diff --git a/2023/48xxx/CVE-2023-48799.json b/2023/48xxx/CVE-2023-48799.json index 62488ff438a..88faaa4b16f 100644 --- a/2023/48xxx/CVE-2023-48799.json +++ b/2023/48xxx/CVE-2023-48799.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2023-48799", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2023-48799", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "TOTOLINK-X6000R Firmware-V9.4.0cu.852_B20230719 is vulnerable to Command Execution." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.notion.so/X6000R-632dd667b4574a2c84b04035d04afb5c?pvs=4", + "refsource": "MISC", + "name": "https://www.notion.so/X6000R-632dd667b4574a2c84b04035d04afb5c?pvs=4" + }, + { + "refsource": "MISC", + "name": "https://palm-jump-676.notion.site/CVE-2023-48799-632dd667b4574a2c84b04035d04afb5c", + "url": "https://palm-jump-676.notion.site/CVE-2023-48799-632dd667b4574a2c84b04035d04afb5c" } ] } diff --git a/2023/48xxx/CVE-2023-48800.json b/2023/48xxx/CVE-2023-48800.json index 678f1264ef5..5d6c5abfa53 100644 --- a/2023/48xxx/CVE-2023-48800.json +++ b/2023/48xxx/CVE-2023-48800.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2023-48800", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2023-48800", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_417338 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://www.notion.so/X6000R-sub_417338-ad96548d06c645738daf3ab77575fd74?pvs=4", + "refsource": "MISC", + "name": "https://www.notion.so/X6000R-sub_417338-ad96548d06c645738daf3ab77575fd74?pvs=4" + }, + { + "refsource": "MISC", + "name": "https://palm-jump-676.notion.site/CVE-2023-48800-ad96548d06c645738daf3ab77575fd74", + "url": "https://palm-jump-676.notion.site/CVE-2023-48800-ad96548d06c645738daf3ab77575fd74" } ] } diff --git a/2023/49xxx/CVE-2023-49287.json b/2023/49xxx/CVE-2023-49287.json index c331fa9819d..8ab90060980 100644 --- a/2023/49xxx/CVE-2023-49287.json +++ b/2023/49xxx/CVE-2023-49287.json @@ -72,6 +72,11 @@ "url": "https://github.com/cxong/tinydir/releases/tag/1.2.6", "refsource": "MISC", "name": "https://github.com/cxong/tinydir/releases/tag/1.2.6" + }, + { + "url": "http://www.openwall.com/lists/oss-security/2023/12/04/1", + "refsource": "MISC", + "name": "http://www.openwall.com/lists/oss-security/2023/12/04/1" } ] }, diff --git a/2023/6xxx/CVE-2023-6460.json b/2023/6xxx/CVE-2023-6460.json index 019d671966e..0c687337c01 100644 --- a/2023/6xxx/CVE-2023-6460.json +++ b/2023/6xxx/CVE-2023-6460.json @@ -1,17 +1,88 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-6460", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@google.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version 6.1.0 to avoid this issue" + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-922 Insecure Storage of Sensitive Information", + "cweId": "CWE-922" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Google", + "product": { + "product_data": [ + { + "product_name": "nodejs-firestore", + "version": { + "version_data": [ + { + "version_affected": "<", + "version_name": "0", + "version_value": "6.1.0" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/googleapis/nodejs-firestore/pull/1742", + "refsource": "MISC", + "name": "https://github.com/googleapis/nodejs-firestore/pull/1742" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "HIGH", + "attackVector": "LOCAL", + "availabilityImpact": "NONE", + "baseScore": 4, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N", + "version": "3.1" } ] }