mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-08-04 08:44:25 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
4af941613a
commit
3bd66ed57e
@ -10,6 +10,7 @@
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Zephyr",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
@ -17,16 +18,13 @@
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"platform": "all",
|
||||
"version_affected": "<",
|
||||
"version_value": "1.14.0"
|
||||
"version_value": "prior to 1.14.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Zephyr"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -38,7 +36,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote code execution.\nThis issue affects:\nZephyr shell versions prior to 1.14.0 on all."
|
||||
"value": "Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service, and possibly remote code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -60,16 +58,19 @@
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-17"
|
||||
"refsource": "MISC",
|
||||
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-17",
|
||||
"name": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-17"
|
||||
},
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
|
||||
"refsource": "MISC",
|
||||
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html",
|
||||
"name": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
|
||||
},
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13260"
|
||||
"refsource": "MISC",
|
||||
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13260",
|
||||
"name": "https://github.com/zephyrproject-rtos/zephyr/pull/13260"
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -79,4 +80,4 @@
|
||||
],
|
||||
"discovery": "USER"
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -10,6 +10,7 @@
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Zephyr",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
@ -17,16 +18,13 @@
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"platform": "all",
|
||||
"version_affected": "<",
|
||||
"version_value": "1.14.0"
|
||||
"version_value": "prior to 1.14.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Zephyr"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -38,7 +36,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user to cause a crash, possibly with arbitrary code execution.\nThis issue affects:\nZephyr shell versions prior to 1.14.0 on all."
|
||||
"value": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the shell component of Zephyr allows a serial or telnet connected user to cause a crash, possibly with arbitrary code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -60,16 +58,19 @@
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-18"
|
||||
"refsource": "MISC",
|
||||
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html",
|
||||
"name": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
|
||||
},
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://docs.zephyrproject.org/1.14.0/releases/release-notes-1.14.html"
|
||||
"refsource": "MISC",
|
||||
"url": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-18",
|
||||
"name": "https://zephyrprojectsec.atlassian.net/browse/ZEPSEC-18"
|
||||
},
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13048"
|
||||
"refsource": "MISC",
|
||||
"url": "https://github.com/zephyrproject-rtos/zephyr/pull/13048",
|
||||
"name": "https://github.com/zephyrproject-rtos/zephyr/pull/13048"
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -79,4 +80,4 @@
|
||||
],
|
||||
"discovery": "USER"
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,82 +1,80 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-11060",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "HG100 contains an Uncontrolled Resource Consumption vulnerability"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "HG100",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "firmware",
|
||||
"version_value": "1.05.12"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "ASUS"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The web api server on Port 8080 of ASUS HG100 firmware <= 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker can cause a Denial of Service (DoS) by sending headers very slowly to keep HTTP or HTTPS connections and associated resources alive for a long period of time."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-400 Uncontrolled Resource Consumption"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906002",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906002"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/aarVJ",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/aarVJ"
|
||||
},
|
||||
{
|
||||
"name": "https://www.exploit-db.com/exploits/46720",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://www.exploit-db.com/exploits/46720"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-11060",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "HG100 contains an Uncontrolled Resource Consumption vulnerability"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "ASUS",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "HG100 firmware",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "up to 1.05.12"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The web api server on Port 8080 of ASUS HG100 firmware up to 1.05.12, which is vulnerable to Slowloris HTTP Denial of Service: an attacker can cause a Denial of Service (DoS) by sending headers very slowly to keep HTTP or HTTPS connections and associated resources alive for a long period of time."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-400 Uncontrolled Resource Consumption"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906002",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906002"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/aarVJ",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/aarVJ"
|
||||
},
|
||||
{
|
||||
"name": "https://www.exploit-db.com/exploits/46720",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://www.exploit-db.com/exploits/46720"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
