Auto-Update: 2025-01-04T13:00:19.451859+00:00

This commit is contained in:
cad-safe-bot 2025-01-04 13:03:43 +00:00
parent 7a1c403ef4
commit 5009eb7865
6 changed files with 352 additions and 11 deletions

View File

@ -0,0 +1,64 @@
{
"id": "CVE-2024-12195",
"sourceIdentifier": "security@wordfence.com",
"published": "2025-01-04T12:15:22.953",
"lastModified": "2025-01-04T12:15:22.953",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The WP Project Manager \u2013 Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to SQL Injection via the 'project_id' parameter of the /wp-json/pm/v2/projects/2/task-lists REST API endpoint in all versions up to, and including, 2.6.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, who have been granted access to a project, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "security@wordfence.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/wedevs-project-manager/tags/2.6.14/src/Task_List/Controllers/Task_List_Controller.php#L688",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3213295/wedevs-project-manager",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/798d120a-edec-4af9-b574-46f9beabc491?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,64 @@
{
"id": "CVE-2024-12279",
"sourceIdentifier": "security@wordfence.com",
"published": "2025-01-04T12:15:24.453",
"lastModified": "2025-01-04T12:15:24.453",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The WP Social AutoConnect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
]
},
"weaknesses": [
{
"source": "security@wordfence.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://plugins.trac.wordpress.org/changeset/3211577/",
"source": "security@wordfence.com"
},
{
"url": "https://wordpress.org/plugins/wp-fb-autoconnect/#developers",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/392d8286-a5fd-4d5d-9f6a-f13564013edc?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,64 @@
{
"id": "CVE-2024-12475",
"sourceIdentifier": "security@wordfence.com",
"published": "2025-01-04T12:15:24.650",
"lastModified": "2025-01-04T12:15:24.650",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7
}
]
},
"weaknesses": [
{
"source": "security@wordfence.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://plugins.trac.wordpress.org/changeset/3207533/",
"source": "security@wordfence.com"
},
{
"url": "https://wordpress.org/plugins/wp-multi-store-locator/#developers",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/089406e7-4f6a-416b-9077-e17c44069300?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,145 @@
{
"id": "CVE-2025-0206",
"sourceIdentifier": "cna@vuldb.com",
"published": "2025-01-04T12:15:24.830",
"lastModified": "2025-01-04T12:15:24.830",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as critical was found in code-projects Online Shoe Store 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/index.php. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnerableSystemConfidentiality": "LOW",
"vulnerableSystemIntegrity": "NONE",
"vulnerableSystemAvailability": "NONE",
"subsequentSystemConfidentiality": "NONE",
"subsequentSystemIntegrity": "NONE",
"subsequentSystemAvailability": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirements": "NOT_DEFINED",
"integrityRequirements": "NOT_DEFINED",
"availabilityRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnerableSystemConfidentiality": "NOT_DEFINED",
"modifiedVulnerableSystemIntegrity": "NOT_DEFINED",
"modifiedVulnerableSystemAvailability": "NOT_DEFINED",
"modifiedSubsequentSystemConfidentiality": "NOT_DEFINED",
"modifiedSubsequentSystemIntegrity": "NOT_DEFINED",
"modifiedSubsequentSystemAvailability": "NOT_DEFINED",
"safety": "NOT_DEFINED",
"automatable": "NOT_DEFINED",
"recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"baseScore": 5.0,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "cna@vuldb.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-266"
},
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"references": [
{
"url": "https://code-projects.org/",
"source": "cna@vuldb.com"
},
{
"url": "https://gist.github.com/th4s1s/955b71b20235dddf30689d4b85b4d271",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?ctiid.290143",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?id.290143",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?submit.474033",
"source": "cna@vuldb.com"
}
]
}

