mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-07-09 16:05:11 +00:00
Auto-Update: 2024-06-25T12:00:18.798859+00:00
This commit is contained in:
parent
29a41ab1cd
commit
7c76613504
@ -2,12 +2,12 @@
|
|||||||
"id": "CVE-2024-2965",
|
"id": "CVE-2024-2965",
|
||||||
"sourceIdentifier": "security@huntr.dev",
|
"sourceIdentifier": "security@huntr.dev",
|
||||||
"published": "2024-06-06T19:15:55.897",
|
"published": "2024-06-06T19:15:55.897",
|
||||||
"lastModified": "2024-06-07T14:56:05.647",
|
"lastModified": "2024-06-25T11:15:49.873",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Awaiting Analysis",
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-ai/langchain` repository, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality."
|
"value": "A Denial-of-Service (DoS) vulnerability exists in the `SitemapLoader` class of the `langchain-community` package, affecting all versions. The `parse_sitemap` method, responsible for parsing sitemaps and extracting URLs, lacks a mechanism to prevent infinite recursion when a sitemap URL refers to the current sitemap itself. This oversight allows for the possibility of an infinite loop, leading to a crash by exceeding the maximum recursion depth in Python. This vulnerability can be exploited to occupy server socket/port resources and crash the Python process, impacting the availability of services relying on this functionality."
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"lang": "es",
|
"lang": "es",
|
||||||
@ -15,13 +15,13 @@
|
|||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV30": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "security@huntr.dev",
|
"source": "security@huntr.dev",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.0",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
"vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||||||
"attackVector": "PHYSICAL",
|
"attackVector": "PHYSICAL",
|
||||||
"attackComplexity": "HIGH",
|
"attackComplexity": "HIGH",
|
||||||
"privilegesRequired": "NONE",
|
"privilegesRequired": "NONE",
|
||||||
|
59
CVE-2024/CVE-2024-46xx/CVE-2024-4639.json
Normal file
59
CVE-2024/CVE-2024-46xx/CVE-2024-4639.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-4639",
|
||||||
|
"sourceIdentifier": "psirt@moxa.com",
|
||||||
|
"published": "2024-06-25T10:15:19.897",
|
||||||
|
"lastModified": "2024-06-25T10:15:19.897",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in IPSec configuration. An attacker could modify the intended commands sent to target functions, which could cause malicious users to execute unauthorized commands."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "Las versiones de firmware de la serie OnCell G3470A-LTE v1.7.7 y anteriores han sido identificadas como vulnerables debido a la falta de entradas neutralizadas en la configuraci\u00f3n IPSec. Un atacante podr\u00eda modificar los comandos previstos enviados a las funciones de destino, lo que podr\u00eda provocar que usuarios malintencionados ejecuten comandos no autorizados."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "psirt@moxa.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE",
|
||||||
|
"baseScore": 7.1,
|
||||||
|
"baseSeverity": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 4.2
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "psirt@moxa.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-77"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-242550-oncell-g3470a-lte-series-multiple-web-application-vulnerabilities",
|
||||||
|
"source": "psirt@moxa.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
59
CVE-2024/CVE-2024-46xx/CVE-2024-4640.json
Normal file
59
CVE-2024/CVE-2024-46xx/CVE-2024-4640.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-4640",
|
||||||
|
"sourceIdentifier": "psirt@moxa.com",
|
||||||
|
"published": "2024-06-25T10:15:20.780",
|
||||||
|
"lastModified": "2024-06-25T10:15:20.780",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to missing bounds checking on buffer operations. An attacker could write past the boundaries of allocated buffer regions in memory, causing a program crash."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "Las versiones de firmware de la serie OnCell G3470A-LTE v1.7.7 y anteriores se han identificado como vulnerables debido a la falta de verificaci\u00f3n de los l\u00edmites en las operaciones del b\u00fafer. Un atacante podr\u00eda escribir m\u00e1s all\u00e1 de los l\u00edmites de las regiones del b\u00fafer asignadas en la memoria, provocando un bloqueo del programa."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "psirt@moxa.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "HIGH",
