generated content from 2025-01-27

mapping.csv

@@ -265154,3 +265154,24 @@ vulnerability,CVE-2025-0542,vulnerability--4eef7969-243e-4a66-97e1-d1743cebfba6
 vulnerability,CVE-2025-0411,vulnerability--dc8b1036-16b4-46d8-8e1f-55130ba16fb9
 vulnerability,CVE-2025-0357,vulnerability--30ddd2a7-0dbf-4e6c-87b7-4f2adb7f43b8
 vulnerability,CVE-2025-0350,vulnerability--1ea854a9-b7ed-4eb7-a901-d49f7aec6ede
+vulnerability,CVE-2024-31906,vulnerability--a7759ae0-5349-4a94-979d-bb506a68d168
+vulnerability,CVE-2024-12334,vulnerability--16e86a11-c915-4f11-b3bd-151239ed4aad
+vulnerability,CVE-2024-46881,vulnerability--a38ec0f0-57ed-4614-9229-6a6789adaa4b
+vulnerability,CVE-2024-10705,vulnerability--8dc64a10-87e7-4ca0-be50-e2090f3ef7a2
+vulnerability,CVE-2024-10574,vulnerability--bdc88b54-35aa-4d55-b62b-9550ac27122b
+vulnerability,CVE-2024-10636,vulnerability--0546b32e-8c1b-4c91-8543-7e7a97d04261
+vulnerability,CVE-2024-10628,vulnerability--72edfaa4-ef75-4ee6-bc19-4b6f769b5731
+vulnerability,CVE-2024-10633,vulnerability--6cc0e987-e8e4-46f1-b8c1-69da4ca2317d
+vulnerability,CVE-2024-13505,vulnerability--530d4fa8-6862-47e8-83b4-25f1e10c93c9
+vulnerability,CVE-2024-11936,vulnerability--7ab5267b-5a7b-42ed-9f43-38512cb9a151
+vulnerability,CVE-2024-11641,vulnerability--c2d73039-1cfd-4df4-824e-da8651510bb2
+vulnerability,CVE-2024-11090,vulnerability--789d7891-e37e-4571-a8b5-7d5fd0c5f8a7
+vulnerability,CVE-2022-49043,vulnerability--6911253e-98ab-4b52-8696-fb10194568e2
+vulnerability,CVE-2023-50946,vulnerability--315e08cf-ea30-4d93-abf6-bb143fb0ae2c
+vulnerability,CVE-2023-50945,vulnerability--1aa7bf82-c8f8-4dbd-b863-cb02792c579b
+vulnerability,CVE-2023-38009,vulnerability--3b04503e-afef-4e38-8b97-34c9683f1440
+vulnerability,CVE-2025-24858,vulnerability--d455894a-0d7b-427e-9c24-ba9ad7813501
+vulnerability,CVE-2025-0722,vulnerability--896e383a-d42f-471c-aab8-f8936618d550
+vulnerability,CVE-2025-0720,vulnerability--a530e5cb-f0a2-4a0e-b366-8c5c0aa37620
+vulnerability,CVE-2025-0721,vulnerability--40804b94-48d9-461c-b895-67afe7937c05
+vulnerability,CVE-2017-20196,vulnerability--f80916cf-d6d9-4350-a2f3-92e92b97beb4

