admin/nvd-json-data-feeds
1
0
Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2025-07-09 16:05:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2024-05-18T10:00:38.200587+00:00

Browse Source
This commit is contained in:
cad-safe-bot 2024-05-18 10:03:28 +00:00
parent 965348ff68
commit 4ba13d02ff
7 changed files with 289 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
CVE-2024/CVE-2024-27xx/CVE-2024-2771.json Normal file
View File

@ -0,0 +1,47 @@
{
"id": "CVE-2024-2771",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-05-18T08:15:06.413",
"lastModified": "2024-05-18T08:15:06.413",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's settings and features. This also makes it possible for unauthenticated attackers to delete manager accounts."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/changeset/3088078/fluentform/trunk/app/Http/Policies/RoleManagerPolicy.php",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/071195d6-3452-4241-a8d3-92efc84e4850?source=cve",
"source": "security@wordfence.com"
}
]
}

47
CVE-2024/CVE-2024-27xx/CVE-2024-2772.json Normal file
View File

@ -0,0 +1,47 @@
{
"id": "CVE-2024-2772",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-05-18T08:15:07.393",
"lastModified": "2024-05-18T08:15:07.393",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in all versions up to, and including, 5.1.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the Fluent Forms settings, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This can be chained with CVE-2024-2771 for a low-privileged user to inject malicious web scripts."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/changeset/3073857",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2ccba77c-fb90-4906-b0fe-77607ec5df1f?source=cve",
"source": "security@wordfence.com"
}
]
}

47
CVE-2024/CVE-2024-27xx/CVE-2024-2782.json Normal file
View File

@ -0,0 +1,47 @@
{
"id": "CVE-2024-2782",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-05-18T08:15:07.727",
"lastModified": "2024-05-18T08:15:07.727",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST API endpoint in all versions up to, and including, 5.1.16. This makes it possible for unauthenticated attackers to modify all of the plugin's settings."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/changeset/3088078/fluentform/trunk/app/Http/Policies/GlobalSettingsPolicy.php",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0814e7b3-404a-4db5-b564-46c9086ec048?source=cve",
"source": "security@wordfence.com"
}
]
}

71
CVE-2024/CVE-2024-46xx/CVE-2024-4698.json Normal file
View File

@ -0,0 +1,71 @@
{
"id": "CVE-2024-4698",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-05-18T08:15:08.090",
"lastModified": "2024-05-18T08:15:08.090",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'show_line_text ' and 'slide_button_hover_animation' parameters in versions up to, and including, 10.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/trunk/widgets/testimonials-carousel/class-testimonialscarousel-blog.php#L1076",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/trunk/widgets/testimonials-carousel/class-testimonialscarousel-bottom.php#L1478",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/trunk/widgets/testimonials-carousel/class-testimonialscarousel-centered.php#L1619",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/trunk/widgets/testimonials-carousel/class-testimonialscarousel-gallery-coverflow.php#L1876",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/trunk/widgets/testimonials-carousel/class-testimonialscarousel-logo.php#L1715",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/testimonials-carousel-elementor/trunk/widgets/testimonials-carousel/class-testimonialscarousel.php#L1847",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3087862/",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4542b0f8-c9ee-4992-b737-e5f727c7b5b0?source=cve",
"source": "security@wordfence.com"
}
]
}

59
CVE-2024/CVE-2024-47xx/CVE-2024-4709.json Normal file
View File

@ -0,0 +1,59 @@
{
"id": "CVE-2024-4709",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-05-18T08:15:08.410",
"lastModified": "2024-05-18T08:15:08.410",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018subject\u2019 parameter in versions up to, and including, 5.1.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, and access granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 2.7
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Services/FormBuilder/Notifications/EmailNotification.php#L106",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Services/FormBuilder/Notifications/EmailNotification.php#L164",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/browser/fluentform/trunk/app/Services/FormBuilder/Notifications/EmailNotification.php#L194",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3088078/",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5fe317a6-a391-441a-aac8-c8fa57e73169?source=cve",
"source": "security@wordfence.com"
}
]
}

