mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-29 05:56:59 +00:00
- Synchronized data.
This commit is contained in:
CVE Team
parent
4479406504
commit
6113a0b0fb
@ -1,95 +1,96 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "secure@dell.com",
|
||||
"DATE_PUBLIC": "2018-09-28T05:00:00.000Z",
|
||||
"ID": "CVE-2018-11064",
|
||||
"STATE": "PUBLIC"
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "secure@dell.com",
|
||||
"DATE_PUBLIC" : "2018-09-28T05:00:00.000Z",
|
||||
"ID" : "CVE-2018-11064",
|
||||
"STATE" : "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name": "Dell EMC Unity",
|
||||
"version": {
|
||||
"version_data": [
|
||||
"product_name" : "Dell EMC Unity",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_name": "4.3.0.x",
|
||||
"version_value": "4.3.1.x"
|
||||
"affected" : "<=",
|
||||
"version_name" : "4.3.0.x",
|
||||
"version_value" : "4.3.1.x"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Dell EMC UnityVSA",
|
||||
"version": {
|
||||
"version_data": [
|
||||
"product_name" : "Dell EMC UnityVSA",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_name": "4.3.0.x",
|
||||
"version_value": "4.3.1.x"
|
||||
"affected" : "<=",
|
||||
"version_name" : "4.3.0.x",
|
||||
"version_value" : "4.3.1.x"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Dell EMC"
|
||||
"vendor_name" : "Dell EMC"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Dell EMC Unity OE versions 4.3.0.x and 4.3.1.x and UnityVSA OE versions 4.3.0.x and 4.3.1.x contains an Incorrect File Permissions vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability to alter multiple library files in service tools that might result in arbitrary code execution with elevated privileges. No user file systems are directly affected by this vulnerability."
|
||||
"lang" : "eng",
|
||||
"value" : "Dell EMC Unity OE versions 4.3.0.x and 4.3.1.x and UnityVSA OE versions 4.3.0.x and 4.3.1.x contains an Incorrect File Permissions vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability to alter multiple library files in service tools that might result in arbitrary code execution with elevated privileges. No user file systems are directly affected by this vulnerability."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "LOCAL",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.8,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
"impact" : {
|
||||
"cvss" : {
|
||||
"attackComplexity" : "LOW",
|
||||
"attackVector" : "LOCAL",
|
||||
"availabilityImpact" : "HIGH",
|
||||
"baseScore" : 7.8,
|
||||
"baseSeverity" : "HIGH",
|
||||
"confidentialityImpact" : "HIGH",
|
||||
"integrityImpact" : "HIGH",
|
||||
"privilegesRequired" : "LOW",
|
||||
"scope" : "UNCHANGED",
|
||||
"userInteraction" : "NONE",
|
||||
"vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version" : "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description": [
|
||||
"description" : [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Incorrect File Permissions"
|
||||
"lang" : "eng",
|
||||
"value" : "Incorrect File Permissions"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"refsource": "FULLDISC",
|
||||
"url": "https://seclists.org/fulldisclosure/2018/Sep/55"
|
||||
"name" : "20180926 DSA-2018-141: Dell EMC Unity Family Incorrect File Permissions vulnerability",
|
||||
"refsource" : "FULLDISC",
|
||||
"url" : "https://seclists.org/fulldisclosure/2018/Sep/55"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
"source" : {
|
||||
"discovery" : "UNKNOWN"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,99 +1,100 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "secure@dell.com",
|
||||
"DATE_PUBLIC": "2018-09-27T07:00:00.000Z",
|
||||
"ID": "CVE-2018-11081",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Pivotal Operations Manager UAA config - temp Ram Disk"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "pivotal-ops-manager",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<=",
|
||||
"version_name": "1.11.x",
|
||||
"version_value": "2"
|
||||
},
|
||||
{
|
||||
"affected": "<",
|
||||
"version_name": "2.0.x",
|
||||
"version_value": "2.0.16"
|
||||
},
|
||||
{
|
||||
"affected": "<",
|
||||
"version_name": "2.1.x",
|
||||
"version_value": "2.1.11"
|
||||
},
|
||||
{
|
||||
"affected": "<",
|
||||
"version_name": "2.2.x",
|
||||
"version_value": "2.2.1"
|
||||
}
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "secure@dell.com",
|
||||
