admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-07-29 05:56:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

"-Synchronized-Data."

Browse Source
This commit is contained in:
CVE Team 2024-01-26 17:00:34 +00:00
parent 981e0c8f41
commit 5f0fd7746a
No known key found for this signature in database
GPG Key ID: E3252B3D49582C98
20 changed files with 710 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
2020/36xxx/CVE-2020-36771.json
View File

@ -70,6 +70,11 @@
"url": "https://blog.cloudlinux.com/cagefs-lve-wrappers-and-bsock-have-been-rolled-out-to-100",
"refsource": "MISC",
"name": "https://blog.cloudlinux.com/cagefs-lve-wrappers-and-bsock-have-been-rolled-out-to-100"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Jan/24",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Jan/24"
}
]
},

5
2020/36xxx/CVE-2020-36772.json
View File

@ -70,6 +70,11 @@
"url": "https://blog.cloudlinux.com/lve-manager-lve-stats-lve-utils-and-alt-python27-cllib-have-been-rolled-out-to-100",
"refsource": "MISC",
"name": "https://blog.cloudlinux.com/lve-manager-lve-stats-lve-utils-and-alt-python27-cllib-have-been-rolled-out-to-100"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Jan/25",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Jan/25"
}
]
},

8
2023/45xxx/CVE-2023-45779.json
View File

@ -11,7 +11,7 @@
"description_data": [
{
"lang": "eng",
"value": "In TBD of TBD, there is a possible malicious update to platform components due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
"value": "In the APEX module framework of Android, there is a possible malicious update to platform components due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.\n\n"
}
]
},
@ -59,5 +59,11 @@
"name": "https://source.android.com/security/bulletin/2023-12-01"
}
]
},
"generator": {
"engine": "Vulnogram 0.1.0-dev"
},
"source": {
"discovery": "UNKNOWN"
}
}

95
2024/0xxx/CVE-2024-0931.json
View File

@ -1,17 +1,104 @@
{
"data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-0931",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ASSIGNER": "cna@vuldb.com",
"STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "A vulnerability classified as critical was found in Tenda AC10U 15.03.06.49_multi_TDE01. This vulnerability affects the function saveParentControlInfo. The manipulation of the argument deviceId/time/urls leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252136. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "deu",
"value": "In Tenda AC10U 15.03.06.49_multi_TDE01 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Das betrifft die Funktion saveParentControlInfo. Mittels dem Manipulieren des Arguments deviceId/time/urls mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-121 Stack-based Buffer Overflow",
"cweId": "CWE-121"
}
]
}
]
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Tenda",
"product": {
"product_data": [
{
"product_name": "AC10U",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "15.03.06.49_multi_TDE01"
}
]
}
}
]
}
}
]
}
},
"references": {
"reference_data": [
{
"url": "https://vuldb.com/?id.252136",
"refsource": "MISC",
"name": "https://vuldb.com/?id.252136"
},
{
"url": "https://vuldb.com/?ctiid.252136",
"refsource": "MISC",
"name": "https://vuldb.com/?ctiid.252136"
},
{
"url": "https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/saveParentControlInfo_1.md",
"refsource": "MISC",
"name": "https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/saveParentControlInfo_1.md"
}
]
},
"credits": [
{
"lang": "en",
"value": "chenjun ma (VulDB User)"
}
],
"impact": {
"cvss": [
{
"version": "3.1",
"baseScore": 4.7,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"baseSeverity": "MEDIUM"
},
{
"version": "3.0",
"baseScore": 4.7,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"baseSeverity": "MEDIUM"
},
{
"version": "2.0",
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P"
}
]
}

95
2024/0xxx/CVE-2024-0932.json
View File

@ -1,17 +1,104 @@
{
"data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-0932",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ASSIGNER": "cna@vuldb.com",
"STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "A vulnerability, which was classified as critical, has been found in Tenda AC10U 15.03.06.49_multi_TDE01. This issue affects the function setSmartPowerManagement. The manipulation of the argument time leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252137 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "deu",
"value": "Eine Schwachstelle wurde in Tenda AC10U 15.03.06.49_multi_TDE01 entdeckt. Sie wurde als kritisch eingestuft. Dies betrifft die Funktion setSmartPowerManagement. Mittels Manipulieren des Arguments time mit unbekannten Daten kann eine stack-based buffer overflow-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-121 Stack-based Buffer Overflow",
"cweId": "CWE-121"
}
]
}
]
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Tenda",
"product": {
"product_data": [
{
"product_name": "AC10U",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "15.03.06.49_multi_TDE01"
}
]
}
}
]
}
}
]
}
},
"references": {
"reference_data": [
{
"url": "https://vuldb.com/?id.252137",
"refsource": "MISC",
"name": "https://vuldb.com/?id.252137"
},
{
"url": "https://vuldb.com/?ctiid.252137",
"refsource": "MISC",
"name": "https://vuldb.com/?ctiid.252137"
},
{
"url": "https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/setSmartPowerManagement.md",
"refsource": "MISC",
"name": "https://github.com/yaoyue123/iot/blob/main/Tenda/AC10U/setSmartPowerManagement.md"
}
]
},
"credits": [
{
"lang": "en",
"value": "chenjun ma (VulDB User)"
}
],
"impact": {
"cvss": [
{
"version": "3.1",
"baseScore": 4.7,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"baseSeverity": "MEDIUM"
},
{
"version": "3.0",
"baseScore": 4.7,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"baseSeverity": "MEDIUM"
},
{
"version": "2.0",
"baseScore": 5.8,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P"
}
]
}

