admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-06-12 02:05:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-merge PR#8355

Browse Source 
Auto-merge PR#8355
This commit is contained in:
CVE Team 2022-12-22 04:30:25 -05:00 committed by GitHub
commit c08bbe6611
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 128 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

70
2020/36xxx/CVE-2020-36624.json
View File

@ -4,14 +4,78 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2020-36624",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"TITLE": "ahorner text-helpers translation.rb reverse tabnabbing",
"REQUESTER": "cna@vuldb.com",
"ASSIGNER": "cna@vuldb.com",
"STATE": "PUBLIC"
},
"generator": "vuldb.com",
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "ahorner",
"product": {
"product_data": [
{
"product_name": "text-helpers",
"version": {
"version_data": [
{
"version_value": "1.1.0"
},
{
"version_value": "1.1.1"
}
]
}
}
]
}
}
]
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-266 Incorrect Privilege Assignment -> CWE-1022 Use of Web Link to Untrusted Target with window.opener Access"
}
]
}
]
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "A vulnerability was found in ahorner text-helpers 1.1.0\/1.1.1. It has been declared as critical. This vulnerability affects unknown code of the file lib\/text_helpers\/translation.rb. The manipulation of the argument link leads to use of web link to untrusted target with window.opener access. The attack can be initiated remotely. Upgrading to version 1.2.0 is able to address this issue. The name of the patch is 184b60ded0e43c985788582aca2d1e746f9405a3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216520."
}
]
},
"impact": {
"cvss": {
"version": "3.1",
"baseScore": "6.3",
"vectorString": "CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:L\/I:L\/A:L"
}
},
"references": {
"reference_data": [
{
"url": "https:\/\/github.com\/ahorner\/text-helpers\/pull\/19"
},
{
"url": "https:\/\/github.com\/ahorner\/text-helpers\/releases\/tag\/v1.2.0"
},
{
"url": "https:\/\/github.com\/ahorner\/text-helpers\/commit\/184b60ded0e43c985788582aca2d1e746f9405a3"
},
{
"url": "https:\/\/vuldb.com\/?id.216520"
}
]
}

64
2020/36xxx/CVE-2020-36625.json
View File

@ -4,14 +4,72 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2020-36625",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"TITLE": "destiny.gg chat main.go websocket.Upgrader cross-site request forgery",
"REQUESTER": "cna@vuldb.com",
"ASSIGNER": "cna@vuldb.com",
"STATE": "PUBLIC"
},
"generator": "vuldb.com",
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "destiny.gg",
"product": {
"product_data": [
{
"product_name": "chat",
"version": {
"version_data": [
{
"version_value": "n\/a"
}
]
}
}
]
}
}
]
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863 Incorrect Authorization -> CWE-862 Missing Authorization -> CWE-352 Cross-Site Request Forgery"
}
]
}
]
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is bebd256fc3063111fb4503ca25e005ebf6e73780. It is recommended to apply a patch to fix this issue. The identifier VDB-216521 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer."
}
]
},
"impact": {
"cvss": {
"version": "3.1",
"baseScore": "4.3",
"vectorString": "CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:R\/S:U\/C:N\/I:L\/A:N"
}
},
"references": {
"reference_data": [
{
"url": "https:\/\/github.com\/destinygg\/chat\/pull\/35"
},
{
"url": "https:\/\/github.com\/destinygg\/chat\/commit\/bebd256fc3063111fb4503ca25e005ebf6e73780"
},
{
"url": "https:\/\/vuldb.com\/?id.216521"
}
]
}