17
README.md
View File

@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2024-05-18T08:00:37.315455+00:00
2024-05-18T10:00:38.200587+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2024-05-18T06:15:08.310000+00:00
2024-05-18T08:15:08.410000+00:00
```
### Last Data Feed Release
@ -33,17 +33,18 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
250630
250635
```
### CVEs added in the last Commit
Recently added CVEs: `4`
Recently added CVEs: `5`
- [CVE-2024-3810](CVE-2024/CVE-2024-38xx/CVE-2024-3810.json) (`2024-05-18T06:15:06.440`)
- [CVE-2024-3811](CVE-2024/CVE-2024-38xx/CVE-2024-3811.json) (`2024-05-18T06:15:07.660`)
- [CVE-2024-3812](CVE-2024/CVE-2024-38xx/CVE-2024-3812.json) (`2024-05-18T06:15:08.000`)
- [CVE-2024-4849](CVE-2024/CVE-2024-48xx/CVE-2024-4849.json) (`2024-05-18T06:15:08.310`)
- [CVE-2024-2771](CVE-2024/CVE-2024-27xx/CVE-2024-2771.json) (`2024-05-18T08:15:06.413`)
- [CVE-2024-2772](CVE-2024/CVE-2024-27xx/CVE-2024-2772.json) (`2024-05-18T08:15:07.393`)
- [CVE-2024-2782](CVE-2024/CVE-2024-27xx/CVE-2024-2782.json) (`2024-05-18T08:15:07.727`)
- [CVE-2024-4698](CVE-2024/CVE-2024-46xx/CVE-2024-4698.json) (`2024-05-18T08:15:08.090`)
- [CVE-2024-4709](CVE-2024/CVE-2024-47xx/CVE-2024-4709.json) (`2024-05-18T08:15:08.410`)
### CVEs modified in the last Commit

