diff --git a/1999/0xxx/CVE-1999-0199.json b/1999/0xxx/CVE-1999-0199.json new file mode 100644 index 00000000000..a506b4ba4ad --- /dev/null +++ b/1999/0xxx/CVE-1999-0199.json @@ -0,0 +1,72 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-1999-0199", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.cee.studio/tdelete.html", + "refsource": "MISC", + "name": "https://www.cee.studio/tdelete.html" + }, + { + "url": "https://github.com/bminor/glibc/commit/2864e767053317538feafa815046fff89e5a16be#diff-94e8c502f255fdfc346df0e29fd4ef40", + "refsource": "MISC", + "name": "https://github.com/bminor/glibc/commit/2864e767053317538feafa815046fff89e5a16be#diff-94e8c502f255fdfc346df0e29fd4ef40" + }, + { + "url": "https://ftp.gnu.org/gnu/glibc/glibc-2.2.tar.gz", + "refsource": "MISC", + "name": "https://ftp.gnu.org/gnu/glibc/glibc-2.2.tar.gz" + } + ] + } +} \ No newline at end of file diff --git a/2020/23xxx/CVE-2020-23832.json b/2020/23xxx/CVE-2020-23832.json index a133b7bf235..afb5475f9a3 100644 --- a/2020/23xxx/CVE-2020-23832.json +++ b/2020/23xxx/CVE-2020-23832.json @@ -1,17 +1,71 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-23832", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-23832", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A Persistent Cross-Site Scripting (XSS) vulnerability in message_admin.php in Projectworlds Car Rental Management System v1.0 allows unauthenticated remote attackers to harvest an admin login session cookie and steal an admin session upon an admin login." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://projectworlds.in", + "refsource": "MISC", + "name": "https://projectworlds.in" + }, + { + "url": "https://github.com/projectworlds32/Car-Rental-Syatem-PHP-MYSQL/archive/master.zip", + "refsource": "MISC", + "name": "https://github.com/projectworlds32/Car-Rental-Syatem-PHP-MYSQL/archive/master.zip" + }, + { + "refsource": "MISC", + "name": "https://packetstormsecurity.com/files/158795/Car-Rental-Management-System-1.0-Cross-Site-Scripting.html", + "url": "https://packetstormsecurity.com/files/158795/Car-Rental-Management-System-1.0-Cross-Site-Scripting.html" } ] } diff --git a/2020/24xxx/CVE-2020-24214.json b/2020/24xxx/CVE-2020-24214.json index 7c04bfd8945..4a5612dadb9 100644 --- a/2020/24xxx/CVE-2020-24214.json +++ b/2020/24xxx/CVE-2020-24214.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-24214", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-24214", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can send a crafted unauthenticated RTSP request to cause a buffer overflow and application crash. The device will not be able to perform its main purpose of video encoding and streaming for up to a minute, until it automatically reboots. Attackers can send malicious requests once a minute, effectively disabling the device." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://www.kb.cert.org/vuls/id/896979", + "url": "https://www.kb.cert.org/vuls/id/896979" + }, + { + "refsource": "MISC", + "name": "https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/", + "url": "https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/" } ] } diff --git a/2020/24xxx/CVE-2020-24215.json b/2020/24xxx/CVE-2020-24215.json index 70535ea67b3..27a3c8278f2 100644 --- a/2020/24xxx/CVE-2020-24215.json +++ b/2020/24xxx/CVE-2020-24215.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-24215", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-24215", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use hard-coded credentials in HTTP requests to perform any administrative task on the device including retrieving the device's configuration (with the cleartext admin password), and uploading a custom firmware update, to ultimately achieve arbitrary code execution." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://www.kb.cert.org/vuls/id/896979", + "url": "https://www.kb.cert.org/vuls/id/896979" + }, + { + "refsource": "MISC", + "name": "https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/", + "url": "https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/" } ] } diff --git a/2020/25xxx/CVE-2020-25613.json b/2020/25xxx/CVE-2020-25613.json index 5415f76bf14..48c9330df64 100644 --- a/2020/25xxx/CVE-2020-25613.json +++ b/2020/25xxx/CVE-2020-25613.json @@ -1,17 +1,71 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-25613", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-25613", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://hackerone.com/reports/965267", + "refsource": "MISC", + "name": "https://hackerone.com/reports/965267" + }, + { + "refsource": "CONFIRM", + "name": "https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/", + "url": "https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/" + }, + { + "refsource": "CONFIRM", + "name": "https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7", + "url": "https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7" } ] } diff --git a/2020/25xxx/CVE-2020-25986.json b/2020/25xxx/CVE-2020-25986.json index a8cf249009a..6846f95d9e0 100644 --- a/2020/25xxx/CVE-2020-25986.json +++ b/2020/25xxx/CVE-2020-25986.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-25986", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-25986", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Cross Site Request Forgery (CSRF) vulnerability in MonoCMS Blog version as of 29-09-2020 allows attackers to change the password of a user." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://monocms.com/download", + "refsource": "MISC", + "name": "https://monocms.com/download" + }, + { + "refsource": "MISC", + "name": "http://packetstormsecurity.com/files/159430/MonoCMS-Blog-1.0-File-Deletion-CSRF-Hardcoded-Credentials.html", + "url": "http://packetstormsecurity.com/files/159430/MonoCMS-Blog-1.0-File-Deletion-CSRF-Hardcoded-Credentials.html" } ] } diff --git a/2020/25xxx/CVE-2020-25987.json b/2020/25xxx/CVE-2020-25987.json index 8e6d69d1241..df4da300b4b 100644 --- a/2020/25xxx/CVE-2020-25987.json +++ b/2020/25xxx/CVE-2020-25987.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-25987", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-25987", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "MonoCMS Blog version as of 29-09-2020 stores hard-coded admin hashes in the log.xml file in the source files for MonoCMS Blog. Hash type is bcrypt and hashcat mode 3200 can be used to crack the hash." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://monocms.com/download", + "refsource": "MISC", + "name": "https://monocms.com/download" + }, + { + "refsource": "MISC", + "name": "http://packetstormsecurity.com/files/159430/MonoCMS-Blog-1.0-File-Deletion-CSRF-Hardcoded-Credentials.html", + "url": "http://packetstormsecurity.com/files/159430/MonoCMS-Blog-1.0-File-Deletion-CSRF-Hardcoded-Credentials.html" } ] }