From 8bfbf97a2e4cf31d4f2699c910839924354bf0af Mon Sep 17 00:00:00 2001 From: CVE Team Date: Wed, 15 Jan 2020 21:01:19 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2009/3xxx/CVE-2009-3724.json | 55 +++- 2009/5xxx/CVE-2009-5025.json | 60 +++- 2009/5xxx/CVE-2009-5068.json | 50 ++- 2016/1000xxx/CVE-2016-1000022.json | 83 +---- 2019/15xxx/CVE-2019-15010.json | 480 +++++++++++++++-------------- 2019/15xxx/CVE-2019-15012.json | 480 +++++++++++++++-------------- 2019/20xxx/CVE-2019-20097.json | 480 +++++++++++++++-------------- 2019/20xxx/CVE-2019-20372.json | 5 + 8 files changed, 891 insertions(+), 802 deletions(-) diff --git a/2009/3xxx/CVE-2009-3724.json b/2009/3xxx/CVE-2009-3724.json index 5f2bf87c31f..7bb35155c46 100644 --- a/2009/3xxx/CVE-2009-3724.json +++ b/2009/3xxx/CVE-2009-3724.json @@ -1,8 +1,31 @@ { "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", + "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2009-3724", - "STATE": "RESERVED" + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "python-markdown2", + "product": { + "product_data": [ + { + "product_name": "python-markdown2", + "version": { + "version_data": [ + { + "version_value": "before 1.0.1.14" + } + ] + } + } + ] + } + } + ] + } }, "data_format": "MITRE", "data_type": "CVE", @@ -11,7 +34,33 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Cross-Site Scripting" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.openwall.com/lists/oss-security/2009/10/29/5", + "refsource": "MISC", + "name": "https://www.openwall.com/lists/oss-security/2009/10/29/5" + }, + { + "refsource": "MISC", + "name": "https://snyk.io/vuln/SNYK-PYTHON-PYRAD-40000", + "url": "https://snyk.io/vuln/SNYK-PYTHON-PYRAD-40000" } ] } diff --git a/2009/5xxx/CVE-2009-5025.json b/2009/5xxx/CVE-2009-5025.json index 879df95e7c0..b65a1aeb1e4 100644 --- a/2009/5xxx/CVE-2009-5025.json +++ b/2009/5xxx/CVE-2009-5025.json @@ -1,8 +1,31 @@ { "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", + "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2009-5025", - "STATE": "RESERVED" + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "PyForum", + "product": { + "product_data": [ + { + "product_name": "PyForum", + "version": { + "version_data": [ + { + "version_value": "v1.0.3" + } + ] + } + } + ] + } + } + ] + } }, "data_format": "MITRE", "data_type": "CVE", @@ -11,7 +34,38 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A backdoor (aka BMSA-2009-07) was found in PyForum v1.0.3 where an attacker who knows a valid user email could force a password reset on behalf of that user." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Other" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://packetstormsecurity.com/files/cve/CVE-2009-5025", + "refsource": "MISC", + "name": "https://packetstormsecurity.com/files/cve/CVE-2009-5025" + }, + { + "url": "https://www.openwall.com/lists/oss-security/2011/07/26/7", + "refsource": "MISC", + "name": "https://www.openwall.com/lists/oss-security/2011/07/26/7" + }, + { + "refsource": "MISC", + "name": "https://seclists.org/fulldisclosure/2009/Nov/353", + "url": "https://seclists.org/fulldisclosure/2009/Nov/353" } ] } diff --git a/2009/5xxx/CVE-2009-5068.json b/2009/5xxx/CVE-2009-5068.json index 9054c098fa6..8c549885d3a 100644 --- a/2009/5xxx/CVE-2009-5068.json +++ b/2009/5xxx/CVE-2009-5068.json @@ -1,8 +1,31 @@ { "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", + "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2009-5068", - "STATE": "RESERVED" + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SMF", + "product": { + "product_data": [ + { + "product_name": "SMF", + "version": { + "version_data": [ + { + "version_value": "through 2.0.3" + } + ] + } + } + ] + } + } + ] + } }, "data_format": "MITRE", "data_type": "CVE", @@ -11,7 +34,28 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3. On some configurations a SMF deployment is shared by several \"co-admins\" that are not trusted beyond the SMF deployment. This vulnerability allows them to read arbitrary files on the filesystem and therefore gain new privileges by reading the settings.php with the database passwords." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "file disclosure" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "http://www.openwall.com/lists/oss-security/2013/02/01/4", + "refsource": "MISC", + "name": "http://www.openwall.com/lists/oss-security/2013/02/01/4" } ] } diff --git a/2016/1000xxx/CVE-2016-1000022.json b/2016/1000xxx/CVE-2016-1000022.json index 0bbac96a332..3abef6a4615 100644 --- a/2016/1000xxx/CVE-2016-1000022.json +++ b/2016/1000xxx/CVE-2016-1000022.json @@ -1,86 +1,17 @@ { - "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", - "ID": "CVE-2016-1000022", - "STATE": "PUBLIC" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "product": { - "product_data": [ - { - "product_name": "n/a", - "version": { - "version_data": [ - { - "version_value": "n/a" - } - ] - } - } - ] - }, - "vendor_name": "n/a" - } - ] - } - }, - "data_format": "MITRE", "data_type": "CVE", + "data_format": "MITRE", "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2016-1000022", + "ASSIGNER": "cve@mitre.org", + "STATE": "REJECT" + }, "description": { "description_data": [ { "lang": "eng", - "value": "negotiator before 0.6.1 is vulnerable to a regular expression DoS" - } - ] - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ - { - "lang": "eng", - "value": "n/a" - } - ] - } - ] - }, - "references": { - "reference_data": [ - { - "refsource": "MISC", - "name": "https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000022.json", - "url": "https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000022.json" - }, - { - "url": "https://security-tracker.debian.org/tracker/CVE-2016-1000022", - "refsource": "MISC", - "name": "https://security-tracker.debian.org/tracker/CVE-2016-1000022" - }, - { - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000022", - "refsource": "MISC", - "name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000022" - }, - { - "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2016-1000022", - "refsource": "MISC", - "name": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2016-1000022" - }, - { - "url": "https://access.redhat.com/errata/RHSA-2016:1605", - "refsource": "MISC", - "name": "https://access.redhat.com/errata/RHSA-2016:1605" - }, - { - "refsource": "MISC", - "name": "https://www.npmjs.com/advisories/106", - "url": "https://www.npmjs.com/advisories/106" + "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10539. Reason: This candidate is a duplicate of CVE-2016-10539. Notes: All CVE users should reference CVE-2016-10539 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage." } ] } diff --git a/2019/15xxx/CVE-2019-15010.json b/2019/15xxx/CVE-2019-15010.json index a4e8af3b27c..b2325248f9f 100644 --- a/2019/15xxx/CVE-2019-15010.json +++ b/2019/15xxx/CVE-2019-15010.json @@ -1,241 +1,243 @@ { - "CVE_data_meta": { - "ASSIGNER": "security@atlassian.com", - "DATE_PUBLIC": "2020-01-15T10:00:00", - "ID": "CVE-2019-15010", - "STATE": "PUBLIC" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "product": { - "product_data": [ - { - "product_name": "Bitbucket Server", - "version": { - "version_data": [ - { - "version_value": "3.0", - "version_affected": ">=" - }, - { - "version_value": "5.16.11", - "version_affected": "<" - }, - { - "version_value": "6.0", - "version_affected": ">=" - }, - { - "version_value": "6.0.11", - "version_affected": "<" - }, - { - "version_value": "6.1.0", - "version_affected": ">=" - }, - { - "version_value": "6.1.9", - "version_affected": "<" - }, - { - "version_value": "6.2.0", - "version_affected": ">=" - }, - { - "version_value": "6.2.7", - "version_affected": "<" - }, - { - "version_value": "6.3.0", - "version_affected": ">=" - }, - { - "version_value": "6.3.6", - "version_affected": "<" - }, - { - "version_value": "6.4.0", - "version_affected": ">=" - }, - { - "version_value": "6.4.4", - "version_affected": "<" - }, - { - "version_value