mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-05-06 18:53:08 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
3af6be5aa2
commit
4f0a1e978a
84
2015/10xxx/CVE-2015-10130.json
Normal file
84
2015/10xxx/CVE-2015-10130.json
Normal file
@ -0,0 +1,84 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2015-10130",
|
||||
"ASSIGNER": "security@wordfence.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the circle_thumbnail_slider_with_lightbox_image_management_func() function. This makes it possible for unauthenticated attackers to edit image data which can be used to inject malicious JavaScript, along with deleting images, and uploading malicious files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-352 Cross-Site Request Forgery (CSRF)"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "nik00726",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Team Circle Image Slider With Lightbox",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b6a54470-fc66-43c5-a523-ddbefd47ee1f?source=cve",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b6a54470-fc66-43c5-a523-ddbefd47ee1f?source=cve"
|
||||
},
|
||||
{
|
||||
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1269993%40circle-image-slider-with-lightbox&new=1269993%40circle-image-slider-with-lightbox&sfp_email=&sfph_mail=",
|
||||
"refsource": "MISC",
|
||||
"name": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=1269993%40circle-image-slider-with-lightbox&new=1269993%40circle-image-slider-with-lightbox&sfp_email=&sfph_mail="
|
||||
}
|
||||
]
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Ala Arfaoui"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@ -1,17 +1,74 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-32257",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "productcert@siemens.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2). The affected application consists of a web service that lacks proper access control for some of the endpoints. This could lead to unauthorized access to resources and potentially lead to code execution."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-284: Improper Access Control",
|
||||
"cweId": "CWE-284"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Siemens",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SINEMA Remote Connect Server",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "0",
|
||||
"version_value": "V3.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://cert-portal.siemens.com/productcert/html/ssa-576771.html",
|
||||
"refsource": "MISC",
|
||||
"name": "https://cert-portal.siemens.com/productcert/html/ssa-576771.html"
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
|
||||
"baseScore": 9.8,
|
||||
"baseSeverity": "CRITICAL"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -59,6 +59,11 @@
|
||||
"url": "https://github.com/tianocore/edk2/security/advisories/GHSA-xvv8-66cq-prwr",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/tianocore/edk2/security/advisories/GHSA-xvv8-66cq-prwr"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -59,6 +59,11 @@
|
||||
"url": "https://github.com/tianocore/edk2/security/advisories/GHSA-4hcq-p8q8-hj8j",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/tianocore/edk2/security/advisories/GHSA-4hcq-p8q8-hj8j"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -59,6 +59,11 @@
|
||||
"url": "https://github.com/tianocore/edk2/security/advisories/GHSA-ch4w-v7m3-g8wx",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/tianocore/edk2/security/advisories/GHSA-ch4w-v7m3-g8wx"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -90,6 +90,16 @@
|
||||
"url": "https://support.apple.com/kb/HT213984",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT213984"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/23",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/23"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -73,6 +73,11 @@
|
||||
"url": "https://security.netapp.com/advisory/ntap-20240307-0011/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://security.netapp.com/advisory/ntap-20240307-0011/"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -73,6 +73,11 @@
|
||||
"url": "https://security.netapp.com/advisory/ntap-20240307-0011/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://security.netapp.com/advisory/ntap-20240307-0011/"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -73,6 +73,11 @@
|
||||
"url": "https://security.netapp.com/advisory/ntap-20240307-0011/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://security.netapp.com/advisory/ntap-20240307-0011/"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -73,6 +73,11 @@
|
||||
"url": "https://security.netapp.com/advisory/ntap-20240307-0011/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://security.netapp.com/advisory/ntap-20240307-0011/"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -73,6 +73,11 @@
|
||||
"url": "https://security.netapp.com/advisory/ntap-20240307-0011/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://security.netapp.com/advisory/ntap-20240307-0011/"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -73,6 +73,11 @@
|
||||
"url": "https://security.netapp.com/advisory/ntap-20240307-0011/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://security.netapp.com/advisory/ntap-20240307-0011/"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -64,6 +64,11 @@
|
||||
"url": "https://hackerone.com/reports/1937213",
|
||||
"refsource": "MISC",
|
||||
"name": "https://hackerone.com/reports/1937213"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -1,17 +1,17 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-4780",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security@wordfence.com",
|
||||
"STATE": "REJECT"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-0590. Reason: This candidate is a duplicate of CVE-2024-0590. Notes: All CVE users should reference CVE-2024-0590 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage."
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,88 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2023-4839",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security@wordfence.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "The WP Go Maps for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "wpgmaps",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "WP Go Maps (formerly WP Google Maps)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "*",
|
||||
"version_value": "9.0.32"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/208c5ed1-879f-45ea-833e-d2e54c4f063f?source=cve",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/208c5ed1-879f-45ea-833e-d2e54c4f063f?source=cve"
|
||||
},
|
||||
{
|
||||
"url": "https://plugins.trac.wordpress.org/changeset/3045434/wp-google-maps/trunk/legacy-core.php",
|
||||
"refsource": "MISC",
|
||||
"name": "https://plugins.trac.wordpress.org/changeset/3045434/wp-google-maps/trunk/legacy-core.php"
|
||||
}
|
||||
]
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Marco Wotschka"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Akbar Kustirama"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
|
||||
"baseScore": 4.4,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -174,12 +174,6 @@
|
||||
],
|
||||
"defaultStatus": "affected"
|
||||
}
|
||||
},
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -631,11 +625,6 @@
|
||||
"refsource": "MISC",
|
||||
"name": "https://access.redhat.com/errata/RHSA-2024:1269"
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2024:1278",
|
||||
"refsource": "MISC",
|
||||
"name": "https://access.redhat.com/errata/RHSA-2024:1278"
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2023-5178",
|
||||
"refsource": "MISC",
|
||||
|
||||
@ -1,17 +1,94 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-0154",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "secure@dell.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper parameter initialization vulnerability. A local low privileged attacker could potentially exploit this vulnerability to read the contents of non-SMM stack memory."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-788: Access of Memory Location After End of Buffer",
|
||||
"cweId": "CWE-788"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Dell",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "PowerEdge Platform",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "N/A",
|
||||
"version_value": "2.0.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.dell.com/support/kbdoc/en-us/000222898/dsa-2024-034-security-update-for-dell-poweredge-server-bios-for-an-improper-parameter-initialization-vulnerability",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.dell.com/support/kbdoc/en-us/000222898/dsa-2024-034-security-update-for-dell-poweredge-server-bios-for-an-improper-parameter-initialization-vulnerability"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.1.0-dev"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Dell would like to thank codebreaker1337 for reporting this issue."
