Skip to content

Commit 7b12f04

Browse files
advisory-database[bot]advisory-database[bot]
committed
Advisory Database Sync
1 parent 787f99e commit 7b12f04

File tree

75 files changed

+3490
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

75 files changed

+3490
-0
lines changed

‎advisories/unreviewed/2023/10/GHSA-2377-2j75-w5v6/GHSA-2377-2j75-w5v6.json‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2377-2j75-w5v6",
4+
"modified": "2023-10-20T09:30:28Z",
5+
"published": "2023-10-20T09:30:28Z",
6+
"aliases": [
7+
"CVE-2020-36751"
8+
],
9+
"details": "The Coupon Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to missing or incorrect nonce validation on the save_meta() function. This makes it possible for unauthenticated attackers to save meta fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [
17+
18+
],
19+
"references": [
20+
{
21+
"type": "ADVISORY",
22+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36751"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/"
27+
},
28+
{
29+
"type": "WEB",
30+
"url": "https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/"
31+
},
32+
{
33+
"type": "WEB",
34+
"url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/"
35+
},
36+
{
37+
"type": "WEB",
38+
"url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/"
47+
},
48+
{
49+
"type": "WEB",
50+
"url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/"
51+
},
52+
{
53+
"type": "WEB",
54+
"url": "https://plugins.trac.wordpress.org/changeset/2368658/coupon-creator/tags/2.5.2.1/plugin-engine/src/Pngx/Admin/Meta.php"
55+
},
56+
{
57+
"type": "WEB",
58+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ab57f010-4fd2-40c2-950f-c03888521c8f?source=cve"
59+
}
60+
],
61+
"database_specific": {
62+
"cwe_ids": [
63+
"CWE-352"
64+
],
65+
"severity": null,
66+
"github_reviewed": false,
67+
"github_reviewed_at": null,
68+
"nvd_published_at": null
69+
}
70+
}

‎advisories/unreviewed/2023/10/GHSA-243r-m3w5-w83p/GHSA-243r-m3w5-w83p.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-243r-m3w5-w83p",
4+
"modified": "2023-10-20T09:30:29Z",
5+
"published": "2023-10-20T09:30:29Z",
6+
"aliases": [
7+
"CVE-2023-5231"
8+
],
9+
"details": "The Magic Action Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 2.17.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [
17+
18+
],
19+
"references": [
20+
{
21+
"type": "ADVISORY",
22+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5231"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://plugins.trac.wordpress.org/browser/magic-action-box/tags/2.17.2/lib/functions.php#L287"
27+
},
28+
{
29+
"type": "WEB",
30+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce9b908b-1388-41fb-915c-e4e29eaf57ed?source=cve"
31+
}
32+
],
33+
"database_specific": {
34+
"cwe_ids": [
35+
"CWE-79"
36+
],
37+
"severity": null,
38+
"github_reviewed": false,
39+
"github_reviewed_at": null,
40+
"nvd_published_at": null
41+
}
42+
}

‎advisories/unreviewed/2023/10/GHSA-2456-m625-hcj6/GHSA-2456-m625-hcj6.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2456-m625-hcj6",
4+
"modified": "2023-10-20T09:30:29Z",
5+
"published": "2023-10-20T09:30:29Z",
6+
"aliases": [
7+
"CVE-2023-5615"
8+
],
9+
"details": "The Skype Legacy Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skype-status' shortcode in all versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [
17+
18+
],
19+
"references": [
20+
{
21+
"type": "ADVISORY",
22+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5615"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://plugins.trac.wordpress.org/browser/skype-online-status/tags/3.1/skype-classes.php#L316"
27+
},
28+
{
29+
"type": "WEB",
30+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/914bcc8f-fecd-450e-b2a7-0989b7a0dd4c?source=cve"
31+
}
32+
],
33+
"database_specific": {
34+
"cwe_ids": [
35+
"CWE-79"
36+
],
37+
"severity": null,
38+
"github_reviewed": false,
39+
"github_reviewed_at": null,
40+
"nvd_published_at": null
41+
}
42+
}

‎advisories/unreviewed/2023/10/GHSA-2wq9-hq2m-2hfq/GHSA-2wq9-hq2m-2hfq.json‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2wq9-hq2m-2hfq",
4+
"modified": "2023-10-20T09:30:29Z",
5+
"published": "2023-10-20T09:30:29Z",
6+
"aliases": [
7+
"CVE-2022-3622"
8+
],
9+
"details": "The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and including, 6.9.11. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to change some plugin settings intended to be modifiable by admins only.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [
17+
18+
],
19+
"references": [
20+
{
21+
"type": "ADVISORY",
22+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3622"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://plugins.trac.wordpress.org/browser/blog2social/tags/6.9.10/includes/B2S/Settings/Item.php#L116"
27+
},
28+
{
29+
"type": "WEB",
30+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2795052%40blog2social&new=2795052%40blog2social&sfp_email=&sfph_mail="
31+
},
32+
{
33+
"type": "WEB",
34+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2796598%40blog2social&new=2796598%40blog2social&sfp_email=&sfph_mail="
35+
},
36+
{
37+
"type": "WEB",
38+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f5b8d39c-d307-42c9-a972-29b5521a82a4?source=cve"
39+
}
40+
],
41+
"database_specific": {
42+
"cwe_ids": [
43+
"CWE-862"
44+
],
45+
"severity": null,
46+
"github_reviewed": false,
47+
"github_reviewed_at": null,
48+
"nvd_published_at": null
49+
}
50+
}

