mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-05-06 18:53:08 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
64b7d86214
commit
9ca1cf521a
@ -1,7 +1,7 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@amd.com",
|
||||
"DATE_PUBLIC": "2021-11-09T20:00:00.000Z",
|
||||
"DATE_PUBLIC": "2022-05-10T20:00:00.000Z",
|
||||
"ID": "CVE-2021-26312",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
@ -12,34 +12,34 @@
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "1st Gen AMD EPYC\u2122",
|
||||
"product_name": " EPYC\u2122 Processors ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_value": "NaplesPI-SP3_1.0.0.G"
|
||||
"version_affected": "=",
|
||||
"version_value": "various "
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "2nd Gen AMD EPYC\u2122",
|
||||
"product_name": "Ryzen\u2122 Series ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_value": "RomePI-SP3_1.0.0.C"
|
||||
"version_affected": "=",
|
||||
"version_value": "various"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "3rd Gen AMD EPYC\u2122",
|
||||
"product_name": " Athlon\u2122 Series ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_value": "MilanPI-SP3_1.0.0.4"
|
||||
"version_affected": "=",
|
||||
"version_value": "various"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -58,7 +58,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "PSP protection against improperly configured side channels may lead to potential information disclosure. This issue affects: AMD 1st Gen AMD EPYC\u2122 versions prior to NaplesPI-SP3_1.0.0.G. AMD 2nd Gen AMD EPYC\u2122 versions prior to RomePI-SP3_1.0.0.C. AMD 3rd Gen AMD EPYC\u2122 versions prior to MilanPI-SP3_1.0.0.4."
|
||||
"value": "Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -71,7 +71,7 @@
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-667 Improper Locking"
|
||||
"value": "CWE-665 Improper Initialization"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -81,13 +81,18 @@
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1021",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1021"
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "AMD-SB-1021",
|
||||
"advisory": "AMD-SB-1027 and AMD-SB-1028",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,98 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@amd.com",
|
||||
"DATE_PUBLIC": "2022-05-10T20:00:00.000Z",
|
||||
"ID": "CVE-2021-26339",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": " EPYC\u2122 Processors ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various "
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Ryzen\u2122 Series ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": " Athlon\u2122 Series ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AMD"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A bug in AMD CPU\u2019s core logic may allow for an attacker, using specific code from an unprivileged VM, to trigger a CPU core hang resulting in a potential denial of service. AMD believes the specific code includes a specific x86 instruction sequence that would not be generated by compilers."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "tbd"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "AMD-SB-1027 and AMD-SB-1028",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,71 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@amd.com",
|
||||
"DATE_PUBLIC": "2022-05-10T20:00:00.000Z",
|
||||
"ID": "CVE-2021-26342",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": " EPYC\u2122 Processors ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various "
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AMD"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "In SEV guest VMs, the CPU may fail to flush the Translation Lookaside Buffer (TLB) following a particular sequence of operations that includes creation of a new virtual machine control block (VMCB). The failure to flush the TLB may cause the microcode to use stale TLB translations which may allow for disclosure of SEV guest memory contents. Users of SEV-ES/SEV-SNP guest VMs are not impacted by this vulnerability."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "tbd"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": " AMD-SB-1028",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,71 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@amd.com",
|
||||
"DATE_PUBLIC": "2022-05-10T20:00:00.000Z",
|
||||
"ID": "CVE-2021-26347",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": " EPYC\u2122 Processors ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various "
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AMD"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "TOCTOU (time-of-check to time-of-use) issue in the System Management Unit (SMU) may result in a DMA (Direct Memory Access) to invalid DRAM address that could result in denial of service."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "tbd"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "AMD-SB-1028",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,71 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@amd.com",
