diff --git a/2023/6xxx/CVE-2023-6606.json b/2023/6xxx/CVE-2023-6606.json index 769ebd4a73e..e76ff3b44bb 100644 --- a/2023/6xxx/CVE-2023-6606.json +++ b/2023/6xxx/CVE-2023-6606.json @@ -111,6 +111,27 @@ ] } }, + { + "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "versions": [ + { + "version": "0:4.18.0-477.51.1.el8_8", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "defaultStatus": "affected" + } + } + ] + } + }, { "product_name": "Red Hat Enterprise Linux 9", "version": { @@ -298,6 +319,11 @@ "refsource": "MISC", "name": "https://access.redhat.com/errata/RHSA-2024:1248" }, + { + "url": "https://access.redhat.com/errata/RHSA-2024:1404", + "refsource": "MISC", + "name": "https://access.redhat.com/errata/RHSA-2024:1404" + }, { "url": "https://access.redhat.com/security/cve/CVE-2023-6606", "refsource": "MISC", diff --git a/2023/6xxx/CVE-2023-6610.json b/2023/6xxx/CVE-2023-6610.json index 501759c7a4a..332aef440af 100644 --- a/2023/6xxx/CVE-2023-6610.json +++ b/2023/6xxx/CVE-2023-6610.json @@ -111,6 +111,27 @@ ] } }, + { + "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "versions": [ + { + "version": "0:4.18.0-477.51.1.el8_8", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "defaultStatus": "affected" + } + } + ] + } + }, { "product_name": "Red Hat Enterprise Linux 9", "version": { @@ -298,6 +319,11 @@ "refsource": "MISC", "name": "https://access.redhat.com/errata/RHSA-2024:1248" }, + { + "url": "https://access.redhat.com/errata/RHSA-2024:1404", + "refsource": "MISC", + "name": "https://access.redhat.com/errata/RHSA-2024:1404" + }, { "url": "https://access.redhat.com/security/cve/CVE-2023-6610", "refsource": "MISC", diff --git a/2023/7xxx/CVE-2023-7192.json b/2023/7xxx/CVE-2023-7192.json index faa9bb5b180..ade37f89ce7 100644 --- a/2023/7xxx/CVE-2023-7192.json +++ b/2023/7xxx/CVE-2023-7192.json @@ -85,6 +85,20 @@ "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "version": { "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "versions": [ + { + "version": "0:4.18.0-305.125.1.rt7.201.el8_4", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "defaultStatus": "affected" + } + }, { "version_value": "not down converted", "x_cve_json_5_version_data": { @@ -144,6 +158,27 @@ ] } }, + { + "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "versions": [ + { + "version": "0:4.18.0-477.51.1.el8_8", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "defaultStatus": "affected" + } + } + ] + } + }, { "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "version": { @@ -357,6 +392,16 @@ "refsource": "MISC", "name": "https://access.redhat.com/errata/RHSA-2024:1367" }, + { + "url": "https://access.redhat.com/errata/RHSA-2024:1382", + "refsource": "MISC", + "name": "https://access.redhat.com/errata/RHSA-2024:1382" + }, + { + "url": "https://access.redhat.com/errata/RHSA-2024:1404", + "refsource": "MISC", + "name": "https://access.redhat.com/errata/RHSA-2024:1404" + }, { "url": "https://access.redhat.com/security/cve/CVE-2023-7192", "refsource": "MISC", diff --git a/2024/0xxx/CVE-2024-0646.json b/2024/0xxx/CVE-2024-0646.json index c2d931f03c4..f01ceb96504 100644 --- a/2024/0xxx/CVE-2024-0646.json +++ b/2024/0xxx/CVE-2024-0646.json @@ -214,6 +214,20 @@ "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "version": { "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "versions": [ + { + "version": "0:4.18.0-305.125.1.rt7.201.el8_4", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "defaultStatus": "affected" + } + }, { "version_value": "not down converted", "x_cve_json_5_version_data": { @@ -248,6 +262,12 @@ ], "defaultStatus": "affected" } + }, + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "defaultStatus": "unaffected" + } } ] } @@ -288,6 +308,20 @@ "x_cve_json_5_version_data": { "defaultStatus": "unaffected" } + }, + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "versions": [ + { + "version": "0:4.18.0-477.51.1.el8_8", + "lessThan": "*", + "versionType": "rpm", + "status": "unaffected" + } + ], + "defaultStatus": "affected" + } } ] } @@ -592,6 +626,21 @@ "refsource": "MISC", "name": "https://access.redhat.com/errata/RHSA-2024:1368" }, + { + "url": "https://access.redhat.com/errata/RHSA-2024:1377", + "refsource": "MISC", + "name": "https://access.redhat.com/errata/RHSA-2024:1377" + }, + { + "url": "https://access.redhat.com/errata/RHSA-2024:1382", + "refsource": "MISC", + "name": "https://access.redhat.com/errata/RHSA-2024:1382" + }, + { + "url": "https://access.redhat.com/errata/RHSA-2024:1404", + "refsource": "MISC", + "name": "https://access.redhat.com/errata/RHSA-2024:1404" + }, { "url": "https://access.redhat.com/security/cve/CVE-2024-0646", "refsource": "MISC", diff --git a/2024/29xxx/CVE-2024-29141.json b/2024/29xxx/CVE-2024-29141.json index 7c3e9b07547..299c79999f2 100644 --- a/2024/29xxx/CVE-2024-29141.json +++ b/2024/29xxx/CVE-2024-29141.json @@ -1,17 +1,122 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-29141", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "audit@patchstack.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PDF Embedder allows Stored XSS.This issue affects PDF Embedder: from n/a through 4.6.4.