": "6.5.0", - "version_affected": ">=" - }, - { - "version_value": "6.5.3", - "version_affected": "<" - }, - { - "version_value": "6.6.0", - "version_affected": ">=" - }, - { - "version_value": "6.6.3", - "version_affected": "<" - }, - { - "version_value": "6.7.0", - "version_affected": ">=" - }, - { - "version_value": "6.7.3", - "version_affected": "<" - }, - { - "version_value": "6.8.0", - "version_affected": ">=" - }, - { - "version_value": "6.8.2", - "version_affected": "<" - }, - { - "version_value": "6.9.0", - "version_affected": ">=" - }, - { - "version_value": "6.9.1", - "version_affected": "<" - } - ] - } - }, - { - "product_name": "Bitbucket Data Center", - "version": { - "version_data": [ - { - "version_value": "3.0", - "version_affected": ">=" - }, - { - "version_value": "5.16.11", - "version_affected": "<" - }, - { - "version_value": "6.0", - "version_affected": ">=" - }, - { - "version_value": "6.0.11", - "version_affected": "<" - }, - { - "version_value": "6.1.0", - "version_affected": ">=" - }, - { - "version_value": "6.1.9", - "version_affected": "<" - }, - { - "version_value": "6.2.0", - "version_affected": ">=" - }, - { - "version_value": "6.2.7", - "version_affected": "<" - }, - { - "version_value": "6.3.0", - "version_affected": ">=" - }, - { - "version_value": "6.3.6", - "version_affected": "<" - }, - { - "version_value": "6.4.0", - "version_affected": ">=" - }, - { - "version_value": "6.4.4", - "version_affected": "<" - }, - { - "version_value": "6.5.0", - "version_affected": ">=" - }, - { - "version_value": "6.5.3", - "version_affected": "<" - }, - { - "version_value": "6.6.0", - "version_affected": ">=" - }, - { - "version_value": "6.6.3", - "version_affected": "<" - }, - { - "version_value": "6.7.0", - "version_affected": ">=" - }, - { - "version_value": "6.7.3", - "version_affected": "<" - }, - { - "version_value": "6.8.0", - "version_affected": ">=" - }, - { - "version_value": "6.8.2", - "version_affected": "<" - }, - { - "version_value": "6.9.0", - "version_affected": ">=" - }, - { - "version_value": "6.9.1", - "version_affected": "<" - } - ] - } - } - ] - }, - "vendor_name": "Atlassian" - } - ] - } - }, - "data_format": "MITRE", - "data_type": "CVE", - "data_version": "4.0", - "description": { - "description_data": [ - { - "lang": "eng", - "value": "Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, and from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via certain user input fields. A remote attacker with user level permissions can exploit this vulnerability to run arbitrary commands on the victim's systems. Using a specially crafted payload as user input, the attacker can execute arbitrary commands on the victim's Bitbucket Server or Bitbucket Data Center instance." - } - ] - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ - { - "lang": "eng", - "value": "Expression Language Injection" - } + "CVE_data_meta": { + "ASSIGNER": "security@atlassian.com", + "DATE_PUBLIC": "2020-01-15T10:00:00", + "ID": "CVE-2019-15010", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "Bitbucket Server", + "version": { + "version_data": [ + { + "version_value": "3.0", + "version_affected": ">=" + }, + { + "version_value": "5.16.11", + "version_affected": "<" + }, + { + "version_value": "6.0", + "version_affected": ">=" + }, + { + "version_value": "6.0.11", + "version_affected": "<" + }, + { + "version_value": "6.1.0", + "version_affected": ">=" + }, + { + "version_value": "6.1.9", + "version_affected": "<" + }, + { + "version_value": "6.2.0", + "version_affected": ">=" + }, + { + "version_value": "6.2.7", + "version_affected": "<" + }, + { + "version_value": "6.3.0", + "version_affected": ">=" + }, + { + "version_value": "6.3.6", + "version_affected": "<" + }, + { + "version_value": "6.4.0", + "version_affected": ">=" + }, + { + "version_value": "6.4.4", + "version_affected": "<" + }, + { + "version_value": "6.5.0", + "version_affected": ">=" + }, + { + "version_value": "6.5.3", + "version_affected": "<" + }, + { + "version_value": "6.6.0", + "version_affected": ">=" + }, + { + "version_value": "6.6.3", + "version_affected": "<" + }, + { + "version_value": "6.7.0", + "version_affected": ">=" + }, + { + "version_value": "6.7.3", + "version_affected": "<" + }, + { + "version_value": "6.8.0", + "version_affected": ">=" + }, + { + "version_value": "6.8.2", + "version_affected": "<" + }, + { + "version_value": "6.9.0", + "version_affected": ">=" + }, + { + "version_value": "6.9.1", + "version_affected": "<" + } + ] + } + }, + { + "product_name": "Bitbucket