mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-08-04 08:44:25 +00:00
fix merge conflict.
This commit is contained in:
CVE Team
commit
65efe99529
@ -1,185 +1,188 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-0304",
|
||||
"ASSIGNER": "cna@sap.com"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP NetWeaver AS ABAP Platform(KRNL32NUC)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21EXT"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.22"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.22EXT"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SAP NetWeaver AS ABAP Platform(KRNL32UC)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21EXT"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.22"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.22EXT"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SAP NetWeaver AS ABAP Platform(KRNL64NUC)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21EXT"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.22"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.22EXT"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.49"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SAP NetWeaver AS ABAP Platform(KRNL64UC)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21EXT"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.22"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.22EXT"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.49"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.73"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SAP NetWeaver AS ABAP Platform(KERNEL)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.45"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.49"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.53"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.73"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or specifically manipulated command that can be executed by the application. An attacker could thereby control the behaviour of the application."
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
|
||||
"problemtype":{
|
||||
"problemtype_data":[
|
||||
{
|
||||
"description":[
|
||||
{
|
||||
"lang": "eng",
|
||||
"value":"Code Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references":{
|
||||
"reference_data":[
|
||||
{
|
||||
"url":"https://launchpad.support.sap.com/#/notes/2719530"
|
||||
},
|
||||
{
|
||||
"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-0304",
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP NetWeaver AS ABAP Platform(KRNL32NUC)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21EXT"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.22"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.22EXT"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SAP NetWeaver AS ABAP Platform(KRNL32UC)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21EXT"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.22"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.22EXT"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SAP NetWeaver AS ABAP Platform(KRNL64NUC)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21EXT"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.22"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.22EXT"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.49"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SAP NetWeaver AS ABAP Platform(KRNL64UC)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21EXT"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.22"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.22EXT"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.49"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.73"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SAP NetWeaver AS ABAP Platform(KERNEL)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.21"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.45"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.49"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.53"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.73"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "FTP Function of SAP NetWeaver AS ABAP Platform, versions- KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.45, 7.49, 7.53, 7.73, allows an attacker to inject code or specifically manipulated command that can be executed by the application. An attacker could thereby control the behaviour of the application."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Code Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2719530",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2719530"
|
||||
},
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,85 +1,88 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-0305",
|
||||
"ASSIGNER": "cna@sap.com"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP NetWeaver Process Integration(SAP_XIESR and SAP_XITOOL)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.10 to 7.11"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.2"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.3"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.31"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.4"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.5"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restrict or incorrectly restrict frame objects or UI layers that belong to another application or domain, resulting in Clickjacking vulnerability. Successful exploitation of this vulnerability leads to unwanted modification of user's data."
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
|
||||
"problemtype":{
|
||||
"problemtype_data":[
|
||||
{
|
||||
"description":[
|
||||
{
|
||||
"lang": "eng",
|
||||
"value":"Clickjacking"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references":{
|
||||
"reference_data":[
|
||||
{
|
||||
"url":"https://launchpad.support.sap.com/#/notes/2755502"
|
||||
},
|
||||
{
|
||||
"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-0305",
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP NetWeaver Process Integration(SAP_XIESR and SAP_XITOOL)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.10 to 7.11"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.2"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.3"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.31"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.4"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.5"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Java Server Pages (JSPs) provided by the SAP NetWeaver Process Integration (SAP_XIESR and SAP_XITOOL: 7.10 to 7.11, 7.20, 7.30, 7.31, 7.40, 7.50) do not restrict or incorrectly restrict frame objects or UI layers that belong to another application or domain, resulting in Clickjacking vulnerability. Successful exploitation of this vulnerability leads to unwanted modification of user's data."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Clickjacking"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2755502",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2755502"
|
||||
},
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,65 +1,68 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-0306",
|
||||
"ASSIGNER": "cna@sap.com"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP HANA Extended Application Services (advanced model)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "SAP HANA Extended Application Services (advanced model), version 1, allows authenticated low privileged XS Advanced Platform users such as SpaceAuditors to execute requests to obtain a complete list of SAP HANA user IDs and names."