13
_state.csv
View File

@ -245832,8 +245832,10 @@ CVE-2024-27703,0,0,2b79380c63baf4bc3c9abfadfdc13a8325f8dae30b340951dc89a1b9f1e8f
CVE-2024-27705,0,0,3d747f0757e381b42c2775f784e825713efa67635f4ff8b104a1a16be5b625e5,2024-04-04T12:48:41.700000
CVE-2024-27706,0,0,c91aee23aaa0ed501da15123d608c9d5855bcbcff43faab8a1a227af822acd84,2024-04-04T12:48:41.700000
CVE-2024-27707,0,0,bd4780ccfe95d75b10e00a8c73b93480b3348a16006d364b38b5efca7ebc67cb,2024-03-08T14:02:57.420000
CVE-2024-2771,1,1,f48dfafe8b27a7d7d6c3d9563c9c1a447fbff5d8e6523f6e87124238b2cc6fc0,2024-05-18T08:15:06.413000
CVE-2024-27718,0,0,55b4fe5eceb765847e8b5fde530c7383b01c4bd9d6322c23b03086464d536a04,2024-03-05T13:41:01.900000
CVE-2024-27719,0,0,af4ad9f7aa618fdf95594199c2170305427044874004c69062178d9da2af7882,2024-03-28T20:53:20.813000
CVE-2024-2772,1,1,c5ed555358e304713e473da295597086d774c2aeeaff112a97d14b5ebcc47e2d,2024-05-18T08:15:07.393000
CVE-2024-2773,0,0,cd9d9ba8e4be968bc2651353aa5040f75149c9dd887285d84c4d2dd525690a2b,2024-05-17T02:38:29.487000
CVE-2024-27733,0,0,8d363cf969790e7f98247f28db2e0a162d296bdeea0f77bb77693ca2f7a6137e,2024-03-08T14:02:57.420000
CVE-2024-27734,0,0,beea65252cc94a0d0f3bdddbf9c1d315f78023e25f1447b83e1012950b402076,2024-03-01T22:22:25.913000
@ -245877,6 +245879,7 @@ CVE-2024-27810,0,0,6049fb646b1808a590530e8c485a46aeb953f07218d01a51b5c58ac62d04a
CVE-2024-27813,0,0,e93d3b51e68bf205b4b1c508cd48008dc03bd28824930bac8a04f10d4017bef9,2024-05-14T16:13:02.773000
CVE-2024-27816,0,0,93d01dc7c7a6ed7031e919296e0389610cf0f3dc5c2bdbef40477594f06baf0e,2024-05-14T16:13:02.773000
CVE-2024-27818,0,0,33cd4327be0946f648f3e3d2f260554c2856c43b480e8910a082b212ce2aab89,2024-05-14T16:13:02.773000
CVE-2024-2782,1,1,bca5eeb9f2507ceff30a34591a3116da9e01734a9fe1084995513bac68239637,2024-05-18T08:15:07.727000
CVE-2024-27821,0,0,10bfe137689a8ac4e87a7ec9128fe810269e1ef2911faf4af0aa3df2bae5e5fe,2024-05-14T16:13:02.773000
CVE-2024-27822,0,0,e423504b6a3679d0a91f0393931e0ba5e5c72b72be3d6fa1589508a9c0463a7c,2024-05-14T16:13:02.773000
CVE-2024-27824,0,0,b005865c04ecea07f717ce69bf9c1d252b7f48b1c26ffa97851c12adbf90cc17,2024-05-14T16:13:02.773000
@ -249969,9 +249972,9 @@ CVE-2024-3806,0,0,6bbac8d6c88802878efd703235f913abf5f918c846b51b9285e58ed8ddf880
CVE-2024-3807,0,0,b5687c705ca990e1c1a2e9ad106003739cb7bca636e958ece9155bcc4ab8d5b2,2024-05-14T16:11:39.510000
CVE-2024-3808,0,0,6e074e31636384af2b6d4c4deeb087980da7fc56f8430a6542c2a3c25ff06612,2024-05-14T16:11:39.510000
CVE-2024-3809,0,0,37707cfa70ea9f681f8356134c37777c1e86daf3349fcedf4bb40eddd72d2fa3,2024-05-14T16:11:39.510000
CVE-2024-3810,1,1,6e67ea93016866473dc758c3900a365cc240be34e67ca7f44a4b5e3ab393e024,2024-05-18T06:15:06.440000
CVE-2024-3811,1,1,e1c4892b86bca6154cccb40b756148e6a356434ba325ff4d85437d146059d1e9,2024-05-18T06:15:07.660000
CVE-2024-3812,1,1,471c9599f5151fd0e5d227812f8e2840ee6e9728987b0ff55497b8463f158cb2,2024-05-18T06:15:08
CVE-2024-3810,0,0,6e67ea93016866473dc758c3900a365cc240be34e67ca7f44a4b5e3ab393e024,2024-05-18T06:15:06.440000
