generated content from 2024-09-26

mapping.csv

@@ -250059,3 +250059,45 @@ vulnerability,CVE-2023-5359,vulnerability--94186a1e-c190-40ee-9899-6ad4095d5f76
 vulnerability,CVE-2021-38963,vulnerability--a3fa5b4f-e9c1-41a8-9eaf-83f88155c193
 vulnerability,CVE-2022-43845,vulnerability--7ffcc086-431f-4cc4-8d4a-604a1d21ca9a
 vulnerability,CVE-2022-2439,vulnerability--81f077ed-2494-4091-96d1-0d03da555b1f
+vulnerability,CVE-2024-3866,vulnerability--9077734b-d268-4931-b47c-711b2a5dcb63
+vulnerability,CVE-2024-9169,vulnerability--adafd177-b147-4c02-a1da-f2dca1be7d52
+vulnerability,CVE-2024-9069,vulnerability--e32778bf-962f-4211-9e61-28a98391e040
+vulnerability,CVE-2024-9068,vulnerability--de531ba9-ce0c-4f65-b38f-2fd368918462
+vulnerability,CVE-2024-9027,vulnerability--376f4d66-bed2-48ba-9e7b-d4c8a309faa5
+vulnerability,CVE-2024-9024,vulnerability--a8afd228-2549-42df-b9da-4e8e702f2f03
+vulnerability,CVE-2024-9073,vulnerability--8c18b1cd-22a0-4816-8f97-c0ab24e25c03
+vulnerability,CVE-2024-9028,vulnerability--acf1f7d9-126e-4b0e-a023-67b746f2b112
+vulnerability,CVE-2024-8549,vulnerability--c90aa163-655a-46dc-afbf-e3a919fc3477
+vulnerability,CVE-2024-8621,vulnerability--d0fb4944-70a0-41e7-8f23-c7d7f4067386
+vulnerability,CVE-2024-8275,vulnerability--b1f7239d-acb7-4678-8495-7d1b70cc4bfe
+vulnerability,CVE-2024-8349,vulnerability--b5e91984-afbb-4d5b-a5a2-aa9cb614fb54
+vulnerability,CVE-2024-8350,vulnerability--29308deb-ab9a-4a72-a897-b42a918c92b0
+vulnerability,CVE-2024-8481,vulnerability--e026d8e7-3a43-447c-89f2-77ef74855fff
+vulnerability,CVE-2024-8668,vulnerability--5c074451-422c-4513-aa2f-db8026a3d61a
+vulnerability,CVE-2024-8483,vulnerability--b020a9fb-a39c-418e-8485-e80aa7d5e740
+vulnerability,CVE-2024-8434,vulnerability--4bef1d72-d6e7-423d-9f2d-c03d380c8f23
+vulnerability,CVE-2024-8514,vulnerability--d83053e6-0495-4236-bdbd-ec4406c864eb
+vulnerability,CVE-2024-8658,vulnerability--249a87f9-5d4d-4045-b8f5-cb47206e92e1
+vulnerability,CVE-2024-8485,vulnerability--7021678d-27a9-467f-8983-82a83d44011b
+vulnerability,CVE-2024-8713,vulnerability--70c61d61-5020-4c3e-9cd8-1829622cd8d4
+vulnerability,CVE-2024-8290,vulnerability--6919460a-969b-4bdf-92b1-88f391b2fad7
+vulnerability,CVE-2024-8175,vulnerability--96c63eab-3d37-4fcf-b8c9-972b337575b1
+vulnerability,CVE-2024-8678,vulnerability--7c1b07ba-e1f3-4871-8e65-bb08c696469e
+vulnerability,CVE-2024-8910,vulnerability--22aa1d3a-d3bb-4af0-8d90-b55e87ebedea
+vulnerability,CVE-2024-8515,vulnerability--88e3ca2a-7cf2-422b-a71b-ec8a6b932627
+vulnerability,CVE-2024-8516,vulnerability--0dfdf7a8-14da-4a58-89ff-4e9504488498
+vulnerability,CVE-2024-8476,vulnerability--df7fc748-4898-442f-8775-9cf6d9395d8f
+vulnerability,CVE-2024-8484,vulnerability--769cfe46-c81f-4492-9f51-880591dbf3b5
+vulnerability,CVE-2024-8741,vulnerability--3feba1eb-f68f-4d37-9d42-594bcb33a0af
+vulnerability,CVE-2024-40761,vulnerability--4977a46c-9cd4-4fa2-9cf2-eecec1a26d0b
+vulnerability,CVE-2024-23454,vulnerability--dc6a659b-cebf-4f90-87cd-bcdc3af4689e
+vulnerability,CVE-2024-6590,vulnerability--b34ab681-16cb-45d1-8b14-389d257ca7af
+vulnerability,CVE-2024-6845,vulnerability--4d19040b-206d-4022-baff-55397bdd71c4
+vulnerability,CVE-2024-7892,vulnerability--a1e1297b-1950-4f05-a34a-fbe94453230e
+vulnerability,CVE-2024-7878,vulnerability--0e952f8a-77c1-42da-87cd-b7064afd6ead
+vulnerability,CVE-2024-7386,vulnerability--87e77c2b-2b61-4b30-98c8-4213073f2d2b
+vulnerability,CVE-2024-7491,vulnerability--ddc237bd-a7fd-4e0a-98fe-6a0756711562
+vulnerability,CVE-2024-7385,vulnerability--31084422-2f0f-4aa3-b21a-12338f431555
+vulnerability,CVE-2024-7426,vulnerability--be092bc0-315a-40f3-b56a-e10614b840f6
+vulnerability,CVE-2024-7617,vulnerability--c672c194-3f71-4d1b-b417-857190c0d30d
+vulnerability,CVE-2024-47303,vulnerability--4c30333c-3ee0-4140-a907-d1fd1a5c2f6c

objects/vulnerability/vulnerability--0dfdf7a8-14da-4a58-89ff-4e9504488498.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--59877717-34af-43ca-b0b7-c32ec273fcfe",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0dfdf7a8-14da-4a58-89ff-4e9504488498",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-26T00:20:00.27506Z",
+            "modified": "2024-09-26T00:20:00.27506Z",
+            "name": "CVE-2024-8516",
+            "description": "The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.1 via the render() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract limited post information from draft and future scheduled posts.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8516"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--0e952f8a-77c1-42da-87cd-b7064afd6ead.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--d65547e9-63a3-4cb7-bba5-81f3d9a98050",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0e952f8a-77c1-42da-87cd-b7064afd6ead",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-26T00:20:00.959241Z",
