From a063497ac267d507cf0d60ece779741f35c68679 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Wed, 10 Apr 2024 20:00:50 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2021/46xxx/CVE-2021-46905.json | 2 +- 2021/46xxx/CVE-2021-46959.json | 12 ++-- 2021/46xxx/CVE-2021-46974.json | 6 +- 2021/47xxx/CVE-2021-47058.json | 8 +-- 2024/26xxx/CVE-2024-26809.json | 12 +--- 2024/29xxx/CVE-2024-29946.json | 4 +- 2024/3xxx/CVE-2024-3270.json | 108 ++++++++++++++++++++++++++++-- 2024/3xxx/CVE-2024-3281.json | 61 ++--------------- 2024/3xxx/CVE-2024-3283.json | 82 ++--------------------- 2024/3xxx/CVE-2024-3311.json | 117 +++++++++++++++++++++++++++++++-- 10 files changed, 242 insertions(+), 170 deletions(-) diff --git a/2021/46xxx/CVE-2021-46905.json b/2021/46xxx/CVE-2021-46905.json index 8eccd92b138..4e10650e135 100644 --- a/2021/46xxx/CVE-2021-46905.json +++ b/2021/46xxx/CVE-2021-46905.json @@ -161,6 +161,6 @@ ] }, "generator": { - "engine": "bippy-e0c11145c45e" + "engine": "bippy-851b3ed3d212" } } \ No newline at end of file diff --git a/2021/46xxx/CVE-2021-46959.json b/2021/46xxx/CVE-2021-46959.json index 60437d8e75d..2f3eb1e80f5 100644 --- a/2021/46xxx/CVE-2021-46959.json +++ b/2021/46xxx/CVE-2021-46959.json @@ -40,27 +40,27 @@ "version_data": [ { "version_affected": "<", - "version_name": "a4add022c155", + "version_name": "0713aa02f20d", "version_value": "62bb2c7f2411" }, { "version_affected": "<", - "version_name": "0870525cf94b", + "version_name": "2be1837b1737", "version_value": "8bf96425c90f" }, { "version_affected": "<", - "version_name": "8c45a1c6c951", + "version_name": "e620a73d7ca7", "version_value": "8e029707f50a" }, { "version_affected": "<", - "version_name": "234b432c7b61", + "version_name": "c886774bf583", "version_value": "28a5529068c5" }, { "version_affected": "<", - "version_name": "3e04a4976add", + "version_name": "2737549129ec", "version_value": "001c8e83646a" }, { @@ -199,6 +199,6 @@ ] }, "generator": { - "engine": "bippy-5f0117140d9a" + "engine": "bippy-851b3ed3d212" } } \ No newline at end of file diff --git a/2021/46xxx/CVE-2021-46974.json b/2021/46xxx/CVE-2021-46974.json index d0e5bbb4065..dcec4e66972 100644 --- a/2021/46xxx/CVE-2021-46974.json +++ b/2021/46xxx/CVE-2021-46974.json @@ -40,12 +40,12 @@ "version_data": [ { "version_affected": "<", - "version_name": "ae03b6b1c880", + "version_name": "12462c88e6e2", "version_value": "4d542ddb88fb" }, { "version_affected": "<", - "version_name": "f92a819b4cbe", + "version_name": "eed84f94ff8d", "version_value": "0e2dfdc74a7f" }, { @@ -162,6 +162,6 @@ ] }, "generator": { - "engine": "bippy-5f0117140d9a" + "engine": "bippy-851b3ed3d212" } } \ No newline at end of file diff --git a/2021/47xxx/CVE-2021-47058.json b/2021/47xxx/CVE-2021-47058.json index c49df9559d1..c74af1e24b4 100644 --- a/2021/47xxx/CVE-2021-47058.json +++ b/2021/47xxx/CVE-2021-47058.json @@ -40,17 +40,17 @@ "version_data": [ { "version_affected": "<", - "version_name": "5b654b030079", + "version_name": "1b8dd2d64ea9", "version_value": "2dc1554d5f0f" }, { "version_affected": "<", - "version_name": "480c5e9c7e4c", + "version_name": "6f484096196b", "version_value": "d8897f7b2283" }, { "version_affected": "<", - "version_name": "c9698380b01a", + "version_name": "75e5e51acf59", "version_value": "eb949f891226" }, { @@ -156,6 +156,6 @@ ] }, "generator": { - "engine": "bippy-5f0117140d9a" + "engine": "bippy-851b3ed3d212" } } \ No newline at end of file diff --git a/2024/26xxx/CVE-2024-26809.json b/2024/26xxx/CVE-2024-26809.json index 42a41ab0537..bfb12ff247f 100644 --- a/2024/26xxx/CVE-2024-26809.json +++ b/2024/26xxx/CVE-2024-26809.json @@ -57,16 +57,6 @@ "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ - { - "version": "5.19", - "status": "affected" - }, - { - "version": "0", - "lessThan": "5.19", - "status": "unaffected", - "versionType": "custom" - }, { "version": "5.10.214", "lessThanOrEqual": "5.10.*", @@ -162,6 +152,6 @@ ] }, "generator": { - "engine": "bippy-851b3ed3d212" + "engine": "bippy-e0c11145c45e" } } \ No newline at end of file diff --git a/2024/29xxx/CVE-2024-29946.json b/2024/29xxx/CVE-2024-29946.json index a0872ecfd44..98dbb41362d 100644 --- a/2024/29xxx/CVE-2024-29946.json +++ b/2024/29xxx/CVE-2024-29946.json @@ -11,7 +11,7 @@ "description_data": [ { "lang": "eng", - "value": "In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phish the victim by tricking them into initiating a request within their browser." + "value": "In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub in the Splunk Dashboard Studio app lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phish the victim by tricking them into initiating a request within their browser." } ] }, @@ -64,7 +64,7 @@ { "version_affected": "<", "version_name": "-", - "version_value": "9.1.2312.104" + "version_value": "9.1.2312.200" } ] } diff --git a/2024/3xxx/CVE-2024-3270.json b/2024/3xxx/CVE-2024-3270.json index a453431ccec..ff66e06abc0 100644 --- a/2024/3xxx/CVE-2024-3270.json +++ b/2024/3xxx/CVE-2024-3270.json @@ -1,17 +1,117 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-3270", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2. This vulnerability affects unknown code of the component AdvancedFeature. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-259282 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure and replied to be planning to fix this issue in version 3.7." + }, + { + "lang": "deu", + "value": "In ThingsBoard bis 3.6.2 wurde eine Schwachstelle entdeckt. Sie wurde als problematisch eingestuft. Betroffen ist eine unbekannte Verarbeitung der Komponente AdvancedFeature. Dank Manipulation mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-284 Improper Access Controls", + "cweId": "CWE-284" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "ThingsBoard", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "3.6.0" + }, + { + "version_affected": "=", + "version_value": "3.6.1" + }, + { + "version_affected": "=", + "version_value": "3.6.2" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.259282", + "refsource": "MISC", + "name": "https://vuldb.com/?id.259282" + }, + { + "url": "https://vuldb.com/?ctiid.259282", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.259282" + }, + { + "url": "https://vuldb.com/?submit.301359", + "refsource": "MISC", + "name": "https://vuldb.com/?submit.301359" + }, + { + "url": "https://drive.google.com/file/d/1w9iSMpyKDuapH9wjsgTe8AYPn8Z30u2Z/view?usp=drive_link", + "refsource": "MISC", + "name": "https://drive.google.com/file/d/1w9iSMpyKDuapH9wjsgTe8AYPn8Z30u2Z/view?usp=drive_link" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "sickuritywizard (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 3.8, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L", + "baseSeverity": "LOW" + }, + { + "version": "3.0", + "baseScore": 3.8, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L", + "baseSeverity": "LOW" + }, + { + "version": "2.0", + "baseScore": 4.7, + "vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:P" } ] } diff --git a/2024/3xxx/CVE-2024-3281.json b/2024/3xxx/CVE-2024-3281.json index 02cf1d20d39..0a0aa5850bb 100644 --- a/2024/3xxx/CVE-2024-3281.json +++ b/2024/3xxx/CVE-2024-3281.json @@ -1,71 +1,18 @@ { - "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", + "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-3281", - "ASSIGNER": "hp-security-alert@hp.com", - "STATE": "PUBLIC" + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" }, "description": { "description_data": [ { "lang": "eng", - "value": "A vulnerability was discovered in the firmware builds after 8.0.2.3267 and prior to 8.1.3.1301 in CCX devices. A flaw in the firmware build process did not properly restrict access to a resource from an unauthorized actor." + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." } ] - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ - { - "lang": "eng", - "value": "n/a" - } - ] - } - ] - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "vendor_name": "HP Inc.", - "product": { - "product_data": [ - { - "product_name": "Poly CCX devices", - "version": { - "version_data": [ - { - "version_affected": "=", - "version_value": "See HP Security Bulletin reference for affected versions." - } - ] - } - } - ] - } - } - ] - } - }, - "references": { - "reference_data": [ - { - "url": "https://support.hp.com/us-en/document/ish_10388650-10388701-16/hpsbpy03929", - "refsource": "MISC", - "name": "https://support.hp.com/us-en/document/ish_10388650-10388701-16/hpsbpy03929" - }, - { - "url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-003.txt", - "refsource": "MISC", - "name": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-003.txt" - } - ] - }, - "generator": { - "engine": "cveClient/1.0.15" } } \ No newline at end of file diff --git a/2024/3xxx/CVE-2024-3283.json b/2024/3xxx/CVE-2024-3283.json index 24a917fdc0a..390cbaf4afa 100644 --- a/2024/3xxx/CVE-2024-3283.json +++ b/2024/3xxx/CVE-2024-3283.json @@ -1,91 +1,17 @@ { - "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", + "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-3283", - "ASSIGNER": "security@huntr.com", - "STATE": "PUBLIC" + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" }, "description": { "description_data": [ { "lang": "eng", - "value": "A vulnerability in mintplex-labs/anything-llm allows users