CVE-2024-3811,0,0,e1c4892b86bca6154cccb40b756148e6a356434ba325ff4d85437d146059d1e9,2024-05-18T06:15:07.660000
CVE-2024-3812,0,0,471c9599f5151fd0e5d227812f8e2840ee6e9728987b0ff55497b8463f158cb2,2024-05-18T06:15:08
CVE-2024-3817,0,0,46e4b3903939ad7f28eeb8afee28fc4c5b18be71847d60ae426ede3b66e11122,2024-04-18T13:04:28.900000
CVE-2024-3818,0,0,3b93c96d931c7712dba585285a5a0f954163c40c8ab2b4d2e42e74b7a416a166,2024-04-19T13:10:25.637000
CVE-2024-3819,0,0,070335cf0d21b4518c9cf130cbde224bb7db7bd3582033700dab419bc756cd20,2024-05-02T18:00:37.360000
@ -250452,9 +250455,11 @@ CVE-2024-4687,0,0,5959def1b7bdf7125a357f3c153983f3d5ac8d6eae818fc6bf7591d3c2beaf
CVE-2024-4688,0,0,5209c8e598df4232c95422a32cff4b63e70cf2beafa2b8b363e44607e8b05dd2,2024-05-17T02:40:33.500000
CVE-2024-4689,0,0,dc95d8f4f9f77b231313911514e3d3b97848c495dee3874d04a472dce094765c,2024-05-14T16:11:39.510000
CVE-2024-4693,0,0,8b202b0a3d7cdbe460ad8fc60aa4dcd9510713b61e0c7f4c4b9991496781ed47,2024-05-14T16:11:39.510000
CVE-2024-4698,1,1,7afeecf374e74ed68acbb90f514746a29c3d2ddf739b7509d472ab8451f732b4,2024-05-18T08:15:08.090000
CVE-2024-4699,0,0,21634a770b960d22aa24dc1f0ea343763012f9507287610a68f5378061204954,2024-05-17T02:40:33.683000
CVE-2024-4701,0,0,761d41a28193a1e33042d464e0d5792093f168eb245e7d1be80e9000538f9ccc,2024-05-14T16:11:39.510000
CVE-2024-4702,0,0,391d02c5718dd442c026ca8f3973c4fe10894f8eeb54175158dc44cd7ef50d4a,2024-05-15T16:40:19.330000
CVE-2024-4709,1,1,6b9bcdc3f820c2f44c00c34efd751e32fefc629519574390fc89a6064355596b,2024-05-18T08:15:08.410000
CVE-2024-4712,0,0,1b096c388f37a8dc235e93a130297376c1188074ec6b9a37b1819e757fb63d04,2024-05-14T16:11:39.510000
CVE-2024-4713,0,0,63c8fe02e071c01e10e60f543cd0776ed83adea75c2d063179e2f75e75c30c3b,2024-05-17T02:40:33.880000
CVE-2024-4714,0,0,4e7ff77f8284c93c8758bb989744763ec5c4cb8551eeb8d726beabface4981b3,2024-05-17T02:40:33.983000
@ -250541,7 +250546,7 @@ CVE-2024-4840,0,0,c9ca0895b4a51cab0e2c0d59965d65e29a18e7a3fb86aea7f8e73c28a9d25d
CVE-2024-4843,0,0,58cfe808f738fd9393d526b6ae9c349063459aa7046a90d478177ce3db0c98a6,2024-05-16T13:03:05.353000
CVE-2024-4844,0,0,9cc52c71da3e5a51bc8bac3549d843df2f9b393e878f774cc4555ff01bf8c6f2,2024-05-16T13:03:05.353000
CVE-2024-4847,0,0,bba6603a81b56f6d60e806e2e7574571e772d40efe56d1512e7524611ff51b1c,2024-05-15T16:40:19.330000
CVE-2024-4849,1,1,cf05ac9f954acc664aee89456d166c8162ab156913355e7575a336cb8cbe7099,2024-05-18T06:15:08.310000
CVE-2024-4849,0,0,cf05ac9f954acc664aee89456d166c8162ab156913355e7575a336cb8cbe7099,2024-05-18T06:15:08.310000
CVE-2024-4853,0,0,08d9956cd1fc82aacd4cc52b553fb1ad7c9d41ecc90cc195f4a6a68d3e7942e4,2024-05-14T16:11:39.510000
CVE-2024-4854,0,0,3d480ab215b58518bc8b4d2ff21b01ce90d2ee2286e511ec2300ae6a56284679,2024-05-14T16:11:39.510000
CVE-2024-4855,0,0,bb7758177ed568c219e106881d12c1be9e05abe80abbc1ed8dc52d386d88e25c,2024-05-14T16:11:39.510000

Can't render this file because it is too large.