Auto-Update: 2024-06-01T08:00:37.915599+00:00

This commit is contained in:
cad-safe-bot 2024-06-01 08:03:29 +00:00
parent f205b36b72
commit 3c734e7ca1
7 changed files with 276 additions and 10 deletions

View File

@ -0,0 +1,47 @@
{
"id": "CVE-2024-1324",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-06-01T07:15:07.850",
"lastModified": "2024-06-01T07:15:07.850",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The QQWorld Auto Save Images plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the save_remote_images_get_auto_saved_results() function hooked via a norpriv AJAX in all versions up to, and including, 1.9.8. This makes it possible for unauthenticated attackers to retrieve the contents of arbitrary posts that may not be public."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/qqworld-auto-save-images/trunk/qqworld-auto-save-images.php#L417",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ed82f527-b7af-4466-a977-855f109ed997?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,47 @@
{
"id": "CVE-2024-2506",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-06-01T07:15:08.393",
"lastModified": "2024-06-01T07:15:08.393",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Popup Builder \u2013 Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS functionality in all versions up to, and including, 4.2.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3085485%40popup-builder&new=3085485%40popup-builder&sfp_email=&sfph_mail=#file51",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/804a973e-4650-428c-910f-09e4fc3aa4bb?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,51 @@
{
"id": "CVE-2024-4087",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-06-01T06:15:08.340",
"lastModified": "2024-06-01T06:15:08.340",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Back to Top widget in all versions up to, and including, 1.3.975 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.3.972/modules/back-to-top/widgets/wpr-back-to-top.php#L684",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3094946/royal-elementor-addons/tags/1.3.976/modules/back-to-top/widgets/wpr-back-to-top.php?old=3086875&old_path=royal-elementor-addons%2Ftags%2F1.3.975%2Fmodules%2Fback-to-top%2Fwidgets%2Fwpr-back-to-top.php",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cca7bb88-4a2c-4406-8610-15ce6e77c31f?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,63 @@
{
"id": "CVE-2024-4342",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-06-01T06:15:09.520",
"lastModified": "2024-06-01T06:15:09.520",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's image hotspot, image accordion, off canvas, woogrid, and product mini cart widgets in all versions up to, and including, 1.3.975 