diff --git a/2021/0xxx/CVE-2021-0583.json b/2021/0xxx/CVE-2021-0583.json index a3eb31beee8..888dde23547 100644 --- a/2021/0xxx/CVE-2021-0583.json +++ b/2021/0xxx/CVE-2021-0583.json @@ -4,14 +4,58 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-0583", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_value": "Android-9 Android-10" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Elevation of privilege" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/aaos/2021-10-01", + "url": "https://source.android.com/security/bulletin/aaos/2021-10-01" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In onCreate of BluetoothPairingDialog, there is a possible way to enable Bluetooth without user consent due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID: A-182282956" } ] } diff --git a/2021/27xxx/CVE-2021-27664.json b/2021/27xxx/CVE-2021-27664.json index e1098837bd2..888db88eb1c 100644 --- a/2021/27xxx/CVE-2021-27664.json +++ b/2021/27xxx/CVE-2021-27664.json @@ -1,18 +1,105 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { + "ASSIGNER": "productsecurity@jci.com", + "DATE_PUBLIC": "2021-10-07T18:16:00.000Z", "ID": "CVE-2021-27664", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "STATE": "PUBLIC", + "TITLE": "exacqVision Web Service" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "exacqVision Web Service", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "21.06.11.0", + "version_value": "21.06.11.0" + } + ] + } + } + ] + }, + "vendor_name": "Johnson Controls" + } + ] + } + }, + "credit": [ + { + "lang": "eng", + "value": "Tenable Research" + } + ], + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Under certain configurations an unauthenticated remote user could be given access to credentials stored in the exacqVision Server." } ] + }, + "generator": { + "engine": "Vulnogram 0.0.9" + }, + "impact": { + "cvss": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 9.8, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "version": "3.1" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-269: Improper Privilege Management" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories", + "refsource": "CONFIRM", + "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories" + }, + { + "name": "ICS-CERT Advisory", + "refsource": "CERT", + "url": "https://us-cert.gov/ics/advisories/icsa-21-280-01" + } + ] + }, + "solution": [ + { + "lang": "eng", + "value": "Upgrade exacqVision Web Service to version 21.09.\n\nCurrent users can obtain the critical software update from the Software Download location at: https://www.exacq.com/support/downloads.php\n" + } + ], + "source": { + "discovery": "EXTERNAL" } } \ No newline at end of file diff --git a/2021/27xxx/CVE-2021-27665.json b/2021/27xxx/CVE-2021-27665.json index 8639595c60a..4c5d3831117 100644 --- a/2021/27xxx/CVE-2021-27665.json +++ b/2021/27xxx/CVE-2021-27665.json @@ -1,18 +1,105 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { + "ASSIGNER": "productsecurity@jci.com", + "DATE_PUBLIC": "2021-10-07T18:16:00.000Z", "ID": "CVE-2021-27665", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "STATE": "PUBLIC", + "TITLE": "exacqVision Server 32-bit" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "exacqVision Web Service", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "21.06.11.0", + "version_value": "21.06.11.0" + } + ] + } + } + ] + }, + "vendor_name": "Johnson Controls" + } + ] + } + }, + "credit": [ + { + "lang": "eng", + "value": "Tenable Research" + } + ], + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An unauthenticated remote user could exploit a potential integer overflow condition in the exacqVision Server with a specially crafted script and cause denial-of-service condition." } ] + }, + "generator": { + "engine": "Vulnogram 0.0.9" + }, + "impact": { + "cvss": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "version": "3.1" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-190: Integer Overflow or Wraparound" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "name": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories", + "refsource": "CONFIRM", + "url": "https://www.johnsoncontrols.com/cyber-solutions/security-advisories" + }, + { + "name": "ICS-CERT Advisory", + "refsource": "CERT", + "url": "https://us-cert.gov/ics/advisories/icsa-21-280-03" + } + ] + }, + "solution": [ + { + "lang": "eng", + "value": "Upgrade exacqVision Server 32-bit to version 21.09 or upgrade to exacqVision Server 64-bit\n\nCurrent users can obtain the critical software update from the Software Download location at: https://www.exacq.com/support/downloads.php\n" + } + ], + "source": { + "discovery": "EXTERNAL" } } \ No newline at end of file diff --git a/2021/37xxx/CVE-2021-37123.json b/2021/37xxx/CVE-2021-37123.json index d9e9e96dd65..38dffcea958 100644 --- a/2021/37xxx/CVE-2021-37123.json +++ b/2021/37xxx/CVE-2021-37123.json @@ -4,14 +4,58 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-37123", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@huawei.