|
||||
"DATE_PUBLIC": "2022-05-10T20:00:00.000Z",
|
||||
"ID": "CVE-2021-26348",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": " EPYC\u2122 Processors ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various "
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AMD"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Failure to flush the Translation Lookaside Buffer (TLB) of the I/O memory management unit (IOMMU) may lead an IO device to write to memory it should not be able to access, resulting in a potential loss of integrity."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "tbd"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "AMD-SB-1028",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,71 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@amd.com",
|
||||
"DATE_PUBLIC": "2022-05-10T20:00:00.000Z",
|
||||
"ID": "CVE-2021-26349",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": " EPYC\u2122 Processors ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various "
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AMD"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Failure to assign a new report ID to an imported guest may potentially result in an SEV-SNP guest VM being tricked into trusting a dishonest Migration Agent (MA)."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "tbd"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "AMD-SB-1028",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,71 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@amd.com",
|
||||
"DATE_PUBLIC": "2022-05-10T20:00:00.000Z",
|
||||
"ID": "CVE-2021-26350",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": " EPYC\u2122 Processors ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various "
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AMD"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A TOCTOU race condition in SMU may allow for the caller to obtain and manipulate the address of a message port register which may result in a potential denial of service."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "tbd"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "AMD-SB-1028",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,71 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@amd.com",
|
||||
"DATE_PUBLIC": "2022-05-10T20:00:00.000Z",
|
||||
"ID": "CVE-2021-26364",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": " EPYC\u2122 Processors ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various "
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AMD"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Insufficient bounds checking in an SMU mailbox register could allow an attacker to potentially read outside of the SRAM address range which could result in an exception handling leading to a potential denial of service."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "tbd"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "AMD-SB-1028",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,98 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@amd.com",
|
||||
"DATE_PUBLIC": "2022-05-10T20:00:00.000Z",
|
||||
"ID": "CVE-2021-26372",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": " EPYC\u2122 Processors ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various "
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Ryzen\u2122 Series ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": " Athlon\u2122 Series ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AMD"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Insufficient bound checks related to PCIE in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "tbd"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "AMD-SB-1027 and AMD-SB-1028",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,98 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@amd.com",
|
||||
"DATE_PUBLIC": "2022-05-10T20:00:00.000Z",
|
||||
"ID": "CVE-2021-26373",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": " EPYC\u2122 Processors ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various "
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Ryzen\u2122 Series ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": " Athlon\u2122 Series ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AMD"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Insufficient bound checks in the System Management Unit (SMU) may result in a system voltage malfunction that could result in denial of resources and/or possibly denial of service."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "tbd"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "AMD-SB-1027 and AMD-SB-1028",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,98 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@amd.com",
