generated content from 2024-12-13

objects/vulnerability/vulnerability--03020106-7c9b-4fa2-b36f-a503f97e2e18.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--771be76f-c2c1-4d3d-a078-100582145705",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--03020106-7c9b-4fa2-b36f-a503f97e2e18",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-13T00:40:39.556258Z",
+            "modified": "2024-12-13T00:40:39.556258Z",
+            "name": "CVE-2024-10111",
+            "description": "The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 6.26.3. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username and the user does not have an already-existing account for the service returning the token.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-10111"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--035bf396-9f7d-461d-8c19-7a5e24a59e3d.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--661639a3-274d-499c-9440-12566d2df5fd",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--035bf396-9f7d-461d-8c19-7a5e24a59e3d",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-13T00:40:41.120063Z",
+            "modified": "2024-12-13T00:40:41.120063Z",
+            "name": "CVE-2024-54116",
+            "description": "Out-of-bounds read vulnerability in the M3U8 module\nImpact: Successful exploitation of this vulnerability may cause features to perform abnormally.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-54116"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--035d0575-4273-475d-ade7-49c4afc63106.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--38133ec7-a958-4c2b-afd3-f378c530e231",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--035d0575-4273-475d-ade7-49c4afc63106",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-13T00:40:41.122672Z",
+            "modified": "2024-12-13T00:40:41.122672Z",
+            "name": "CVE-2024-54510",
+            "description": "A race condition was addressed with improved locking. This issue is fixed in iPadOS 17.7.3, watchOS 11.2, tvOS 18.2, macOS Sequoia 15.2, iOS 18.2 and iPadOS 18.2, macOS Ventura 13.7.2, macOS Sonoma 14.7.2. An app may be able to leak sensitive kernel state.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-54510"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0403e6f6-2ae3-4a58-a1e2-34dc9851a21b.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--052f5ae7-cc36-43e4-a04f-b46650080bf1",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0403e6f6-2ae3-4a58-a1e2-34dc9851a21b",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-13T00:40:39.440987Z",
+            "modified": "2024-12-13T00:40:39.440987Z",
+            "name": "CVE-2024-12072",
+            "description": "The Analytics Cat – Google Analytics Made Easy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action, such as clicking on a specially crafted link.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12072"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--056efd6f-74ba-45dd-baa8-e758e5f2d0d7.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--aa35d38e-95bf-44f9-b3b3-c23c65cd4f99",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--056efd6f-74ba-45dd-baa8-e758e5f2d0d7",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-13T00:40:39.770515Z",
+            "modified": "2024-12-13T00:40:39.770515Z",
+            "name": "CVE-2024-47601",
+            "description": "GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_parse_blockgroup_or_simpleblock function within matroska-demux.c. This function does not properly check the validity of the GstBuffer *sub pointer before performing dereferences. As a result, null pointer dereferences may occur. This vulnerability is fixed in 1.24.10.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-47601"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--060f2ec3-3e8f-4a2f-847f-a41f7f64bc7d.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--e11e3b92-7667-4fb1-b72c-a6a4ff3a23a9",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--060f2ec3-3e8f-4a2f-847f-a41f7f64bc7d",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-13T00:40:41.146949Z",
+            "modified": "2024-12-13T00:40:41.146949Z",
+            "name": "CVE-2024-54503",
+            "description": "An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.2 and iPadOS 18.2. Muting a call while ringing may not result in mute being enabled.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-54503"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--09a02adf-368a-457f-8657-2f1f3f2982cc.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--23f62b19-0fba-4b2a-8ff9-90b99986158e",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--09a02adf-368a-457f-8657-2f1f3f2982cc",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-13T00:40:39.472172Z",
+            "modified": "2024-12-13T00:40:39.472172Z",
+            "name": "CVE-2024-12441",
+            "description": "The BP Email Assign Templates plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12441"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--09db6ad5-921a-4fdb-8419-e652b66ac74b.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--a37c1557-0f3e-4d0d-b3f9-0607b01193e8",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--09db6ad5-921a-4fdb-8419-e652b66ac74b",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-13T00:40:40.097912Z",
+            "modified": "2024-12-13T00:40:40.097912Z",
+            "name": "CVE-2024-11785",
+            "description": "The Integrate Firebase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'firebase_show' shortcode in all versions up to, and including, 0.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-11785"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0e4ac90b-1290-4f51-a724-13f810600d2b.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--5963612c-3b92-4695-b426-73a21de74c83",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0e4ac90b-1290-4f51-a724-13f810600d2b",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-13T00:40:40.088092Z",