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 3.8,
|
||||
"baseSeverity": "LOW",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,94 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-0161",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "secure@dell.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacker could potentially exploit this vulnerability leading to arbitrary writes to SMRAM."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-20: Improper Input Validation",
|
||||
"cweId": "CWE-20"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Dell",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "PowerEdge Platform",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "N/A",
|
||||
"version_value": "1.1.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.dell.com/support/kbdoc/en-us/000222979/dsa-2024-006-security-update-for-dell-poweredge-server-bios-for-an-improper-smm-communication-buffer-verification-vulnerability",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.dell.com/support/kbdoc/en-us/000222979/dsa-2024-006-security-update-for-dell-poweredge-server-bios-for-an-improper-smm-communication-buffer-verification-vulnerability"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.1.0-dev"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Dell would like to thank codebreaker1337 as well as schur of BUPT, Dubhe Lab for reporting this issue."
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.2,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,88 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-0162",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "secure@dell.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A local low privileged attacker could potentially exploit this vulnerability leading to out-of-bound read/writes to SMRAM."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer",
|
||||
"cweId": "CWE-119"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Dell",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "PowerEdge BIOS Intel 16G",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "N/A",
|
||||
"version_value": " 2.0.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.dell.com/support/kbdoc/en-us/000222812/dsa-2024-004-security-update-for-dell-poweredge-server-bios-for-an-improper-smm-communication-buffer-verification-vulnerability",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.dell.com/support/kbdoc/en-us/000222812/dsa-2024-004-security-update-for-dell-poweredge-server-bios-for-an-improper-smm-communication-buffer-verification-vulnerability"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.1.0-dev"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,88 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-0163",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "secure@dell.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized resources."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
|
||||
"cweId": "CWE-367"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Dell",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "PowerEdge BIOS Intel 16G",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "N/A",
|
||||
"version_value": "2.0.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.dell.com/support/kbdoc/en-us/000222756/dsa-2024-003-security-update-for-dell-poweredge-server-bios-for-a-time-of-check-time-of-use-toctou-vulnerability",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.dell.com/support/kbdoc/en-us/000222756/dsa-2024-003-security-update-for-dell-poweredge-server-bios-for-a-time-of-check-time-of-use-toctou-vulnerability"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.1.0-dev"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -67,6 +67,10 @@
|
||||
]
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GiongfNef"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Kodai Kubono"
|
||||
|
||||
@ -179,12 +179,6 @@
|
||||
],
|
||||
"defaultStatus": "affected"
|
||||
}
|
||||
},
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -482,11 +476,6 @@
|
||||
"refsource": "MISC",
|
||||
"name": "https://access.redhat.com/errata/RHSA-2024:1269"
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/errata/RHSA-2024:1278",
|
||||
"refsource": "MISC",
|
||||
"name": "https://access.redhat.com/errata/RHSA-2024:1278"
|
||||
},
|
||||
{
|
||||
"url": "https://access.redhat.com/security/cve/CVE-2024-0646",
|
||||
"refsource": "MISC",
|
||||
|
||||
@ -69,6 +69,11 @@
|
||||
"url": "https://checkmk.com/werk/16361",
|
||||
"refsource": "MISC",
|
||||
"name": "https://checkmk.com/werk/16361"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/29",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/29"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -1,17 +1,84 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-1582",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security@wordfence.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgmza' shortcode in all versions up to, and including, 9.0.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "wpgmaps",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "WP Go Maps (formerly WP Google Maps)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "*",
|
||||
"version_value": "9.0.32"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/67f405d0-7139-4b5c-ab3c-cd1de5592866?source=cve",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/67f405d0-7139-4b5c-ab3c-cd1de5592866?source=cve"
|
||||
},
|
||||
{
|
||||
"url": "https://plugins.trac.wordpress.org/changeset/3045434/wp-google-maps/trunk/includes/class.shortcodes.php",
|
||||
"refsource": "MISC",
|
||||
"name": "https://plugins.trac.wordpress.org/changeset/3045434/wp-google-maps/trunk/includes/class.shortcodes.php"
|
||||
}
|
||||
]
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Richard Telleng"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
|
||||
"baseScore": 6.4,
|
||||
"baseSeverity": "MEDIUM"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,107 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-1618",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve-coordination@incibe.es",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A search path or unquoted item vulnerability in Faronics Deep Freeze Server Standard, which affects versions 8.30.020.4627 and earlier. This vulnerability affects the DFServ.exe file.\u00a0An attacker with local user privileges could exploit this vulnerability to replace the legitimate DFServ.exe service executable with a malicious file of the same name and located in a directory that has a higher priority than the legitimate directory.\u00a0Thus, when the service starts, it will run the malicious file instead of the legitimate executable, allowing the attacker to execute arbitrary code, gain unauthorized access to the compromised system or stop the service from running."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-428 Unquoted Search Path or Element",
|
||||
"cweId": "CWE-428"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Faronics",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Deep Freeze Server Standard",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "0",
|
||||
"version_value": "8.30.020.4627"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/unquoted-item-or-search-path-vulnerability-faronics-deep-freeze-server",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.incibe.es/en/incibe-cert/notices/aviso/unquoted-item-or-search-path-vulnerability-faronics-deep-freeze-server"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.1.0-dev"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "The vulnerability has been resolved by the Faronics team in version 8.31."
