diff --git a/data/anchore/2024/CVE-2024-10365.json b/data/anchore/2024/CVE-2024-10365.json new file mode 100644 index 00000000..87df86d8 --- /dev/null +++ b/data/anchore/2024/CVE-2024-10365.json @@ -0,0 +1,39 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-10365", + "description": "The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.3 via the render function in modules/widgets/tp_carousel_anything.php, modules/widgets/tp_page_scroll.php, and other widgets. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/changeset/3186482/the-plus-addons-for-elementor-page-builder", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/f7ce1d19-25fa-434d-943b-d10c5cb2ec51?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:posimyth:the_plus_addons_for_elementor:*:*:*:*:free:wordpress:*:*" + ], + "packageName": "the-plus-addons-for-elementor-page-builder", + "packageType": "wordpress-plugin", + "product": "The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce", + "repo": "https://plugins.svn.wordpress.org/the-plus-addons-for-elementor-page-builder", + "vendor": "posimyththemes", + "versions": [ + { + "lessThan": "6.0.4", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-10515.json b/data/anchore/2024/CVE-2024-10515.json new file mode 100644 index 00000000..dcc7a967 --- /dev/null +++ b/data/anchore/2024/CVE-2024-10515.json @@ -0,0 +1,41 @@ +{ + "additionalMetadata": { + "cna": "wpscan", + "cveId": "CVE-2024-10515", + "description": "In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://wpscan.com/vulnerability/367aad17-fbb5-48eb-8829-5d3513098d02/" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:squirrly:seo_plugin_by_squirrly_seo:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "squirrly-seo", + "packageType": "wordpress-plugin", + "product": "SEO Plugin by Squirrly SEO", + "versions": [ + { + "lessThan": "12.3.21", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + }, + "references": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f15ad88b-7dcb-4a36-877a-e7017d98d498?source=cve" + } + ] + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-10520.json b/data/anchore/2024/CVE-2024-10520.json new file mode 100644 index 00000000..8240af9a --- /dev/null +++ b/data/anchore/2024/CVE-2024-10520.json @@ -0,0 +1,38 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-10520", + "description": "The WP Project Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'check' method of the 'Create_Milestone', 'Create_Task_List', 'Create_Task', and 'Delete_Task' classes in version 2.6.14. This makes it possible for unauthenticated attackers to create milestones, create task lists, create tasks, or delete tasks in any project. NOTE: Version 2.6.14 implemented a partial fix for this vulnerability.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/changeset/3191204/wedevs-project-manager", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/497760a8-7d4a-45a0-91e4-a8ee27bcdb02?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:wedevs:wp_project_manager:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "wedevs-project-manager", + "packageType": "wordpress-plugin", + "product": "WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts", + "vendor": "wedevs", + "versions": [ + { + "lessThan": "2.6.15", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-10855.json b/data/anchore/2024/CVE-2024-10855.json new file mode 100644 index 00000000..83ba20d8 --- /dev/null +++ b/data/anchore/2024/CVE-2024-10855.json @@ -0,0 +1,39 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-10855", + "description": "The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validation on the filename parameter of the sirv_upload_file_by_chunks() function and lack of in all versions up to, and including, 7.3.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/browser/sirv/tags/7.2.8/sirv.php#L4691", + "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3186406%40sirv&new=3186406%40sirv&sfp_email=&sfph_mail=", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ec09e5-4994-4d23-bf8e-26b64d5303fa?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:sirv:sirv:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "sirv", + "packageType": "wordpress-plugin", + "product": "Image Optimizer, Resizer and CDN – Sirv", + "vendor": "sirv", + "versions": [ + { + "lessThan": "7.3.1", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-10872.json b/data/anchore/2024/CVE-2024-10872.json new file mode 100644 index 00000000..13567889 --- /dev/null +++ b/data/anchore/2024/CVE-2024-10872.json @@ -0,0 +1,40 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-10872", + "description": "The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `template-post-custom-field` block in all versions up to, and including, 2.