"-Synchronized-Data."

This commit is contained in:
CVE Team 2024-12-24 05:01:02 +00:00
parent 55d99ea732
commit d0077863dd
No known key found for this signature in database
GPG Key ID: BC5FD8F2443B23B7
5 changed files with 385 additions and 20 deletions

View File

@ -1,17 +1,100 @@
{ {
"data_version": "4.0",
"data_type": "CVE", "data_type": "CVE",
"data_format": "MITRE", "data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": { "CVE_data_meta": {
"ID": "CVE-2024-12266", "ID": "CVE-2024-12266",
"ASSIGNER": "cve@mitre.org", "ASSIGNER": "security@wordfence.com",
"STATE": "RESERVED" "STATE": "PUBLIC"
}, },
"description": { "description": {
"description_data": [ "description_data": [
{ {
"lang": "eng", "lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." "value": "The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the elex_dp_export_rules() and elex_dp_import_rules() functions in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to import and export product rules along with obtaining phpinfo() data"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-862 Missing Authorization",
"cweId": "CWE-862"
}
]
}
]
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "elextensions",
"product": {
"product_data": [
{
"product_name": "ELEX WooCommerce Dynamic Pricing and Discounts",
"version": {
"version_data": [
{
"version_affected": "<=",
"version_name": "*",
"version_value": "2.1.7"
}
]
}
}
]
}
}
]
}
},
"references": {
"reference_data": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/063d452b-2a35-40aa-a002-ea55da778222?source=cve",
"refsource": "MISC",
"name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/063d452b-2a35-40aa-a002-ea55da778222?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/elex-woocommerce-dynamic-pricing-and-discounts/tags/2.1.7/admin/elex-exporter.php#L9",
"refsource": "MISC",
"name": "https://plugins.trac.wordpress.org/browser/elex-woocommerce-dynamic-pricing-and-discounts/tags/2.1.7/admin/elex-exporter.php#L9"
},
{
"url": "https://plugins.trac.wordpress.org/browser/elex-woocommerce-dynamic-pricing-and-discounts/tags/2.1.7/admin/elex-importer.php#L8",
"refsource": "MISC",
"name": "https://plugins.trac.wordpress.org/browser/elex-woocommerce-dynamic-pricing-and-discounts/tags/2.1.7/admin/elex-importer.php#L8"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3211131%40elex-woocommerce-dynamic-pricing-and-discounts&new=3211131%40elex-woocommerce-dynamic-pricing-and-discounts&sfp_email=&sfph_mail=#file7",
"refsource": "MISC",
"name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3211131%40elex-woocommerce-dynamic-pricing-and-discounts&new=3211131%40elex-woocommerce-dynamic-pricing-and-discounts&sfp_email=&sfph_mail=#file7"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3211131%40elex-woocommerce-dynamic-pricing-and-discounts&new=3211131%40elex-woocommerce-dynamic-pricing-and-discounts&sfp_email=&sfph_mail=#file8",
"refsource": "MISC",
"name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3211131%40elex-woocommerce-dynamic-pricing-and-discounts&new=3211131%40elex-woocommerce-dynamic-pricing-and-discounts&sfp_email=&sfph_mail=#file8"
}
]
},
"credits": [
{
"lang": "en",
"value": "Fariq Fadillah Gusti Insani"
}
],
"impact": {
"cvss": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
} }
] ]
} }

View File

@ -1,17 +1,95 @@
{ {
"data_version": "4.0",
"data_type": "CVE", "data_type": "CVE",
"data_format": "MITRE", "data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": { "CVE_data_meta": {
"ID": "CVE-2024-12507", "ID": "CVE-2024-12507",
"ASSIGNER": "cve@mitre.org", "ASSIGNER": "security@wordfence.com",
"STATE": "RESERVED" "STATE": "PUBLIC"
}, },
"description": { "description": {
"description_data": [ "description_data": [
{ {
"lang": "eng", "lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." "value": "The Optio Dentistry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'optio-lightbox' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79"
}
]
}
]
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "optio",
"product": {
"product_data": [
{
"product_name": "Optio Dentistry",
"version": {
"version_data": [
{
"version_affected": "<=",
"version_name": "*",
"version_value": "2.1"
}
]
}
}
]
}
}
]
}
},
"references": {
"reference_data": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4241118f-9bcb-4dec-abd2-7172db2cf445?source=cve",
"refsource": "MISC",
"name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4241118f-9bcb-4dec-abd2-7172db2cf445?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/optio-dentistry/tags/2.1/optio-dentistry.php#L18",
"refsource": "MISC",
"name": "https://plugins.trac.wordpress.org/browser/optio-dentistry/tags/2.1/optio-dentistry.php#L18"
},
{
"url": "https://plugins.trac.wordpress.org/browser/optio-dentistry/tags/2.1/optio-dentistry.php#L92",
"refsource": "MISC",
"name": "https://plugins.trac.wordpress.org/browser/optio-dentistry/tags/2.1/optio-dentistry.php#L92"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208800%40optio-dentistry&new=3208800%40optio-dentistry&sfp_email=&sfph_mail=",
"refsource": "MISC",
"name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3208800%40optio-dentistry&new=3208800%40optio-dentistry&sfp_email=&sfph_mail="
}
]
},
"credits": [
{
"lang": "en",
"value": "muhammad yudha"
}
],
"impact": {
"cvss": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 6.4,
"baseSeverity": "MEDIUM"
} }
] ]
} }