|
||||
}
|
||||
],
|
||||
"value": "The vulnerability has been resolved by the Faronics team in version 8.31."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Rafael Pedrero"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.8,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,418 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-20262",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@cisco.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A vulnerability in the Secure Copy Protocol (SCP) and SFTP feature of Cisco IOS XR Software could allow an authenticated, local attacker to create or overwrite files in a system directory, which could lead to a denial of service (DoS) condition. The attacker would require valid user credentials to perform this attack.\r\n\r This vulnerability is due to a lack of proper validation of SCP and SFTP CLI input parameters. An attacker could exploit this vulnerability by authenticating to the device and issuing SCP or SFTP CLI commands with specific parameters. A successful exploit could allow the attacker to impact the functionality of the device, which could lead to a DoS condition. The device may need to be manually rebooted to recover.\r\n\r Note: This vulnerability is exploitable only when a local user invokes SCP or SFTP commands at the Cisco IOS XR CLI. A local user with administrative privileges could exploit this vulnerability remotely."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper Privilege Management",
|
||||
"cweId": "CWE-269"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Cisco",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Cisco IOS XR Software",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.47"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.3.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.3.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.3.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.3.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.3.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.0.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.0.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.0.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.12"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.22"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.32"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.36"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.42"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.2.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.2.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.2.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.2.25"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.2.11"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.3.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.3.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.3.15"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.4.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.4.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.4.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.25"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.26"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.28"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.29"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.32"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.33"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.6.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.6.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.6.25"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.6.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.0.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.0.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.0.12"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.0.14"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.1.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.1.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.7.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.7.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.2.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.2.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.2.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.15"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.4.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.4.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.6.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.6.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.7.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.7.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.7.21"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.8.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.8.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.9.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.9.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.10.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.10.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-scp-dos-kb6sUUHw",
|
||||
"refsource": "MISC",
|
||||
"name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-scp-dos-kb6sUUHw"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "cisco-sa-iosxr-scp-dos-kb6sUUHw",
|
||||
"discovery": "INTERNAL",
|
||||
"defects": [
|
||||
"CSCwf11720"
|
||||
]
|
||||
},
|
||||
"exploit": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
|
||||
"baseScore": 6.5,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,454 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-20266",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@cisco.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A vulnerability in the DHCP version 4 (DHCPv4) server feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to trigger a crash of the dhcpd process, resulting in a denial of service (DoS) condition.\r\n\r This vulnerability exists because certain DHCPv4 messages are improperly validated when they are processed by an affected device. An attacker could exploit this vulnerability by sending a malformed DHCPv4 message to an affected device. A successful exploit could allow the attacker to cause a crash of the dhcpd process. While the dhcpd process is restarting, which may take approximately two minutes, DHCPv4 server services are unavailable on the affected device. This could temporarily prevent network access to clients that join the network during that time period and rely on the DHCPv4 server of the affected device.\r\n\r Notes: \r\n\r \r Only the dhcpd process crashes and eventually restarts automatically. The router does not reload.\r This vulnerability only applies to DHCPv4. DHCP version 6 (DHCPv6) is not affected."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "NULL Pointer Dereference",
|
||||
"cweId": "CWE-476"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Cisco",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Cisco IOS XR Software",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.47"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.3.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.3.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.3.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.3.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.3.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.0.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.0.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.0.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.12"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.22"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.32"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.36"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.42"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.2.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.2.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.2.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.2.25"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.2.11"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.3.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.3.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.3.15"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.4.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.4.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.4.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.25"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.26"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.28"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.29"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.32"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.33"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.6.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.6.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.6.25"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.6.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.0.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.0.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.0.12"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.0.14"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.1.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.1.15"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.1.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.1.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.7.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.7.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.7.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.7.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.2.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.2.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.2.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.15"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.4.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.4.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.8.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.8.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.6.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.6.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.7.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.7.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.7.21"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.9.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.9.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.8.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.8.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.9.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.9.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.9.21"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.10.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.10.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dhcp-dos-3tgPKRdm",
|
||||
"refsource": "MISC",
|
||||
"name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-dhcp-dos-3tgPKRdm"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "cisco-sa-iosxr-dhcp-dos-3tgPKRdm",
|
||||
"discovery": "INTERNAL",
|
||||
"defects": [
|
||||
"CSCwf83090"
|
||||
]
|
||||
},
|
||||
"exploit": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "LOW"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,190 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-20320",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@cisco.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A vulnerability in the SSH client feature of Cisco IOS XR Software for Cisco 8000 Series Routers and Cisco Network Convergence System (NCS) 540 Series and 5700 Series Routers could allow an authenticated, local attacker to elevate privileges on an affected device. \r\n\r This vulnerability is due to insufficient validation of arguments that are included with the SSH client CLI command. An attacker with low-privileged access to an affected device could exploit this vulnerability by issuing a crafted SSH client command to the CLI. A successful exploit could allow the attacker to elevate privileges to root on the affected device."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Incorrect Privilege Assignment",
|
||||
"cweId": "CWE-266"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Cisco",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Cisco IOS XR Software",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.2.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.2.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.15"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.4.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.4.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.6.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.6.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.7.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.7.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.7.21"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.8.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.8.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.9.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.9.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.9.21"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.10.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ssh-privesc-eWDMKew3",
|
||||
"refsource": "MISC",
|
||||
"name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ssh-privesc-eWDMKew3"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "cisco-sa-iosxr-ssh-privesc-eWDMKew3",
|
||||
"discovery": "INTERNAL",
|
||||
"defects": [
|
||||
"CSCwh52374"
|
||||
]
|
||||
},
|
||||
"exploit": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"baseScore": 7.8,
|
||||
"baseSeverity": "HIGH",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,98 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-20322",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@cisco.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A vulnerability in the access control list (ACL) processing on Pseudowire interfaces in the ingress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL.\r\n\r This vulnerability is due to improper assignment of lookup keys to internal interface contexts. An attacker could exploit this vulnerability by attempting to send traffic through an affected device. A successful exploit could allow the attacker to access resources behind the affected device that were supposed to be protected by a configured ACL."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper Access Control",
|
||||
"cweId": "CWE-284"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Cisco",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Cisco IOS XR Software",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.10.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.11.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-acl-bypass-RZU5NL3e",
|
||||
"refsource": "MISC",
|
||||
"name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-acl-bypass-RZU5NL3e"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "cisco-sa-iosxr-acl-bypass-RZU5NL3e",
|
||||
"discovery": "INTERNAL",
|
||||
"defects": [
|
||||
"CSCwh77265"
|
||||
]
|
||||
},
|
||||
"exploit": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
|
||||
"baseScore": 5.8,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,334 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-20327",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@cisco.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A vulnerability in the PPP over Ethernet (PPPoE) termination feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers could allow an unauthenticated, adjacent attacker to crash the ppp_ma process, resulting in a denial of service (DoS) condition.\r\n\r This vulnerability is due to the improper handling of malformed PPPoE packets that are received on a router that is running Broadband Network Gateway (BNG) functionality with PPPoE termination on a Lightspeed-based or Lightspeed-Plus-based line card. An attacker could exploit this vulnerability by sending a crafted PPPoE packet to an affected line card interface that does not terminate PPPoE. A successful exploit could allow the attacker to crash the ppp_ma process, resulting in a DoS condition for PPPoE traffic across the router."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper Input Validation",
|
||||
"cweId": "CWE-20"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Cisco",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Cisco IOS XR Software",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.2.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.3.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.3.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.3.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.3.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.3.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.0.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.0.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.0.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.1.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.2.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.2.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.2.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.2.25"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.3.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.3.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.4.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.4.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.5.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.6.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.6.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.6.25"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.0.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.0.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.1.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.1.15"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.1.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.1.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.7.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.7.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.7.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.3.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.4.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.4.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.8.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.8.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.5.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.6.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.6.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.7.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.7.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.9.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "6.9.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.8.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.8.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.9.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "7.9.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pppma-JKWFgneW",
|
||||
"refsource": "MISC",
|
||||
"name": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-pppma-JKWFgneW"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "cisco-sa-iosxr-pppma-JKWFgneW",
|
||||
"discovery": "INTERNAL",
|
||||
"defects": [
|
||||
"CSCwf75789"
|
||||
]
|
||||
},
|
||||
"exploit": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
|
||||
"baseScore": 7.4,
|
||||
"baseSeverity": "HIGH",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -11,7 +11,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Out out bounds Write vulnerabilities in svc1td_vld_slh of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow."