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/browser/getwid/trunk/includes/templates/template-parts/post-custom-field.php#L9", + "https://plugins.trac.wordpress.org/changeset/3188812#file1", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/8ae0030f-af21-43fb-959a-8da04cab05bb?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:motopress:getwid_-_gutenberg_blocks:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "getwid", + "packageType": "wordpress-plugin", + "product": "Getwid – Gutenberg Blocks", + "repo": "https://plugins.svn.wordpress.org/getwid", + "vendor": "jetmonsters", + "versions": [ + { + "lessThan": "2.0.13", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-10891.json b/data/anchore/2024/CVE-2024-10891.json new file mode 100644 index 00000000..6879d20a --- /dev/null +++ b/data/anchore/2024/CVE-2024-10891.json @@ -0,0 +1,38 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-10891", + "description": "The Save as PDF Plugin by Pdfcrowd plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'save_as_pdf_pdfcrowd' shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/browser/save-as-pdf-by-pdfcrowd/trunk/public/class-save-as-pdf-pdfcrowd-public.php#L586", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/3763d893-83a0-4b6a-9c21-34a69313d555?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:pdfcrowd:save_as_pdf:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "save-as-pdf-by-pdfcrowd", + "packageType": "wordpress-plugin", + "product": "Save as PDF Plugin by Pdfcrowd", + "vendor": "pdfcrowd", + "versions": [ + { + "lessThan": "4.2.2", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-10899.json b/data/anchore/2024/CVE-2024-10899.json new file mode 100644 index 00000000..eac6bedf --- /dev/null +++ b/data/anchore/2024/CVE-2024-10899.json @@ -0,0 +1,39 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-10899", + "description": "The The WooCommerce Product Table Lite plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. The same 'id' parameter is vulnerable to Reflected Cross-Site Scripting as well.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/browser/wc-product-table-lite/tags/3.8.6/main.php#L1778", + "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3190789%40wc-product-table-lite&new=3190789%40wc-product-table-lite&sfp_email=&sfph_mail=", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/c9b010ff-8a4a-4553-bb2b-d58a254d7ee4?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:wcproducttable:woocommerce_product_table_lite:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "wc-product-table-lite", + "packageType": "wordpress-plugin", + "product": "WooCommerce Product Table Lite", + "vendor": "wcproducttable", + "versions": [ + { + "lessThan": "3.8.7", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-10900.json b/data/anchore/2024/CVE-2024-10900.json new file mode 100644 index 00000000..80ced66a --- /dev/null +++ b/data/anchore/2024/CVE-2024-10900.json @@ -0,0 +1,40 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-10900", + "description": "The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pm_remove_file_attachment() function in all versions up to, and including, 5.9.3.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary user meta which can do things like deny an administrator's access to their site. .", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/trunk/admin/class-profile-magic-admin.php#L1902", + "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3190069%40profilegrid-user-profiles-groups-and-communities&new=3190069%40profilegrid-user-profiles-groups-and-communities&sfp_email=&sfph_mail=", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/a0e5fcfa-ebc9-45f6-9cbc-c9e3540baa6f?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:metagauss:profilegrid:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "profilegrid-user-profiles-groups-and-communities", + "packageType": "wordpress-plugin", + "product": "ProfileGrid – User Profiles, Groups and Communities", + "repo": "https://plugins.svn.wordpress.org/profilegrid-user-profiles-groups-and-communities", + "vendor": "metagauss", + "versions": [ + { + "lessThan": "5.9.3.7", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-10913.json b/data/anchore/2024/CVE-2024-10913.json new file mode 100644 index 00000000..0e81cf50 --- /dev/null +++ b/data/anchore/2024/CVE-2024-10913.json @@ -0,0 +1,40 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-10913", + "description": "The Clone plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.4.6 via deserialization of untrusted input in the 'recursive_unserialized_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/browser/wp-clone-by-wp-academy//tags/2.4.6/lib/icit_srdb_replacer.php#L24", + "https://plugins.trac.wordpress.org/browser/wp-clone-by-wp-academy/tags/2.4.7/lib/icit_srdb_replacer.php#L24", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/16569267-ab52-4b96-86f0-d37c470a3938?