From 1de17c009db3ddef6dfeecb874aa1baacf6718ec Mon Sep 17 00:00:00 2001 From: CVE Team Date: Wed, 16 Oct 2024 17:00:30 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2023/32xxx/CVE-2023-32266.json | 129 +++++++++++++++++- 2024/10xxx/CVE-2024-10033.json | 85 +++++++++++- 2024/10xxx/CVE-2024-10041.json | 18 +++ 2024/10xxx/CVE-2024-10042.json | 18 +++ 2024/10xxx/CVE-2024-10043.json | 18 +++ 2024/10xxx/CVE-2024-10044.json | 18 +++ 2024/20xxx/CVE-2024-20280.json | 233 ++++++++++++++++++++++++++++++++- 2024/20xxx/CVE-2024-20420.json | 141 +++++++++++++++++++- 2024/20xxx/CVE-2024-20421.json | 145 +++++++++++++++++++- 2024/20xxx/CVE-2024-20458.json | 145 +++++++++++++++++++- 2024/20xxx/CVE-2024-20459.json | 145 +++++++++++++++++++- 2024/20xxx/CVE-2024-20460.json | 145 +++++++++++++++++++- 2024/20xxx/CVE-2024-20461.json | 145 +++++++++++++++++++- 2024/20xxx/CVE-2024-20462.json | 121 ++++++++++++++++- 2024/20xxx/CVE-2024-20463.json | 145 +++++++++++++++++++- 2024/20xxx/CVE-2024-20512.json | 133 ++++++++++++++++++- 2024/35xxx/CVE-2024-35584.json | 2 +- 2024/38xxx/CVE-2024-38814.json | 78 ++++++++++- 2024/45xxx/CVE-2024-45061.json | 18 +++ 2024/45xxx/CVE-2024-45071.json | 78 ++++++++++- 2024/45xxx/CVE-2024-45072.json | 78 ++++++++++- 2024/46xxx/CVE-2024-46605.json | 71 +++++++++- 2024/46xxx/CVE-2024-46606.json | 71 +++++++++- 2024/47xxx/CVE-2024-47002.json | 18 +++ 2024/47xxx/CVE-2024-47140.json | 18 +++ 2024/49xxx/CVE-2024-49579.json | 18 +++ 2024/49xxx/CVE-2024-49580.json | 18 +++ 2024/4xxx/CVE-2024-4184.json | 75 ++++++++++- 2024/4xxx/CVE-2024-4189.json | 75 ++++++++++- 2024/4xxx/CVE-2024-4211.json | 75 ++++++++++- 2024/4xxx/CVE-2024-4690.json | 75 ++++++++++- 2024/4xxx/CVE-2024-4692.json | 75 ++++++++++- 32 files changed, 2528 insertions(+), 99 deletions(-) create mode 100644 2024/10xxx/CVE-2024-10041.json create mode 100644 2024/10xxx/CVE-2024-10042.json create mode 100644 2024/10xxx/CVE-2024-10043.json create mode 100644 2024/10xxx/CVE-2024-10044.json create mode 100644 2024/45xxx/CVE-2024-45061.json create mode 100644 2024/47xxx/CVE-2024-47002.json create mode 100644 2024/47xxx/CVE-2024-47140.json create mode 100644 2024/49xxx/CVE-2024-49579.json create mode 100644 2024/49xxx/CVE-2024-49580.json diff --git a/2023/32xxx/CVE-2023-32266.json b/2023/32xxx/CVE-2023-32266.json index 37d4fc80c58..7d2bcd67a7c 100644 --- a/2023/32xxx/CVE-2023-32266.json +++ b/2023/32xxx/CVE-2023-32266.json @@ -1,18 +1,137 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-32266", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@opentext.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Untrusted Search Path vulnerability in OpenText\u2122 Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation. \u00a0\n\nThis issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-426 Untrusted Search Path", + "cweId": "CWE-426" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "OpenText\u2122", + "product": { + "product_data": [ + { + "product_name": "Application Lifecycle Management (ALM),Quality Center", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "15.00" + }, + { + "version_affected": "=", + "version_value": "15.01" + }, + { + "version_affected": "=", + "version_value": "15.01 P1" + }, + { + "version_affected": "=", + "version_value": "15.01 P2" + }, + { + "version_affected": "=", + "version_value": "15.01 P3" + }, + { + "version_affected": "=", + "version_value": "15.01 P4" + }, + { + "version_affected": "=", + "version_value": "15.01 P5" + }, + { + "version_affected": "=", + "version_value": "15.51" + }, + { + "version_affected": "=", + "version_value": "15.51 P1" + }, + { + "version_affected": "=", + "version_value": "15.51 P2" + }, + { + "version_affected": "=", + "version_value": "15.51 P3" + }, + { + "version_affected": "=", + "version_value": "16.00" + }, + { + "version_affected": "=", + "version_value": "16.01 P1" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://portal.microfocus.com/s/article/KM000024386?language=en_US", + "refsource": "MISC", + "name": "https://portal.microfocus.com/s/article/KM000024386?language=en_US" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "UNKNOWN" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "https://portal.microfocus.com/s/article/KM000024386?language=en_US
" + } + ], + "value": "https://portal.microfocus.com/s/article/KM000024386?language=en_US" + } + ], + "credits": [ + { + "lang": "en", + "value": "Vaibhav Srivastava (eSecForte Technologies Pvt. Ltd.)" + } + ] } \ No newline at end of file diff --git a/2024/10xxx/CVE-2024-10033.json b/2024/10xxx/CVE-2024-10033.json index 2f4d079945f..56aa85fe4ff 100644 --- a/2024/10xxx/CVE-2024-10033.json +++ b/2024/10xxx/CVE-2024-10033.json @@ -1,17 +1,94 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-10033", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the \"?next=\" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Red Hat", + "product": { + "product_data": [ + { + "product_name": "Red Hat Ansible Automation Platform 2", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "defaultStatus": "affected" + } + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://access.redhat.com/security/cve/CVE-2024-10033", + "refsource": "MISC", + "name": "https://access.redhat.com/security/cve/CVE-2024-10033" + }, + { + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2319162", + "refsource": "MISC", + "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2319162" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "This issue was discovered by Rick Elrod (Red Hat)." + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 5.4, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", + "version": "3.1" } ] } diff --git a/2024/10xxx/CVE-2024-10041.json b/2024/10xxx/CVE-2024-10041.json new file mode 100644 index 00000000000..132e243b95c --- /dev/null +++ b/2024/10xxx/CVE-2024-10041.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-10041", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/10xxx/CVE-2024-10042.json b/2024/10xxx/CVE-2024-10042.json new file mode 100644 index 00000000000..1b2161ca51f --- /dev/null +++ b/2024/10xxx/CVE-2024-10042.