@ -1,88 +1,86 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-11061",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "HG100 has a broken access control vulnerability in its Web API Server"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "HG100",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "firmware",
|
||||
"version_value": "4.00.0.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "ASUS"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "timhuang"
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A broken access control vulnerability in HG100 firmware version <= 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via http://[target]/smarthome/devicecontrol without any authentication."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Boken Access Control"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906003",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906003"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/5df6x",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/5df6x"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/tim124058/ASUS-SmartHome-Exploit/",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://github.com/tim124058/ASUS-SmartHome-Exploit/"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-11061",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "HG100 has a broken access control vulnerability in its Web API Server"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "ASUS",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "HG100 firmware",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "up to 4.00.0.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "timhuang"
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A broken access control vulnerability in HG100 firmware versions up to 4.00.06 allows an attacker in the same local area network to control IoT devices that connect with itself via http://[target]/smarthome/devicecontrol without any authentication."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Boken Access Control"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906003",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906003"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/5df6x",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/5df6x"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/tim124058/ASUS-SmartHome-Exploit/",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://github.com/tim124058/ASUS-SmartHome-Exploit/"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
@ -1,93 +1,96 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-11063",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "SmartHome application has a broken access control vulnerability in its Web API Server"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SmartHome",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "Android app version",
|
||||
"version_value": "3.0.42_190515"
|
||||
},
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "ios app version",
|
||||
"version_value": "2.0.22"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "ASUS"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "timhuang"
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A broken access control vulnerability in SmartHome app (Android version <= 3.0.42_190515, ios version <= 2.0.22) allows an attacker in the same local area network to list user accounts and control IoT devices that connect with its gateway (HG100) via http://[target]/smarthome/devicecontrol without any authentication."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Boken Access Control"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201908014",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201908014"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/5LWQJ",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/5LWQJ"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/tim124058/ASUS-SmartHome-Exploit/",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://github.com/tim124058/ASUS-SmartHome-Exploit/"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-11063",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "SmartHome application has a broken access control vulnerability in its Web API Server"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "ASUS",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SmartHome Android app",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "up to 3.0.42_190515"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SmartHome ios app",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "up to 2.0.22"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "timhuang"
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A broken access control vulnerability in SmartHome app (Android versions up to 3.0.42_190515, ios versions up to 2.0.22) allows an attacker in the same local area network to list user accounts and control IoT devices that connect with its gateway (HG100) via http://[target]/smarthome/devicecontrol without any authentication."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Boken Access Control"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://github.com/tim124058/ASUS-SmartHome-Exploit/",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://github.com/tim124058/ASUS-SmartHome-Exploit/"
|
||||
},
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201908014",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201908014"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/5LWQJ",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/5LWQJ"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
@ -1,88 +1,86 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-11064",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "A vulnerability of remote credential disclosure was discovered in Advan VD-1"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Advan VD-1",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "firmware",
|
||||
"version_value": "230"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AndroVideo"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Keniver Wang (CHT Security) "