|
||||||
|
"baseScore": 7.1,
|
||||||
|
"baseSeverity": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 4.2
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "psirt@moxa.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-120"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-242550-oncell-g3470a-lte-series-multiple-web-application-vulnerabilities",
|
||||||
|
"source": "psirt@moxa.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
59
CVE-2024/CVE-2024-46xx/CVE-2024-4641.json
Normal file
59
CVE-2024/CVE-2024-46xx/CVE-2024-4641.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-4641",
|
||||||
|
"sourceIdentifier": "psirt@moxa.com",
|
||||||
|
"published": "2024-06-25T10:15:21.000",
|
||||||
|
"lastModified": "2024-06-25T10:15:21.000",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to accepting a format string from an external source as an argument. An attacker could modify an externally controlled format string to cause a memory leak and denial of service."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "Las versiones de firmware de la serie OnCell G3470A-LTE v1.7.7 y anteriores se han identificado como vulnerables debido a que aceptan una cadena de formato de una fuente externa como argumento. Un atacante podr\u00eda modificar una cadena de formato controlada externamente para provocar una p\u00e9rdida de memoria y una denegaci\u00f3n de servicio."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "psirt@moxa.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "LOW",
|
||||||
|
"baseScore": 6.3,
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 3.4
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "psirt@moxa.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-134"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-242550-oncell-g3470a-lte-series-multiple-web-application-vulnerabilities",
|
||||||
|
"source": "psirt@moxa.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
59
CVE-2024/CVE-2024-52xx/CVE-2024-5216.json
Normal file
59
CVE-2024/CVE-2024-52xx/CVE-2024-5216.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-5216",
|
||||||
|
"sourceIdentifier": "security@huntr.dev",
|
||||||
|
"published": "2024-06-25T11:15:50.193",
|
||||||
|
"lastModified": "2024-06-25T11:15:50.193",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "A vulnerability in mintplex-labs/anything-llm allows for a Denial of Service (DoS) condition due to uncontrolled resource consumption. Specifically, the issue arises from the application's failure to limit the size of usernames, enabling attackers to create users with excessively bulky texts in the username field. This exploit results in the user management panel becoming unresponsive, preventing administrators from performing critical user management actions such as editing, suspending, or deleting users. The impact of this vulnerability includes administrative paralysis, compromised security, and operational disruption, as it allows malicious users to perpetuate their presence within the system indefinitely, undermines the system's security posture, and degrades overall system performance."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "security@huntr.dev",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "HIGH",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@huntr.dev",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-400"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/mintplex-labs/anything-llm/commit/3ef009de73c837f9025df8bba62572885c70c72f",
|
||||||
|
"source": "security@huntr.dev"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://huntr.com/bounties/8ec14991-ee35-493d-a8d3-21a1cfd57869",
|
||||||
|
"source": "security@huntr.dev"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
@ -8,6 +8,10 @@
|
|||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
|
"value": "The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "El complemento Quiz Maker para WordPress es vulnerable a la inyecci\u00f3n SQL basada en tiempo a trav\u00e9s del par\u00e1metro 'ays_questions' en todas las versiones hasta la 6.5.8.3 incluida debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y a la falta de preparaci\u00f3n suficiente en el SQL existente. consulta. Esto hace posible que atacantes no autenticados agreguen consultas SQL adicionales a consultas ya existentes que pueden usarse para extraer informaci\u00f3n confidencial de la base de datos."
