diff --git a/data/anchore/2022/CVE-2022-4534.json b/data/anchore/2022/CVE-2022-4534.json new file mode 100644 index 00000000..b9f1bb8b --- /dev/null +++ b/data/anchore/2022/CVE-2022-4534.json @@ -0,0 +1,39 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2022-4534", + "description": "The Limit Login Attempts (Spam Protection) plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.3. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/browser/wp-limit-failed-login-attempts/tags/5.3/login.php#L466", + "https://plugins.trac.wordpress.org/changeset/3163023/", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/561ec1b2-ee26-4e0c-b437-d70b04be5b4c?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:wp-buy:login_protection_-_limit_failed_login_attempts:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "wp-limit-failed-login-attempts", + "packageType": "wordpress-plugin", + "product": "Limit Login Attempts (Spam Protection)", + "vendor": "wp-buy", + "versions": [ + { + "lessThan": "5.4", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-32602.json b/data/anchore/2024/CVE-2024-32602.json new file mode 100644 index 00000000..31ec802e --- /dev/null +++ b/data/anchore/2024/CVE-2024-32602.json @@ -0,0 +1,46 @@ +{ + "additionalMetadata": { + "cna": "patchstack", + "cveId": "CVE-2024-32602", + "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.3.1.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://patchstack.com/database/vulnerability/woocommerce-multilingual/wordpress-woocommerce-multilingual-multicurrency-plugin-5-3-3-1-sql-injection-vulnerability?_s_id=cve" + ], + "solutions": [ + "Update to 5.3.4 or a higher version." + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:onthegosystems:woocommerce_multilingual_\\&_multicurrency:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "woocommerce-multilingual", + "packageType": "wordpress-plugin", + "product": "WooCommerce Multilingual & Multicurrency", + "repo": "https://plugins.svn.wordpress.org/woocommerce-multilingual", + "vendor": "OnTheGoSystems", + "versions": [ + { + "lessThan": "5.3.4", + "status": "affected", + "version": "0", + "versionType": "custom" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + }, + "references": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8b0f58b8-46d6-4deb-bfcc-806bb635b060?source=cve" + } + ] + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-47161.json b/data/anchore/2024/CVE-2024-47161.json new file mode 100644 index 00000000..fa65397e --- /dev/null +++ b/data/anchore/2024/CVE-2024-47161.json @@ -0,0 +1,34 @@ +{ + "additionalMetadata": { + "cna": "jetbrains", + "cveId": "CVE-2024-47161", + "description": "In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://www.jetbrains.com/privacy-security/issues-fixed/" + ] + }, + "adp": { + "affected": [ + { + "cpes": [ + "cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*" + ], + "product": "TeamCity", + "vendor": "JetBrains", + "versions": [ + { + "lessThan": "2024.07.3", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-47529.json b/data/anchore/2024/CVE-2024-47529.json new file mode 100644 index 00000000..ab424435 --- /dev/null +++ b/data/anchore/2024/CVE-2024-47529.json @@ -0,0 +1,38 @@ +{ + "additionalMetadata": { + "cna": "github_m", + "cveId": "CVE-2024-47529", + "description": "OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting (see GHSL-2024-128). This vulnerability is fixed in 5.19.0. This only affects Open Source edition, and not OpenC3 COSMOS Enterprise Edition.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://github.com/OpenC3/cosmos/commit/b5ab34fe7fa54c0c8171c4aa3caf4e03d6f63bd7", + "https://github.com/OpenC3/cosmos/security/advisories/GHSA-4xqv-47rm-37mm" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://github.com", + "cpes": [ + "cpe:2.3:a:openc3:cosmos:*:*:*:*:open_source:*:*:*" + ], + "packageName": "openc3/cosmos", + "product": "cosmos", + "repo": "https://github.com/openc3/cosmos", + "vendor": "OpenC3", + "versions": [ + { + "lessThan": "5.19.0", + "status": "affected", + "version": "0", + "versionType": "custom" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-47773.json b/data/anchore/2024/CVE-2024-47773.json new file mode 100644 index 00000000..8f0802c0 --- /dev/null +++ b/data/anchore/2024/CVE-2024-47773.json @@ -0,0 +1,43 @@ +{ + "additionalMetadata": { + "cna": "github_m", + "cveId": "CVE-2024-47773", + "description": "Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a response without any preloaded data. This issue only affects anonymous visitors of the site. This problem has been patched in the latest version of Discourse. Users are advised to upgrade. Users unable to upgrade should disable anonymous cache by setting the `DISCOURSE_DISABLE_ANON_CACHE` environment variable to a non-empty value.