mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-05-07 11:06:39 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
64d0c2937f
commit
a063497ac2
@ -161,6 +161,6 @@
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "bippy-e0c11145c45e"
|
||||
"engine": "bippy-851b3ed3d212"
|
||||
}
|
||||
}
|
||||
@ -40,27 +40,27 @@
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "a4add022c155",
|
||||
"version_name": "0713aa02f20d",
|
||||
"version_value": "62bb2c7f2411"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "0870525cf94b",
|
||||
"version_name": "2be1837b1737",
|
||||
"version_value": "8bf96425c90f"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "8c45a1c6c951",
|
||||
"version_name": "e620a73d7ca7",
|
||||
"version_value": "8e029707f50a"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "234b432c7b61",
|
||||
"version_name": "c886774bf583",
|
||||
"version_value": "28a5529068c5"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "3e04a4976add",
|
||||
"version_name": "2737549129ec",
|
||||
"version_value": "001c8e83646a"
|
||||
},
|
||||
{
|
||||
@ -199,6 +199,6 @@
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "bippy-5f0117140d9a"
|
||||
"engine": "bippy-851b3ed3d212"
|
||||
}
|
||||
}
|
||||
@ -40,12 +40,12 @@
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "ae03b6b1c880",
|
||||
"version_name": "12462c88e6e2",
|
||||
"version_value": "4d542ddb88fb"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "f92a819b4cbe",
|
||||
"version_name": "eed84f94ff8d",
|
||||
"version_value": "0e2dfdc74a7f"
|
||||
},
|
||||
{
|
||||
@ -162,6 +162,6 @@
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "bippy-5f0117140d9a"
|
||||
"engine": "bippy-851b3ed3d212"
|
||||
}
|
||||
}
|
||||
@ -40,17 +40,17 @@
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "5b654b030079",
|
||||
"version_name": "1b8dd2d64ea9",
|
||||
"version_value": "2dc1554d5f0f"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "480c5e9c7e4c",
|
||||
"version_name": "6f484096196b",
|
||||
"version_value": "d8897f7b2283"
|
||||
},
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "c9698380b01a",
|
||||
"version_name": "75e5e51acf59",
|
||||
"version_value": "eb949f891226"
|
||||
},
|
||||
{
|
||||
@ -156,6 +156,6 @@
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "bippy-5f0117140d9a"
|
||||
"engine": "bippy-851b3ed3d212"
|
||||
}
|
||||
}
|
||||
@ -57,16 +57,6 @@
|
||||
"version_value": "not down converted",
|
||||
"x_cve_json_5_version_data": {
|
||||
"versions": [
|
||||
{
|
||||
"version": "5.19",
|
||||
"status": "affected"
|
||||
},
|
||||
{
|
||||
"version": "0",
|
||||
"lessThan": "5.19",
|
||||
"status": "unaffected",
|
||||
"versionType": "custom"
|
||||
},
|
||||
{
|
||||
"version": "5.10.214",
|
||||
"lessThanOrEqual": "5.10.*",
|
||||
@ -162,6 +152,6 @@
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "bippy-851b3ed3d212"
|
||||
"engine": "bippy-e0c11145c45e"
|
||||
}
|
||||
}
|
||||
@ -11,7 +11,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phish the victim by tricking them into initiating a request within their browser."
|
||||
"value": "In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub in the Splunk Dashboard Studio app lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phish the victim by tricking them into initiating a request within their browser."
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -64,7 +64,7 @@
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "-",
|
||||
"version_value": "9.1.2312.104"
|
||||
"version_value": "9.1.2312.200"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,117 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-3270",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@vuldb.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2. This vulnerability affects unknown code of the component AdvancedFeature. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259282 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure and replied to be planning to fix this issue in version 3.7."
|
||||
},
|
||||
{
|
||||
"lang": "deu",
|
||||
"value": "In ThingsBoard bis 3.6.2 wurde eine Schwachstelle entdeckt. Sie wurde als problematisch eingestuft. Betroffen ist eine unbekannte Verarbeitung der Komponente AdvancedFeature. Dank Manipulation mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-284 Improper Access Controls",
|
||||
"cweId": "CWE-284"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "n/a",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "ThingsBoard",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "3.6.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "3.6.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "3.6.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://vuldb.com/?id.259282",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?id.259282"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?ctiid.259282",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?ctiid.259282"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?submit.301359",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?submit.301359"
|
||||
},
|
||||
{
|
||||
"url": "https://drive.google.com/file/d/1w9iSMpyKDuapH9wjsgTe8AYPn8Z30u2Z/view?usp=drive_link",
|
||||
"refsource": "MISC",
|
||||
"name": "https://drive.google.com/file/d/1w9iSMpyKDuapH9wjsgTe8AYPn8Z30u2Z/view?usp=drive_link"
|
||||
}
|
||||
]
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "sickuritywizard (VulDB User)"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"baseScore": 3.8,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
|
||||
"baseSeverity": "LOW"
|
||||
},
|
||||
{
|
||||
"version": "3.0",
|
||||
"baseScore": 3.8,
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
|
||||
"baseSeverity": "LOW"
|
||||
},
|
||||
{
|
||||
"version": "2.0",
|
||||
"baseScore": 4.7,
|
||||
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:P"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,71 +1,18 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-3281",
|
||||
"ASSIGNER": "hp-security-alert@hp.com",
|
||||
"STATE": "PUBLIC"
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A vulnerability was discovered in the firmware builds after 8.0.2.3267 and prior to 8.1.3.1301 in CCX devices. A flaw in the firmware build process did not properly restrict access to a resource from an unauthorized actor."