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
|
51
CVE-2024/CVE-2024-63xx/CVE-2024-6305.json
Normal file
51
CVE-2024/CVE-2024-63xx/CVE-2024-6305.json
Normal file
@ -0,0 +1,51 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-6305",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-06-25T11:15:50.420",
|
||||||
|
"lastModified": "2024-06-25T11:15:50.420",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "WordPress Core is vulnerable to Stored Cross-Site Scripting via the Template Part Block in various versions up to 6.5.5 due to insufficient input sanitization and output escaping on the 'tagName' attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE",
|
||||||
|
"baseScore": 6.4,
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.1,
|
||||||
|
"impactScore": 2.7
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://core.trac.wordpress.org/changeset/58471",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://wordpress.org/news/2024/06/wordpress-6-5-5/",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a225ccb-a7dc-4437-bd97-b309d6ae6a47?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
51
CVE-2024/CVE-2024-63xx/CVE-2024-6306.json
Normal file
51
CVE-2024/CVE-2024-63xx/CVE-2024-6306.json
Normal file
@ -0,0 +1,51 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-6306",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-06-25T11:15:50.623",
|
||||||
|
"lastModified": "2024-06-25T11:15:50.623",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "WordPress Core is vulnerable to Directory Traversal in various versions up to 6.5.5 via the Template Part block. This makes it possible for authenticated attackers, with Contributor-level access and above, to include arbitrary HTML Files on sites running Windows."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE",
|
||||||
|
"baseScore": 4.3,
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 1.4
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://core.trac.wordpress.org/changeset/58470",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://wordpress.org/news/2024/06/wordpress-6-5-5/",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4af2b01b-2dcb-44ae-a764-8ecc5f8caa81?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
55
CVE-2024/CVE-2024-63xx/CVE-2024-6307.json
Normal file
55
CVE-2024/CVE-2024-63xx/CVE-2024-6307.json
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-6307",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-06-25T11:15:50.820",
|
||||||
|
"lastModified": "2024-06-25T11:15:50.820",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions up to 6.5.5 due to insufficient input sanitization and output escaping on URLs. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE",
