mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-08-04 08:44:25 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
16ed29b7a1
commit
a64705d90f
@ -1,17 +1,174 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-10771",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@sick.de",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Due to missing input validation during one step of the firmware update process, the product\nis vulnerable to remote code execution. With network access and the user level \u201dService\u201d, an attacker\ncan execute arbitrary system commands in the root user\u2019s contexts."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-94 Improper Control of Generation of Code ('Code Injection')",
|
||||
"cweId": "CWE-94"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SICK AG",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SICK InspectorP61x",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "0",
|
||||
"version_value": "<5.0.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SICK InspectorP62x",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "0",
|
||||
"version_value": "<5.0.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TiM3xx",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "0",
|
||||
"version_value": "<5.10.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://sick.com/psirt",
|
||||
"refsource": "MISC",
|
||||
"name": "https://sick.com/psirt"
|
||||
},
|
||||
{
|
||||
"url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF",
|
||||
"refsource": "MISC",
|
||||
"name": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
|
||||
},
|
||||
{
|
||||
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
|
||||
},
|
||||
{
|
||||
"url": "https://www.first.org/cvss/calculator/3.1",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.first.org/cvss/calculator/3.1"
|
||||
},
|
||||
{
|
||||
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf"
|
||||
},
|
||||
{
|
||||
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
},
|
||||
"source": {
|
||||
"advisory": "SCA-2024-0006",
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "For TiM3xx: \n\nWe recommend updating the firmware only in a trusted environment."
|
||||
}
|
||||
],
|
||||
"value": "For TiM3xx:\u00a0\n\nWe recommend updating the firmware only in a trusted environment."
|
||||
}
|
||||
],
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "For InspectorP61x and InspectorP62x: Customers are strongly recommended to upgrade to the latest release."
|
||||
}
|
||||
],
|
||||
"value": "For InspectorP61x and InspectorP62x: Customers are strongly recommended to upgrade to the latest release."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Manuel Stotz"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Tobias Jaeger"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,149 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-10772",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@sick.de",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Since the firmware update is not validated, an attacker can install modified firmware on the\ndevice. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-649 Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking",
|
||||
"cweId": "CWE-649"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SICK AG",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SICK InspectorP61x",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "0",
|
||||
"version_value": "<5.0.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SICK InspectorP62x",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "0",
|
||||
"version_value": "<5.0.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://sick.com/psirt",
|
||||
"refsource": "MISC",
|
||||
"name": "https://sick.com/psirt"
|
||||
},
|
||||
{
|
||||
"url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF",
|
||||
"refsource": "MISC",
|
||||
"name": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
|
||||
},
|
||||
{
|
||||
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
|
||||
},
|
||||
{
|
||||
"url": "https://www.first.org/cvss/calculator/3.1",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.first.org/cvss/calculator/3.1"
|
||||
},
|
||||
{
|
||||
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf"
|
||||
},
|
||||
{
|
||||
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
},
|
||||
"source": {
|
||||
"advisory": "SCA-2024-0006",
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "For InspectorP61x and InspectorP62x: Customers are strongly recommended to upgrade to the latest release."
|
||||
}
|
||||
],
|
||||
"value": "For InspectorP61x and InspectorP62x: Customers are strongly recommended to upgrade to the latest release."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Manuel Stotz"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Tobias Jaeger"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,161 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-10773",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@sick.de",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain\nfull access to the device."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-912 Hidden Functionality",
|
||||
"cweId": "CWE-912"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SICK AG",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SICK InspectorP61x",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "0",
|
||||
"version_value": "<5.0.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SICK InspectorP62x",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "0",
|
||||
"version_value": "<5.0.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "TiM3xx",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "0",
|
||||
"version_value": "<5.10.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://sick.com/psirt",
|
||||
"refsource": "MISC",
|
||||
"name": "https://sick.com/psirt"
|
||||
},
|
||||
{
|
||||
"url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF",
|
||||
"refsource": "MISC",
|
||||
"name": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
|
||||
},
|
||||
{
|
||||
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
|
||||
},
|
||||
{
|
||||
"url": "https://www.first.org/cvss/calculator/3.1",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.first.org/cvss/calculator/3.1"
|
||||
},
|
||||
{
|
||||
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf"
|
||||
},
|
||||
{
|
||||
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
},
|
||||
"source": {
|
||||
"advisory": "SCA-2024-0006",
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"solution": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "For InspectorP61x, InspectorP62x and TiM3xx: Customers are strongly recommended to upgrade to the latest release."
