generated content from 2025-01-05

oasis-open · Jan 5, 2025 · 45afeab · 45afeab
1 parent f897943
commit 45afeab
Show file tree

Hide file tree

Showing 40 changed files with 897 additions and 0 deletions.
diff --git a/mapping.csv b/mapping.csv
@@ -261934,3 +261934,42 @@ vulnerability,CVE-2025-0176,vulnerability--074472e8-faaf-4a71-8606-fd9a6a277cb8
 vulnerability,CVE-2025-0198,vulnerability--7a4b6244-270a-4891-b27f-3bd0c56134df
 vulnerability,CVE-2025-0197,vulnerability--c832c259-0542-40be-8978-50896271d354
 vulnerability,CVE-2025-0195,vulnerability--040fee21-e870-4838-a614-420faf77c382
+vulnerability,CVE-2024-12701,vulnerability--a68b8519-4fd6-4798-9686-17600020b145
+vulnerability,CVE-2024-12221,vulnerability--6a16fc20-dad1-4f1a-a3f6-ba19e509b525
+vulnerability,CVE-2024-12279,vulnerability--bcc352d0-5943-4598-84f1-44b893e5d2db
+vulnerability,CVE-2024-12583,vulnerability--9f001217-aff2-4bda-a241-f14964833c37
+vulnerability,CVE-2024-12047,vulnerability--15b40dcb-5163-4d61-98d7-e7156f8dfc4d
+vulnerability,CVE-2024-12195,vulnerability--066834b9-1029-44a6-8c9c-4a94156b43ce
+vulnerability,CVE-2024-12545,vulnerability--902b8241-e42e-452e-af39-303e9d127f32
+vulnerability,CVE-2024-12475,vulnerability--ec7a43df-9e1d-4d46-a946-f5c006912ac5
+vulnerability,CVE-2024-10957,vulnerability--bb614ee0-db36-42d5-a8e6-de567fab6a0e
+vulnerability,CVE-2024-10932,vulnerability--1c2d3c64-8f10-4591-933f-8ef38ee30ffa
+vulnerability,CVE-2024-11930,vulnerability--fb21438d-153e-4afd-8acd-c4289e8b406d
+vulnerability,CVE-2024-11974,vulnerability--390d0301-e831-40a1-97a5-35b77d1ea3e0
+vulnerability,CVE-2024-41766,vulnerability--3dd2b714-9cc7-407e-b03a-69086ddbad7c
+vulnerability,CVE-2024-41768,vulnerability--8d8cc659-f48e-43f8-9beb-fc4f04a19f3a
+vulnerability,CVE-2024-41767,vulnerability--f85edfea-d73c-4217-ab58-d35a9c0949ac
+vulnerability,CVE-2024-41765,vulnerability--ab2f8eea-7ad1-4ff6-bdb3-0e37b7cf387e
+vulnerability,CVE-2024-41763,vulnerability--bbeb64ac-4c23-4765-944c-93ef393e2d0d
+vulnerability,CVE-2025-22390,vulnerability--8f0de014-2990-432c-8b90-a56df0c1c1fc
+vulnerability,CVE-2025-22385,vulnerability--3a7b33b7-d23d-424c-b937-41151dc1008e
+vulnerability,CVE-2025-22383,vulnerability--be67e2b5-be1a-420f-b75b-eb4933197021
+vulnerability,CVE-2025-22388,vulnerability--188d2221-31b3-4961-9cff-fae9d93fa96f
+vulnerability,CVE-2025-22386,vulnerability--3dfe7af4-f71a-4b30-b066-e98db925d7fa
+vulnerability,CVE-2025-22389,vulnerability--a620b0ca-0f35-40ce-b310-b9a3a71b995f
+vulnerability,CVE-2025-22387,vulnerability--fbcf69ab-55bf-4f83-995c-964cdbd3a227
+vulnerability,CVE-2025-22384,vulnerability--4fdd445d-1ff1-4e9b-92a2-32b666896071
+vulnerability,CVE-2025-0202,vulnerability--d5344e0b-401d-478e-b829-5762cda44286
+vulnerability,CVE-2025-0212,vulnerability--0fc6c086-2500-429a-b625-ba32e708f107
+vulnerability,CVE-2025-0204,vulnerability--c608a226-dff2-4cc2-bb56-c35cbfedbd0f
+vulnerability,CVE-2025-0201,vulnerability--0d35ec05-b779-4c83-a40b-ad41dbfdfcb4
+vulnerability,CVE-2025-0200,vulnerability--de6a1dc0-a1ec-4491-82c0-6f3992f9d80a
+vulnerability,CVE-2025-0213,vulnerability--262369f1-e68b-4bff-bdd5-bd0dde71f95e
+vulnerability,CVE-2025-0210,vulnerability--8fa361a0-6823-4fe5-b059-533d0160fee3
+vulnerability,CVE-2025-0208,vulnerability--3cd9c1ba-6976-438e-a6dd-f4bf0d2a4ded
+vulnerability,CVE-2025-0206,vulnerability--afa39420-be77-4f36-a121-fd3088159c8a
+vulnerability,CVE-2025-0207,vulnerability--ce5a5b20-a3b3-4239-8bc5-0ae7b52720c0
+vulnerability,CVE-2025-0205,vulnerability--e7ac9d27-90fd-42a3-af78-8e1092be7db4
+vulnerability,CVE-2025-0214,vulnerability--e09f2db8-6062-492e-b211-b8c0eb71302b
+vulnerability,CVE-2025-0211,vulnerability--6736c90c-ceb2-4199-a890-6a669d4e31a3
+vulnerability,CVE-2025-0203,vulnerability--5b0ae69e-df52-42ac-9d36-dc94d366891d
diff --git a/objects/vulnerability/vulnerability--066834b9-1029-44a6-8c9c-4a94156b43ce.json b/objects/vulnerability/vulnerability--066834b9-1029-44a6-8c9c-4a94156b43ce.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--0d1d6205-4a0f-44b9-9e3b-1972bdfdf82e",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--066834b9-1029-44a6-8c9c-4a94156b43ce",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-05T00:22:59.482148Z",
+            "modified": "2025-01-05T00:22:59.482148Z",
+            "name": "CVE-2024-12195",
+            "description": "The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to SQL Injection via the 'project_id' parameter of the /wp-json/pm/v2/projects/2/task-lists REST API endpoint in all versions up to, and including, 2.6.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for authenticated attackers, who have been granted access to a project, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12195"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--0d35ec05-b779-4c83-a40b-ad41dbfdfcb4.json b/objects/vulnerability/vulnerability--0d35ec05-b779-4c83-a40b-ad41dbfdfcb4.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b1e505ce-233b-4a58-b84d-bb22e574dc3a",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0d35ec05-b779-4c83-a40b-ad41dbfdfcb4",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-05T00:23:11.512471Z",