|
||||
"value": "Out-of-bounds Write vulnerabilities in svc1td_vld_slh of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow."
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -11,7 +11,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Out out bounds Write vulnerabilities in svc1td_vld_elh of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow."
|
||||
"value": "Out-of-bounds Write vulnerabilities in svc1td_vld_elh of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow."
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -11,7 +11,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Out out bounds Write vulnerabilities in svc1td_vld_plh_ap of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow."
|
||||
"value": "Out-of-bounds Write vulnerabilities in svc1td_vld_plh_ap of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow."
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -59,6 +59,11 @@
|
||||
"url": "https://bugzilla.openanolis.cn/show_bug.cgi?id=7956",
|
||||
"refsource": "MISC",
|
||||
"name": "https://bugzilla.openanolis.cn/show_bug.cgi?id=7956"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IVVYSTEVMPYGF6GDSOD44MUXZXAZHOHB/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IVVYSTEVMPYGF6GDSOD44MUXZXAZHOHB/"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -139,6 +139,16 @@
|
||||
"url": "https://support.apple.com/kb/HT214055",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT214055"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/23",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/23"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -122,6 +122,11 @@
|
||||
"url": "https://support.apple.com/kb/HT214085",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT214085"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -68,6 +68,21 @@
|
||||
"url": "https://support.apple.com/en-us/HT214084",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT214084"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/23",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/23"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -144,6 +144,16 @@
|
||||
"url": "https://support.apple.com/kb/HT214085",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT214085"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/23",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/23"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -93,6 +93,41 @@
|
||||
"url": "https://support.apple.com/kb/HT214087",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/kb/HT214087"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/19",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/19"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/18",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/18"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/25",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/25"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/24",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/24"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/23",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/23"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -68,6 +68,21 @@
|
||||
"url": "https://support.apple.com/en-us/HT214084",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT214084"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/23",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/23"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -68,6 +68,21 @@
|
||||
"url": "https://support.apple.com/en-us/HT214084",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT214084"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/23",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/23"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -63,6 +63,16 @@
|
||||
"url": "https://support.apple.com/en-us/HT214084",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT214084"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/23",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/23"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -68,6 +68,21 @@
|
||||
"url": "https://support.apple.com/en-us/HT214084",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT214084"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/23",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/23"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -141,6 +141,31 @@
|
||||
"url": "https://support.apple.com/en-us/HT214088",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT214088"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/25",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/25"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/24",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/24"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/23",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/23"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -68,6 +68,21 @@
|
||||
"url": "https://support.apple.com/en-us/HT214084",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT214084"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/23",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/23"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -68,6 +68,21 @@
|
||||
"url": "https://support.apple.com/en-us/HT214084",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT214084"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/23",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/23"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -102,6 +102,26 @@
|
||||
"url": "https://support.apple.com/en-us/HT214084",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT214084"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/25",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/25"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/23",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/23"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -68,6 +68,21 @@
|
||||
"url": "https://support.apple.com/en-us/HT214084",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT214084"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/23",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/23"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -68,6 +68,21 @@
|
||||
"url": "https://support.apple.com/en-us/HT214084",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT214084"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/23",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/23"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -68,6 +68,16 @@
|
||||
"url": "https://support.apple.com/en-us/HT214084",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT214084"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -141,6 +141,31 @@
|
||||
"url": "https://support.apple.com/en-us/HT214088",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.apple.com/en-us/HT214088"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/21",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/21"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/25",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/25"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/24",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/24"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/22",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/22"
|
||||
},
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2024/Mar/23",
|
||||
"refsource": "MISC",
|
||||
"name": "http://seclists.org/fulldisclosure/2024/Mar/23"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
18
2024/23xxx/CVE-2024-23494.json
Normal file
18
2024/23xxx/CVE-2024-23494.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-23494",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/23xxx/CVE-2024-23975.json
Normal file
18
2024/23xxx/CVE-2024-23975.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-23975",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@ -1,17 +1,122 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-25097",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "audit@patchstack.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode LLC TNC PDF viewer allows Stored XSS.This issue affects TNC PDF viewer: from n/a through 2.8.0.\n\n"
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
|
||||
"cweId": "CWE-79"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "ThemeNcode LLC",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "TNC PDF viewer",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"versions": [
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "2.9.0",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "2.8.0",
|
||||
"status": "affected",
|
||||
"version": "n/a",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://patchstack.com/database/vulnerability/pdf-viewer-by-themencode/wordpress-tnc-pdf-viewer-plugin-2-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve",
|
||||
"refsource": "MISC",
|
||||
"name": "https://patchstack.com/database/vulnerability/pdf-viewer-by-themencode/wordpress-tnc-pdf-viewer-plugin-2-8-0-cross-site-scripting-xss-vulnerability?_s_id=cve"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.1.0-dev"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "Update to 2.9.0 or a higher version."