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-10042", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/10xxx/CVE-2024-10043.json b/2024/10xxx/CVE-2024-10043.json new file mode 100644 index 00000000000..efb6aec223c --- /dev/null +++ b/2024/10xxx/CVE-2024-10043.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-10043", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/10xxx/CVE-2024-10044.json b/2024/10xxx/CVE-2024-10044.json new file mode 100644 index 00000000000..05f6f9149fc --- /dev/null +++ b/2024/10xxx/CVE-2024-10044.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-10044", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/20xxx/CVE-2024-20280.json b/2024/20xxx/CVE-2024-20280.json index f1383854858..0371f7c6298 100644 --- a/2024/20xxx/CVE-2024-20280.json +++ b/2024/20xxx/CVE-2024-20280.json @@ -1,17 +1,242 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-20280", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@cisco.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is stored in the full state and configuration backup files.\r\n\r\nThis vulnerability is due to a weakness in the encryption method that is used for the backup function. An attacker could exploit this vulnerability by accessing a backup file and leveraging a static key that is used for the backup configuration feature. A successful exploit could allow an attacker with access to a backup file to learn sensitive information that is stored in full state backup files and configuration backup files, such as local user credentials, authentication server passwords, Simple Network Management Protocol (SNMP) community names, and the device SSL server certificate and key." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Use of Hard-coded Cryptographic Key", + "cweId": "CWE-321" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Cisco", + "product": { + "product_data": [ + { + "product_name": "Cisco Unified Computing System Central Software", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "2.0(1e)" + }, + { + "version_affected": "=", + "version_value": "1.1(1b)" + }, + { + "version_affected": "=", + "version_value": "1.4(1b)" + }, + { + "version_affected": "=", + "version_value": "2.0(1a)" + }, + { + "version_affected": "=", + "version_value": "2.0(1h)" + }, + { + "version_affected": "=", + "version_value": "1.3(1a)" + }, + { + "version_affected": "=", + "version_value": "2.0(1g)" + }, + { + "version_affected": "=", + "version_value": "2.0(1c)" + }, + { + "version_affected": "=", + "version_value": "2.0(1k)" + }, + { + "version_affected": "=", + "version_value": "1.0(1a)" + }, + { + "version_affected": "=", + "version_value": "2.0(1l)" + }, + { + "version_affected": "=", + "version_value": "1.2(1f)" + }, + { + "version_affected": "=", + "version_value": "2.0(1f)" + }, + { + "version_affected": "=", + "version_value": "1.4(1c)" + }, + { + "version_affected": "=", + "version_value": "1.3(1c)" + }, + { + "version_affected": "=", + "version_value": "1.1(1a)" + }, + { + "version_affected": "=", + "version_value": "1.4(1a)" + }, + { + "version_affected": "=", + "version_value": "1.2(1a)" + }, + { + "version_affected": "=", + "version_value": "1.2(1d)" + }, + { + "version_affected": "=", + "version_value": "2.0(1j)" + }, + { + "version_affected": "=", + "version_value": "1.5(1c)" + }, + { + "version_affected": "=", + "version_value": "1.5(1a)" + }, + { + "version_affected": "=", + "version_value": "1.1(2a)" + }, + { + "version_affected": "=", + "version_value": "1.3(1b)" + }, + { + "version_affected": "=", + "version_value": "2.0(1b)" + }, + { + "version_affected": "=", + "version_value": "2.0(1i)" + }, + { + "version_affected": "=", + "version_value": "1.2(1e)" + }, + { + "version_affected": "=", + "version_value": "1.5(1b)" + }, + { + "version_affected": "=", + "version_value": "2.0(1d)" + }, + { + "version_affected": "=", + "version_value": "2.0(1m)" + }, + { + "version_affected": "=", + "version_value": "2.0(1n)" + }, + { + "version_affected": "=", + "version_value": "2.0(1o)" + }, + { + "version_affected": "=", + "version_value": "2.0(1p)" + }, + { + "version_affected": "=", + "version_value": "2.0(1q)" + }, + { + "version_affected": "=", + "version_value": "2.0(1r)" + }, + { + "version_affected": "=", + "version_value": "2.0(1s)" + }, + { + "version_affected": "=", + "version_value": "2.0(1t)" + }, + { + "version_affected": "=", + "version_value": "2.0(1u)" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsc-bkpsky-TgJ5f73J", + "refsource": "MISC", + "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucsc-bkpsky-TgJ5f73J" + } + ] + }, + "source": { + "advisory": "cisco-sa-ucsc-bkpsky-TgJ5f73J", + "discovery": "INTERNAL", + "defects": [ + "CSCwe23286" + ] + }, + "exploit": [ + { + "lang": "en", + "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory." + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", + "baseScore": 6.3, + "baseSeverity": "MEDIUM", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "availabilityImpact": "NONE" } ] } diff --git a/2024/20xxx/CVE-2024-20420.json b/2024/20xxx/CVE-2024-20420.json index 07eb20e7444..e394c90d9c5 100644 --- a/2024/20xxx/CVE-2024-20420.json +++ b/2024/20xxx/CVE-2024-20420.json @@ -1,17 +1,150 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-20420", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@cisco.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, remote attacker with low privileges to run commands as an Admin user. \r\n\r\nThis vulnerability is due to incorrect authorization verification by the HTTP server. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to run commands as the Admin user." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Execution with Unnecessary Privileges", + "cweId": "CWE-250" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Cisco", + "product": { + "product_data": [ + { + "product_name": "Cisco Analog Telephone Adaptor (ATA) Software", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "12.0.1 SR2" + }, + { + "version_affected": "=", + "version_value": "11.1.0" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR1" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR1" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR2" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR3" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR4" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR3" + }, + { + "version_affected": "=", + "version_value": "11.2.1" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR4" + }, + { + "version_affected": "=", + "version_value": "11.2.2" + }, + { + "version_affected": "=", + "version_value": "11.2.2 MSR1" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR5" + }, + { + "version_affected": "=", + "version_value": "11.2.3" + }, + { + "version_affected": "=", + "version_value": "11.2.4" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy", + "refsource": "MISC", + "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy" + } + ] + }, + "source": { + "advisory": "cisco-sa-ata19x-multi-RDTEqRsy", + "discovery": "INTERNAL", + "defects": [ + "CSCwf28191" + ] + }, + "exploit": [ + { + "lang": "en", + "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory." + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", + "baseScore": 5.4, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE" } ] } diff --git a/2024/20xxx/CVE-2024-20421.json b/2024/20xxx/CVE-2024-20421.json index 085098e04e1..9606e2cf5c6 100644 --- a/2024/20xxx/CVE-2024-20421.json +++ b/2024/20xxx/CVE-2024-20421.json @@ -1,17 +1,154 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-20421", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@cisco.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.\r\n\r\nThis vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Cross-Site Request Forgery (CSRF)", + "cweId": "CWE-352" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Cisco", + "product": { + "product_data": [ + { + "product_name": "Cisco Analog Telephone Adaptor (ATA) Software", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "12.0.1 SR2" + }, + { + "version_affected": "=", + "version_value": "11.1.0" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR1" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR1" + }, + { + "version_affected": "=", + "version_value": "12.0.1" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR2" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR3" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR4" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR3" + }, + { + "version_affected": "=", + "version_value": "11.2.1" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR4" + }, + { + "version_affected": "=", + "version_value": "11.2.2" + }, + { + "version_affected": "=", + "version_value": "11.2.2 MSR1" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR5" + }, + { + "version_affected": "=", + "version_value": "11.2.3" + }, + { + "version_affected": "=", + "version_value": "11.2.4" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy", + "refsource": "MISC", + "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy" + } + ] + }, + "source": { + "advisory": "cisco-sa-ata19x-multi-RDTEqRsy", + "discovery": "INTERNAL", + "defects": [ + "CSCwf28426" + ] + }, + "exploit": [ + { + "lang": "en", + "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory." + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L", + "baseScore": 7.1, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "availabilityImpact": "LOW" } ] } diff --git a/2024/20xxx/CVE-2024-20458.json b/2024/20xxx/CVE-2024-20458.json index 096bab6a538..74146485255 100644 --- a/2024/20xxx/CVE-2024-20458.json +++ b/2024/20xxx/CVE-2024-20458.json @@ -1,17 +1,154 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-20458", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@cisco.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to view or delete the configuration or change the firmware on an affected device.\r\n\r\nThis vulnerability is due to a lack of authentication on specific HTTP endpoints. An attacker could exploit this vulnerability by browsing to a specific URL. A successful exploit could allow the attacker to view or delete the configuration or change the firmware." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", + "cweId": "CWE-78" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Cisco", + "product": { + "product_data": [ + { + "product_name": "Cisco Analog Telephone Adaptor (ATA) Software", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "12.0.1 SR2" + }, + { + "version_affected": "=", + "version_value": "11.1.0" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR1" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR1" + }, + { + "version_affected": "=", + "version_value": "12.0.1" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR2" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR3" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR4" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR3" + }, + { + "version_affected": "=", + "version_value": "11.2.1" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR4" + }, + { + "version_affected": "=", + "version_value": "11.2.2" + }, + { + "version_affected": "=", + "version_value": "11.2.2 MSR1" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR5" + }, + { + "version_affected": "=", + "version_value": "11.2.3" + }, + { + "version_affected": "=", + "version_value": "11.2.4" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy", + "refsource": "MISC", + "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy" + } + ] + }, + "source": { + "advisory": "cisco-sa-ata19x-multi-RDTEqRsy", + "discovery": "INTERNAL", + "defects": [ + "CSCwf28097" + ] + }, + "exploit": [ + { + "lang": "en", + "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory." + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", + "baseScore": 8.2, + "baseSeverity": "HIGH", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "availabilityImpact": "LOW" } ] } diff --git a/2024/20xxx/CVE-2024-20459.json b/2024/20xxx/CVE-2024-20459.json index 38b1ca8a529..45bfc624064 100644 --- a/2024/20xxx/CVE-2024-20459.json +++ b/2024/20xxx/CVE-2024-20459.json @@ -1,17 +1,154 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-20459", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@cisco.