diff --git a/2019/18xxx/CVE-2019-18614.json b/2019/18xxx/CVE-2019-18614.json new file mode 100644 index 00000000000..51109be632f --- /dev/null +++ b/2019/18xxx/CVE-2019-18614.json @@ -0,0 +1,62 @@ +{ + "CVE_data_meta": { + "ASSIGNER": "cve@mitre.org", + "ID": "CVE-2019-18614", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "On the Cypress CYW20735 evaluation board, any data that exceeds 384 bytes is copied and causes an overflow. This is because the maximum BLOC buffer size for sending and receiving data is set to 384 bytes, but everything else is still configured to the usual size of 1092 (which was used for everything in the previous CYW20719 and later CYW20819 evaluation board). To trigger the overflow, an attacker can either send packets over the air or as unprivileged local user. Over the air, the minimal PoC is sending \"l2ping -s 600\" to the target address prior to any pairing. Locally, the buffer overflow is immediately triggered by opening an ACL or SCO connection to a headset. This occurs because, in WICED Studio 6.2 and 6.4, BT_ACL_HOST_TO_DEVICE_DEFAULT_SIZE and BT_ACL_DEVICE_TO_HOST_DEFAULT_SIZE are set to 384." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://github.com/seemoo-lab/frankenstein/blob/master/doc/CVE_2019_18614.md", + "url": "https://github.com/seemoo-lab/frankenstein/blob/master/doc/CVE_2019_18614.md" + } + ] + } +} \ No newline at end of file diff --git a/2020/0xxx/CVE-2020-0223.json b/2020/0xxx/CVE-2020-0223.json new file mode 100644 index 00000000000..7bbc29a81b1 --- /dev/null +++ b/2020/0xxx/CVE-2020-0223.json @@ -0,0 +1,62 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2020-0223", + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_value": "Android kernel" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Elevation of privilege" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/pixel/2020-06-01", + "url": "https://source.android.com/security/bulletin/pixel/2020-06-01" + } + ] + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "This is an unbounded write into kernel global memory, via a user-controlled buffer size.Product: AndroidVersions: Android kernelAndroid ID: A-135130450" + } + ] + } +} \ No newline at end of file diff --git a/2020/0xxx/CVE-2020-0232.json b/2020/0xxx/CVE-2020-0232.json new file mode 100644 index 00000000000..21c05b84a32 --- /dev/null +++ b/2020/0xxx/CVE-2020-0232.json @@ -0,0 +1,62 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2020-0232", + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_value": "Android kernel" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Elevation of privilege" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/pixel/2020-06-01", + "url": "https://source.android.com/security/bulletin/pixel/2020-06-01" + } + ] + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "Function abc_pcie_issue_dma_xfer_sync creates a transfer object, adds it to the session object then continues to work with it. A concurrent thread could retrieve created transfer object from the session object and delete it using abc_pcie_dma_user_xfer_clean. If this happens, abc_pcie_start_dma_xfer and abc_pcie_wait_dma_xfer in the original thread will trigger UAF when working with the transfer object.Product: AndroidVersions: Android kernelAndroid ID: A-151453714" + } + ] + } +} \ No newline at end of file diff --git a/2020/0xxx/CVE-2020-0234.json b/2020/0xxx/CVE-2020-0234.json new file mode 100644 index 00000000000..408c90f6444 --- /dev/null +++ b/2020/0xxx/CVE-2020-0234.json @@ -0,0 +1,62 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2020-0234", + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_value": "Android kernel" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Elevation of privilege" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/pixel/2020-06-01", + "url": "https://source.android.com/security/bulletin/pixel/2020-06-01" + } + ] + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "In crus_afe_get_param of msm-cirrus-playback.