|
||||
}
|
||||
],
|
||||
"value": "Update to\u00a02.9.0 or a higher version."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NG\u00d4 THI\u00caN AN / ancorn_ from VNPT-VCI (Patchstack Alliance)"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 6.5,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,122 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-25099",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "audit@patchstack.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David de Boer Paytium: Mollie payment forms & donations allows Stored XSS.This issue affects Paytium: Mollie payment forms & donations: from n/a through 4.4.2.\n\n"
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
|
||||
"cweId": "CWE-79"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "David de Boer",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Paytium: Mollie payment forms & donations",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"versions": [
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "4.4.3",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "4.4.2",
|
||||
"status": "affected",
|
||||
"version": "n/a",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://patchstack.com/database/vulnerability/paytium/wordpress-paytium-mollie-payment-forms-donations-plugin-4-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve",
|
||||
"refsource": "MISC",
|
||||
"name": "https://patchstack.com/database/vulnerability/paytium/wordpress-paytium-mollie-payment-forms-donations-plugin-4-4-2-cross-site-scripting-xss-vulnerability?_s_id=cve"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.1.0-dev"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "Update to 4.4.3 or a higher version."
|
||||
}
|
||||
],
|
||||
"value": "Update to\u00a04.4.3 or a higher version."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NG\u00d4 THI\u00caN AN / ancorn_ from VNPT-VCI (Patchstack Alliance)"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 6.5,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,122 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-25101",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "audit@patchstack.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Maspik \u2013 Spam Blacklist allows Stored XSS.This issue affects Maspik \u2013 Spam Blacklist: from n/a through 0.10.6.\n\n"
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
|
||||
"cweId": "CWE-79"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "yonifre",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Maspik \u2013 Spam Blacklist",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"versions": [
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "0.10.7",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "0.10.6",
|
||||
"status": "affected",
|
||||
"version": "n/a",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://patchstack.com/database/vulnerability/contact-forms-anti-spam/wordpress-maspik-spam-blacklist-plugin-0-10-6-cross-site-scripting-xss-vulnerability?_s_id=cve",
|
||||
"refsource": "MISC",
|
||||
"name": "https://patchstack.com/database/vulnerability/contact-forms-anti-spam/wordpress-maspik-spam-blacklist-plugin-0-10-6-cross-site-scripting-xss-vulnerability?_s_id=cve"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.1.0-dev"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "Update to 0.10.7 or a higher version."
|
||||
}
|
||||
],
|
||||
"value": "Update to\u00a00.10.7 or a higher version."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Dhabaleshwar Das (Patchstack Alliance)"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 5.9,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
18
2024/25xxx/CVE-2024-25567.json
Normal file
18
2024/25xxx/CVE-2024-25567.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-25567",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/25xxx/CVE-2024-25574.json
Normal file
18
2024/25xxx/CVE-2024-25574.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-25574",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/25xxx/CVE-2024-25937.json
Normal file
18
2024/25xxx/CVE-2024-25937.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-25937",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@ -5,164 +5,14 @@
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-26609",
|
||||
"ASSIGNER": "cve@kernel.org",
|
||||
"STATE": "PUBLIC"
|
||||
"STATE": "REJECT"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: reject QUEUE/DROP verdict parameters\n\nThis reverts commit e0abdadcc6e1.\n\ncore.c:nf_hook_slow assumes that the upper 16 bits of NF_DROP\nverdicts contain a valid errno, i.e. -EPERM, -EHOSTUNREACH or similar,\nor 0.\n\nDue to the reverted commit, its possible to provide a positive\nvalue, e.g. NF_ACCEPT (1), which results in use-after-free.\n\nIts not clear to me why this commit was made.\n\nNF_QUEUE is not used by nftables; \"queue\" rules in nftables\nwill result in use of \"nft_queue\" expression.\n\nIf we later need to allow specifiying errno values from userspace\n(do not know why), this has to call NF_DROP_GETERR and check that\n\"err <= 0\" holds true."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Linux",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Linux",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "e0abdadcc6e1",
|
||||
"version_value": "8365e9d92b85"
|
||||
},
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"versions": [
|
||||
{
|
||||
"version": "3.15",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "0",
|
||||
"lessThan": "3.15",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "4.19.307",
|
||||
"lessThanOrEqual": "4.19.*",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "5.4.269",
|
||||
"lessThanOrEqual": "5.4.*",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "5.10.210",
|
||||
"lessThanOrEqual": "5.10.*",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "5.15.149",
|
||||
"lessThanOrEqual": "5.15.*",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "6.1.76",
|
||||
"lessThanOrEqual": "6.1.*",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "6.6.15",
|
||||
"lessThanOrEqual": "6.6.*",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "6.7.3",
|
||||
"lessThanOrEqual": "6.7.*",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "6.8",
|
||||
"lessThanOrEqual": "*",
|
||||
"status": "unaffected",
|
||||
"versionType": "original_commit_for_fix"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "affected"
|
||||
}
|
||||
"value": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/8365e9d92b85fda975a5ece7a3a139cb964018c8",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/8365e9d92b85fda975a5ece7a3a139cb964018c8"
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/4e66422f1b56149761dc76030e6345d1cca6f869",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/4e66422f1b56149761dc76030e6345d1cca6f869"
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/55a60251fa50d4e68175e36666b536a602ce4f6c",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/55a60251fa50d4e68175e36666b536a602ce4f6c"
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/960cf4f812530f01f6acc6878ceaa5404c06af7b",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/960cf4f812530f01f6acc6878ceaa5404c06af7b"
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/8e34430e33b8a80bc014f3efe29cac76bc30a4b4",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/8e34430e33b8a80bc014f3efe29cac76bc30a4b4"
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/6653118b176a00915125521c6572ae8e507621db",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/6653118b176a00915125521c6572ae8e507621db"
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/f05a497e7bc8851eeeb3a58da180ba469efebb05",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/f05a497e7bc8851eeeb3a58da180ba469efebb05"
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/f342de4e2f33e0e39165d8639387aa6c19dff660",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/f342de4e2f33e0e39165d8639387aa6c19dff660"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "bippy-8df59b4913de"
|
||||
}
|
