Auto-Update: 2024-08-24T04:00:17.126027+00:00

This commit is contained in:
cad-safe-bot 2024-08-24 04:03:14 +00:00
parent 534efdc324
commit 656744212a
8 changed files with 390 additions and 7 deletions

View File

@ -0,0 +1,72 @@
{
"id": "CVE-2023-0926",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-08-24T02:15:03.993",
"lastModified": "2024-08-24T02:15:03.993",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Custom Permalinks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping on tag names. This allows authenticated users, with editor-level permissions or greater to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, even when 'unfiltered_html' has been disabled."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 1.3,
"impactScore": 2.7
}
]
},
"weaknesses": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://github.com/samiahmedsiddiqui/custom-permalinks/pull/96",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3138206/custom-permalinks/trunk/admin/class-custom-permalinks-post-types-table.php",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3138206/custom-permalinks/trunk/admin/class-custom-permalinks-taxonomies-table.php",
"source": "security@wordfence.com"
},
{
"url": "https://wordpress.org/plugins/custom-permalinks/",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/97f8549a-292d-4a6d-8ec0-550467e5cf0f?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,60 @@
{
"id": "CVE-2023-6987",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-08-24T02:15:04.267",
"lastModified": "2024-08-24T02:15:04.267",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The String locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sql-column' parameter in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This required WP_DEBUG to be enabled in order to be exploited."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
]
},
"weaknesses": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://plugins.trac.wordpress.org/changeset/3139143/string-locator/tags/2.6.6/includes/Extension/SQL/views/editor/sql.php",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/18e0140e-ac24-48c6-aea0-bb0da203a817?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,60 @@
{
"id": "CVE-2024-2254",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-08-24T03:15:04.020",
"lastModified": "2024-08-24T03:15:04.020",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The RT Easy Builder \u2013 Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 3.1,
"impactScore": 2.7
}
]
},
"weaknesses": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/rt-easy-builder-advanced-addons-for-elementor/trunk/modules/elementor/widgets/pricing-table/template.php#L19",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a5fb289e-bd38-42ea-86a4-7816b59bd0b2?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,60 @@
{
"id": "CVE-2024-6631",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-08-24T03:15:04.317",
"lastModified": "2024-08-24T03:15:04.317",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 3.1.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform unauthorized actions, such as updating plugin settings."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 3.1,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"references": [
{
"url": "https://plugins.trac.wordpress.org/changeset/3119956/imagerecycle-pdf-image-compression/tags/3.1.15/class/class-image-otimizer.php",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f330bf36-0a39-40d6-a075-c87fdb9dc2da?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,60 @@
{
"id": "CVE-2024-7568",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-08-24T02:15:04.490",
"lastModified": "2024-08-24T02:15:04.490",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the output_sub_admin_page_0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The plugin author deleted the functionality of the plugin to patch this issue and close the plugin, we recommend seeking an alternative to this plugin."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL"
},
"exploitabilityScore": 2.8,
"impactScore": 6.0
}
]
},
"weaknesses": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3139340%40favicon-generator&new=3139340%40favicon-generator&sfp_email=&sfph_mail=",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6eb3ad80-3510-4018-91af-b733ef62e28f?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,60 @@
{
"id": "CVE-2024-8120",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-08-24T03:15:04.543",
"lastModified": "2024-08-24T03:15:04.543",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.14. This is due to missing or incorrect nonce validation on several functions in the class/class-image-otimizer.php file. This makes it possible for unauthenticated attackers to update plugin settings along with performing other actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://plugins.trac.wordpress.org/changeset/3119956/imagerecycle-pdf-image-compression/tags/3.1.15/class/class-image-otimizer.php",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a06bba7f-0259-4b87-b3fe-6ad8318fda7d?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2024-08-24T02:00:17.222719+00:00
2024-08-24T04:00:17.126027+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2024-08-24T01:00:01.280000+00:00
2024-08-24T03:15:04.543000+00:00
```
### Last Data Feed Release
@ -33,20 +33,25 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
261071
261077
```
### CVEs added in the last Commit
Recently added CVEs: `0`
Recently added CVEs: `6`
- [CVE-2023-0926](CVE-2023/CVE-2023-09xx/CVE-2023-0926.json) (`2024-08-24T02:15:03.993`)
- [CVE-2023-6987](CVE-2023/CVE-2023-69xx/CVE-2023-6987.json) (`2024-08-24T02:15:04.267`)
- [CVE-2024-2254](CVE-2024/CVE-2024-22xx/CVE-2024-2254.json) (`2024-08-24T03:15:04.020`)
- [CVE-2024-6631](CVE-2024/CVE-2024-66xx/CVE-2024-6631.json) (`2024-08-24T03:15:04.317`)
- [CVE-2024-7568](CVE-2024/CVE-2024-75xx/CVE-2024-7568.json) (`2024-08-24T02:15:04.490`)
- [CVE-2024-8120](CVE-2024/CVE-2024-81xx/CVE-2024-8120.json) (`2024-08-24T03:15:04.543`)
### CVEs modified in the last Commit
Recently modified CVEs: `1`
Recently modified CVEs: `0`
- [CVE-2024-39717](CVE-2024/CVE-2024-397xx/CVE-2024-39717.json) (`2024-08-24T01:00:01.280`)
## Download and Usage

