From 3c42c355ee9869fe7ca69cbab40b9de1fa696a0b Mon Sep 17 00:00:00 2001 From: CVE Team Date: Tue, 13 Feb 2024 14:00:34 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2020/7xxx/CVE-2020-7924.json | 116 ++++++++------- 2021/20xxx/CVE-2021-20327.json | 112 +++++++-------- 2021/20xxx/CVE-2021-20328.json | 119 ++++++++-------- 2024/1xxx/CVE-2024-1309.json | 81 ++++++++++- 2024/24xxx/CVE-2024-24781.json | 251 ++++++++++++++++++++++++++++++++- 2024/24xxx/CVE-2024-24782.json | 239 ++++++++++++++++++++++++++++++- 6 files changed, 730 insertions(+), 188 deletions(-) diff --git a/2020/7xxx/CVE-2020-7924.json b/2020/7xxx/CVE-2020-7924.json index cffcb90dbc4..e47642d888b 100644 --- a/2020/7xxx/CVE-2020-7924.json +++ b/2020/7xxx/CVE-2020-7924.json @@ -1,15 +1,38 @@ { + "data_version": "4.0", + "data_type": "CVE", + "data_format": "MITRE", "CVE_data_meta": { - "ASSIGNER": "cna@mongodb.com", - "DATE_PUBLIC": "2021-04-12T16:00:00.000Z", "ID": "CVE-2020-7924", - "STATE": "PUBLIC", - "TITLE": "Specific command line parameter might result in accepting invalid certificate" + "ASSIGNER": "cna@mongodb.com", + "STATE": "PUBLIC" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions later than 3.6.5; 3.6 versions prior to 3.6.21; 4.0 versions prior to 4.0.21; 4.2 versions prior to 4.2.11; 100 versions prior to 100.2.0. MongoDB Inc. Mongomirror 0 versions later than 0.6.0.\n\n" + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-295 Improper Certificate Validation", + "cweId": "CWE-295" + } + ] + } + ] }, "affects": { "vendor": { "vendor_data": [ { + "vendor_name": "MongoDB Inc.", "product": { "product_data": [ { @@ -17,13 +40,8 @@ "version": { "version_data": [ { - "version_affected": ">", - "version_name": "3.6", - "version_value": "3.6.5" - }, - { - "version_affected": "<", - "version_name": "3.6", + "version_affected": "<=", + "version_name": "3.6.5", "version_value": "3.6.21" }, { @@ -49,72 +67,50 @@ "version": { "version_data": [ { - "version_affected": ">", - "version_name": "0", - "version_value": "0.6.0" + "version_affected": "<", + "version_name": "0.6.0", + "version_value": "0*" } ] } } ] - }, - "vendor_name": "MongoDB Inc." + } } ] } }, - "data_format": "MITRE", - "data_type": "CVE", - "data_version": "4.0", - "description": { - "description_data": [ + "references": { + "reference_data": [ { - "lang": "eng", - "value": "Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions later than 3.6.5; 3.6 versions prior to 3.6.21; 4.0 versions prior to 4.0.21; 4.2 versions prior to 4.2.11; 100 versions prior to 100.2.0. MongoDB Inc. Mongomirror 0 versions later than 0.6.0." + "url": "https://jira.mongodb.org/browse/TOOLS-2587", + "refsource": "MISC", + "name": "https://jira.mongodb.org/browse/TOOLS-2587" } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, - "impact": { - "cvss": { - "attackComplexity": "HIGH", - "attackVector": "NETWORK", - "availabilityImpact": "NONE", - "baseScore": 4.2, - "baseSeverity": "MEDIUM", - "confidentialityImpact": "LOW", - "integrityImpact": "LOW", - "privilegesRequired": "NONE", - "scope": "UNCHANGED", - "userInteraction": "REQUIRED", - "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", - "version": "3.1" - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ - { - "lang": "eng", - "value": "CWE-295 Improper Certificate Validation" - } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "refsource": "MISC", - "url": "https://jira.mongodb.org/browse/TOOLS-2587", - "name": "https://jira.mongodb.org/browse/TOOLS-2587" - } - ] - }, "source": { "discovery": "INTERNAL" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 4.2, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", + "version": "3.1" + } + ] } } \ No newline at end of file diff --git a/2021/20xxx/CVE-2021-20327.json b/2021/20xxx/CVE-2021-20327.json index e70ab256c3d..33840daa51d 100644 --- a/2021/20xxx/CVE-2021-20327.json +++ b/2021/20xxx/CVE-2021-20327.json @@ -1,88 +1,88 @@ { - "CVE_data_meta": { - "ASSIGNER": "cna@mongodb.com", - "DATE_PUBLIC": "2021-02-25T14:51:00.000Z", - "ID": "CVE-2021-20327", - "STATE": "PUBLIC", - "TITLE": " MongoDB Node.js client side field level encryption library may not be validating KMS certificate" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "product": { - "product_data": [ - { - "product_name": "mongodb-client-encryption module", - "version": { - "version_data": [ - { - "version_affected": "=", - "version_name": "1.2", - "version_value": "1.2.0" - } - ] - } - } - ] - }, - "vendor_name": "MongoDB Inc." - } - ] - } - }, - "data_format": "MITRE", - "data_type": "CVE", "data_version": "4.0", + "data_type": "CVE", + "data_format": "MITRE", + "CVE_data_meta": { + "ID": "CVE-2021-20327", + "ASSIGNER": "cna@mongodb.com", + "STATE": "PUBLIC" + }, "description": { "description_data": [ { "lang": "eng", - "value": "A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and the KMS service rendering client-side field level encryption (CSFLE) ineffective. This issue was discovered during internal testing and affects mongodb-client-encryption module version 1.2.0, which was available from 2021-Jan-29 and deprecated in the NPM Registry on 2021-Feb-04. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services from applications residing inside the AWS, GCP, and Azure nework fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption." + "value": "A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and the KMS service rendering client-side field level encryption (CSFLE) ineffective. This issue was discovered during internal testing and affects mongodb-client-encryption module version 1.2.0, which was available from 2021-Jan-29 and deprecated in the NPM Registry on 2021-Feb-04. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services from applications residing inside the AWS, GCP, and Azure nework fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption. This issue affect MongoDB Node.js Driver mongodb-client-encryption module version 1.2.0\n\n\n" } ] }, - "generator": { - "engine": "Vulnogram 0.0.9" - }, - "impact": { - "cvss": { - "attackComplexity": "HIGH", - "attackVector": "ADJACENT_NETWORK", - "availabilityImpact": "NONE", - "baseScore": 6.4, - "baseSeverity": "MEDIUM", - "confidentialityImpact": "HIGH", - "integrityImpact": "HIGH", - "privilegesRequired": "NONE", - "scope": "UNCHANGED", - "userInteraction": "REQUIRED", - "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", - "version": "3.1" - } - }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", - "value": "CWE-295 Improper Certificate Validation" + "value": "CWE-295 Improper Certificate Validation", + "cweId": "CWE-295" } ] } ] }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "MongoDB Inc.", + "product": { + "product_data": [ + { + "product_name": "MongoDB Node.js Driver mongodb-client-encryption module", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "1.2.0" + } + ] + } + } + ] + } + } + ] + } + }, "references": { "reference_data": [ { - "refsource": "MISC", "url": "https://jira.mongodb.org/browse/NODE-3125", + "refsource": "MISC", "name": "https://jira.mongodb.org/browse/NODE-3125" } ] }, + "generator": { + "engine": "Vulnogram 0.0.9" + }, "source": { "discovery": "INTERNAL" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "HIGH", + "attackVector": "ADJACENT_NETWORK", + "availabilityImpact": "NONE", + "baseScore": 6.4, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", + "version": "3.1" + } + ] } } \ No newline at end of file diff --git a/2021/20xxx/CVE-2021-20328.json b/2021/20xxx/CVE-2021-20328.json index 98268360d8f..03e08c47cd4 100644 --- a/2021/20xxx/CVE-2021-20328.json +++ b/2021/20xxx/CVE-2021-20328.json @@ -1,15 +1,38 @@ { + "data_version": "4.0", + "data_type": "CVE", + "data_format": "MITRE", "CVE_data_meta": { - "ASSIGNER": "cna@mongodb.com", - "DATE_PUBLIC": "2021-02-25T17:00:00.000Z", "ID": "CVE-2021-20328", - "STATE": "PUBLIC", - "TITLE": " MongoDB Java driver client-side field level encryption not verifying KMS host name" + "ASSIGNER": "cna@mongodb.com", + "STATE": "PUBLIC" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption.\n\n" + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-295 Improper Certificate Validation", + "cweId": "CWE-295" + } + ] + } + ] }, "affects": { "vendor": { "vendor_data": [ { + "vendor_name": "MongoDB Inc.", "product": { "product_data": [ { @@ -50,6 +73,10 @@ "product_name": "mongodb-driver-sync", "version": { "version_data": [ + { + "version_affected": "=", + "version_value": "4.2.0" + }, { "version_affected": "<=", "version_name": "3.11", @@ -69,11 +96,6 @@ "version_affected": "<=", "version_name": "4.1", "version_value": "4.1.1" - }, - { - "version_affected": "=", - "version_name": "4.2", - "version_value": "4.2.0" } ] } @@ -82,6 +104,10 @@ "product_name": "mongodb-driver-legacy", "version": { "version_data": [ + { + "version_affected": "=", + "version_value": "4.2.0" + }, { "version_affected": "<=", "version_name": "3.11", @@ -101,74 +127,47 @@ "version_affected": "<=", "version_name": "4.1", "version_value": "4.1.1" - }, - { - "version_affected": "=", - "version_name": "4.2", - "version_value": "4.2.0" } ] } } ] - }, - "vendor_name": "MongoDB Inc." + } } ] } }, - "data_format": "MITRE", - "data_type": "CVE", - "data_version": "4.0", - "description": { - "description_data": [ + "references": { + "reference_data": [ { - "lang": "eng", - "value": "Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server\u2019s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don\u2019t use Field Level Encryption." + "url": "https://jira.mongodb.org/browse/JAVA-4017", + "refsource": "MISC", + "name": "https://jira.mongodb.org/browse/JAVA-4017" } ] }, "generator": { "engine": "Vulnogram 0.0.9" }, - "impact": { - "cvss": { - "attackComplexity": "HIGH", - "attackVector": "ADJACENT_NETWORK", - "availabilityImpact": "NONE", - "baseScore": 6.4, - "baseSeverity": "MEDIUM", - "confidentialityImpact": "HIGH", - "integrityImpact": "HIGH", - "privilegesRequired": "NONE", - "scope": "UNCHANGED", - "userInteraction": "REQUIRED", - "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", - "version": "3.1" - } - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ - { - "lang": "eng", - "value": "CWE-295 Improper Certificate Validation" - } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "refsource": "MISC", - "url": "https://jira.mongodb.org/browse/JAVA-4017", - "name": "https://jira.mongodb.org/browse/JAVA-4017" - } - ] - }, "source": { "discovery": "INTERNAL" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "HIGH", + "attackVector": "ADJACENT_NETWORK", + "availabilityImpact": "NONE", + "baseScore": 6.4, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", + "version": "3.1" + } + ] } } \ No newline at end of file diff --git a/2024/1xxx/CVE-2024-1309.json b/2024/1xxx/CVE-2024-1309.json index f7bd5e06c33..bd3dd840e5b 100644 --- a/2024/1xxx/CVE-2024-1309.json +++ b/2024/1xxx/CVE-2024-1309.json @@ -1,17 +1,90 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-1309", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@honeywell.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Uncontrolled Resource Consumption vulnerability in Honeywell Niagara Framework on Windows, Linux, QNX allows Content Spoofing.This issue affects Niagara Framework: before Niagara AX 3.8.1, before Niagara 4.1.\n\n" + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-400 Uncontrolled Resource Consumption", + "cweId": "CWE-400" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Honeywell", + "product": { + "product_data": [ + { + "product_name": "Niagara Framework", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "0", + "version_value": "Niagara AX 3.8.1" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://process.honeywell.com", + "refsource": "MISC", + "name": "https://process.honeywell.com" + }, + { + "url": "https://www.honeywell.com/us/en/product-security", + "refsource": "MISC", + "name": "https://www.honeywell.com/us/en/product-security" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "accessComplexity": "LOW", + "accessVector": "NETWORK", + "authentication": "NONE", + "availabilityImpact": "PARTIAL", + "baseScore": 6.4, + "confidentialityImpact": "NONE", + "integrityImpact": "PARTIAL", + "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", + "version": "2.0" } ] } diff --git a/2024/24xxx/CVE-2024-24781.json b/2024/24xxx/CVE-2024-24781.json index 086198e9c02..bb147ea257f 100644 --- a/2024/24xxx/CVE-2024-24781.json +++ b/2024/24xxx/CVE-2024-24781.json @@ -1,17 +1,260 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-24781", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "info@cert.vde.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An unauthenticated remote attacker can use an uncontrolled resource consumption vulnerability to DoS the affected devices through excessive traffic on a single ethernet port.\u00a0" + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-400 Uncontrolled Resource Consumption", + "cweId": "CWE-400" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "HIMA", + "product": { + "product_data": [ + { + "product_name": "F30 03X YY (COM)", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "24.14" + } + ] + } + }, + { + "product_name": "F30 03X YY (CPU)", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "18.6" + } + ] + } + }, + { + "product_name": "F35 03X YY (COM)", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "24.14" + } + ] + } + }, + { + "product_name": "F35 03X YY (CPU)", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "18.6" + } + ] + } + }, + { + "product_name": "F60 