Skip to content

Commit ba4218c

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-567c-gxmx-3pq9 GHSA-9rf3-44g3-h94q GHSA-c893-4f2j-x5ch GHSA-j7jv-x682-58fv GHSA-jphx-whwm-8gpv GHSA-p676-v935-rjvf
1 parent f05cb74 commit ba4218c

File tree

6 files changed

+66
-24
lines changed

6 files changed

+66
-24
lines changed

‎advisories/unreviewed/2024/12/GHSA-567c-gxmx-3pq9/GHSA-567c-gxmx-3pq9.json

+11-4
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-567c-gxmx-3pq9",
4-
"modified": "2024-12-27T21:30:30Z",
4+
"modified": "2024-12-28T21:30:26Z",
55
"published": "2024-12-27T21:30:30Z",
66
"aliases": [
77
"CVE-2024-50945"
88
],
99
"details": "An improper access control vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f, allowing users to submit reviews without verifying if they have purchased the product.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-863"
38+
],
39+
"severity": "HIGH",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2024-12-27T19:15:08Z"

‎advisories/unreviewed/2024/12/GHSA-9rf3-44g3-h94q/GHSA-9rf3-44g3-h94q.json

+11-4
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-9rf3-44g3-h94q",
4-
"modified": "2024-12-27T21:30:30Z",
4+
"modified": "2024-12-28T21:30:26Z",
55
"published": "2024-12-27T21:30:30Z",
66
"aliases": [
77
"CVE-2024-54450"
88
],
99
"details": "An issue was discovered in Kurmi Provisioning Suite 7.9.0.33. If an X-Forwarded-For header is received during authentication, the Kurmi application will record the (possibly forged) IP address mentioned in that header rather than the real IP address that the user logged in from. This fake IP address can later be displayed in the My Account popup that shows the IP address that was used to log in.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-290"
34+
],
35+
"severity": "CRITICAL",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2024-12-27T20:15:23Z"

‎advisories/unreviewed/2024/12/GHSA-c893-4f2j-x5ch/GHSA-c893-4f2j-x5ch.json

+11-4
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-c893-4f2j-x5ch",
4-
"modified": "2024-12-27T21:30:30Z",
4+
"modified": "2024-12-28T21:30:26Z",
55
"published": "2024-12-27T21:30:30Z",
66
"aliases": [
77
"CVE-2024-50944"
88
],
99
"details": "Integer overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shopping cart functionality. The issue lies in the quantity parameter in the CartController's AddToCart method.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -32,8 +37,10 @@
3237
}
3338
],
3439
"database_specific": {
35-
"cwe_ids": [],
36-
"severity": null,
40+
"cwe_ids": [
41+
"CWE-190"
42+
],
43+
"severity": "CRITICAL",
3744
"github_reviewed": false,
3845
"github_reviewed_at": null,
3946
"nvd_published_at": "2024-12-27T19:15:08Z"

‎advisories/unreviewed/2024/12/GHSA-j7jv-x682-58fv/GHSA-j7jv-x682-58fv.json

+11-4
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-j7jv-x682-58fv",
4-
"modified": "2024-12-27T21:30:30Z",
4+
"modified": "2024-12-28T21:30:26Z",
55
"published": "2024-12-27T21:30:30Z",
66
"aliases": [
77
"CVE-2024-54452"
88
],
99
"details": "An issue was discovered in Kurmi Provisioning Suite before 7.9.0.35 and 7.10.x through 7.10.0.18. A Directory Traversal and Local File Inclusion vulnerability in the logsSys.do page allows remote attackers (authenticated as administrators) to trigger the display of unintended files. Any file accessible to the Kurmi user account could be displayed, e.g., configuration files with information such as the database password.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-22"
34+
],
35+
"severity": "MODERATE",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2024-12-27T20:15:23Z"

‎advisories/unreviewed/2024/12/GHSA-jphx-whwm-8gpv/GHSA-jphx-whwm-8gpv.json

+11-4
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-jphx-whwm-8gpv",
4-
"modified": "2024-12-27T21:30:30Z",
4+
"modified": "2024-12-28T21:30:26Z",
55
"published": "2024-12-27T21:30:30Z",
66
"aliases": [
77
"CVE-2024-53476"
88
],
99
"details": "A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restrictions by simultaneously submitting purchase requests from multiple accounts for the same product. This can lead to overselling when stock is limited, as the system fails to accurately track inventory under high concurrency, resulting in potential loss and unfulfilled orders.",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -28,8 +33,10 @@
2833
}
2934
],
3035
"database_specific": {
31-
"cwe_ids": [],
32-
"severity": null,
36+
"cwe_ids": [
37+
"CWE-362"
38+
],
39+
"severity": "MODERATE",
3340
"github_reviewed": false,
3441
"github_reviewed_at": null,
3542
"nvd_published_at": "2024-12-27T19:15:09Z"

‎advisories/unreviewed/2024/12/GHSA-p676-v935-rjvf/GHSA-p676-v935-rjvf.json

+11-4
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,18 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-p676-v935-rjvf",
4-
"modified": "2024-12-27T21:30:30Z",
4+
"modified": "2024-12-28T21:30:26Z",
55
"published": "2024-12-27T21:30:30Z",
66
"aliases": [
77
"CVE-2024-54451"
88
],
99
"details": "A cross-site scripting (XSS) vulnerability in the graphicCustomization.do page in Kurmi Provisioning Suite before 7.9.0.38, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15 allows remote attackers (authenticated as system administrators) to inject arbitrary web script or HTML via the COMPONENT_fields(htmlTitle) field, which is rendered in other pages of the application for all users (if the graphical customization has been activated by a super-administrator).",
10-
"severity": [],
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
14+
}
15+
],
1116
"affected": [],
1217
"references": [
1318
{
@@ -24,8 +29,10 @@
2429
}
2530
],
2631
"database_specific": {
27-
"cwe_ids": [],
28-
"severity": null,
32+
"cwe_ids": [
33+
"CWE-79"
34+
],
35+
"severity": "MODERATE",
2936
"github_reviewed": false,
3037
"github_reviewed_at": null,
3138
"nvd_published_at": "2024-12-27T20:15:23Z"

0 commit comments

Comments
 (0)