||||
}
|
||||
@ -5,164 +5,14 @@
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-26613",
|
||||
"ASSIGNER": "cve@kernel.org",
|
||||
"STATE": "PUBLIC"
|
||||
"STATE": "REJECT"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv\n\nSyzcaller UBSAN crash occurs in rds_cmsg_recv(),\nwhich reads inc->i_rx_lat_trace[j + 1] with index 4 (3 + 1),\nbut with array size of 4 (RDS_RX_MAX_TRACES).\nHere 'j' is assigned from rs->rs_rx_trace[i] and in-turn from\ntrace.rx_trace_pos[i] in rds_recv_track_latency(),\nwith both arrays sized 3 (RDS_MSG_RX_DGRAM_TRACE_MAX). So fix the\noff-by-one bounds check in rds_recv_track_latency() to prevent\na potential crash in rds_cmsg_recv().\n\nFound by syzcaller:\n=================================================================\nUBSAN: array-index-out-of-bounds in net/rds/recv.c:585:39\nindex 4 is out of range for type 'u64 [4]'\nCPU: 1 PID: 8058 Comm: syz-executor228 Not tainted 6.6.0-gd2f51b3516da #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996),\nBIOS 1.15.0-1 04/01/2014\nCall Trace:\n <TASK>\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x136/0x150 lib/dump_stack.c:106\n ubsan_epilogue lib/ubsan.c:217 [inline]\n __ubsan_handle_out_of_bounds+0xd5/0x130 lib/ubsan.c:348\n rds_cmsg_recv+0x60d/0x700 net/rds/recv.c:585\n rds_recvmsg+0x3fb/0x1610 net/rds/recv.c:716\n sock_recvmsg_nosec net/socket.c:1044 [inline]\n sock_recvmsg+0xe2/0x160 net/socket.c:1066\n __sys_recvfrom+0x1b6/0x2f0 net/socket.c:2246\n __do_sys_recvfrom net/socket.c:2264 [inline]\n __se_sys_recvfrom net/socket.c:2260 [inline]\n __x64_sys_recvfrom+0xe0/0x1b0 net/socket.c:2260\n do_syscall_x64 arch/x86/entry/common.c:51 [inline]\n do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\n=================================================================="
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Linux",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Linux",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "3289025aedc0",
|
||||
"version_value": "344350bfa3b4"
|
||||
},
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"versions": [
|
||||
{
|
||||
"version": "4.11",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "0",
|
||||
"lessThan": "4.11",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "4.19.307",
|
||||
"lessThanOrEqual": "4.19.*",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "5.4.269",
|
||||
"lessThanOrEqual": "5.4.*",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "5.10.210",
|
||||
"lessThanOrEqual": "5.10.*",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "5.15.149",
|
||||
"lessThanOrEqual": "5.15.*",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "6.1.76",
|
||||
"lessThanOrEqual": "6.1.*",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "6.6.15",
|
||||
"lessThanOrEqual": "6.6.*",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "6.7.3",
|
||||
"lessThanOrEqual": "6.7.*",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "6.8",
|
||||
"lessThanOrEqual": "*",
|
||||
"status": "unaffected",
|
||||
"versionType": "original_commit_for_fix"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "affected"
|
||||
}
|
||||
"value": "** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/344350bfa3b4b37d7c3d5a00536e6fbf0e953fbf",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/344350bfa3b4b37d7c3d5a00536e6fbf0e953fbf"
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/a37ae111db5e0f7e3d6b692056c30e3e0f6f79cd",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/a37ae111db5e0f7e3d6b692056c30e3e0f6f79cd"
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/5ae8d50044633306ff160fcf7faa24994175efe1",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/5ae8d50044633306ff160fcf7faa24994175efe1"
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/00d1ee8e1d02194f7b7b433e904e04bbcd2cc0dc",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/00d1ee8e1d02194f7b7b433e904e04bbcd2cc0dc"
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/71024928b3f71ce4529426f8692943205c58d30b",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/71024928b3f71ce4529426f8692943205c58d30b"
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/7a73190ea557e7f26914b0fe04c1f57a96cb771f",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/7a73190ea557e7f26914b0fe04c1f57a96cb771f"
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/0b787c2dea15e7a2828fa3a74a5447df4ed57711",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/0b787c2dea15e7a2828fa3a74a5447df4ed57711"
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/13e788deb7348cc88df34bed736c3b3b9927ea52",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/13e788deb7348cc88df34bed736c3b3b9927ea52"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "bippy-8df59b4913de"
|
||||
}
|
||||
}
|
||||
@ -137,6 +137,11 @@
|
||||
"url": "https://git.kernel.org/stable/c/2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815",
|
||||
"refsource": "MISC",
|
||||
"name": "https://git.kernel.org/stable/c/2f03fc340cac9ea1dc63cbf8c93dd2eb0f227815"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IVVYSTEVMPYGF6GDSOD44MUXZXAZHOHB/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IVVYSTEVMPYGF6GDSOD44MUXZXAZHOHB/"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -56,6 +56,11 @@
|
||||
"url": "https://github.com/LuMingYinDetect/libLAS_defects/blob/main/libLAS_detect_1.md",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/LuMingYinDetect/libLAS_defects/blob/main/libLAS_detect_1.md"
|
||||
},
|
||||
{
|
||||
"refsource": "FEDORA",
|
||||
"name": "FEDORA-2024-34301311f8",
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WVOY7E2QWQRVXZTJGI7Z4KXGSU6BGEKH/"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,74 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-27907",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "productcert@siemens.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A vulnerability has been identified in Simcenter Femap (All versions < V2306.0000). The affected application contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted Catia MODEL file. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-22051)"
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-787: Out-of-bounds Write",
|
||||
"cweId": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Siemens",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Simcenter Femap",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "0",
|
||||
"version_value": "V2306.0000"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://cert-portal.siemens.com/productcert/html/ssa-000072.html",
|
||||
"refsource": "MISC",
|
||||
"name": "https://cert-portal.siemens.com/productcert/html/ssa-000072.html"
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
|
||||
"baseScore": 7.8,
|
||||
"baseSeverity": "HIGH"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,122 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-27952",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "audit@patchstack.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Codeus Advanced Sermons allows Reflected XSS.This issue affects Advanced Sermons: from n/a through 3.2.\n\n"
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
|
||||
"cweId": "CWE-79"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "WP Codeus",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Advanced Sermons",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"versions": [
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "3.3",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "3.2",
|
||||
"status": "affected",
|
||||
"version": "n/a",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://patchstack.com/database/vulnerability/advanced-sermons/wordpress-advanced-sermons-plugin-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve",
|
||||
"refsource": "MISC",
|
||||
"name": "https://patchstack.com/database/vulnerability/advanced-sermons/wordpress-advanced-sermons-plugin-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.1.0-dev"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "Update to 3.3 or a higher version."