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/changeset/3094946/royal-elementor-addons/tags/1.3.976/modules/image-accordion/widgets/wpr-image-accordion.php?old=3086875&old_path=royal-elementor-addons%2Ftags%2F1.3.975%2Fmodules%2Fimage-accordion%2Fwidgets%2Fwpr-image-accordion.php",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3094946/royal-elementor-addons/tags/1.3.976/modules/image-hotspots/widgets/wpr-image-hotspots.php?old=3086875&old_path=royal-elementor-addons%2Ftags%2F1.3.975%2Fmodules%2Fimage-hotspots%2Fwidgets%2Fwpr-image-hotspots.php",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3094946/royal-elementor-addons/tags/1.3.976/modules/offcanvas/widgets/wpr-offcanvas.php?old=3086875&old_path=royal-elementor-addons%2Ftags%2F1.3.975%2Fmodules%2Foffcanvas%2Fwidgets%2Fwpr-offcanvas.php",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3094946/royal-elementor-addons/tags/1.3.976/modules/theme-builder/woocommerce/product-mini-cart/widgets/wpr-product-mini-cart.php?old=3086875&old_path=royal-elementor-addons%2Ftags%2F1.3.975%2Fmodules%2Ftheme-builder%2Fwoocommerce%2Fproduct-mini-cart%2Fwidgets%2Fwpr-product-mini-cart.php",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3094946/royal-elementor-addons/tags/1.3.976/modules/woo-grid/widgets/wpr-woo-grid.php?old=3086875&old_path=royal-elementor-addons%2Ftags%2F1.3.975%2Fmodules%2Fwoo-grid%2Fwidgets%2Fwpr-woo-grid.php",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d565196-592d-415c-b37c-e54456aa9ed8?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,51 @@
{
"id": "CVE-2024-5501",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-06-01T06:15:09.993",
"lastModified": "2024-06-01T06:15:09.993",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Supreme Modules Lite \u2013 Divi Theme, Extra Theme and Divi Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018button_one_id\u2019 parameter in all versions up to, and including, 2.5.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/supreme-modules-for-divi/trunk/includes/modules/Buttons/Buttons.php#L1889",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3095671/",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6543e6e2-e052-466e-ad19-656fd8d01805?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2024-06-01T06:00:30.048267+00:00
2024-06-01T08:00:37.915599+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2024-06-01T05:15:08.287000+00:00
2024-06-01T07:15:08.393000+00:00
```
### Last Data Feed Release
@ -33,16 +33,18 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
252349
252354
```
### CVEs added in the last Commit
Recently added CVEs: `3`
Recently added CVEs: `5`
- [CVE-2023-6382](CVE-2023/CVE-2023-63xx/CVE-2023-6382.json) (`2024-06-01T05:15:08.287`)
- [CVE-2024-3564](CVE-2024/CVE-2024-35xx/CVE-2024-3564.json) (`2024-06-01T04:15:08.743`)
- [CVE-2024-3565](CVE-2024/CVE-2024-35xx/CVE-2024-3565.json) (`2024-06-01T04:15:09.000`)
- [CVE-2024-1324](CVE-2024/CVE-2024-13xx/CVE-2024-1324.json) (`2024-06-01T07:15:07.850`)
- [CVE-2024-2506](CVE-2024/CVE-2024-25xx/CVE-2024-2506.json) (`2024-06-01T07:15:08.393`)
- [CVE-2024-4087](CVE-2024/CVE-2024-40xx/CVE-2024-4087.json) (`2024-06-01T06:15:08.340`)
- [CVE-2024-4342](CVE-2024/CVE-2024-43xx/CVE-2024-4342.json) (`2024-06-01T06:15:09.520`)
- [CVE-2024-5501](CVE-2024/CVE-2024-55xx/CVE-2024-5501.json) (`2024-06-01T06:15:09.993`)
### CVEs modified in the last Commit

View File

@ -239441,7 +239441,7 @@ CVE-2023-6378,0,0,4e5c95a250705e0dd6a8bbc06b93d64ed77669aa10d8e08cf26322a24f2351
CVE-2023-6379,0,0,b7a577bc70f83785aa29bf1c30ba879dfd82bc67d666c7986d31270d7af1419f,2023-12-15T20:33:49.850000