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-148189280" + } + ] + } +} \ No newline at end of file diff --git a/2020/0xxx/CVE-2020-0235.json b/2020/0xxx/CVE-2020-0235.json new file mode 100644 index 00000000000..81e264dfb6e --- /dev/null +++ b/2020/0xxx/CVE-2020-0235.json @@ -0,0 +1,62 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2020-0235", + "ASSIGNER": "security@android.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "Android", + "version": { + "version_data": [ + { + "version_value": "Android kernel" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Elevation of privilege" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://source.android.com/security/bulletin/pixel/2020-06-01", + "url": "https://source.android.com/security/bulletin/pixel/2020-06-01" + } + ] + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "In crus_sp_shared_ioctl we first copy 4 bytes from userdata into \"size\" variable, and then use that variable as the size parameter for \"copy_from_user\", ending up overwriting memory following \"crus_sp_hdr\". \"crus_sp_hdr\" is a static variable, of type \"struct crus_sp_ioctl_header\".Product: AndroidVersions: Android kernelAndroid ID: A-135129430" + } + ] + } +} \ No newline at end of file diff --git a/2020/11xxx/CVE-2020-11838.json b/2020/11xxx/CVE-2020-11838.json index 18fd21ee81c..a444b1522ca 100644 --- a/2020/11xxx/CVE-2020-11838.json +++ b/2020/11xxx/CVE-2020-11838.json @@ -4,14 +4,58 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-11838", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@suse.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "ArcSight Management Center.", + "version": { + "version_data": [ + { + "version_value": "2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9.4" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Cross Site Scripting." + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://softwaresupport.softwaregrp.com/doc/KM03650893", + "url": "https://softwaresupport.softwaregrp.com/doc/KM03650893" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9.4. The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS) or information disclosure." } ] } diff --git a/2020/11xxx/CVE-2020-11840.json b/2020/11xxx/CVE-2020-11840.json index 61b34463d66..3d9239434a6 100644 --- a/2020/11xxx/CVE-2020-11840.json +++ b/2020/11xxx/CVE-2020-11840.json @@ -4,14 +4,58 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-11840", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@suse.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "ArcSight Management Center.", + "version": { + "version_data": [ + { + "version_value": "2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9.4" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Unauthorized information disclosure." + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://softwaresupport.softwaregrp.com/doc/KM03650893", + "url": "https://softwaresupport.softwaregrp.com/doc/KM03650893" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9.4. The vulnerabilities could be remotely exploited resulting unauthorized information disclosure." } ] } diff --git a/2020/11xxx/CVE-2020-11841.json b/2020/11xxx/CVE-2020-11841.json index 4946abdcd94..a9235a92910 100644 --- a/2020/11xxx/CVE-2020-11841.json +++ b/2020/11xxx/CVE-2020-11841.json @@ -4,14 +4,58 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-11841", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@suse.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "ArcSight Management Center.", + "version": { + "version_data": [ + { + "version_value": "2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9.4" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Unauthorized information disclosure." + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://softwaresupport.softwaregrp.com/doc/KM03650893", + "url": "https://softwaresupport.softwaregrp.com/doc/KM03650893" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Unauthorized information disclosure vulnerability in Micro Focus ArcSight Management Center product, Affecting versions 2.6.1, 2.7.x, 2.8.x, 2.9.x prior to 2.9.4. The vulnerabilities could be remotely exploited resulting unauthorized information disclosure." } ] } diff --git a/2020/4xxx/CVE-2020-4310.json b/2020/4xxx/CVE-2020-4310.json index 5d76cd4abfa..f84374b316d 100644 --- a/2020/4xxx/CVE-2020-4310.json +++ b/2020/4xxx/CVE-2020-4310.json @@ -1,112 +1,112 @@ { - "CVE_data_meta" : { - "DATE_PUBLIC" : "2020-06-12T00:00:00", - "STATE" : "PUBLIC", - "ASSIGNER" : "psirt@us.ibm.com", - "ID" : "CVE-2020-4310" - }, - "data_format" : "MITRE", - "description" : { - "description_data" : [ - { - "value" : "IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the Data Conversion logic. IBM X-Force ID: 177081.", - "lang" : "eng" - } - ] - }, - "references" : { - "reference_data" : [ - { - "url" : "https://www.ibm.com/support/pages/node/6223914", - "refsource" : "CONFIRM", - "name" : "https://www.ibm.com/support/pages/node/6223914", - "title" : "IBM Security Bulletin 6223914 (WebSphere MQ)" - }, - { - "url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/177081", - "refsource" : "XF", - "title" : "X-Force Vulnerability Report", - "name" : "ibm-mq-cve20204310-dos (177081)" - } - ] - }, - "problemtype" : { - "problemtype_data" : [ - { - "description" : [ - { - "value" : "Denial of Service", - "lang" : "eng" - } - ] - } - ] - }, - "affects" : { - "vendor" : { - "vendor_data" : [ + "CVE_data_meta": { + "DATE_PUBLIC": "2020-06-12T00:00:00", + "STATE": "PUBLIC", + "ASSIGNER": "psirt@us.ibm.com", + "ID": "CVE-2020-4310" + }, + "data_format": "MITRE", + "description": { + "description_data": [ { - "product" : { - "product_data" : [ - { - "version" : { - "version_data" : [ - { - "version_value" : "7.1" - }, - { - "version_value" : "7.5" - } - ] - }, - "product_name" : "WebSphere MQ" - }, - { - "product_name" : "MQ", - "version" : { - "version_data" : [ - { - "version_value" : "8.0" - }, - { - "version_value" : "9.0.LTS" - }, - { - "version_value" : "9.1.LTS" - }, - { - "version_value" : "9.1.CD" - } - ] - } - } - ] - }, - "vendor_name" : "IBM" + "value": "IBM MQ and MQ Appliance 7.1, 7.5, 8.0, 9.0 LTS, 9.1 LTS, and 9.1 C are vulnerable to a denial of service attack due to an error within the Data Conversion logic. IBM X-Force ID: 177081.", + "lang": "eng" } - ] - } - }, - "data_version" : "4.0", - "impact" : { - "cvssv3" : { - "TM" : { - "E" : "U", - "RC" : "C", - "RL" : "O" - }, - "BM" : { - "AV" : "N", - "AC" : "H", - "I" : "N", - "PR" : "N", - "S" : "U", - "A" : "H", - "SCORE" : "5.900", - "UI" : "N", - "C" : "N" - } - } - }, - "data_type" : "CVE" -} + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.ibm.com/support/pages/node/6223914", + "refsource": "CONFIRM", + "name": "https://www.ibm.com/support/pages/node/6223914", + "title": "IBM Security Bulletin 6223914 (WebSphere MQ)" + }, + { + "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/177081", + "refsource": "XF", + "title": "X-Force Vulnerability Report", + "name": "ibm-mq-cve20204310-dos (177081)" + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "value": "Denial of Service", + "lang": "eng" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "version": { + "version_data": [ + { + "version_value": "7.1" + }, + { + "version_value": "7.5" + } + ] + }, + "product_name": "WebSphere MQ" + }, + { + "product_name": "MQ", + "version": { + "version_data": [ + { + "version_value": "8.0" + }, + { + "version_value": "9.0.LTS" + }, + { + "version_value": "9.1.LTS" + }, + { + "version_value": "9.1.CD" + } + ] + } + } + ] + }, + "vendor_name": "IBM" + } + ] + } + }, + "data_version": "4.0", + "impact": { + "cvssv3": { + "TM": { + "E": "U", + "RC": "C", + "RL": "O" + }, + "BM": { + "AV": "N", + "AC": "H", + "I": "N", + "PR": "N", + "S": "U", + "A": "H", + "SCORE": "5.900", + "UI": "N", + "C": "N" + } + } + }, + "data_type": "CVE" +} \ No newline at end of file diff --git a/2020/4xxx/CVE-2020-4320.json b/2020/4xxx/CVE-2020-4320.json index 7b89cc4751f..fd3a67aa429 100644 --- a/2020/4xxx/CVE-2020-4320.json +++ b/2020/4xxx/CVE-2020-4320.json @@ -1,99 +1,99 @@ { - "problemtype" : { - "problemtype_data" : [ - { - "description" : [ - { - "value" : "Denial of Service", - "lang" : "eng" - } - ] - } - ] - }, - "affects" : { - "vendor" : { - "vendor_data" : [ + "problemtype": { + "problemtype_data": [ { - "vendor_name" : "IBM", - "product" : { - "product_data" : [ - { - "product_name" : "MQ", - "version" : { - "version_data" : [ - { - "version_value" : "8.0" - }, - { - "version_value" : "9.0.LTS" - }, - { - "version_value" : "9.1.LTS" - }, - { - "version_value" : "9.1.CD" - } - ] - } - } - ] - } + "description": [ + { + "value": "Denial of Service", + "lang": "eng" + } + ] } - ] - } - }, - "data_version" : "4.0", - "impact" : { - "cvssv3" : { - "TM" : { - "RC" : "C", - "RL" : "O", - "E" : "U" - }, - "BM" : { - "AV" : "N", - "I" : "N", - "AC" : "H", - "S" : "U", - "PR" : "L", - "A" : "H", - "SCORE" : "5.300", - "C" : "N", - "UI" : "N" - } - } - }, - "data_type" : "CVE", - "CVE_data_meta" : { - "ASSIGNER" : "psirt@us.ibm.com", - "ID" : "CVE-2020-4320", - "STATE" : "PUBLIC", - "DATE_PUBLIC" : "2020-06-15T00:00:00" - }, - "description" : { - "description_data" : [ - { - "value" : "IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificate distinguished name SSLPEER setting. IBM X-Force ID: 177403.", - "lang" : "eng" - } - ] - }, - "data_format" : "MITRE", - "references" : { - "reference_data" : [ - { - "title" : "IBM Security Bulletin 5736885 (MQ)", - "name" : "https://www.ibm.com/support/pages/node/5736885", - "refsource" : "CONFIRM", - "url" : "https://www.ibm.com/support/pages/node/5736885" - }, - { - "name" : "ibm-mq-cve20204320-dos (177403)", - "title" : "X-Force Vulnerability Report", - "refsource" : "XF", - "url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/177403" - } - ] - } -} + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "IBM", + "product": { + "product_data": [ + { + "product_name": "MQ", + "version": { + "version_data": [ + { + "version_value": "8.0" + }, + { + "version_value": "9.0.LTS" + }, + { + "version_value": "9.1.LTS" + }, + { + "version_value": "9.1.CD" + } + ] + } + } + ] + } + } + ] + } + }, + "data_version": "4.0", + "impact": { + "cvssv3": { + "TM": { + "RC": "C", + "RL": "O", + "E": "U" + }, + "BM": { + "AV": "N", + "I": "N", + "AC": "H", + "S": "U", + "PR": "L", + "A": "H", + "SCORE": "5.300", + "C": "N", + "UI": "N" + } + } + }, + "data_type": "CVE", + "CVE_data_meta": { + "ASSIGNER": "psirt@us.ibm.com", + "ID": "CVE-2020-4320", + "STATE": "PUBLIC", + "DATE_PUBLIC": "2020-06-15T00:00:00" + }, + "description": { + "description_data": [ + { + "value": "IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificate distinguished name SSLPEER setting. IBM X-Force ID: 177403.", + "lang": "eng" + } + ] + }, + "data_format": "MITRE", + "references": { + "reference_data": [ + { + "title": "IBM Security Bulletin 5736885 (MQ)", + "name": "https://www.ibm.com/support/pages/node/5736885", + "refsource": "CONFIRM", + "url": "https://www.ibm.com/support/pages/node/5736885" + }, + { + "name": "ibm-mq-cve20204320-dos (177403)", + "title": "X-Force Vulnerability Report", + "refsource": "XF", + "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/177403" + } + ] + } +} \ No newline at end of file diff --git a/2020/8xxx/CVE-2020-8541.json b/2020/8xxx/CVE-2020-8541.json index d5faacaa700..a54a0fed003 100644 --- a/2020/8xxx/CVE-2020-8541.json +++ b/2020/8xxx/CVE-2020-8541.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-8541", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-8541", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "OX App Suite through 7.10.3 allows XXE attacks." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.open-xchange.com/", + "refsource": "MISC", + "name": "https://www.open-xchange.com/" + }, + { + "refsource": "MISC", + "name": "https://packetstormsecurity.com/files/158070/OX-App-Suite-OX-Documents-7.10.3-XSS-SSRF-Improper-Validation.html", + "url": "https://packetstormsecurity.com/files/158070/OX-App-Suite-OX-Documents-7.10.3-XSS-SSRF-Improper-Validation.html" } ] } diff --git a/2020/8xxx/CVE-2020-8542.json b/2020/8xxx/CVE-2020-8542.json index f1c93a72296..a623721c78a 100644 --- a/2020/8xxx/CVE-2020-8542.json +++ b/2020/8xxx/CVE-2020-8542.