|
||||||
|
"baseScore": 6.4,
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.1,
|
||||||
|
"impactScore": 2.7
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://core.trac.wordpress.org/changeset/58472",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://core.trac.wordpress.org/changeset/58473",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://wordpress.org/news/2024/06/wordpress-6-5-5/",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bc0d36f8-6569-49a1-b722-5cf57c4bb32a?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
23
README.md
23
README.md
@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours.
|
|||||||
### Last Repository Update
|
### Last Repository Update
|
||||||
|
|
||||||
```plain
|
```plain
|
||||||
2024-06-25T10:00:21.347936+00:00
|
2024-06-25T12:00:18.798859+00:00
|
||||||
```
|
```
|
||||||
|
|
||||||
### Most recent CVE Modification Timestamp synchronized with NVD
|
### Most recent CVE Modification Timestamp synchronized with NVD
|
||||||
|
|
||||||
```plain
|
```plain
|
||||||
2024-06-25T09:15:57.760000+00:00
|
2024-06-25T11:15:50.820000+00:00
|
||||||
```
|
```
|
||||||
|
|
||||||
### Last Data Feed Release
|
### Last Data Feed Release
|
||||||
@ -33,23 +33,28 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
|
|||||||
### Total Number of included CVEs
|
### Total Number of included CVEs
|
||||||
|
|
||||||
```plain
|
```plain
|
||||||
255105
|
255112
|
||||||
```
|
```
|
||||||
|
|
||||||
### CVEs added in the last Commit
|
### CVEs added in the last Commit
|
||||||
|
|
||||||
Recently added CVEs: `4`
|
Recently added CVEs: `7`
|
||||||
|
|
||||||
- [CVE-2024-34141](CVE-2024/CVE-2024-341xx/CVE-2024-34141.json) (`2024-06-25T09:15:56.807`)
|
- [CVE-2024-4639](CVE-2024/CVE-2024-46xx/CVE-2024-4639.json) (`2024-06-25T10:15:19.897`)
|
||||||
- [CVE-2024-34142](CVE-2024/CVE-2024-341xx/CVE-2024-34142.json) (`2024-06-25T09:15:57.130`)
|
- [CVE-2024-4640](CVE-2024/CVE-2024-46xx/CVE-2024-4640.json) (`2024-06-25T10:15:20.780`)
|
||||||
- [CVE-2024-4638](CVE-2024/CVE-2024-46xx/CVE-2024-4638.json) (`2024-06-25T09:15:57.413`)
|
- [CVE-2024-4641](CVE-2024/CVE-2024-46xx/CVE-2024-4641.json) (`2024-06-25T10:15:21.000`)
|
||||||
- [CVE-2024-6028](CVE-2024/CVE-2024-60xx/CVE-2024-6028.json) (`2024-06-25T09:15:57.760`)
|
- [CVE-2024-5216](CVE-2024/CVE-2024-52xx/CVE-2024-5216.json) (`2024-06-25T11:15:50.193`)
|
||||||
|
- [CVE-2024-6305](CVE-2024/CVE-2024-63xx/CVE-2024-6305.json) (`2024-06-25T11:15:50.420`)
|
||||||
|
- [CVE-2024-6306](CVE-2024/CVE-2024-63xx/CVE-2024-6306.json) (`2024-06-25T11:15:50.623`)
|
||||||
|
- [CVE-2024-6307](CVE-2024/CVE-2024-63xx/CVE-2024-6307.json) (`2024-06-25T11:15:50.820`)
|
||||||
|
|
||||||
|
|
||||||