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
|
||||
"problemtype":{
|
||||
"problemtype_data":[
|
||||
{
|
||||
"description":[
|
||||
{
|
||||
"lang": "eng",
|
||||
"value":"Information Disclosure"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references":{
|
||||
"reference_data":[
|
||||
{
|
||||
"url":"https://launchpad.support.sap.com/#/notes/2771128"
|
||||
},
|
||||
{
|
||||
"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-0306",
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP HANA Extended Application Services (advanced model)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "1.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "SAP HANA Extended Application Services (advanced model), version 1, allows authenticated low privileged XS Advanced Platform users such as SpaceAuditors to execute requests to obtain a complete list of SAP HANA user IDs and names."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Information Disclosure"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2771128",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2771128"
|
||||
},
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,65 +1,68 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-0307",
|
||||
"ASSIGNER": "cna@sap.com"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Solution Manager(Diagnostics Agent)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials, an attacker with admin privileges could gain access to the entire configuration, but no system sensitive information can be gained."
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
|
||||
"problemtype":{
|
||||
"problemtype_data":[
|
||||
{
|
||||
"description":[
|
||||
{
|
||||
"lang": "eng",
|
||||
"value":"Information Disclosure"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references":{
|
||||
"reference_data":[
|
||||
{
|
||||
"url":"https://launchpad.support.sap.com/#/notes/2772266"
|
||||
},
|
||||
{
|
||||
"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-0307",
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP Solution Manager(Diagnostics Agent)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Diagnostics Agent in Solution Manager, version 7.2, stores several credentials such as SLD user connection as well as Solman user communication in the SAP Secure Storage file which is not encrypted by default. By decoding these credentials, an attacker with admin privileges could gain access to the entire configuration, but no system sensitive information can be gained."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Information Disclosure"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2772266",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2772266"
|
||||
},
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,81 +1,84 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-0308",
|
||||
"ASSIGNER": "cna@sap.com"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP E-Commerce (Business-to-Consumer application)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.3"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.31"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.32"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.33"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.54"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine, leading to Code Injection."
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
|
||||
"problemtype":{
|
||||
"problemtype_data":[
|
||||
{
|
||||
"description":[
|
||||
{
|
||||
"lang": "eng",
|
||||
"value":"Code Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references":{
|
||||
"reference_data":[
|
||||
{
|
||||
"url":"https://launchpad.support.sap.com/#/notes/2773493"
|
||||
},
|
||||
{
|
||||
"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-0308",
|
||||
"ASSIGNER": "cna@sap.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SAP SE",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SAP E-Commerce (Business-to-Consumer application)",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.3"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.31"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.32"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.33"
|
||||
},
|
||||
{
|
||||
"version_name": "<",
|
||||
"version_value": "7.54"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "An authenticated attacker in SAP E-Commerce (Business-to-Consumer application), versions 7.3, 7.31, 7.32, 7.33, 7.54, can change the price of the product to zero and also checkout, by injecting an HTML code in the application that will be executed whenever the victim logs in to the application even on a different machine, leading to Code Injection."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Code Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://launchpad.support.sap.com/#/notes/2773493",
|
||||
"refsource": "MISC",
|
||||
"name": "https://launchpad.support.sap.com/#/notes/2773493"
|
||||
},
|
||||
{
|
||||
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242",
|
||||
"refsource": "MISC",
|
||||
"name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=521864242"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@ -48,6 +48,11 @@
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10157",
|
||||
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10157",
|
||||
"refsource": "CONFIRM"
|
||||
},
|
||||
{
|
||||
"refsource": "BID",
|
||||
"name": "108734",
|
||||
"url": "http://www.securityfocus.com/bid/108734"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -4,14 +4,58 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-10971",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "ics-cert@hq.dhs.gov",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "n/a",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Network Configurator for DeviceNet Safety",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "3.41 and prior"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "UNTRUSTED SEARCH PATH CWE-426"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-19-134-01",
|
||||
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-19-134-01"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an untrusted search path that could execute a malicious .dll file not under the application's direct control and outside the intended directories."