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:backupbliss:clone:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "wp-clone-by-wp-academy", + "packageType": "wordpress-plugin", + "product": "Clone", + "repo": "https://plugins.svn.wordpress.org/wp-clone-by-wp-academy", + "vendor": "migrate", + "versions": [ + { + "lessThan": "2.4.7", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-11179.json b/data/anchore/2024/CVE-2024-11179.json new file mode 100644 index 00000000..cdd5542c --- /dev/null +++ b/data/anchore/2024/CVE-2024-11179.json @@ -0,0 +1,40 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-11179", + "description": "The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' parameter in all versions up to, and including, 4.15.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/browser/mstore-api/tags/4.15.5/controllers/helpers/vendor-admin-wcfm-helper.php#L803", + "https://plugins.trac.wordpress.org/changeset/3190678/mstore-api/trunk/controllers/helpers/vendor-admin-wcfm-helper.php", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/b308bddf-a153-4d5b-936f-2170a1a494a5?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:inspireui:mstore_api:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "mstore-api", + "packageType": "wordpress-plugin", + "product": "MStore API – Create Native Android & iOS Apps On The Cloud", + "repo": "https://plugins.svn.wordpress.org/mstore-api", + "vendor": "inspireui", + "versions": [ + { + "lessThan": "4.15.8", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-11277.json b/data/anchore/2024/CVE-2024-11277.json new file mode 100644 index 00000000..937d76a7 --- /dev/null +++ b/data/anchore/2024/CVE-2024-11277.json @@ -0,0 +1,38 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-11277", + "description": "The 404 Solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URLs in all versions up to, and including, 2.35.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3191597%40404-solution&new=3191597%40404-solution&sfp_email=&sfph_mail=", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/259f9ea3-ac24-4bea-8d0d-c635a68d9c98?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:ajexperience:404_solution:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "404-solution", + "packageType": "wordpress-plugin", + "product": "404 Solution", + "vendor": "aaron13100", + "versions": [ + { + "lessThan": "2.35.20", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-11278.json b/data/anchore/2024/CVE-2024-11278.json new file mode 100644 index 00000000..f15f0b8c --- /dev/null +++ b/data/anchore/2024/CVE-2024-11278.json @@ -0,0 +1,39 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-11278", + "description": "The GD bbPress Attachments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 4.7.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/browser/gd-bbpress-attachments/trunk/code/front.php#L280", + "https://plugins.trac.wordpress.org/changeset/3189863/gd-bbpress-attachments/trunk/code/front.php", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/6f598cfc-4d41-4d22-95f0-47efdb7d07a2?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:dev4press:gd_bbpress_attachments:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "gd-bbpress-attachments", + "packageType": "wordpress-plugin", + "product": "GD bbPress Attachments", + "vendor": "gdragon", + "versions": [ + { + "lessThan": "4.7.3", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-23604.json b/data/anchore/2024/CVE-2024-23604.json new file mode 100644 index 00000000..4dde9df1 --- /dev/null +++ b/data/anchore/2024/CVE-2024-23604.json @@ -0,0 +1,42 @@ +{ + "additionalMetadata": { + "cna": "jpcert", + "cveId": "CVE-2024-23604", + "description": "Cross-site scripting vulnerability exists in FitNesse all releases, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with specially crafted multiple parameters.