Auto-Update: 2024-12-10T11:00:29.855738+00:00

fkie-cad · Dec 10, 2024 · c7a3ddf · c7a3ddf
1 parent 65c0a12
commit c7a3ddf
Show file tree

Hide file tree

Showing 7 changed files with 362 additions and 15 deletions.
diff --git a/CVE-2024/CVE-2024-119xx/CVE-2024-11940.json b/CVE-2024/CVE-2024-119xx/CVE-2024-11940.json
@@ -0,0 +1,72 @@
+{
+  "id": "CVE-2024-11940",
+  "sourceIdentifier": "[email protected]",
+  "published": "2024-12-10T09:15:04.870",
+  "lastModified": "2024-12-10T09:15:04.870",
+  "vulnStatus": "Received",
+  "cveTags": [],
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Property Hive Mortgage Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018price\u2019 parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "[email protected]",
+        "type": "Primary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+          "baseScore": 6.4,
+          "baseSeverity": "MEDIUM",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "LOW",
+          "userInteraction": "NONE",
+          "scope": "CHANGED",
+          "confidentialityImpact": "LOW",
+          "integrityImpact": "LOW",
+          "availabilityImpact": "NONE"
+        },
+        "exploitabilityScore": 3.1,
+        "impactScore": 2.7
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "[email protected]",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-79"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://plugins.trac.wordpress.org/browser/property-hive-mortgage-calculator/tags/1.0.6/propertyhive-mortgage-calculator.php",
+      "source": "[email protected]"
+    },
+    {
+      "url": "https://plugins.trac.wordpress.org/browser/property-hive-mortgage-calculator/tags/1.0.6/templates/mortgage-calculator.php",
+      "source": "[email protected]"
+    },
+    {
+      "url": "https://plugins.trac.wordpress.org/changeset/3202219/",
+      "source": "[email protected]"
+    },
+    {
+      "url": "https://wordpress.org/plugins/property-hive-mortgage-calculator/#developers",
+      "source": "[email protected]"
+    },
+    {
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0f01f69e-0ff8-4771-9bf5-53ef78438cc2?source=cve",
+      "source": "[email protected]"
+    }
+  ]
+}
diff --git a/CVE-2024/CVE-2024-119xx/CVE-2024-11945.json b/CVE-2024/CVE-2024-119xx/CVE-2024-11945.json
@@ -0,0 +1,68 @@
+{
+  "id": "CVE-2024-11945",
+  "sourceIdentifier": "[email protected]",
+  "published": "2024-12-10T10:15:04.810",
+  "lastModified": "2024-12-10T10:15:04.810",
+  "vulnStatus": "Received",
+  "cveTags": [],
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Email Reminders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018id\u2019 parameter in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "[email protected]",
+        "type": "Primary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
+          "baseScore": 6.4,
+          "baseSeverity": "MEDIUM",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "LOW",
+          "userInteraction": "NONE",
+          "scope": "CHANGED",
+          "confidentialityImpact": "LOW",
+          "integrityImpact": "LOW",
+          "availabilityImpact": "NONE"
+        },
+        "exploitabilityScore": 3.1,
+        "impactScore": 2.7
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "[email protected]",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-79"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://plugins.trac.wordpress.org/browser/email-reminders/trunk/includes/page-rules/rules_shortcodes.php#L70",
+      "source": "[email protected]"
+    },
+    {
+      "url": "https://plugins.trac.wordpress.org/changeset/3202124/",
+      "source": "[email protected]"
+    },
+    {
+      "url": "https://wordpress.org/plugins/email-reminders/#developers",
+      "source": "[email protected]"
+    },
+    {
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a0adfd13-a9f1-4bec-96ec-6a51cd08e4ea?source=cve",
+      "source": "[email protected]"
+    }
+  ]
+}
diff --git a/CVE-2024/CVE-2024-119xx/CVE-2024-11973.json b/CVE-2024/CVE-2024-119xx/CVE-2024-11973.json
@@ -0,0 +1,64 @@
+{
+  "id": "CVE-2024-11973",
+  "sourceIdentifier": "[email protected]",
+  "published": "2024-12-10T10:15:06.123",
+  "lastModified": "2024-12-10T10:15:06.123",
+  "vulnStatus": "Received",
+  "cveTags": [],
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "The Quran multilanguage Text & Audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sourate' and 'lang' parameter in all versions up to, and including, 2.3.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "[email protected]",
+        "type": "Primary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+          "baseScore": 6.1,
+          "baseSeverity": "MEDIUM",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "REQUIRED",
+          "scope": "CHANGED",
+          "confidentialityImpact": "LOW",
+          "integrityImpact": "LOW",
+          "availabilityImpact": "NONE"
+        },
+        "exploitabilityScore": 2.8,
+        "impactScore": 2.7