|
||||
}
|
||||
],
|
||||
"value": "For InspectorP61x, InspectorP62x and TiM3xx: Customers are strongly recommended to upgrade to the latest release."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Manuel Stotz"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Tobias Jaeger"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 9,
|
||||
"baseSeverity": "CRITICAL",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,149 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-10774",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@sick.de",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-306 Missing Authentication for Critical Function",
|
||||
"cweId": "CWE-306"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SICK AG",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SICK InspectorP61x",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "0",
|
||||
"version_value": "<5.0.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SICK InspectorP62x",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "0",
|
||||
"version_value": "<5.0.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://sick.com/psirt",
|
||||
"refsource": "MISC",
|
||||
"name": "https://sick.com/psirt"
|
||||
},
|
||||
{
|
||||
"url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF",
|
||||
"refsource": "MISC",
|
||||
"name": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
|
||||
},
|
||||
{
|
||||
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
|
||||
},
|
||||
{
|
||||
"url": "https://www.first.org/cvss/calculator/3.1",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.first.org/cvss/calculator/3.1"
|
||||
},
|
||||
{
|
||||
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf"
|
||||
},
|
||||
{
|
||||
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
},
|
||||
"source": {
|
||||
"advisory": "SCA-2024-0006",
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "For InspectorP61x and InspectorP62x: \n\nCustomers are strongly recommended to upgrade to the latest release. Furthermore, the\napp development for which the CROWN API is required should be done in a trusted environment. As\nsoon as the device is used productively with the custom-developed apps, the CROWN API should be\ndeactivated."
|
||||
}
|
||||
],
|
||||
"value": "For InspectorP61x and InspectorP62x: \n\nCustomers are strongly recommended to upgrade to the latest release. Furthermore, the\napp development for which the CROWN API is required should be done in a trusted environment. As\nsoon as the device is used productively with the custom-developed apps, the CROWN API should be\ndeactivated."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Manuel Stotz"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Tobias Jaeger"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 7.3,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,149 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-10776",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@sick.de",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Lua apps can be deployed, removed, started, reloaded or stopped without authorization via\nAppManager. This allows an attacker to remove legitimate apps creating a DoS attack, read and write\nfiles or load apps that use all features of the product available to a customer."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-306 Missing Authentication for Critical Function",
|
||||
"cweId": "CWE-306"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SICK AG",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SICK InspectorP61x",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "0",
|
||||
"version_value": "<5.0.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SICK InspectorP62x",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<",
|
||||
"version_name": "0",
|
||||
"version_value": "<5.0.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://sick.com/psirt",
|
||||
"refsource": "MISC",
|
||||
"name": "https://sick.com/psirt"
|
||||
},
|
||||
{
|
||||
"url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF",
|
||||
"refsource": "MISC",
|
||||
"name": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
|
||||
},
|
||||
{
|
||||
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
|
||||
},
|
||||
{
|
||||
"url": "https://www.first.org/cvss/calculator/3.1",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.first.org/cvss/calculator/3.1"
|
||||
},
|
||||
{
|
||||
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf"
|
||||
},
|
||||
{
|
||||
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
},
|
||||
"source": {
|
||||
"advisory": "SCA-2024-0006",
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "Customers are strongly recommended to upgrade to the latest release. Furthermore, the\napp development should be done in a trusted environment. After the development, app management\nshould be disabled"
|
||||
}
|
||||
],
|
||||
"value": "Customers are strongly recommended to upgrade to the latest release. Furthermore, the\napp development should be done in a trusted environment. After the development, app management\nshould be disabled"
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Manuel Stotz"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Tobias Jaeger"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.2,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,147 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-11022",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "psirt@sick.de",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "The authentication process to the web server uses a challenge response procedure which\ninludes the nonce and additional information. This challenge can be used several times for login and is\ntherefore vulnerable for a replay attack."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-323 Reusing a Nonce, Key Pair in Encryption",
|
||||
"cweId": "CWE-323"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "SICK AG",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "SICK InspectorP61x",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "all versions"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"product_name": "SICK InspectorP62x",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "all versions"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://sick.com/psirt",
|
||||
"refsource": "MISC",
|
||||
"name": "https://sick.com/psirt"
|
||||
},
|
||||
{
|
||||
"url": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF",
|
||||
"refsource": "MISC",
|
||||
"name": "https://cdn.sick.com/media/docs/1/11/411/Special_information_CYBERSECURITY_BY_SICK_en_IM0084411.PDF"
|
||||
},
|
||||
{
|
||||
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
|
||||
},
|
||||
{
|
||||
"url": "https://www.first.org/cvss/calculator/3.1",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.first.org/cvss/calculator/3.1"
|
||||
},
|
||||
{
|
||||
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.pdf"
|
||||
},
|
||||
{
|
||||
"url": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.sick.com/.well-known/csaf/white/2024/sca-2024-0006.json"
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.2.0"
|
||||
},
|
||||
"source": {
|
||||
"advisory": "SCA-2024-0006",
|
||||
"discovery": "EXTERNAL"
|
||||
},
|
||||
"work_around": [
|
||||
{
|
||||
"lang": "en",
|
||||
"supportingMedia": [
|
||||
{
|
||||
"base64": false,
|
||||
"type": "text/html",
|
||||
"value": "As the communication is not encrypted, the device should only be used in a trusted environment.\n<br><br>"
|
||||
}
|
||||
],
|
||||
"value": "As the communication is not encrypted, the device should only be used in a trusted environment."
|
||||
}
|
||||
],
|
||||
"credits": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Manuel Stotz"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Tobias Jaeger"
|
||||
}
|
||||
],
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 5.6,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
18
2024/12xxx/CVE-2024-12299.json
Normal file
18
2024/12xxx/CVE-2024-12299.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-12299",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user