generated content from 2024-08-25

oasis-open · Aug 25, 2024 · 357f9d1 · 357f9d1
1 parent 2facfa4
commit 357f9d1
Show file tree

Hide file tree

Showing 30 changed files with 667 additions and 0 deletions.
diff --git a/mapping.csv b/mapping.csv
@@ -247436,3 +247436,32 @@ vulnerability,CVE-2024-45187,vulnerability--2bdbaf12-7c81-4706-98da-6763ea6030a1
 vulnerability,CVE-2024-45190,vulnerability--bcf32aa0-4d5f-40a7-9422-779b19841b81
 vulnerability,CVE-2024-6715,vulnerability--0e701bdb-1ccc-4385-9780-36aa203b54ae
 vulnerability,CVE-2024-32501,vulnerability--fd443a2c-6b80-4d2a-a6b6-351561ac563a
+vulnerability,CVE-2022-43915,vulnerability--c7ef88e8-a1c8-4af4-8101-1319b771993f
+vulnerability,CVE-2024-2254,vulnerability--55a69c29-c609-40a6-91ec-dbad5dea7ced
+vulnerability,CVE-2024-7351,vulnerability--d633dd9b-41bc-4e2e-972c-509d0b308a99
+vulnerability,CVE-2024-7568,vulnerability--16281911-107d-455c-af13-16afe23bced6
+vulnerability,CVE-2024-7656,vulnerability--59f28ce9-a240-4854-8aa7-335814a883cb
+vulnerability,CVE-2024-8135,vulnerability--02bd7e1f-96f9-437f-a9d5-1e0c8d02dde9
+vulnerability,CVE-2024-8134,vulnerability--075d83a5-fa9a-4cc5-8f14-f1fb5469ee20
+vulnerability,CVE-2024-8128,vulnerability--2d52c2f0-6cd7-4629-af48-cc0db6904ae7
+vulnerability,CVE-2024-8132,vulnerability--d1352c57-267e-4bce-9cbf-a44a1b38af77
+vulnerability,CVE-2024-8127,vulnerability--44612181-11d1-44fe-9331-1f8b531b2af2
+vulnerability,CVE-2024-8131,vulnerability--0b0df6a8-746f-4b9c-8b16-35ebb76c2f0f
+vulnerability,CVE-2024-8129,vulnerability--e77e48a3-b509-4cea-b1a6-8187c1653c40
+vulnerability,CVE-2024-8130,vulnerability--9e0c12ce-4645-446f-bd77-eed107214d4e
+vulnerability,CVE-2024-8137,vulnerability--d8cd6ddb-cc3d-41a9-880a-ae4ab53b291e
+vulnerability,CVE-2024-8138,vulnerability--f5593cc3-966a-4b15-9f00-99b0e0a6890e
+vulnerability,CVE-2024-8136,vulnerability--662fe2fd-ddf2-435c-8f3f-f121c12480d7
+vulnerability,CVE-2024-8120,vulnerability--21040cf4-da18-47c6-ac59-249115c38a94
+vulnerability,CVE-2024-8133,vulnerability--cd295fa0-1a28-4412-b9f4-edbaf42dcd58
+vulnerability,CVE-2024-45235,vulnerability--efd7e04c-029f-4794-aeb9-9f2774479ef6
+vulnerability,CVE-2024-45234,vulnerability--f7b71aa6-46d5-408f-a6fd-46bddf3e2d36
+vulnerability,CVE-2024-45240,vulnerability--4e767584-bc3f-436f-935e-0bb4d537ed43
+vulnerability,CVE-2024-45237,vulnerability--5c1f31f6-6037-48d1-b0ac-165f0d956a76
+vulnerability,CVE-2024-45238,vulnerability--071a51b7-6966-45da-a24e-9c988c34a377
+vulnerability,CVE-2024-45239,vulnerability--d5851fda-5267-4d88-8bcf-6eb28f028d68
+vulnerability,CVE-2024-45236,vulnerability--9c369cea-eddd-4092-af5b-9931b6afe9b8
+vulnerability,CVE-2024-6499,vulnerability--cf10b0d2-27b0-44a7-99ce-c255c127013d
+vulnerability,CVE-2024-6631,vulnerability--b6f3e662-f461-4aa8-9e6b-181a09e68934
+vulnerability,CVE-2023-0926,vulnerability--4fe50500-c200-4e73-bd72-b959f46c9d62
+vulnerability,CVE-2023-6987,vulnerability--544bd829-700f-4f1b-8727-0a112bb4f390
diff --git a/objects/vulnerability/vulnerability--02bd7e1f-96f9-437f-a9d5-1e0c8d02dde9.json b/objects/vulnerability/vulnerability--02bd7e1f-96f9-437f-a9d5-1e0c8d02dde9.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--c2c9bb48-0e7e-40c7-acaf-92fecdd281a2",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--02bd7e1f-96f9-437f-a9d5-1e0c8d02dde9",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-25T00:20:48.802661Z",
+            "modified": "2024-08-25T00:20:48.802661Z",
+            "name": "CVE-2024-8135",
+            "description": "A vulnerability classified as critical has been found in Go-Tribe gotribe up to cd3ccd32cd77852c9ea73f986eaf8c301cfb6310. Affected is the function Sign of the file pkg/token/token.go. The manipulation of the argument config.key leads to hard-coded credentials. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 4fb9b9e80a2beedd09d9fde4b9cf5bd510baf18f. It is recommended to apply a patch to fix this issue.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8135"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--071a51b7-6966-45da-a24e-9c988c34a377.json b/objects/vulnerability/vulnerability--071a51b7-6966-45da-a24e-9c988c34a377.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--1c6cd07b-9ba7-435d-89cf-ab73e043fcb3",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--071a51b7-6966-45da-a24e-9c988c34a377",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-25T00:20:48.900887Z",
+            "modified": "2024-08-25T00:20:48.900887Z",
+            "name": "CVE-2024-45238",
