From 16ed29b7a17dc2686aa5747e5683171ed631786c Mon Sep 17 00:00:00 2001 From: CVE Team Date: Fri, 6 Dec 2024 12:00:32 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2023/34xxx/CVE-2023-34968.json | 3 +- 2023/39xxx/CVE-2023-39418.json | 3 +- 2023/3xxx/CVE-2023-3347.json | 3 +- 2023/5xxx/CVE-2023-5115.json | 3 +- 2023/5xxx/CVE-2023-5189.json | 3 +- 2023/5xxx/CVE-2023-5625.json | 3 +- 2024/11xxx/CVE-2024-11729.json | 76 ++++++++++++++++++++++++++++++++-- 2024/11xxx/CVE-2024-11730.json | 76 ++++++++++++++++++++++++++++++++-- 2024/53xxx/CVE-2024-53907.json | 66 ++++++++++++++++++++++++++--- 2024/53xxx/CVE-2024-53908.json | 66 ++++++++++++++++++++++++++--- 10 files changed, 276 insertions(+), 26 deletions(-) diff --git a/2023/34xxx/CVE-2023-34968.json b/2023/34xxx/CVE-2023-34968.json index 3d2e59ab688..c106ce41c52 100644 --- a/2023/34xxx/CVE-2023-34968.json +++ b/2023/34xxx/CVE-2023-34968.json @@ -21,7 +21,8 @@ "description": [ { "lang": "eng", - "value": "n/a" + "value": "Insertion of Sensitive Information Into Sent Data", + "cweId": "CWE-201" } ] } diff --git a/2023/39xxx/CVE-2023-39418.json b/2023/39xxx/CVE-2023-39418.json index 141e355feda..cbeed3ad50a 100644 --- a/2023/39xxx/CVE-2023-39418.json +++ b/2023/39xxx/CVE-2023-39418.json @@ -21,7 +21,8 @@ "description": [ { "lang": "eng", - "value": "n/a" + "value": "Insufficient Granularity of Access Control", + "cweId": "CWE-1220" } ] } diff --git a/2023/3xxx/CVE-2023-3347.json b/2023/3xxx/CVE-2023-3347.json index aaedbcd2546..4d6924c9c0c 100644 --- a/2023/3xxx/CVE-2023-3347.json +++ b/2023/3xxx/CVE-2023-3347.json @@ -21,7 +21,8 @@ "description": [ { "lang": "eng", - "value": "n/a" + "value": "Improper Verification of Cryptographic Signature", + "cweId": "CWE-347" } ] } diff --git a/2023/5xxx/CVE-2023-5115.json b/2023/5xxx/CVE-2023-5115.json index 6cdad428aa3..f2264a1c97a 100644 --- a/2023/5xxx/CVE-2023-5115.json +++ b/2023/5xxx/CVE-2023-5115.json @@ -21,7 +21,8 @@ "description": [ { "lang": "eng", - "value": "n/a" + "value": "Absolute Path Traversal", + "cweId": "CWE-36" } ] } diff --git a/2023/5xxx/CVE-2023-5189.json b/2023/5xxx/CVE-2023-5189.json index 831ae23dc2f..213894ed283 100644 --- a/2023/5xxx/CVE-2023-5189.json +++ b/2023/5xxx/CVE-2023-5189.json @@ -21,7 +21,8 @@ "description": [ { "lang": "eng", - "value": "n/a" + "value": "Relative Path Traversal", + "cweId": "CWE-23" } ] } diff --git a/2023/5xxx/CVE-2023-5625.json b/2023/5xxx/CVE-2023-5625.json index 154b18624e0..dd0ee5c2626 100644 --- a/2023/5xxx/CVE-2023-5625.json +++ b/2023/5xxx/CVE-2023-5625.json @@ -21,7 +21,8 @@ "description": [ { "lang": "eng", - "value": "n/a" + "value": "Allocation of Resources Without Limits or Throttling", + "cweId": "CWE-770" } ] } diff --git a/2024/11xxx/CVE-2024-11729.json b/2024/11xxx/CVE-2024-11729.json index 5deacb21caa..b47ce8661d2 100644 --- a/2024/11xxx/CVE-2024-11729.json +++ b/2024/11xxx/CVE-2024-11729.json @@ -1,17 +1,85 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-11729", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@wordfence.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The KiviCare \u2013 Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'service_list[0][service_id]' parameter of the get_widget_payment_options AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", + "cweId": "CWE-89" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "iqonicdesign", + "product": { + "product_data": [ + { + "product_name": "KiviCare \u2013 Clinic & Patient Management System (EHR)", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "*", + "version_value": "3.6.4" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/86632212-37b5-4280-8a2a-163957ad9787?source=cve", + "refsource": "MISC", + "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/86632212-37b5-4280-8a2a-163957ad9787?source=cve" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset/3201428/kivicare-clinic-management-system/trunk/app/controllers/KCBookAppointmentWidgetController.php", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/changeset/3201428/kivicare-clinic-management-system/trunk/app/controllers/KCBookAppointmentWidgetController.php" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Khayal