+            "modified": "2024-12-13T00:40:40.088092Z",
+            "name": "CVE-2024-11891",
+            "description": "The Perfect Font Awesome Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pfai' shortcode in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-11891"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0e896e8e-6f94-4753-bb23-2c2d0b97107e.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--879eb34e-cb1f-4ba4-b693-e3e4de09f209",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0e896e8e-6f94-4753-bb23-2c2d0b97107e",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-13T00:40:39.730286Z",
+            "modified": "2024-12-13T00:40:39.730286Z",
+            "name": "CVE-2024-47603",
+            "description": "GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been discovered in the gst_matroska_demux_update_tracks function within matroska-demux.c. The vulnerability occurs when the gst_caps_is_equal function is called with invalid caps values. If this happen, then in the function gst_buffer_get_size the call to GST_BUFFER_MEM_PTR can return a null pointer. Attempting to dereference the size field of this null pointer results in a null pointer dereference. This vulnerability is fixed in 1.24.10.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-47603"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0eca8c8a-2215-466d-9981-649eea86af0d.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--d1553d45-aa6f-4a14-ba21-271a77193438",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0eca8c8a-2215-466d-9981-649eea86af0d",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-13T00:40:41.206502Z",
+            "modified": "2024-12-13T00:40:41.206502Z",
+            "name": "CVE-2024-55659",
+            "description": "SiYuan is a personal knowledge management system. Prior to version 3.1.16, the `/api/asset/upload` endpoint in Siyuan is vulnerable to both arbitrary file write to the host and stored cross-site scripting (via the file write). Version 3.1.16 contains a patch for the issue.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-55659"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--1191572b-5000-4b3a-b4a7-2f96c0f634f5.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b3bebcbb-20a9-4452-a1d3-4b278490c88d",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--1191572b-5000-4b3a-b4a7-2f96c0f634f5",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-13T00:40:41.149229Z",
+            "modified": "2024-12-13T00:40:41.149229Z",
+            "name": "CVE-2024-54112",
+            "description": "Cross-process screen stack vulnerability in the UIExtension module\nImpact: Successful exploitation of this vulnerability may affect service confidentiality.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-54112"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--122bacb3-3159-472c-a4c9-aced5cf979a4.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--171d8985-3139-4b87-9362-bf7ea6099464",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--122bacb3-3159-472c-a4c9-aced5cf979a4",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-13T00:40:39.505051Z",
+            "modified": "2024-12-13T00:40:39.505051Z",
+            "name": "CVE-2024-12490",
+            "description": "A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /pages/teacher_save.php. The manipulation of the argument salut leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12490"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--1296aeac-9996-4571-97b2-9ffcebaba361.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--d19948cf-cea7-4298-8bc7-0000afd2c366",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--1296aeac-9996-4571-97b2-9ffcebaba361",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-13T00:40:41.181509Z",
+            "modified": "2024-12-13T00:40:41.181509Z",
+            "name": "CVE-2024-54102",
+            "description": "Race condition vulnerability in the DDR module\nImpact: Successful exploitation of this vulnerability may affect service confidentiality.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-54102"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--13dfc77d-830e-43b5-a125-b9ddcab126b3.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--a9b92a64-ada1-4d6e-8ad2-5fcfd295f977",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--13dfc77d-830e-43b5-a125-b9ddcab126b3",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-13T00:40:41.167802Z",
+            "modified": "2024-12-13T00:40:41.167802Z",
+            "name": "CVE-2024-54811",
+            "description": "A SQL injection vulnerability in /index.php in PHPGurukul Park Ticketing Management System v1.0 allows an attacker to execute arbitrary SQL commands via the \"login\" parameter.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-54811"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--14c7edf6-8f20-4849-928c-d4ec9f98567d.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--dc2eb79d-5292-4e33-977e-5b95c7fd2917",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--14c7edf6-8f20-4849-928c-d4ec9f98567d",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-12-13T00:40:41.084775Z",
+            "modified": "2024-12-13T00:40:41.084775Z",
+            "name": "CVE-2024-54842",
+            "description": "A SQL injection vulnerability was found in phpgurukul Online Nurse Hiring System v1.0 in /admin/password-recovery.php via the mobileno parameter.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-54842"
+                }
+            ]
+        }
+    ]
+}