mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-29 05:56:59 +00:00
Adding TWCERT/CC id CVE-2019-11064 and ids from CVE-2019-13405 to CVE-2019-13408
This commit is contained in:
yinnping
parent
b4d5fc1678
commit
cc2354debd
@ -1,18 +1,88 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-11064",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-11064",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "A vulnerability of remote credential disclosure was discovered in Advan VD-1"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Advan VD-1",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "firmware",
|
||||
"version_value": "230"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AndroVideo"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Keniver Wang (CHT Security) "
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "A vulnerability of remote credential disclosure was discovered in Advan VD-1. An attacker can export system configuration which is not encrypted to get the administrator’s account and password in plain text without any authentication."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-200 Information Exposure"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906005",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906005"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/gCDQN",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/gCDQN"
|
||||
},
|
||||
{
|
||||
"name": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
88
2019/13xxx/CVE-2019-13405.json
Normal file
88
2019/13xxx/CVE-2019-13405.json
Normal file
@ -0,0 +1,88 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-13405",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Advan VD-1 allows a remote user to enable Android Debug Bridge without any authentication"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Advan VD-1",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_name": "firmware",
|
||||
"version_value": "230"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AndroVideo"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Keniver Wang (CHT Security) "
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "VD-1 provides developer to use ADB for debugging. Although VD-1 disabled this feature in default, an attacker can send a POST request to cgibin/AdbSetting.cgi to enable ADB then take the compromised device as a relay or to install mining software."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Insecure remote ADB service"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906006",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906006"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/VeNHn",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/VeNHn"
|
||||
},
|
||||
{
|
||||
"name": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
88
2019/13xxx/CVE-2019-13406.json
Normal file
88
2019/13xxx/CVE-2019-13406.json
Normal file
@ -0,0 +1,88 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-13406",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Advan VD-1 has a vulnerability that allows remote arbitrary APK installation"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Advan VD-1",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "firmware",
|
||||
"version_value": "230"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AndroVideo"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Keniver Wang (CHT Security) "
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "VD-1 provides a web UI for system administrators to install APK in remote. An attacker can send a POST request to cgibin/ApkUpload.cgi to install arbitrary APK without any authentication."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Broken access control"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906007",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906007"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/hVut7",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/hVut7"
|
||||
},
|
||||
{
|
||||
"name": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
88
2019/13xxx/CVE-2019-13407.json
Normal file
88
2019/13xxx/CVE-2019-13407.json
Normal file
@ -0,0 +1,88 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-13407",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Advan VD-1 has a reflected XSS vulnerability in page cgibin/ssi.cgi"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Advan VD-1",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "firmware",
|
||||
"version_value": "230"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AndroVideo"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Keniver Wang (CHT Security) "
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-79 Cross-site Scripting (XSS)"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906008",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906008"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/SpTwh",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/SpTwh"
|
||||
},
|
||||
{
|
||||
"name": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
88
2019/13xxx/CVE-2019-13408.json
Normal file
88
2019/13xxx/CVE-2019-13408.json
Normal file
@ -0,0 +1,88 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@cert.org.tw",
|
||||
"DATE_PUBLIC": "2019-08-20T16:00:00.000Z",
|
||||
"ID": "CVE-2019-13408",
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "Advan VD-1 allows users to download arbitrary files"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "Advan VD-1",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "<=",
|
||||
"version_name": "firmware",
|
||||
"version_value": "230"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "AndroVideo"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Keniver Wang (CHT Security) "
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "VD-1 has a feature that allows administrators to download system configuration file. It also allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.7"
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-23 Relative Path Traversal"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"name": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906009",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://tvn.twcert.org.tw/taiwanvn/TVN-201906009"
|
||||
},
|
||||
{
|
||||
"name": "http://surl.twcert.org.tw/2bvXq",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "http://surl.twcert.org.tw/2bvXq"
|
||||
},
|
||||
{
|
||||
"name": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md",
|
||||
"refsource": "CONFIRM",
|
||||
"url": "https://gist.github.com/keniver/f5155b42eb278ec0273b83565b64235b#file-androvideo-advan-vd-1-multiple-vulnerabilities-md"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user