Data Center", + "version": { + "version_data": [ + { + "version_value": "3.0", + "version_affected": ">=" + }, + { + "version_value": "5.16.11", + "version_affected": "<" + }, + { + "version_value": "6.0", + "version_affected": ">=" + }, + { + "version_value": "6.0.11", + "version_affected": "<" + }, + { + "version_value": "6.1.0", + "version_affected": ">=" + }, + { + "version_value": "6.1.9", + "version_affected": "<" + }, + { + "version_value": "6.2.0", + "version_affected": ">=" + }, + { + "version_value": "6.2.7", + "version_affected": "<" + }, + { + "version_value": "6.3.0", + "version_affected": ">=" + }, + { + "version_value": "6.3.6", + "version_affected": "<" + }, + { + "version_value": "6.4.0", + "version_affected": ">=" + }, + { + "version_value": "6.4.4", + "version_affected": "<" + }, + { + "version_value": "6.5.0", + "version_affected": ">=" + }, + { + "version_value": "6.5.3", + "version_affected": "<" + }, + { + "version_value": "6.6.0", + "version_affected": ">=" + }, + { + "version_value": "6.6.3", + "version_affected": "<" + }, + { + "version_value": "6.7.0", + "version_affected": ">=" + }, + { + "version_value": "6.7.3", + "version_affected": "<" + }, + { + "version_value": "6.8.0", + "version_affected": ">=" + }, + { + "version_value": "6.8.2", + "version_affected": "<" + }, + { + "version_value": "6.9.0", + "version_affected": ">=" + }, + { + "version_value": "6.9.1", + "version_affected": "<" + } + ] + } + } + ] + }, + "vendor_name": "Atlassian" + } ] - } - ] - }, - "references": { - "reference_data": [ - { - "url": "https://jira.atlassian.com/browse/BSERV-12098" - } - ] - } -} + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, and from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via certain user input fields. A remote attacker with user level permissions can exploit this vulnerability to run arbitrary commands on the victim's systems. Using a specially crafted payload as user input, the attacker can execute arbitrary commands on the victim's Bitbucket Server or Bitbucket Data Center instance." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Expression Language Injection" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://jira.atlassian.com/browse/BSERV-12098", + "refsource": "MISC", + "name": "https://jira.atlassian.com/browse/BSERV-12098" + } + ] + } +} \ No newline at end of file diff --git a/2019/15xxx/CVE-2019-15012.json b/2019/15xxx/CVE-2019-15012.json index d07e470c37a..0048f50cbb4 100644 --- a/2019/15xxx/CVE-2019-15012.json +++ b/2019/15xxx/CVE-2019-15012.json @@ -1,241 +1,243 @@ { - "CVE_data_meta": { - "ASSIGNER": "security@atlassian.com", - "DATE_PUBLIC": "2020-01-15T10:00:00", - "ID": "CVE-2019-15012", - "STATE": "PUBLIC" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "product": { - "product_data": [ - { - "product_name": "Bitbucket Server", - "version": { - "version_data": [ - { - "version_value": "4.13", - "version_affected": ">=" - }, - { - "version_value": "5.16.11", - "version_affected": "<" - }, - { - "version_value": "6.0", - "version_affected": ">=" - }, - { - "version_value": "6.0.11", - "version_affected": "<" - }, - { - "version_value": "6.1.0", - "version_affected": ">=" - }, - { - "version_value": "6.1.9", - "version_affected": "<" - }, - { - "version_value": "6.2.0", - "version_affected": ">=" - }, - { - "version_value": "6.2.7", - "version_affected": "<" - }, - { - "version_value": "6.3.0", - "version_affected": ">=" - }, - { - "version_value": "6.3.6", - "version_affected": "<" - }, - { - "version_value": "6.4.0", - "version_affected": ">=" - }, - { - "version_value": "6.4.4", - "version_affected": "<" - }, - { - "version_value": "6.5.0", - "version_affected": ">=" - }, - { - "version_value": "6.5.3", - "version_affected": "<" - }, - { - "version_value": "6.6.0", - "version_affected": ">=" - }, - { - "version_value": "6.6.3", - "version_affected": "<" - }, - { - "version_value": "6.7.0", - "version_affected": ">=" - }, - { - "version_value": "6.7.3", - "version_affected": "<" - }, - { - "version_value": "6.8.0", - "version_affected": ">=" - }, - { - "version_value": "6.8.2", - "version_affected": "<" - }, - { - "version_value": "6.9.0", - "version_affected": ">=" - }, - { - "version_value": "6.9.1", - "version_affected": "<" - } - ] - } - }, - { - "product_name": "Bitbucket Data Center", - "version": { - "version_data": [ - { - "version_value": "4.13", - "version_affected": ">=" - }, - { - "version_value": "5.16.11", - "version_affected": "<" - }, - { - "version_value": "6.0", - "version_affected": ">=" - }, - { - "version_value": "6.0.11", - "version_affected": "<" - }, - { - "version_value": "6.1.0", - "version_affected": ">=" - }, - { - "version_value": "6.1.9", - "version_affected": "<" - }, - { - "version_value": "6.2.0", - "version_affected": ">=" - }, - { - "version_value": "6.2.7", - "version_affected": "<" - }, - { - "version_value": "6.3.0", - "version_affected": ">=" - }, - { - "version_value": "6.3.6", - "version_affected": "<" - }, - { - "version_value": "6.4.0", - "version_affected": ">=" - }, - { - "version_value": "6.4.4", - "version_affected": "<" - }, - { - "version_value": "6.5.0", - "version_affected": ">=" - }, - { - "version_value": "6.5.3", - "version_affected": "<" - }, - { - "version_value": "6.6.0", - "version_affected": ">=" - }, - { - "version_value": "6.6.3", - "version_affected": "<" - }, - { - "version_value": "6.7.0", - "version_affected": ">=" - }, - { - "version_value": "6.7.3", - "version_affected": "<" - }, - { - "version_value": "6.8.0", - "version_affected": ">=" - }, - { - "version_value": "6.8.2", - "version_affected": "<" - }, - { - "version_value": "6.9.0", - "version_affected": ">=" - }, - { - "version_value": "6.9.1", - "version_affected": "<" - } - ] - } - } - ] - }, - "vendor_name": "Atlassian" - } - ] - } - }, - "data_format": "MITRE", - "data_type": "CVE", - "data_version": "4.0", - "description": { - "description_data": [ - { - "lang": "eng", - "value": "Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victims Bitbucket Server or Bitbucket Data Center instance using the edit-file endpoint, if the user has Bitbucket Server or Bitbucket Data Center running, and has the permission to write the file at that destination. In some cases, this can result in execution of arbitrary code by the victims Bitbucket Server or Bitbucket Data Center instance." - } - ] - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ - { - "lang": "eng", - "value": "Path traversal" - } + "CVE_data_meta": { + "ASSIGNER": "security@atlassian.com", + "DATE_PUBLIC": "2020-01-15T10:00:00", + "ID": "CVE-2019-15012", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "Bitbucket Server", + "version": { + "version_data": [ + { + "version_value": "4.13", + "version_affected": ">=" + }, + { + "version_value": "5.16.11", + "version_affected": "<" + }, + { + "version_value": "6.0", + "version_affected": ">=" + }, + { + "version_value": "6.0.11", + "version_affected": "<" + }, + { + "version_value": "6.1.0", + "version_affected": ">=" + }, + { + "version_value": "6.1.9", + "version_affected": "<" + }, + { + "version_value": "6.2.0", + "version_affected": ">=" + }, + { + "version_value": "6.2.7", + "version_affected": "<" + }, + { + "version_value": "6.3.0", + "version_affected": ">=" + }, + { + "version_value": "6.3.6", + "version_affected": "<" + }, + { + "version_value": "6.4.0", + "version_affected": ">=" + }, + { + "version_value": "