|
||||
}
|
||||
],
|
||||
"value": "Update to\u00a03.3 or a higher version."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Le Ngoc Anh (Patchstack Alliance)"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 7.1,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,122 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-27953",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "audit@patchstack.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Missing Authorization vulnerability in Cool Plugins Cryptocurrency Widgets \u2013 Price Ticker & Coins List.This issue affects Cryptocurrency Widgets \u2013 Price Ticker & Coins List: from n/a through 2.6.8.\n\n"
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-862 Missing Authorization",
|
||||
"cweId": "CWE-862"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Cool Plugins",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Cryptocurrency Widgets \u2013 Price Ticker & Coins List",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"versions": [
|
||||
{
|
||||
"changes": [
|
||||
{
|
||||
"at": "2.6.9",
|
||||
"status": "unaffected"
|
||||
}
|
||||
],
|
||||
"lessThanOrEqual": "2.6.8",
|
||||
"status": "affected",
|
||||
"version": "n/a",
|
||||
"versionType": "custom"
|
||||
}
|
||||
],
|
||||
"defaultStatus": "unaffected"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://patchstack.com/database/vulnerability/cryptocurrency-price-ticker-widget/wordpress-cryptocurrency-widgets-plugin-2-6-8-broken-access-control-vulnerability?_s_id=cve",
|
||||
"refsource": "MISC",
|
||||
"name": "https://patchstack.com/database/vulnerability/cryptocurrency-price-ticker-widget/wordpress-cryptocurrency-widgets-plugin-2-6-8-broken-access-control-vulnerability?_s_id=cve"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.1.0-dev"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "Update to 2.6.9 or a higher version."
|
||||
}
|
||||
],
|
||||
"value": "Update to\u00a02.6.9 or a higher version."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CatFather (Patchstack Alliance)"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 4.7,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
18
2024/28xxx/CVE-2024-28029.json
Normal file
18
2024/28xxx/CVE-2024-28029.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-28029",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/28xxx/CVE-2024-28040.json
Normal file
18
2024/28xxx/CVE-2024-28040.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-28040",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/28xxx/CVE-2024-28045.json
Normal file
18
2024/28xxx/CVE-2024-28045.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-28045",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/28xxx/CVE-2024-28171.json
Normal file
18
2024/28xxx/CVE-2024-28171.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-28171",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@ -1,17 +1,61 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-28535",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ID": "CVE-2024-28535",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "n/a",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the mitInterface parameter of fromAddressNat function."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/fromAddressNat_mitInterface.md",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/fromAddressNat_mitInterface.md"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,61 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-28553",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ID": "CVE-2024-28553",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "n/a",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the entrys parameter fromAddressNat function."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/fromAddressNat_entrys.md",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/fromAddressNat_entrys.md"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
18
2024/28xxx/CVE-2024-28872.json
Normal file
18
2024/28xxx/CVE-2024-28872.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-28872",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/28xxx/CVE-2024-28873.json
Normal file
18
2024/28xxx/CVE-2024-28873.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-28873",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/28xxx/CVE-2024-28874.json
Normal file
18
2024/28xxx/CVE-2024-28874.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-28874",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/28xxx/CVE-2024-28945.json
Normal file
18
2024/28xxx/CVE-2024-28945.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-28945",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@ -11,7 +11,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "pgAdmin 4 uses a file-based session management approach. The session files are saved on disk as pickle objects. When a user performs a request, the value of the session cookie 'pga4_session' is used to retrieve the file, then its content is deserialised, and finally its signature verified.\nThe cookie value is split in 2 parts at the first '!' character. The first part is the session ID (sid), while the second is the session digest.\n The vulnerability lies in versions of pgAdmin prior to 8.4 where a method loads session files by concatenating the sessions folder - located inside the pgAdmin 4 DATA_DIR - with the session ID. Precisely, the two values are concatenated using the ['os.path.join'] function. It does not set a trusted base-path which should not be escaped\n"
|
||||
"value": "pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users\u2019 sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.\n"
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -67,6 +67,11 @@
|
||||
"url": "https://github.com/pgadmin-org/pgadmin4/issues/7258",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/pgadmin-org/pgadmin4/issues/7258"
|
||||
},
|
||||
{
|
||||
"url": "https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/"
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -79,17 +84,17 @@
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "HIGH",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 4.6,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 9.9,
|
||||
"baseSeverity": "CRITICAL",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
|
||||
@ -1,17 +1,88 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2049",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "secure@citrix.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Server-Side Request Forgery (SSRF) in Citrix SD-WAN Standard/Premium Editions on or after 11.4.0 and before 11.4.4.46 allows an attacker to disclose limited information from the appliance via Access to management IP."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-918 Server-Side Request Forgery (SSRF)",
|
||||
"cweId": "CWE-918"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Citrix",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Citrix SD-WAN Standard/Premium Editions",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "11.4",
|
||||
"version_value": "11.4.4.46"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://support.citrix.com/article/CTX617071/citrix-sdwan-security-bulletin-for-cve20242049",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.citrix.com/article/CTX617071/citrix-sdwan-security-bulletin-for-cve20242049"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.1.0-dev"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 6.5,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -11,11 +11,11 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A vulnerability was found in Harrison Chase LangChain 0.1.9. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255372."
|
||||
"value": "A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/tfidf.py of the component TFIDFRetriever. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.27 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-255372."
|
||||
},
|
||||
{
|
||||
"lang": "deu",
|
||||
"value": "Es wurde eine kritische Schwachstelle in Harrison Chase LangChain 0.1.9 ausgemacht. Es geht dabei um die Funktion load_local in der Bibliothek libs/community/langchain_community/retrievers/tfidf.py. Durch das Manipulieren mit unbekannten Daten kann eine server-side request forgery-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
|
||||
"value": "Es wurde eine kritische Schwachstelle in LangChain langchain_community 0.0.26 ausgemacht. Es geht dabei um die Funktion load_local in der Bibliothek libs/community/langchain_community/retrievers/tfidf.py der Komponente TFIDFRetriever. Durch das Manipulieren mit unbekannten Daten kann eine server-side request forgery-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Ein Aktualisieren auf die Version 0.0.27 vermag dieses Problem zu l\u00f6sen. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -36,16 +36,16 @@
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Harrison Chase",
|
||||
"vendor_name": "LangChain",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "LangChain",
|
||||
"product_name": "langchain_community",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "0.1.9"
|
||||
"version_value": "0.0.26"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,104 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2391",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@vuldb.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A vulnerability was found in EVE-NG 5.0.1-13 and classified as problematic. Affected by this issue is some unknown functionality of the component Lab Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256442 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
|
||||
},
|
||||
{
|
||||
"lang": "deu",
|
||||
"value": "Eine Schwachstelle wurde in EVE-NG 5.0.1-13 gefunden. Sie wurde als problematisch eingestuft. Dies betrifft einen unbekannten Teil der Komponente Lab Handler. Durch Beeinflussen mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79 Cross Site Scripting",
|
||||
"cweId": "CWE-79"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "n/a",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "EVE-NG",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "5.0.1-13"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://vuldb.com/?id.256442",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?id.256442"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?ctiid.256442",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?ctiid.256442"
|
||||
},
|
||||
{
|
||||
"url": "https://www.exploit-db.com/exploits/51153",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.exploit-db.com/exploits/51153"
|
||||
}
|
||||
]
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Casp3r0x0 (VulDB User)"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"baseScore": 2.4,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
|
||||
"baseSeverity": "LOW"
|
||||
},
|
||||
{
|
||||
"version": "3.0",
|
||||
"baseScore": 2.4,
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
|
||||
"baseSeverity": "LOW"
|
||||
},
|
||||
{
|
||||
"version": "2.0",
|
||||
"baseScore": 3.3,
|
||||
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,104 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2393",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@vuldb.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A vulnerability was found in SourceCodester CRUD without Page Reload 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file add_user.php. The manipulation of the argument city leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256453 was assigned to this vulnerability."
