From a9b7f96faa2d6518acda14649221e9bfcba24dd8 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Tue, 10 Dec 2024 17:00:55 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2024/12xxx/CVE-2024-12417.json | 18 ++++++ 2024/12xxx/CVE-2024-12418.json | 18 ++++++ 2024/12xxx/CVE-2024-12419.json | 18 ++++++ 2024/12xxx/CVE-2024-12428.json | 18 ++++++ 2024/12xxx/CVE-2024-12429.json | 18 ++++++ 2024/12xxx/CVE-2024-12430.json | 18 ++++++ 2024/43xxx/CVE-2024-43499.json | 5 ++ 2024/43xxx/CVE-2024-43598.json | 4 +- 2024/43xxx/CVE-2024-43637.json | 10 +++ 2024/49xxx/CVE-2024-49050.json | 2 +- 2024/49xxx/CVE-2024-49054.json | 3 +- 2024/55xxx/CVE-2024-55544.json | 113 +++++++++++++++++++++++++++++++-- 2024/55xxx/CVE-2024-55545.json | 113 +++++++++++++++++++++++++++++++-- 2024/55xxx/CVE-2024-55602.json | 96 ++++++++++++++++++++++++++-- 14 files changed, 436 insertions(+), 18 deletions(-) create mode 100644 2024/12xxx/CVE-2024-12417.json create mode 100644 2024/12xxx/CVE-2024-12418.json create mode 100644 2024/12xxx/CVE-2024-12419.json create mode 100644 2024/12xxx/CVE-2024-12428.json create mode 100644 2024/12xxx/CVE-2024-12429.json create mode 100644 2024/12xxx/CVE-2024-12430.json diff --git a/2024/12xxx/CVE-2024-12417.json b/2024/12xxx/CVE-2024-12417.json new file mode 100644 index 00000000000..9ba4f3bad41 --- /dev/null +++ b/2024/12xxx/CVE-2024-12417.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-12417", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/12xxx/CVE-2024-12418.json b/2024/12xxx/CVE-2024-12418.json new file mode 100644 index 00000000000..f18cbad6401 --- /dev/null +++ b/2024/12xxx/CVE-2024-12418.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-12418", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/12xxx/CVE-2024-12419.json b/2024/12xxx/CVE-2024-12419.json new file mode 100644 index 00000000000..9dd4879c852 --- /dev/null +++ b/2024/12xxx/CVE-2024-12419.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-12419", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/12xxx/CVE-2024-12428.json b/2024/12xxx/CVE-2024-12428.json new file mode 100644 index 00000000000..4e1fd9344c4 --- /dev/null +++ b/2024/12xxx/CVE-2024-12428.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-12428", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/12xxx/CVE-2024-12429.json b/2024/12xxx/CVE-2024-12429.json new file mode 100644 index 00000000000..2e19240c1c2 --- /dev/null +++ b/2024/12xxx/CVE-2024-12429.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-12429", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/12xxx/CVE-2024-12430.json b/2024/12xxx/CVE-2024-12430.json new file mode 100644 index 00000000000..89b8db48b19 --- /dev/null +++ b/2024/12xxx/CVE-2024-12430.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-12430", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/43xxx/CVE-2024-43499.json b/2024/43xxx/CVE-2024-43499.json index 060ace80e3e..64f19ea4045 100644 --- a/2024/43xxx/CVE-2024-43499.json +++ b/2024/43xxx/CVE-2024-43499.json @@ -19,6 +19,11 @@ "problemtype_data": [ { "description": [ + { + "lang": "eng", + "value": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)", + "cweId": "CWE-409" + }, { "lang": "eng", "value": "CWE-606: Unchecked Input for Loop Condition", diff --git a/2024/43xxx/CVE-2024-43598.json b/2024/43xxx/CVE-2024-43598.json index ce8d6c51a0d..1687764ab19 100644 --- a/2024/43xxx/CVE-2024-43598.json +++ b/2024/43xxx/CVE-2024-43598.json @@ -67,8 +67,8 @@ { "version": "3.1", "baseSeverity": "HIGH", - "baseScore": 7.5, - "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C" + "baseScore": 