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://github.com/discourse/discourse/security/advisories/GHSA-58vv-9j8h-hw2v" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://github.com", + "cpes": [ + "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*" + ], + "packageName": "discourse/discourse", + "product": "discourse", + "repo": "https://github.com/discourse/discourse", + "vendor": "discourse", + "versions": [ + { + "lessThan": "3.3.2", + "status": "affected", + "version": "0", + "versionType": "custom" + }, + { + "lessThan": "3.4.0.beta2", + "status": "affected", + "version": "3.4.0.beta1", + "versionType": "custom" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-47780.json b/data/anchore/2024/CVE-2024-47780.json new file mode 100644 index 00000000..208c7e8e --- /dev/null +++ b/data/anchore/2024/CVE-2024-47780.json @@ -0,0 +1,57 @@ +{ + "additionalMetadata": { + "cna": "github_m", + "cveId": "CVE-2024-47780", + "description": "TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to \"everybody.\" However, affected users could not manipulate these pages. Users are advised to update to TYPO3 versions 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, 13.3.1 that fix the problem described. There are no known workarounds for this vulnerability.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://github.com/TYPO3/typo3/security/advisories/GHSA-rf5m-h8q9-9w6q", + "https://typo3.org/security/advisory/typo3-core-sa-2024-012" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://packagist.org", + "cpes": [ + "cpe:2.3:a:typo3:typo3:*:*:*:*:*:php:*:*" + ], + "packageName": "typo3/cms-backend", + "packageType": "php-composer", + "product": "typo3", + "repo": "https://github.com/typo3/typo3", + "vendor": "TYPO3", + "versions": [ + { + "lessThan": "10.4.46", + "status": "affected", + "version": "10.0.0", + "versionType": "custom" + }, + { + "lessThan": "11.5.40", + "status": "affected", + "version": "11.0.0", + "versionType": "custom" + }, + { + "lessThan": "12.4.21", + "status": "affected", + "version": "12.0.0", + "versionType": "custom" + }, + { + "lessThan": "13.3.1", + "status": "affected", + "version": "13.0.0", + "versionType": "custom" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-47822.json b/data/anchore/2024/CVE-2024-47822.json new file mode 100644 index 00000000..1256e078 --- /dev/null +++ b/data/anchore/2024/CVE-2024-47822.json @@ -0,0 +1,39 @@ +{ + "additionalMetadata": { + "cna": "github_m", + "cveId": "CVE-2024-47822", + "description": "Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in `req.query` is not redacted when the `LOG_STYLE` is set to `raw`. If these logs are not properly sanitized or protected, an attacker with access to it can potentially gain administrative control, leading to unauthorized data access and manipulation. This impacts systems where the `LOG_STYLE` is set to `raw`. The `access_token` in the query could potentially be a long-lived static token. Users with impacted systems should rotate their static tokens if they were provided using query string. This vulnerability has been patched in release version 10.13.2 and subsequent releases as well. Users are advised to upgrade. There are no known workarounds for this vulnerability.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://github.com/directus/directus/security/advisories/GHSA-vw58-ph65-6rxp" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://registry.npmjs.org", + "cpes": [ + "cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*", + "cpe:2.3:a:rangerstudio:directus:*:*:*:*:*:node.js:*:*" + ], + "packageName": "directus", + "packageType": "npm", + "product": "directus", + "repo": "https://github.com/directus/directus", + "vendor": "directus", + "versions": [ + { + "lessThan": "10.13.2", + "status": "affected", + "version": "0", + "versionType": "custom" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-47948.json b/data/anchore/2024/CVE-2024-47948.json new file mode 100644 index 00000000..4650e545 --- /dev/null +++ b/data/anchore/2024/CVE-2024-47948.json @@ -0,0 +1,34 @@ +{ + "additionalMetadata": { + "cna": "jetbrains", + "cveId": "CVE-2024-47948", + "description": "In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://www.jetbrains.com/privacy-security/issues-fixed/" + ] + }, + "adp": { + "affected": [ + { + "cpes": [ + "cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*" + ], + "product": "TeamCity", + "vendor": "JetBrains", + "versions": [ + { + "lessThan": "2024.07.3", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-47949.json b/data/anchore/2024/CVE-2024-47949.json new file mode 100644 index 00000000..a6807cca --- /dev/null +++ b/data/anchore/2024/CVE-2024-47949.json @@ -0,0 +1,34 @@ +{ + "additionalMetadata": { + "cna": "jetbrains", + "cveId": "CVE-2024-47949", + "description": "In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://www.jetbrains.com/privacy-security/issues-fixed/" + ] + }, + "adp": { + "affected": [ + { + "cpes": [ + "cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*" + ], + "product": "TeamCity", + "vendor": "JetBrains", + "versions": [ + { + "lessThan": "2024.07.3", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-47950.json b/data/anchore/2024/CVE-2024-47950.json new file mode 100644 index 00000000..4aec756a --- /dev/null +++ b/data/anchore/2024/CVE-2024-47950.json @@ -0,0 +1,34 @@ +{ + "additionalMetadata": { + "cna": "jetbrains", + "cveId": "CVE-2024-47950", + "description": "In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://www.jetbrains.com/privacy-security/issues-fixed/" + ] + }, + "adp": { + "affected": [ + { + "cpes": [ + "cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*" + ], + "product": "TeamCity", + "vendor": "JetBrains", + "versions": [ + { + "lessThan": "2024.07.3", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-47951.json b/data/anchore/2024/CVE-2024-47951.json new file mode 100644 index 00000000..2c0d44d3 --- /dev/null +++ b/data/anchore/2024/CVE-2024-47951.json @@ -0,0 +1,34 @@ +{ + "additionalMetadata": { + "cna": "jetbrains", + "cveId": "CVE-2024-47951", + "description": "In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://www.jetbrains.com/privacy-security/issues-fixed/" + ] + }, + "adp": { + "affected": [ + { + "cpes": [ + "cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*" + ], + "product": "TeamCity", + "vendor": "JetBrains", + "versions": [ + { + "lessThan": "2024.07.3", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-8431.json b/data/anchore/2024/CVE-2024-8431.json new file mode 100644 index 00000000..8ea21a6e --- /dev/null +++ b/data/anchore/2024/CVE-2024-8431.json @@ -0,0 +1,39 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-8431", + "description": "The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajaxGetGalleryJson() function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve private post titles.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/browser/robo-gallery/tags/3.2.21/includes/extensions/block/src/init.php#L105", + "https://plugins.trac.wordpress.org/changeset/3162670/robo-gallery/trunk/includes/extensions/block/src/init.php", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/632c0a1a-6ac2-44c3-b66c-44fa4cf05b2d?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:robogallery:robo_gallery:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "robo-gallery", + "packageType": "wordpress-plugin", + "product": "Photo Gallery, Images, Slider in Rbs Image Gallery", + "vendor": "robosoft", + "versions": [ + { + "lessThan": "3.2.22", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-8433.json b/data/anchore/2024/CVE-2024-8433.json new file mode 100644 index 00000000..54101ba9 --- /dev/null +++ b/data/anchore/2024/CVE-2024-8433.json @@ -0,0 +1,40 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-8433", + "description": "The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘themehunk_megamenu_bg_image' parameter in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Please note that this was partially fixed in 1.1.0 due to the missing authorization protection that was added.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/browser/themehunk-megamenu-plus/tags/1.1.0/views/admin/item_settings.php?rev=3156084#L196", + "https://plugins.trac.wordpress.org/browser/themehunk-megamenu-plus/trunk/inc/megamenu-base.php#L35", + "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3163871%40themehunk-megamenu-plus&new=3163871%40themehunk-megamenu-plus&sfp_email=&sfph_mail=#file21", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/fc661cfd-6290-4b36-858a-cf2269b5fcf9?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:themehunk:easy_mega_menu_plugin:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "themehunk-megamenu-plus", + "packageType": "wordpress-plugin", + "product": "Easy Mega Menu Plugin for WordPress – ThemeHunk", + "vendor": "themehunk", + "versions": [ + { + "lessThan": "1.1.1", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-8482.json b/data/anchore/2024/CVE-2024-8482.json new file mode 100644 index 00000000..5952bf9e --- /dev/null +++ b/data/anchore/2024/CVE-2024-8482.json @@ -0,0 +1,39 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-8482", + "description": "The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.3.982 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/browser/royal-elementor-addons/tags/1.3.987/modules/team-member/widgets/wpr-team-member.php?rev=3162784", + "https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/modules/team-member/widgets/wpr-team-member.php#L1746", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/5ccece54-18fa-42e4-ba1a-d0879b73d66d?