objects/vulnerability/vulnerability--0546b32e-8c1b-4c91-8543-7e7a97d04261.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--239727e0-6818-4ba1-8e21-8850b425f2bd",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--0546b32e-8c1b-4c91-8543-7e7a97d04261",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-27T01:43:50.009357Z",
+            "modified": "2025-01-27T01:43:50.009357Z",
+            "name": "CVE-2024-10636",
+            "description": "The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-10636"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--16e86a11-c915-4f11-b3bd-151239ed4aad.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--7b6df11b-412a-44b0-ab03-f532d14b9d0e",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--16e86a11-c915-4f11-b3bd-151239ed4aad",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-27T01:43:49.454123Z",
+            "modified": "2025-01-27T01:43:49.454123Z",
+            "name": "CVE-2024-12334",
+            "description": "The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via any parameter in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-12334"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--1aa7bf82-c8f8-4dbd-b863-cb02792c579b.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--d4425e7d-ea20-4d15-ada1-6fb41a52f6d9",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--1aa7bf82-c8f8-4dbd-b863-cb02792c579b",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-27T01:43:54.306154Z",
+            "modified": "2025-01-27T01:43:54.306154Z",
+            "name": "CVE-2023-50945",
+            "description": "IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-50945"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--315e08cf-ea30-4d93-abf6-bb143fb0ae2c.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--1bd0a74e-3fc3-41ef-950e-cb8cd4c93037",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--315e08cf-ea30-4d93-abf6-bb143fb0ae2c",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-27T01:43:54.282265Z",
+            "modified": "2025-01-27T01:43:54.282265Z",
+            "name": "CVE-2023-50946",
+            "description": "IBM Common Licensing 9.0  could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization mechanism.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-50946"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--3b04503e-afef-4e38-8b97-34c9683f1440.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--998563d4-851f-4a8f-ad61-af95565f374e",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--3b04503e-afef-4e38-8b97-34c9683f1440",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-27T01:43:54.901155Z",
+            "modified": "2025-01-27T01:43:54.901155Z",
+            "name": "CVE-2023-38009",
+            "description": "IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2023-38009"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--40804b94-48d9-461c-b895-67afe7937c05.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--86b7e6ec-c22a-4d51-91c5-4c456669d115",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--40804b94-48d9-461c-b895-67afe7937c05",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-27T01:44:00.117037Z",
+            "modified": "2025-01-27T01:44:00.117037Z",
+            "name": "CVE-2025-0721",
+            "description": "A vulnerability classified as problematic has been found in needyamin image_gallery 1.0. This affects the function image_gallery of the file /view.php. The manipulation of the argument username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-0721"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--530d4fa8-6862-47e8-83b4-25f1e10c93c9.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--5354d9c8-f04b-4544-9f78-dc160b9db093",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--530d4fa8-6862-47e8-83b4-25f1e10c93c9",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-27T01:43:50.423326Z",
+            "modified": "2025-01-27T01:43:50.423326Z",
+            "name": "CVE-2024-13505",
+            "description": "The Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ays_sections[5][questions][8][title]’ parameter in all versions up to, and including, 5.1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-13505"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--6911253e-98ab-4b52-8696-fb10194568e2.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--e1517236-1388-49cb-9c97-3fa19aa314cd",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--6911253e-98ab-4b52-8696-fb10194568e2",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-27T01:43:53.841799Z",
+            "modified": "2025-01-27T01:43:53.841799Z",
+            "name": "CVE-2022-49043",
+            "description": "xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2022-49043"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--6cc0e987-e8e4-46f1-b8c1-69da4ca2317d.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--a591e49f-8739-4701-a27c-bad733bb3eca",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--6cc0e987-e8e4-46f1-b8c1-69da4ca2317d",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-27T01:43:50.021338Z",
+            "modified": "2025-01-27T01:43:50.021338Z",
+            "name": "CVE-2024-10633",
+            "description": "The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency). This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-10633"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--72edfaa4-ef75-4ee6-bc19-4b6f769b5731.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--bff28a31-8b18-4838-af6a-07423e02e361",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--72edfaa4-ef75-4ee6-bc19-4b6f769b5731",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-27T01:43:50.017001Z",
+            "modified": "2025-01-27T01:43:50.017001Z",
+            "name": "CVE-2024-10628",
+            "description": "The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.  This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-10628"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--789d7891-e37e-4571-a8b5-7d5fd0c5f8a7.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--3873a8b5-67e0-4621-b0f6-4f9e5cc994cb",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--789d7891-e37e-4571-a8b5-7d5fd0c5f8a7",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-27T01:43:51.752174Z",
+            "modified": "2025-01-27T01:43:51.752174Z",
+            "name": "CVE-2024-11090",
+            "description": "The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.13 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-11090"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--7ab5267b-5a7b-42ed-9f43-38512cb9a151.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--f8934b25-3998-44b1-91e8-24bbce1f1ec4",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--7ab5267b-5a7b-42ed-9f43-38512cb9a151",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-27T01:43:51.703891Z",
+            "modified": "2025-01-27T01:43:51.703891Z",
+            "name": "CVE-2024-11936",
+            "description": "The Zox News theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backup_options' and 'restore_options' function in all versions up to, and including, 3.16.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-11936"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--896e383a-d42f-471c-aab8-f8936618d550.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--41feb50d-b98b-4a39-addd-9d1cbca2bc9f",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--896e383a-d42f-471c-aab8-f8936618d550",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-27T01:44:00.100069Z",
+            "modified": "2025-01-27T01:44:00.100069Z",
+            "name": "CVE-2025-0722",
+            "description": "A vulnerability classified as critical was found in needyamin image_gallery 1.0. This vulnerability affects unknown code of the file /admin/gallery.php of the component Cover Image Handler. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2025-0722"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--8dc64a10-87e7-4ca0-be50-e2090f3ef7a2.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--da884991-062f-4dea-9f2e-1ca3ebadf741",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--8dc64a10-87e7-4ca0-be50-e2090f3ef7a2",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-27T01:43:49.989869Z",
+            "modified": "2025-01-27T01:43:49.989869Z",
+            "name": "CVE-2024-10705",
+            "description": "The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.5 via the 'mpg_download_file_by_link' function. This makes it possible for authenticated attackers, with editor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-10705"
+                }
+            ]
+        }
+    ]
+}

objects/vulnerability/vulnerability--a38ec0f0-57ed-4614-9229-6a6789adaa4b.json

@@ -0,0 +1,22 @@
+{
+    "type": "bundle",
+    "id": "bundle--68270cf4-c05d-4d05-b0bc-1c241124f08f",
+    "objects": [
+        {
+            "type": "vulnerability",
+            "spec_version": "2.1",
+            "id": "vulnerability--a38ec0f0-57ed-4614-9229-6a6789adaa4b",
+            "created_by_ref": "identity--8ce3f695-d5a4-4dc8-9e93-a65af453a31a",
+            "created": "2025-01-27T01:43:49.841074Z",
+            "modified": "2025-01-27T01:43:49.841074Z",
+            "name": "CVE-2024-46881",
+            "description": "Develocity (formerly Gradle Enterprise) before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise Config schema version 8. Migration functionality from schema version 8 to versions 9 and 10 (in affected vulnerable versions) does not include the projects section of the configuration. This leads to all of the project settings being reset to their defaults when the old schema is loaded. In the case of projects.enabled, the default is false. Thus, using an enterprise config v8 results in Project level access control being disabled, even if it was previously enabled, and previously restricted project information disclosed. Most commonly, this occurs when a Develocity instance is upgraded from an earlier version. Specifically, this occurs if: Develocity 2023.3.X is upgraded to 2023.4.X; Develocity 2023.3.X is upgraded to 2024.1.X up to and including 2024.1.7; or Develocity 2023.4.X is upgraded to 2024.1.X up to and including 2024.1.7. The flaw does not occur when upgrading to a fixed version. An upgrade can only be triggered via administrator access, and cannot be forced by an external attacker.",
+            "external_references": [
+                {
+                    "source_name": "cve",
+                    "external_id": "CVE-2024-46881"
+                }
+            ]
+        }
+    ]
+}