\n\n" + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "PDF Embedder", + "product": { + "product_data": [ + { + "product_name": "PDF Embedder", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "versions": [ + { + "changes": [ + { + "at": "4.7.1", + "status": "unaffected" + } + ], + "lessThanOrEqual": "4.6.4", + "status": "affected", + "version": "n/a", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://patchstack.com/database/vulnerability/pdf-embedder/wordpress-pdf-embedder-plugin-4-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve", + "refsource": "MISC", + "name": "https://patchstack.com/database/vulnerability/pdf-embedder/wordpress-pdf-embedder-plugin-4-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "EXTERNAL" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Update to 4.7.1 or a higher version." + } + ], + "value": "Update to 4.7.1 or a higher version." + } + ], + "credits": [ + { + "lang": "en", + "value": "Steven Julian" + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 6.5, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "privilegesRequired": "LOW", + "scope": "CHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", + "version": "3.1" } ] } diff --git a/2024/29xxx/CVE-2024-29142.json b/2024/29xxx/CVE-2024-29142.json index b193c912a5c..407e2718939 100644 --- a/2024/29xxx/CVE-2024-29142.json +++ b/2024/29xxx/CVE-2024-29142.json @@ -1,17 +1,122 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-29142", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "audit@patchstack.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebberZone Better Search \u2013 Relevant search results for WordPress allows Stored XSS.This issue affects Better Search \u2013 Relevant search results for WordPress: from n/a through 3.3.0.\n\n" + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "WebberZone", + "product": { + "product_data": [ + { + "product_name": "Better Search \u2013 Relevant search results for WordPress", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "versions": [ + { + "changes": [ + { + "at": "3.3.1", + "status": "unaffected" + } + ], + "lessThanOrEqual": "3.3.0", + "status": "affected", + "version": "n/a", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://patchstack.com/database/vulnerability/better-search/wordpress-better-search-plugin-3-3-0-stored-cross-site-scripting-xss-vulnerability?_s_id=cve", + "refsource": "MISC", + "name": "https://patchstack.com/database/vulnerability/better-search/wordpress-better-search-plugin-3-3-0-stored-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "EXTERNAL" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Update to 3.3.1 or a higher version." + } + ], + "value": "Update to 3.3.1 or a higher version." + } + ], + "credits": [ + { + "lang": "en", + "value": "Abdi Pranata (Patchstack Alliance)" + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 7.1, + "baseSeverity": "HIGH", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "privilegesRequired": "NONE", + "scope": "CHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", + "version": "3.1" } ] } diff --git a/2024/29xxx/CVE-2024-29143.json b/2024/29xxx/CVE-2024-29143.json index ef887731af9..9c40eee0a4a 100644 --- a/2024/29xxx/CVE-2024-29143.json +++ b/2024/29xxx/CVE-2024-29143.json @@ -1,17 +1,122 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-29143", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "audit@patchstack.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs, sareiodata Passwordless Login passwordless-login allows Stored XSS.This issue affects Passwordless Login: from n/a through 1.1.2.\n\n" + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Cozmoslabs, sareiodata", + "product": { + "product_data": [ + { + "product_name": "Passwordless Login", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "versions": [ + { + "changes": [ + { + "at": "1.1.3", + "status": "unaffected" + } + ], + "lessThanOrEqual": "1.1.2", + "status": "affected", + "version": "n/a", + "versionType": "custom" + } + ], + "defaultStatus": "unaffected" + } + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://patchstack.com/database/vulnerability/passwordless-login/wordpress-passwordless-login-plugin-1-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve", + "refsource": "MISC", + "name": "https://patchstack.com/database/vulnerability/passwordless-login/wordpress-passwordless-login-plugin-1-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "EXTERNAL" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Update to 1.1.3 or a higher version." + } + ], + "value": "Update to 1.1.3 or a higher version." + } + ], + "credits": [ + { + "lang": "en", + "value": "stealthcopter (Patchstack Alliance)" + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 6.5, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "privilegesRequired": "LOW", + "scope": "CHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", + "version": "3.1" } ] } diff --git a/2024/2xxx/CVE-2024-2609.json b/2024/2xxx/CVE-2024-2609.json index f9e798a4e3f..21213b98a6f 100644 --- a/2024/2xxx/CVE-2024-2609.json +++ b/2024/2xxx/CVE-2024-2609.json @@ -1,18 +1,75 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2609", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@mozilla.org", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The permission prompt input delay could have expired while the window is not in focus, which made the prompt vulnerable to clickjacking by malicious websites. This vulnerability affects Firefox < 124." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Permission prompt input delay could expire when not in focus" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Mozilla", + "product": { + "product_data": [ + { + "product_name": "Firefox", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "unspecified", + "version_value": "124" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1866100", + "refsource": "MISC", + "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1866100" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2024-12/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2024-12/" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Shaheen Fazim" + } + ] } \ No newline at end of file diff --git a/2024/2xxx/CVE-2024-2610.json b/2024/2xxx/CVE-2024-2610.json index 897648faac7..72627262746 100644 --- a/2024/2xxx/CVE-2024-2610.json +++ b/2024/2xxx/CVE-2024-2610.json @@ -1,18 +1,109 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2610", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@mozilla.org", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass strict content security policies. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Improper handling of html and body tags enabled CSP nonce leakage" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Mozilla", + "product": { + "product_data": [ + { + "product_name": "Firefox", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "unspecified", + "version_value": "124" + } + ] + } + }, + { + "product_name": "Firefox ESR", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "unspecified", + "version_value": "115.9" + } + ] + } + }, + { + "product_name": "Thunderbird", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "unspecified", + "version_value": "115.9" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1871112", + "refsource": "MISC", + "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1871112" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2024-12/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2024-12/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2024-13/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2024-13/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2024-14/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2024-14/" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Georg Felber and Marco Squarcina (TU Wien)" + } + ] } \ No newline at end of file diff --git a/2024/2xxx/CVE-2024-2611.json b/2024/2xxx/CVE-2024-2611.json index 0669605da11..4dc671e2dd2 100644 --- a/2024/2xxx/CVE-2024-2611.json +++ b/2024/2xxx/CVE-2024-2611.json @@ -1,18 +1,109 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2611", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@mozilla.org", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Clickjacking vulnerability could have led to a user accidentally granting permissions" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Mozilla", + "product": { + "product_data": [ + { + "product_name": "Firefox", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "unspecified", + "version_value": "124" + } + ] + } + }, + { + "product_name": "Firefox ESR", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "unspecified", + "version_value": "115.9" + } + ] + } + }, + { + "product_name": "Thunderbird", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "unspecified", + "version_value": "115.9" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1876675", + "refsource": "MISC", + "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1876675" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2024-12/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2024-12/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2024-13/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2024-13/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2024-14/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2024-14/" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Hafiizh" + } + ] } \ No newline at end of file diff --git a/2024/2xxx/CVE-2024-2612.json b/2024/2xxx/CVE-2024-2612.json index 367987c7653..7f313e191d1 100644 --- a/2024/2xxx/CVE-2024-2612.json +++ b/2024/2xxx/CVE-2024-2612.json @@ -1,18 +1,109 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2612", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@mozilla.org", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered a crash or potentially be leveraged to achieve code execution. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Self referencing object could have potentially led to a use-after-free" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Mozilla", + "product": { + "product_data": [ + { + "product_name": "Firefox", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "unspecified", + "version_value": "124" + } + ] + } + }, + { + "product_name": "Firefox ESR", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "unspecified", + "version_value": "115.9" + } + ] + } + }, + { + "product_name": "Thunderbird", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "unspecified", + "version_value": "115.9" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1879444", + "refsource": "MISC", + "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1879444" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2024-12/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2024-12/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2024-13/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2024-13/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2024-14/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2024-14/" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Ronald Crane" + } + ] } \ No newline at end of file diff --git a/2024/2xxx/CVE-2024-2613.json b/2024/2xxx/CVE-2024-2613.json index 2f8a292a5d0..79c1e8ea876 100644 --- a/2024/2xxx/CVE-2024-2613.json +++ b/2024/2xxx/CVE-2024-2613.json @@ -1,18 +1,75 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2613", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@mozilla.org", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash. This vulnerability affects Firefox < 124." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Improper handling of QUIC ACK frame data could have led to OOM" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Mozilla", + "product": { + "product_data": [ + { + "product_name": "Firefox", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "unspecified", + "version_value": "124" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1875701", + "refsource": "MISC", + "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1875701" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2024-12/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2024-12/" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Max Inden" + } + ] } \ No newline at end of file diff --git a/2024/2xxx/CVE-2024-2614.json b/2024/2xxx/CVE-2024-2614.json index 8a8d06453c0..1528b444ca6 100644 --- a/2024/2xxx/CVE-2024-2614.json +++ b/2024/2xxx/CVE-2024-2614.json @@ -1,18 +1,109 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2614", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@mozilla.org", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Mozilla", + "product": { + "product_data": [ + { + "product_name": "Firefox", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "unspecified", + "version_value": "124" + } + ] + } + }, + { + "product_name": "Firefox ESR", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "unspecified", + "version_value": "115.9" + } + ] + } + }, + { + "product_name": "Thunderbird", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "unspecified", + "version_value": "115.9" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1685358%2C1861016%2C1880405%2C1881093", + "refsource": "MISC", + "name": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1685358%2C1861016%2C1880405%2C1881093" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2024-12/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2024-12/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2024-13/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2024-13/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2024-14/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2024-14/" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Noah Lokocz, Kevin Brosnan, Ryan VanderMeulen and the Mozilla Fuzzing Team" + } + ] } \ No newline at end of file diff --git a/2024/2xxx/CVE-2024-2615.json b/2024/2xxx/CVE-2024-2615.json index f541ffad1d2..847ab28f910 100644 --- a/2024/2xxx/CVE-2024-2615.json +++ b/2024/2xxx/CVE-2024-2615.json @@ -55,9 +55,9 @@ "references": { "reference_data": [ { - "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1881074%2C1882438%2C1881650", + "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1881074%2C1882438", "refsource": "MISC", - "name": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1881074%2C1882438%2C1881650" + "name": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1881074%2C1882438" }, { "url": "https://www.mozilla.org/security/advisories/mfsa2024-12/", diff --git a/2024/2xxx/CVE-2024-2616.json b/2024/2xxx/CVE-2024-2616.json index 961013f7651..49786daa935 100644 --- a/2024/2xxx/CVE-2024-2616.json +++ b/2024/2xxx/CVE-2024-2616.json @@ -1,18 +1,92 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2616", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@mozilla.org", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt to continue. This vulnerability affects Firefox ESR < 115.9 and Thunderbird < 115.9." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Improve handling of out-of-memory conditions in ICU" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Mozilla", + "product": { + "product_data": [ + { + "product_name": "Firefox ESR", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "unspecified", + "version_value": "115.9" + } + ] + } + }, + { + "product_name": "Thunderbird", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "unspecified", + "version_value": "115.9" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1846197", + "refsource": "MISC", + "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1846197" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2024-13/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2024-13/" + }, + { + "url": "https://www.mozilla.org/security/advisories/mfsa2024-14/", + "refsource": "MISC", + "name": "https://www.mozilla.org/security/advisories/mfsa2024-14/" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Ryan VanderMeulen and Dan Minor" + } + ] } \ No newline at end of file diff --git a/2024/2xxx/CVE-2024-2632.json b/2024/2xxx/CVE-2024-2632.json index b947611f1ce..16a6db8cdcb 100644 --- a/2024/2xxx/CVE-2024-2632.json +++ b/2024/2xxx/CVE-2024-2632.json @@ -84,6 +84,10 @@ { "lang": "en", "value": "Pedro Jose Navas P\u00e9rez" + }, + { + "lang": "en", + "value": "Jes\u00fas Ant\u00f3n" } ], "impact": { diff --git a/2024/2xxx/CVE-2024-2633.json b/2024/2xxx/CVE-2024-2633.json index 1653f82e0ac..80f17487ed6 100644 --- a/2024/2xxx/CVE-2024-2633.json +++ b/2024/2xxx/CVE-2024-2633.json @@ -1,17 +1,106 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2633", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cve-coordination@incibe.es", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A Cross-Site Scripting Vulnerability has been found on Meta4 HR affecting version 819.001.022 and earlier. The endpoint '/sitetest/english/dumpenv.jsp' is vulnerable to XSS attack by 'lang' query, i.e. '/sitetest/english/dumpenv.jsp?snoop=yes&lang=%27%3Cimg%20src/onerror=alert(1)%3E¶ms'." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Cross-site Scripting (XSS)", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Cegid", + "product": { + "product_data": [ + { + "product_name": "Meta4 HR", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "819.001.022" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid", + "refsource": "MISC", + "name": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "EXTERNAL" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "The Meta4 HR system administrator should remove the following pages from the web servers facing the Internet: From M4WebServices: The folder \"sitetest\" (containing the dumpenv.jsp page) From M4Gateway: The page dump.jsp In future releases of Cegid Meta4 HR, these pages will be removed from the distribution since they do not offer real functionality.
" + } + ], + "value": "The Meta4 HR system administrator should remove the following pages from the web servers facing the Internet: From M4WebServices: The folder \"sitetest\" (containing the dumpenv.jsp page) From M4Gateway: The page dump.jsp In future releases of Cegid Meta4 HR, these pages will be removed from the distribution since they do not offer real functionality.\n" + } + ], + "credits": [ + { + "lang": "en", + "value": "Pedro Jose Navas P\u00e9rez" + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 6.1, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "privilegesRequired": "NONE", + "scope": "CHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "version": "3.1" } ] } diff --git a/2024/2xxx/CVE-2024-2634.json b/2024/2xxx/CVE-2024-2634.json index 194ba42de4c..f1e78e7d5d9 100644 --- a/2024/2xxx/CVE-2024-2634.json +++ b/2024/2xxx/CVE-2024-2634.json @@ -1,17 +1,106 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2634", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cve-coordination@incibe.es", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A Cross-Site Scripting Vulnerability has been found on Meta4 HR affecting version 819.001.022 and earlier. The endpoint '/sse_generico/generico_login.jsp' is vulnerable to XSS attack via 'lang' query, i.e. '/sse_generico/generico_login.jsp?lang=%27%3balert(%27BLEUSS%27)%2f%2f¶ms='." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Cross-site Scripting (XSS)", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Cegid", + "product": { + "product_data": [ + { + "product_name": "Meta4 HR", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "819.001.022" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid", + "refsource": "MISC", + "name": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "EXTERNAL" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Any product with all fixes applied after 2013 is not vulnerable to this XSS." + } + ], + "value": "Any product with all fixes applied after 2013 is not vulnerable to this XSS." + } + ], + "credits": [ + { + "lang": "en", + "value": "Pedro Jose Navas P\u00e9rez" + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 6.1, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "privilegesRequired": "NONE", + "scope": "CHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "version": "3.1" } ] } diff --git a/2024/2xxx/CVE-2024-2635.json b/2024/2xxx/CVE-2024-2635.json index 7725e91ee2e..23215b8fedc 100644 --- a/2024/2xxx/CVE-2024-2635.json +++ b/2024/2xxx/CVE-2024-2635.json @@ -1,17 +1,106 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2635", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cve-coordination@incibe.es", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": " The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they do not offer product functionality " + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-698: Execution After Redirect (EAR)", + "cweId": "CWE-698" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Cegid", + "product": { + "product_data": [ + { + "product_name": "Meta4 HR", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "819.001.022" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid", + "refsource": "MISC", + "name": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "EXTERNAL" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they do not offer product functionality.
" + } + ], + "value": "The configuration pages available are not intended to be placed on an Internet facing web server, as they expose file paths to the client, who can be an attacker. Instead of rewriting these pages to avoid this vulnerability, they will be dismissed from future releases of Cegid Meta4 HR, as they do not offer product functionality.