mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-05-08 19:46:39 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
b2d1ed2d48
commit
1557c7ae5d
@ -1,18 +1,106 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-7398",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security@concretecms.org",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Users or groups with permission to create event calendars can embed scripts, and users or groups with permission to modify event calendars can execute scripts.\u00a0The Concrete CMS Security Team gave this vulnerability a CVSS v4 score of 1.8 with vector CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N .\u00a0Thank you, Yusuke Uchida for reporting."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')",
|
||||
"cweId": "CWE-79"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Concrete CMS",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Concrete CMS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "9.0.0",
|
||||
"version_value": "9.3.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "5.0.0",
|
||||
"version_value": "8.5.19"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/concretecms/concretecms/commit/7c8ed0d1d9db0d7f6df7fa066e0858ea618451a5",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/concretecms/concretecms/commit/7c8ed0d1d9db0d7f6df7fa066e0858ea618451a5"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/concretecms/concretecms/pull/12183",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/concretecms/concretecms/pull/12183"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/concretecms/concretecms/pull/12184",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/concretecms/concretecms/pull/12184"
|
||||
},
|
||||
{
|
||||
"url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/934-release-notes",
|
||||
"refsource": "MISC",
|
||||
"name": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/934-release-notes"
|
||||
},
|
||||
{
|
||||
"url": "https://documentation.concretecms.org/developers/introduction/version-history/8519-release-notes",
|
||||
"refsource": "MISC",
|
||||
"name": "https://documentation.concretecms.org/developers/introduction/version-history/8519-release-notes"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
},
|
||||
"source": {
|
||||
"advisory": "2400810",
|
||||
"defect": [
|
||||
"HackerOne"
|
||||
],
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Yusuke Uchida"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -1,18 +1,101 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-8291",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security@concretecms.org",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color.\u00a0 A rogue admin could add malicious code to the Thumbnails/Add-Type. The Concrete CMS Security Team gave this a CVSS v4 score of 2.1 with vector CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N \u00a0Thanks,\u00a0 Alexey Solovyev for reporting."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
|
||||
"cweId": "CWE-22"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Concrete CMS",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Concrete CMS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "9.0.0",
|
||||
"version_value": "9.3.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "5.0.0",
|
||||
"version_value": "8.5.19"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/concretecms/concretecms/pull/12183",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/concretecms/concretecms/pull/12183"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/concretecms/concretecms/commit/dbce253166f6b10ff3e0c09e50fd395370b8b065",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/concretecms/concretecms/commit/dbce253166f6b10ff3e0c09e50fd395370b8b065"
|
||||
},
|
||||
{
|
||||
"url": "https://documentation.concretecms.org/developers/introduction/version-history/8519-release-notes",
|
||||
"refsource": "MISC",
|
||||
"name": "https://documentation.concretecms.org/developers/introduction/version-history/8519-release-notes"
|
||||
},
|
||||
{
|
||||
"url": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/934-release-notes",
|
||||
"refsource": "MISC",
|
||||
"name": "https://documentation.concretecms.org/9-x/developers/introduction/version-history/934-release-notes"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
},
|
||||
"source": {
|
||||
"advisory": "921527",
|
||||
"defect": [
|
||||
"HackerOne"
|
||||
],
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Alexey Solovyev"
|
||||
}
|
||||
]
|
||||
}
|
||||
18
2024/9xxx/CVE-2024-9170.json
Normal file
18
2024/9xxx/CVE-2024-9170.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-9170",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user