Farzaliyev" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "baseScore": 6.5, + "baseSeverity": "MEDIUM" } ] } diff --git a/2024/11xxx/CVE-2024-11730.json b/2024/11xxx/CVE-2024-11730.json index 11bdb017b9e..682c1a7c30e 100644 --- a/2024/11xxx/CVE-2024-11730.json +++ b/2024/11xxx/CVE-2024-11730.json @@ -1,17 +1,85 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-11730", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@wordfence.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The KiviCare \u2013 Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'sort[]' parameter of the static_data_list AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with doctor/receptionist-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", + "cweId": "CWE-89" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "iqonicdesign", + "product": { + "product_data": [ + { + "product_name": "KiviCare \u2013 Clinic & Patient Management System (EHR)", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "*", + "version_value": "3.6.4" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30f2a3ee-7f95-478c-b3d7-c254b9472d42?source=cve", + "refsource": "MISC", + "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/30f2a3ee-7f95-478c-b3d7-c254b9472d42?source=cve" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset/3201428/kivicare-clinic-management-system/trunk/app/controllers/KCStaticDataController.php", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/changeset/3201428/kivicare-clinic-management-system/trunk/app/controllers/KCStaticDataController.php" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Khayal Farzaliyev" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "baseScore": 6.5, + "baseSeverity": "MEDIUM" } ] } diff --git a/2024/53xxx/CVE-2024-53907.json b/2024/53xxx/CVE-2024-53907.json index f6da49c2498..438550736c6 100644 --- a/2024/53xxx/CVE-2024-53907.json +++ b/2024/53xxx/CVE-2024-53907.json @@ -1,17 +1,71 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2024-53907", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2024-53907", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack via certain inputs containing large sequences of nested incomplete HTML entities." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://docs.djangoproject.com/en/dev/releases/security/", + "refsource": "MISC", + "name": "https://docs.djangoproject.com/en/dev/releases/security/" + }, + { + "url": "https://groups.google.com/g/django-announce", + "refsource": "MISC", + "name": "https://groups.google.com/g/django-announce" + }, + { + "refsource": "CONFIRM", + "name": "https://www.openwall.com/lists/oss-security/2024/12/04/3", + "url": "https://www.openwall.com/lists/oss-security/2024/12/04/3" } ] } diff --git a/2024/53xxx/CVE-2024-53908.json b/2024/53xxx/CVE-2024-53908.json index f5267513203..6d79c87280a 100644 --- a/2024/53xxx/CVE-2024-53908.json +++ b/2024/53xxx/CVE-2024-53908.json @@ -1,17 +1,71 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2024-53908", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2024-53908", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. (Applications that use the jsonfield.has_key lookup via __ are unaffected.)" + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://docs.djangoproject.com/en/dev/releases/security/", + "refsource": "MISC", + "name": "https://docs.djangoproject.com/en/dev/releases/security/" + }, + { + "url": "https://groups.google.com/g/django-announce", + "refsource": "MISC", + "name": "https://groups.google.com/g/django-announce" + }, + { + "refsource": "MISC", + "name": "https://www.openwall.com/lists/oss-security/2024/12/04/3", + "url": "https://www.openwall.com/lists/oss-security/2024/12/04/3" } ] }