|
||||
"DATE_PUBLIC": "2022-05-10T20:00:00.000Z",
|
||||
"ID": "CVE-2021-26375",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": " EPYC\u2122 Processors ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various "
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Ryzen\u2122 Series ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": " Athlon\u2122 Series ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AMD"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Insufficient General Purpose IO (GPIO) bounds check in System Management Unit (SMU) may result in access/updates from/to invalid address space that could result in denial of service."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "tbd"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "AMD-SB-1027 and AMD-SB-1028",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,98 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@amd.com",
|
||||
"DATE_PUBLIC": "2022-05-10T20:00:00.000Z",
|
||||
"ID": "CVE-2021-26376",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": " EPYC\u2122 Processors ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various "
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Ryzen\u2122 Series ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": " Athlon\u2122 Series ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AMD"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Insufficient checks in System Management Unit (SMU) FeatureConfig may result in reenabling features potentially resulting in denial of resources and/or denial of service."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "tbd"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "AMD-SB-1027 and AMD-SB-1028",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,98 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@amd.com",
|
||||
"DATE_PUBLIC": "2022-05-10T20:00:00.000Z",
|
||||
"ID": "CVE-2021-26378",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": " EPYC\u2122 Processors ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various "
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Ryzen\u2122 Series ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": " Athlon\u2122 Series ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AMD"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Insufficient bound checks in the System Management Unit (SMU) may result in access to an invalid address space that could result in denial of service."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "tbd"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "AMD-SB-1027 and AMD-SB-1028",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,98 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@amd.com",
|
||||
"DATE_PUBLIC": "2022-05-10T20:00:00.000Z",
|
||||
"ID": "CVE-2021-26388",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": " EPYC\u2122 Processors ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various "
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "Ryzen\u2122 Series ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": " Athlon\u2122 Series ",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "various"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AMD"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Improper validation of the BIOS directory may allow for searches to read beyond the directory table copy in RAM, exposing out of bounds memory contents, resulting in a potential denial of service."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "tbd"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "AMD-SB-1027 and AMD-SB-1028",
|
||||
"discovery": "UNKNOWN"
|
||||
}
|
||||
}
|
||||
@ -1,18 +1,71 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@amd.com",
|
||||
"DATE_PUBLIC": "2022-05-10T20:30:00.000Z",
|
||||
"ID": "CVE-2021-26400",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "AMD Processors",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_name": "Processor ",
|
||||
"version_value": "All Supported Processors"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AMD"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "AMD processors may speculatively re-order load instructions which can result in stale data being observed when multiple processors are operating on shared memory, resulting in potential data leakage."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "NA"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1035",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1035"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
@ -4,14 +4,58 @@
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2021-30361",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cve@checkpoint.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "n/a",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Check Point Gaia Portal",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "before Jumbo HFAs released 13-Apr-2022"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://supportcontent.checkpoint.com/solutions?id=sk179128",