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "http://fitnesse.org/FitNesseDownload", + "https://github.com/unclebob/fitnesse", + "https://github.com/unclebob/fitnesse/blob/master/SECURITY.md", + "https://jvn.jp/en/jp/JVN94521208/" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://repo.maven.apache.org/maven2", + "cpes": [ + "cpe:2.3:a:cleancoder:fitnesse:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:org.fitnesse:fitnesse:*:*:*:*:*:maven:*:*" + ], + "packageName": "org.fitnesse:fitnesse", + "packageType": "maven", + "product": "FitNesse", + "repo": "https://github.com/unclebob/fitnesse", + "vendor": "unclebob", + "versions": [ + { + "lessThanOrEqual": "*", + "status": "affected", + "version": "0", + "versionType": "maven" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-28039.json b/data/anchore/2024/CVE-2024-28039.json new file mode 100644 index 00000000..06475d6b --- /dev/null +++ b/data/anchore/2024/CVE-2024-28039.json @@ -0,0 +1,42 @@ +{ + "additionalMetadata": { + "cna": "jpcert", + "cveId": "CVE-2024-28039", + "description": "Improper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated attacker to obtain sensitive information, alter data, or cause a denial-of-service (DoS) condition.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "http://fitnesse.org/FitNesseDownload", + "https://github.com/unclebob/fitnesse", + "https://github.com/unclebob/fitnesse/blob/master/SECURITY.md", + "https://jvn.jp/en/jp/JVN94521208/" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://repo.maven.apache.org/maven2", + "cpes": [ + "cpe:2.3:a:cleancoder:fitnesse:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:org.fitnesse:fitnesse:*:*:*:*:*:maven:*:*" + ], + "packageName": "org.fitnesse:fitnesse", + "packageType": "maven", + "product": "FitNesse", + "repo": "https://github.com/unclebob/fitnesse", + "vendor": "unclebob", + "versions": [ + { + "lessThanOrEqual": "*", + "status": "affected", + "version": "0", + "versionType": "maven" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-28125.json b/data/anchore/2024/CVE-2024-28125.json new file mode 100644 index 00000000..2f97cba0 --- /dev/null +++ b/data/anchore/2024/CVE-2024-28125.json @@ -0,0 +1,43 @@ +{ + "additionalMetadata": { + "cna": "jpcert", + "cveId": "CVE-2024-28125", + "description": "FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further investigation.", + "disputed": true, + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "http://fitnesse.org/FitNesseDownload", + "https://github.com/unclebob/fitnesse", + "https://github.com/unclebob/fitnesse/blob/master/SECURITY.md", + "https://jvn.jp/en/jp/JVN94521208/" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://repo.maven.apache.org/maven2", + "cpes": [ + "cpe:2.3:a:cleancoder:fitnesse:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:org.fitnesse:fitnesse:*:*:*:*:*:maven:*:*" + ], + "packageName": "org.fitnesse:fitnesse", + "packageType": "maven", + "product": "FitNesse", + "repo": "https://github.com/unclebob/fitnesse", + "vendor": "unclebob", + "versions": [ + { + "lessThanOrEqual": "*", + "status": "affected", + "version": "0", + "versionType": "maven" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-28128.json b/data/anchore/2024/CVE-2024-28128.json new file mode 100644 index 00000000..f5068168 --- /dev/null +++ b/data/anchore/2024/CVE-2024-28128.json @@ -0,0 +1,42 @@ +{ + "additionalMetadata": { + "cna": "jpcert", + "cveId": "CVE-2024-28128", + "description": "Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execute an arbitrary script on the web browser of the user who is using the product and accessing a link with a specially crafted certain parameter.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "http://fitnesse.org/FitNesseDownload", + "https://github.com/unclebob/fitnesse", + "https://github.com/unclebob/fitnesse/blob/master/SECURITY.md", + "https://jvn.jp/en/jp/JVN94521208/" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://repo.maven.apache.org/maven2", + "cpes": [ + "cpe:2.3:a:cleancoder:fitnesse:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:org.fitnesse:fitnesse:*:*:*:*:*:maven:*:*" + ], + "packageName": "org.fitnesse:fitnesse", + "packageType": "maven", + "product": "FitNesse", + "repo": "https://github.com/unclebob/fitnesse", + "vendor": "unclebob", + "versions": [ + { + "lessThan": "20220319", + "status": "affected", + "version": "0", + "versionType": "maven" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-29913.json b/data/anchore/2024/CVE-2024-29913.json new file mode 100644 index 00000000..3b408ae8 --- /dev/null +++ b/data/anchore/2024/CVE-2024-29913.json @@ -0,0 +1,46 @@ +{ + "additionalMetadata": { + "cna": "patchstack", + "cveId": "CVE-2024-29913", + "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons allows Stored XSS.This issue affects Tutor LMS Elementor Addons: from n/a through 2.1.3.