From 15feff7d5642765d174e56266cb1aa1eff9a8e41 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Thu, 15 Feb 2024 07:00:34 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2023/46xxx/CVE-2023-46595.json | 2 +- 2023/46xxx/CVE-2023-46596.json | 97 ++++++++++++++++++++++++++++++++-- 2023/47xxx/CVE-2023-47256.json | 5 ++ 2023/47xxx/CVE-2023-47257.json | 5 ++ 2023/6xxx/CVE-2023-6246.json | 43 ++++++++------- 2023/6xxx/CVE-2023-6779.json | 29 +++++----- 2024/0xxx/CVE-2024-0708.json | 75 ++++++++++++++++++++++++-- 2024/1xxx/CVE-2024-1524.json | 18 +++++++ 2024/21xxx/CVE-2024-21727.json | 68 ++++++++++++++++++++++-- 9 files changed, 297 insertions(+), 45 deletions(-) create mode 100644 2024/1xxx/CVE-2024-1524.json diff --git a/2023/46xxx/CVE-2023-46595.json b/2023/46xxx/CVE-2023-46595.json index 8789d211b4a..35d08884bc3 100644 --- a/2023/46xxx/CVE-2023-46595.json +++ b/2023/46xxx/CVE-2023-46595.json @@ -11,7 +11,7 @@ "description_data": [ { "lang": "eng", - "value": "Net-NTLM leak in Fireflow A32.20 and A32.50 allows an attacker\u00a0to obtain victim\u2019s domain credentials and Net-NTLM hash which can lead\u00a0to relay domain attacks.\n\n" + "value": "Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor\u00a0allows an attacker\u00a0to obtain victim\u2019s domain credentials and Net-NTLM hash which can lead\u00a0to relay domain attacks. Fixed in\u00a0A32.20 (b570 or above), A32.50 (b390 or above)\n\n" } ] }, diff --git a/2023/46xxx/CVE-2023-46596.json b/2023/46xxx/CVE-2023-46596.json index cdf57282812..dfcb8af4ee0 100644 --- a/2023/46xxx/CVE-2023-46596.json +++ b/2023/46xxx/CVE-2023-46596.json @@ -1,17 +1,106 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-46596", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security.vulnerabilities@algosec.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Improper input validation in Algosec FireFlow VisualFlow workflow editor via Name, Description and Configuration File field in\u00a0version A32.20, A32.50, A32.60 permits an attacker to initiate an XSS attack by injecting malicious executable scripts into the application's code. Fixed in version\u00a0A32.20 (b600 and\nabove),\u00a0A32.50 (b430 and\nabove),\u00a0A32.60 (b250 and\nabove)" + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Algosec", + "product": { + "product_data": [ + { + "product_name": "Algosec FireFlow", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "A32.10, A32.20, A32.50" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://cwe.mitre.org/data/definitions/79.html", + "refsource": "MISC", + "name": "https://cwe.mitre.org/data/definitions/79.html" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "EXTERNAL" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "\n\nUpgrade ASMS suite to \n\nA32.20 (b600 and\nabove), A32.50 (b430 and\nabove), A32.60 (b250 and\nabove)\n\n\n\n
https://portal.algosec.com/en/downloads/hotfix_releases
" + } + ], + "value": "\nUpgrade ASMS suite to \n\nA32.20 (b600 and\nabove), A32.50 (b430 and\nabove), A32.60 (b250 and\nabove)\n\n\n\n\n https://portal.algosec.com/en/downloads/hotfix_releases https://portal.algosec.com/en/downloads/hotfix_releases \n" + } + ], + "credits": [ + { + "lang": "en", + "value": "Micha\u0142 Bogdanowicz from Nordea Bank ABP (https://www.linkedin.com/in/micha%C5%82-bogdanowicz-603267a8/)" + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "HIGH", + "attackVector": "ADJACENT_NETWORK", + "availabilityImpact": "LOW", + "baseScore": 5.1, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "HIGH", + "integrityImpact": "LOW", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:L", + "version": "3.1" } ] } diff --git a/2023/47xxx/CVE-2023-47256.json b/2023/47xxx/CVE-2023-47256.json index 5a2d3f91482..fb9d834d83b 100644 --- a/2023/47xxx/CVE-2023-47256.json +++ b/2023/47xxx/CVE-2023-47256.json @@ -56,6 +56,11 @@ "refsource": "MISC", "name": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.8-security-fix", "url": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.8-security-fix" + }, + { + "refsource": "MISC", + "name": "https://web.archive.org/web/20240208140218/https://gotham-security.com/screenconnect-cve-2023-47256", + "url": "https://web.archive.org/web/20240208140218/https://gotham-security.com/screenconnect-cve-2023-47256" } ] } diff --git a/2023/47xxx/CVE-2023-47257.json b/2023/47xxx/CVE-2023-47257.json index e42d24f182c..62c215a9e5c 100644 --- a/2023/47xxx/CVE-2023-47257.json +++ b/2023/47xxx/CVE-2023-47257.json @@ -56,6 +56,11 @@ "refsource": "MISC", "name": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.8-security-fix", "url": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.8-security-fix" + }, + { + "refsource": "MISC", + "name": "https://web.archive.org/web/20240208140218/https://gotham-security.com/screenconnect-cve-2023-47256", + "url": "https://web.archive.org/web/20240208140218/https://gotham-security.com/screenconnect-cve-2023-47256" } ] } diff --git a/2023/6xxx/CVE-2023-6246.json b/2023/6xxx/CVE-2023-6246.json index 7a494efcfb0..6af3a33d35c 100644 --- a/2023/6xxx/CVE-2023-6246.json +++ b/2023/6xxx/CVE-2023-6246.json @@ -152,21 +152,6 @@ }, "references": { "reference_data": [ - { - "url": "https://access.redhat.com/security/cve/CVE-2023-6246", - "refsource": "MISC", - "name": "https://access.redhat.com/security/cve/CVE-2023-6246" - }, - { - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2249053", - "refsource": "MISC", - "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2249053" - }, - { - "url": "https://www.openwall.com/lists/oss-security/2024/01/30/6", - "refsource": "MISC", - "name": "https://www.openwall.com/lists/oss-security/2024/01/30/6" - }, { "url": "http://packetstormsecurity.com/files/176931/glibc-qsort-Out-Of-Bounds-Read-Write.html", "refsource": "MISC", @@ -177,6 +162,26 @@ "refsource": "MISC", "name": "http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html" }, + { + "url": "http://seclists.org/fulldisclosure/2024/Feb/3", + "refsource": "MISC", + "name": "http://seclists.org/fulldisclosure/2024/Feb/3" + }, + { + "url": "http://seclists.org/fulldisclosure/2024/Feb/5", + "refsource": "MISC", + "name": "http://seclists.org/fulldisclosure/2024/Feb/5" + }, + { + "url": "https://access.redhat.com/security/cve/CVE-2023-6246", + "refsource": "MISC", + "name": "https://access.redhat.com/security/cve/CVE-2023-6246" + }, + { + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2249053", + "refsource": "MISC", + "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2249053" + }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2FIH77VHY3KCRROCXOT6L27WMZXSJ2G/", "refsource": "MISC", @@ -193,14 +198,14 @@ "name": "https://security.gentoo.org/glsa/202402-01" }, { - "url": "http://seclists.org/fulldisclosure/2024/Feb/3", + "url": "https://www.openwall.com/lists/oss-security/2024/01/30/6", "refsource": "MISC", - "name": "http://seclists.org/fulldisclosure/2024/Feb/3" + "name": "https://www.openwall.com/lists/oss-security/2024/01/30/6" }, { - "url": "http://seclists.org/fulldisclosure/2024/Feb/5", + "url": "https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt", "refsource": "MISC", - "name": "http://seclists.org/fulldisclosure/2024/Feb/5" + "name": "https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt" } ] }, diff --git a/2023/6xxx/CVE-2023-6779.json b/2023/6xxx/CVE-2023-6779.json index c23ed63397b..f8d3feb8fba 100644 --- a/2023/6xxx/CVE-2023-6779.json +++ b/2023/6xxx/CVE-2023-6779.json @@ -152,6 +152,16 @@ }, "references": { "reference_data": [ + { + "url": "http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html", + "refsource": "MISC", + "name": "http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html" + }, + { + "url": "http://seclists.org/fulldisclosure/2024/Feb/3", + "refsource": "MISC", + "name": "http://seclists.org/fulldisclosure/2024/Feb/3" + }, { "url": "https://access.redhat.com/security/cve/CVE-2023-6779", "refsource": "MISC", @@ -162,16 +172,6 @@ "refsource": "MISC", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2254395" }, - { - "url": "https://www.openwall.com/lists/oss-security/2024/01/30/6", - "refsource": "MISC", - "name": "https://www.openwall.com/lists/oss-security/2024/01/30/6" - }, - { - "url": "http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html", - "refsource": "MISC", - "name": "http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html" - }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D2FIH77VHY3KCRROCXOT6L27WMZXSJ2G/", "refsource": "MISC", @@ -188,9 +188,14 @@ "name": "https://security.gentoo.org/glsa/202402-01" }, { - "url": "http://seclists.org/fulldisclosure/2024/Feb/3", + "url": "https://www.openwall.com/lists/oss-security/2024/01/30/6", "refsource": "MISC", - "name": "http://seclists.org/fulldisclosure/2024/Feb/3" + "name": "https://www.openwall.com/lists/oss-security/2024/01/30/6" + }, + { + "url": "https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt", + "refsource": "MISC", + "name": "https://www.qualys.com/2024/01/30/cve-2023-6246/syslog.txt" } ] }, diff --git a/2024/0xxx/CVE-2024-0708.json b/2024/0xxx/CVE-2024-0708.json index 87b6be7e62c..c116975d60b 100644 --- a/2024/0xxx/CVE-2024-0708.json +++ b/2024/0xxx/CVE-2024-0708.json @@ -1,17 +1,84 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-0708", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@wordfence.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The Landing Page Cat \u2013 Coming Soon Page, Maintenance Page & Squeeze Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.7.2. This makes it possible for unauthenticated attackers to access landing pages that may not be public." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-200 Information Exposure" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "fatcatapps", + "product": { + "product_data": [ + { + "product_name": "Landing Page Cat \u2013 Coming Soon Page, Maintenance Page & Squeeze Pages", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "*", + "version_value": "1.7.2" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b34f50a-4d2d-49b8-86e4-0416c8be202b?source=cve", + "refsource": "MISC", + "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b34f50a-4d2d-49b8-86e4-0416c8be202b?source=cve" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset/3034324/landing-page-cat/trunk/includes/landing/landing.php", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/changeset/3034324/landing-page-cat/trunk/includes/landing/landing.php" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Nathaniel Oh" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", + "baseScore": 5.3, + "baseSeverity": "MEDIUM" } ] } diff --git a/2024/1xxx/CVE-2024-1524.json b/2024/1xxx/CVE-2024-1524.json new file mode 100644 index 00000000000..4f4567dbfdc --- /dev/null +++ b/2024/1xxx/CVE-2024-1524.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-1524", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/21xxx/CVE-2024-21727.json b/2024/21xxx/CVE-2024-21727.json index d49b54b9b6c..6309f4ba677 100644 --- a/2024/21xxx/CVE-2024-21727.json +++ b/2024/21xxx/CVE-2024-21727.json @@ -1,18 +1,76 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-21727", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@joomla.org", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "XSS vulnerability in DP Calendar component for Joomla." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "digital-peak.com", + "product": { + "product_data": [ + { + "product_name": "DP Calendar for Joomla", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "8.0.0-8.14.0" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://extensions.joomla.org/extension/dpcalendar/", + "refsource": "MISC", + "name": "https://extensions.joomla.org/extension/dpcalendar/" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "UNKNOWN" + }, + "credits": [ + { + "lang": "en", + "value": "Sai Krishna P and Siva Pothuluru S" + } + ] } \ No newline at end of file