8.1, + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C" } ] } diff --git a/2024/43xxx/CVE-2024-43637.json b/2024/43xxx/CVE-2024-43637.json index 3cd04dbebb9..88e4e55cd8f 100644 --- a/2024/43xxx/CVE-2024-43637.json +++ b/2024/43xxx/CVE-2024-43637.json @@ -361,5 +361,15 @@ "name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43637" } ] + }, + "impact": { + "cvss": [ + { + "version": "3.1", + "baseSeverity": "MEDIUM", + "baseScore": 6.8, + "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C" + } + ] } } \ No newline at end of file diff --git a/2024/49xxx/CVE-2024-49050.json b/2024/49xxx/CVE-2024-49050.json index a22e3f45e31..13aa940bfb4 100644 --- a/2024/49xxx/CVE-2024-49050.json +++ b/2024/49xxx/CVE-2024-49050.json @@ -21,7 +21,7 @@ "description": [ { "lang": "eng", - "value": "CWE-501: Trust boundary violation", + "value": "CWE-501: Trust Boundary Violation", "cweId": "CWE-501" } ] diff --git a/2024/49xxx/CVE-2024-49054.json b/2024/49xxx/CVE-2024-49054.json index 3ebffd3570b..83095831625 100644 --- a/2024/49xxx/CVE-2024-49054.json +++ b/2024/49xxx/CVE-2024-49054.json @@ -21,7 +21,8 @@ "description": [ { "lang": "eng", - "value": "Spoofing" + "value": "CWE-357: Insufficient UI Warning of Dangerous Operations", + "cweId": "CWE-357" } ] } diff --git a/2024/55xxx/CVE-2024-55544.json b/2024/55xxx/CVE-2024-55544.json index 6750105eef9..3b2e622cb20 100644 --- a/2024/55xxx/CVE-2024-55544.json +++ b/2024/55xxx/CVE-2024-55544.json @@ -1,18 +1,121 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-55544", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "office@cyberdanube.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')", + "cweId": "CWE-77" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "ORing", + "product": { + "product_data": [ + { + "product_name": "IAP-420", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "2.01e" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://cyberdanube.com/security-research/st-polten-uas-multiple-vulnerabilities-in-oring-iap/", + "refsource": "MISC", + "name": "https://cyberdanube.com/security-research/st-polten-uas-multiple-vulnerabilities-in-oring-iap/" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "EXTERNAL" + }, + "credits": [ + { + "lang": "en", + "value": "P. Chist\u00e8" + }, + { + "lang": "en", + "value": "A. Falb" + }, + { + "lang": "en", + "value": "M. Selinger" + }, + { + "lang": "en", + "value": "M. Suchy" + }, + { + "lang": "en", + "value": "P. Oberndorfer" + }, + { + "lang": "en", + "value": "P. Maluenda" + }, + { + "lang": "en", + "value": "D. Sagl" + }, + { + "lang": "en", + "value": "M. Narbeshuber-Spletzer" + }, + { + "lang": "en", + "value": "J. Springer" + }, + { + "lang": "en", + "value": "P. Riedl" + }, + { + "lang": "en", + "value": "C. Hierzer" + }, + { + "lang": "en", + "value": "M. Pammer" + } + ] } \ No newline at end of file diff --git a/2024/55xxx/CVE-2024-55545.json b/2024/55xxx/CVE-2024-55545.json index 2f0618b6417..ed061248a1a 100644 --- a/2024/55xxx/CVE-2024-55545.json +++ b/2024/55xxx/CVE-2024-55545.json @@ -1,18 +1,121 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-55545", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "office@cyberdanube.