Auto-Update: 2024-02-28T09:00:28.036230+00:00

2025-05-07 19:16:29 +00:00 · 2024-02-28 09:00:31 +00:00 · 2024-02-28 09:00:31 +00:00 · 5708342527
commit 5708342527
parent 39da5c1403
5 changed files with 169 additions and 6 deletions
--- a/CVE-2024/CVE-2024-13xx/CVE-2024-1388.json
+++ b/CVE-2024/CVE-2024-13xx/CVE-2024-1388.json
@ -0,0 +1,47 @@
+{
+  "id": "CVE-2024-1388",
+  "sourceIdentifier": "security@wordfence.com",
+  "published": "2024-02-28T07:15:07.737",
+  "lastModified": "2024-02-28T07:15:07.737",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_customizer_options() function in all versions up to, and including, 1.3.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to reset the theme's settings."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "security@wordfence.com",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "LOW",
+          "userInteraction": "NONE",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "NONE",
+          "integrityImpact": "LOW",
+          "availabilityImpact": "NONE",
+          "baseScore": 4.3,
+          "baseSeverity": "MEDIUM"
+        },
+        "exploitabilityScore": 2.8,
+        "impactScore": 1.4
+      }
+    ]
+  },
+  "references": [
+    {
+      "url": "https://themes.trac.wordpress.org/changeset/217428/yuki/1.3.14/inc/extensions/class-reset-extension.php",
+      "source": "security@wordfence.com"
+    },
+    {
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d964e0ef-f14e-463b-bf4e-3f25788df03c?source=cve",
+      "source": "security@wordfence.com"
+    }
+  ]
+}
--- a/CVE-2024/CVE-2024-15xx/CVE-2024-1568.json
+++ b/CVE-2024/CVE-2024-15xx/CVE-2024-1568.json
@ -0,0 +1,47 @@
+{
+  "id": "CVE-2024-1568",
+  "sourceIdentifier": "security@wordfence.com",
+  "published": "2024-02-28T07:15:08.713",
+  "lastModified": "2024-02-28T07:15:08.713",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.20.52 via the OnAdminApi_HtmlCheck function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "security@wordfence.com",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "LOW",
+          "userInteraction": "NONE",
+          "scope": "CHANGED",
+          "confidentialityImpact": "LOW",
+          "integrityImpact": "LOW",
+          "availabilityImpact": "NONE",
+          "baseScore": 6.4,
+          "baseSeverity": "MEDIUM"
+        },
+        "exploitabilityScore": 3.1,
+        "impactScore": 2.7
+      }
+    ]
+  },
+  "references": [
+    {
+      "url": "https://plugins.trac.wordpress.org/changeset/3040707/seraphinite-accelerator",
+      "source": "security@wordfence.com"
+    },
+    {
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/07287a85-df00-408a-8b02-978fd3116155?source=cve",
+      "source": "security@wordfence.com"
+    }
+  ]
+}
--- a/CVE-2024/CVE-2024-19xx/CVE-2024-1943.json
+++ b/CVE-2024/CVE-2024-19xx/CVE-2024-1943.json
@ -0,0 +1,47 @@
+{
+  "id": "CVE-2024-1943",
+  "sourceIdentifier": "security@wordfence.com",
+  "published": "2024-02-28T07:15:09.150",
+  "lastModified": "2024-02-28T07:15:09.150",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Yuki theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 1.3.14. This is due to missing or incorrect nonce validation on the reset_customizer_options() function. This makes it possible for unauthenticated attackers to reset the themes settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "security@wordfence.com",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "REQUIRED",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "NONE",
+          "integrityImpact": "LOW",
+          "availabilityImpact": "NONE",
+          "baseScore": 4.3,
+          "baseSeverity": "MEDIUM"
+        },
+        "exploitabilityScore": 2.8,
+        "impactScore": 1.4
+      }
+    ]
+  },
+  "references": [
+    {
+      "url": "https://themes.trac.wordpress.org/changeset/218603/yuki/1.3.15/inc/extensions/class-reset-extension.php",
+      "source": "security@wordfence.com"
+    },
+    {
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dfb760fb-f281-4649-9bd3-92f8e281f07e?source=cve",
+      "source": "security@wordfence.com"
+    }
+  ]
+}
--- a/CVE-2024/CVE-2024-279xx/CVE-2024-27913.json
+++ b/CVE-2024/CVE-2024-279xx/CVE-2024-27913.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2024-27913",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2024-02-28T07:15:09.677",
+  "lastModified": "2024-02-28T07:15:09.677",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash) via a malformed OSPF LSA packet, because of an attempted access to a missing attribute field."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/FRRouting/frr/pull/15431",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/README.md
+++ b/README.md
@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
 ### Last Repository Update

 ```plain
-2024-02-28T07:00:25.443818+00:00
+2024-02-28T09:00:28.036230+00:00
 ```

 ### Most recent CVE Modification Timestamp synchronized with NVD

 ```plain
-2024-02-28T06:15:49.827000+00:00
+2024-02-28T07:15:09.677000+00:00
 ```

 ### Last Data Feed Release
@ -29,15 +29,17 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
 ### Total Number of included CVEs

 ```plain
-239691
+239695
 ```

 ### CVEs added in the last Commit

-Recently added CVEs: `2`
+Recently added CVEs: `4`

-* [CVE-2024-0550](CVE-2024/CVE-2024-05xx/CVE-2024-0550.json) (`2024-02-28T05:15:08.770`)
-* [CVE-2024-22723](CVE-2024/CVE-2024-227xx/CVE-2024-22723.json) (`2024-02-28T06:15:49.827`)
+* [CVE-2024-1388](CVE-2024/CVE-2024-13xx/CVE-2024-1388.json) (`2024-02-28T07:15:07.737`)
+* [CVE-2024-1568](CVE-2024/CVE-2024-15xx/CVE-2024-1568.json) (`2024-02-28T07:15:08.713`)
+* [CVE-2024-1943](CVE-2024/CVE-2024-19xx/CVE-2024-1943.json) (`2024-02-28T07:15:09.150`)
+* [CVE-2024-27913](CVE-2024/CVE-2024-279xx/CVE-2024-27913.json) (`2024-02-28T07:15:09.677`)


 ### CVEs modified in the last Commit