+            "description": "An issue was discovered in Fort before 1.6.3. A malicious RPKI repository that descends from a (trusted) Trust Anchor can serve (via rsync or RRDP) a resource certificate containing a bit string that doesn't properly decode into a Subject Public Key. OpenSSL does not report this problem during parsing, and when compiled with OpenSSL libcrypto versions below 3, Fort recklessly dereferences the pointer. Because Fort is an RPKI Relying Party, a crash can lead to Route Origin Validation unavailability, which can lead to compromised routing.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-45238"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--075d83a5-fa9a-4cc5-8f14-f1fb5469ee20.json b/objects/vulnerability/vulnerability--075d83a5-fa9a-4cc5-8f14-f1fb5469ee20.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--3a7e8f2b-2657-41bd-a165-81618306637f",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--075d83a5-fa9a-4cc5-8f14-f1fb5469ee20",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-25T00:20:48.804437Z",
+            "modified": "2024-08-25T00:20:48.804437Z",
+            "name": "CVE-2024-8134",
+            "description": "** UNSUPPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been rated as critical. This issue affects the function cgi_FMT_Std2R5_1st_DiskMGR of the file /cgi-bin/hd_config.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_source_dev leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8134"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--0b0df6a8-746f-4b9c-8b16-35ebb76c2f0f.json b/objects/vulnerability/vulnerability--0b0df6a8-746f-4b9c-8b16-35ebb76c2f0f.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--5162ee3e-e851-4ea5-82d6-43f339a80a1e",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0b0df6a8-746f-4b9c-8b16-35ebb76c2f0f",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-25T00:20:48.810794Z",
+            "modified": "2024-08-25T00:20:48.810794Z",
+            "name": "CVE-2024-8131",
+            "description": "** UNSUPPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as critical. Affected by this issue is the function module_enable_disable of the file /cgi-bin/apkg_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument f_module_name leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8131"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--16281911-107d-455c-af13-16afe23bced6.json b/objects/vulnerability/vulnerability--16281911-107d-455c-af13-16afe23bced6.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b4172487-1e85-4a15-a36a-a064f3099a1f",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--16281911-107d-455c-af13-16afe23bced6",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-25T00:20:47.913874Z",
+            "modified": "2024-08-25T00:20:47.913874Z",
+            "name": "CVE-2024-7568",
+            "description": "The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the output_sub_admin_page_0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on the server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The plugin author deleted the functionality of the plugin to patch this issue and close the plugin, we recommend seeking an alternative to this plugin.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-7568"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--21040cf4-da18-47c6-ac59-249115c38a94.json b/objects/vulnerability/vulnerability--21040cf4-da18-47c6-ac59-249115c38a94.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--e8310d4f-471f-42f5-a295-974e6bd1c058",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--21040cf4-da18-47c6-ac59-249115c38a94",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-25T00:20:48.820224Z",
+            "modified": "2024-08-25T00:20:48.820224Z",
+            "name": "CVE-2024-8120",
+            "description": "The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.14. This is due to missing or incorrect nonce validation on several functions in the class/class-image-otimizer.php file. This makes it possible for unauthenticated attackers to update plugin settings along with performing other actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8120"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--2d52c2f0-6cd7-4629-af48-cc0db6904ae7.json b/objects/vulnerability/vulnerability--2d52c2f0-6cd7-4629-af48-cc0db6904ae7.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--c55e598d-049e-4bd4-9572-b0f59f4afa71",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--2d52c2f0-6cd7-4629-af48-cc0db6904ae7",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-25T00:20:48.805993Z",