### CVEs modified in the last Commit
|
### CVEs modified in the last Commit
|
||||||
|
|
||||||
Recently modified CVEs: `0`
|
Recently modified CVEs: `2`
|
||||||
|
|
||||||
|
- [CVE-2024-2965](CVE-2024/CVE-2024-29xx/CVE-2024-2965.json) (`2024-06-25T11:15:49.873`)
|
||||||
|
- [CVE-2024-6028](CVE-2024/CVE-2024-60xx/CVE-2024-6028.json) (`2024-06-25T09:15:57.760`)
|
||||||
|
|
||||||
|
|
||||||
## Download and Usage
|
## Download and Usage
|
||||||
|
17
_state.csv
17
_state.csv
@ -248377,7 +248377,7 @@ CVE-2024-2963,0,0,fd3dfe2484fa8fbcf32b1e1713c092eebd2b546a8fe9a7f583270172bb703a
|
|||||||
CVE-2024-2964,0,0,491ec5f2811a24301edaa3e4cd378090bf610cd2f1b9a50cd7e0dcb254704174,2024-03-29T12:45:02.937000
|
CVE-2024-2964,0,0,491ec5f2811a24301edaa3e4cd378090bf610cd2f1b9a50cd7e0dcb254704174,2024-03-29T12:45:02.937000
|
||||||
CVE-2024-29640,0,0,87923c5f8022466da2d8ef6f4760770a9b5d77108f7ca786dd890e142c1a64f2,2024-04-01T01:12:59.077000
|
CVE-2024-29640,0,0,87923c5f8022466da2d8ef6f4760770a9b5d77108f7ca786dd890e142c1a64f2,2024-04-01T01:12:59.077000
|
||||||
CVE-2024-29644,0,0,39829980cc0c3cec42e83f1a7d1e74f651bed504f90005be4e46042a91527a65,2024-03-26T12:55:05.010000
|
CVE-2024-29644,0,0,39829980cc0c3cec42e83f1a7d1e74f651bed504f90005be4e46042a91527a65,2024-03-26T12:55:05.010000
|
||||||
CVE-2024-2965,0,0,1ec58398cb69e76a7bbbcfddddf050bca23781a3fb842732dc4fb30f19d61d8b,2024-06-07T14:56:05.647000
|
CVE-2024-2965,0,1,ae0a5407fd78d6b2604d9fd881735bd6f473d7086b4c284611aa9a0f4adc9d14,2024-06-25T11:15:49.873000
|
||||||
CVE-2024-29650,0,0,8ad374bfabee755625e57dff59b85656db535734df280985070b11f8f0b8c3b6,2024-03-25T16:43:06.137000
|
CVE-2024-29650,0,0,8ad374bfabee755625e57dff59b85656db535734df280985070b11f8f0b8c3b6,2024-03-25T16:43:06.137000
|
||||||
CVE-2024-29651,0,0,64d9a8930ee4398a03fcd3e224f1e639eea2a6cdeff56b4b739c9ec75d30844a,2024-05-20T19:34:58.277000
|
CVE-2024-29651,0,0,64d9a8930ee4398a03fcd3e224f1e639eea2a6cdeff56b4b739c9ec75d30844a,2024-05-20T19:34:58.277000
|
||||||
CVE-2024-2966,0,0,474ae2e5b1d6c6447ca9bee38c5e4dafcb7b2c2503070dea1f4351179cfe9798,2024-04-11T12:47:44.137000
|
CVE-2024-2966,0,0,474ae2e5b1d6c6447ca9bee38c5e4dafcb7b2c2503070dea1f4351179cfe9798,2024-04-11T12:47:44.137000
|
||||||
@ -251331,8 +251331,8 @@ CVE-2024-34129,0,0,d3dc43049d80f783794d9399825be80ea683040539452e8a7be93120bda8c
|
|||||||
CVE-2024-3413,0,0,8bf7e231eaef8a1fb270998ee982f12463c5a7d17ff17eb8735dbc8fc584bd57,2024-05-17T02:39:54.073000
|
CVE-2024-3413,0,0,8bf7e231eaef8a1fb270998ee982f12463c5a7d17ff17eb8735dbc8fc584bd57,2024-05-17T02:39:54.073000
|
||||||
CVE-2024-34130,0,0,89584332f9dd3125064424fac4aabed722eb075df05ba25c9a02617aa8a6856c,2024-06-13T18:35:19.777000
|