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://patchstack.com/database/vulnerability/tutor-lms-elementor-addons/wordpress-tutor-lms-elementor-addons-plugin-2-1-3-cross-site-scripting-xss-vulnerability?_s_id=cve" + ], + "solutions": [ + "Update to 2.1.4 or a higher version." + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:themeum:tutor_lms_elementor_addons:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "tutor-lms-elementor-addons", + "packageType": "wordpress-plugin", + "product": "Tutor LMS Elementor Addons", + "repo": "https://plugins.svn.wordpress.org/tutor-lms-elementor-addons", + "vendor": "Themeum", + "versions": [ + { + "lessThan": "2.1.4", + "status": "affected", + "version": "0", + "versionType": "custom" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + }, + "references": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/959ce050-bafc-4d17-93bd-a9b09b4b4baa?source=cve" + } + ] + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-42499.json b/data/anchore/2024/CVE-2024-42499.json new file mode 100644 index 00000000..9aa2b250 --- /dev/null +++ b/data/anchore/2024/CVE-2024-42499.json @@ -0,0 +1,41 @@ +{ + "additionalMetadata": { + "cna": "jpcert", + "cveId": "CVE-2024-42499", + "description": "Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an attacker may be able to know whether a file exists at a specific path, and/or obtain some part of the file contents under specific conditions.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://fitnesse.org/FitNesseDownload", + "https://github.com/unclebob/fitnesse/releases/tag/20241026", + "https://jvn.jp/en/jp/JVN36791327/" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://repo.maven.apache.org/maven2", + "cpes": [ + "cpe:2.3:a:cleancoder:fitnesse:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:org.fitnesse:fitnesse:*:*:*:*:*:maven:*:*" + ], + "packageName": "org.fitnesse:fitnesse", + "packageType": "maven", + "product": "FitNesse", + "repo": "https://github.com/unclebob/fitnesse", + "vendor": "unclebob", + "versions": [ + { + "lessThan": "20241026", + "status": "affected", + "version": "0", + "versionType": "maven" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-52442.json b/data/anchore/2024/CVE-2024-52442.json new file mode 100644 index 00000000..41a65463 --- /dev/null +++ b/data/anchore/2024/CVE-2024-52442.json @@ -0,0 +1,38 @@ +{ + "additionalMetadata": { + "cna": "patchstack", + "cveId": "CVE-2024-52442", + "description": "Incorrect Privilege Assignment vulnerability in Userplus UserPlus allows Privilege Escalation.This issue affects UserPlus: from n/a through 2.0.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://patchstack.com/database/vulnerability/userplus/wordpress-userplus-plugin-2-0-privilege-escalation-vulnerability?_s_id=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:wpuserplus:userplus:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "userplus", + "packageType": "wordpress-plugin", + "product": "UserPlus", + "repo": "https://plugins.svn.wordpress.org/userplus", + "vendor": "Userplus", + "versions": [ + { + "lessThanOrEqual": "2.0", + "status": "affected", + "version": "0", + "versionType": "custom" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-52471.json b/data/anchore/2024/CVE-2024-52471.json new file mode 100644 index 00000000..7e7844af --- /dev/null +++ b/data/anchore/2024/CVE-2024-52471.json @@ -0,0 +1,38 @@ +{ + "additionalMetadata": { + "cna": "patchstack", + "cveId": "CVE-2024-52471", + "description": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in petesheppard84 Extensions for Elementor allows Reflected XSS.This issue affects Extensions for Elementor: from n/a through 2.0.37.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://patchstack.com/database/vulnerability/extensions-for-elementor/wordpress-extensions-for-elementor-plugin-2-0-37-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:idioweb:extensions_for_elementor:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "extensions-for-elementor", + "packageType": "wordpress-plugin", + "product": "Extensions for Elementor", + "repo": "https://plugins.svn.wordpress.org/extensions-for-elementor", + "vendor": "petesheppard84", + "versions": [ + { + "lessThanOrEqual": "2.0.37", + "status": "affected", + "version": "0", + "versionType": "custom" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-52597.json b/data/anchore/2024/CVE-2024-52597.json new file mode 100644 index 00000000..ea531adc --- /dev/null +++ b/data/anchore/2024/CVE-2024-52597.json @@ -0,0 +1,38 @@ +{ + "additionalMetadata": { + "cna": "github_m", + "cveId": "CVE-2024-52597", + "description": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers in direct access to uploaded SVGs. The application allows uploading images in several places. One of the accepted types of image is SVG, which allows JS scripting. Therefore, by uploading a malicious SVG which contains JS code, an attacker which is able to drive a victim to the uploaded image could compromise that victim's session and access to their tokens. Version 5.4.1 contains a patch for the issue.