admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-05-05 10:18:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

"-Synchronized-Data."

Browse Source
This commit is contained in:
CVE Team 2021-12-29 15:01:11 +00:00
parent a300fbb6f6
commit cd768e0d4b
No known key found for this signature in database
GPG Key ID: 5708902F06FEF743
4 changed files with 192 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
2017/1002xxx/CVE-2017-1002201.json
View File

@ -63,6 +63,11 @@
"refsource": "GENTOO",
"name": "GLSA-202007-27",
"url": "https://security.gentoo.org/glsa/202007-27"
},
{
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211229 [SECURITY] [DLA 2864-1] ruby-haml security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/12/msg00028.html"
}
]
},

5
2021/35xxx/CVE-2021-35448.json
View File

@ -61,6 +61,11 @@
"url": "https://www.exploit-db.com/exploits/50047",
"refsource": "MISC",
"name": "https://www.exploit-db.com/exploits/50047"
},
{
"refsource": "MISC",
"name": "https://leobreaker1411.github.io/blog/cve-2021-35448",
"url": "https://leobreaker1411.github.io/blog/cve-2021-35448"
}
]
}

97
2021/36xxx/CVE-2021-36722.json
View File

@ -1,18 +1,103 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "cna@cyber.gov.il",
"DATE_PUBLIC": "2021-12-28T11:43:00.000Z",
"ID": "CVE-2021-36722",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Emuse - eServices / eNvoice SQL injection "
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "eServices / eNvoice",
"version": {
"version_data": [
{
"version_name": "Production",
"version_value": "Production"
}
]
}
}
]
},
"vendor_name": "Emuse"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Simon Kenin - ClearSky Cyber Security Ltd."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on the affected endpoints. The SQLi caused by CWE-209: Generation of Error Message Containig Sensetive Information, showing parts of the aspx code and the webroot location , information an attacker can leverage to further compromise the host."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.gov.il/en/departments/faq/cve_advisories",
"refsource": "CONFIRM",
"url": "https://www.gov.il/en/departments/faq/cve_advisories"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The sql injection vulnerability was fixed by Escaping All User-Supplied Input"
}
],
"source": {
"advisory": "ILVN-2021-0007",
"defect": [
"ILVN-2021-0007"
],
"discovery": "EXTERNAL"
}
}

97
2021/36xxx/CVE-2021-36723.json
View File

@ -1,18 +1,103 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "cna@cyber.gov.il",
"DATE_PUBLIC": "2021-12-28T11:43:00.000Z",
"ID": "CVE-2021-36723",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Emuse - eServices / eNvoice Exposure Of Private Personal Information"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "eServices / eNvoice",
"version": {
"version_data": [
{
"version_name": "Production",
"version_value": "Production"
}
]
}
}
]
},
"vendor_name": "Emuse"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Simon Kenin - ClearSky Cyber Security Ltd."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all the files on the service."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-359 Exposure of Private Information ('Privacy Violation')"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.gov.il/en/departments/faq/cve_advisories",
"refsource": "CONFIRM",
"url": "https://www.gov.il/en/departments/faq/cve_advisories"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs vulnerability was fixed by adding securety mechanisms and randomising the IDs."
}
],
"source": {
"advisory": "ILVN-2021-0008",
"defect": [
"ILVN-2021-0008"
],
"discovery": "EXTERNAL"
}
}