View File

@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2025-01-04T11:00:19.544766+00:00
2025-01-04T13:00:19.451859+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2025-01-04T10:15:06.410000+00:00
2025-01-04T12:15:24.830000+00:00
```
### Last Data Feed Release
@ -33,17 +33,17 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
275700
275704
```
### CVEs added in the last Commit
Recently added CVEs: `4`
- [CVE-2024-11930](CVE-2024/CVE-2024-119xx/CVE-2024-11930.json) (`2025-01-04T09:15:05.880`)
- [CVE-2024-12221](CVE-2024/CVE-2024-122xx/CVE-2024-12221.json) (`2025-01-04T10:15:06.410`)
- [CVE-2024-12583](CVE-2024/CVE-2024-125xx/CVE-2024-12583.json) (`2025-01-04T09:15:06.090`)
- [CVE-2025-0205](CVE-2025/CVE-2025-02xx/CVE-2025-0205.json) (`2025-01-04T09:15:06.280`)
- [CVE-2024-12195](CVE-2024/CVE-2024-121xx/CVE-2024-12195.json) (`2025-01-04T12:15:22.953`)
- [CVE-2024-12279](CVE-2024/CVE-2024-122xx/CVE-2024-12279.json) (`2025-01-04T12:15:24.453`)
- [CVE-2024-12475](CVE-2024/CVE-2024-124xx/CVE-2024-12475.json) (`2025-01-04T12:15:24.650`)
- [CVE-2025-0206](CVE-2025/CVE-2025-02xx/CVE-2025-0206.json) (`2025-01-04T12:15:24.830`)
### CVEs modified in the last Commit