View File

@ -213416,6 +213416,7 @@ CVE-2023-0922,0,0,e88363014fa03af766b81b29e87eb2a194c0e5b92a435d6d515221384ade58
CVE-2023-0923,0,0,44dbf287658de483b7aae4b4ab4b93985a3f4a4e13a42b0866850d85395be8ab,2024-05-03T16:15:09.933000
CVE-2023-0924,0,0,1c1c931ffe53d33cd77240221e3d9bd41c2d7a127f33b78399f18f146604e7ed,2023-11-07T04:01:56.437000
CVE-2023-0925,0,0,4b2d3d1a23856c0a21902846c10a74c9d1c5bad5a1e8e0c6c1607e19da19aa9d,2023-11-07T04:01:56.647000
CVE-2023-0926,1,1,19628d6959b41e4adfb86aac754c2d83f5ac9c25efec414e051b11cd1680e550,2024-08-24T02:15:03.993000
CVE-2023-0927,0,0,48a3a17a5dd2e86be25ab4ded50c67ab57c24719ee93a0ab099f778f14fc0ea8,2023-10-26T19:58:09.573000
CVE-2023-0928,0,0,870d522ea101c5c048031d09aa6ee4f91095da0f4ce0c9a7aaa8873d494878e3,2023-10-26T19:58:05.803000
CVE-2023-0929,0,0,d6c0a1f7fef7eae178af90037b7fce08b6752100c90d127655c45ffe6c055088,2023-10-20T20:40:15.977000
@ -240832,6 +240833,7 @@ CVE-2023-6983,0,0,9bb17bb43513198b09baed08b06b563f410b7877b78a327f682b670ff2d038
CVE-2023-6984,0,0,95e53ad3082089315ce478672330f2fb1a0b35ace6a3af51b62b497961afccdd,2024-01-09T20:31:06.297000
CVE-2023-6985,0,0,0a6e72eeba37236b49b3d5673a2b7307f78ed31c2d1e923141cde22b0f76d7f8,2024-02-13T18:33:20.830000
CVE-2023-6986,0,0,b98ac7e8ecf09abe48d97bc78f56f1ca29647e66fc7bd9cc3a8dab51e9c4cb87,2024-01-10T16:52:07.623000
CVE-2023-6987,1,1,e91a3c5b03afb80a3cd39ab1105fe446a4d4510f0775312806b978a76ac6c92b,2024-08-24T02:15:04.267000
CVE-2023-6988,0,0,47aafcb676e1a091b533016a9967a0d8ba6d954019e0193c5a2ab40435d75ad8,2024-01-18T17:13:30.383000
CVE-2023-6989,0,0,59d996ae67710cbe1732e95c5506bc554c15ae0c6fab12dfa7b2d96a1c208ea2,2024-02-13T15:23:09.840000
CVE-2023-6990,0,0,6d6ca20a9223d0924e515a33c4a22954541cdfc6c34a10ac8cfd77904d6d36c1,2024-01-18T17:34:58.227000
@ -244691,6 +244693,7 @@ CVE-2024-22529,0,0,c99a9546a8a1bf73954eb7152b5917a72a7df555ecc955a1c1717a6f52ba7
CVE-2024-2253,0,0,9e9e4eb36754a889ba12eae0616f7d1597a027d9b393d499aed081cb747c7f40,2024-05-30T13:15:41.297000
CVE-2024-22532,0,0,de186662f33e74d83cd8fffe00aab46fcd2955cb2806c1da45608ae2427d3c0c,2024-08-01T13:46:58.680000
CVE-2024-22533,0,0,85338afee49dae9d2d34419392208a0e08c059f930c68060a5bc4d947f64730e,2024-02-10T04:09:13.303000
CVE-2024-2254,1,1,7ce6ba2385740fd63f083388a0f0e5772951dc0bdae627db2c97b3a96ccdd549,2024-08-24T03:15:04.020000
CVE-2024-22543,0,0,b1a889b0e18be55a9638cd371ddf76030836a5edd3b6465766a28cf814e1ba4e,2024-08-16T17:35:03.823000
CVE-2024-22544,0,0,c83930b3fd617d56b4e76bf97e8edd2a7a4295e7011794060244a8c71ee5f812,2024-08-01T13:46:59.453000
CVE-2024-22545,0,0,68df59d7f199c8b9a762129a9a26d5183a0bcd88eec159e4a975bd0c437f8e2d,2024-03-05T18:15:48.443000
@ -256354,7 +256357,7 @@ CVE-2024-39705,0,0,91d39f33d5bd2d9618d124407e406b5aefb3921b0f0d526c128476a465358
CVE-2024-39708,0,0,2eafb164d29e8efc470b1c615a7a961efa5060a31edd6795a1174fbb57cde7b9,2024-08-15T16:15:20.100000
CVE-2024-3971,0,0,232de18e9e74ddfe0c81af44fc47161b6db81bcc698685ef24ea3f7084d9ef87,2024-07-29T16:51:34.570000