"DATE_PUBLIC" : "2018-09-27T07:00:00.000Z",
|
||||
"ID" : "CVE-2018-11081",
|
||||
"STATE" : "PUBLIC",
|
||||
"TITLE" : "Pivotal Operations Manager UAA config - temp Ram Disk"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "pivotal-ops-manager",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<=",
|
||||
"version_name" : "1.11.x",
|
||||
"version_value" : "2"
|
||||
},
|
||||
{
|
||||
"affected" : "<",
|
||||
"version_name" : "2.0.x",
|
||||
"version_value" : "2.0.16"
|
||||
},
|
||||
{
|
||||
"affected" : "<",
|
||||
"version_name" : "2.1.x",
|
||||
"version_value" : "2.1.11"
|
||||
},
|
||||
{
|
||||
"affected" : "<",
|
||||
"version_name" : "2.2.x",
|
||||
"version_value" : "2.2.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Pivotal"
|
||||
}
|
||||
},
|
||||
"vendor_name" : "Pivotal"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "Pivotal Operations Manager, versions 2.2.x prior to 2.2.1, 2.1.x prior to 2.1.11, 2.0.x prior to 2.0.16, and 1.11.x prior to 2, fails to write the Operations Manager UAA config onto the temp RAM disk, thus exposing the configs directly onto disk. A remote user that has gained access to the Operations Manager VM, can now file search and find the UAA credentials for Operations Manager on the system disk.."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Pivotal Operations Manager, versions 2.2.x prior to 2.2.1, 2.1.x prior to 2.1.11, 2.0.x prior to 2.0.16, and 1.11.x prior to 2, fails to write the Operations Manager UAA config onto the temp RAM disk. Thus, exposing the the configs directly onto disk. A remote user that has gained access to the Operations Manager VM, can now file search and find the UAA credentials for Operations Manager on the system disk..\n\n"
|
||||
},
|
||||
"impact" : {
|
||||
"cvss" : {
|
||||
"attackComplexity" : "LOW",
|
||||
"attackVector" : "ADJACENT_NETWORK",
|
||||
"availabilityImpact" : "HIGH",
|
||||
"baseScore" : 7.9,
|
||||
"baseSeverity" : "HIGH",
|
||||
"confidentialityImpact" : "HIGH",
|
||||
"integrityImpact" : "HIGH",
|
||||
"privilegesRequired" : "HIGH",
|
||||
"scope" : "CHANGED",
|
||||
"userInteraction" : "REQUIRED",
|
||||
"vectorString" : "CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
|
||||
"version" : "3.0"
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.9,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Cleartext Storage in a File or on Disk"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://pivotal.io/security/cve-2018-11081"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "Cleartext Storage in a File or on Disk"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://pivotal.io/security/cve-2018-11081",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://pivotal.io/security/cve-2018-11081"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source" : {
|
||||
"discovery" : "UNKNOWN"
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,96 +1,97 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "secure@dell.com",
|
||||
"DATE_PUBLIC": "2018-10-01T07:00:00.000Z",
|
||||
"ID": "CVE-2018-11082",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Cloud Foundry UAA MFA does not prevent brute force of MFA code"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "UAA Release",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<",
|
||||
"version_name": "all versions",
|
||||
"version_value": "61.0"
|
||||
}
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "secure@dell.com",
|
||||
"DATE_PUBLIC" : "2018-10-01T07:00:00.000Z",
|
||||
"ID" : "CVE-2018-11082",
|
||||
"STATE" : "PUBLIC",
|
||||
"TITLE" : "Cloud Foundry UAA MFA does not prevent brute force of MFA code"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "UAA Release",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<",
|
||||
"version_name" : "all versions",
|
||||
"version_value" : "61.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name" : "UAA",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected" : "<",
|
||||
"version_name" : "all versions",
|
||||
"version_value" : "4.20.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "UAA",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<",
|
||||
"version_name": "all versions",
|
||||
"version_value": "4.20.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Cloud Foundry"
|
||||
}
|
||||
},
|
||||
"vendor_name" : "Cloud Foundry"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login as the targeted user."