\n" + } + ], + "credits": [ + { + "lang": "en", + "value": "Jes\u00fas Ant\u00f3n " + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 7.3, + "baseSeverity": "HIGH", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "version": "3.1" } ] } diff --git a/2024/2xxx/CVE-2024-2636.json b/2024/2xxx/CVE-2024-2636.json index 888b2d7c351..205cc397d5c 100644 --- a/2024/2xxx/CVE-2024-2636.json +++ b/2024/2xxx/CVE-2024-2636.json @@ -1,17 +1,106 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2636", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cve-coordination@incibe.es", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": " An Unrestricted Upload of File vulnerability has been found on Cegid Meta4 HR, that allows an attacker to upload malicios files to the server via '/config/espanol/update_password.jsp' file. Modifying the 'M4_NEW_PASSWORD' parameter, an attacker could store a malicious JSP file inside the file directory, to be executed the the file is loaded in the application. " + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-434 Unrestricted Upload of File with Dangerous Type", + "cweId": "CWE-434" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Cegid", + "product": { + "product_data": [ + { + "product_name": "Meta4 HR", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "819.001.022" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid", + "refsource": "MISC", + "name": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-meta4-hr-cegid" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "EXTERNAL" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "The Meta4 HR system administrator should remove the following pages from the web servers facing the Internet: From M4WebServices: The folder \"config\" (containing the webappconfig.jsp page). In future releases of Cegid Meta4 HR, these pages will be removed from the default distribution, so that there is not a real possibility of being left on an Internet facing production server." + } + ], + "value": "The Meta4 HR system administrator should remove the following pages from the web servers facing the Internet: From M4WebServices: The folder \"config\" (containing the webappconfig.jsp page). In future releases of Cegid Meta4 HR, these pages will be removed from the default distribution, so that there is not a real possibility of being left on an Internet facing production server." + } + ], + "credits": [ + { + "lang": "en", + "value": "Jes\u00fas Ant\u00f3n " + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "HIGH", + "baseScore": 9, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", + "version": "3.1" } ] } diff --git a/2024/2xxx/CVE-2024-2642.json b/2024/2xxx/CVE-2024-2642.json index 38f9d644641..92ce578c284 100644 --- a/2024/2xxx/CVE-2024-2642.json +++ b/2024/2xxx/CVE-2024-2642.json @@ -1,17 +1,104 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2642", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /EXCU_SHELL. The manipulation of the argument Command1 leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257281 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way." + }, + { + "lang": "deu", + "value": "In Ruijie RG-NBS2009G-P bis 20240305 wurde eine kritische Schwachstelle ausgemacht. Das betrifft eine unbekannte Funktionalit\u00e4t der Datei /EXCU_SHELL. Mit der Manipulation des Arguments Command1 mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-77 Command Injection", + "cweId": "CWE-77" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Ruijie", + "product": { + "product_data": [ + { + "product_name": "RG-NBS2009G-P", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "20240305" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.257281", + "refsource": "MISC", + "name": "https://vuldb.com/?id.257281" + }, + { + "url": "https://vuldb.com/?ctiid.257281", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.257281" + }, + { + "url": "https://h0e4a0r1t.github.io/2024/vulns/Ruijie%20RG-NBS2009G-P%20switch%20has%20a%20foreground%20CLI%20command%20injection%20vulnerability.pdf", + "refsource": "MISC", + "name": "https://h0e4a0r1t.github.io/2024/vulns/Ruijie%20RG-NBS2009G-P%20switch%20has%20a%20foreground%20CLI%20command%20injection%20vulnerability.pdf" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "H0e4a0r1t (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 7.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "HIGH" + }, + { + "version": "3.0", + "baseScore": 7.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "HIGH" + }, + { + "version": "2.0", + "baseScore": 7.5, + "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P" } ] } diff --git a/2024/2xxx/CVE-2024-2644.json b/2024/2xxx/CVE-2024-2644.json index 7fa8f45b655..d8140132a62 100644 --- a/2024/2xxx/CVE-2024-2644.json +++ b/2024/2xxx/CVE-2024-2644.json @@ -1,17 +1,104 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2644", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been rated as critical. Affected by this issue is some unknown functionality of the file /protocol/firewall/addfirewall.php. The manipulation of the argument FireWallTableArray leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257282 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way." + }, + { + "lang": "deu", + "value": "Eine kritische Schwachstelle wurde in Netentsec NS-ASG Application Security Gateway 6.3 ausgemacht. Dies betrifft einen unbekannten Teil der Datei /protocol/firewall/addfirewall.php. Durch die Manipulation des Arguments FireWallTableArray mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-89 SQL Injection", + "cweId": "CWE-89" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Netentsec", + "product": { + "product_data": [ + { + "product_name": "NS-ASG Application Security Gateway", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "6.3" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.257282", + "refsource": "MISC", + "name": "https://vuldb.com/?id.257282" + }, + { + "url": "https://vuldb.com/?ctiid.257282", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.257282" + }, + { + "url": "https://github.com/hundanchen69/cve/blob/main/NS-ASG-sql-laddfirewall.md", + "refsource": "MISC", + "name": "https://github.com/hundanchen69/cve/blob/main/NS-ASG-sql-laddfirewall.md" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "chenzefeng (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 6.