxx/CVE-2024-5756.json @@ -1,17 +1,89 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-5756", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@wordfence.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The Email Subscribers by Icegram Express \u2013 Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.23 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "icegram", + "product": { + "product_data": [ + { + "product_name": "Email Subscribers by Icegram Express \u2013 Email Marketing, Newsletters, Automation for WordPress & WooCommerce", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "*", + "version_value": "5.7.23" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5bd11c6-2f55-4eee-834a-c4e405482b9c?source=cve", + "refsource": "MISC", + "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5bd11c6-2f55-4eee-834a-c4e405482b9c?source=cve" + }, + { + "url": "https://plugins.trac.wordpress.org/browser/email-subscribers/trunk/lite/includes/db/class-es-db-contacts.php#L532", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/browser/email-subscribers/trunk/lite/includes/db/class-es-db-contacts.php#L532" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset/3101638/email-subscribers/trunk/lite/includes/db/class-es-db-contacts.php", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/changeset/3101638/email-subscribers/trunk/lite/includes/db/class-es-db-contacts.php" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Arkadiusz Hydzik" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "baseScore": 9.8, + "baseSeverity": "CRITICAL" } ] } diff --git a/2024/6xxx/CVE-2024-6218.json b/2024/6xxx/CVE-2024-6218.json index 9a014b1b164..c4a9f88c3a3 100644 --- a/2024/6xxx/CVE-2024-6218.json +++ b/2024/6xxx/CVE-2024-6218.json @@ -90,20 +90,20 @@ "cvss": [ { "version": "3.1", - "baseScore": 6.3, - "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", - "baseSeverity": "MEDIUM" + "baseScore": 7.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "HIGH" }, { "version": "3.0", - "baseScore": 6.3, - "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", - "baseSeverity": "MEDIUM" + "baseScore": 7.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "HIGH" }, { "version": "2.0", - "baseScore": 6.5, - "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P" + "baseScore": 7.5, + "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P" } ] } diff --git a/2024/6xxx/CVE-2024-6239.json b/2024/6xxx/CVE-2024-6239.json new file mode 100644 index 00000000000..0a4594be5be --- /dev/null +++ b/2024/6xxx/CVE-2024-6239.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-6239", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file