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://github.com/Bubka/2FAuth/commit/93c508e118f483f3c93ac36e1f91face95af642d", + "https://github.com/Bubka/2FAuth/security/advisories/GHSA-q5p4-6q4v-gqg3" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://github.com", + "cpes": [ + "cpe:2.3:a:2fauth:2fauth:*:*:*:*:*:*:*:*" + ], + "packageName": "bubka/2fauth", + "product": "2FAuth", + "repo": "https://github.com/bubka/2fauth", + "vendor": "Bubka", + "versions": [ + { + "lessThan": "5.4.1", + "status": "affected", + "version": "0", + "versionType": "custom" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-52598.json b/data/anchore/2024/CVE-2024-52598.json new file mode 100644 index 00000000..f428b70e --- /dev/null +++ b/data/anchore/2024/CVE-2024-52598.json @@ -0,0 +1,37 @@ +{ + "additionalMetadata": { + "cna": "github_m", + "cveId": "CVE-2024-52598", + "description": "2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Two interconnected vulnerabilities exist in version 5.4.1 a SSRF and URI validation bypass issue. The endpoint at POST /api/v1/twofaccounts/preview allows setting a remote URI to retrieve the image of a 2fa site. By abusing this functionality, it is possible to force the application to make a GET request to an arbitrary URL, whose content will be stored in an image file in the server if it looks like an image. Additionally, the library does some basic validation on the URI, attempting to filter our URIs which do not have an image extension. However, this can be easily bypassed by appending the string `#.svg` to the URI. The combination of these two issues allows an attacker to retrieve URIs accessible from the application, as long as their content type is text based. If not, the request is still sent, but the response is not reflected to the attacker. Version 5.4.1 fixes the issues.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://github.com/Bubka/2FAuth/security/advisories/GHSA-xwxc-w7v3-2p4j" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://github.com", + "cpes": [ + "cpe:2.3:a:2fauth:2fauth:*:*:*:*:*:*:*:*" + ], + "packageName": "bubka/2fauth", + "product": "2FAuth", + "repo": "https://github.com/bubka/2fauth", + "vendor": "Bubka", + "versions": [ + { + "lessThan": "5.4.1", + "status": "affected", + "version": "0", + "versionType": "custom" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-5576.json b/data/anchore/2024/CVE-2024-5576.json new file mode 100644 index 00000000..1dd8bb59 --- /dev/null +++ b/data/anchore/2024/CVE-2024-5576.json @@ -0,0 +1,43 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-5576", + "description": "The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'course_carousel_skin' attribute within the plugin's Course Carousel widget in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/browser/tutor-lms-elementor-addons/tags/2.1.4/templates/course/course-carousel.php#L81", + "https://plugins.trac.wordpress.org/changeset/3136459/", + "https://plugins.trac.wordpress.org/changeset/3136459/#file13", + "https://plugins.trac.wordpress.org/changeset/3136459/#file9", + "https://wordpress.org/plugins/tutor-lms-elementor-addons/#developers", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/7fdd1b1c-84b5-451a-a921-80be3b154398?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:themeum:tutor_lms_elementor_addons:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "tutor-lms-elementor-addons", + "packageType": "wordpress-plugin", + "product": "Tutor LMS Elementor Addons", + "repo": "https://plugins.svn.wordpress.org/tutor-lms-elementor-addons", + "vendor": "themeum", + "versions": [ + { + "lessThan": "2.1.5", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-8726.json b/data/anchore/2024/CVE-2024-8726.json new file mode 100644 index 00000000..96038a2f --- /dev/null +++ b/data/anchore/2024/CVE-2024-8726.json @@ -0,0 +1,39 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-8726", + "description": "The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3189361%40mailchimp-forms-by-mailmunch&new=3189361%40mailchimp-forms-by-mailmunch&sfp_email=&sfph_mail=", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/a1a1c5e7-75a4-4ca5-9707-4076b92e0c33?