From bd7e4f800da210628903577b6392ecd17d14b31c Mon Sep 17 00:00:00 2001 From: CVE Team Date: Wed, 31 May 2023 09:00:37 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2022/25xxx/CVE-2022-25164.json | 15 +++-- 2022/29xxx/CVE-2022-29825.json | 22 ++++++- 2022/29xxx/CVE-2022-29826.json | 22 ++++++- 2022/29xxx/CVE-2022-29827.json | 11 +++- 2022/29xxx/CVE-2022-29828.json | 11 +++- 2022/29xxx/CVE-2022-29829.json | 33 +++++++++- 2022/29xxx/CVE-2022-29830.json | 22 ++++++- 2023/2xxx/CVE-2023-2749.json | 85 ++++++++++++++++++++++++-- 2023/34xxx/CVE-2023-34213.json | 18 ++++++ 2023/34xxx/CVE-2023-34214.json | 18 ++++++ 2023/34xxx/CVE-2023-34215.json | 18 ++++++ 2023/34xxx/CVE-2023-34216.json | 18 ++++++ 2023/34xxx/CVE-2023-34217.json | 18 ++++++ 2023/3xxx/CVE-2023-3003.json | 96 +++++++++++++++++++++++++++-- 2023/3xxx/CVE-2023-3004.json | 96 +++++++++++++++++++++++++++-- 2023/3xxx/CVE-2023-3005.json | 106 +++++++++++++++++++++++++++++++++ 2023/3xxx/CVE-2023-3006.json | 18 ++++++ 17 files changed, 592 insertions(+), 35 deletions(-) create mode 100644 2023/34xxx/CVE-2023-34213.json create mode 100644 2023/34xxx/CVE-2023-34214.json create mode 100644 2023/34xxx/CVE-2023-34215.json create mode 100644 2023/34xxx/CVE-2023-34216.json create mode 100644 2023/34xxx/CVE-2023-34217.json create mode 100644 2023/3xxx/CVE-2023-3005.json create mode 100644 2023/3xxx/CVE-2023-3006.json diff --git a/2022/25xxx/CVE-2022-25164.json b/2022/25xxx/CVE-2022-25164.json index eed2a43b1d6..9bd70bd61a9 100644 --- a/2022/25xxx/CVE-2022-25164.json +++ b/2022/25xxx/CVE-2022-25164.json @@ -11,7 +11,7 @@ "description_data": [ { "lang": "eng", - "value": "Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 all versions and Mitsubishi Electric MX OPC UA Module Configurator-R all versions allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthorized users can gain unauthorized access to the CPU module and the OPC UA server module." + "value": "Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 all versions and Mitsubishi Electric MX OPC UA Module Configurator-R all versions allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users can gain unauthorized access to the MELSEC CPU module and the MELSEC OPC UA server module." } ] }, @@ -40,8 +40,8 @@ "version": { "version_data": [ { - "version_value": "all versions", - "version_affected": "=" + "version_affected": "=", + "version_value": "all versions" } ] } @@ -51,8 +51,8 @@ "version": { "version_data": [ { - "version_value": "all versions", - "version_affected": "=" + "version_affected": "=", + "version_value": "all versions" } ] } @@ -74,6 +74,11 @@ "url": "https://jvn.jp/vu/JVNVU97244961/index.html", "refsource": "MISC", "name": "https://jvn.jp/vu/JVNVU97244961/index.html" + }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "refsource": "MISC", + "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05" } ] }, diff --git a/2022/29xxx/CVE-2022-29825.json b/2022/29xxx/CVE-2022-29825.json index b79716b46e9..8dd5c08e61b 100644 --- a/2022/29xxx/CVE-2022-29825.json +++ b/2022/29xxx/CVE-2022-29825.json @@ -11,7 +11,7 @@ "description_data": [ { "lang": "eng", - "value": "Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 all versions allows an unauthenticated attacker to disclose sensitive information. As a result, unauthorized users may view or execute programs illegally." + "value": "Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U and GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C allows an unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally." } ] }, @@ -40,8 +40,19 @@ "version": { "version_data": [ { - "version_value": "all versions", - "version_affected": "=" + "version_affected": "=", + "version_value": "from 1.000A to 1.090U" + } + ] + } + }, + { + "product_name": "GT Designer3 Version1 (GOT2000)", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "from 1.122C to 1.290C" } ] } @@ -63,6 +74,11 @@ "url": "https://jvn.jp/vu/JVNVU97244961/index.html", "refsource": "MISC", "name": "https://jvn.jp/vu/JVNVU97244961/index.html" + }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "refsource": "MISC", + "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05" } ] }, diff --git a/2022/29xxx/CVE-2022-29826.json b/2022/29xxx/CVE-2022-29826.json index ece240a8bea..7351eddf4ec 100644 --- a/2022/29xxx/CVE-2022-29826.json +++ b/2022/29xxx/CVE-2022-29826.json @@ -11,7 +11,7 @@ "description_data": [ { "lang": "eng", - "value": "Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions 1.086Q and prior allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthorized users may view or execute programs illegally." + "value": "Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.087R and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.042U allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally." } ] }, @@ -40,8 +40,19 @@ "version": { "version_data": [ { - "version_value": "1.086Q and prior", - "version_affected": "=" + "version_affected": "=", + "version_value": "from 