mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-08-04 08:44:25 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
cec694def2
commit
219d68506f
@ -91,6 +91,11 @@
|
||||
"refsource": "MLIST",
|
||||
"name": "[debian-lts-announce] 20230120 [SECURITY] [DLA 3278-1] tiff security update",
|
||||
"url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html"
|
||||
},
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"name": "https://support.apple.com/kb/HT213843",
|
||||
"url": "https://support.apple.com/kb/HT213843"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -358,6 +358,11 @@
|
||||
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41073",
|
||||
"refsource": "MISC",
|
||||
"name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41073"
|
||||
},
|
||||
{
|
||||
"url": "http://packetstormsecurity.com/files/174528/Microsoft-Windows-Privilege-Escalation.html",
|
||||
"refsource": "MISC",
|
||||
"name": "http://packetstormsecurity.com/files/174528/Microsoft-Windows-Privilege-Escalation.html"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -56,6 +56,11 @@
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/Timorlover/CVE-2023-23333",
|
||||
"url": "https://github.com/Timorlover/CVE-2023-23333"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "http://packetstormsecurity.com/files/174537/SolarView-Compact-6.00-Remote-Command-Execution.html",
|
||||
"url": "http://packetstormsecurity.com/files/174537/SolarView-Compact-6.00-Remote-Command-Execution.html"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,89 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-23623",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a `script-src` directive and _not_ providing `unsafe-eval` in that directive, is not respected in renderers that have sandbox disabled. i.e. `sandbox: false` in the `webPreferences` object. This allows usage of methods like `eval()` and `new Function` unexpectedly which can result in an expanded attack surface. This issue only ever affected the 22 and 23 major versions of Electron and has been fixed in the latest versions of those release lines. Specifically, these versions contain the fixes: 22.0.1 and 23.0.0-alpha.2 We recommend all apps upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by enabling `sandbox: true` on all renderers."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-670: Always-Incorrect Control Flow Implementation",
|
||||
"cweId": "CWE-670"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "electron",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "electron",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 22.0.0-beta.1, < 22.0.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 23.0.0-alpha.1, < 23.0.0-alpha.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-gxh7-wv9q-fwfr",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.5,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -58,6 +58,11 @@
|
||||
"url": "https://support.apple.com/en-us/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213670"
|
||||
},
|
||||
{
|
||||
"url": "https://support.apple.com/kb/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT213670"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -58,6 +58,11 @@
|
||||
"url": "https://support.apple.com/en-us/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213670"
|
||||
},
|
||||
{
|
||||
"url": "https://support.apple.com/kb/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT213670"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -58,6 +58,11 @@
|
||||
"url": "https://support.apple.com/en-us/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213670"
|
||||
},
|
||||
{
|
||||
"url": "https://support.apple.com/kb/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT213670"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -58,6 +58,11 @@
|
||||
"url": "https://support.apple.com/en-us/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213670"
|
||||
},
|
||||
{
|
||||
"url": "https://support.apple.com/kb/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT213670"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -85,6 +85,11 @@
|
||||
"url": "https://support.apple.com/en-us/HT213673",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213673"
|
||||
},
|
||||
{
|
||||
"url": "https://support.apple.com/kb/HT213843",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT213843"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -58,6 +58,11 @@
|
||||
"url": "https://support.apple.com/en-us/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213670"
|
||||
},
|
||||
{
|
||||
"url": "https://support.apple.com/kb/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT213670"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -58,6 +58,11 @@
|
||||
"url": "https://support.apple.com/en-us/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213670"
|
||||
},
|
||||
{
|
||||
"url": "https://support.apple.com/kb/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT213670"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -58,6 +58,11 @@
|
||||
"url": "https://support.apple.com/en-us/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213670"
|
||||
},
|
||||
{
|
||||
"url": "https://support.apple.com/kb/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT213670"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -58,6 +58,11 @@
|
||||
"url": "https://support.apple.com/en-us/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213670"
|
||||
},
|
||||
{
|
||||
"url": "https://support.apple.com/kb/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT213670"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -58,6 +58,11 @@
|
||||
"url": "https://support.apple.com/en-us/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213670"
|
||||
},
|
||||
{
|
||||
"url": "https://support.apple.com/kb/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT213670"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -58,6 +58,11 @@
|
||||
"url": "https://support.apple.com/en-us/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213670"
|
||||
},
|
||||
{
|
||||
"url": "https://support.apple.com/kb/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT213670"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -58,6 +58,11 @@
|
||||
"url": "https://support.apple.com/en-us/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213670"
|
||||
},
|
||||
{
|
||||
"url": "https://support.apple.com/kb/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT213670"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,102 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-29198",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps using `contextIsolation` and `contextBridge` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. This issue is only exploitable if an API exposed to the main world via `contextBridge` can return an object or array that contains a javascript object which cannot be serialized, for instance, a canvas rendering context. This would normally result in an exception being thrown `Error: object could not be cloned`. The app side workaround is to ensure that such a case is not possible. Ensure all values returned from a function exposed over the context bridge are supported. This issue has been fixed in versions `25.0.0-alpha.2`, `24.0.1`, `23.2.3`, and `22.3.6`."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-754: Improper Check for Unusual or Exceptional Conditions",
|
||||
"cweId": "CWE-754"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "electron",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "electron",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "< 22.3.6"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 23.0.0, < 23.2.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 24.0.0, < 24.0.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 25.0.0-alpha.1, < 25.0.0-alpha.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/electron/electron/security/advisories/GHSA-p7v2-p9m8-qqg7",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/electron/electron/security/advisories/GHSA-p7v2-p9m8-qqg7"