CVE-2024-34130,0,0,89584332f9dd3125064424fac4aabed722eb075df05ba25c9a02617aa8a6856c,2024-06-13T18:35:19.777000
|
||||||
CVE-2024-3414,0,0,69231815197d8c759df4a79a39950c8d4f6258471ea32f1c29be1a7038b6ec47,2024-05-17T02:39:54.160000
|
CVE-2024-3414,0,0,69231815197d8c759df4a79a39950c8d4f6258471ea32f1c29be1a7038b6ec47,2024-05-17T02:39:54.160000
|
||||||
CVE-2024-34141,1,1,9349c88755a55bfc99e3c9d5d7bab8c900684df9c21d3a497a2767cd4d1cc6f9,2024-06-25T09:15:56.807000
|
CVE-2024-34141,0,0,9349c88755a55bfc99e3c9d5d7bab8c900684df9c21d3a497a2767cd4d1cc6f9,2024-06-25T09:15:56.807000
|
||||||
CVE-2024-34142,1,1,83181d63877d25698e74c438beea417f8ba42c60dbb9f319c96e2d17db1e92a4,2024-06-25T09:15:57.130000
|
CVE-2024-34142,0,0,83181d63877d25698e74c438beea417f8ba42c60dbb9f319c96e2d17db1e92a4,2024-06-25T09:15:57.130000
|
||||||
CVE-2024-34144,0,0,161e418bd2efea8731bcf0c84ef4939748aabfddbc9f310a20f204f2b5cb4158,2024-05-02T18:00:37.360000
|
CVE-2024-34144,0,0,161e418bd2efea8731bcf0c84ef4939748aabfddbc9f310a20f204f2b5cb4158,2024-05-02T18:00:37.360000
|
||||||
CVE-2024-34145,0,0,8976018515653d9edfc24ef743cee1c2f455c68450e5a16824609e8151c9f246,2024-05-02T18:00:37.360000
|
CVE-2024-34145,0,0,8976018515653d9edfc24ef743cee1c2f455c68450e5a16824609e8151c9f246,2024-05-02T18:00:37.360000
|
||||||
CVE-2024-34146,0,0,57b55472d7ef8f36d24d72d33ce2a7a08770dabb111aaf45da4e0803162f240d,2024-05-02T18:00:37.360000
|
CVE-2024-34146,0,0,57b55472d7ef8f36d24d72d33ce2a7a08770dabb111aaf45da4e0803162f240d,2024-05-02T18:00:37.360000
|
||||||
@ -254154,7 +254154,10 @@ CVE-2024-4634,0,0,26305cc83de7193b57243a5cab6ca5caf74694a0d7bbca15218a554118aa8e
|
|||||||
CVE-2024-4635,0,0,39b2c6bf6977107b11329776563f920ebcfe13f250d063c0984d8282a28a8353,2024-05-16T13:03:05.353000
|
CVE-2024-4635,0,0,39b2c6bf6977107b11329776563f920ebcfe13f250d063c0984d8282a28a8353,2024-05-16T13:03:05.353000
|
||||||
CVE-2024-4636,0,0,408131d6e6f7a1de019141a0a08ced7ddc9316cec6084c2dbfd44b2d5b664bc5,2024-05-15T16:40:19.330000
|
CVE-2024-4636,0,0,408131d6e6f7a1de019141a0a08ced7ddc9316cec6084c2dbfd44b2d5b664bc5,2024-05-15T16:40:19.330000
|
||||||
CVE-2024-4637,0,0,21c5b691b799fa0ad4b2a54783a02d470d1ce61487f2f97641252b6306511e58,2024-06-04T16:57:41.053000
|
CVE-2024-4637,0,0,21c5b691b799fa0ad4b2a54783a02d470d1ce61487f2f97641252b6306511e58,2024-06-04T16:57:41.053000
|
||||||
CVE-2024-4638,1,1,08167ff53b9f0160e5193543e64b1e71cd296bf83d39b069e11c32210db54019,2024-06-25T09:15:57.413000
|
CVE-2024-4638,0,0,08167ff53b9f0160e5193543e64b1e71cd296bf83d39b069e11c32210db54019,2024-06-25T09:15:57.413000
|
||||||
|
CVE-2024-4639,1,1,77bf440fde8cc4e599977a47dcebf44afbdcc620e17f19c0bf7b54e1b81d70f1,2024-06-25T10:15:19.897000
|
||||||
|
CVE-2024-4640,1,1,300148a0e00695e660f6da8d0f86f66e85556a7d3ab5b54dcb33b8d883fe4a0c,2024-06-25T10:15:20.780000