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware version <= 230. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any authentication."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-200 Information Exposure"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906005",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906005"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/gCDQN",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/gCDQN"
|
||||
},
|
||||
{
|
||||
"name": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-11064",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "A vulnerability of remote credential disclosure was discovered in Advan VD-1"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "AndroVideo",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Advan VD-1 firmware",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "up to 230"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Keniver Wang (CHT Security) "
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A vulnerability of remote credential disclosure was discovered in Advan VD-1 firmware versions up to 230. An attacker can export system configuration which is not encrypted to get the administrator\u2019s account and password in plain text via cgibin/ExportSettings.cgi?Export=1 without any authentication."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-200 Information Exposure"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906005",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906005"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/gCDQN",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/gCDQN"
|
||||
},
|
||||
{
|
||||
"name": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
@ -1,7 +1,7 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"AKA": "",
|
||||
"ASSIGNER": "jordan@liggitt.net",
|
||||
"ASSIGNER": "security@kubernetes.io",
|
||||
"DATE_PUBLIC": "2019-05-24",
|
||||
"ID": "CVE-2019-11245",
|
||||
"STATE": "PUBLIC",
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"AKA": "",
|
||||
"ASSIGNER": "jordan@liggitt.net",
|
||||
"ASSIGNER": "security@kubernetes.io",
|
||||
"DATE_PUBLIC": "2019-06-21",
|
||||
"ID": "CVE-2019-11246",
|
||||
"STATE": "PUBLIC",
|
||||
@ -11,6 +11,7 @@
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Kubernetes",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
@ -18,95 +19,52 @@
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "<",
|
||||
"version_name": "1.12",
|
||||
"version_value": "1.12.9"
|
||||
"version_value": "prior to 1.12.9"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "<",
|
||||
"version_name": "1.13",
|
||||
"version_value": "1.13.6"
|
||||
"version_value": "prior to 1.13.6"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "<",
|
||||
"version_name": "1.14",
|
||||
"version_value": "1.14.2"
|
||||
"version_value": "prior to 1.14.2"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.1",
|
||||
"version_value": "1.1"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.2",
|
||||
"version_value": "1.2"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.3",
|
||||
"version_value": "1.4"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.4",
|
||||
"version_value": "1.4"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.5",
|
||||
"version_value": "1.5"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.6",
|
||||
"version_value": "1.6"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.7",
|
||||
"version_value": "1.7"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.8",
|
||||
"version_value": "1.8"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.9",
|
||||
"version_value": "1.9"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.10",
|
||||
"version_value": "1.10"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.11",
|
||||
"version_value": "1.11"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Kubernetes"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -125,7 +83,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user."
|
||||
"value": "The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user\u2019s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user\u2019s machine when kubectl cp is called, limited only by the system permissions of the local user. Kubernetes affected versions include versions prior to 1.12.9, versions prior to 1.13.6, versions prior to 1.14.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11."
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"AKA": "",
|
||||
"ASSIGNER": "jordan@liggitt.net",
|
||||
"ASSIGNER": "security@kubernetes.io",
|
||||
"DATE_PUBLIC": "2019-08-05",
|
||||
"ID": "CVE-2019-11247",
|
||||
"STATE": "PUBLIC",
|
||||
@ -11,6 +11,7 @@
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Kubernetes",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
@ -18,65 +19,37 @@
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "<",
|
||||
"version_name": "1.13",
|
||||
"version_value": "1.13.9"
|
||||
"version_value": "prior to 1.13.9"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "<",
|
||||
"version_name": "1.14",
|
||||
"version_value": "1.14.5"
|
||||
"version_value": "prior to 1.14.5"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "<",
|
||||
"version_name": "1.15",
|
||||
"version_value": "1.15.2"
|
||||
"version_value": "prior to 1.15.2"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.7",
|
||||
"version_value": "1.7"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.8",
|
||||
"version_value": "1.8"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.9",
|
||||
"version_value": "1.9"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.10",
|
||||
"version_value": "1.10"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.11",
|
||||
"version_value": "1.11"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.12",
|
||||
"version_value": "1.12"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Kubernetes"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -95,7 +68,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges)."
|
||||
"value": "The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12."
