generated content from 2024-04-11

objects/vulnerability/vulnerability--00074bd8-400a-4a0b-8b98-ebbc5c509395.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--3e1679f5-9ccf-4a5f-9670-5b55e0c243ed",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--00074bd8-400a-4a0b-8b98-ebbc5c509395",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-04-11T00:28:30.479802Z",
+            "modified": "2024-04-11T00:28:30.479802Z",
+            "name": "CVE-2024-1850",
+            "description": "The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized access, modification or deletion of posts due to a missing capability check on functions hooked by AJAX actions in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with subscriber access or higher, to view all posts generated with this plugin (even in non-published status), create new posts (and publish them), publish unpublished post or perform post deletions.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-1850"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--001d889b-857d-4b07-91ed-dc9500ec9f1f.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--ac16a37f-c212-4580-836d-1c5fa9c30b46",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--001d889b-857d-4b07-91ed-dc9500ec9f1f",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-04-11T00:28:29.850508Z",
+            "modified": "2024-04-11T00:28:29.850508Z",
+            "name": "CVE-2024-2499",
+            "description": "The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'accordions' shortcode in all versions up to, and including, 0.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-2499"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--00507cb8-457d-4ef6-bb41-aa566c13bd34.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--d81eb9e2-3937-47be-80c1-aaf541460406",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--00507cb8-457d-4ef6-bb41-aa566c13bd34",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-04-11T00:28:29.914054Z",
+            "modified": "2024-04-11T00:28:29.914054Z",
+            "name": "CVE-2024-2347",
+            "description": "The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name in all versions up to, and including, 4.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-2347"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--005ea51c-b9f6-45b4-9de6-4b4c1912a787.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--c2b6ee9a-aa9a-4f83-89d8-05f63db5fb32",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--005ea51c-b9f6-45b4-9de6-4b4c1912a787",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-04-11T00:28:30.629033Z",
+            "modified": "2024-04-11T00:28:30.629033Z",
+            "name": "CVE-2024-31453",
+            "description": "PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.2.0, the absence of restrictions on the endpoint, which allows users to create a path for uploading a file in a file distribution, allows an attacker to add arbitrary files to the distribution. The vulnerability allows an attacker to influence those users who come to the file distribution after them and slip the victim files with a malicious or phishing signature. Version 2.2.0 contains a patch for the issue.\n\nCVE-2024-31453 allows users to violate the integrity of a file bucket and upload new files there, while the vulnerability with the number CVE-2024-31454 allows users to violate the integrity of a single file that is uploaded by another user by writing data there and not allows you to upload new files to the bucket. Thus, vulnerabilities are reproduced differently, require different security recommendations and affect different objects of the application’s business logic.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-31453"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0060a8f3-5202-4381-83bf-ebbfe48dd401.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--5d974aa6-7325-4f0f-934c-6dc130a4d3a3",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0060a8f3-5202-4381-83bf-ebbfe48dd401",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-04-11T00:28:31.005688Z",
+            "modified": "2024-04-11T00:28:31.005688Z",
+            "name": "CVE-2024-29191",
+            "description": "gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The links page (`links.html`) appends the `src` GET parameter (`[0]`) in all of its links for 1-click previews. The context in which `src` is being appended is `innerHTML` (`[1]`), which will insert the text as HTML. Commit 3b3d5b033aac3a019af64f83dec84f70ed2c8aba contains a patch for the issue.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-29191"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0067d627-6aae-4654-aef1-369c42ed5de7.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--95ea0bda-8922-49dc-95d6-b5c2c9500b4c",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0067d627-6aae-4654-aef1-369c42ed5de7",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-04-11T00:28:30.159127Z",
+            "modified": "2024-04-11T00:28:30.159127Z",
+            "name": "CVE-2024-20689",
+            "description": "Secure Boot Security Feature Bypass Vulnerability",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-20689"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--00bddaab-18a4-4b2e-86d2-a05f8eb016d8.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--4ce951f8-8e57-49af-9a0f-75d9fbb7e5ba",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--00bddaab-18a4-4b2e-86d2-a05f8eb016d8",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-04-11T00:28:29.855558Z",
+            "modified": "2024-04-11T00:28:29.855558Z",
+            "name": "CVE-2024-2792",
+            "description": "The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via widgets in all versions up to, and including, 1.13.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-2792"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--00bee04d-4257-4b18-b34a-7104efc566cc.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--8da1cc9a-3f71-4c15-a5a5-49038d4eb2f9",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--00bee04d-4257-4b18-b34a-7104efc566cc",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-04-11T00:28:30.620794Z",
