From 3bcb26e705aa1d1e91c7b532d21708e536d9459d Mon Sep 17 00:00:00 2001 From: CVE Team Date: Sun, 14 May 2023 09:00:36 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2023/2xxx/CVE-2023-2691.json | 96 ++++++++++++++++++++++++++++++++++-- 2023/2xxx/CVE-2023-2692.json | 96 ++++++++++++++++++++++++++++++++++-- 2023/2xxx/CVE-2023-2693.json | 96 ++++++++++++++++++++++++++++++++++-- 3 files changed, 276 insertions(+), 12 deletions(-) diff --git a/2023/2xxx/CVE-2023-2691.json b/2023/2xxx/CVE-2023-2691.json index eb4be3ee25f..a37be8cd15a 100644 --- a/2023/2xxx/CVE-2023-2691.json +++ b/2023/2xxx/CVE-2023-2691.json @@ -1,17 +1,105 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-2691", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability, which was classified as problematic, was found in SourceCodester Personnel Property Equipment System 1.0. Affected is an unknown function of the file admin/add_item.php of the component POST Parameter Handler. The manipulation of the argument item_name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-228972." + }, + { + "lang": "deu", + "value": "Es wurde eine Schwachstelle in SourceCodester Personnel Property Equipment System 1.0 gefunden. Sie wurde als problematisch eingestuft. Es geht dabei um eine nicht klar definierte Funktion der Datei admin/add_item.php der Komponente POST Parameter Handler. Durch das Manipulieren des Arguments item_name mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Cross Site Scripting", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SourceCodester", + "product": { + "product_data": [ + { + "product_name": "Personnel Property Equipment System", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "1.0" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.228972", + "refsource": "MISC", + "name": "https://vuldb.com/?id.228972" + }, + { + "url": "https://vuldb.com/?ctiid.228972", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.228972" + }, + { + "url": "https://github.com/LeozhangCA/CVEReport/blob/main/StoredXSS.md", + "refsource": "MISC", + "name": "https://github.com/LeozhangCA/CVEReport/blob/main/StoredXSS.md" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "LeoZhangCA (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 3.5, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "baseSeverity": "LOW" + }, + { + "version": "3.0", + "baseScore": 3.5, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "baseSeverity": "LOW" + }, + { + "version": "2.0", + "baseScore": 4, + "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", + "baseSeverity": "MEDIUM" } ] } diff --git a/2023/2xxx/CVE-2023-2692.json b/2023/2xxx/CVE-2023-2692.json index 31de26141d7..af9a609f5ec 100644 --- a/2023/2xxx/CVE-2023-2692.json +++ b/2023/2xxx/CVE-2023-2692.json @@ -1,17 +1,105 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-2692", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability has been found in SourceCodester ICT Laboratory Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file views/room_info.php of the component GET Parameter Handler. The manipulation of the argument name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228973 was assigned to this vulnerability." + }, + { + "lang": "deu", + "value": "In SourceCodester ICT Laboratory Management System 1.0 wurde eine Schwachstelle gefunden. Sie wurde als problematisch eingestuft. Dabei geht es um eine nicht genauer bekannte Funktion der Datei views/room_info.php der Komponente GET Parameter Handler. Durch Manipulieren des Arguments name mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Cross Site Scripting", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SourceCodester", + "product": { + "product_data": [ + { + "product_name": "ICT Laboratory Management System", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "1.0" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.228973", + "refsource": "MISC", + "name": "https://vuldb.com/?id.228973" + }, + { + "url": "https://vuldb.com/?ctiid.228973", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.228973" + }, + { + "url": "https://github.com/LeozhangCA/CVEReport/blob/main/XSS.md", + "refsource": "MISC", + "name": "https://github.com/LeozhangCA/CVEReport/blob/main/XSS.md" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "LeoZhangCA (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 3.5, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "baseSeverity": "LOW" + }, + { + "version": "3.0", + "baseScore": 3.5, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "baseSeverity": "LOW" + }, + { + "version": "2.0", + "baseScore": 4, + "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", + "baseSeverity": "MEDIUM" } ] } diff --git a/2023/2xxx/CVE-2023-2693.json b/2023/2xxx/CVE-2023-2693.json index 82bca3b045f..fc028cc7e0c 100644 --- a/2023/2xxx/CVE-2023-2693.json +++ b/2023/2xxx/CVE-2023-2693.json @@ -1,17 +1,105 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-2693", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability was found in SourceCodester Online Exam System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /mahasiswa/data of the component POST Parameter Handler. The manipulation of the argument columns[1][data] leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-228974 is the identifier assigned to this vulnerability." + }, + { + "lang": "deu", + "value": "Eine Schwachstelle wurde in SourceCodester Online Exam System 1.0 gefunden. Sie wurde als kritisch eingestuft. Hierbei geht es um eine nicht exakt ausgemachte Funktion der Datei /mahasiswa/data der Komponente POST Parameter Handler. Durch das Beeinflussen des Arguments columns[1][data] mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-89 SQL Injection", + "cweId": "CWE-89" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SourceCodester", + "product": { + "product_data": [ + { + "product_name": "Online Exam System", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "1.0" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.228974", + "refsource": "MISC", + "name": "https://vuldb.com/?id.228974" + }, + { + "url": "https://vuldb.com/?ctiid.228974", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.228974" + }, + { + "url": "https://github.com/tht1997/CVE_2023/blob/main/Lost%20and%20Found%20Information%20System/img/mahasiswa_data.png", + "refsource": "MISC", + "name": "https://github.com/tht1997/CVE_2023/blob/main/Lost%20and%20Found%20Information%20System/img/mahasiswa_data.png" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "huutuanbg97 (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 6.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "3.0", + "baseScore": 6.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "2.0", + "baseScore": 6.5, + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", + "baseSeverity": "MEDIUM" } ] }