|
||||
"url": "https://supportcontent.checkpoint.com/solutions?id=sk179128"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "The Check Point Gaia Portal's GUI Clients allowed authenticated administrators with permission for the GUI Clients settings to inject a command that would run on the Gaia OS."
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,96 +1,96 @@
|
||||
{
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"value" : "Denial of Service",
|
||||
"lang" : "eng"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"data_version" : "4.0",
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"vendor_name" : "IBM",
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "8.4"
|
||||
},
|
||||
{
|
||||
"version_value" : "8.3"
|
||||
},
|
||||
{
|
||||
"version_value" : "8.2"
|
||||
}
|
||||
]
|
||||
},
|
||||
"product_name" : "Spectrum Virtualize"
|
||||
}
|
||||
]
|
||||
}
|
||||
"description": [
|
||||
{
|
||||
"value": "Denial of Service",
|
||||
"lang": "eng"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"CVE_data_meta" : {
|
||||
"DATE_PUBLIC" : "2022-05-10T00:00:00",
|
||||
"ID" : "CVE-2021-38969",
|
||||
"STATE" : "PUBLIC",
|
||||
"ASSIGNER" : "psirt@us.ibm.com"
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"refsource" : "CONFIRM",
|
||||
"name" : "https://www.ibm.com/support/pages/node/6584337",
|
||||
"url" : "https://www.ibm.com/support/pages/node/6584337",
|
||||
"title" : "IBM Security Bulletin 6584337 (Spectrum Virtualize)"
|
||||
},
|
||||
{
|
||||
"name" : "ibm-spectrum-cve202138969-auth (212609)",
|
||||
"refsource" : "XF",
|
||||
"title" : "X-Force Vulnerability Report",
|
||||
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/212609"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"value" : "IBM Spectrum Virtualize 8.2, 8.3, and 8.4 could allow an attacker to allow unauthorized access due to the reuse of support generated credentials. IBM X-Force ID: 212609.",
|
||||
"lang" : "eng"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_type" : "CVE",
|
||||
"impact" : {
|
||||
"cvssv3" : {
|
||||
"TM" : {
|
||||
"RL" : "O",
|
||||
"RC" : "C",
|
||||
"E" : "U"
|
||||
},
|
||||
"BM" : {
|
||||
"UI" : "N",
|
||||
"S" : "U",
|
||||
"A" : "L",
|
||||
"AC" : "H",
|
||||
"SCORE" : "5.600",
|
||||
"I" : "L",
|
||||
"PR" : "N",
|
||||
"AV" : "N",
|
||||
"C" : "L"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "IBM",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "8.4"
|
||||
},
|
||||
{
|
||||
"version_value": "8.3"
|
||||
},
|
||||
{
|
||||
"version_value": "8.2"
|
||||
}
|
||||
]
|
||||
},
|
||||
"product_name": "Spectrum Virtualize"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"CVE_data_meta": {
|
||||
"DATE_PUBLIC": "2022-05-10T00:00:00",
|
||||
"ID": "CVE-2021-38969",
|
||||
"STATE": "PUBLIC",
|
||||
"ASSIGNER": "psirt@us.ibm.com"
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"name": "https://www.ibm.com/support/pages/node/6584337",
|
||||
"url": "https://www.ibm.com/support/pages/node/6584337",
|
||||
"title": "IBM Security Bulletin 6584337 (Spectrum Virtualize)"
|
||||
},
|
||||
{
|
||||
"name": "ibm-spectrum-cve202138969-auth (212609)",
|
||||
"refsource": "XF",
|
||||
"title": "X-Force Vulnerability Report",
|
||||
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/212609"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"value": "IBM Spectrum Virtualize 8.2, 8.3, and 8.4 could allow an attacker to allow unauthorized access due to the reuse of support generated credentials. IBM X-Force ID: 212609.",
|
||||
"lang": "eng"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_type": "CVE",
|
||||
"impact": {
|
||||
"cvssv3": {
|
||||
"TM": {
|
||||
"RL": "O",
|
||||
"RC": "C",
|
||||
"E": "U"
|
||||
},
|
||||
"BM": {
|
||||
"UI": "N",
|
||||
"S": "U",
|
||||
"A": "L",
|
||||
"AC": "H",
|
||||
"SCORE": "5.600",
|
||||
"I": "L",
|
||||
"PR": "N",
|
||||
"AV": "N",
|
||||
"C": "L"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -1,102 +1,102 @@
|
||||
{
|
||||
"data_type" : "CVE",
|
||||
"impact" : {
|
||||
"cvssv3" : {
|
||||
"TM" : {
|
||||
"RC" : "C",
|
||||
"E" : "H",
|
||||
"RL" : "O"
|
||||
},
|
||||
"BM" : {
|
||||
"C" : "L",
|
||||
"AV" : "N",
|
||||
"I" : "L",
|
||||
"PR" : "L",
|
||||
"S" : "C",
|
||||
"AC" : "L",
|
||||
"A" : "N",
|
||||
"UI" : "R",
|
||||
"SCORE" : "5.400"
|
||||
}
|
||||
}
|
||||
},
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"value" : "IBM Jazz Foundation (IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2)\r\nis vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 214619.",
|
||||
"lang" : "eng"
|
||||
}
|
||||
]
|
||||
},
|
||||
"CVE_data_meta" : {
|
||||
"DATE_PUBLIC" : "2022-05-10T00:00:00",
|
||||
"ID" : "CVE-2021-39059",
|
||||
"ASSIGNER" : "psirt@us.ibm.com",