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability in the web-based management interface of Cisco ATA 190 Multiplatform Series Analog Telephone Adapter firmware could allow an authenticated, remote attacker with high privileges to execute arbitrary commands as the root user on the underlying operating system.\r\n\r\nThis vulnerability is due to a lack of input sanitization in the web-based management interface. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system as the root user." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", + "cweId": "CWE-78" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Cisco", + "product": { + "product_data": [ + { + "product_name": "Cisco Analog Telephone Adaptor (ATA) Software", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "12.0.1 SR2" + }, + { + "version_affected": "=", + "version_value": "11.1.0" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR1" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR1" + }, + { + "version_affected": "=", + "version_value": "12.0.1" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR2" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR3" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR4" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR3" + }, + { + "version_affected": "=", + "version_value": "11.2.1" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR4" + }, + { + "version_affected": "=", + "version_value": "11.2.2" + }, + { + "version_affected": "=", + "version_value": "11.2.2 MSR1" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR5" + }, + { + "version_affected": "=", + "version_value": "11.2.3" + }, + { + "version_affected": "=", + "version_value": "11.2.4" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy", + "refsource": "MISC", + "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy" + } + ] + }, + "source": { + "advisory": "cisco-sa-ata19x-multi-RDTEqRsy", + "discovery": "INTERNAL", + "defects": [ + "CSCwf28499" + ] + }, + "exploit": [ + { + "lang": "en", + "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory." + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", + "baseScore": 6.5, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "HIGH", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE" } ] } diff --git a/2024/20xxx/CVE-2024-20460.json b/2024/20xxx/CVE-2024-20460.json index a993e46a77e..6602073db61 100644 --- a/2024/20xxx/CVE-2024-20460.json +++ b/2024/20xxx/CVE-2024-20460.json @@ -1,17 +1,154 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-20460", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@cisco.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user.\r\n\r\nThis vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information on an affected device." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", + "cweId": "CWE-80" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Cisco", + "product": { + "product_data": [ + { + "product_name": "Cisco Analog Telephone Adaptor (ATA) Software", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "12.0.1 SR2" + }, + { + "version_affected": "=", + "version_value": "11.1.0" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR1" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR1" + }, + { + "version_affected": "=", + "version_value": "12.0.1" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR2" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR3" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR4" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR3" + }, + { + "version_affected": "=", + "version_value": "11.2.1" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR4" + }, + { + "version_affected": "=", + "version_value": "11.2.2" + }, + { + "version_affected": "=", + "version_value": "11.2.2 MSR1" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR5" + }, + { + "version_affected": "=", + "version_value": "11.2.3" + }, + { + "version_affected": "=", + "version_value": "11.2.4" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy", + "refsource": "MISC", + "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy" + } + ] + }, + "source": { + "advisory": "cisco-sa-ata19x-multi-RDTEqRsy", + "discovery": "INTERNAL", + "defects": [ + "CSCwf28041" + ] + }, + "exploit": [ + { + "lang": "en", + "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory." + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "baseScore": 6.1, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE" } ] } diff --git a/2024/20xxx/CVE-2024-20461.json b/2024/20xxx/CVE-2024-20461.json index f4b97beb4d6..a008a55e7a1 100644 --- a/2024/20xxx/CVE-2024-20461.json +++ b/2024/20xxx/CVE-2024-20461.json @@ -1,17 +1,154 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-20461", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@cisco.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability in the CLI of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an authenticated, local attacker with high privileges to execute arbitrary commands as the root user.\r\n\r\nThis vulnerability exists because CLI input is not properly sanitized. An attacker could exploit this vulnerability by sending malicious characters to the CLI. A successful exploit could allow the attacker to read and write to the underlying operating system as the root user." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", + "cweId": "CWE-78" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Cisco", + "product": { + "product_data": [ + { + "product_name": "Cisco Analog Telephone Adaptor (ATA) Software", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "12.0.1 SR2" + }, + { + "version_affected": "=", + "version_value": "11.1.0" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR1" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR1" + }, + { + "version_affected": "=", + "version_value": "12.0.1" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR2" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR3" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR4" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR3" + }, + { + "version_affected": "=", + "version_value": "11.2.1" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR4" + }, + { + "version_affected": "=", + "version_value": "11.2.2" + }, + { + "version_affected": "=", + "version_value": "11.2.2 MSR1" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR5" + }, + { + "version_affected": "=", + "version_value": "11.2.3" + }, + { + "version_affected": "=", + "version_value": "11.2.4" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy", + "refsource": "MISC", + "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy" + } + ] + }, + "source": { + "advisory": "cisco-sa-ata19x-multi-RDTEqRsy", + "discovery": "INTERNAL", + "defects": [ + "CSCwf28378" + ] + }, + "exploit": [ + { + "lang": "en", + "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory." + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", + "baseScore": 6, + "baseSeverity": "MEDIUM", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "privilegesRequired": "HIGH", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE" } ] } diff --git a/2024/20xxx/CVE-2024-20462.json b/2024/20xxx/CVE-2024-20462.json index 1fc70619873..d880dff5aed 100644 --- a/2024/20xxx/CVE-2024-20462.json +++ b/2024/20xxx/CVE-2024-20462.json @@ -1,17 +1,130 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-20462", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@cisco.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability in the web-based management interface of Cisco ATA 190 Series Multiplatform Analog Telephone Adapter firmware could allow an authenticated, local attacker with low privileges to view passwords on an affected device.\r\n\r\nThis vulnerability is due to incorrect sanitization of HTML content from an affected device. A successful exploit could allow the attacker to view passwords that belong to other users." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Storing Passwords in a Recoverable Format", + "cweId": "CWE-257" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Cisco", + "product": { + "product_data": [ + { + "product_name": "Cisco Analog Telephone Adaptor (ATA) Software", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "11.1.0" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR1" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR2" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR3" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR4" + }, + { + "version_affected": "=", + "version_value": "11.2.1" + }, + { + "version_affected": "=", + "version_value": "11.2.2" + }, + { + "version_affected": "=", + "version_value": "11.2.2 MSR1" + }, + { + "version_affected": "=", + "version_value": "11.2.3" + }, + { + "version_affected": "=", + "version_value": "11.2.4" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy", + "refsource": "MISC", + "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy" + } + ] + }, + "source": { + "advisory": "cisco-sa-ata19x-multi-RDTEqRsy", + "discovery": "INTERNAL", + "defects": [ + "CSCwf28398" + ] + }, + "exploit": [ + { + "lang": "en", + "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory." + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", + "baseScore": 5.5, + "baseSeverity": "MEDIUM", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "availabilityImpact": "NONE" } ] } diff --git a/2024/20xxx/CVE-2024-20463.json b/2024/20xxx/CVE-2024-20463.json index 74d0e5b86ae..13c00cc39d5 100644 --- a/2024/20xxx/CVE-2024-20463.json +++ b/2024/20xxx/CVE-2024-20463.json @@ -1,17 +1,154 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-20463", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@cisco.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to modify the configuration or reboot an affected device.\r\n\r\nThis vulnerability is due to the HTTP server allowing state changes in GET requests. An attacker could exploit this vulnerability by sending a malicious request to the web-based management interface on an affected device. A successful exploit could allow the attacker to make limited modifications to the configuration or reboot the device, resulting in a denial of service (DoS) condition. " + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Authentication Bypass by Primary Weakness", + "cweId": "CWE-305" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Cisco", + "product": { + "product_data": [ + { + "product_name": "Cisco Analog Telephone Adaptor (ATA) Software", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "12.0.1 SR2" + }, + { + "version_affected": "=", + "version_value": "11.1.0" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR1" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR1" + }, + { + "version_affected": "=", + "version_value": "12.0.1" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR2" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR3" + }, + { + "version_affected": "=", + "version_value": "11.1.0 MSR4" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR3" + }, + { + "version_affected": "=", + "version_value": "11.2.1" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR4" + }, + { + "version_affected": "=", + "version_value": "11.2.2" + }, + { + "version_affected": "=", + "version_value": "11.2.2 MSR1" + }, + { + "version_affected": "=", + "version_value": "12.0.1 SR5" + }, + { + "version_affected": "=", + "version_value": "11.2.3" + }, + { + "version_affected": "=", + "version_value": "11.2.4" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy", + "refsource": "MISC", + "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ata19x-multi-RDTEqRsy" + } + ] + }, + "source": { + "advisory": "cisco-sa-ata19x-multi-RDTEqRsy", + "discovery": "INTERNAL", + "defects": [ + "CSCwf28345" + ] + }, + "exploit": [ + { + "lang": "en", + "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory." + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", + "baseScore": 5.4, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "LOW" } ] } diff --git a/2024/20xxx/CVE-2024-20512.json b/2024/20xxx/CVE-2024-20512.json index b7e4c4c93e8..c4511062115 100644 --- a/2024/20xxx/CVE-2024-20512.json +++ b/2024/20xxx/CVE-2024-20512.json @@ -1,17 +1,142 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-20512", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@cisco.