|
||||||
|
CVE-2024-4641,1,1,203400a6c4b1dde96c7a303c61e0bad42a214e83d668b5d3b26454a4126836be,2024-06-25T10:15:21
|
||||||
CVE-2024-4642,0,0,af413e9c39a7a95f4fad15629993388538023a0a54f7d3f1141388f9a4b404f9,2024-05-20T17:15:09.667000
|
CVE-2024-4642,0,0,af413e9c39a7a95f4fad15629993388538023a0a54f7d3f1141388f9a4b404f9,2024-05-20T17:15:09.667000
|
||||||
CVE-2024-4644,0,0,5d38890bfca86b13a178b6ea41ebf3343b04f0eb53943a12f40545b93c47b88a,2024-06-04T19:20:44.287000
|
CVE-2024-4644,0,0,5d38890bfca86b13a178b6ea41ebf3343b04f0eb53943a12f40545b93c47b88a,2024-06-04T19:20:44.287000
|
||||||
CVE-2024-4645,0,0,029fc657c20e99e63c4a0896df7eaed00c7e95079c841983238fcd27dbc9082f,2024-05-29T20:15:13.240000
|
CVE-2024-4645,0,0,029fc657c20e99e63c4a0896df7eaed00c7e95079c841983238fcd27dbc9082f,2024-05-29T20:15:13.240000
|
||||||
@ -254573,6 +254576,7 @@ CVE-2024-5208,0,0,3985337bac39b70213766ebf64511613ec02cc254f1933a2c8ecd567239b3c
|
|||||||
CVE-2024-5211,0,0,a4277f26aaa565cc417eac86a473b48ddc12386cf29490b9b3d30644e664c347,2024-06-13T18:36:09.010000
|
CVE-2024-5211,0,0,a4277f26aaa565cc417eac86a473b48ddc12386cf29490b9b3d30644e664c347,2024-06-13T18:36:09.010000
|
||||||
CVE-2024-5213,0,0,5a68006f91028e70fb3202f4e898c6483c20faed2d33be845b22e07c07dc81e8,2024-06-20T12:43:25.663000
|
CVE-2024-5213,0,0,5a68006f91028e70fb3202f4e898c6483c20faed2d33be845b22e07c07dc81e8,2024-06-20T12:43:25.663000
|
||||||
CVE-2024-5214,0,0,77a86526714522a20940695733fe46b4562089752d3c663cf289b583b7c6bbda,2024-06-03T19:15:09.360000
|
CVE-2024-5214,0,0,77a86526714522a20940695733fe46b4562089752d3c663cf289b583b7c6bbda,2024-06-03T19:15:09.360000
|
||||||
|
CVE-2024-5216,1,1,1d1c3c448497d1bdb33db169e9a910530fa4151a4583b3e5da1bb05aac955096,2024-06-25T11:15:50.193000
|
||||||
CVE-2024-5218,0,0,928b5f8d4e08afc285c0cf6e370373ec87899b716b1cb4db68027907b01d2a82,2024-05-28T12:39:42.673000
|
CVE-2024-5218,0,0,928b5f8d4e08afc285c0cf6e370373ec87899b716b1cb4db68027907b01d2a82,2024-05-28T12:39:42.673000
|
||||||
CVE-2024-5220,0,0,f61a4e43424028e9a9336f6f6ed766295c86a8a5421f6ff87daa2be13ac80d02,2024-05-28T12:39:42.673000
|
CVE-2024-5220,0,0,f61a4e43424028e9a9336f6f6ed766295c86a8a5421f6ff87daa2be13ac80d02,2024-05-28T12:39:42.673000
|
||||||
CVE-2024-5221,0,0,6f51797e5b3c0557a37760dbd03fa62a550b475fd63c18dbeda417440e82bc1e,2024-06-11T17:45:05.337000
|
CVE-2024-5221,0,0,6f51797e5b3c0557a37760dbd03fa62a550b475fd63c18dbeda417440e82bc1e,2024-06-11T17:45:05.337000
|
||||||
@ -254994,7 +254998,7 @@ CVE-2024-6014,0,0,6f42b027c41cbc2bef7f3eccd4ed3d2b0646bd4a1028da377690698f146442
|
|||||||
CVE-2024-6015,0,0,b5dd732698ac918c4f9a100a042e5587c72b21ba3272e6fc136fa01311e31fdc,2024-06-17T15:15:52.830000
|