|
||||
"STATE" : "PUBLIC"
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://www.ibm.com/support/pages/node/6584347",
|
||||
"refsource" : "CONFIRM",
|
||||
"title" : "IBM Security Bulletin 6584347 (Jazz Team Server)",
|
||||
"url" : "https://www.ibm.com/support/pages/node/6584347"
|
||||
},
|
||||
{
|
||||
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/214619",
|
||||
"title" : "X-Force Vulnerability Report",
|
||||
"refsource" : "XF",
|
||||
"name" : "ibm-jazz-cve202139059-xss (214619)"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_version" : "4.0",
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"vendor_name" : "IBM",
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "Jazz Team Server",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "6.0.6"
|
||||
},
|
||||
{
|
||||
"version_value" : "6.0.6.1"
|
||||
},
|
||||
{
|
||||
"version_value" : "7.0"
|
||||
},
|
||||
{
|
||||
"version_value" : "7.0.1"
|
||||
},
|
||||
{
|
||||
"version_value" : "7.0.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
"data_type": "CVE",
|
||||
"impact": {
|
||||
"cvssv3": {
|
||||
"TM": {
|
||||
"RC": "C",
|
||||
"E": "H",
|
||||
"RL": "O"
|
||||
},
|
||||
"BM": {
|
||||
"C": "L",
|
||||
"AV": "N",
|
||||
"I": "L",
|
||||
"PR": "L",
|
||||
"S": "C",
|
||||
"AC": "L",
|
||||
"A": "N",
|
||||
"UI": "R",
|
||||
"SCORE": "5.400"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "Cross-Site Scripting"
|
||||
}
|
||||
}
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"value": "IBM Jazz Foundation (IBM Jazz Team Server 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 214619.",
|
||||
"lang": "eng"
|
||||
}
|
||||
]
|
||||
},
|
||||
"CVE_data_meta": {
|
||||
"DATE_PUBLIC": "2022-05-10T00:00:00",
|
||||
"ID": "CVE-2021-39059",
|
||||
"ASSIGNER": "psirt@us.ibm.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://www.ibm.com/support/pages/node/6584347",
|
||||
"refsource": "CONFIRM",
|
||||
"title": "IBM Security Bulletin 6584347 (Jazz Team Server)",
|
||||
"url": "https://www.ibm.com/support/pages/node/6584347"
|
||||
},
|
||||
{
|
||||
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/214619",
|
||||
"title": "X-Force Vulnerability Report",
|
||||
"refsource": "XF",
|
||||
"name": "ibm-jazz-cve202139059-xss (214619)"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_version": "4.0",
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "IBM",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Jazz Team Server",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "6.0.6"
|
||||
},
|
||||
{
|
||||
"version_value": "6.0.6.1"
|
||||
},
|
||||
{
|
||||
"version_value": "7.0"
|
||||
},
|
||||
{
|
||||
"version_value": "7.0.1"
|
||||
},
|
||||
{
|
||||
"version_value": "7.0.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Cross-Site Scripting"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@ -43,7 +43,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges."
|
||||
"value": "The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn\u2019t mimic the permissions of the JVM being patched, allowing it to escalate privileges."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -81,16 +81,19 @@
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://alas.aws.amazon.com/AL2/ALAS-2021-1732.html"
|
||||
"refsource": "MISC",
|
||||
"url": "https://alas.aws.amazon.com/AL2/ALAS-2021-1732.html",
|
||||
"name": "https://alas.aws.amazon.com/AL2/ALAS-2021-1732.html"
|
||||
},
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://alas.aws.amazon.com/ALAS-2021-1554.html"
|
||||
"refsource": "MISC",
|
||||
"url": "https://alas.aws.amazon.com/ALAS-2021-1554.html",
|
||||
"name": "https://alas.aws.amazon.com/ALAS-2021-1554.html"
|
||||
},
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities"
|
||||
"refsource": "MISC",
|
||||
"url": "https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities",
|
||||
"name": "https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -1,18 +1,71 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "psirt@amd.com",
|
||||
"DATE_PUBLIC": "2022-05-10T20:30:00.000Z",
|
||||
"ID": "CVE-2021-46744",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "AMD Processors",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_name": "Processor ",
|
||||
"version_value": "EPYC "
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AMD"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An attacker with access to a malicious hypervisor may be able to infer data values used in a SEV guest on AMD CPUs by monitoring ciphertext values over time."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "NA"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1033",
|
||||
"name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1033"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