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface.\r\n\r\nThis vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive browser-based information." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Cisco", + "product": { + "product_data": [ + { + "product_name": "Cisco Unified Contact Center Management Portal", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "12.6(1)" + }, + { + "version_affected": "=", + "version_value": "12.6(1)_ES1" + }, + { + "version_affected": "=", + "version_value": "12.6(1)_ES2" + }, + { + "version_affected": "=", + "version_value": "12.6(1)_ES3" + }, + { + "version_affected": "=", + "version_value": "12.6(1)_ES4" + }, + { + "version_affected": "=", + "version_value": "12.6(1)_ES5" + }, + { + "version_affected": "=", + "version_value": "12.6(1)_ES6" + }, + { + "version_affected": "=", + "version_value": "12.6(1)_ES7" + }, + { + "version_affected": "=", + "version_value": "12.6(1)_ES8" + }, + { + "version_affected": "=", + "version_value": "12.6(1)_ES9" + }, + { + "version_affected": "=", + "version_value": "12.6(1)_ES10" + }, + { + "version_affected": "=", + "version_value": "12.6(1)_ES11" + }, + { + "version_affected": "=", + "version_value": "12.6(1)_ES12" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ccmpdm-rxss-tAX76U3k", + "refsource": "MISC", + "name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ccmpdm-rxss-tAX76U3k" + } + ] + }, + "source": { + "advisory": "cisco-sa-ccmpdm-rxss-tAX76U3k", + "discovery": "EXTERNAL", + "defects": [ + "CSCwk85998" + ] + }, + "exploit": [ + { + "lang": "en", + "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory." + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "baseScore": 6.1, + "baseSeverity": "MEDIUM", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE" } ] } diff --git a/2024/35xxx/CVE-2024-35584.json b/2024/35xxx/CVE-2024-35584.json index bff7e3d11de..8fa37bb7327 100644 --- a/2024/35xxx/CVE-2024-35584.json +++ b/2024/35xxx/CVE-2024-35584.json @@ -34,7 +34,7 @@ "description_data": [ { "lang": "eng", - "value": "SQL injection vulnerability in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1, 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to sanitisation. The application takes arbitrary value from \"X-Forwarded-For\" header and appends it to a SQL INSERT statement directly, leading to SQL Injection." + "value": "SQL injection vulnerabilities were discovered in Ajax.php, ForWindow.php, ForExport.php, Modules.php, functions/HackingLogFnc.php in OpenSis Community Edition 9.1 to 8.0, and possibly earlier versions. It is possible for an authenticated user to perform SQL Injection due to the lack to sanitisation. The application takes arbitrary value from \"X-Forwarded-For\" header and appends it to a SQL INSERT statement directly, leading to SQL Injection." } ] }, diff --git a/2024/38xxx/CVE-2024-38814.json b/2024/38xxx/CVE-2024-38814.json index 75c18d779c0..b08f865e97d 100644 --- a/2024/38xxx/CVE-2024-38814.json +++ b/2024/38xxx/CVE-2024-38814.json @@ -1,17 +1,87 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-38814", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@vmware.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware. A\n malicious authenticated user with non-administrator privileges may be \nable to enter specially crafted SQL queries and perform unauthorized \nremote code execution on the HCX manager.\u00a0\nUpdates are available to remediate this vulnerability in affected VMware products." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", + "cweId": "CWE-89" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "N/A", + "product": { + "product_data": [ + { + "product_name": "VMware HCX", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "VMware HCX 4.8.0-4.8.2, VMware HCX 4.9.0-4.9.1, VMware HCX 4.10.0" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25019", + "refsource": "MISC", + "name": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25019" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "LOW", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "version": "3.1" } ] } diff --git a/2024/45xxx/CVE-2024-45061.json b/2024/45xxx/CVE-2024-45061.json new file mode 100644 index 00000000000..7b7bf5e09be --- /dev/null +++ b/2024/45xxx/CVE-2024-45061.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-45061", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/45xxx/CVE-2024-45071.json b/2024/45xxx/CVE-2024-45071.json index cf1705ba167..1ac9b0d441b 100644 --- a/2024/45xxx/CVE-2024-45071.json +++ b/2024/45xxx/CVE-2024-45071.json @@ -1,17 +1,87 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-45071", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@us.ibm.