+            "modified": "2024-09-26T00:20:00.959241Z",
+            "name": "CVE-2024-7878",
+            "description": "The WP ULike  WordPress plugin before 4.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-7878"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--22aa1d3a-d3bb-4af0-8d90-b55e87ebedea.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--4e1d81a9-1e46-44d3-98ba-b014f44a8b28",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--22aa1d3a-d3bb-4af0-8d90-b55e87ebedea",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-26T00:20:00.263184Z",
+            "modified": "2024-09-26T00:20:00.263184Z",
+            "name": "CVE-2024-8910",
+            "description": "The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.5 via the render function in includes/widgets/htmega_accordion.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8910"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--249a87f9-5d4d-4045-b8f5-cb47206e92e1.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--145fb8ef-b7a7-48fb-9461-302d391d3bd3",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--249a87f9-5d4d-4045-b8f5-cb47206e92e1",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-26T00:20:00.248299Z",
+            "modified": "2024-09-26T00:20:00.248299Z",
+            "name": "CVE-2024-8658",
+            "description": "The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mycred_update_database() function in all versions up to, and including, 2.7.3. This makes it possible for unauthenticated attackers to upgrade an out of date database.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8658"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--29308deb-ab9a-4a72-a897-b42a918c92b0.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--366be7d0-5f04-4a07-bb85-fb2cbb42d5a1",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--29308deb-ab9a-4a72-a897-b42a918c92b0",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-26T00:20:00.216254Z",
+            "modified": "2024-09-26T00:20:00.216254Z",
+            "name": "CVE-2024-8350",
+            "description": "The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgm_management/v1/add_user/ REST API endpoint in all versions up to, and including, 6.1.0.1. This makes it possible for authenticated attackers, with group leader-level access and above, to add users to their group which ultimately allows them to leverage CVE-2024-8349 and gain admin access to the site.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8350"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--31084422-2f0f-4aa3-b21a-12338f431555.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--25248b3e-affe-443c-861a-1ecbf6e9de31",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--31084422-2f0f-4aa3-b21a-12338f431555",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-26T00:20:00.983338Z",
+            "modified": "2024-09-26T00:20:00.983338Z",
+            "name": "CVE-2024-7385",
+            "description": "The WordPress Simple HTML Sitemap plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-7385"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--376f4d66-bed2-48ba-9e7b-d4c8a309faa5.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--7169f0ef-54d7-4003-b67e-1f52864a4d80",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--376f4d66-bed2-48ba-9e7b-d4c8a309faa5",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-26T00:20:00.196871Z",
+            "modified": "2024-09-26T00:20:00.196871Z",
+            "name": "CVE-2024-9027",
+            "description": "The WPZOOM Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'box' shortcode in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-9027"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--3feba1eb-f68f-4d37-9d42-594bcb33a0af.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--4f872449-4e86-4cea-8252-1d62824bf46d",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--3feba1eb-f68f-4d37-9d42-594bcb33a0af",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-26T00:20:00.283749Z",
+            "modified": "2024-09-26T00:20:00.283749Z",
+            "name": "CVE-2024-8741",