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -3,16 +3,98 @@
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "security@pivotal.io",
|
||||
"DATE_PUBLIC": "2019-05-30T00:00:00.000Z",
|
||||
"ID": "CVE-2019-11269",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Open Redirector in spring-security-oauth2"
|
||||
},
|
||||
"source": {
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Spring Security OAuth",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"affected": "<",
|
||||
"version_name": "2.2",
|
||||
"version_value": "v2.2.5.RELEASE"
|
||||
},
|
||||
{
|
||||
"affected": "<",
|
||||
"version_name": "2.1",
|
||||
"version_value": "v2.1.5.RELEASE"
|
||||
},
|
||||
{
|
||||
"affected": "<",
|
||||
"version_name": "2.0",
|
||||
"version_value": "v2.0.18.RELEASE"
|
||||
},
|
||||
{
|
||||
"affected": "<",
|
||||
"version_name": "2.3",
|
||||
"version_value": "v2.3.6.RELEASE"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Spring"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-601: Open Redirect"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://pivotal.io/security/cve-2019-11269",
|
||||
"name": "https://pivotal.io/security/cve-2019-11269"
|
||||
}
|
||||
]
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.2,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "REQUIRED",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
|
||||
"version": "3.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -56,6 +56,11 @@
|
||||
"url": "https://developer.joomla.org/security-centre/785-20190603-core-acl-hardening-of-com-joomlaupdate",
|
||||
"refsource": "MISC",
|
||||
"name": "https://developer.joomla.org/security-centre/785-20190603-core-acl-hardening-of-com-joomlaupdate"
|
||||
},
|
||||
{
|
||||
"refsource": "BID",
|
||||
"name": "108729",
|
||||
"url": "http://www.securityfocus.com/bid/108729"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -56,6 +56,11 @@
|
||||
"url": "https://developer.joomla.org/security-centre/783-20190601-core-csv-injection-in-com-actionlogs",
|
||||
"refsource": "MISC",
|
||||
"name": "https://developer.joomla.org/security-centre/783-20190601-core-csv-injection-in-com-actionlogs"
|
||||
},
|
||||
{
|
||||
"refsource": "BID",
|
||||
"name": "108736",
|
||||
"url": "http://www.securityfocus.com/bid/108736"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -56,6 +56,11 @@
|
||||
"url": "https://developer.joomla.org/security-centre/784-20190602-core-xss-in-subform-field",
|
||||
"refsource": "MISC",
|
||||
"name": "https://developer.joomla.org/security-centre/784-20190602-core-xss-in-subform-field"
|
||||
},
|
||||
{
|
||||
"refsource": "BID",
|
||||
"name": "108735",
|
||||
"url": "http://www.securityfocus.com/bid/108735"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -48,6 +48,11 @@
|
||||
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3872",
|
||||
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3872",
|
||||
"refsource": "CONFIRM"
|
||||
},
|
||||
{
|
||||
"refsource": "BID",
|
||||
"name": "108732",
|
||||
"url": "http://www.securityfocus.com/bid/108732"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -1,17 +1,61 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-3946",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-3946",
|
||||
"ASSIGNER": "vulnreport@tenable.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "n/a",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Fuji Electric V-Server",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "Versions prior to 6.0.33.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Denial of Service"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.tenable.com/security/research/tra-2019-27",
|
||||
"url": "https://www.tenable.com/security/research/tra-2019-27"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Fuji Electric V-Server before 6.0.33.0 is vulnerable to denial of service via a crafted UDP message sent to port 8005. An unauthenticated, remote attacker can crash vserver.exe due to an integer overflow in the UDP message handling logic."
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,61 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-3947",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-3947",
|
||||
"ASSIGNER": "vulnreport@tenable.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "n/a",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Fuji Electric V-Server",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "Versions prior to 6.0.33.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Plaintext storage of credentials"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.tenable.com/security/research/tra-2019-27",
|
||||
"url": "https://www.tenable.com/security/research/tra-2019-27"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Fuji Electric V-Server before 6.0.33.0 stores database credentials in project files as plaintext. An attacker that can gain access to the project file can recover the database credentials and gain access to the database server."
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,61 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-5442",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-5442",
|
||||
"ASSIGNER": "support@hackerone.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "n/a",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Pippo",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "1.12.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "XML Entity Expansion (CWE-776)"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://hackerone.com/reports/506791",
|
||||
"url": "https://hackerone.com/reports/506791"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will continue to be exhausted and will affect other processes on the system."
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,18 +1,62 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-7838",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a file extension blacklist bypass vulnerability. Successful exploitation could lead to arbitrary code execution."