CVE-2024-39713,0,0,99e8a316dad486c18bb302062018548767182c9767b7c9ef5e1c3b6a3cdb13f2,2024-08-05T12:41:45.957000
CVE-2024-39717,0,1,9b658c1b72374bac948bd2893497dbee43cb32efb0c17914a8e2849fa634bcc6,2024-08-24T01:00:01.280000
CVE-2024-39717,0,0,9b658c1b72374bac948bd2893497dbee43cb32efb0c17914a8e2849fa634bcc6,2024-08-24T01:00:01.280000
CVE-2024-3972,0,0,0caddd7b34d493c3554c875afe72275890f23d83038241874e85ef811a9076b6,2024-08-01T13:56:47.637000
CVE-2024-39723,0,0,003097d794792a3e1194202f71608927b35e402887d5f5ddf07d35b5dd183916,2024-07-11T14:54:10.243000
CVE-2024-39728,0,0,fba26233ce0c4692619efffa132c45bfb836485ad2132e6f2e6d7ce0ec6f97d0,2024-07-16T13:57:37.203000
@ -260226,6 +260229,7 @@ CVE-2024-6625,0,0,b913737eefce9f28c47dc537f0edd398b1eeb297cd2eb30c69b59c34013171
CVE-2024-6627,0,0,c1ab91b855386d03fb23ec47d7ea95469618609ded94a66bedffee95371608e8,2024-07-29T14:12:08.783000
CVE-2024-6629,0,0,e7fb6a99ed3ad0ead40ca75ee8e19034c6248a18a082e5cb8e8eaa0368a38b0a,2024-08-14T19:26:41.113000
CVE-2024-6630,0,0,7742b604143993a9d769b9ab9c3e5aab85337a51e6772bb186961af80d29fee2,2024-07-10T18:15:05.407000
CVE-2024-6631,1,1,d522ea4869a14e1d4abcd2e05fcb3e89c0ee4006f3da7425f57db3dc89096298,2024-08-24T03:15:04.317000
CVE-2024-6634,0,0,20e842ed204ff1f080594226c009c0585274acd37661b69fb1d6603728f53ffe,2024-07-29T14:12:08.783000
CVE-2024-6635,0,0,97d6e55960f6f2e5010584395fc193a0feb186e4d795b57d89159c3132b84fff,2024-07-22T13:00:31.330000
CVE-2024-6636,0,0,b927f4aba2100824a9064e3c9444e3f54a47671d743161ced3b5a100a38b49ab,2024-07-22T13:00:31.330000
@ -260817,6 +260821,7 @@ CVE-2024-7560,0,0,69bf0d3c1d2353061d3a66813d4df2a8a02417391648b6018a10fb1d777785
CVE-2024-7561,0,0,4f145ac8bff9e09f18481f098864cf0c68d07bfaa0facd60438519477eaf9cd1,2024-08-08T13:04:18.753000
CVE-2024-7564,0,0,9647575e3fbd33f04dc9f7112e25f0abbbf3e6266c5fe28f9ec18868dfbd0106,2024-08-07T19:59:36.240000
CVE-2024-7567,0,0,8d84928fabcffd92f0ffc65ee27fdbbaa4428b293e351afb4071fd1cdbd8dfa6,2024-08-14T02:07:05.410000
CVE-2024-7568,1,1,1327911fac6dee00bf60f57475ab7dd976fc091c7d2ccf8f5a7fe6815d2ccc0e,2024-08-24T02:15:04.490000
CVE-2024-7569,0,0,07c556a0d4f236c73af8fac785c7f2963a3da01e4fc90b977a8fbdbb98959074,2024-08-14T02:07:05.410000
CVE-2024-7570,0,0,5fffab459f0b197c9cc8f01b0f615f787054152c65ebadc4d4a680afc4fd51fa,2024-08-14T02:07:05.410000
CVE-2024-7574,0,0,20d9970481b83bc1831e248b5fd88e17f245f697fcf3310f9ca87d287eec943e,2024-08-12T13:41:36.517000
@ -261070,3 +261075,4 @@ CVE-2024-8088,0,0,18356b85710169a8b6f513d9dabfc4574b8cdfad067997210129ccd11cf0c8
CVE-2024-8089,0,0,fe8d41ba149aaae8be5bcde261fbae8cee913e6a537c9c73424591ad94ea6fed,2024-08-23T16:18:28.547000
CVE-2024-8112,0,0,53bc9e4fb84bb028363b46c3cb18428063770b5e5c085f93ec85e24d18222c0b,2024-08-23T16:18:28.547000
CVE-2024-8113,0,0,663828d204cb9ecb17f530ae295b4541dee23e7a4b7b9d658530d5cb44ff87e3,2024-08-23T16:18:28.547000
CVE-2024-8120,1,1,b588d9e16e67a2e06fbd40a6289508e4549b2d995767d4ddf7a7de8f5dc1fd92,2024-08-24T03:15:04.543000

Can't render this file because it is too large.