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Missing input validation in the ORing IAP-420 web-interface allows stored Cross-Site Scripting (XSS).This issue affects IAP-420 version 2.01e and below." } ] - } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "ORing", + "product": { + "product_data": [ + { + "product_name": "IAP-420", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "0", + "version_value": "2.01e" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://cyberdanube.com/security-research/st-polten-uas-multiple-vulnerabilities-in-oring-iap/", + "refsource": "MISC", + "name": "https://cyberdanube.com/security-research/st-polten-uas-multiple-vulnerabilities-in-oring-iap/" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "EXTERNAL" + }, + "credits": [ + { + "lang": "en", + "value": "P. Chist\u00e8" + }, + { + "lang": "en", + "value": "A. Falb" + }, + { + "lang": "en", + "value": "M. Selinger" + }, + { + "lang": "en", + "value": "M. Suchy" + }, + { + "lang": "en", + "value": "P. Oberndorfer" + }, + { + "lang": "en", + "value": "P. Maluenda" + }, + { + "lang": "en", + "value": "D. Sagl" + }, + { + "lang": "en", + "value": "M. Narbeshuber-Spletzer" + }, + { + "lang": "en", + "value": "J. Springer" + }, + { + "lang": "en", + "value": "P. Riedl" + }, + { + "lang": "en", + "value": "C. Hierzer" + }, + { + "lang": "en", + "value": "M. Pammer" + } + ] } \ No newline at end of file diff --git a/2024/55xxx/CVE-2024-55602.json b/2024/55xxx/CVE-2024-55602.json index 6dc4bdd85f0..e5fae0ef1fb 100644 --- a/2024/55xxx/CVE-2024-55602.json +++ b/2024/55xxx/CVE-2024-55602.json @@ -1,17 +1,105 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-55602", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security-advisories@github.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "PwnDoc is a penetration test report generator. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an authenticated user who is able to update and download templates can inject path traversal (`../`) sequences into the file extension property to read arbitrary files on the system. Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 contains a patch for the issue." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", + "cweId": "CWE-22" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "pwndoc", + "product": { + "product_data": [ + { + "product_name": "pwndoc", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "< 1d4219c596f4f518798492e48386a20c6e9a2fe6" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/pwndoc/pwndoc/security/advisories/GHSA-2mqc-gg7h-76p6", + "refsource": "MISC", + "name": "https://github.com/pwndoc/pwndoc/security/advisories/GHSA-2mqc-gg7h-76p6" + }, + { + "url": "https://github.com/pwndoc/pwndoc/commit/1d4219c596f4f518798492e48386a20c6e9a2fe6", + "refsource": "MISC", + "name": "https://github.com/pwndoc/pwndoc/commit/1d4219c596f4f518798492e48386a20c6e9a2fe6" + }, + { + "url": "https://gist.github.com/JorianWoltjer/8a42e25c6dfa7604020d2a226e193407", + "refsource": "MISC", + "name": "https://gist.github.com/JorianWoltjer/8a42e25c6dfa7604020d2a226e193407" + }, + { + "url": "https://github.com/pwndoc/pwndoc/blob/2e7f5747d5688b1368e549c786ce7266fe5ab2b5/backend/src/routes/template.js#L103", + "refsource": "MISC", + "name": "https://github.com/pwndoc/pwndoc/blob/2e7f5747d5688b1368e549c786ce7266fe5ab2b5/backend/src/routes/template.js#L103" + }, + { + "url": "https://github.com/pwndoc/pwndoc/blob/2e7f5747d5688b1368e549c786ce7266fe5ab2b5/backend/src/routes/template.js#L43-L47", + "refsource": "MISC", + "name": "https://github.com/pwndoc/pwndoc/blob/2e7f5747d5688b1368e549c786ce7266fe5ab2b5/backend/src/routes/template.js#L43-L47" + } + ] + }, + "source": { + "advisory": "GHSA-2mqc-gg7h-76p6", + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 7.6, + "baseSeverity": "HIGH", + "confidentialityImpact": "HIGH", + "integrityImpact": "LOW", + "privilegesRequired": "HIGH", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", + "version": "3.1" } ] }