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_type": "CVE",
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "Update 3 and earlier, Update 10 and earlier, and Update\u00a018 and earlier versions"
|
||||
}
|
||||
]
|
||||
},
|
||||
"product_name": "ColdFusion"
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Adobe"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "File extension blacklist bypass"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_version": "4.0",
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb19-27.html",
|
||||
"refsource": "CONFIRM",
|
||||
"name": "https://helpx.adobe.com/security/products/coldfusion/apsb19-27.html"
|
||||
}
|
||||
]
|
||||
},
|
||||
"CVE_data_meta": {
|
||||
"STATE": "PUBLIC",
|
||||
"ID": "CVE-2019-7838",
|
||||
"ASSIGNER": "psirt@adobe.com"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,62 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-7839",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution."
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_type": "CVE",
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "Update 3 and earlier, Update 10 and earlier, and Update\u00a018 and earlier versions"
|
||||
}
|
||||
]
|
||||
},
|
||||
"product_name": "ColdFusion"
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Adobe"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Command Injection"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_version": "4.0",
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb19-27.html",
|
||||
"refsource": "CONFIRM",
|
||||
"name": "https://helpx.adobe.com/security/products/coldfusion/apsb19-27.html"
|
||||
}
|
||||
]
|
||||
},
|
||||
"CVE_data_meta": {
|
||||
"STATE": "PUBLIC",
|
||||
"ID": "CVE-2019-7839",
|
||||
"ASSIGNER": "psirt@adobe.com"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,62 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-7840",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "ColdFusion versions Update 3 and earlier, Update 10 and earlier, and Update 18 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution."
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_type": "CVE",
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "Update 3 and earlier, Update 10 and earlier, and Update\u00a018 and earlier versions"
|
||||
}
|
||||
]
|
||||
},
|
||||
"product_name": "ColdFusion"
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Adobe"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Deserialization of untrusted data"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_version": "4.0",
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://helpx.adobe.com/security/products/coldfusion/apsb19-27.html",
|
||||
"refsource": "CONFIRM",
|
||||
"name": "https://helpx.adobe.com/security/products/coldfusion/apsb19-27.html"
|
||||
}
|
||||
]
|
||||
},
|
||||
"CVE_data_meta": {
|
||||
"STATE": "PUBLIC",
|
||||
"ID": "CVE-2019-7840",
|
||||
"ASSIGNER": "psirt@adobe.com"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,62 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-7845",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Adobe Flash Player versions 32.0.0.192 and earlier, 32.0.0.192 and earlier, and 32.0.0.192 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution."
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_type": "CVE",
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "32.0.0.192 and earlier, 32.0.0.192 and earlier, and 32.0.0.192 \u202fand earlier versions"
|
||||
}
|
||||
]
|
||||
},
|
||||
"product_name": "Adobe Flash Player"
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "Adobe"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Use After Free"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_version": "4.0",
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://helpx.adobe.com/security/products/flash-player/apsb19-30.html",
|
||||
"refsource": "CONFIRM",
|
||||
"name": "https://helpx.adobe.com/security/products/flash-player/apsb19-30.html"
|
||||
}
|
||||
]
|
||||
},
|
||||
"CVE_data_meta": {
|
||||
"STATE": "PUBLIC",
|
||||
"ID": "CVE-2019-7845",
|
||||
"ASSIGNER": "psirt@adobe.com"
|
||||
}
|
||||
}
|
||||
@ -1,17 +1,61 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-9676",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-9676",
|
||||
"ASSIGNER": "cybersecurity@dahuatech.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "n/a",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "IPC-HFW1XXX,IPC-HDW1XXX,IPC-HFW2XXX",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "Build before 2018/11"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Buffer overflow"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.dahuasecurity.com/support/cybersecurity/details/617",
|
||||
"url": "https://www.dahuasecurity.com/support/cybersecurity/details/617"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Buffer overflow vulnerability found in some Dahua IP Camera devices IPC-HFW1XXX,IPC-HDW1XXX,IPC-HFW2XXX Build before 2018/11. The vulnerability exits in the function of redirection display for serial port printing information, which can not be used by product basic functions. After an attacker logs in locally, this vulnerability can be exploited to cause device restart or arbitrary code execution. Dahua has identified the corresponding security problems in the static code auditing process, so it has gradually deleted this function, which is no longer available in the newer devices and softwares. Dahua has released versions of the affected products to fix the vulnerability."
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user