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "3.0", + "baseScore": 6.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "2.0", + "baseScore": 6.5, + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P" } ] } diff --git a/2024/2xxx/CVE-2024-2645.json b/2024/2xxx/CVE-2024-2645.json index f8e43d2305f..bfab01a881c 100644 --- a/2024/2xxx/CVE-2024-2645.json +++ b/2024/2xxx/CVE-2024-2645.json @@ -1,17 +1,104 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2645", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability classified as problematic has been found in Netentsec NS-ASG Application Security Gateway 6.3. This affects an unknown part of the file /vpnweb/resetpwd/resetpwd.php. The manipulation of the argument UserId leads to improper neutralization of data within xpath expressions. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257283. NOTE: The vendor was contacted early about this disclosure but did not respond in any way." + }, + { + "lang": "deu", + "value": "Es wurde eine Schwachstelle in Netentsec NS-ASG Application Security Gateway 6.3 entdeckt. Sie wurde als problematisch eingestuft. Dabei betrifft es einen unbekannter Codeteil der Datei /vpnweb/resetpwd/resetpwd.php. Durch Manipulation des Arguments UserId mit unbekannten Daten kann eine improper neutralization of data within xpath expressions-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-643 Improper Neutralization of Data within XPath Expressions", + "cweId": "CWE-643" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Netentsec", + "product": { + "product_data": [ + { + "product_name": "NS-ASG Application Security Gateway", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "6.3" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.257283", + "refsource": "MISC", + "name": "https://vuldb.com/?id.257283" + }, + { + "url": "https://vuldb.com/?ctiid.257283", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.257283" + }, + { + "url": "https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-laddfirewall.md", + "refsource": "MISC", + "name": "https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-laddfirewall.md" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "dtxharry (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 4.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", + "baseSeverity": "MEDIUM" + }, + { + "version": "3.0", + "baseScore": 4.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", + "baseSeverity": "MEDIUM" + }, + { + "version": "2.0", + "baseScore": 4, + "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N" } ] } diff --git a/2024/2xxx/CVE-2024-2646.json b/2024/2xxx/CVE-2024-2646.json index dcc1a52f6aa..4af7644604e 100644 --- a/2024/2xxx/CVE-2024-2646.json +++ b/2024/2xxx/CVE-2024-2646.json @@ -1,17 +1,104 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2646", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3. This vulnerability affects unknown code of the file /vpnweb/index.php?para=index. The manipulation of the argument check_VirtualSiteId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-257284. NOTE: The vendor was contacted early about this disclosure but did not respond in any way." + }, + { + "lang": "deu", + "value": "In Netentsec NS-ASG Application Security Gateway 6.3 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Hierbei betrifft es unbekannten Programmcode der Datei /vpnweb/index.php?para=index. Mittels dem Manipulieren des Arguments check_VirtualSiteId mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-89 SQL Injection", + "cweId": "CWE-89" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Netentsec", + "product": { + "product_data": [ + { + "product_name": "NS-ASG Application Security Gateway", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "6.3" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.257284", + "refsource": "MISC", + "name": "https://vuldb.com/?id.257284" + }, + { + "url": "https://vuldb.com/?ctiid.257284", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.257284" + }, + { + "url": "https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-index.md", + "refsource": "MISC", + "name": "https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-index.md" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "zwf.cve (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 6.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "3.0", + "baseScore": 6.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "2.0", + "baseScore": 6.5, + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P" } ] } diff --git a/2024/2xxx/CVE-2024-2647.json b/2024/2xxx/CVE-2024-2647.json index e96fa9bf3a5..1cbc81c1871 100644 --- a/2024/2xxx/CVE-2024-2647.json +++ b/2024/2xxx/CVE-2024-2647.json @@ -1,17 +1,104 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2647", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability, which was classified as critical, has been found in Netentsec NS-ASG Application Security Gateway 6.3. This issue affects some unknown processing of the file /admin/singlelogin.php. The manipulation of the argument loginId leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-257285 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way." + }, + { + "lang": "deu", + "value": "Eine Schwachstelle wurde in Netentsec NS-ASG Application Security Gateway 6.3 entdeckt. Sie wurde als kritisch eingestuft. Davon betroffen ist unbekannter Code der Datei /admin/singlelogin.php. Mittels Manipulieren des