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:royal-elementor-addons:royal_elementor_addons:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "royal-elementor-addons", + "packageType": "wordpress-plugin", + "product": "Royal Elementor Addons and Templates", + "vendor": "wproyal", + "versions": [ + { + "lessThan": "1.3.987", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-8488.json b/data/anchore/2024/CVE-2024-8488.json new file mode 100644 index 00000000..39526c82 --- /dev/null +++ b/data/anchore/2024/CVE-2024-8488.json @@ -0,0 +1,39 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-8488", + "description": "The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Survey fields in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/changeset/3155029/survey-maker/tags/4.9.6/includes/class-survey-maker-data.php?old=3153722&old_path=survey-maker%2Ftags%2F4.9.5%2Fincludes%2Fclass-survey-maker-data.php", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e04edb6-ef37-4ea8-a734-dbdcf689ba9b?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:ays-pro:survey_maker:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "survey-maker", + "packageType": "wordpress-plugin", + "product": "Survey Maker", + "repo": "https://plugins.svn.wordpress.org/survey-maker", + "vendor": "ays-pro", + "versions": [ + { + "lessThan": "4.9.6", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-8629.json b/data/anchore/2024/CVE-2024-8629.json new file mode 100644 index 00000000..fe295d2c --- /dev/null +++ b/data/anchore/2024/CVE-2024-8629.json @@ -0,0 +1,39 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-8629", + "description": "The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.3.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/browser/woocommerce-multilingual/tags/5.3.7/inc/class-wcml-comments.php#L257", + "https://plugins.trac.wordpress.org/changeset/3164233/woocommerce-multilingual/trunk/inc/class-wcml-comments.php", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/494dc869-6f4d-428b-99a8-87212f3007be?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:onthegosystems:woocommerce_multilingual_\\&_multicurrency:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "woocommerce-multilingual", + "packageType": "wordpress-plugin", + "product": "WooCommerce Multilingual & Multicurrency with WPML", + "vendor": "amirhelzer", + "versions": [ + { + "lessThan": "5.3.8", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-8925.json b/data/anchore/2024/CVE-2024-8925.json new file mode 100644 index 00000000..24b58934 --- /dev/null +++ b/data/anchore/2024/CVE-2024-8925.json @@ -0,0 +1,46 @@ +{ + "additionalMetadata": { + "cna": "php", + "cveId": "CVE-2024-8925", + "description": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://github.com/php/php-src/security/advisories/GHSA-9pqp-7h25-4f32" + ] + }, + "adp": { + "affected": [ + { + "cpes": [ + "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*" + ], + "product": "PHP", + "vendor": "PHP Group", + "versions": [ + { + "lessThan": "8.1.30", + "status": "affected", + "version": "0", + "versionType": "semver" + }, + { + "lessThan": "8.2.24", + "status": "affected", + "version": "8.2", + "versionType": "semver" + }, + { + "lessThan": "8.3.12", + "status": "affected", + "version": "8.3", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-8926.json b/data/anchore/2024/CVE-2024-8926.json new file mode 100644 index 00000000..e5c61091 --- /dev/null +++ b/data/anchore/2024/CVE-2024-8926.json @@ -0,0 +1,49 @@ +{ + "additionalMetadata": { + "cna": "php", + "cveId": "CVE-2024-8926", + "description": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows \"Best Fit\" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://github.com/advisories/GHSA-vxpp-6299-mxw3" + ] + }, + "adp": { + "affected": [ + { + "cpes": [ + "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*" + ], + "platforms": [ + "Windows" + ], + "product": "PHP", + "vendor": "PHP Group", + "versions": [ + { + "lessThan": "8.1.30", + "status": "affected", + "version": "0", + "versionType": "semver" + }, + { + "lessThan": "8.2.24", + "status": "affected", + "version": "8.2", + "versionType": "semver" + }, + { + "lessThan": "8.3.12", + "status": "affected", + "version": "8.3", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-8927.json b/data/anchore/2024/CVE-2024-8927.json new file mode 100644 index 00000000..219f3b8f --- /dev/null +++ b/data/anchore/2024/CVE-2024-8927.json @@ -0,0 +1,46 @@ +{ + "additionalMetadata": { + "cna": "php", + "cveId": "CVE-2024-8927", + "description": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://github.com/php/php-src/security/advisories/GHSA-94p6-54jq-9mwp" + ] + }, + "adp": { + "affected": [ + { + "cpes": [ + "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*" + ], + "product": "PHP", + "vendor": "PHP Group", + "versions": [ + { + "lessThan": "8.1.30", + "status": "affected", + "version": "0", + "versionType": "semver" + }, + { + "lessThan": "8.2.24", + "status": "affected", + "version": "8.2", + "versionType": "semver" + }, + { + "lessThan": "8.3.12", + "status": "affected", + "version": "8.3", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-8964.json b/data/anchore/2024/CVE-2024-8964.json new file mode 100644 index 00000000..a8301312 --- /dev/null +++ b/data/anchore/2024/CVE-2024-8964.json @@ -0,0 +1,39 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-8964", + "description": "The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 7.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/changeset/3162079/", + "https://wordpress.org/plugins/sirv/#developers", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/39b2435f-32a3-4158-a734-c21a0cab15be?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:sirv:sirv:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "sirv", + "packageType": "wordpress-plugin", + "product": "Image Optimizer, Resizer and CDN – Sirv", + "vendor": "sirv", + "versions": [ + { + "lessThan": "7.3.0", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-9021.json b/data/anchore/2024/CVE-2024-9021.json new file mode 100644 index 00000000..54903496 --- /dev/null +++ b/data/anchore/2024/CVE-2024-9021.json @@ -0,0 +1,37 @@ +{ + "additionalMetadata": { + "cna": "wpscan", + "cveId": "CVE-2024-9021", + "description": "In the process of testing the Relevanssi WordPress plugin before 4.23.1, a vulnerability was found that allows you to implement Stored XSS on behalf of the Contributor+ by embedding malicious script, which entails account takeover backdoor", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://wpscan.com/vulnerability/5f25646d-b80b-40b1-bcaf-3b860ddc4059/" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:relevanssi:relevanssi:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "relevanssi", + "packageType": "wordpress-plugin", + "product": "Relevanssi", + "repo": "https://plugins.svn.wordpress.org/relevanssi", + "versions": [ + { + "lessThan": "4.23.1", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-9026.json b/data/anchore/2024/CVE-2024-9026.json new file mode 100644 index 00000000..0b3a524e --- /dev/null +++ b/data/anchore/2024/CVE-2024-9026.json @@ -0,0 +1,46 @@ +{ + "additionalMetadata": { + "cna": "php", + "cveId": "CVE-2024-9026", + "description": "In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://github.com/php/php-src/security/advisories/GHSA-865w-9rf3-2wh5" + ] + }, + "adp": { + "affected": [ + { + "cpes": [ + "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*" + ], + "product": "PHP", + "vendor": "PHP Group", + "versions": [ + { + "lessThan": "8.1.30", + "status": "affected", + "version": "0", + "versionType": "semver" + }, + { + "lessThan": "8.2.24", + "status": "affected", + "version": "8.2", + "versionType": "semver" + }, + { + "lessThan": "8.3.12", + "status": "affected", + "version": "8.3", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-9602.json b/data/anchore/2024/CVE-2024-9602.json new file mode 100644 index 00000000..64f2aa0c --- /dev/null +++ b/data/anchore/2024/CVE-2024-9602.json @@ -0,0 +1,35 @@ +{ + "additionalMetadata": { + "cna": "chrome", + "cveId": "CVE-2024-9602", + "description": "Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_8.html", + "https://issues.chromium.org/issues/368241697" + ] + }, + "adp": { + "affected": [ + { + "cpes": [ + "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*" + ], + "product": "Chrome", + "vendor": "Google", + "versions": [ + { + "lessThan": "129.0.6668.100", + "status": "affected", + "version": "0", + "versionType": "custom" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-9603.json b/data/anchore/2024/CVE-2024-9603.json new file mode 100644 index 00000000..db447e94 --- /dev/null +++ b/data/anchore/2024/CVE-2024-9603.json @@ -0,0 +1,35 @@ +{ + "additionalMetadata": { + "cna": "chrome", + "cveId": "CVE-2024-9603", + "description": "Type Confusion in V8 in Google Chrome prior to 129.0.6668.100 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_8.html", + "https://issues.chromium.org/issues/367818758" + ] + }, + "adp": { + "affected": [ + { + "cpes": [ + "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*" + ], + "product": "Chrome", + "vendor": "Google", + "versions": [ + { + "lessThan": "129.0.6668.100", + "status": "affected", + "version": "0", + "versionType": "custom" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file