|
||||
},
|
||||
"impact" : {
|
||||
"cvss" : {
|
||||
"attackComplexity" : "HIGH",
|
||||
"attackVector" : "NETWORK",
|
||||
"availabilityImpact" : "HIGH",
|
||||
"baseScore" : 6.6,
|
||||
"baseSeverity" : "MEDIUM",
|
||||
"confidentialityImpact" : "HIGH",
|
||||
"integrityImpact" : "HIGH",
|
||||
"privilegesRequired" : "HIGH",
|
||||
"scope" : "UNCHANGED",
|
||||
"userInteraction" : "NONE",
|
||||
"vectorString" : "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version" : "3.0"
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 6.6,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper Access Control"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://www.cloudfoundry.org/blog/cve-2018-11082/"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "Improper Access Control"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://www.cloudfoundry.org/blog/cve-2018-11082/",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://www.cloudfoundry.org/blog/cve-2018-11082/"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source" : {
|
||||
"discovery" : "UNKNOWN"
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,98 +1,99 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "secure@dell.com",
|
||||
"ID": "CVE-2018-11083",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Bosh accepts refresh tokens in place of an access token"
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "secure@dell.com",
|
||||
"ID" : "CVE-2018-11083",
|
||||
"STATE" : "PUBLIC",
|
||||
"TITLE" : "Bosh accepts refresh tokens in place of an access token"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name": "BOSH",
|
||||
"version": {
|
||||
"version_data": [
|
||||
"product_name" : "BOSH",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected": "<",
|
||||
"version_name": "264",
|
||||
"version_value": "v264.14.0"
|
||||
"affected" : "<",
|
||||
"version_name" : "264",
|
||||
"version_value" : "v264.14.0"
|
||||
},
|
||||
{
|
||||
"affected": "<",
|
||||
"version_name": "265",
|
||||
"version_value": "v265.7.0"
|
||||
"affected" : "<",
|
||||
"version_name" : "265",
|
||||
"version_value" : "v265.7.0"
|
||||
},
|
||||
{
|
||||
"affected": "<",
|
||||
"version_name": "266",
|
||||
"version_value": "v266.8.0"
|
||||
"affected" : "<",
|
||||
"version_name" : "266",
|
||||
"version_value" : "v266.8.0"
|
||||
},
|
||||
{
|
||||
"affected": "<",
|
||||
"version_name": "267",
|
||||
"version_value": "v267.2.0"
|
||||
"affected" : "<",
|
||||
"version_name" : "267",
|
||||
"version_value" : "v267.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Cloud Foundry"
|
||||
"vendor_name" : "Cloud Foundry"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to be as access tokens when using UAA for authentication. A remote attacker with an admin refresh token given by UAA can be used to access BOSH resources without obtaining an access token, even if their user no longer has access to those resources."
|
||||
"lang" : "eng",
|
||||
"value" : "Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh tokens to be as access tokens when using UAA for authentication. A remote attacker with an admin refresh token given by UAA can be used to access BOSH resources without obtaining an access token, even if their user no longer has access to those resources."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.4,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
"impact" : {
|
||||
"cvss" : {
|
||||
"attackComplexity" : "LOW",
|
||||
"attackVector" : "ADJACENT_NETWORK",
|
||||
"availabilityImpact" : "HIGH",
|
||||
"baseScore" : 8.4,
|
||||
"baseSeverity" : "HIGH",
|
||||
"confidentialityImpact" : "HIGH",
|
||||
"integrityImpact" : "HIGH",
|
||||
"privilegesRequired" : "LOW",
|
||||
"scope" : "CHANGED",
|
||||
"userInteraction" : "REQUIRED",
|
||||
"vectorString" : "CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
|
||||
"version" : "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description": [
|
||||
"description" : [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Improper Authentication"
|
||||
"lang" : "eng",
|
||||
"value" : "Improper Authentication"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://www.cloudfoundry.org/blog/cve-2018-11083"
|
||||
"name" : "https://www.cloudfoundry.org/blog/cve-2018-11083",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://www.cloudfoundry.org/blog/cve-2018-11083"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
"source" : {
|
||||
"discovery" : "UNKNOWN"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -2,7 +2,30 @@
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "cve@mitre.org",
|
||||
"ID" : "CVE-2018-13042",
|
||||
"STATE" : "RESERVED"
|
||||
"STATE" : "PUBLIC"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "n/a",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
@ -11,7 +34,28 @@
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value" : "The 1Password application 6.8 for Android is affected by a Denial Of Service vulnerability. By starting the activity com.agilebits.onepassword.filling.openyolo.OpenYoloDeleteActivity or com.agilebits.onepassword.filling.openyolo.OpenYoloRetrieveActivity from an external application (since they are exported), it is possible to crash the 1Password instance."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://app-updates.agilebits.com/product_history/OPA4",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://app-updates.agilebits.com/product_history/OPA4"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,84 +1,85 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "secure@dell.com",
|
||||
"DATE_PUBLIC": "2018-10-02T07:00:00.000Z",
|
||||
"ID": "CVE-2018-15763",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "PKS leaks IaaS Credentials to Application Logs"
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "secure@dell.com",
|
||||
"DATE_PUBLIC" : "2018-10-02T07:00:00.000Z",
|
||||
"ID" : "CVE-2018-15763",
|
||||
"STATE" : "PUBLIC",
|
||||
"TITLE" : "PKS leaks IaaS Credentials to Application Logs"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name": "Pivotal Container Service",
|
||||
"version": {
|
||||
"version_data": [
|
||||
"product_name" : "Pivotal Container Service",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected": "<",
|
||||
"version_name": "all versions",
|
||||
"version_value": "1.2.0"
|
||||
"affected" : "<",
|
||||
"version_name" : "all versions",
|
||||
"version_value" : "1.2.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Pivotal"
|
||||
"vendor_name" : "Pivotal"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Pivotal Container Service, versions prior to 1.2.0, contains an information disclosure vulnerability which exposes IaaS credentials to application logs. A malicious user with access to application logs may be able to obtain IaaS credentials and perform actions using these credentials."