‎advisories/unreviewed/2023/10/GHSA-33gx-m93p-j6wc/GHSA-33gx-m93p-j6wc.json‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-33gx-m93p-j6wc",
4+
"modified": "2023-10-20T09:30:28Z",
5+
"published": "2023-10-20T09:30:28Z",
6+
"aliases": [
7+
"CVE-2020-36758"
8+
],
9+
"details": "The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This is due to missing or incorrect nonce validation on the save_feedzy_post_type_meta() function. This makes it possible for unauthenticated attackers to update post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [
17+
18+
],
19+
"references": [
20+
{
21+
"type": "ADVISORY",
22+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36758"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/"
27+
},
28+
{
29+
"type": "WEB",
30+
"url": "https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/"
31+
},
32+
{
33+
"type": "WEB",
34+
"url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/"
35+
},
36+
{
37+
"type": "WEB",
38+
"url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/"
47+
},
48+
{
49+
"type": "WEB",
50+
"url": "https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/"
51+
},
52+
{
53+
"type": "WEB",
54+
"url": "https://plugins.trac.wordpress.org/changeset/2369394/feedzy-rss-feeds/trunk/includes/admin/feedzy-rss-feeds-admin.php"
55+
},
56+
{
57+
"type": "WEB",
58+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e3b916dc-3b94-4319-a805-0ea99d14429f?source=cve"
59+
}
60+
],
61+
"database_specific": {
62+
"cwe_ids": [
63+
"CWE-352"
64+
],
65+
"severity": null,
66+
"github_reviewed": false,
67+
"github_reviewed_at": null,
68+
"nvd_published_at": null
69+
}
70+
}

‎advisories/unreviewed/2023/10/GHSA-364j-ch9m-hp4h/GHSA-364j-ch9m-hp4h.json‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-364j-ch9m-hp4h",
4+
"modified": "2023-10-20T09:30:29Z",
5+
"published": "2023-10-20T09:30:29Z",
6+
"aliases": [
7+
"CVE-2023-3996"
8+
],
9+
"details": "The ARMember Lite - Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 4.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"
14+
}
15+
],
16+
"affected": [
17+
18+
],
19+
"references": [
20+
{
21+
"type": "ADVISORY",
22+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3996"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://plugins.svn.wordpress.org/armember-membership/tags/4.0.2/readme.md"
27+
},
28+
{
29+
"type": "WEB",
30+
"url": "https://plugins.svn.wordpress.org/armember-membership/tags/4.0.2/readme.txt"
31+
},
32+
{
33+
"type": "WEB",
34+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2905086%40armember-membership%2Ftrunk&old=2885708%40armember-membership%2Ftrunk&sfp_email=&sfph_mail="
35+
},
36+
{
37+
"type": "WEB",
38+
"url": "https://www.armemberplugin.com"
39+
},
40+
{
41+
"type": "WEB",
42+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c1022ac4-869e-415a-a7c8-3650421608ea?source=cve"
43+
}
44+
],
45+
"database_specific": {
46+
"cwe_ids": [
47+
"CWE-79"
48+
],
49+
"severity": null,
50+
"github_reviewed": false,
51+
"github_reviewed_at": null,
52+
"nvd_published_at": null
53+
}
54+
}

‎advisories/unreviewed/2023/10/GHSA-3rhv-vcmv-prv6/GHSA-3rhv-vcmv-prv6.json‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3rhv-vcmv-prv6",
4+
"modified": "2023-10-20T09:30:29Z",
5+
"published": "2023-10-20T09:30:29Z",
6+
"aliases": [
7+
"CVE-2023-5533"
8+
],
9+
"details": "The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9. This makes it possible for unauthenticated attackers to perform some of those actions that were intended for higher privileged users.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
14+
}
15+
],
16+
"affected": [
17+
18+
],
19+
"references": [
20+
{
21+
"type": "ADVISORY",
22+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5533"
23+
},
24+
{
25+
"type": "WEB",
26+
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2977505%40chatbot%2Ftrunk&old=2967435%40chatbot%2Ftrunk&sfp_email=&sfph_mail="
27+
},
28+
{
29+
"type": "WEB",
30+
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a9db002f-ff41-493a-87b1-5f0b4b07cfc2?source=cve"
31+
}
32+
],
33+
"database_specific": {
34+
"cwe_ids": [
35+
"CWE-862"
36+
],
37+
"severity": null,
38+
"github_reviewed": false,
39+
"github_reviewed_at": null,
40+
"nvd_published_at": null
41+
}
42+
}

0 commit comments

Comments
 (0)