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-8542", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-8542", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "OX App Suite through 7.10.3 allows XSS." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.open-xchange.com/", + "refsource": "MISC", + "name": "https://www.open-xchange.com/" + }, + { + "refsource": "MISC", + "name": "https://packetstormsecurity.com/files/158070/OX-App-Suite-OX-Documents-7.10.3-XSS-SSRF-Improper-Validation.html", + "url": "https://packetstormsecurity.com/files/158070/OX-App-Suite-OX-Documents-7.10.3-XSS-SSRF-Improper-Validation.html" } ] } diff --git a/2020/8xxx/CVE-2020-8543.json b/2020/8xxx/CVE-2020-8543.json index a88e2898009..62cc3d94c19 100644 --- a/2020/8xxx/CVE-2020-8543.json +++ b/2020/8xxx/CVE-2020-8543.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-8543", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-8543", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "OX App Suite through 7.10.3 has Improper Input Validation." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.open-xchange.com/", + "refsource": "MISC", + "name": "https://www.open-xchange.com/" + }, + { + "refsource": "MISC", + "name": "https://packetstormsecurity.com/files/158070/OX-App-Suite-OX-Documents-7.10.3-XSS-SSRF-Improper-Validation.html", + "url": "https://packetstormsecurity.com/files/158070/OX-App-Suite-OX-Documents-7.10.3-XSS-SSRF-Improper-Validation.html" } ] } diff --git a/2020/8xxx/CVE-2020-8544.json b/2020/8xxx/CVE-2020-8544.json index e76da0df13f..704203676d7 100644 --- a/2020/8xxx/CVE-2020-8544.json +++ b/2020/8xxx/CVE-2020-8544.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-8544", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-8544", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "OX App Suite through 7.10.3 allows SSRF." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.open-xchange.com/", + "refsource": "MISC", + "name": "https://www.open-xchange.com/" + }, + { + "refsource": "MISC", + "name": "https://packetstormsecurity.com/files/158070/OX-App-Suite-OX-Documents-7.10.3-XSS-SSRF-Improper-Validation.html", + "url": "https://packetstormsecurity.com/files/158070/OX-App-Suite-OX-Documents-7.10.3-XSS-SSRF-Improper-Validation.html" } ] } diff --git a/2020/9xxx/CVE-2020-9296.json b/2020/9xxx/CVE-2020-9296.json index 817ba883a26..1b75b1db86c 100644 --- a/2020/9xxx/CVE-2020-9296.json +++ b/2020/9xxx/CVE-2020-9296.json @@ -4,14 +4,58 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-9296", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security-report@netflix.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "Netflix Conductor", + "version": { + "version_data": [ + { + "version_value": "All versions prior to version v2.25.3" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Server-Side Template Injection" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-001.md", + "url": "https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-001.md" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Netflix Conductor uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code." } ] } diff --git a/2020/9xxx/CVE-2020-9522.json b/2020/9xxx/CVE-2020-9522.json index 95569dd190c..15e9a2f0b22 100644 --- a/2020/9xxx/CVE-2020-9522.json +++ b/2020/9xxx/CVE-2020-9522.json @@ -4,14 +4,58 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2020-9522", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@suse.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "ArcSight Enterprise Security Manager (ESM).", + "version": { + "version_data": [ + { + "version_value": "7.0.x, 7.2 and 7.2.1" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Cross Site Scripting" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://softwaresupport.softwaregrp.com/doc/KM03650888", + "url": "https://softwaresupport.softwaregrp.com/doc/KM03650888" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Cross Site Scripting (XSS) vulnerability in Micro Focus ArcSight Enterprise Security Manager (ESM) product, Affecting versions 7.0.x, 7.2 and 7.2.1 . The vulnerabilities could be remotely exploited resulting in Cross-Site Scripting (XSS) or information disclosure." } ] }