CVE-2023-6380,0,0,392e06acbd089517e78f47acec46283d5c2952e9063d6ec241117f7f2010ba21,2023-12-15T20:22:40.343000
CVE-2023-6381,0,0,9eb2cc86268893afb53ecfd36bf1545e56605f2230eb1c628f554cc9d2441ca9,2023-12-18T19:58:19.327000
CVE-2023-6382,1,1,e0db7620db06593734acbcf41a0f8895a043ff10f17fcf8765faabded5015f98,2024-06-01T05:15:08.287000
CVE-2023-6382,0,0,e0db7620db06593734acbcf41a0f8895a043ff10f17fcf8765faabded5015f98,2024-06-01T05:15:08.287000
CVE-2023-6383,0,0,eac1f58249c44013eaf9187ffa2f61b6b9c7a5a7e3f599e1a3d52dda8bd10105,2024-01-11T20:02:29.963000
CVE-2023-6384,0,0,e42c9ea468164d3f1395963798a71fe4d69d29c0523c49e6e6b388cfb04d28f8,2024-01-26T19:41:47.807000
CVE-2023-6385,0,0,049ae674d4d43f272c3f927a467a05302d852711996c1c33eaa10b46d553ec9f,2024-04-10T13:23:38.787000
@ -241292,6 +241292,7 @@ CVE-2024-1320,0,0,3a0636d373189b89337775a3f1aacdfe2e6f337604803376016d2fcbf4500c
CVE-2024-1321,0,0,af85235b999d15d959919e61d6e5de59b85a9e9916fb22a2e4657d05e4933502,2024-03-13T18:16:18.563000
CVE-2024-1322,0,0,5019d30fc595e15b7284ce25283849f3514b2c7376ac1a074e5d6c20d0ba7d5b,2024-02-29T13:49:29.390000
CVE-2024-1323,0,0,f857e29b0540aed96943a25b1179a5166e6aff501672f2c505f52ee84f4e77cb,2024-02-27T14:20:06.637000
CVE-2024-1324,1,1,1604fe7b890447a97be74760baffe24e75a7dc51128f2d57200b4593dc3cf155,2024-06-01T07:15:07.850000
CVE-2024-1325,0,0,42176d3fb0ea047577bb43005fdd80a5b216404e4d10bfc5a87ca78c2479aa17,2024-03-20T13:00:16.367000
CVE-2024-1326,0,0,f742b2e1b0f964f5a5861c38f5d4ab056095ec8f5957f404653a524040bbf1d4,2024-03-21T12:58:51.093000
CVE-2024-1327,0,0,1b6e3f0296467e9f6b424925712e479dea0088dc2698e1adadd7f96bd6f1e88d,2024-04-03T12:38:04.840000
@ -244723,6 +244724,7 @@ CVE-2024-25047,0,0,13db085f684d79ef9745d34b45d7fc06de8a1d4ab15f35cf7f17ac2900698
CVE-2024-25048,0,0,610a65aa068817d20a042aeecc25c887034723f165ecc379125f80c2bf8a57aa,2024-04-29T12:42:03.667000
CVE-2024-2505,0,0,f9efd81999a67e571786699340d45ecbc4af4577ba4f92360cdbb165e79506a4,2024-04-29T12:42:03.667000
CVE-2024-25050,0,0,2895a503880459770c96f9ab5f8cf4bc71edd50703fee0b5f0e32007918ee69d,2024-04-29T12:42:03.667000
CVE-2024-2506,1,1,8ad373587e8f603f35f109fba476a8c7eaf4e0be07fd8830b82a826eb910cf72,2024-06-01T07:15:08.393000
CVE-2024-25062,0,0,9596ed5cf07a8bc8469d4afc28fc727a431af7cff3b6b8e84435c301d9955756,2024-02-13T00:40:40.503000
CVE-2024-25063,0,0,ada8a3e76748f7f6ba8d6378c081423ac8f962f095964d00e876ad6b7009736e,2024-03-04T22:45:02.117000
CVE-2024-25064,0,0,1c648660fe74d25bd4bc9587030796b3cc77cb44c915d4df3e4024ac11525ccf,2024-03-04T22:43:15.337000
@ -250776,8 +250778,8 @@ CVE-2024-3560,0,0,66c1a96b1f1d19ab8c2a91f30bb939a8ccde028ecd6951f27029cb1628de4d
CVE-2024-35618,0,0,f4a659269990a7da5fc8a683283ab4936f111dc8d0577fd89324aa0b32252657,2024-05-24T18:09:20.027000
CVE-2024-35621,0,0,359bbde00ddda9bcf647c6b7e008c50b5044b1ab7e2482e3d77bfaec39975360,2024-05-28T17:11:47.007000
CVE-2024-35627,0,0,152f6a140367536a1e62d9a33b0213a3c0edb39ccbba33db112f0915411e954b,2024-05-24T01:15:30.977000
CVE-2024-3564,1,1,126b0ad745c05ac2b6e0879d574d7c57b3c5395a16548c8e712a48ce4bee21ab,2024-06-01T04:15:08.743000
CVE-2024-3565,1,1,e1b2000c5686d2ca445ed687220d6569396d5c02fc079146ba9e31752c24516d,2024-06-01T04:15:09