View File

@ -244759,7 +244759,7 @@ CVE-2024-11925,0,0,77043a2dc07077ec38aa584033543217cc9fb39ce00751159aa83ba0aa54c
CVE-2024-11926,0,0,12ad1d9fc49995c8eb92feee3b52ec9fafd14557b209a764d700401682560722,2024-12-18T12:15:09.107000
CVE-2024-11928,0,0,4eb81c3b991253e17b093831750d2f60d8030675796e16e7e29cc29429037a0b,2024-12-10T11:15:07.220000
CVE-2024-1193,0,0,dfff57fc9ce7a1dbebe4335de503e2f3e62619c8f53eebdea960e5ff40a71456,2024-11-21T08:50:00.427000
CVE-2024-11930,1,1,3d6f16686fbf2f10ff523adfd2c8cbb605e12592056b32937532511e03efa5aa,2025-01-04T09:15:05.880000
CVE-2024-11930,0,0,3d6f16686fbf2f10ff523adfd2c8cbb605e12592056b32937532511e03efa5aa,2025-01-04T09:15:05.880000
CVE-2024-11933,0,0,ff719b80c8b04b1955877df42e564ce90eac2c09e4f59c20e785f18a1e8804d6,2024-12-03T16:04:10.350000
CVE-2024-11935,0,0,f2a8d43d6f9999d38415d9b41f66ab77f7c4f7c94de5d0bc77beeed93d88f487,2024-12-04T13:15:05.910000
CVE-2024-11938,0,0,6867b7d1c50742be481431f973c83467fcdb9442488abece06649b31c7a1e61f,2024-12-21T07:15:08.453000
@ -244920,6 +244920,7 @@ CVE-2024-12191,0,0,1e8bd8b2f07b3fe146f4b61013f2b06e2a8540311589dff28519979e9314f
CVE-2024-12192,0,0,834144ca9fc9b2f489354c4c77819ed4316907b7c59c9cd340994d34c3340476,2024-12-17T16:15:24.130000
CVE-2024-12193,0,0,10ce2992a46aa457016dda8b80435b1cc3164a5282166d2cf793af020fd1e4f2,2024-12-17T16:15:24.247000
CVE-2024-12194,0,0,0e20cc1461477ab11889597d984f84204a7b805ad5300cb09bfa539588353be0,2024-12-17T16:15:24.370000
CVE-2024-12195,1,1,73ca58f0e099117114caa56ab58ab900ae81f0d95755208245f9eca55423290a,2025-01-04T12:15:22.953000
CVE-2024-12196,0,0,9fa580adf43e9cbf06e25fc8b96bbf2ae78be5e0921b9598efca40b2ec0f8630,2024-12-04T21:15:21.090000
CVE-2024-12197,0,0,dedd56b6ad9e63809150ef147450d70c9b3fa5f2f9c5fcfc5fb76bd61ec18f37,2024-12-17T16:15:24.493000
CVE-2024-12198,0,0,1ae05c6d195d1fa95932ba78f37c94c53257b7fbac2ea052346fcb00c2f64367,2024-12-17T16:15:24.617000
@ -244934,7 +244935,7 @@ CVE-2024-12212,0,0,4068a90166bc858f8bfa4c7fe1dbc180f7e4e033930f31a1b74471c9abd77
CVE-2024-12219,0,0,30a275e193bbba91aa16bdcd2e01caf0ae8c253910825d417094094009d7c6a9,2024-12-17T08:15:05.010000
CVE-2024-1222,0,0,ff0f67607974451388d42ae6b90b2e9690717b801a6493a4e7aa508a94c6883e,2024-11-21T08:50:05.110000
CVE-2024-12220,0,0,5a9af5863bd9968393d1012c1c5f5fb4875db98205155149f405e76579a2b19e,2024-12-17T08:15:05.393000
CVE-2024-12221,1,1,8fad08691cce151fb30093e1018ac5dece558333693419a9442736a1f5767a8b,2025-01-04T10:15:06.410000
CVE-2024-12221,0,0,8fad08691cce151fb30093e1018ac5dece558333693419a9442736a1f5767a8b,2025-01-04T10:15:06.410000
CVE-2024-12227,0,0,c353a784c73b22c93b545f7e3c07e2ff77771e5d977f7464354ff7113388628f,2024-12-05T14:15:19.400000
CVE-2024-12228,0,0,cba3b66c66f8b74b7da0219a0273d1dd0c005a65d0aca4a38c9a6589b54985c9,2024-12-10T23:19:04.773000
CVE-2024-12229,0,0,aa44844c8d830c107b3760370b58cb504158d7d7c510be09891b02a376b9c9ac,2024-12-10T23:19:31.487000
@ -244970,6 +244971,7 @@ CVE-2024-1227,0,0,2b74966c63acb4b53db9100814c0ea98b900c2b18de594c13a326b21bfb265
CVE-2024-12270,0,0,a59b36ad08a62409fa966fc5cef53e6796ba20371cadd9c7e001162bc2771bae,2024-12-07T10:15:06.200000
CVE-2024-12271,0,0,e756524ee3996486f46fc9dfb0848744c8a90daec55e50296545ffd31d194dcb,2024-12-12T13:15:07.570000
CVE-2024-12272,0,0,cbbb238a5fc49c4ada4f96dbd5ec3bf6a1bab33a6ad37ef5b0235e516631a83b,2024-12-25T04:15:06.457000
CVE-2024-12279,1,1,9733fcc263294614cb14c679edb202184bedb7555bf9f6fd2b2bb344049bfd1a,2025-01-04T12:15:24.453000