95
2024/0xxx/CVE-2024-0933.json
View File

@ -1,17 +1,104 @@
{
"data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-0933",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ASSIGNER": "cna@vuldb.com",
"STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "A vulnerability was found in Niushop B2B2C V5 and classified as critical. Affected by this issue is some unknown functionality of the file \\app\\model\\Upload.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252140. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "deu",
"value": "Eine Schwachstelle wurde in Niushop B2B2C V5 gefunden. Sie wurde als kritisch eingestuft. Davon betroffen ist unbekannter Code der Datei \\app\\model\\Upload.php. Durch das Beeinflussen mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-434 Unrestricted Upload",
"cweId": "CWE-434"
}
]
}
]
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Niushop",
"product": {
"product_data": [
{
"product_name": "B2B2C",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "V5"
}
]
}
}
]
}
}
]
}
},
"references": {
"reference_data": [
{
"url": "https://vuldb.com/?id.252140",
"refsource": "MISC",
"name": "https://vuldb.com/?id.252140"
},
{
"url": "https://vuldb.com/?ctiid.252140",
"refsource": "MISC",
"name": "https://vuldb.com/?ctiid.252140"
},
{
"url": "https://docs.qq.com/doc/DYnNWeHdTVXZqZURH",
"refsource": "MISC",
"name": "https://docs.qq.com/doc/DYnNWeHdTVXZqZURH"
}
]
},
"credits": [
{
"lang": "en",
"value": "Mooooon (VulDB User)"
}
],
"impact": {
"cvss": [
{
"version": "3.1",
"baseScore": 6.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseSeverity": "MEDIUM"
},
{
"version": "3.0",
"baseScore": 6.3,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseSeverity": "MEDIUM"
},
{
"version": "2.0",
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P"
}
]
}

100
2024/0xxx/CVE-2024-0936.json
View File

@ -1,17 +1,109 @@
{
"data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-0936",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ASSIGNER": "cna@vuldb.com",
"STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "A vulnerability classified as critical was found in van_der_Schaar LAB TemporAI 0.0.3. Affected by this vulnerability is the function load_from_file of the component PKL File Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252181 was assigned to this vulnerability. NOTE: The vendor was contacted early and confirmed immediately the existence of the issue. A patch is planned to be released in February 2024."
},
{
"lang": "deu",
"value": "In van_der_Schaar LAB TemporAI 0.0.3 wurde eine kritische Schwachstelle entdeckt. Das betrifft die Funktion load_from_file der Komponente PKL File Handler. Mittels Manipulieren mit unbekannten Daten kann eine deserialization-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-502 Deserialization",
"cweId": "CWE-502"
}
]
}
]
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "van_der_Schaar LAB",
"product": {
"product_data": [
{
"product_name": "TemporAI",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "0.0.3"
}
]
}
}
]
}
}
]
}
},
"references": {
"reference_data": [
{
"url": "https://vuldb.com/?id.252181",
"refsource": "MISC",
"name": "https://vuldb.com/?id.252181"
},
{
"url": "https://vuldb.com/?ctiid.252181",
"refsource": "MISC",
"name": "https://vuldb.com/?ctiid.252181"
},
{
"url": "https://github.com/bayuncao/vul-cve-5",
"refsource": "MISC",
"name": "https://github.com/bayuncao/vul-cve-5"
},
{
"url": "https://github.com/bayuncao/vul-cve-5/blob/main/poc.py",
"refsource": "MISC",
"name": "https://github.com/bayuncao/vul-cve-5/blob/main/poc.py"
}
]
},
"credits": [
{
"lang": "en",
"value": "bayuncao (VulDB User)"
}
],
"impact": {
"cvss": [
{
"version": "3.1",
"baseScore": 6.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"baseSeverity": "MEDIUM"
},
{
"version": "3.0",
"baseScore": 6.3,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"baseSeverity": "MEDIUM"
},
{
"version": "2.0",
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P"
}
]
}

18
2024/0xxx/CVE-2024-0952.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-0952",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2024/0xxx/CVE-2024-0953.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-0953",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2024/0xxx/CVE-2024-0954.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-0954",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2024/0xxx/CVE-2024-0955.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-0955",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2024/0xxx/CVE-2024-0956.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-0956",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2024/0xxx/CVE-2024-0957.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-0957",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