+            "modified": "2025-01-05T00:23:11.512471Z",
+            "name": "CVE-2025-0201",
+            "description": "A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /user/update_account.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-0201"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--0fc6c086-2500-429a-b625-ba32e708f107.json b/objects/vulnerability/vulnerability--0fc6c086-2500-429a-b625-ba32e708f107.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--8f08626e-1eec-4df3-9e9a-d72c01daa025",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0fc6c086-2500-429a-b625-ba32e708f107",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-05T00:23:11.507848Z",
+            "modified": "2025-01-05T00:23:11.507848Z",
+            "name": "CVE-2025-0212",
+            "description": "A vulnerability was found in Campcodes Student Grading System 1.0. It has been classified as critical. This affects an unknown part of the file /view_students.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-0212"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--15b40dcb-5163-4d61-98d7-e7156f8dfc4d.json b/objects/vulnerability/vulnerability--15b40dcb-5163-4d61-98d7-e7156f8dfc4d.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--89330bf3-12af-4e29-bed0-0e17b797b922",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--15b40dcb-5163-4d61-98d7-e7156f8dfc4d",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-05T00:22:59.478167Z",
+            "modified": "2025-01-05T00:22:59.478167Z",
+            "name": "CVE-2024-12047",
+            "description": "The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ parameter in all versions up to, and including, 6.30.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12047"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--188d2221-31b3-4961-9cff-fae9d93fa96f.json b/objects/vulnerability/vulnerability--188d2221-31b3-4961-9cff-fae9d93fa96f.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b0fdb988-2ed2-4607-8bf7-d3666abad6c2",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--188d2221-31b3-4961-9cff-fae9d93fa96f",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-05T00:23:11.411556Z",
+            "modified": "2025-01-05T00:23:11.411556Z",
+            "name": "CVE-2025-22388",
+            "description": "An issue was discovered in Optimizely EPiServer.CMS.Core before 12.22.0. A high-severity Stored Cross-Site Scripting (XSS) vulnerability exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising user data, escalating privileges, or executing unauthorized actions. The issue exists in multiple areas, including content editing, link management, and file uploads.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-22388"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--1c2d3c64-8f10-4591-933f-8ef38ee30ffa.json b/objects/vulnerability/vulnerability--1c2d3c64-8f10-4591-933f-8ef38ee30ffa.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--de854a81-7dea-4f4c-85ca-da9eb49da2c1",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--1c2d3c64-8f10-4591-933f-8ef38ee30ffa",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-05T00:22:59.573583Z",
+            "modified": "2025-01-05T00:22:59.573583Z",
+            "name": "CVE-2024-10932",
+            "description": "The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site in order to trigger the exploit.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-10932"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--262369f1-e68b-4bff-bdd5-bd0dde71f95e.json b/objects/vulnerability/vulnerability--262369f1-e68b-4bff-bdd5-bd0dde71f95e.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--b18440b5-01c5-4f54-add2-f65a39e8da16",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--262369f1-e68b-4bff-bdd5-bd0dde71f95e",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-05T00:23:11.517678Z",
+            "modified": "2025-01-05T00:23:11.517678Z",
+            "name": "CVE-2025-0213",
+            "description": "A vulnerability was found in Campcodes Project Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /forms/update_forms.php?action=change_pic2&id=4. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-0213"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--390d0301-e831-40a1-97a5-35b77d1ea3e0.json b/objects/vulnerability/vulnerability--390d0301-e831-40a1-97a5-35b77d1ea3e0.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--f5e1fd91-d1f5-4bee-93b3-45377d64269b",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--390d0301-e831-40a1-97a5-35b77d1ea3e0",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-05T00:23:00.020392Z",