+            "modified": "2024-04-11T00:28:30.620794Z",
+            "name": "CVE-2024-31809",
+            "description": "TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the FileName parameter in the setUpgradeFW function.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-31809"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--00bff1b4-e73f-4d4c-91c5-044bb7d079c7.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b2decbcc-d039-485b-b110-452e62fa8dc5",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--00bff1b4-e73f-4d4c-91c5-044bb7d079c7",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-04-11T00:28:31.12742Z",
+            "modified": "2024-04-11T00:28:31.12742Z",
+            "name": "CVE-2024-25568",
+            "description": "OS command injection vulnerability in WRC-X3200GST3-B v1.25 and earlier, and WRC-G01-W v1.24 and earlier allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands by sending a specially crafted request to the product.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-25568"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--00ff02e2-1371-45ef-bd6b-d242ec9987e8.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--58bcdd05-247f-4fb8-a16a-5db30ba0efae",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--00ff02e2-1371-45ef-bd6b-d242ec9987e8",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-04-11T00:28:30.800801Z",
+            "modified": "2024-04-11T00:28:30.800801Z",
+            "name": "CVE-2024-30692",
+            "description": "A issue was discovered in ROS2 Galactic Geochelone versions ROS_VERSION 2 and ROS_PYTHON_VERSION 3, allows remote attackers to cause a denial of service (DoS) in the ROS2 nodes.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-30692"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--014ce4e3-af5e-463e-986e-7f564261cf52.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--0c850fb8-9537-42a6-9792-d58f794c432e",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--014ce4e3-af5e-463e-986e-7f564261cf52",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-04-11T00:28:37.533782Z",
+            "modified": "2024-04-11T00:28:37.533782Z",
+            "name": "CVE-2023-1082",
+            "description": "An remote attacker with low privileges can perform a command injection which can lead to root access.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-1082"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--015fa819-a9e1-4857-b0ac-cb4e47a599b3.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b1030a1c-d851-43ce-8acc-432ec4d799a3",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--015fa819-a9e1-4857-b0ac-cb4e47a599b3",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-04-11T00:28:29.841749Z",
+            "modified": "2024-04-11T00:28:29.841749Z",
+            "name": "CVE-2024-2335",
+            "description": "The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget link URLs in all versions up to, and including, 2.16.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-2335"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0166471d-fafb-4500-8abd-772578ec5ba9.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--0e054957-86b2-4020-b24c-5aa6dfeff791",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0166471d-fafb-4500-8abd-772578ec5ba9",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-04-11T00:28:30.007382Z",
+            "modified": "2024-04-11T00:28:30.007382Z",
+            "name": "CVE-2024-28900",
+            "description": "Windows Remote Access Connection Manager Information Disclosure Vulnerability",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-28900"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--016a225b-cbb0-4cf8-a3bf-69385e872bc8.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--3ddbc8fc-fe0f-4dba-a4f1-cc2140c0c79f",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--016a225b-cbb0-4cf8-a3bf-69385e872bc8",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-04-11T00:28:30.443737Z",
+            "modified": "2024-04-11T00:28:30.443737Z",
+            "name": "CVE-2024-1233",
+            "description": "A flaw was found in` JwtValidator.resolvePublicKey` in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery (SSRF) vulnerability.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-1233"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--016d4c30-6ac2-49ee-9e73-8ce6a18ff294.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--d660b493-0ea5-47fe-b75d-e18fa4402b9f",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--016d4c30-6ac2-49ee-9e73-8ce6a18ff294",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-04-11T00:28:30.092308Z",
+            "modified": "2024-04-11T00:28:30.092308Z",
+            "name": "CVE-2024-0076",
+            "description": "\nNVIDIA CUDA toolkit for all platforms contains a vulnerability in cuobjdump and nvdisasm where an attacker may cause a crash by tricking a user into reading a malformed ELF file. A successful exploit of this vulnerability may lead to a partial denial of service.\n\n",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-0076"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0182fa92-95be-4c44-80e2-e91539f8e437.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b6a6ba10-2bfc-4694-a3d8-241f8c953fa9",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0182fa92-95be-4c44-80e2-e91539f8e437",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-04-11T00:28:30.401652Z",
+            "modified": "2024-04-11T00:28:30.401652Z",
+            "name": "CVE-2024-1752",
+            "description": "The Font Farsi WordPress plugin through 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-1752"
+                }
+            ]
+        }
+    ]
+}