@ -94,7 +94,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committed on both hardware and virtual firewalls.\n\nThis issue does not impact Panorama appliances or Prisma Access customers.\nThis issue impacts:\nPAN-OS 8.1 versions earlier than PAN-OS 8.1.23;\nPAN-OS 9.0 versions earlier than PAN-OS 9.0.16;\nPAN-OS 9.1 versions earlier than PAN-OS 9.1.13;\nPAN-OS 10.0 versions earlier than PAN-OS 10.0.10;\nPAN-OS 10.1 versions earlier than PAN-OS 10.1.5.\n"
|
||||
"value": "A vulnerability exists in Palo Alto Networks PAN-OS software that enables an authenticated network-based PAN-OS administrator to upload a specifically created configuration that disrupts system processes and potentially execute arbitrary code with root privileges when the configuration is committed on both hardware and virtual firewalls. This issue does not impact Panorama appliances or Prisma Access customers. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.23; PAN-OS 9.0 versions earlier than PAN-OS 9.0.16; PAN-OS 9.1 versions earlier than PAN-OS 9.1.13; PAN-OS 10.0 versions earlier than PAN-OS 10.0.10; PAN-OS 10.1 versions earlier than PAN-OS 10.1.5."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -138,8 +138,9 @@
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2022-0024"
|
||||
"refsource": "MISC",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2022-0024",
|
||||
"name": "https://security.paloaltonetworks.com/CVE-2022-0024"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -86,7 +86,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\\) to execute a program with elevated privileges.\n\nThis issue impacts:\nAll versions of the Cortex XDR agent when upgrading to Cortex XDR agent 7.7.0 on Windows;\nCortex XDR agent 7.7.0 without content update 500 or a later version on Windows.\n\nThis issue does not impact other platforms or other versions of the Cortex XDR agent."
|
||||
"value": "A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\\) to execute a program with elevated privileges. This issue impacts: All versions of the Cortex XDR agent when upgrading to Cortex XDR agent 7.7.0 on Windows; Cortex XDR agent 7.7.0 without content update 500 or a later version on Windows. This issue does not impact other platforms or other versions of the Cortex XDR agent."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -130,8 +130,9 @@
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2022-0025"
|
||||
"refsource": "MISC",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2022-0025",
|
||||
"name": "https://security.paloaltonetworks.com/CVE-2022-0025"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -111,7 +111,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\\) to execute a program with elevated privileges.\n\nThis issue impacts all versions of Cortex XDR agent without content update 330 or a later content update version."
|
||||
"value": "A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with file creation privilege in the Windows root directory (such as C:\\) to execute a program with elevated privileges. This issue impacts all versions of Cortex XDR agent without content update 330 or a later content update version."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -155,8 +155,9 @@
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2022-0026"
|
||||
"refsource": "MISC",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2022-0026",
|
||||
"name": "https://security.paloaltonetworks.com/CVE-2022-0026"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -64,7 +64,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "An improper authorization vulnerability in Palo Alto Network Cortex XSOAR software enables authenticated users in non-Read-Only groups to generate an email report that contains summary information about all incidents in the Cortex XSOAR instance, including incidents to which the user does not have access.\nThis issue impacts:\nAll versions of Cortex XSOAR 6.1;\nAll versions of Cortex XSOAR 6.2;\nAll versions of Cortex XSOAR 6.5;\nCortex XSOAR 6.6 versions earlier than Cortex XSOAR 6.6.0 build 6.6.0.2585049.\n"
|
||||
"value": "An improper authorization vulnerability in Palo Alto Network Cortex XSOAR software enables authenticated users in non-Read-Only groups to generate an email report that contains summary information about all incidents in the Cortex XSOAR instance, including incidents to which the user does not have access. This issue impacts: All versions of Cortex XSOAR 6.1; All versions of Cortex XSOAR 6.2; All versions of Cortex XSOAR 6.5; Cortex XSOAR 6.6 versions earlier than Cortex XSOAR 6.6.0 build 6.6.0.2585049."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -108,8 +108,9 @@
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2022-0027"
|
||||
"refsource": "MISC",
|
||||
"url": "https://security.paloaltonetworks.com/CVE-2022-0027",
|
||||
"name": "https://security.paloaltonetworks.com/CVE-2022-0027"
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -1,93 +1,93 @@
|
||||
{
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 218367."