CVE-2024-1228,0,0,02a2d35b9c29d8600ba5afee210d0e6465f5ee41eb5d9edcafc9d5f9e15f44ef,2024-11-21T08:50:06.280000
CVE-2024-12283,0,0,27e00fa0bc574ce5113c52cfd02ee2100414eb1f36a7d99001797949356bf37d,2024-12-11T09:15:05.697000
CVE-2024-12286,0,0,a2cf97a2f897256d80732f72cb83c0245f2eb4e867cc795bfeda6550048be20a,2024-12-10T18:15:27.150000
@ -245068,6 +245070,7 @@ CVE-2024-12468,0,0,20d3be8a82fb7f9b6094ff27e59754b2c2151696c1841d3d96ac080fb2a03
CVE-2024-12469,0,0,871c3c1e000bdae5610f745ffefecdbdcd7d22ba906daf923687641c197ab750,2024-12-17T10:15:05.997000
CVE-2024-1247,0,0,87dd54613b1838220658d2242080e8fb0b79934df6e5afef144b61ee319c0ba1,2024-11-21T08:50:09.013000
CVE-2024-12474,0,0,2858a766a8bcbd6035c2be4131a605cddb7bb17f787cc233f6060efa0069c36f,2024-12-14T06:15:19.627000
CVE-2024-12475,1,1,f15ae25929cc8f0bd288861c59cbb63f77614f57516a7a95543988715ffc6cd3,2025-01-04T12:15:24.650000
CVE-2024-12478,0,0,9740cd4243776bc4b985718131b1bfcc5e0a94370bd612144af92e9b380848b7,2024-12-16T11:15:04.890000
CVE-2024-12479,0,0,71e9962db709a4fb365c50c76ea2678c0c0be3cc10bb9fad5f99b55609975bac,2024-12-13T17:10:45.860000
CVE-2024-12480,0,0,278aebffcfd2515ae9c7caddd55ce9bc13fc09babf1329c96da477d94bc16635,2024-12-13T17:11:08.800000
@ -245124,7 +245127,7 @@ CVE-2024-12579,0,0,6b066a632ed42755872bfe12897131044e41b00627589546ab36be31d813b
CVE-2024-1258,0,0,36d421eec5fc7cce6382fad9fd3a9a8780da80fcb6e09fc8e5e480709b2e6caa,2024-11-21T08:50:10.573000
CVE-2024-12581,0,0,899275a869b7c967a158446f680d5b1e6ee7fb8c13fa325a1164dc54186bea7f,2024-12-13T06:15:26.433000
CVE-2024-12582,0,0,bbfe1aae814f308a85392c13709691d46da248e6458c80cb519b63fa483aa592,2024-12-24T04:15:05.137000
CVE-2024-12583,1,1,6c1f345fbc3f1cc53302e61a1dfbebbfcc1b6c1ee5d98cc4a9e3c7ebaa7ceed3,2025-01-04T09:15:06.090000
CVE-2024-12583,0,0,6c1f345fbc3f1cc53302e61a1dfbebbfcc1b6c1ee5d98cc4a9e3c7ebaa7ceed3,2025-01-04T09:15:06.090000
CVE-2024-12588,0,0,9ef4dd85f085f6ba612688cc14a2c49d05248e20e75bd2d7bdd4aff39b5ac0f2,2024-12-21T09:15:06.233000
CVE-2024-1259,0,0,1c6bb100fc9cba505c4d696801bfd3102c508e530bb2e36c86a6685675278bd7,2024-11-21T08:50:10.730000
CVE-2024-12591,0,0,ab3753b6008fbe3e6034e40f9f857196cd212596c7c67b4ab270eba30c140899,2024-12-21T10:15:09.177000
@ -275685,7 +275688,8 @@ CVE-2025-0201,0,0,6cdbb4667402fc2bfb5cec935533ca27feaf75663d021f7b6d92241d93220b
CVE-2025-0202,0,0,134321c7f40a118fdc086dc6dd45aa3f434bd152f41ac44b0e1b8cf73eaa9bdc,2025-01-04T05:15:07.660000
CVE-2025-0203,0,0,0936b8fabe5939ab217834cf3af41d8e076c72b533695acdc6213f3dd9c3be39,2025-01-04T07:15:18.153000
CVE-2025-0204,0,0,8d815f9dfba8c16d95951db6f88c1d79e7832a34dc8aeff650469bbc3a37f4d1,2025-01-04T08:15:06.923000
CVE-2025-0205,1,1,aa5b68b00b98dba8a0d346b3f72ea3ad15db09dde4cd37bb1ce9c2f4b99ff43e,2025-01-04T09:15:06.280000
CVE-2025-0205,0,0,aa5b68b00b98dba8a0d346b3f72ea3ad15db09dde4cd37bb1ce9c2f4b99ff43e,2025-01-04T09:15:06.280000
CVE-2025-0206,1,1,2c51d520a4879eb37fad3da037af175b82b1f84ee273be776d242bffb65c08ab,2025-01-04T12:15:24.830000
CVE-2025-21609,0,0,debac97612532639eda73000ed423c6055a43cea29689a043be2143f9409c2e8,2025-01-03T17:15:09.147000
CVE-2025-21610,0,0,91f58e52c41e26ee8c782751f380f5e6f82b9b51c281135ca06080d1bc5407a4,2025-01-03T17:15:09.290000
CVE-2025-22214,0,0,e2cc6e4f91ccc0784ce6c5e7f203a7b7ecf1116a49ea9d5798e3ff93276eaeec,2025-01-02T04:15:06.277000

Can't render this file because it is too large.