From e9144ad663892e7a0ff64db296257c5e1b482779 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Tue, 8 Oct 2024 08:00:33 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2024/47xxx/CVE-2024-47095.json | 61 +++++++++++++++++++++++-- 2024/8xxx/CVE-2024-8964.json | 81 ++++++++++++++++++++++++++++++++-- 2 files changed, 134 insertions(+), 8 deletions(-) diff --git a/2024/47xxx/CVE-2024-47095.json b/2024/47xxx/CVE-2024-47095.json index 5f2532e09f2..f1fb2e24c49 100644 --- a/2024/47xxx/CVE-2024-47095.json +++ b/2024/47xxx/CVE-2024-47095.json @@ -1,18 +1,71 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-47095", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "disclose@securin.io", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Cross Site Scripting vulnerability in Follet School Solutions Destiny before v22.0.1 AU1 allows a remote attacker to run arbitrary client-side code via the expiredSupportMessage parameter of handleloginform.do." } ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Follet School Solutions", + "product": { + "product_data": [ + { + "product_name": "Destiny", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "0", + "version_value": "22.0.1 AU1" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.securin.io/zerodays/cve-2024-47095-reflected-cross-site-scripting-in-follett-school-solutions-destiny-library-manager/", + "refsource": "MISC", + "name": "https://www.securin.io/zerodays/cve-2024-47095-reflected-cross-site-scripting-in-follett-school-solutions-destiny-library-manager/" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "UNKNOWN" } } \ No newline at end of file diff --git a/2024/8xxx/CVE-2024-8964.json b/2024/8xxx/CVE-2024-8964.json index 4ef0a4efdf0..cc52abd231f 100644 --- a/2024/8xxx/CVE-2024-8964.json +++ b/2024/8xxx/CVE-2024-8964.json @@ -1,17 +1,90 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-8964", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@wordfence.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The Image Optimizer, Resizer and CDN \u2013 Sirv plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 7.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "sirv", + "product": { + "product_data": [ + { + "product_name": "Image Optimizer, Resizer and CDN \u2013 Sirv", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "*", + "version_value": "7.2.9" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/39b2435f-32a3-4158-a734-c21a0cab15be?source=cve", + "refsource": "MISC", + "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/39b2435f-32a3-4158-a734-c21a0cab15be?source=cve" + }, + { + "url": "https://wordpress.org/plugins/sirv/#developers", + "refsource": "MISC", + "name": "https://wordpress.org/plugins/sirv/#developers" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset/3162079/", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/changeset/3162079/" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Francesco Carlucci" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", + "baseScore": 6.4, + "baseSeverity": "MEDIUM" } ] }