+            "modified": "2025-01-05T00:23:00.020392Z",
+            "name": "CVE-2024-11974",
+            "description": "The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit-action', and 'woofixit-action’ parameters in all versions up to, and including, 3.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-11974"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--3a7b33b7-d23d-424c-b937-41151dc1008e.json b/objects/vulnerability/vulnerability--3a7b33b7-d23d-424c-b937-41151dc1008e.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--e0f57421-633d-48cf-acfa-2f414b20806d",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--3a7b33b7-d23d-424c-b937-41151dc1008e",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-05T00:23:11.406258Z",
+            "modified": "2025-01-05T00:23:11.406258Z",
+            "name": "CVE-2025-22385",
+            "description": "An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested storefront accounts can be created on behalf of visitors.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-22385"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--3cd9c1ba-6976-438e-a6dd-f4bf0d2a4ded.json b/objects/vulnerability/vulnerability--3cd9c1ba-6976-438e-a6dd-f4bf0d2a4ded.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--87e2c5cc-fc02-4f3e-933c-905475e37492",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--3cd9c1ba-6976-438e-a6dd-f4bf0d2a4ded",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-05T00:23:11.519734Z",
+            "modified": "2025-01-05T00:23:11.519734Z",
+            "name": "CVE-2025-0208",
+            "description": "A vulnerability, which was classified as critical, was found in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /summary.php. The manipulation of the argument tid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-0208"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--3dd2b714-9cc7-407e-b03a-69086ddbad7c.json b/objects/vulnerability/vulnerability--3dd2b714-9cc7-407e-b03a-69086ddbad7c.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--4ecce9ac-a40f-4a8e-99f7-ca4890455f03",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--3dd2b714-9cc7-407e-b03a-69086ddbad7c",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-05T00:23:00.578195Z",
+            "modified": "2025-01-05T00:23:00.578195Z",
+            "name": "CVE-2024-41766",
+            "description": "IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3  could allow a remote attacker to cause a denial of service using a complex regular expression.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-41766"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--3dfe7af4-f71a-4b30-b066-e98db925d7fa.json b/objects/vulnerability/vulnerability--3dfe7af4-f71a-4b30-b066-e98db925d7fa.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--f95ac595-d665-45ff-aa53-3ee062c38ee2",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--3dfe7af4-f71a-4b30-b066-e98db925d7fa",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-05T00:23:11.417679Z",
+            "modified": "2025-01-05T00:23:11.417679Z",
+            "name": "CVE-2025-22386",
+            "description": "An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-22386"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--4fdd445d-1ff1-4e9b-92a2-32b666896071.json b/objects/vulnerability/vulnerability--4fdd445d-1ff1-4e9b-92a2-32b666896071.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--c98f5ecb-8c4b-421f-b795-8f4306ebdcde",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--4fdd445d-1ff1-4e9b-92a2-32b666896071",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-05T00:23:11.42425Z",
+            "modified": "2025-01-05T00:23:11.42425Z",
+            "name": "CVE-2025-22384",
+            "description": "An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching the server.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-22384"
+                }
+            ]
+        }
+    ]
+}
diff --git a/objects/vulnerability/vulnerability--5b0ae69e-df52-42ac-9d36-dc94d366891d.json b/objects/vulnerability/vulnerability--5b0ae69e-df52-42ac-9d36-dc94d366891d.json
@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--231ce5ee-6855-4223-b72a-0517d23ba38d",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--5b0ae69e-df52-42ac-9d36-dc94d366891d",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-05T00:23:11.529011Z",
+            "modified": "2025-01-05T00:23:11.529011Z",
+            "name": "CVE-2025-0203",
+            "description": "A vulnerability was found in code-projects Student Management System 1.0. It has been declared as critical. This vulnerability affects the function showSubject1 of the file /config/DbFunction.php. The manipulation of the argument sid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-0203"
+                }
+            ]
+        }
+    ]
+}