CPU 03X YY (COM)", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "24.14" + } + ] + } + }, + { + "product_name": "F60 CPU 03X YY (CPU)", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "18.6" + } + ] + } + }, + { + "product_name": "F-COM 01", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14.12" + } + ] + } + }, + { + "product_name": "F-COM 01 coated", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14.12" + } + ] + } + }, + { + "product_name": "F-CPU 01", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14.6" + } + ] + } + }, + { + "product_name": "F-CPU 01 coated", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14.6" + } + ] + } + }, + { + "product_name": "X-COM 01 E YY", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "15.14" + } + ] + } + }, + { + "product_name": "X-COM 01 YY", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14.12" + } + ] + } + }, + { + "product_name": "X-CPU 01", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14.6" + } + ] + } + }, + { + "product_name": "X-CPU 31", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14.6" + } + ] + } + }, + { + "product_name": "X-SB 01", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "7.54" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://cert.vde.com/en/advisories/VDE-2024-013", + "refsource": "MISC", + "name": "https://cert.vde.com/en/advisories/VDE-2024-013" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "advisory": "VDE-2024-013", + "defect": [ + "CERT@VDE#64651" + ], + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "version": "3.1" } ] } diff --git a/2024/24xxx/CVE-2024-24782.json b/2024/24xxx/CVE-2024-24782.json index 7658ddfee5e..db300e2fecb 100644 --- a/2024/24xxx/CVE-2024-24782.json +++ b/2024/24xxx/CVE-2024-24782.json @@ -1,17 +1,248 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-24782", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "info@cert.vde.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An unauthenticated attacker can send a ping request from one network to another through an error in the origin verification even though the ports are separated by VLAN." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-346 Origin Validation Error", + "cweId": "CWE-346" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "HIMA", + "product": { + "product_data": [ + { + "product_name": "F30 03X YY (COM)", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "24.14" + } + ] + } + }, + { + "product_name": "F30 03X YY (CPU)", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "18.6" + } + ] + } + }, + { + "product_name": "F35 03X YY (COM)", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "24.14" + } + ] + } + }, + { + "product_name": "F35 03X YY (CPU)", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "18.6" + } + ] + } + }, + { + "product_name": "F60 CPU 03X YY (COM)", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "24.14" + } + ] + } + }, + { + "product_name": "F60 CPU 03X YY (CPU)", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "18.6" + } + ] + } + }, + { + "product_name": "F-COM 01", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14.12" + } + ] + } + }, + { + "product_name": "F-COM 01 coated", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14.12" + } + ] + } + }, + { + "product_name": "F-CPU 01", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14.6" + } + ] + } + }, + { + "product_name": "F-CPU 01 coated", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14.6" + } + ] + } + }, + { + "product_name": "X-COM 01 E YY", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "15.14" + } + ] + } + }, + { + "product_name": "X-COM 01 YY", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14.12" + } + ] + } + }, + { + "product_name": "X-CPU 01", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14.6" + } + ] + } + }, + { + "product_name": "X-CPU 31", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "14.6" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://cert.vde.com/en/advisories/VDE-2024-013", + "refsource": "MISC", + "name": "https://cert.vde.com/en/advisories/VDE-2024-013" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "advisory": "VDE-2024-013", + "defect": [ + "CERT@VDE#64651" + ], + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "ADJACENT_NETWORK", + "availabilityImpact": "NONE", + "baseScore": 4.3, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "LOW", + "integrityImpact": "NONE", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", + "version": "3.1" } ] }