mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-06-19 17:32:41 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
384d6089aa
commit
3ee0dc2b4f
@ -57,6 +57,11 @@
|
||||
"name": "https://hackerone.com/reports/321686",
|
||||
"refsource": "MISC",
|
||||
"url": "https://hackerone.com/reports/321686"
|
||||
},
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"name": "https://security.netapp.com/advisory/ntap-20230622-0009/",
|
||||
"url": "https://security.netapp.com/advisory/ntap-20230622-0009/"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -53,6 +53,11 @@
|
||||
"refsource": "MISC",
|
||||
"name": "https://syzkaller.appspot.com/bug?extid=7e9494b8b399902e994e",
|
||||
"url": "https://syzkaller.appspot.com/bug?extid=7e9494b8b399902e994e"
|
||||
},
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"name": "https://security.netapp.com/advisory/ntap-20230622-0010/",
|
||||
"url": "https://security.netapp.com/advisory/ntap-20230622-0010/"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -1,17 +1,107 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-2611",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "ics-cert@hq.dhs.gov",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Advantech R-SeeNet \nversions 2.4.22 \n\nis installed with a hidden root-level user that is not available in the \nusers list. This hidden user has a password that cannot be changed by \nusers.\n\n\n\n\n\n"
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-798 Use of Hard-coded Credentials",
|
||||
"cweId": "CWE-798"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Advantech ",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "R-SeeNet",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "0",
|
||||
"version_value": "2.4.22"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-02",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-02"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.1.0-dev"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "\nAdvantech released R-SeeNet 2.4.23, which fixes both vulnerabilities. All users are recommended to upgrade to this version: <a target=\"_blank\" rel=\"nofollow\" href=\"https://icr.advantech.cz/products/software/r-seenet\">https://icr.advantech.cz/products/software/r-seenet</a>\n\n<br>"
|
||||
}
|
||||
],
|
||||
"value": "Advantech released R-SeeNet 2.4.23, which fixes both vulnerabilities. All users are recommended to upgrade to this version: https://icr.advantech.cz/products/software/r-seenet https://icr.advantech.cz/products/software/r-seenet \n\n\n"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Esjay, working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA."
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 9.8,
|
||||
"baseSeverity": "CRITICAL",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,107 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-3256",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "ics-cert@hq.dhs.gov",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Advantech R-SeeNet \nversions 2.4.22 \nallows low-level users to access and load the content of local files.\n\n\n\n"
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-73 External Control of File Name or Path",
|
||||
"cweId": "CWE-73"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Advantech ",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "R-SeeNet",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "0",
|
||||
"version_value": "2.4.22"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-02",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-02"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.1.0-dev"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "\nAdvantech released R-SeeNet 2.4.23, which fixes both vulnerabilities. All users are recommended to upgrade to this version: <a target=\"_blank\" rel=\"nofollow\" href=\"https://icr.advantech.cz/products/software/r-seenet\">https://icr.advantech.cz/products/software/r-seenet</a>\n\n<br>"
|
||||
}
|
||||
],
|
||||
"value": "Advantech released R-SeeNet 2.4.23, which fixes both vulnerabilities. All users are recommended to upgrade to this version: https://icr.advantech.cz/products/software/r-seenet https://icr.advantech.cz/products/software/r-seenet \n\n\n"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Esjay, working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA."
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,18 +1,114 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-3326",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "secteam@freebsd.org",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.\n"
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-303 Incorrect Implementation of Authentication Algorithm",
|
||||
"cweId": "CWE-303"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "FreeBSD",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "FreeBSD",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "13.2-RELEASE",
|
||||
"version_value": "13.2-RELEASE-p1"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "13.1-RELEASE",
|
||||
"version_value": "13.1-RELEASE-p8"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "12.4-RELEASE",
|
||||
"version_value": "12.4-RELEASE-p3"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:04.pam_krb5.asc",
|
||||
"refsource": "MISC",
|
||||
"name": "https://security.FreeBSD.org/advisories/FreeBSD-SA-23:04.pam_krb5.asc"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.1.0-dev"
|
||||
},
|
||||
"source": {
|
||||
"advisory": "FreeBSD-SA-23:04.pam_krb5",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"configuration": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "<div>Exposure only occurs if pam_krb5 is enabled in the PAM configuration, an /etc/krb5.conf is installed, and the system does not have a system keytab.</div><div><br></div><div>For FreeBSD, the default installation has pam_krb5 commented out and does not have an /etc/krb5.conf.</div>"
|
||||
}
|
||||
],
|
||||
"value": "Exposure only occurs if pam_krb5 is enabled in the PAM configuration, an /etc/krb5.conf is installed, and the system does not have a system keytab.\n\n\n\n\nFor FreeBSD, the default installation has pam_krb5 commented out and does not have an /etc/krb5.conf.\n\n"
|
||||
}
|
||||
],
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "If you are not using Kerberos at all, ensure /etc/krb5.conf is missing from your system. Additionally, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.<br><br>If you are using Kerberos, but not using pam_krb5, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.<br><br>If you are using pam_krb5, ensure you have a keytab on your system as provided by your Kerberos administrator.<br>"
|
||||
}
|
||||
],
|
||||
"value": "If you are not using Kerberos at all, ensure /etc/krb5.conf is missing from your system. Additionally, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.\n\nIf you are using Kerberos, but not using pam_krb5, ensure pam_krb5 is commented out of your PAM configuration located as documented in pam.conf(5), generally /etc/pam.d. Note, the default FreeBSD PAM configuration has pam_krb5 commented out.\n\nIf you are using pam_krb5, ensure you have a keytab on your system as provided by your Kerberos administrator.\n"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Taylor R Campbell <riastradh@NetBSD.org>"
|
||||
}
|
||||
]
|
||||
}
|
||||
18
2023/3xxx/CVE-2023-3371.json
Normal file
18
2023/3xxx/CVE-2023-3371.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-3371",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user