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "IBM", + "product": { + "product_data": [ + { + "product_name": "WebSphere Application Server", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "8.5, 9.0" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.ibm.com/support/pages/node/7173270", + "refsource": "MISC", + "name": "https://www.ibm.com/support/pages/node/7173270" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 5.5, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "privilegesRequired": "HIGH", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", + "version": "3.1" } ] } diff --git a/2024/45xxx/CVE-2024-45072.json b/2024/45xxx/CVE-2024-45072.json index 4ea2b7a8a03..af16eb8c152 100644 --- a/2024/45xxx/CVE-2024-45072.json +++ b/2024/45xxx/CVE-2024-45072.json @@ -1,17 +1,87 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-45072", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@us.ibm.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-611 Improper Restriction of XML External Entity Reference", + "cweId": "CWE-611" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "IBM", + "product": { + "product_data": [ + { + "product_name": "WebSphere Application Server", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "8.5, 9.0" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.ibm.com/support/pages/node/7173263", + "refsource": "MISC", + "name": "https://www.ibm.com/support/pages/node/7173263" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 5.5, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L", + "version": "3.1" } ] } diff --git a/2024/46xxx/CVE-2024-46605.json b/2024/46xxx/CVE-2024-46605.json index 85e81e105a2..57c0f51cfcd 100644 --- a/2024/46xxx/CVE-2024-46605.json +++ b/2024/46xxx/CVE-2024-46605.json @@ -1,17 +1,76 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2024-46605", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2024-46605", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A cross-site scripting (XSS) vulnerability in the component /admin.php?page=album of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "http://piwigo.com", + "refsource": "MISC", + "name": "http://piwigo.com" + }, + { + "url": "https://drive.google.com/file/d/1-OiaEitTaY7tpEPZMZ8GYtyUH3QWVn22/view?usp=drive_link", + "refsource": "MISC", + "name": "https://drive.google.com/file/d/1-OiaEitTaY7tpEPZMZ8GYtyUH3QWVn22/view?usp=drive_link" + }, + { + "url": "https://github.com/Piwigo/Piwigo", + "refsource": "MISC", + "name": "https://github.com/Piwigo/Piwigo" + }, + { + "refsource": "MISC", + "name": "https://github.com/achufistov/cve-achufistov/blob/main/CVE-2024-46605.md", + "url": "https://github.com/achufistov/cve-achufistov/blob/main/CVE-2024-46605.md" } ] } diff --git a/2024/46xxx/CVE-2024-46606.json b/2024/46xxx/CVE-2024-46606.json index 7e88bee6a42..4995b4b0b61 100644 --- a/2024/46xxx/CVE-2024-46606.json +++ b/2024/46xxx/CVE-2024-46606.json @@ -1,17 +1,76 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2024-46606", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2024-46606", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A cross-site scripting (XSS) vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "http://piwigo.com", + "refsource": "MISC", + "name": "http://piwigo.com" + }, + { + "url": "https://github.com/Piwigo/Piwigo", + "refsource": "MISC", + "name": "https://github.com/Piwigo/Piwigo" + }, + { + "url": "https://drive.google.com/drive/u/1/folders/1zirdhXurKVj1XtLlBESmiORuCUXtLGam", + "refsource": "MISC", + "name": "https://drive.google.com/drive/u/1/folders/1zirdhXurKVj1XtLlBESmiORuCUXtLGam" + }, + { + "refsource": "MISC", + "name": "https://github.com/achufistov/cve-achufistov/blob/main/CVE-2024-46606.md", + "url": "https://github.com/achufistov/cve-achufistov/blob/main/CVE-2024-46606.md" } ] } diff --git a/2024/47xxx/CVE-2024-47002.json b/2024/47xxx/CVE-2024-47002.json new file mode 100644 index 00000000000..a0853488eef --- /dev/null +++ b/2024/47xxx/CVE-2024-47002.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-47002", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/47xxx/CVE-2024-47140.json b/2024/47xxx/CVE-2024-47140.json new file mode 100644 index 00000000000..ded89126f3a --- /dev/null +++ b/2024/47xxx/CVE-2024-47140.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-47140", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/49xxx/CVE-2024-49579.json b/2024/49xxx/CVE-2024-49579.json new file mode 100644 index 00000000000..fde24112afe --- /dev/null +++ b/2024/49xxx/CVE-2024-49579.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-49579", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/49xxx/CVE-2024-49580.json b/2024/49xxx/CVE-2024-49580.json new file mode 100644 index 00000000000..b9d0c6673bf --- /dev/null +++ b/2024/49xxx/CVE-2024-49580.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-49580", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/4xxx/CVE-2024-4184.json b/2024/4xxx/CVE-2024-4184.json index ede26ad4980..444cf0f8903 100644 --- a/2024/4xxx/CVE-2024-4184.json +++ b/2024/4xxx/CVE-2024-4184.json @@ -1,18 +1,83 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-4184", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@opentext.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-611 Improper Restriction of XML External Entity Reference", + "cweId": "CWE-611" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "OpenText", + "product": { + "product_data": [ + { + "product_name": "OpenText Application Automation Tools", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "24.1.0 and below" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://portal.microfocus.com/s/article/KM000033540?language=en_US", + "refsource": "MISC", + "name": "https://portal.microfocus.com/s/article/KM000033540?language=en_US" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "UNKNOWN" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Upgrade to version 24.2 or above of OpenText Application Automation Tools addresses this vulnerability:
" + } + ], + "value": "Upgrade to version 24.2 or above of OpenText Application Automation Tools addresses this vulnerability:" + } + ] } \ No newline at end of file diff --git a/2024/4xxx/CVE-2024-4189.json b/2024/4xxx/CVE-2024-4189.json index 0f57a018608..070e790b1f0 100644 --- a/2024/4xxx/CVE-2024-4189.json +++ b/2024/4xxx/CVE-2024-4189.json @@ -1,18 +1,83 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-4189", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@opentext.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-611 Improper Restriction of XML External Entity Reference", + "cweId": "CWE-611" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "OpenText", + "product": { + "product_data": [ + { + "product_name": "OpenText Application Automation Tools", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "24.1.0 and below" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://portal.microfocus.com/s/article/KM000033547?language=en_US", + "refsource": "MISC", + "name": "https://portal.microfocus.com/s/article/KM000033547?language=en_US" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "UNKNOWN" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Upgrade to version 24.2 or above of OpenText Application Automation Tools addresses this vulnerability:
" + } + ], + "value": "Upgrade to version 24.2 or above of OpenText Application Automation Tools addresses this vulnerability:" + } + ] } \ No newline at end of file diff --git a/2024/4xxx/CVE-2024-4211.json b/2024/4xxx/CVE-2024-4211.json index 22a7a238972..8c42ec75099 100644 --- a/2024/4xxx/CVE-2024-4211.json +++ b/2024/4xxx/CVE-2024-4211.json @@ -1,18 +1,83 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-4211", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@opentext.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels.\n\n\nMultiple missing permission checks - ALM job config has been discovered in OpenText Application Automation Tools. The vulnerability could allow users with Overall/Read permission to enumerate ALM server names, usernames and client IDs configured to be used with ALM servers.\n\n\nThis issue affects OpenText Application Automation Tools: 24.1.0 and below." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-280: Improper Handling of Insufficient Permissions or Privileges", + "cweId": "CWE-280" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "OpenText", + "product": { + "product_data": [ + { + "product_name": "OpenText Application Automation Tools", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "24.1.0 and below" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://portal.microfocus.com/s/article/KM000033543?language=en_US", + "refsource": "MISC", + "name": "https://portal.microfocus.com/s/article/KM000033543?language=en_US" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "UNKNOWN" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Upgrade to version 24.2 or above of OpenText Application Automation Tools addresses this vulnerability:
" + } + ], + "value": "Upgrade to version 24.2 or above of OpenText Application Automation Tools addresses this vulnerability:" + } + ] } \ No newline at end of file diff --git a/2024/4xxx/CVE-2024-4690.json b/2024/4xxx/CVE-2024-4690.json index 03440a9646d..7d80365c774 100644 --- a/2024/4xxx/CVE-2024-4690.json +++ b/2024/4xxx/CVE-2024-4690.json @@ -1,18 +1,83 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-4690", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@opentext.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue affects OpenText Application Automation Tools: 24.1.0 and below." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-611 Improper Restriction of XML External Entity Reference", + "cweId": "CWE-611" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "OpenText", + "product": { + "product_data": [ + { + "product_name": "OpenText Application Automation Tools", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "24.1.0 and below" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://portal.microfocus.com/s/article/KM000033548?language=en_US", + "refsource": "MISC", + "name": "https://portal.microfocus.com/s/article/KM000033548?language=en_US" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "UNKNOWN" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Upgrade to version 24.2 or above of OpenText Application Automation Tools addresses this vulnerability:
" + } + ], + "value": "Upgrade to version 24.2 or above of OpenText Application Automation Tools addresses this vulnerability:" + } + ] } \ No newline at end of file diff --git a/2024/4xxx/CVE-2024-4692.json b/2024/4xxx/CVE-2024-4692.json index e6ec9c7a51b..ab718615584 100644 --- a/2024/4xxx/CVE-2024-4692.json +++ b/2024/4xxx/CVE-2024-4692.json @@ -1,18 +1,83 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-4692", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@opentext.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Improper Validation of Specified Quantity in Input vulnerability in OpenText OpenText Application Automation Tools allows Exploiting Incorrectly Configured Access Control Security Levels.\n\n\nMultiple missing permission checks - Service Virtualization config has been discovered in in OpenText Application Automation Tools. The vulnerability could allow users with Overall/Read permission to enumerate Service Virtualization server names.\n\nThis issue affects OpenText Application Automation Tools: 24.1.0 and below." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-280: Improper Handling of Insufficient Permissions or Privileges", + "cweId": "CWE-280" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "OpenText", + "product": { + "product_data": [ + { + "product_name": "OpenText Application Automation Tools", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "24.1.0 and below" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://portal.microfocus.com/s/article/KM000033546?language=en_US", + "refsource": "MISC", + "name": "https://portal.microfocus.com/s/article/KM000033546?language=en_US" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "UNKNOWN" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Upgrade to version 24.2 or above of OpenText Application Automation Tools addresses this vulnerability:
" + } + ], + "value": "Upgrade to version 24.2 or above of OpenText Application Automation Tools addresses this vulnerability:" + } + ] } \ No newline at end of file