1.000A to 1.087R" + } + ] + } + }, + { + "product_name": "Motion Control Setting(GX Works3 related software)", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "from 1.000A to 1.042U" } ] } @@ -63,6 +74,11 @@ "url": "https://jvn.jp/vu/JVNVU97244961/index.html", "refsource": "MISC", "name": "https://jvn.jp/vu/JVNVU97244961/index.html" + }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "refsource": "MISC", + "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05" } ] }, diff --git a/2022/29xxx/CVE-2022-29827.json b/2022/29xxx/CVE-2022-29827.json index 1bb247f4f63..1b414bd0265 100644 --- a/2022/29xxx/CVE-2022-29827.json +++ b/2022/29xxx/CVE-2022-29827.json @@ -11,7 +11,7 @@ "description_data": [ { "lang": "eng", - "value": "Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 all versions allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthorized users may view or execute programs illegally." + "value": "Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 all versions allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally." } ] }, @@ -40,8 +40,8 @@ "version": { "version_data": [ { - "version_value": "all versions", - "version_affected": "=" + "version_affected": "=", + "version_value": "all versions" } ] } @@ -63,6 +63,11 @@ "url": "https://jvn.jp/vu/JVNVU97244961/index.html", "refsource": "MISC", "name": "https://jvn.jp/vu/JVNVU97244961/index.html" + }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "refsource": "MISC", + "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05" } ] }, diff --git a/2022/29xxx/CVE-2022-29828.json b/2022/29xxx/CVE-2022-29828.json index 954ed7e869e..5cd015590c7 100644 --- a/2022/29xxx/CVE-2022-29828.json +++ b/2022/29xxx/CVE-2022-29828.json @@ -11,7 +11,7 @@ "description_data": [ { "lang": "eng", - "value": "Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 all versions allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthorized users may view or execute programs illegally." + "value": "Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 all versions allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project file or execute programs illegally." } ] }, @@ -40,8 +40,8 @@ "version": { "version_data": [ { - "version_value": "all versions", - "version_affected": "=" + "version_affected": "=", + "version_value": "all versions" } ] } @@ -63,6 +63,11 @@ "url": "https://jvn.jp/vu/JVNVU97244961/index.html", "refsource": "MISC", "name": "https://jvn.jp/vu/JVNVU97244961/index.html" + }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "refsource": "MISC", + "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05" } ] }, diff --git a/2022/29xxx/CVE-2022-29829.json b/2022/29xxx/CVE-2022-29829.json index 34eaf6e8406..797a7cd05f6 100644 --- a/2022/29xxx/CVE-2022-29829.json +++ b/2022/29xxx/CVE-2022-29829.json @@ -11,7 +11,7 @@ "description_data": [ { "lang": "eng", - "value": "Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 all versions allows a remote unauthenticated attacker to disclose sensitive information . As a result, unauthorized users may view or execute programs illegally." + "value": "Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C and Motion Control Setting(GX Works3 related software) versions from 1.035M to 1.042U allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally." } ] }, @@ -40,8 +40,30 @@ "version": { "version_data": [ { - "version_value": "all versions", - "version_affected": "=" + "version_affected": "=", + "version_value": "from 1.000A to 1.090U" + } + ] + } + }, + { + "product_name": "GT Designer3 Version1 (GOT2000)", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "from 1.122C to 1.290C" + } + ] + } + }, + { + "product_name": "Motion Control Setting(GX Works3 related software)", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "from 1.035M to 1.042U" } ] } @@ -63,6 +85,11 @@ "url": "https://jvn.jp/vu/JVNVU97244961/index.html", "refsource": "MISC", "name": "https://jvn.jp/vu/JVNVU97244961/index.html" + }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "refsource": "MISC", + "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05" } ] }, diff --git a/2022/29xxx/CVE-2022-29830.json b/2022/29xxx/CVE-2022-29830.json index 74d616e918f..a01ab02d4f7 100644 --- a/2022/29xxx/CVE-2022-29830.json +++ b/2022/29xxx/CVE-2022-29830.json @@ -11,7 +11,7 @@ "description_data": [ { "lang": "eng", - "value": "Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 all versions allows a remote unauthenticated attacker to disclose or tamper with sensitive information. As a result, unauthorized users may obtain information about project files illegally." + "value": "Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 all versions and Motion Control Setting(GX Works3 related software) all versions allows a remote unauthenticated attacker to disclose or tamper with sensitive information. As a result, unauthenticated users may obtain information about project files illegally." } ] }, @@ -40,8 +40,19 @@ "version": { "version_data": [ { - "version_value": "all versions", - "version_affected": "=" + "version_affected": "=", + "version_value": "all versions" + } + ] + } + }, + { + "product_name": "Motion Control Setting(GX Works3 related software)", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "all versions" } ] } @@ -63,6 +74,11 @@ "url": "https://jvn.jp/vu/JVNVU97244961/index.html", "refsource": "MISC", "name": "https://jvn.jp/vu/JVNVU97244961/index.html" + }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "refsource": "MISC", + "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05" } ] }, diff --git a/2023/2xxx/CVE-2023-2749.json b/2023/2xxx/CVE-2023-2749.json index bf06fd96f1c..b3bb2f5df31 100644 --- a/2023/2xxx/CVE-2023-2749.json +++ b/2023/2xxx/CVE-2023-2749.json @@ -1,17 +1,94 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-2749", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@asustor.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitive files or directories without appropriate permission restrictions. Download Center on ADM 4.0 and above will be affected. Affected products and versions include: Download Center 1.1.5.r1280 and below. " + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", + "cweId": "CWE-200" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "ASUSTOR", + "product": { + "product_data": [ + { + "product_name": "Download Center", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "1.1.5", + "version_value": "1.1.5.r1280" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.asustor.com/security/security_advisory_detail?id=24", + "refsource": "MISC", + "name": "https://www.asustor.com/security/security_advisory_detail?id=24" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "UNKNOWN" + }, + "credits": [ + { + "lang": "en", + "value": "Zhiyong Xing, Inner Mongolia Xinyuan Network Security Technology Co., Ltd., China" + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "LOW", + "baseScore": 8.6, + "baseSeverity": "HIGH", + "confidentialityImpact": "LOW", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", + "version": "3.1" } ] } diff --git a/2023/34xxx/CVE-2023-34213.json b/2023/34xxx/CVE-2023-34213.json new file mode 100644 index 00000000000..a78b8b71688 --- /dev/null +++ b/2023/34xxx/CVE-2023-34213.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2023-34213", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2023/34xxx/CVE-2023-34214.json b/2023/34xxx/CVE-2023-34214.json new file mode 100644 index 00000000000..3e4a2431d81 --- /dev/null +++ b/2023/34xxx/CVE-2023-34214.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2023-34214", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2023/34xxx/CVE-2023-34215.json b/2023/34xxx/CVE-2023-34215.json new file mode 100644 index 00000000000..731762827c2 --- /dev/null +++ b/2023/34xxx/CVE-2023-34215.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2023-34215", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2023/34xxx/CVE-2023-34216.json b/2023/34xxx/CVE-2023-34216.json new file mode 100644 index 00000000000..347e0edb5c4 --- /dev/null +++ b/2023/34xxx/CVE-2023-34216.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2023-34216", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2023/34xxx/CVE-2023-34217.json b/2023/34xxx/CVE-2023-34217.json new file mode 100644 index 00000000000..ebd0d23fdba --- /dev/null +++ b/2023/34xxx/CVE-2023-34217.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2023-34217", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2023/3xxx/CVE-2023-3003.json b/2023/3xxx/CVE-2023-3003.json index b8b0e40d59b..e2c39b74fd6 100644 --- a/2023/3xxx/CVE-2023-3003.json +++ b/2023/3xxx/CVE-2023-3003.json @@ -1,17 +1,105 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-3003", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability classified as critical was found in SourceCodester Train Station Ticketing System 1.0. Affected by this vulnerability is an unknown functionality of the file manage_prices.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230347." + }, + { + "lang": "deu", + "value": "In SourceCodester Train Station Ticketing System 1.0 wurde eine kritische Schwachstelle entdeckt. Betroffen ist eine unbekannte Verarbeitung der Datei manage_prices.php der Komponente GET Parameter Handler. Durch das Manipulieren des Arguments id mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-89 SQL Injection", + "cweId": "CWE-89" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SourceCodester", + "product": { + "product_data": [ + { + "product_name": "Train Station Ticketing System", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "1.0" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.230347", + "refsource": "MISC", + "name": "https://vuldb.com/?id.230347" + }, + { + "url": "https://vuldb.com/?ctiid.230347", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.230347" + }, + { + "url": "https://github.com/shiyur14/bugReport/blob/main/SQL.md", + "refsource": "MISC", + "name": "https://github.com/shiyur14/bugReport/blob/main/SQL.md" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "syr14 (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 6.