with manager roles to escalate their privileges to admin roles through a mass assignment issue. The '/admin/system-preferences' API endpoint improperly authorizes manager-level users to modify the 'multi_user_mode' system variable, enabling them to access the '/api/system/enable-multi-user' endpoint and create a new admin user. This issue results from the endpoint accepting a full JSON object in the request body without proper validation of modifiable fields, leading to unauthorized modification of system settings and subsequent privilege escalation." - } - ] - }, - "problemtype": { - "problemtype_data": [ - { - "description": [ - { - "lang": "eng", - "value": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes", - "cweId": "CWE-915" - } - ] - } - ] - }, - "affects": { - "vendor": { - "vendor_data": [ - { - "vendor_name": "mintplex-labs", - "product": { - "product_data": [ - { - "product_name": "mintplex-labs/anything-llm", - "version": { - "version_data": [ - { - "version_affected": "<", - "version_name": "unspecified", - "version_value": "1.0.0" - } - ] - } - } - ] - } - } - ] - } - }, - "references": { - "reference_data": [ - { - "url": "https://huntr.com/bounties/a8000cce-0ecb-4820-9cfb-57ba6f4d58a2", - "refsource": "MISC", - "name": "https://huntr.com/bounties/a8000cce-0ecb-4820-9cfb-57ba6f4d58a2" - }, - { - "url": "https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2", - "refsource": "MISC", - "name": "https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2" - } - ] - }, - "source": { - "advisory": "a8000cce-0ecb-4820-9cfb-57ba6f4d58a2", - "discovery": "EXTERNAL" - }, - "impact": { - "cvss": [ - { - "version": "3.0", - "attackComplexity": "LOW", - "attackVector": "NETWORK", - "availabilityImpact": "HIGH", - "confidentialityImpact": "HIGH", - "integrityImpact": "HIGH", - "privilegesRequired": "HIGH", - "scope": "UNCHANGED", - "userInteraction": "NONE", - "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", - "baseScore": 7.2, - "baseSeverity": "HIGH" + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." } ] } diff --git a/2024/3xxx/CVE-2024-3311.json b/2024/3xxx/CVE-2024-3311.json index d0fbae853fb..ea4faddc00e 100644 --- a/2024/3xxx/CVE-2024-3311.json +++ b/2024/3xxx/CVE-2024-3311.json @@ -1,17 +1,126 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-3311", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability was found in Dreamer CMS up to 4.1.3.0. It has been declared as critical. Affected by this vulnerability is the function ZipUtils.unZipFiles of the file controller/admin/ThemesController.java. The manipulation leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.3.1 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-259369 was assigned to this vulnerability." + }, + { + "lang": "deu", + "value": "In Dreamer CMS bis 4.1.3.0 wurde eine kritische Schwachstelle ausgemacht. Hierbei betrifft es die Funktion ZipUtils.unZipFiles der Datei controller/admin/ThemesController.java. Dank der Manipulation mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Ein Aktualisieren auf die Version 4.1.3.1 vermag dieses Problem zu l\u00f6sen. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-22 Path Traversal", + "cweId": "CWE-22" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Dreamer", + "product": { + "product_data": [ + { + "product_name": "CMS", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "4.1.0" + }, + { + "version_affected": "=", + "version_value": "4.1.1" + }, + { + "version_affected": "=", + "version_value": "4.1.2" + }, + { + "version_affected": "=", + "version_value": "4.1.3" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.259369", + "refsource": "MISC", + "name": "https://vuldb.com/?id.259369" + }, + { + "url": "https://vuldb.com/?ctiid.259369", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.259369" + }, + { + "url": "https://vuldb.com/?submit.303874", + "refsource": "MISC", + "name": "https://vuldb.com/?submit.303874" + }, + { + "url": "https://gitee.com/y1336247431/poc-public/issues/I9BA5R", + "refsource": "MISC", + "name": "https://gitee.com/y1336247431/poc-public/issues/I9BA5R" + }, + { + "url": "https://gitee.com/iteachyou/dreamer_cms/releases/tag/Latest_Stable_Release_4.1.3.1", + "refsource": "MISC", + "name": "https://gitee.com/iteachyou/dreamer_cms/releases/tag/Latest_Stable_Release_4.1.3.1" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "passwd7 (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 6.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "3.0", + "baseScore": 6.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "2.0", + "baseScore": 6.5, + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P" } ] }