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"AKA": "",
|
||||
"ASSIGNER": "jordan@liggitt.net",
|
||||
"ASSIGNER": "security@kubernetes.io",
|
||||
"DATE_PUBLIC": "2019-08-06",
|
||||
"ID": "CVE-2019-11248",
|
||||
"STATE": "PUBLIC",
|
||||
@ -11,6 +11,7 @@
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Kubernetes",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
@ -18,95 +19,52 @@
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "<",
|
||||
"version_name": "1.12",
|
||||
"version_value": "1.12.10"
|
||||
"version_value": "prior to 1.12.10"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "<",
|
||||
"version_name": "1.13",
|
||||
"version_value": "1.13.8"
|
||||
"version_value": "prior to 1.13.8"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "<",
|
||||
"version_name": "1.14",
|
||||
"version_value": "1.14.4"
|
||||
"version_value": "prior to 1.14.4"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.1",
|
||||
"version_value": "1.1"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.2",
|
||||
"version_value": "1.2"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.3",
|
||||
"version_value": "1.4"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.4",
|
||||
"version_value": "1.4"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.5",
|
||||
"version_value": "1.5"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.6",
|
||||
"version_value": "1.6"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.7",
|
||||
"version_value": "1.7"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.8",
|
||||
"version_value": "1.8"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.9",
|
||||
"version_value": "1.9"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.10",
|
||||
"version_value": "1.10"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.11",
|
||||
"version_value": "1.11"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Kubernetes"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"AKA": "",
|
||||
"ASSIGNER": "jordan@liggitt.net",
|
||||
"ASSIGNER": "security@kubernetes.io",
|
||||
"DATE_PUBLIC": "2019-08-05",
|
||||
"ID": "CVE-2019-11249",
|
||||
"STATE": "PUBLIC",
|
||||
@ -11,6 +11,7 @@
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Kubernetes",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
@ -18,101 +19,55 @@
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "<",
|
||||
"version_name": "1.13",
|
||||
"version_value": "1.13.9"
|
||||
"version_value": "prior to 1.13.9"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "<",
|
||||
"version_name": "1.14",
|
||||
"version_value": "1.14.5"
|
||||
"version_value": "prior to 1.14.5"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "<",
|
||||
"version_name": "1.15",
|
||||
"version_value": "1.15.2"
|
||||
"version_value": "prior to 1.15.2"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.1",
|
||||
"version_value": "1.1"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.2",
|
||||
"version_value": "1.2"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.3",
|
||||
"version_value": "1.4"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.4",
|
||||
"version_value": "1.4"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.5",
|
||||
"version_value": "1.5"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.6",
|
||||
"version_value": "1.6"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.7",
|
||||
"version_value": "1.7"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.8",
|
||||
"version_value": "1.8"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.9",
|
||||
"version_value": "1.9"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.10",
|
||||
"version_value": "1.10"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.11",
|
||||
"version_value": "1.11"
|
||||
},
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "=",
|
||||
"version_name": "1.12",
|
||||
"version_value": "1.12"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Kubernetes"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -131,7 +86,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user."
|
||||
"value": "The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on the user\u2019s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user\u2019s machine when kubectl cp is called, limited only by the system permissions of the local user. Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.1, 1.2, 1.4, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -169,15 +124,15 @@
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://github.com/kubernetes/kubernetes/issues/80984",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://github.com/kubernetes/kubernetes/issues/80984"
|
||||
},
|
||||
{
|
||||
"name": "v1.13.9, v1.14.5, v1.15.2 released to address CVE-2019-11247, CVE-2019-11249",
|
||||
"refsource": "MLIST",
|
||||
"url": "https://groups.google.com/d/msg/kubernetes-security-announce/vUtEcSEY6SM/v2ZZxsmtFQAJ"
|
||||
},
|
||||
{
|
||||
"name": "https://github.com/kubernetes/kubernetes/issues/80984",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://github.com/kubernetes/kubernetes/issues/80984"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"AKA": "",
|
||||
"ASSIGNER": "jordan@liggitt.net",
|
||||
"ASSIGNER": "security@kubernetes.io",
|
||||
"DATE_PUBLIC": "2019-08-12",
|
||||
"ID": "CVE-2019-11250",
|
||||
"STATE": "PUBLIC",
|
||||
@ -11,6 +11,7 @@
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Kubernetes",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
@ -18,17 +19,13 @@
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"platform": "",
|
||||
"version_affected": "<",
|
||||
"version_name": "1.16",
|
||||
"version_value": "1.16"
|
||||
"version_value": "prior to 1.16"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Kubernetes"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,88 +1,86 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-13405",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Advan VD-1 allows a remote user to enable Android Debug Bridge without any authentication"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Advan VD-1",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_name": "firmware",
|
||||
"version_value": "230"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AndroVideo"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Keniver Wang (CHT Security) "
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A broken access control vulnerability found in Advan VD-1 firmware version == 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB without any authentication then take the compromised device as a relay or to install mining software."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Broken access control"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906006",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906006"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/VeNHn",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/VeNHn"
|
||||
},
|
||||
{
|
||||
"name": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-13405",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Advan VD-1 allows a remote user to enable Android Debug Bridge without any authentication"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "AndroVideo",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Advan VD-1 firmware",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "230"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Keniver Wang (CHT Security) "
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB without any authentication then take the compromised device as a relay or to install mining software."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Broken access control"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"
|
||||
},