|
||||
},
|
||||
{
|
||||
"lang": "deu",
|
||||
"value": "In SourceCodester CRUD without Page Reload 1.0 wurde eine kritische Schwachstelle ausgemacht. Dabei geht es um eine nicht genauer bekannte Funktion der Datei add_user.php. Durch Beeinflussen des Arguments city mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-89 SQL Injection",
|
||||
"cweId": "CWE-89"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SourceCodester",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "CRUD without Page Reload",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://vuldb.com/?id.256453",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?id.256453"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?ctiid.256453",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?ctiid.256453"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/CveSecLook/cve/blob/main/CRUD%20(Create%2C%20Read%2C%20Update%2C%20Delete)%20Without%20Page%20Reload%3ARefresh%20Using%20PHP%20and%20MySQL%20with%20Source%20Code%202/sql-1.md",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/CveSecLook/cve/blob/main/CRUD%20(Create%2C%20Read%2C%20Update%2C%20Delete)%20Without%20Page%20Reload%3ARefresh%20Using%20PHP%20and%20MySQL%20with%20Source%20Code%202/sql-1.md"
|
||||
}
|
||||
]
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "404cchd (VulDB User)"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"baseScore": 6.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
{
|
||||
"version": "3.0",
|
||||
"baseScore": 6.3,
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
{
|
||||
"version": "2.0",
|
||||
"baseScore": 6.5,
|
||||
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,104 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2394",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@vuldb.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /Admin/add-admin.php. The manipulation of the argument avatar leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-256454 is the identifier assigned to this vulnerability."
|
||||
},
|
||||
{
|
||||
"lang": "deu",
|
||||
"value": "Eine kritische Schwachstelle wurde in SourceCodester Employee Management System 1.0 ausgemacht. Hierbei geht es um eine nicht exakt ausgemachte Funktion der Datei /Admin/add-admin.php. Dank der Manipulation des Arguments avatar mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-434 Unrestricted Upload",
|
||||
"cweId": "CWE-434"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SourceCodester",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Employee Management System",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://vuldb.com/?id.256454",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?id.256454"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?ctiid.256454",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?ctiid.256454"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/LiAoRJ/CVE_Hunter/blob/main/RCE-1.md",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/LiAoRJ/CVE_Hunter/blob/main/RCE-1.md"
|
||||
}
|
||||
]
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "LiAoRJ (VulDB User)"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"baseScore": 4.7,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
{
|
||||
"version": "3.0",
|
||||
"baseScore": 4.7,
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
{
|
||||
"version": "2.0",
|
||||
"baseScore": 5.8,
|
||||
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
18
2024/2xxx/CVE-2024-2397.json
Normal file
18
2024/2xxx/CVE-2024-2397.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2397",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/2xxx/CVE-2024-2398.json
Normal file
18
2024/2xxx/CVE-2024-2398.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2398",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/2xxx/CVE-2024-2399.json
Normal file
18
2024/2xxx/CVE-2024-2399.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2399",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/2xxx/CVE-2024-2400.json
Normal file
18
2024/2xxx/CVE-2024-2400.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2400",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/2xxx/CVE-2024-2401.json
Normal file
18
2024/2xxx/CVE-2024-2401.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2401",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/2xxx/CVE-2024-2402.json
Normal file
18
2024/2xxx/CVE-2024-2402.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2402",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/2xxx/CVE-2024-2403.json
Normal file
18
2024/2xxx/CVE-2024-2403.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2403",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/2xxx/CVE-2024-2404.json
Normal file
18
2024/2xxx/CVE-2024-2404.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2404",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/2xxx/CVE-2024-2405.json
Normal file
18
2024/2xxx/CVE-2024-2405.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2405",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
115
2024/2xxx/CVE-2024-2412.json
Normal file
115
2024/2xxx/CVE-2024-2412.json
Normal file
@ -0,0 +1,115 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2412",
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The disabling function of the user registration page for Heimavista Rpage and Epage is not properly implemented, allowing remote attackers to complete user registration on sites where user registration is supposed to be disabled."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-284: Improper Access Control",
|
||||
"cweId": "CWE-284"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Heimavista",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Rpage",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "earlier version",
|
||||
"version_value": "v5.4.103.20231111"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Epage",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "earlier version",
|
||||
"version_value": "v3.0.106.20231112"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.twcert.org.tw/tw/lp-132-1.html",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.twcert.org.tw/tw/lp-132-1.html"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.1.0-dev"
|
||||
},
|
||||
"source": {
|
||||
"advisory": "TVN-20240301",
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "Update Rpage to versions later than v5.4.103.20231111<br>Update Epage to versions later than v3.0.106.20231112"
|
||||
}
|
||||
],
|
||||
"value": "Update Rpage to versions later than v5.4.103.20231111\nUpdate Epage to versions later than v3.0.106.20231112"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/2xxx/CVE-2024-2413.json
Normal file
18
2024/2xxx/CVE-2024-2413.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2413",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/2xxx/CVE-2024-2430.json
Normal file
18
2024/2xxx/CVE-2024-2430.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2430",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/2xxx/CVE-2024-2431.json
Normal file
18
2024/2xxx/CVE-2024-2431.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2431",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/2xxx/CVE-2024-2432.json
Normal file
18
2024/2xxx/CVE-2024-2432.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2432",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
18
2024/2xxx/CVE-2024-2433.json
Normal file
18
2024/2xxx/CVE-2024-2433.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-2433",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user