diff --git a/2024/10xxx/CVE-2024-10525.json b/2024/10xxx/CVE-2024-10525.json index 8a1fe930545..a8aee62d171 100644 --- a/2024/10xxx/CVE-2024-10525.json +++ b/2024/10xxx/CVE-2024-10525.json @@ -64,6 +64,11 @@ "url": "https://mosquitto.org/blog/2024/10/version-2-0-19-released/", "refsource": "MISC", "name": "https://mosquitto.org/blog/2024/10/version-2-0-19-released/" + }, + { + "url": "https://github.com/eclipse-mosquitto/mosquitto/commit/8ab20b4ba4204fdcdec78cb4d9f03c944a6e0e1c", + "refsource": "MISC", + "name": "https://github.com/eclipse-mosquitto/mosquitto/commit/8ab20b4ba4204fdcdec78cb4d9f03c944a6e0e1c" } ] }, diff --git a/2024/3xxx/CVE-2024-3935.json b/2024/3xxx/CVE-2024-3935.json index d87e881d8f0..b4e1e3f6c0b 100644 --- a/2024/3xxx/CVE-2024-3935.json +++ b/2024/3xxx/CVE-2024-3935.json @@ -64,6 +64,11 @@ "url": "https://mosquitto.org/blog/2024/10/version-2-0-19-released/", "refsource": "MISC", "name": "https://mosquitto.org/blog/2024/10/version-2-0-19-released/" + }, + { + "url": "https://github.com/eclipse-mosquitto/mosquitto/commit/ae7a804dadac8f2aaedb24336df8496a9680fda9", + "refsource": "MISC", + "name": "https://github.com/eclipse-mosquitto/mosquitto/commit/ae7a804dadac8f2aaedb24336df8496a9680fda9" } ] }, diff --git a/2024/43xxx/CVE-2024-43383.json b/2024/43xxx/CVE-2024-43383.json index 786506ddd42..f2f133139f9 100644 --- a/2024/43xxx/CVE-2024-43383.json +++ b/2024/43xxx/CVE-2024-43383.json @@ -1,17 +1,98 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-43383", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@apache.org", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator.\n\nThis issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016.\n\nAn attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exception type. This can result in remote code execution or other potential unauthorized access.\n\n\nUsers are recommended to upgrade to version 4.8.0-beta00017, which fixes the issue." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-502 Deserialization of Untrusted Data", + "cweId": "CWE-502" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Apache Software Foundation", + "product": { + "product_data": [ + { + "product_name": "Apache Lucene.Net.Replicator", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "4.8.0-beta00005", + "version_value": "4.8.0-beta00016" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://lists.apache.org/thread/wlz1p76dxpt4rl9o29voxjd5zl7717nh", + "refsource": "MISC", + "name": "https://lists.apache.org/thread/wlz1p76dxpt4rl9o29voxjd5zl7717nh" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "EXTERNAL" + }, + "credits": [ + { + "lang": "en", + "value": "Summ3r, Vidar-Team" + }, + { + "lang": "en", + "value": "Apache Lucene" + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "ADJACENT_NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "version": "3.1" } ] } diff --git a/2024/49xxx/CVE-2024-49685.json b/2024/49xxx/CVE-2024-49685.json index d2e8ec36ded..d12515ef961 100644 --- a/2024/49xxx/CVE-2024-49685.json +++ b/2024/49xxx/CVE-2024-49685.json @@ -1,17 +1,122 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-49685", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "audit@patchstack.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) allows Cross Site Request Forgery.This issue affects Custom Twitter Feeds (Tweets Widget): from n/a through 2.2.3." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-352 Cross-Site Request Forgery (CSRF)", + "cweId": "CWE-352" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Smash Balloon", + "product": { + "product_data": [ + { + "product_name": "Custom Twitter Feeds (Tweets Widget)", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "versions": [ + { + "changes": [ + { + "at": "2.2.4", + "status": "unaffected" + } + ], + "lessThanOrEqual": "2.2.3", + "status": "affected", + "version": "n/a", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://patchstack.com/database/vulnerability/custom-twitter-feeds/wordpress-custom-twitter-feeds-plugin-2-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", + "refsource": "MISC", + "name": "https://patchstack.com/database/vulnerability/custom-twitter-feeds/wordpress-custom-twitter-feeds-plugin-2-2-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "EXTERNAL" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Update to 2.2.4 or a higher version." + } + ], + "value": "Update to 2.2.4 or a higher version." + } + ], + "credits": [ + { + "lang": "en", + "value": "Rafie Muhammad (Patchstack)" + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 5.4, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", + "version": "3.1" } ] } diff --git a/2024/8xxx/CVE-2024-8376.json b/2024/8xxx/CVE-2024-8376.json index 55410b2de9d..eaa70a10281 100644 --- a/2024/8xxx/CVE-2024-8376.json +++ b/2024/8xxx/CVE-2024-8376.json @@ -118,6 +118,11 @@ "url": "https://mosquitto.org/", "refsource": "MISC", "name": "https://mosquitto.org/" + }, + { + "url": "https://github.com/eclipse-mosquitto/mosquitto/commit/1914b3ee2a18102d0a94cbdbbfeae1afa03edd17", + "refsource": "MISC", + "name": "https://github.com/eclipse-mosquitto/mosquitto/commit/1914b3ee2a18102d0a94cbdbbfeae1afa03edd17" } ] },