CVE-2024-6015,0,0,b5dd732698ac918c4f9a100a042e5587c72b21ba3272e6fc136fa01311e31fdc,2024-06-17T15:15:52.830000
|
||||||
CVE-2024-6016,0,0,c54c9dea249da6152524c81283c2e2c500a502b8999814b114c6434b99c2c3ed,2024-06-17T14:15:12.487000
|
CVE-2024-6016,0,0,c54c9dea249da6152524c81283c2e2c500a502b8999814b114c6434b99c2c3ed,2024-06-17T14:15:12.487000
|
||||||
CVE-2024-6027,0,0,b2fd57616c7b740fff1978bda2368fdc3959192a2c78f320629b1920784145fa,2024-06-24T19:17:50.240000
|
CVE-2024-6027,0,0,b2fd57616c7b740fff1978bda2368fdc3959192a2c78f320629b1920784145fa,2024-06-24T19:17:50.240000
|
||||||
CVE-2024-6028,1,1,a0bf8ff0724e360ddef8160bbcb8bc5f9abbbad84911b5bb364e1e4c3cf19c2b,2024-06-25T09:15:57.760000
|
CVE-2024-6028,0,1,b191808c369e573c8d18d4d3211895be13d7df913ef54d176a1110788053d527,2024-06-25T09:15:57.760000
|
||||||
CVE-2024-6039,0,0,266923799676f8be01eee28d4a84714045ee9a927bc992eaf897cc5b748105d7,2024-06-17T14:15:12.620000
|
CVE-2024-6039,0,0,266923799676f8be01eee28d4a84714045ee9a927bc992eaf897cc5b748105d7,2024-06-17T14:15:12.620000
|
||||||
CVE-2024-6041,0,0,a295768a83c71f46593370532a5a859cd3d130f4e3527299fc42bdf02397e4d4,2024-06-17T14:15:12.733000
|
CVE-2024-6041,0,0,a295768a83c71f46593370532a5a859cd3d130f4e3527299fc42bdf02397e4d4,2024-06-17T14:15:12.733000
|
||||||
CVE-2024-6042,0,0,6d196e9da9a08d79a22225e118daa7f0e4c238306b694dbe66ba5d1dac9a15e7,2024-06-17T12:42:04.623000
|
CVE-2024-6042,0,0,6d196e9da9a08d79a22225e118daa7f0e4c238306b694dbe66ba5d1dac9a15e7,2024-06-17T12:42:04.623000
|
||||||
@ -255104,3 +255108,6 @@ CVE-2024-6293,0,0,eeaffba53fb5f9eeff42362f9e68ced969d50fc1ed573bd27cb47a275de983
|
|||||||
CVE-2024-6294,0,0,3041bcbf3b0b5ad6bbf3a9834cf50b133cb108f81018300675ffbfbc44672946,2024-06-25T02:15:11.657000
|
CVE-2024-6294,0,0,3041bcbf3b0b5ad6bbf3a9834cf50b133cb108f81018300675ffbfbc44672946,2024-06-25T02:15:11.657000
|
||||||
CVE-2024-6295,0,0,1fff3f0ba280af9323e3d1eb1c5da3207fda9e71741085aa72d53fdeb44054eb,2024-06-25T03:15:10.740000
|
CVE-2024-6295,0,0,1fff3f0ba280af9323e3d1eb1c5da3207fda9e71741085aa72d53fdeb44054eb,2024-06-25T03:15:10.740000
|
||||||
CVE-2024-6297,0,0,963aac9b15e01b92539dd612e6b833645a121fdbb1ea413763ce64509b390ec1,2024-06-25T04:15:17.400000
|
CVE-2024-6297,0,0,963aac9b15e01b92539dd612e6b833645a121fdbb1ea413763ce64509b390ec1,2024-06-25T04:15:17.400000
|
||||||
|
CVE-2024-6305,1,1,ba40559e2670cefd54734e86b7da7f37bcbe0efbceb2fda65bd33ec3539d5be4,2024-06-25T11:15:50.420000
|
||||||
|
CVE-2024-6306,1,1,e7be3407d3123a6d05bee4a1026416fd939e96873c4dc6b8040b7c7151ebe04f,2024-06-25T11:15:50.623000
|
||||||
|
CVE-2024-6307,1,1,151c9c4af9f53defbfea550bc6d57b5e694c83ee72033432347f392c9221ee91,2024-06-25T11:15:50.820000
|
||||||
|
Can't render this file because it is too large.
|
Loading…
x
Reference in New Issue
Block a user