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "Hero-CT060", + "version": { + "version_data": [ + { + "version_value": "before 1.0.0.200" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Improper Authentication" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210929-01-auth-en", + "url": "https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210929-01-auth-en" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "There is an improper authentication vulnerability in Hero-CT060 before 1.0.0.200. The vulnerability is due to that when an user wants to do certain operation, the software does not insufficiently validate the user's identity. Successful exploit could allow the attacker to do certain operations which the user are supposed not to do." } ] } diff --git a/2021/39xxx/CVE-2021-39317.json b/2021/39xxx/CVE-2021-39317.json index f5c896877b0..e2901faf105 100644 --- a/2021/39xxx/CVE-2021-39317.json +++ b/2021/39xxx/CVE-2021-39317.json @@ -1,18 +1,111 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { + "AKA": "Wordfence", + "ASSIGNER": "security@wordfence.com", + "DATE_PUBLIC": "2021-10-06T19:17:00.000Z", "ID": "CVE-2021-39317", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "STATE": "PUBLIC", + "TITLE": "Access Demo Importer <= 1.0.6 Authenticated Arbitrary File Upload" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "Access Demo Importer", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "1.0.6", + "version_value": "1.0.6" + } + ] + } + } + ] + }, + "vendor_name": "AccessPress Themes" + } + ] + } + }, + "credit": [ + { + "lang": "eng", + "value": "Chloe Chamberland, Wordfence" + } + ], + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Versions up to, and including, 1.0.6, of the Access Demo Importer WordPress plugin are vulnerable to arbitrary file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the ~/inc/demo-functions.php." } ] + }, + "generator": { + "engine": "Vulnogram 0.0.9" + }, + "impact": { + "cvss": { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "version": "3.1" + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-285 Improper Authorization" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "url": "https://www.wordfence.com/blog/2021/10/high-severity-vulnerability-patched-in-access-demo-importer-plugin/", + "name": "https://www.wordfence.com/blog/2021/10/high-severity-vulnerability-patched-in-access-demo-importer-plugin/" + }, + { + "refsource": "MISC", + "url": "https://plugins.trac.wordpress.org/changeset/2592642/access-demo-importer/trunk/inc/demo-functions.php", + "name": "https://plugins.trac.wordpress.org/changeset/2592642/access-demo-importer/trunk/inc/demo-functions.php" + }, + { + "refsource": "MISC", + "url": "https://plugins.trac.wordpress.org/changeset/2602132/access-demo-importer/trunk/inc/demo-functions.php", + "name": "https://plugins.trac.wordpress.org/changeset/2602132/access-demo-importer/trunk/inc/demo-functions.php" + } + ] + }, + "solution": [ + { + "lang": "eng", + "value": "Update to version 1.0.7 or newer. " + } + ], + "source": { + "discovery": "INTERNAL" } } \ No newline at end of file diff --git a/2021/40xxx/CVE-2021-40870.json b/2021/40xxx/CVE-2021-40870.json index af2adc4dd4a..2b52dcfa0cc 100644 --- a/2021/40xxx/CVE-2021-40870.json +++ b/2021/40xxx/CVE-2021-40870.json @@ -61,6 +61,11 @@ "url": "https://wearetradecraft.com/advisories/tc-2021-0002/", "refsource": "MISC", "name": "https://wearetradecraft.com/advisories/tc-2021-0002/" + }, + { + "refsource": "MISC", + "name": "http://packetstormsecurity.com/files/164461/Aviatrix-Controller-6.x-Path-Traversal-Code-Execution.html", + "url": "http://packetstormsecurity.com/files/164461/Aviatrix-Controller-6.x-Path-Traversal-Code-Execution.html" } ] }