|
||||
},
|
||||
{
|
||||
"url": "https://www.electronjs.org/docs/latest/api/context-bridge#parameter--error--return-type-support",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.electronjs.org/docs/latest/api/context-bridge#parameter--error--return-type-support"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-p7v2-p9m8-qqg7",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 6,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -81,6 +81,11 @@
|
||||
"refsource": "CONFIRM",
|
||||
"name": "https://security.netapp.com/advisory/ntap-20230517-0009/",
|
||||
"url": "https://security.netapp.com/advisory/ntap-20230517-0009/"
|
||||
},
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"name": "https://support.apple.com/kb/HT213843",
|
||||
"url": "https://support.apple.com/kb/HT213843"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -58,6 +58,11 @@
|
||||
"url": "https://support.apple.com/en-us/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213670"
|
||||
},
|
||||
{
|
||||
"url": "https://support.apple.com/kb/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT213670"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -58,6 +58,11 @@
|
||||
"url": "https://support.apple.com/en-us/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213670"
|
||||
},
|
||||
{
|
||||
"url": "https://support.apple.com/kb/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT213670"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -58,6 +58,11 @@
|
||||
"url": "https://support.apple.com/en-us/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213670"
|
||||
},
|
||||
{
|
||||
"url": "https://support.apple.com/kb/HT213670",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT213670"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -298,6 +298,11 @@
|
||||
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35359",
|
||||
"refsource": "MISC",
|
||||
"name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35359"
|
||||
},
|
||||
{
|
||||
"url": "http://packetstormsecurity.com/files/174528/Microsoft-Windows-Privilege-Escalation.html",
|
||||
"refsource": "MISC",
|
||||
"name": "http://packetstormsecurity.com/files/174528/Microsoft-Windows-Privilege-Escalation.html"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -1,17 +1,63 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-38605",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "product-security@apple.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Ventura 13.5. An app may be able to determine a user\u2019s current location."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "An app may be able to determine a user\u2019s current location"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Apple",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "macOS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "unspecified",
|
||||
"version_value": "13.5"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://support.apple.com/en-us/HT213843",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213843"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,63 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-38616",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "product-security@apple.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A race condition was addressed with improved state handling. This issue is fixed in macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "An app may be able to execute arbitrary code with kernel privileges"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Apple",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "macOS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "unspecified",
|
||||
"version_value": "13.5"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://support.apple.com/en-us/HT213843",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213843"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,101 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-39956",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with an attacker-controlled working directory and 2. The attacker has the ability to write files to that working directory. This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude Physically Local Attacks but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance. This issue has been fixed in versions:`26.0.0-beta.13`, `25.4.1`, `24.7.1`, `23.3.13`, and `22.3.19`. There are no app side workarounds, users must update to a patched version of Electron."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-94: Improper Control of Generation of Code ('Code Injection')",
|
||||
"cweId": "CWE-94"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "electron",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "electron",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "< 22.3.19"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 23.0.0, < 23.3.13"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 24.0.0, < 24.7.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 25.0.0, < 25.4.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 26.0.0-beta.1, < 26.0.0-beta.13"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/electron/electron/security/advisories/GHSA-7x97-j373-85x5",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/electron/electron/security/advisories/GHSA-7x97-j373-85x5"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-7x97-j373-85x5",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 6.1,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,85 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-39967",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "WireMock is a tool for mocking HTTP services. When certain request URLs like \u201c@127.0.0.1:1234\" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock\u2019s instance. There are 3 identified potential attack vectors: via \u201cTestRequester\u201d functionality, webhooks and the proxy mode. As we can control HTTP Method, HTTP Headers, HTTP Data, it allows sending requests with the default level of credentials for the WireMock instance. The vendor has discontinued the affected Wiremock studio product and there will be no fix. Users are advised to find alternatives."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-918: Server-Side Request Forgery (SSRF)",
|
||||
"cweId": "CWE-918"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "wiremock",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "wiremock",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "All versions"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/wiremock/wiremock/security/advisories/GHSA-676j-xrv3-73vc",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/wiremock/wiremock/security/advisories/GHSA-676j-xrv3-73vc"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-676j-xrv3-73vc",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 10,
|
||||
"baseSeverity": "CRITICAL",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,63 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-40392",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "product-security@apple.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.5. An app may be able to read sensitive location information."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "An app may be able to read sensitive location information"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Apple",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "macOS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "unspecified",
|
||||