CVE-2024-3564,0,0,126b0ad745c05ac2b6e0879d574d7c57b3c5395a16548c8e712a48ce4bee21ab,2024-06-01T04:15:08.743000
CVE-2024-3565,0,0,e1b2000c5686d2ca445ed687220d6569396d5c02fc079146ba9e31752c24516d,2024-06-01T04:15:09
CVE-2024-3566,0,0,e417ef1ceca67d3a9a8ba800520d4a9974bcf4eba2e3e6325dafdfbfe6af8d6b,2024-04-10T19:49:51.183000
CVE-2024-3567,0,0,20839fe5058050b88e3eab46e96c3f4983a4ed5d3b8a31d734ec6d77ca524853,2024-04-10T19:49:51.183000
CVE-2024-3568,0,0,573133d2a7191a46b0975280ef7162f7787321191e0ad33f2c4c70c7e8d9c3f5,2024-04-10T19:49:51.183000
@ -251539,6 +251541,7 @@ CVE-2024-4082,0,0,9bcc679f7514b7d071aa621d11dbe3b6578d11cf65d1c2f18fedd0888ce997
CVE-2024-4083,0,0,90b3f0c23e53e5107774f39811ea28166caf07e02a51ec5c595625bec75a4f5e,2024-05-02T18:00:37.360000
CVE-2024-4085,0,0,18b49aedef154a5f78284d7ff3699691fe3b4904260085a931cc6d08f4fb7ca8,2024-05-02T18:00:37.360000
CVE-2024-4086,0,0,c06eb3f0c2fbe1c42ce58a59441202866280214c07091170b4fb53c94814c994,2024-05-02T18:00:37.360000
CVE-2024-4087,1,1,e74efa787d495285cea92567f71658c70a19cd01250c75f95c089062beb56709,2024-06-01T06:15:08.340000
CVE-2024-4092,0,0,4be02f9c67d30932bc0929e64c1c04dde83d92e769e6b30b60cbc598e8e37f4c,2024-05-02T18:00:37.360000
CVE-2024-4093,0,0,5d27408cc41c323f4b0e69479d9f46468fbd0106e510632bee156499f1d6b2eb,2024-05-17T02:40:15.433000
CVE-2024-4097,0,0,6a60177672bc62dbe43e4e7ccd78e74b9159babed54b0d3a303c5a9a6fcd009a,2024-05-02T18:00:37.360000
@ -251703,6 +251706,7 @@ CVE-2024-4336,0,0,bea5a7f53013b694022e2bd0018a4064fb0ebf2c6ec290178b3a567f091ff4
CVE-2024-4337,0,0,08997cb0f3d0ed65aebc3b58ae13b7e381ac12042dd4375a545df1f240dc7b83,2024-04-30T13:11:16.690000
CVE-2024-4339,0,0,bea5b1829080bc48e0dd548941045de99c983236691a3af86422b1ab8f30d243,2024-05-14T16:11:39.510000
CVE-2024-4340,0,0,cc413663d0b28645506d2728a6df6437d317b717b85c09519211319a2c38a0e2,2024-04-30T17:52:35.057000
CVE-2024-4342,1,1,8ba42011d07c0715e835d7017e1b17f289de225c8673a4061c4059f69a247601,2024-06-01T06:15:09.520000
CVE-2024-4345,0,0,f00f50139993a52fd7c5e9953c5559186f91d77a99990283e2fa9024cdbc8333,2024-05-07T13:39:32.710000
CVE-2024-4346,0,0,f22ab2b57ab7913e1ee849412772d79e861a170867683be7f674b4f4c1e4df02,2024-05-07T13:39:32.710000
CVE-2024-4347,0,0,15643945d0a0665e7f19da09fb1e76c15695d6c7f0b26fb83512ea8bedffd3f1,2024-05-24T01:15:30.977000
@ -252333,6 +252337,7 @@ CVE-2024-5496,0,0,f9ff11a24b3abb894f34c14951341b2ee370de96e88bd569fd2da0a0739988
CVE-2024-5497,0,0,5457e11aa9912ccaa85ab2dbc667746bc0af564346b70457a8e484fb204a2400,2024-05-31T13:01:46.727000
CVE-2024-5498,0,0,dab02e844b257084ed7b3549ae0f3640a76ecb84ebd8816420b3fd7743f6bb99,2024-05-31T13:01:46.727000
CVE-2024-5499,0,0,81e89a725c57d0700c4cd096315f3d39ae027d50af2b014e3217c574a66f3e1e,2024-05-31T13:01:46.727000
CVE-2024-5501,1,1,01b60c5bdecafbdbde7ec8a89defab59e96659e3d3cad6a10a6037081b726d85,2024-06-01T06:15:09.993000
CVE-2024-5514,0,0,70c4aeaa591affd56aff675f51e2f18386671ce8fe86006ee8f4233a6878a480,2024-05-30T13:15:41.297000
CVE-2024-5515,0,0,75c087cba560c69ea51e2ef7fee0a75443e34aed02c5f5a8120168bfbc9c38e7,2024-05-30T13:40:12.593000
CVE-2024-5516,0,0,336f81c0c897f191b942647b5f4688ae70d8be9537f65a708fdfac1e0e3d267a,2024-05-30T18:19:11.743000

Can't render this file because it is too large.