From 49f6a48ad5f44a78ce573f76faa493dd91968e16 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Wed, 2 Aug 2023 23:00:35 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2023/1xxx/CVE-2023-1437.json | 62 ++++++++++++++++-- 2023/1xxx/CVE-2023-1935.json | 116 +++++++++++++++++++++++++++++++-- 2023/39xxx/CVE-2023-39113.json | 56 ++++++++++++++-- 2023/39xxx/CVE-2023-39114.json | 56 ++++++++++++++-- 2023/3xxx/CVE-2023-3329.json | 62 ++++++++++++++++-- 5 files changed, 328 insertions(+), 24 deletions(-) diff --git a/2023/1xxx/CVE-2023-1437.json b/2023/1xxx/CVE-2023-1437.json index 9a07361c083..e884b4ab5f4 100644 --- a/2023/1xxx/CVE-2023-1437.json +++ b/2023/1xxx/CVE-2023-1437.json @@ -1,18 +1,72 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-1437", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "ics-cert@hq.dhs.gov", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent client could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute commands and overwrite files." } ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-822 Untrusted Pointer Dereference" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Advantech", + "product": { + "product_data": [ + { + "product_name": "WebAccess/SCADA", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "0", + "version_value": "9.1.4" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-166-02", + "refsource": "MISC", + "name": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-166-02" + } + ] + }, + "generator": { + "engine": "VINCE 2.1.3", + "env": "prod", + "origin": "https://cveawg.mitre.org/api/cve/CVE-2023-1437" + }, + "source": { + "discovery": "UNKNOWN" } } \ No newline at end of file diff --git a/2023/1xxx/CVE-2023-1935.json b/2023/1xxx/CVE-2023-1935.json index d94d7eb18b4..da6faa70ab5 100644 --- a/2023/1xxx/CVE-2023-1935.json +++ b/2023/1xxx/CVE-2023-1935.json @@ -1,17 +1,125 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-1935", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "ics-cert@hq.dhs.gov", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "ROC800-Series RTU devices are vulnerable to an authentication bypass, which could allow an attacker to gain unauthorized access to data or control of the device and cause a denial-of-service condition." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-305" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Emerson Electric", + "product": { + "product_data": [ + { + "product_name": "DL8000", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "All" + } + ] + } + }, + { + "product_name": "ROC827", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "All" + }, + { + "version_affected": "=", + "version_value": "All" + } + ] + } + }, + { + "product_name": "ROC809L", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "All" + } + ] + } + }, + { + "product_name": "ROC809", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "All" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-206-03", + "refsource": "MISC", + "name": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-206-03" + } + ] + }, + "generator": { + "engine": "VINCE 2.1.3", + "env": "prod", + "origin": "https://cveawg.mitre.org/api/cve/CVE-2023-1935" + }, + "source": { + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "version": "3.1", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", + "baseScore": 9.4, + "baseSeverity": "CRITICAL" } ] } diff --git a/2023/39xxx/CVE-2023-39113.json b/2023/39xxx/CVE-2023-39113.json index efca77f4c9b..956b90ac312 100644 --- a/2023/39xxx/CVE-2023-39113.json +++ b/2023/39xxx/CVE-2023-39113.json @@ -1,17 +1,61 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2023-39113", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2023-39113", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "ngiflib commit fb271 was discovered to contain a segmentation violation via the function \"main\" at gif2tag.c. This vulnerability is triggered when running the program gif2tga." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/miniupnp/ngiflib/issues/27", + "refsource": "MISC", + "name": "https://github.com/miniupnp/ngiflib/issues/27" } ] } diff --git a/2023/39xxx/CVE-2023-39114.json b/2023/39xxx/CVE-2023-39114.json index 12ec1be44f3..2a85abd8f54 100644 --- a/2023/39xxx/CVE-2023-39114.json +++ b/2023/39xxx/CVE-2023-39114.json @@ -1,17 +1,61 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2023-39114", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2023-39114", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "ngiflib commit 84a75 was discovered to contain a segmentation violation via the function SDL_LoadAnimatedGif at ngiflibSDL.c. This vulnerability is triggered when running the program SDLaffgif." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/miniupnp/ngiflib/issues/29", + "refsource": "MISC", + "name": "https://github.com/miniupnp/ngiflib/issues/29" } ] } diff --git a/2023/3xxx/CVE-2023-3329.json b/2023/3xxx/CVE-2023-3329.json index 8247b391971..f76f6acb12d 100644 --- a/2023/3xxx/CVE-2023-3329.json +++ b/2023/3xxx/CVE-2023-3329.json @@ -1,18 +1,72 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-3329", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "ics-cert@hq.dhs.gov", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SpiderControl SCADA Webserver versions 2.08 and prior are vulnerable to path traversal. An attacker with administrative privileges could overwrite files on the webserver using the HMI's upload file feature. This could create size zero files anywhere on the webserver, potentially overwriting system files and creating a denial-of-service condition." } ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "iniNet", + "product": { + "product_data": [ + { + "product_name": "SCADAWebServer", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "2.08" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-03", + "refsource": "MISC", + "name": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-03" + } + ] + }, + "generator": { + "engine": "VINCE 2.1.3", + "env": "prod", + "origin": "https://cveawg.mitre.org/api/cve/CVE-2023-3329" + }, + "source": { + "discovery": "UNKNOWN" } } \ No newline at end of file