Arguments loginId mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-89 SQL Injection", + "cweId": "CWE-89" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Netentsec", + "product": { + "product_data": [ + { + "product_name": "NS-ASG Application Security Gateway", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "6.3" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.257285", + "refsource": "MISC", + "name": "https://vuldb.com/?id.257285" + }, + { + "url": "https://vuldb.com/?ctiid.257285", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.257285" + }, + { + "url": "https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-singlelogin.md", + "refsource": "MISC", + "name": "https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-singlelogin.md" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "dafei666 (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 7.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "HIGH" + }, + { + "version": "3.0", + "baseScore": 7.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "HIGH" + }, + { + "version": "2.0", + "baseScore": 7.5, + "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P" } ] } diff --git a/2024/2xxx/CVE-2024-2648.json b/2024/2xxx/CVE-2024-2648.json index 7ea897caa23..1c85be6a4b2 100644 --- a/2024/2xxx/CVE-2024-2648.json +++ b/2024/2xxx/CVE-2024-2648.json @@ -1,17 +1,104 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2648", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability, which was classified as problematic, was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected is an unknown function of the file /nac/naccheck.php. The manipulation of the argument username leads to improper neutralization of data within xpath expressions. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257286 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way." + }, + { + "lang": "deu", + "value": "Es wurde eine Schwachstelle in Netentsec NS-ASG Application Security Gateway 6.3 gefunden. Sie wurde als problematisch eingestuft. Hiervon betroffen ist ein unbekannter Codeblock der Datei /nac/naccheck.php. Durch das Manipulieren des Arguments username mit unbekannten Daten kann eine improper neutralization of data within xpath expressions-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-643 Improper Neutralization of Data within XPath Expressions", + "cweId": "CWE-643" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Netentsec", + "product": { + "product_data": [ + { + "product_name": "NS-ASG Application Security Gateway", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "6.3" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.257286", + "refsource": "MISC", + "name": "https://vuldb.com/?id.257286" + }, + { + "url": "https://vuldb.com/?ctiid.257286", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.257286" + }, + { + "url": "https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-naccheck.md", + "refsource": "MISC", + "name": "https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-naccheck.md" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "18070802606 (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 4.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", + "baseSeverity": "MEDIUM" + }, + { + "version": "3.0", + "baseScore": 4.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", + "baseSeverity": "MEDIUM" + }, + { + "version": "2.0", + "baseScore": 4, + "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N" } ] } diff --git a/2024/2xxx/CVE-2024-2649.json b/2024/2xxx/CVE-2024-2649.json index 590c06c11c2..277c8bfef7d 100644 --- a/2024/2xxx/CVE-2024-2649.json +++ b/2024/2xxx/CVE-2024-2649.json @@ -1,17 +1,104 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-2649", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability has been found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /protocol/iscdevicestatus/deleteonlineuser.php. The manipulation of the argument messagecontent leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257287. NOTE: The vendor was contacted early about this disclosure but did not respond in any way." + }, + { + "lang": "deu", + "value": "In Netentsec NS-ASG Application Security Gateway 6.3 wurde eine Schwachstelle gefunden. Sie wurde als kritisch eingestuft. Betroffen ist eine unbekannte Verarbeitung der Datei /protocol/iscdevicestatus/deleteonlineuser.php. Durch Manipulieren des Arguments messagecontent mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-89 SQL Injection", + "cweId": "CWE-89" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Netentsec", + "product": { + "product_data": [ + { + "product_name": "NS-ASG Application Security Gateway", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "6.3" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.257287", + "refsource": "MISC", + "name": "https://vuldb.com/?id.257287" + }, + { + "url": "https://vuldb.com/?ctiid.257287", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.257287" + }, + { + "url": "https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-deleteonlineuser.md", + "refsource": "MISC", + "name": "https://github.com/flyyue2001/cve/blob/main/NS-ASG-sql-deleteonlineuser.md" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "18070802606 (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 6.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "3.0", + "baseScore": 6.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "2.0", + "baseScore": 6.5, + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P" } ] }