100
2024/21xxx/CVE-2024-21985.json
View File

@ -1,17 +1,109 @@
{
"data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-21985",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ASSIGNER": "security-alert@netapp.com",
"STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "ONTAP 9 versions prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10 \nand 9.13.1P4 are susceptible to a vulnerability which could allow an \nauthenticated user with multiple remote accounts with differing roles to\n perform actions via REST API beyond their intended privilege. Possible \nactions include viewing limited configuration details and metrics or \nmodifying limited settings, some of which could result in a Denial of \nService (DoS).\n\n\n\n"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-269 Improper Privilege Management",
"cweId": "CWE-269"
}
]
}
]
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "NetApp",
"product": {
"product_data": [
{
"product_name": "ONTAP 9",
"version": {
"version_data": [
{
"version_affected": "<",
"version_name": "9.0",
"version_value": "9.9.1P18"
},
{
"version_affected": "<",
"version_name": "9.10.1",
"version_value": "9.10.1P16"
},
{
"version_affected": "<",
"version_name": "9.11.1",
"version_value": "9.11.1P13"
},
{
"version_affected": "<",
"version_name": "9.12.1",
"version_value": "9.12.1P10"
},
{
"version_affected": "<",
"version_name": "9.13.1",
"version_value": "9.13.1P4"
}
]
}
}
]
}
}
]
}
},
"references": {
"reference_data": [
{
"url": "https://security.netapp.com/advisory/ntap-20240126-0001/",
"refsource": "MISC",
"name": "https://security.netapp.com/advisory/ntap-20240126-0001/"
}
]
},
"generator": {
"engine": "Vulnogram 0.1.0-dev"
},
"source": {
"advisory": "NTAP-20240126-0001",
"discovery": "UNKNOWN"
},
"impact": {
"cvss": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
}
]
}

5
2024/23xxx/CVE-2024-23206.json
View File

@ -131,6 +131,11 @@
"url": "https://support.apple.com/en-us/HT214061",
"refsource": "MISC",
"name": "https://support.apple.com/en-us/HT214061"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Jan/27",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Jan/27"
}
]
}

5
2024/23xxx/CVE-2024-23211.json
View File

@ -114,6 +114,11 @@
"url": "https://support.apple.com/en-us/HT214061",
"refsource": "MISC",
"name": "https://support.apple.com/en-us/HT214061"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Jan/27",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Jan/27"
}
]
}

5
2024/23xxx/CVE-2024-23213.json
View File

@ -131,6 +131,11 @@
"url": "https://support.apple.com/en-us/HT214061",
"refsource": "MISC",
"name": "https://support.apple.com/en-us/HT214061"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Jan/27",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Jan/27"
}
]
}

5
2024/23xxx/CVE-2024-23222.json
View File

@ -124,6 +124,11 @@
"url": "https://support.apple.com/en-us/HT214057",
"refsource": "MISC",
"name": "https://support.apple.com/en-us/HT214057"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Jan/27",
"refsource": "MISC",
"name": "http://seclists.org/fulldisclosure/2024/Jan/27"
}
]
}

86
2024/23xxx/CVE-2024-23820.json
View File

@ -1,17 +1,95 @@
{
"data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-23820",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ASSIGNER": "security-advisories@github.com",
"STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "OpenFGA, an authorization/permission engine, is vulnerable to a denial of service attack in versions prior to 1.4.3. In some scenarios that depend on the model and tuples used, a call to `ListObjects` may not release memory properly. So when a sufficiently high number of those calls are executed, the OpenFGA server can create an `out of memory` error and terminate. Version 1.4.3 contains a patch for this issue."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-770: Allocation of Resources Without Limits or Throttling",
"cweId": "CWE-770"
}
]
}
]
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "openfga",
"product": {
"product_data": [
{
"product_name": "openfga",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "< 1.4.3"
}
]
}
}
]
}
}
]
}
},
"references": {
"reference_data": [
{
"url": "https://github.com/openfga/openfga/security/advisories/GHSA-rxpw-85vw-fx87",
"refsource": "MISC",
"name": "https://github.com/openfga/openfga/security/advisories/GHSA-rxpw-85vw-fx87"
},
{
"url": "https://github.com/openfga/openfga/commit/908ac85c8b7769c8042cca31886df8db01976c39",
"refsource": "MISC",
"name": "https://github.com/openfga/openfga/commit/908ac85c8b7769c8042cca31886df8db01976c39"
},
{
"url": "https://github.com/openfga/openfga/releases/tag/v1.4.3",
"refsource": "MISC",
"name": "https://github.com/openfga/openfga/releases/tag/v1.4.3"
}
]
},
"source": {
"advisory": "GHSA-rxpw-85vw-fx87",
"discovery": "UNKNOWN"
},
"impact": {
"cvss": [
{
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
]
}

18
2024/24xxx/CVE-2024-24687.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2024-24687",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}