+            "modified": "2024-08-25T00:20:48.805993Z",
+            "name": "CVE-2024-8128",
+            "description": "** UNSUPPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This issue affects the function cgi_add_zip of the file /cgi-bin/webfile_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument path leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8128"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--44612181-11d1-44fe-9331-1f8b531b2af2.json b/objects/vulnerability/vulnerability--44612181-11d1-44fe-9331-1f8b531b2af2.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--0aa88790-9ab9-4e34-9920-21f43a3df60f",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--44612181-11d1-44fe-9331-1f8b531b2af2",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-25T00:20:48.808724Z",
+            "modified": "2024-08-25T00:20:48.808724Z",
+            "name": "CVE-2024-8127",
+            "description": "** UNSUPPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This vulnerability affects the function cgi_unzip of the file /cgi-bin/webfile_mgr.cgi of the component HTTP POST Request Handler. The manipulation of the argument path leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8127"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--4e767584-bc3f-436f-935e-0bb4d537ed43.json b/objects/vulnerability/vulnerability--4e767584-bc3f-436f-935e-0bb4d537ed43.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--e78fd0a3-31af-4b4f-ac6d-a92fc8e393f6",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--4e767584-bc3f-436f-935e-0bb4d537ed43",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-25T00:20:48.896035Z",
+            "modified": "2024-08-25T00:20:48.896035Z",
+            "name": "CVE-2024-45240",
+            "description": "The TikTok (aka com.zhiliaoapp.musically) application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via deeplink traversal (in the application's exposed WebView). (On Android 12 and later, this is only exploitable by third-party applications.)",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-45240"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--4fe50500-c200-4e73-bd72-b959f46c9d62.json b/objects/vulnerability/vulnerability--4fe50500-c200-4e73-bd72-b959f46c9d62.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--225fb8a0-6f51-4475-8458-0bcaa94a475a",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--4fe50500-c200-4e73-bd72-b959f46c9d62",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-25T00:20:50.877333Z",
+            "modified": "2024-08-25T00:20:50.877333Z",
+            "name": "CVE-2023-0926",
+            "description": "The Custom Permalinks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping on tag names. This allows authenticated users, with editor-level permissions or greater to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, even when 'unfiltered_html' has been disabled.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-0926"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--544bd829-700f-4f1b-8727-0a112bb4f390.json b/objects/vulnerability/vulnerability--544bd829-700f-4f1b-8727-0a112bb4f390.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--6b048ce8-0b9f-4295-8219-3e3845580e93",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--544bd829-700f-4f1b-8727-0a112bb4f390",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-25T00:20:51.598431Z",
+            "modified": "2024-08-25T00:20:51.598431Z",
+            "name": "CVE-2023-6987",
+            "description": "The String locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sql-column' parameter in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This required WP_DEBUG to be enabled in order to be exploited.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-6987"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--55a69c29-c609-40a6-91ec-dbad5dea7ced.json b/objects/vulnerability/vulnerability--55a69c29-c609-40a6-91ec-dbad5dea7ced.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--f9582ec3-1768-4c23-a35d-36edadfc7a1d",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--55a69c29-c609-40a6-91ec-dbad5dea7ced",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-08-25T00:20:47.33364Z",
+            "modified": "2024-08-25T00:20:47.33364Z",
+            "name": "CVE-2024-2254",
+            "description": "The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-2254"
+                }
+            ]
+        }
+    ]
+}