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:mailmunch:mailchimp_forms:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "mailchimp-forms-by-mailmunch", + "packageType": "wordpress-plugin", + "product": "MailChimp Forms by MailMunch", + "repo": "https://plugins.svn.wordpress.org/mailchimp-forms-by-mailmunch", + "vendor": "mailmunch", + "versions": [ + { + "lessThan": "3.2.4", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-9192.json b/data/anchore/2024/CVE-2024-9192.json new file mode 100644 index 00000000..e415567a --- /dev/null +++ b/data/anchore/2024/CVE-2024-9192.json @@ -0,0 +1,37 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-9192", + "description": "The WordPress Video Robot - The Ultimate Video Importer plugin for WordPress is vulnerable to privilege escalation due to insufficient validation on user meta that can be updated in the wpvr_rate_request_result() function in all versions up to, and including, 1.20.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update their user meta on a WordPress site. This can be leveraged to update their capabilities to that of an administrator.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://codecanyon.net/item/wordpress-video-robot-plugin/8619739", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/2da019d3-4aca-485a-aa0c-73728dc1e7c1?source=cve" + ] + }, + "adp": { + "affected": [ + { + "cpes": [ + "cpe:2.3:a:pressaholic:wordpress_video_robot:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "wp-video-robot", + "packageType": "wordpress-plugin", + "product": "WordPress Video Robot - The Ultimate Video Importer", + "vendor": "pressaholic", + "versions": [ + { + "lessThanOrEqual": "1.20.0", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-9239.json b/data/anchore/2024/CVE-2024-9239.json new file mode 100644 index 00000000..c72f4754 --- /dev/null +++ b/data/anchore/2024/CVE-2024-9239.json @@ -0,0 +1,41 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-9239", + "description": "The Booster for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 7.2.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/tags/7.2.3/includes/settings/wcj-settings-pdf-invoicing-advanced.php#L53", + "https://plugins.trac.wordpress.org/browser/woocommerce-jetpack/tags/7.2.3/includes/tools/class-wcj-order-statuses-tool.php#L319", + "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3187178%40woocommerce-jetpack&new=3187178%40woocommerce-jetpack&sfp_email=&sfph_mail=#file5", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/c4665b87-e1f8-4a73-b6d6-1d5c14067b3a?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:booster:booster_for_woocommerce:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "woocommerce-jetpack", + "packageType": "wordpress-plugin", + "product": "Booster for WooCommerce", + "repo": "https://plugins.svn.wordpress.org/woocommerce-jetpack", + "vendor": "pluggabl", + "versions": [ + { + "lessThan": "7.2.4", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file diff --git a/data/anchore/2024/CVE-2024-9653.json b/data/anchore/2024/CVE-2024-9653.json new file mode 100644 index 00000000..ca3c8366 --- /dev/null +++ b/data/anchore/2024/CVE-2024-9653.json @@ -0,0 +1,39 @@ +{ + "additionalMetadata": { + "cna": "wordfence", + "cveId": "CVE-2024-9653", + "description": "The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.", + "reason": "Added CPE configurations because not yet analyzed by NVD.", + "references": [ + "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3186456%40menu-ordering-reservations&new=3186456%40menu-ordering-reservations&sfp_email=&sfph_mail=", + "https://www.wordfence.com/threat-intel/vulnerabilities/id/11ccafd9-dad5-4b7d-b913-7821dd52d12b?source=cve" + ] + }, + "adp": { + "affected": [ + { + "collectionURL": "https://wordpress.org/plugins", + "cpes": [ + "cpe:2.3:a:oracle:restaurant_menu_-_food_ordering_system_-_table_reservation:*:*:*:*:*:wordpress:*:*" + ], + "packageName": "menu-ordering-reservations", + "packageType": "wordpress-plugin", + "product": "Restaurant Menu – Food Ordering System – Table Reservation", + "repo": "https://plugins.svn.wordpress.org/menu-ordering-reservations", + "vendor": "gloriafood", + "versions": [ + { + "lessThan": "2.4.3", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ] + } + ], + "providerMetadata": { + "orgId": "00000000-0000-4000-8000-000000000000", + "shortName": "anchoreadp" + } + } +} \ No newline at end of file