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "[email protected]",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-79"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://plugins.trac.wordpress.org/changeset/3203456/",
+      "source": "[email protected]"
+    },
+    {
+      "url": "https://wordpress.org/plugins/quran-text-multilanguage/#developers",
+      "source": "[email protected]"
+    },
+    {
+      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/09afbbd2-52c6-48a6-a2f0-b1509d864e7e?source=cve",
+      "source": "[email protected]"
+    }
+  ]
+}
diff --git a/CVE-2024/CVE-2024-457xx/CVE-2024-45709.json b/CVE-2024/CVE-2024-457xx/CVE-2024-45709.json
@@ -0,0 +1,60 @@
+{
+  "id": "CVE-2024-45709",
+  "sourceIdentifier": "[email protected]",
+  "published": "2024-12-10T09:15:06.013",
+  "lastModified": "2024-12-10T09:15:06.013",
+  "vulnStatus": "Received",
+  "cveTags": [],
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "SolarWinds Web Help Desk was susceptible to a local file read vulnerability.  This vulnerability requires the software be installed on Linux and configured to use non-default development/test mode making exposure to the vulnerability very limited."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "[email protected]",
+        "type": "Primary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
+          "baseScore": 5.3,
+          "baseSeverity": "MEDIUM",
+          "attackVector": "NETWORK",
+          "attackComplexity": "HIGH",
+          "privilegesRequired": "NONE",
+          "userInteraction": "REQUIRED",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "HIGH",
+          "integrityImpact": "NONE",
+          "availabilityImpact": "NONE"
+        },
+        "exploitabilityScore": 1.6,
+        "impactScore": 3.6
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "[email protected]",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-22"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-4_release_notes.htm",
+      "source": "[email protected]"
+    },
+    {
+      "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-45709",
+      "source": "[email protected]"
+    }
+  ]
+}
diff --git a/CVE-2024/CVE-2024-82xx/CVE-2024-8256.json b/CVE-2024/CVE-2024-82xx/CVE-2024-8256.json
@@ -0,0 +1,78 @@
+{
+  "id": "CVE-2024-8256",
+  "sourceIdentifier": "001d69cf-3fc9-4203-93fb-9865b54e05b2",
+  "published": "2024-12-10T09:15:06.190",
+  "lastModified": "2024-12-10T09:15:06.190",
+  "vulnStatus": "Received",
+  "cveTags": [],
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "In Teltonika Networks RUTOS devices, running on versions 7.0 to 7.8 (excluding) and TSWOS devices running on versions 1.0 to 1.3 (excluding), due to incorrect permission handling a vulnerability exists which allows a lower privileged user with default permissions to access critical device resources via the API."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV40": [
+      {
+        "source": "001d69cf-3fc9-4203-93fb-9865b54e05b2",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "4.0",
+          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
+          "baseScore": 5.9,
+          "baseSeverity": "MEDIUM",
+          "attackVector": "ADJACENT",
+          "attackComplexity": "LOW",
+          "attackRequirements": "PRESENT",
+          "privilegesRequired": "LOW",
+          "userInteraction": "NONE",
+          "vulnerableSystemConfidentiality": "HIGH",
+          "vulnerableSystemIntegrity": "NONE",
+          "vulnerableSystemAvailability": "NONE",
+          "subsequentSystemConfidentiality": "NONE",
+          "subsequentSystemIntegrity": "NONE",
+          "subsequentSystemAvailability": "NONE",
+          "exploitMaturity": "NOT_DEFINED",
+          "confidentialityRequirements": "NOT_DEFINED",
+          "integrityRequirements": "NOT_DEFINED",
+          "availabilityRequirements": "NOT_DEFINED",
+          "modifiedAttackVector": "NOT_DEFINED",
+          "modifiedAttackComplexity": "NOT_DEFINED",
+          "modifiedAttackRequirements": "NOT_DEFINED",
+          "modifiedPrivilegesRequired": "NOT_DEFINED",
+          "modifiedUserInteraction": "NOT_DEFINED",
+          "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED",
+          "modifiedVulnerableSystemIntegrity": "NOT_DEFINED",
+          "modifiedVulnerableSystemAvailability": "NOT_DEFINED",
+          "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED",
+          "modifiedSubsequentSystemIntegrity": "NOT_DEFINED",
+          "modifiedSubsequentSystemAvailability": "NOT_DEFINED",
+          "safety": "NOT_DEFINED",
+          "automatable": "NOT_DEFINED",
+          "recovery": "NOT_DEFINED",
+          "valueDensity": "NOT_DEFINED",
+          "vulnerabilityResponseEffort": "NOT_DEFINED",
+          "providerUrgency": "NOT_DEFINED"
+        }
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "001d69cf-3fc9-4203-93fb-9865b54e05b2",
+      "type": "Secondary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-732"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://www.deepcove.support/teltonika-responsible-disclosure-proactive-testing-report/",
+      "source": "001d69cf-3fc9-4203-93fb-9865b54e05b2"
+    }
+  ]
+}