+            "description": "The Beam me up Scotty – Back to Top Button plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8741"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--4977a46c-9cd4-4fa2-9cf2-eecec1a26d0b.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--940d7c95-6169-49f8-a19a-30054362262b",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--4977a46c-9cd4-4fa2-9cf2-eecec1a26d0b",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-26T00:20:00.308413Z",
+            "modified": "2024-09-26T00:20:00.308413Z",
+            "name": "CVE-2024-40761",
+            "description": "Inadequate Encryption Strength vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 1.3.5.\n\nUsing the MD5 value of a user's email to access Gravatar is insecure and can lead to the leakage of user email. The official recommendation is to use SHA256 instead.\nUsers are recommended to upgrade to version 1.4.0, which fixes the issue.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-40761"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--4bef1d72-d6e7-423d-9f2d-c03d380c8f23.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b0391950-05d3-4442-99c9-4e872f39795b",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--4bef1d72-d6e7-423d-9f2d-c03d380c8f23",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-26T00:20:00.226661Z",
+            "modified": "2024-09-26T00:20:00.226661Z",
+            "name": "CVE-2024-8434",
+            "description": "The Easy Mega Menu Plugin for WordPress – ThemeHunk plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions hooked via AJAX in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform actions like updating plugin settings.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8434"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--4c30333c-3ee0-4140-a907-d1fd1a5c2f6c.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--fa784d33-94c1-44f8-93dd-35d22222523a",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--4c30333c-3ee0-4140-a907-d1fd1a5c2f6c",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-26T00:20:01.435305Z",
+            "modified": "2024-09-26T00:20:01.435305Z",
+            "name": "CVE-2024-47303",
+            "description": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Livemesh Livemesh Addons for Elementor allows Stored XSS.This issue affects Livemesh Addons for Elementor: from n/a through 8.5.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-47303"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--4d19040b-206d-4022-baff-55397bdd71c4.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--84d6a98d-f59d-4394-a0ab-d1ab1c6585d4",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--4d19040b-206d-4022-baff-55397bdd71c4",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-26T00:20:00.577191Z",
+            "modified": "2024-09-26T00:20:00.577191Z",
+            "name": "CVE-2024-6845",
+            "description": "The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-6845"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--5c074451-422c-4513-aa2f-db8026a3d61a.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--14e3b95e-5821-48dc-8c1c-32048257deca",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--5c074451-422c-4513-aa2f-db8026a3d61a",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-26T00:20:00.219871Z",
+            "modified": "2024-09-26T00:20:00.219871Z",
+            "name": "CVE-2024-8668",
+            "description": "The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the tooltip and countdown functionality in all versions up to, and including, 2.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8668"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--6919460a-969b-4bdf-92b1-88f391b2fad7.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--50c6f58b-965c-4182-b356-b03fbe955b98",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--6919460a-969b-4bdf-92b1-88f391b2fad7",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2024-09-26T00:20:00.252533Z",
+            "modified": "2024-09-26T00:20:00.252533Z",
+            "name": "CVE-2024-8290",
+            "description": "The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.12 via the WCFM_Customers_Manage_Controller::processing function due to missing validation on the ID user controlled key. This makes it possible for authenticated attackers, with subscriber/customer-level access and above, to change the email address of administrator user accounts which allows them to reset the password and access the administrator account.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-8290"
+                }
+            ]
+        }
+    ]
+}