diff --git a/2023/30xxx/CVE-2023-30533.json b/2023/30xxx/CVE-2023-30533.json
index 0ba69d2d336..65f6d6dbfe2 100644
--- a/2023/30xxx/CVE-2023-30533.json
+++ b/2023/30xxx/CVE-2023-30533.json
@@ -34,7 +34,7 @@
"description_data": [
{
"lang": "eng",
- "value": "SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file."
+ "value": "SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected."
}
]
},
@@ -61,6 +61,11 @@
"refsource": "MISC",
"name": "https://cdn.sheetjs.com/advisories/CVE-2023-30533",
"url": "https://cdn.sheetjs.com/advisories/CVE-2023-30533"
+ },
+ {
+ "refsource": "MISC",
+ "name": "https://git.sheetjs.com/sheetjs/sheetjs/issues/2986",
+ "url": "https://git.sheetjs.com/sheetjs/sheetjs/issues/2986"
}
]
}
diff --git a/2023/38xxx/CVE-2023-38032.json b/2023/38xxx/CVE-2023-38032.json
index 2661bcd7393..90ca37158e2 100644
--- a/2023/38xxx/CVE-2023-38032.json
+++ b/2023/38xxx/CVE-2023-38032.json
@@ -1,17 +1,101 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2023-38032",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "cve@cert.org.tw",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "\nASUS RT-AC86U AiProtection security- related function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services.\n\n\n\n"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+ "cweId": "CWE-78"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "ASUS",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "RT-AC86U",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "\t 3.0.0.4.386.51529"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.twcert.org.tw/tw/cp-132-7349-7f8cd-1.html",
+ "refsource": "MISC",
+ "name": "https://www.twcert.org.tw/tw/cp-132-7349-7f8cd-1.html"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "TVN-202309003",
+ "discovery": "EXTERNAL"
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Update to 3.0.0.4.386_51915
"
+ }
+ ],
+ "value": "Update to 3.0.0.4.386_51915\n\n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 8.8,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+ "version": "3.1"
}
]
}
diff --git a/2023/38xxx/CVE-2023-38033.json b/2023/38xxx/CVE-2023-38033.json
index acee6f55c8e..b99ceb66881 100644
--- a/2023/38xxx/CVE-2023-38033.json
+++ b/2023/38xxx/CVE-2023-38033.json
@@ -1,17 +1,101 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2023-38033",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "cve@cert.org.tw",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "\nASUS RT-AC86U unused Traffic Analyzer legacy Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services.\n\n"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+ "cweId": "CWE-78"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "ASUS",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "RT-AC86U",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "3.0.0.4.386.51529"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.twcert.org.tw/tw/cp-132-7350-ded5e-1.html",
+ "refsource": "MISC",
+ "name": "https://www.twcert.org.tw/tw/cp-132-7350-ded5e-1.html"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "TVN-202309004",
+ "discovery": "EXTERNAL"
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "\n\nUpdate to 3.0.0.4.386_51915
"
+ }
+ ],
+ "value": "\nUpdate to 3.0.0.4.386_51915\n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 8.8,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+ "version": "3.1"
}
]
}
diff --git a/2023/39xxx/CVE-2023-39236.json b/2023/39xxx/CVE-2023-39236.json
index 279cc40ea80..a44ebca118e 100644
--- a/2023/39xxx/CVE-2023-39236.json
+++ b/2023/39xxx/CVE-2023-39236.json
@@ -1,17 +1,101 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2023-39236",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "cve@cert.org.tw",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "\nASUS RT-AC86U Traffic Analyzer - Statistic function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services.\n\n"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+ "cweId": "CWE-78"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "ASUS",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "RT-AC86U",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "3.0.0.4.386.51529"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.twcert.org.tw/tw/cp-132-7351-ec8fe-1.html",
+ "refsource": "MISC",
+ "name": "https://www.twcert.org.tw/tw/cp-132-7351-ec8fe-1.html"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "TVN-202309005",
+ "discovery": "EXTERNAL"
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "\n\n\n\nUpdate to 3.0.0.4.386_51915
\n\n
"
+ }
+ ],
+ "value": "\n\n\nUpdate to 3.0.0.4.386_51915\n\n\n\n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 8.8,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+ "version": "3.1"
}
]
}
diff --git a/2023/39xxx/CVE-2023-39237.json b/2023/39xxx/CVE-2023-39237.json
index 9cb136f2e2a..0b12467ddf6 100644
--- a/2023/39xxx/CVE-2023-39237.json
+++ b/2023/39xxx/CVE-2023-39237.json
@@ -1,17 +1,101 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2023-39237",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "cve@cert.org.tw",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "\nASUS RT-AC86U Traffic Analyzer - Apps analysis function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services.\n\n"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+ "cweId": "CWE-78"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "ASUS",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "RT-AC86U",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "3.0.0.4.386.51529"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.twcert.org.tw/tw/cp-132-7352-bad68-1.html",
+ "refsource": "MISC",
+ "name": "https://www.twcert.org.tw/tw/cp-132-7352-bad68-1.html"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "TVN-202309006",
+ "discovery": "EXTERNAL"
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "\n\nUpdate to 3.0.0.4.386_51915\n\n
"
+ }
+ ],
+ "value": "\nUpdate to 3.0.0.4.386_51915\n\n\n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 8.8,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+ "version": "3.1"
}
]
}
diff --git a/2023/39xxx/CVE-2023-39910.json b/2023/39xxx/CVE-2023-39910.json
index c21d35d1f9c..f0eb4da773e 100644
--- a/2023/39xxx/CVE-2023-39910.json
+++ b/2023/39xxx/CVE-2023-39910.json
@@ -76,6 +76,11 @@
"refsource": "MISC",
"name": "https://news.ycombinator.com/item?id=37054862",
"url": "https://news.ycombinator.com/item?id=37054862"
+ },
+ {
+ "refsource": "MISC",
+ "name": "https://github.com/libbitcoin/libbitcoin-explorer/wiki/CVE-2023-39910",
+ "url": "https://github.com/libbitcoin/libbitcoin-explorer/wiki/CVE-2023-39910"
}
]
}
diff --git a/2023/4xxx/CVE-2023-4815.json b/2023/4xxx/CVE-2023-4815.json
new file mode 100644
index 00000000000..cc08df00bc7
--- /dev/null
+++ b/2023/4xxx/CVE-2023-4815.json
@@ -0,0 +1,92 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2023-4815",
+ "ASSIGNER": "security@huntr.dev",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "Missing Authentication for Critical Function in GitHub repository answerdev/answer prior to v1.1.3."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-306 Missing Authentication for Critical Function",
+ "cweId": "CWE-306"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "answerdev",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "answerdev/answer",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "unspecified",
+ "version_value": "v1.1.3"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://huntr.dev/bounties/4cd3eeb4-57c9-4af2-ad19-2166c9e0fd2c",
+ "refsource": "MISC",
+ "name": "https://huntr.dev/bounties/4cd3eeb4-57c9-4af2-ad19-2166c9e0fd2c"
+ },
+ {
+ "url": "https://github.com/answerdev/answer/commit/e75142a55546e01d8904f59db228422561f51666",
+ "refsource": "MISC",
+ "name": "https://github.com/answerdev/answer/commit/e75142a55546e01d8904f59db228422561f51666"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "4cd3eeb4-57c9-4af2-ad19-2166c9e0fd2c",
+ "discovery": "EXTERNAL"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.0",
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "LOW",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
+ "baseScore": 8.3,
+ "baseSeverity": "HIGH"
+ }
+ ]
+ }
+}
\ No newline at end of file