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906006",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906006"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/VeNHn",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/VeNHn"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
@ -1,88 +1,86 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-13406",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Advan VD-1 has a vulnerability that allows remote arbitrary APK installation"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Advan VD-1",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "firmware",
|
||||
"version_value": "230"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AndroVideo"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Keniver Wang (CHT Security) "
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A broken access control vulnerability found in Advan VD-1 firmware version <= 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install arbitrary APK without any authentication."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Broken access control"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906007",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906007"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/hVut7",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/hVut7"
|
||||
},
|
||||
{
|
||||
"name": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-13406",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Advan VD-1 has a vulnerability that allows remote arbitrary APK installation"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "AndroVideo",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Advan VD-1 firmware",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "up to 230"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Keniver Wang (CHT Security) "
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A broken access control vulnerability found in Advan VD-1 firmware versions up to 230. An attacker can send a POST request to cgibin/ApkUpload.cgi to install arbitrary APK without any authentication."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Broken access control"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"
|
||||
},
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906007",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906007"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/hVut7",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/hVut7"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
@ -1,88 +1,86 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-13407",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgi"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Advan VD-1",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "firmware",
|
||||
"version_value": "230"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AndroVideo"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Keniver Wang (CHT Security) "
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A XSS found in Advan VD-1 firmware version <= 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79 Cross-site Scripting (XSS)"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906008",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906008"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/SpTwh",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/SpTwh"
|
||||
},
|
||||
{
|
||||
"name": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-13407",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgi"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "AndroVideo",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Advan VD-1 firmware",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "up to 230"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Keniver Wang (CHT Security) "
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79 Cross-site Scripting (XSS)"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"
|
||||
},
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906008",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906008"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/SpTwh",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/SpTwh"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
@ -1,88 +1,86 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-13408",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Advan VD-1 allows users to download arbitrary files"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Advan VD-1",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "firmware",
|
||||
"version_value": "230"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AndroVideo"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Keniver Wang (CHT Security) "
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A relative path traversal vulnerability found in Advan VD-1 firmware version <= 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-23 Relative Path Traversal"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906009",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906009"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/2bvXq",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/2bvXq"
|
||||
},
|
||||
{
|
||||
"name": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-13408",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Advan VD-1 allows users to download arbitrary files"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "AndroVideo",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Advan VD-1 firmware",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "up to 230"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Keniver Wang (CHT Security) "
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-23 Relative Path Traversal"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"
|
||||
},
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906009",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906009"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/2bvXq",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/2bvXq"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
67
2019/15xxx/CVE-2019-15757.json
Normal file
67
2019/15xxx/CVE-2019-15757.json
Normal file
@ -0,0 +1,67 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-15757",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "n/a",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "libMirage 3.2.2 in CDemu has a NULL pointer dereference in the NRG parser in parser.c."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://gist.github.com/andreafioraldi/343d9ba64060b548c02362a5e61ec932",
|
||||
"refsource": "MISC",
|
||||
"name": "https://gist.github.com/andreafioraldi/343d9ba64060b548c02362a5e61ec932"
|
||||
},
|
||||
{
|
||||
"url": "https://sourceforge.net/p/cdemu/bugs/118/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://sourceforge.net/p/cdemu/bugs/118/"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@ -1,17 +1,61 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-5530",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-5530",
|
||||
"ASSIGNER": "security@vmware.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "n/a",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "InstallBuilder",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "prior to 19.7.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Authenticode signature bypass"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://blog.bitrock.com/2019/08/installer-tampering-while-preserving.html",
|
||||
"url": "https://blog.bitrock.com/2019/08/installer-tampering-while-preserving.html"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Windows binaries generated with InstallBuilder versions earlier than 19.7.0 are vulnerable to tampering even if they contain a valid Authenticode signature."
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user