|
||||
"lang" : "eng",
|
||||
"value" : "Pivotal Container Service, versions prior to 1.2.0, contains an information disclosure vulnerability which exposes IaaS credentials to application logs. A malicious user with access to application logs may be able to obtain IaaS credentials and perform actions using these credentials."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 9,
|
||||
"baseSeverity": "CRITICAL",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
"impact" : {
|
||||
"cvss" : {
|
||||
"attackComplexity" : "LOW",
|
||||
"attackVector" : "ADJACENT_NETWORK",
|
||||
"availabilityImpact" : "HIGH",
|
||||
"baseScore" : 9,
|
||||
"baseSeverity" : "CRITICAL",
|
||||
"confidentialityImpact" : "HIGH",
|
||||
"integrityImpact" : "HIGH",
|
||||
"privilegesRequired" : "LOW",
|
||||
"scope" : "CHANGED",
|
||||
"userInteraction" : "NONE",
|
||||
"vectorString" : "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
||||
"version" : "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description": [
|
||||
"description" : [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Information Exposure Through Application Logs"
|
||||
"lang" : "eng",
|
||||
"value" : "Information Exposure Through Application Logs"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://pivotal.io/security/cve-2018-15763"
|
||||
"name" : "https://pivotal.io/security/cve-2018-15763",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://pivotal.io/security/cve-2018-15763"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
"source" : {
|
||||
"discovery" : "UNKNOWN"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,84 +1,85 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "secure@dell.com",
|
||||
"DATE_PUBLIC": "2018-09-27T17:30:00.000Z",
|
||||
"ID": "CVE-2018-1264",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Log Cache logs UAA client secret on startup"
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "secure@dell.com",
|
||||
"DATE_PUBLIC" : "2018-09-27T17:30:00.000Z",
|
||||
"ID" : "CVE-2018-1264",
|
||||
"STATE" : "PUBLIC",
|
||||
"TITLE" : "Log Cache logs UAA client secret on startup"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name": "log-cache-release",
|
||||
"version": {
|
||||
"version_data": [
|
||||
"product_name" : "log-cache-release",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"affected": "<",
|
||||
"version_name": "all versions",
|
||||
"version_value": "1.1.1"
|
||||
"affected" : "<",
|
||||
"version_name" : "all versions",
|
||||
"version_value" : "1.1.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Cloud Foundry"
|
||||
"vendor_name" : "Cloud Foundry"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
"data_format" : "MITRE",
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained access to the Log Cache VM can read this secret, gaining all privileges held by the Log Cache UAA client. In the worst case, if this client is an admin, the attacker would gain complete control over the Foundation."
|
||||
"lang" : "eng",
|
||||
"value" : "Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained access to the Log Cache VM can read this secret, gaining all privileges held by the Log Cache UAA client. In the worst case, if this client is an admin, the attacker would gain complete control over the Foundation."
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 9.1,
|
||||
"baseSeverity": "CRITICAL",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
|
||||
"version": "3.0"
|
||||
"impact" : {
|
||||
"cvss" : {
|
||||
"attackComplexity" : "LOW",
|
||||
"attackVector" : "NETWORK",
|
||||
"availabilityImpact" : "HIGH",
|
||||
"baseScore" : 9.1,
|
||||
"baseSeverity" : "CRITICAL",
|
||||
"confidentialityImpact" : "HIGH",
|
||||
"integrityImpact" : "HIGH",
|
||||
"privilegesRequired" : "HIGH",
|
||||
"scope" : "CHANGED",
|
||||
"userInteraction" : "NONE",
|
||||
"vectorString" : "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
|
||||
"version" : "3.0"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description": [
|
||||
"description" : [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Information Exposure Through Log Files"
|
||||
"lang" : "eng",
|
||||
"value" : "Information Exposure Through Log Files"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://www.cloudfoundry.org/blog/cve-2018-1264/"
|
||||
"name" : "https://www.cloudfoundry.org/blog/cve-2018-1264/",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://www.cloudfoundry.org/blog/cve-2018-1264/"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
"source" : {
|
||||
"discovery" : "UNKNOWN"
|
||||
}
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user