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "HP Inc.",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Poly CCX devices",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "See HP Security Bulletin reference for affected versions."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://support.hp.com/us-en/document/ish_10388650-10388701-16/hpsbpy03929",
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.hp.com/us-en/document/ish_10388650-10388701-16/hpsbpy03929"
|
||||
},
|
||||
{
|
||||
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-003.txt",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-003.txt"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "cveClient/1.0.15"
|
||||
}
|
||||
}
|
||||
@ -1,91 +1,17 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-3283",
|
||||
"ASSIGNER": "security@huntr.com",
|
||||
"STATE": "PUBLIC"
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A vulnerability in mintplex-labs/anything-llm allows users with manager roles to escalate their privileges to admin roles through a mass assignment issue. The '/admin/system-preferences' API endpoint improperly authorizes manager-level users to modify the 'multi_user_mode' system variable, enabling them to access the '/api/system/enable-multi-user' endpoint and create a new admin user. This issue results from the endpoint accepting a full JSON object in the request body without proper validation of modifiable fields, leading to unauthorized modification of system settings and subsequent privilege escalation."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
|
||||
"cweId": "CWE-915"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "mintplex-labs",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "mintplex-labs/anything-llm",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "unspecified",
|
||||
"version_value": "1.0.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://huntr.com/bounties/a8000cce-0ecb-4820-9cfb-57ba6f4d58a2",
|
||||
"refsource": "MISC",
|
||||
"name": "https://huntr.com/bounties/a8000cce-0ecb-4820-9cfb-57ba6f4d58a2"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "a8000cce-0ecb-4820-9cfb-57ba6f4d58a2",
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.0",
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||
"baseScore": 7.2,
|
||||
"baseSeverity": "HIGH"
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,126 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-3311",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "cna@vuldb.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "A vulnerability was found in Dreamer CMS up to 4.1.3.0. It has been declared as critical. Affected by this vulnerability is the function ZipUtils.unZipFiles of the file controller/admin/ThemesController.java. The manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.3.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-259369 was assigned to this vulnerability."
|
||||
},
|
||||
{
|
||||
"lang": "deu",
|
||||
"value": "In Dreamer CMS bis 4.1.3.0 wurde eine kritische Schwachstelle ausgemacht. Hierbei betrifft es die Funktion ZipUtils.unZipFiles der Datei controller/admin/ThemesController.java. Dank der Manipulation mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Ein Aktualisieren auf die Version 4.1.3.1 vermag dieses Problem zu l\u00f6sen. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-22 Path Traversal",
|
||||
"cweId": "CWE-22"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "Dreamer",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "CMS",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "4.1.0"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "4.1.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "4.1.2"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "4.1.3"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://vuldb.com/?id.259369",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?id.259369"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?ctiid.259369",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?ctiid.259369"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?submit.303874",
|
||||
"refsource": "MISC",
|
||||
"name": "https://vuldb.com/?submit.303874"
|
||||
},
|
||||
{
|
||||
"url": "https://gitee.com/y1336247431/poc-public/issues/I9BA5R",
|
||||
"refsource": "MISC",
|
||||
"name": "https://gitee.com/y1336247431/poc-public/issues/I9BA5R"
|
||||
},
|
||||
{
|
||||
"url": "https://gitee.com/iteachyou/dreamer_cms/releases/tag/Latest_Stable_Release_4.1.3.1",
|
||||
"refsource": "MISC",
|
||||
"name": "https://gitee.com/iteachyou/dreamer_cms/releases/tag/Latest_Stable_Release_4.1.3.1"
|
||||
}
|
||||
]
|
||||
},
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "passwd7 (VulDB User)"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"version": "3.1",
|
||||
"baseScore": 6.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
{
|
||||
"version": "3.0",
|
||||
"baseScore": 6.3,
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
{
|
||||
"version": "2.0",
|
||||
"baseScore": 6.5,
|
||||
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user