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_type" : "CVE",
|
||||
"impact" : {
|
||||
"cvssv3" : {
|
||||
"TM" : {
|
||||
"RC" : "C",
|
||||
"E" : "H",
|
||||
"RL" : "O"
|
||||
},
|
||||
"BM" : {
|
||||
"SCORE" : "4.800",
|
||||
"S" : "C",
|
||||
"A" : "N",
|
||||
"AC" : "L",
|
||||
"UI" : "R",
|
||||
"PR" : "H",
|
||||
"I" : "L",
|
||||
"AV" : "N",
|
||||
"C" : "L"
|
||||
}
|
||||
}
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"value" : "Cross-Site Scripting",
|
||||
"lang" : "eng"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "QRadar SIEM",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "7.3"
|
||||
},
|
||||
{
|
||||
"version_value" : "7.4"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "IBM"
|
||||
"lang": "eng",
|
||||
"value": "IBM QRadar SIEM 7.3 and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 218367."
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_version" : "4.0",
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"url" : "https://www.ibm.com/support/pages/node/6584451",
|
||||
"title" : "IBM Security Bulletin 6584451 (QRadar SIEM)",
|
||||
"refsource" : "CONFIRM",
|
||||
"name" : "https://www.ibm.com/support/pages/node/6584451"
|
||||
},
|
||||
{
|
||||
"refsource" : "XF",
|
||||
"name" : "ibm-qradar-cve202222320-xss (218367)",
|
||||
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/218367",
|
||||
"title" : "X-Force Vulnerability Report"
|
||||
}
|
||||
]
|
||||
},
|
||||
"CVE_data_meta" : {
|
||||
"STATE" : "PUBLIC",
|
||||
"ASSIGNER" : "psirt@us.ibm.com",
|
||||
"DATE_PUBLIC" : "2022-05-10T00:00:00",
|
||||
"ID" : "CVE-2022-22320"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_type": "CVE",
|
||||
"impact": {
|
||||
"cvssv3": {
|
||||
"TM": {
|
||||
"RC": "C",
|
||||
"E": "H",
|
||||
"RL": "O"
|
||||
},
|
||||
"BM": {
|
||||
"SCORE": "4.800",
|
||||
"S": "C",
|
||||
"A": "N",
|
||||
"AC": "L",
|
||||
"UI": "R",
|
||||
"PR": "H",
|
||||
"I": "L",
|
||||
"AV": "N",
|
||||
"C": "L"
|
||||
}
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"value": "Cross-Site Scripting",
|
||||
"lang": "eng"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "QRadar SIEM",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "7.3"
|
||||
},
|
||||
{
|
||||
"version_value": "7.4"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "IBM"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_version": "4.0",
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/6584451",
|
||||
"title": "IBM Security Bulletin 6584451 (QRadar SIEM)",
|
||||
"refsource": "CONFIRM",
|
||||
"name": "https://www.ibm.com/support/pages/node/6584451"
|
||||
},
|
||||
{
|
||||
"refsource": "XF",
|
||||
"name": "ibm-qradar-cve202222320-xss (218367)",
|
||||
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/218367",
|
||||
"title": "X-Force Vulnerability Report"
|
||||
}
|
||||
]
|
||||
},
|
||||
"CVE_data_meta": {
|
||||
"STATE": "PUBLIC",
|
||||
"ASSIGNER": "psirt@us.ibm.com",
|
||||
"DATE_PUBLIC": "2022-05-10T00:00:00",
|
||||
"ID": "CVE-2022-22320"
|
||||
}
|
||||
}
|
||||
18
2022/30xxx/CVE-2022-30552.json
Normal file
18
2022/30xxx/CVE-2022-30552.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2022-30552",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user