View File

@ -1,17 +1,85 @@
{ {
"data_version": "4.0",
"data_type": "CVE", "data_type": "CVE",
"data_format": "MITRE", "data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": { "CVE_data_meta": {
"ID": "CVE-2024-12518", "ID": "CVE-2024-12518",
"ASSIGNER": "cve@mitre.org", "ASSIGNER": "security@wordfence.com",
"STATE": "RESERVED" "STATE": "PUBLIC"
}, },
"description": { "description": {
"description_data": [ "description_data": [
{ {
"lang": "eng", "lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." "value": "The ShMapper by Teplitsa plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shmMap' shortcode in all versions up to, and including, 1.4.18 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79"
}
]
}
]
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "denischerniatev",
"product": {
"product_data": [
{
"product_name": "ShMapper by Teplitsa",
"version": {
"version_data": [
{
"version_affected": "<=",
"version_name": "*",
"version_value": "1.4.18"
}
]
}
}
]
}
}
]
}
},
"references": {
"reference_data": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/18e2a443-381c-46cd-85c7-20716f4e59c1?source=cve",
"refsource": "MISC",
"name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/18e2a443-381c-46cd-85c7-20716f4e59c1?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3211065/shmapper-by-teplitsa/trunk/shortcode/shmMap.shortcode.php",
"refsource": "MISC",
"name": "https://plugins.trac.wordpress.org/changeset/3211065/shmapper-by-teplitsa/trunk/shortcode/shmMap.shortcode.php"
}
]
},
"credits": [
{
"lang": "en",
"value": "Peter Thaleikis"
}
],
"impact": {
"cvss": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 6.4,
"baseSeverity": "MEDIUM"
} }
] ]
} }

View File

@ -1,17 +1,85 @@
{ {
"data_version": "4.0",
"data_type": "CVE", "data_type": "CVE",
"data_format": "MITRE", "data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": { "CVE_data_meta": {
"ID": "CVE-2024-12617", "ID": "CVE-2024-12617",
"ASSIGNER": "cve@mitre.org", "ASSIGNER": "security@wordfence.com",
"STATE": "RESERVED" "STATE": "PUBLIC"
}, },
"description": { "description": {
"description_data": [ "description_data": [
{ {
"lang": "eng", "lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." "value": "The WC Price History for Omnibus plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and modify history data."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-862 Missing Authorization",
"cweId": "CWE-862"
}
]
}
]
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "kkarpieszuk",
"product": {
"product_data": [
{
"product_name": "WC Price History for Omnibus",
"version": {
"version_data": [
{
"version_affected": "<=",
"version_name": "*",
"version_value": "2.1.3"
}
]
}
}
]
}
}
]
}
},
"references": {
"reference_data": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b380b053-9847-48a8-ba12-d07db9df2baf?source=cve",
"refsource": "MISC",
"name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b380b053-9847-48a8-ba12-d07db9df2baf?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209687%40wc-price-history&new=3209687%40wc-price-history&sfp_email=&sfph_mail=",
"refsource": "MISC",
"name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209687%40wc-price-history&new=3209687%40wc-price-history&sfp_email=&sfph_mail="
}
]
},
"credits": [
{
"lang": "en",
"value": "Lucio S\u00e1"
}
],
"impact": {
"cvss": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
} }
] ]
} }

View File

@ -1,17 +1,85 @@
{ {
"data_version": "4.0",
"data_type": "CVE", "data_type": "CVE",
"data_format": "MITRE", "data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": { "CVE_data_meta": {
"ID": "CVE-2024-12710", "ID": "CVE-2024-12710",
"ASSIGNER": "cve@mitre.org", "ASSIGNER": "security@wordfence.com",
"STATE": "RESERVED" "STATE": "PUBLIC"
}, },
"description": { "description": {
"description_data": [ "description_data": [
{ {
"lang": "eng", "lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." "value": "The WP-Appbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79"
}
]
}
]
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "marcelismus",
"product": {
"product_data": [
{
"product_name": "WP-Appbox",
"version": {
"version_data": [
{
"version_affected": "<=",
"version_name": "*",
"version_value": "4.5.3"
}
]
}
}
]
}
}
]
}
},
"references": {
"reference_data": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/101451de-1ed4-4717-86c5-a41feafd4c7e?source=cve",
"refsource": "MISC",
"name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/101451de-1ed4-4717-86c5-a41feafd4c7e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=/wp-appbox/tags/4.5.3&new_path=/wp-appbox/tags/4.5.4&sfp_email=&sfph_mail=",
"refsource": "MISC",
"name": "https://plugins.trac.wordpress.org/changeset?old_path=/wp-appbox/tags/4.5.3&new_path=/wp-appbox/tags/4.5.4&sfp_email=&sfph_mail="
}
]
},
"credits": [
{
"lang": "en",
"value": "Colin Xu"
}
],
"impact": {
"cvss": [
{
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 6.1,
"baseSeverity": "MEDIUM"
} }
] ]
} }