diff --git a/2017/16xxx/CVE-2017-16629.json b/2017/16xxx/CVE-2017-16629.json index b7c131601c0..10c580ffa00 100644 --- a/2017/16xxx/CVE-2017-16629.json +++ b/2017/16xxx/CVE-2017-16629.json @@ -2,7 +2,30 @@ "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-16629", - "STATE": "RESERVED" + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } }, "data_format": "MITRE", "data_type": "CVE", @@ -11,7 +34,33 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In SapphireIMS 4097_1, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login form. For \"Incorrect User\" - it gives an error \"The application failed to identify the user. Please contact administrator for help.\" For \"Correct User and Incorrect Password\" - it gives an error \"Authentication failed. Please login again.\"" + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/2020/07/18/cve-2017-16629-sapphireims-login-page-information-disclosure/", + "url": "https://vuln.shellcoder.party/2020/07/18/cve-2017-16629-sapphireims-login-page-information-disclosure/" + }, + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/tags/sapphireims/", + "url": "https://vuln.shellcoder.party/tags/sapphireims/" } ] } diff --git a/2017/16xxx/CVE-2017-16630.json b/2017/16xxx/CVE-2017-16630.json index a25a215fb33..1cce99b5ceb 100644 --- a/2017/16xxx/CVE-2017-16630.json +++ b/2017/16xxx/CVE-2017-16630.json @@ -2,7 +2,30 @@ "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-16630", - "STATE": "RESERVED" + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } }, "data_format": "MITRE", "data_type": "CVE", @@ -11,7 +34,33 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In SapphireIMS 4097_1, a guest user can create a local administrator account on any system that has SapphireIMS installed, because of an Insecure Direct Object Reference (IDOR) in the local user creation function." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/tags/sapphireims/", + "url": "https://vuln.shellcoder.party/tags/sapphireims/" + }, + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/2020/07/18/cve-2017-16630-sapphireims-idor-based-privilege-elevation/", + "url": "https://vuln.shellcoder.party/2020/07/18/cve-2017-16630-sapphireims-idor-based-privilege-elevation/" } ] } diff --git a/2017/16xxx/CVE-2017-16631.json b/2017/16xxx/CVE-2017-16631.json index 3a460b7c9c4..2760c05d570 100644 --- a/2017/16xxx/CVE-2017-16631.json +++ b/2017/16xxx/CVE-2017-16631.json @@ -2,7 +2,30 @@ "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-16631", - "STATE": "RESERVED" + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } }, "data_format": "MITRE", "data_type": "CVE", @@ -11,7 +34,33 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In SapphireIMS 4097_1, a guest user is able to change the password of an administrative user by utilizing an Insecure Direct Object Reference (IDOR) in the \"Account Password Reset\" functionality." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/tags/sapphireims/", + "url": "https://vuln.shellcoder.party/tags/sapphireims/" + }, + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/2020/07/18/cve-2017-16631-sapphireims-idor-on-password-reset/", + "url": "https://vuln.shellcoder.party/2020/07/18/cve-2017-16631-sapphireims-idor-on-password-reset/" } ] } diff --git a/2017/16xxx/CVE-2017-16632.json b/2017/16xxx/CVE-2017-16632.json index 8c5b78f5542..4d1a05c691c 100644 --- a/2017/16xxx/CVE-2017-16632.json +++ b/2017/16xxx/CVE-2017-16632.json @@ -2,7 +2,30 @@ "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2017-16632", - "STATE": "RESERVED" + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } }, "data_format": "MITRE", "data_type": "CVE", @@ -11,7 +34,33 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In SapphireIMS 4097_1, the password in the database is stored in Base64 format." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/tags/sapphireims/", + "url": "https://vuln.shellcoder.party/tags/sapphireims/" + }, + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/2020/07/18/cve-2017-16632-sapphireims-insecure-storage-of-password/", + "url": "https://vuln.shellcoder.party/2020/07/18/cve-2017-16632-sapphireims-insecure-storage-of-password/" } ] } diff --git a/2020/21xxx/CVE-2020-21359.json b/2020/21xxx/CVE-2020-21359.json index 72bedfd1b27..eef3e7599ff 100644 --- a/2020/21xxx/CVE-2020-21359.json +++ b/2020/21xxx/CVE-2020-21359.json @@ -1,17 +1,61 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-21359", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-21359", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An arbitrary file upload vulnerability in the Template Upload function of Maccms10 allows attackers bypass the suffix whitelist verification to execute arbitrary code via adding a character to the end of the uploaded file's name." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/magicblack/maccms10/issues/80", + "refsource": "MISC", + "name": "https://github.com/magicblack/maccms10/issues/80" } ] } diff --git a/2020/21xxx/CVE-2020-21362.json b/2020/21xxx/CVE-2020-21362.json index 06c94533cd5..96fe18b76e2 100644 --- a/2020/21xxx/CVE-2020-21362.json +++ b/2020/21xxx/CVE-2020-21362.json @@ -1,17 +1,61 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-21362", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-21362", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A cross site scripting (XSS) vulnerability in the background search function of Maccms10 allows attackers to execute arbitrary web scripts or HTML via the 'wd' parameter." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/magicblack/maccms10/issues/78", + "refsource": "MISC", + "name": "https://github.com/magicblack/maccms10/issues/78" } ] } diff --git a/2020/21xxx/CVE-2020-21363.json b/2020/21xxx/CVE-2020-21363.json index ab3d6987352..631a3c29547 100644 --- a/2020/21xxx/CVE-2020-21363.json +++ b/2020/21xxx/CVE-2020-21363.json @@ -1,17 +1,61 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-21363", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-21363", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "An arbitrary file deletion vulnerability exists within Maccms10." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/magicblack/maccms10/issues/79", + "refsource": "MISC", + "name": "https://github.com/magicblack/maccms10/issues/79" } ] } diff --git a/2020/25xxx/CVE-2020-25560.json b/2020/25xxx/CVE-2020-25560.json index 25819c7fff0..cea83172551 100644 --- a/2020/25xxx/CVE-2020-25560.json +++ b/2020/25xxx/CVE-2020-25560.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-25560", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-25560", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: ims) and gain access to the portal. Once the access is available, the attacker can inject malicious OS commands on \u201cping\u201d, \u201ctraceroute\u201d and \u201csnmp\u201d functions and execute code on the server. We also observed the same is true if the JSESSIONID is completely removed." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/tags/sapphireims/", + "url": "https://vuln.shellcoder.party/tags/sapphireims/" + }, + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/2020/09/19/cve-2020-25560-sapphireims-unauthenticated-remote-command-execution-on-server/", + "url": "https://vuln.shellcoder.party/2020/09/19/cve-2020-25560-sapphireims-unauthenticated-remote-command-execution-on-server/" } ] } diff --git a/2020/25xxx/CVE-2020-25561.json b/2020/25xxx/CVE-2020-25561.json index 91c31dd0ab3..438cc146f03 100644 --- a/2020/25xxx/CVE-2020-25561.json +++ b/2020/25xxx/CVE-2020-25561.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-25561", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-25561", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "SapphireIMS 5 utilized default sapphire:ims credentials to connect the client to server. This credential is saved in ServerConf.config file in the client." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/tags/sapphireims/", + "url": "https://vuln.shellcoder.party/tags/sapphireims/" + }, + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/2020/09/19/cve-2020-25561-sapphireims-hardcoded-credentials/", + "url": "https://vuln.shellcoder.party/2020/09/19/cve-2020-25561-sapphireims-hardcoded-credentials/" } ] } diff --git a/2020/25xxx/CVE-2020-25562.json b/2020/25xxx/CVE-2020-25562.json index 7436a0feb2c..412ba96fb11 100644 --- a/2020/25xxx/CVE-2020-25562.json +++ b/2020/25xxx/CVE-2020-25562.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-25562", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-25562", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In SapphireIMS 5.0, there is no CSRF token present in the entire application. This can lead to CSRF vulnerabilities in critical application forms like account resent." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/tags/sapphireims/", + "url": "https://vuln.shellcoder.party/tags/sapphireims/" + }, + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/2020/09/19/cve-2020-25562-sapphireims-csrf/", + "url": "https://vuln.shellcoder.party/2020/09/19/cve-2020-25562-sapphireims-csrf/" } ] } diff --git a/2020/25xxx/CVE-2020-25563.json b/2020/25xxx/CVE-2020-25563.json index 5ec04f2166e..1141650010a 100644 --- a/2020/25xxx/CVE-2020-25563.json +++ b/2020/25xxx/CVE-2020-25563.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-25563", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-25563", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In SapphireIMS 5.0, it is possible to create local administrator on any client without requiring any credentials by directly accessing RemoteMgmtTaskSave (Automation Tasks) feature and not having a JSESSIONID." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/tags/sapphireims/", + "url": "https://vuln.shellcoder.party/tags/sapphireims/" + }, + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/2020/09/19/cve-2020-25563-sapphireims-unauthenticated-remote-command-execution-create-local-admin-on-clients/", + "url": "https://vuln.shellcoder.party/2020/09/19/cve-2020-25563-sapphireims-unauthenticated-remote-command-execution-create-local-admin-on-clients/" } ] } diff --git a/2020/25xxx/CVE-2020-25564.json b/2020/25xxx/CVE-2020-25564.json index bfdc177abcb..171d1a40125 100644 --- a/2020/25xxx/CVE-2020-25564.json +++ b/2020/25xxx/CVE-2020-25564.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-25564", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-25564", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In SapphireIMS 5.0, it is possible to create local administrator on any client with credentials of a non-privileged user by directly accessing RemoteMgmtTaskSave (Automation Tasks) feature." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/tags/sapphireims/", + "url": "https://vuln.shellcoder.party/tags/sapphireims/" + }, + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/2020/09/19/cve-2020-25564-sapphireims-unprivileged-user-remote-command-execution-create-local-admin-on-clients/", + "url": "https://vuln.shellcoder.party/2020/09/19/cve-2020-25564-sapphireims-unprivileged-user-remote-command-execution-create-local-admin-on-clients/" } ] } diff --git a/2020/25xxx/CVE-2020-25565.json b/2020/25xxx/CVE-2020-25565.json index 6f8dab8c02d..3eb6df7c6e5 100644 --- a/2020/25xxx/CVE-2020-25565.json +++ b/2020/25xxx/CVE-2020-25565.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-25565", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-25565", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: ims) and gain access to the portal. Once the access is available, the attacker can inject malicious OS commands on \u201cping\u201d, \u201ctraceroute\u201d and \u201csnmp\u201d functions and execute code on the server." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/tags/sapphireims/", + "url": "https://vuln.shellcoder.party/tags/sapphireims/" + }, + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/2020/09/19/cve-2020-25565-sapphireims-unprivileged-user-remote-command-execution-on-server/", + "url": "https://vuln.shellcoder.party/2020/09/19/cve-2020-25565-sapphireims-unprivileged-user-remote-command-execution-on-server/" } ] } diff --git a/2020/25xxx/CVE-2020-25566.json b/2020/25xxx/CVE-2020-25566.json index 498a92307c5..f8e28c39808 100644 --- a/2020/25xxx/CVE-2020-25566.json +++ b/2020/25xxx/CVE-2020-25566.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-25566", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-25566", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In SapphireIMS 5.0, it is possible to take over an account by sending a request to the Save_Password form as shown in POC. Notice that we do not require a JSESSIONID in this request and can reset any user\u2019s password by changing the username to that user and password to base64(desired password)." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/tags/sapphireims/", + "url": "https://vuln.shellcoder.party/tags/sapphireims/" + }, + { + "refsource": "MISC", + "name": "https://vuln.shellcoder.party/2020/09/19/cve-2020-25566-sapphireims-unauthenticated-account-takeover/", + "url": "https://vuln.shellcoder.party/2020/09/19/cve-2020-25566-sapphireims-unauthenticated-account-takeover/" } ] } diff --git a/2021/22xxx/CVE-2021-22098.json b/2021/22xxx/CVE-2021-22098.json index d6f64d3d473..b27b6c00830 100644 --- a/2021/22xxx/CVE-2021-22098.json +++ b/2021/22xxx/CVE-2021-22098.json @@ -4,14 +4,58 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2021-22098", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@vmware.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "UAA server", + "version": { + "version_data": [ + { + "version_value": "Cloud Foundry UAA server prior to version 75.4.0" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-601: URL Redirection to Untrusted Site" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://www.cloudfoundry.org/blog/cve-2021-22098-open-redirect-vulnerability-in-uaa-server/", + "url": "https://www.cloudfoundry.org/blog/cve-2021-22098-open-redirect-vulnerability-in-uaa-server/" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious user can exploit the open redirect vulnerability by social engineering leading to take over of victims\u2019 accounts in certain cases along with redirection of UAA users to a malicious sites." } ] }