"version_value": "13.5"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://support.apple.com/en-us/HT213843",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213843"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,63 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-40397",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "product-security@apple.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5. A remote attacker may be able to cause arbitrary javascript code execution."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A remote attacker may be able to cause arbitrary javascript code execution"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Apple",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "macOS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "unspecified",
|
||||
"version_value": "13.5"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://support.apple.com/en-us/HT213843",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT213843"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,94 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-41053",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-269: Improper Privilege Management",
|
||||
"cweId": "CWE-269"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "redis",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "redis",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 7.0.0, < 7.0.13"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 7.1.0, < 7.2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/redis/redis/security/advisories/GHSA-q4jr-5p56-4xwc",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/redis/redis/security/advisories/GHSA-q4jr-5p56-4xwc"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/redis/redis/commit/9e505e6cd842338424e05883521ca1fb7d0f47f6",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/redis/redis/commit/9e505e6cd842338424e05883521ca1fb7d0f47f6"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-q4jr-5p56-4xwc",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 3.3,
|
||||
"baseSeverity": "LOW",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,103 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-41327",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "WireMock is a tool for mocking HTTP services. WireMock can be configured to only permit proxying (and therefore recording) to certain addresses. This is achieved via a list of allowed address rules and a list of denied address rules, where the allowed list is evaluated first. \n\nUntil WireMock Webhooks Extension 3.0.0-beta-15, the filtering of target addresses from the proxy mode DID NOT work for Webhooks, so the users were potentially vulnerable regardless of the `limitProxyTargets` settings. Via the WireMock webhooks configuration, POST requests from a webhook might be forwarded to an arbitrary service reachable from WireMock\u2019s instance. For example, If someone is running the WireMock docker Container inside a private cluster, they can trigger internal POST requests against unsecured APIs or even against secure ones by passing a token, discovered using another exploit, via authentication headers. This issue has been addressed in versions 2.35.1 and 3.0.3 of wiremock. Wiremock studio has been discontinued and will not see a fix. Users unable to upgrade should use external firewall rules to define the list of permitted destinations."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-918: Server-Side Request Forgery (SSRF)",
|
||||
"cweId": "CWE-918"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "wiremock",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "wiremock",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": " org.wiremock:wiremock-webhooks-extension: >= 2.0.0, < 2.35.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": " org.wiremock:wiremock-webhooks-extension: >= 3.0.0, < 3.0.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": " wiremock-studio: All versions"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/wiremock/wiremock/security/advisories/GHSA-hq8w-9w8w-pmx7",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/wiremock/wiremock/security/advisories/GHSA-hq8w-9w8w-pmx7"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/wiremock/wiremock/releases/tag/3.0.0-beta-15",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/wiremock/wiremock/releases/tag/3.0.0-beta-15"
|
||||
},
|
||||
{
|
||||
"url": "https://wiremock.org/docs/configuration/#preventing-proxying-to-and-recording-from-specific-target-addresses",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiremock.org/docs/configuration/#preventing-proxying-to-and-recording-from-specific-target-addresses"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-hq8w-9w8w-pmx7",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 4.6,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,114 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-41329",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "WireMock is a tool for mocking HTTP services. The proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventing proxying to and recording from specific target addresses. These restrictions can be configured using the domain names, and in such a case the configuration is vulnerable to the DNS rebinding attacks. A similar patch was applied in WireMock 3.0.0-beta-15 for the WireMock Webhook Extensions. The root cause of the attack is a defect in the logic which allows for a race condition triggered by a DNS server whose address expires in between the initial validation and the outbound network request that might go to a domain that was supposed to be prohibited. Control over a DNS service is required to exploit this attack, so it has high execution complexity and limited impact. This issue has been addressed in version 2.35.1 of wiremock-jre8 and wiremock-jre8-standalone, version 3.0.3 of wiremock and wiremock-standalone, version 2.6.1 of the python version of wiremock, and versions 2.35.1-1 and 3.0.3-1 of the wiremock/wiremock Docker container. Users are advised to upgrade. Users unable to upgrade should either configure firewall rules to define the list of permitted destinations or to configure WireMock to use IP addresses instead of the domain names."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-290: Authentication Bypass by Spoofing",
|
||||
"cweId": "CWE-290"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "wiremock",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "wiremock",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": " org.wiremock:wiremock: < 3.0.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": " org.wiremock:wiremock-standalone: < 3.0.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "com.tomakehurst.wiremock:wiremock-jre8: < 2.35.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "com.tomakehurst.wiremock:wiremock-jre8-standalone: < 2.35.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "pypi: wiremock: < 2.6.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "wiremock/wiremock: < 2.35.1-1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "wiremock/wiremock: >= 3.0.0, < 3.0.3-1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/wiremock/wiremock/security/advisories/GHSA-pmxq-pj47-j8j4",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/wiremock/wiremock/security/advisories/GHSA-pmxq-pj47-j8j4"
|
||||
},
|
||||
{
|
||||
"url": "https://wiremock.org/docs/configuration/#preventing-proxying-to-and-recording-from-specific-target-addresses",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiremock.org/docs/configuration/#preventing-proxying-to-and-recording-from-specific-target-addresses"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-pmxq-pj47-j8j4",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 3.9,
|
||||
"baseSeverity": "LOW",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user