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "3.0", + "baseScore": 6.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "2.0", + "baseScore": 6.5, + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", + "baseSeverity": "MEDIUM" } ] } diff --git a/2023/3xxx/CVE-2023-3004.json b/2023/3xxx/CVE-2023-3004.json index ce72d4add1e..4feb5f7ea8e 100644 --- a/2023/3xxx/CVE-2023-3004.json +++ b/2023/3xxx/CVE-2023-3004.json @@ -1,17 +1,105 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-3004", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability, which was classified as critical, has been found in SourceCodester Simple Chat System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=read_msg of the component POST Parameter Handler. The manipulation of the argument convo_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230348." + }, + { + "lang": "deu", + "value": "Eine kritische Schwachstelle wurde in SourceCodester Simple Chat System 1.0 entdeckt. Betroffen davon ist ein unbekannter Prozess der Datei /ajax.php?action=read_msg der Komponente POST Parameter Handler. Durch Manipulieren des Arguments convo_id mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-89 SQL Injection", + "cweId": "CWE-89" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SourceCodester", + "product": { + "product_data": [ + { + "product_name": "Simple Chat System", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "1.0" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.230348", + "refsource": "MISC", + "name": "https://vuldb.com/?id.230348" + }, + { + "url": "https://vuldb.com/?ctiid.230348", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.230348" + }, + { + "url": "https://github.com/sikii7/CVE/blob/main/SQL.md", + "refsource": "MISC", + "name": "https://github.com/sikii7/CVE/blob/main/SQL.md" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "sikii (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 6.3, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "3.0", + "baseScore": 6.3, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "2.0", + "baseScore": 6.5, + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", + "baseSeverity": "MEDIUM" } ] } diff --git a/2023/3xxx/CVE-2023-3005.json b/2023/3xxx/CVE-2023-3005.json new file mode 100644 index 00000000000..c0d20cf233d --- /dev/null +++ b/2023/3xxx/CVE-2023-3005.json @@ -0,0 +1,106 @@ +{ + "data_version": "4.0", + "data_type": "CVE", + "data_format": "MITRE", + "CVE_data_meta": { + "ID": "CVE-2023-3005", + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "A vulnerability, which was classified as problematic, was found in SourceCodester Local Service Search Engine Management System 1.0. This affects an unknown part of the file /admin/ajax.php?action=save_area of the component POST Parameter Handler. The manipulation of the argument area with the input leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-230349 was assigned to this vulnerability." + }, + { + "lang": "deu", + "value": "Es wurde eine problematische Schwachstelle in SourceCodester Local Service Search Engine Management System 1.0 gefunden. Betroffen hiervon ist ein unbekannter Ablauf der Datei /admin/ajax.php?action=save_area der Komponente POST Parameter Handler. Durch das Beeinflussen des Arguments area mit der Eingabe mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Cross Site Scripting", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "SourceCodester", + "product": { + "product_data": [ + { + "product_name": "Local Service Search Engine Management System", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "1.0" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.230349", + "refsource": "MISC", + "name": "https://vuldb.com/?id.230349" + }, + { + "url": "https://vuldb.com/?ctiid.230349", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.230349" + }, + { + "url": "https://github.com/sikii7/CVE/blob/main/XSS.md", + "refsource": "MISC", + "name": "https://github.com/sikii7/CVE/blob/main/XSS.md" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "sikii (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 3.5, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "baseSeverity": "LOW" + }, + { + "version": "3.0", + "baseScore": 3.5, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "baseSeverity": "LOW" + }, + { + "version": "2.0", + "baseScore": 4, + "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", + "baseSeverity": "MEDIUM" + } + ] + } +} \ No newline at end of file diff --git a/2023/3xxx/CVE-2023-3006.json b/2023/3xxx/CVE-2023-3006.json new file mode 100644 index 00000000000..f4724ff3e2a --- /dev/null +++ b/2023/3xxx/CVE-2023-3006.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2023-3006", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file