6.4.4", + "version_affected": "<" + }, + { + "version_value": "6.5.0", + "version_affected": ">=" + }, + { + "version_value": "6.5.3", + "version_affected": "<" + }, + { + "version_value": "6.6.0", + "version_affected": ">=" + }, + { + "version_value": "6.6.3", + "version_affected": "<" + }, + { + "version_value": "6.7.0", + "version_affected": ">=" + }, + { + "version_value": "6.7.3", + "version_affected": "<" + }, + { + "version_value": "6.8.0", + "version_affected": ">=" + }, + { + "version_value": "6.8.2", + "version_affected": "<" + }, + { + "version_value": "6.9.0", + "version_affected": ">=" + }, + { + "version_value": "6.9.1", + "version_affected": "<" + } + ] + } + }, + { + "product_name": "Bitbucket Data Center", + "version": { + "version_data": [ + { + "version_value": "4.13", + "version_affected": ">=" + }, + { + "version_value": "5.16.11", + "version_affected": "<" + }, + { + "version_value": "6.0", + "version_affected": ">=" + }, + { + "version_value": "6.0.11", + "version_affected": "<" + }, + { + "version_value": "6.1.0", + "version_affected": ">=" + }, + { + "version_value": "6.1.9", + "version_affected": "<" + }, + { + "version_value": "6.2.0", + "version_affected": ">=" + }, + { + "version_value": "6.2.7", + "version_affected": "<" + }, + { + "version_value": "6.3.0", + "version_affected": ">=" + }, + { + "version_value": "6.3.6", + "version_affected": "<" + }, + { + "version_value": "6.4.0", + "version_affected": ">=" + }, + { + "version_value": "6.4.4", + "version_affected": "<" + }, + { + "version_value": "6.5.0", + "version_affected": ">=" + }, + { + "version_value": "6.5.3", + "version_affected": "<" + }, + { + "version_value": "6.6.0", + "version_affected": ">=" + }, + { + "version_value": "6.6.3", + "version_affected": "<" + }, + { + "version_value": "6.7.0", + "version_affected": ">=" + }, + { + "version_value": "6.7.3", + "version_affected": "<" + }, + { + "version_value": "6.8.0", + "version_affected": ">=" + }, + { + "version_value": "6.8.2", + "version_affected": "<" + }, + { + "version_value": "6.9.0", + "version_affected": ">=" + }, + { + "version_value": "6.9.1", + "version_affected": "<" + } + ] + } + } + ] + }, + "vendor_name": "Atlassian" + } ] - } - ] - }, - "references": { - "reference_data": [ - { - "url": "https://jira.atlassian.com/browse/BSERV-12100" - } - ] - } - } + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victims Bitbucket Server or Bitbucket Data Center instance using the edit-file endpoint, if the user has Bitbucket Server or Bitbucket Data Center running, and has the permission to write the file at that destination. In some cases, this can result in execution of arbitrary code by the victims Bitbucket Server or Bitbucket Data Center instance." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Path traversal" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://jira.atlassian.com/browse/BSERV-12100", + "refsource": "MISC", + "name": "https://jira.atlassian.com/browse/BSERV-12100" + } + ] + } +} \ No newline at end of file diff --git a/2019/20xxx/CVE-2019-20097.json b/2019/20xxx/CVE-2019-20097.json index 460e5aec1ad..63ac9037ccc 100644 --- a/2019/20xxx/CVE-2019-20097.json +++ b/2019/20xxx/CVE-2019-20097.json @@ -1,241 +1,243 @@ { - "CVE_data_meta": { - "ASSIGNER": "security@atlassian.com", - "DATE_PUBLIC": "2020-01-15T10:00:00", - "ID": "CVE-2019-20097", - "STATE": "PUBLIC" - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "product": { - "product_data": [ - { - "product_name": "Bitbucket Server", - "version": { - "version_data": [ - { - "version_value": "1.0", - "version_affected": ">=" - }, - { - "version_value": "5.16.11", - "version_affected": "<" - }, - { - "version_value": "6.0", - "version_affected": ">=" - }, - { - "version_value": "6.0.11", - "version_affected": "<" - }, - { - "version_value": "6.1.0", - "version_affected": ">=" - }, - { - "version_value": "6.1.9", - "version_affected": "<" - }, - { - "version_value": "6.2.0", - "version_affected": ">=" - }, - { - "version_value": "6.2.7", - "version_affected": "<" - }, - { - "version_value": "6.3.0", - "version_affected": ">=" - }, - { - "version_value": "6.3.6", - "version_affected": "<" - }, - { - "version_value": "6.4.0", - "version_affected": ">=" - }, - { - "version_value": "6.4.4", - "version_affected": "<" - }, - { - "version_value": "6.5.0", - "version_affected": ">=" - }, - { - "version_value": "6.5.3", - "version_affected": "<" - }, - { - "version_value": "6.6.0", - "version_affected": ">=" - }, - { - "version_value": "6.6.3", - "version_affected": "<" - }, - { - "version_value": "6.7.0", - "version_affected": ">=" - }, - { - "version_value": "6.7.3", - "version_affected": "<" - }, - { - "version_value": "6.8.0", - "version_affected": ">=" - }, - { - "version_value": "6.8.2", - "version_affected": "<" - }, - { - "version_value": "6.9.0", - "version_affected": ">=" - }, - { - "version_value": "6.9.1", - "version_affected": "<" - } - ] - } - }, - { - "product_name": "Bitbucket Data Center", - "version": { - "version_data": [ - { - "version_value": "1.0", - "version_affected": ">=" - }, - { - "version_value": "5.16.11", - "version_affected": "<" - }, - { - "version_value": "6.0", - "version_affected": ">=" - }, - { - "version_value": "6.0.11", - "version_affected": "<" - }, - { - "version_value": "6.1.0", - "version_affected": ">=" - }, - { - "version_value": "6.1.9", - "version_affected": "<" - }, - { - "version_value": "6.2.0", - "version_affected": ">=" - }, - { - "version_value": "6.2.7", - "version_affected": "<" - }, - { - "version_value": "6.3.0", - "version_affected": ">=" - }, - { - "version_value": "6.3.6", - "version_affected": "<" - }, - { - "version_value": "6.4.0", - "version_affected": ">=" - }, - { - "version_value": "6.4.4", - "version_affected": "<" - }, - { - "version_value": "6.5.0", - "version_affected": ">=" - }, - { - "version_value": "6.5.3", - "version_affected": "<" - }, - { - "version_value": "6.6.0", - "version_affected": ">=" - }, - { - "version_value": "6.6.3", - "version_affected": "<" - }, - { - "version_value": "6.7.0", - "version_affected": ">=" - }, - { - "version_value": "6.7.3", - "version_affected": "<" - }, - { - "version_value": "6.8.0", - "version_affected": ">=" - }, - { - "version_value": "6.8.2", - "version_affected": "<" - }, - { - "version_value": "6.9.0", - "version_affected": ">=" - }, - { - "version_value": "6.9.1", - "version_affected": "<" - } - ] - } - } - ] - }, - "vendor_name": "Atlassian" - } - ] - } - }, - "data_format": "MITRE", - "data_type": "CVE", - "data_version": "4.0", - "description": { - "description_data": [ - { - "lang": "eng", - "value": "Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the post-receive hook. A remote attacker with permission to clone and push files to a repository on the victim's Bitbucket Server or Bitbucket Data Center instance, can exploit this vulnerability to execute arbitrary commands on the Bitbucket Server or Bitbucket Data Center systems, using a file with specially crafted content." - } - ] - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ - { - "lang": "eng", - "value": "Argument Injection" - } + "CVE_data_meta": { + "ASSIGNER": "security@atlassian.com", + "DATE_PUBLIC": "2020-01-15T10:00:00", + "ID": "CVE-2019-20097", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "Bitbucket Server", + "version": { + "version_data": [ + { + "version_value": "1.0", + "version_affected": ">=" + }, + { + "version_value": "5.16.11", + "version_affected": "<" + }, + { + "version_value": "6.0", + "version_affected": ">=" + }, + { + "version_value": "6.0.11", + "version_affected": "<" + }, + { + "version_value": "6.1.0", + "version_affected": ">=" + }, + { + "version_value": "6.1.9", + "version_affected": "<" + }, + { + "version_value": "6.2.0", + "version_affected": ">=" + }, + { + "version_value": "6.2.7", + "version_affected": "<" + }, + { + "version_value": "6.3.0", + "version_affected": ">=" + }, + { + "version_value": "6.3.6", + "version_affected": "<" + }, + { + "version_value": "6.4.0", + "version_affected": ">=" + }, + { + "version_value": "6.4.4", + "version_affected": "<" + }, + { + "version_value": "6.5.0", + "version_affected": ">=" + }, + { + "version_value": "6.5.3", + "version_affected": "<" + }, + { + "version_value": "6.6.0", + "version_affected": ">=" + }, + { + "version_value": "6.6.3", + "version_affected": "<" + }, + { + "version_value": "6.7.0", + "version_affected": ">=" + }, + { + "version_value": "6.7.3", + "version_affected": "<" + }, + { + "version_value": "6.8.0", + "version_affected": ">=" + }, + { + "version_value": "6.8.2", + "version_affected": "<" + }, + { + "version_value": "6.9.0", + "version_affected": ">=" + }, + { + "version_value": "6.9.1", + "version_affected": "<" + } + ] + } + }, + { + "product_name": "Bitbucket Data Center", + "version": { + "version_data": [ + { + "version_value": "1.0", + "version_affected": ">=" + }, + { + "version_value": "5.16.11", + "version_affected": "<" + }, + { + "version_value": "6.0", + "version_affected": ">=" + }, + { + "version_value": "6.0.11", + "version_affected": "<" + }, + { + "version_value": "6.1.0", + "version_affected": ">=" + }, + { + "version_value": "6.1.9", + "version_affected": "<" + }, + { + "version_value": "6.2.0", + "version_affected": ">=" + }, + { + "version_value": "6.2.7", + "version_affected": "<" + }, + { + "version_value": "6.3.0", + "version_affected": ">=" + }, + { + "version_value": "6.3.6", + "version_affected": "<" + }, + { + "version_value": "6.4.0", + "version_affected": ">=" + }, + { + "version_value": "6.4.4", + "version_affected": "<" + }, + { + "version_value": "6.5.0", + "version_affected": ">=" + }, + { + "version_value": "6.5.3", + "version_affected": "<" + }, + { + "version_value": "6.6.0", + "version_affected": ">=" + }, + { + "version_value": "6.6.3", + "version_affected": "<" + }, + { + "version_value": "6.7.0", + "version_affected": ">=" + }, + { + "version_value": "6.7.3", + "version_affected": "<" + }, + { + "version_value": "6.8.0", + "version_affected": ">=" + }, + { + "version_value": "6.8.2", + "version_affected": "<" + }, + { + "version_value": "6.9.0", + "version_affected": ">=" + }, + { + "version_value": "6.9.1", + "version_affected": "<" + } + ] + } + } + ] + }, + "vendor_name": "Atlassian" + } ] - } - ] - }, - "references": { - "reference_data": [ - { - "url": "https://jira.atlassian.com/browse/BSERV-12099" - } - ] - } -} + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", + "description": { + "description_data": [ + { + "lang": "eng", + "value": "Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11, from version 6.0.0 before 6.0.11, from version 6.1.0 before 6.1.9, from version 6.2.0 before 6.2.7, from version 6.3.0 before 6.3.6, from version 6.4.0 before 6.4.4, from version 6.5.0 before 6.5.3, from version 6.6.0 before 6.6.3, from version 6.7.0 before 6.7.3, from version 6.8.0 before 6.8.2, from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the post-receive hook. A remote attacker with permission to clone and push files to a repository on the victim's Bitbucket Server or Bitbucket Data Center instance, can exploit this vulnerability to execute arbitrary commands on the Bitbucket Server or Bitbucket Data Center systems, using a file with specially crafted content." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Argument Injection" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://jira.atlassian.com/browse/BSERV-12099", + "refsource": "MISC", + "name": "https://jira.atlassian.com/browse/BSERV-12099" + } + ] + } +} \ No newline at end of file diff --git a/2019/20xxx/CVE-2019-20372.json b/2019/20xxx/CVE-2019-20372.json index 62ac4724e61..9ff16bde2dd 100644 --- a/2019/20xxx/CVE-2019-20372.json +++ b/2019/20xxx/CVE-2019-20372.json @@ -81,6 +81,11 @@ "refsource": "UBUNTU", "name": "USN-4235-1", "url": "https://usn.ubuntu.com/4235-1/" + }, + { + "refsource": "UBUNTU", + "name": "USN-4235-2", + "url": "https://usn.ubuntu.com/4235-2/" } ] }