mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-06-19 17:32:41 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
fab4df1860
commit
cf4d452bf4
@ -81,6 +81,11 @@
|
||||
"refsource": "SUSE",
|
||||
"name": "openSUSE-SU-2020:1620",
|
||||
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00012.html"
|
||||
},
|
||||
{
|
||||
"refsource": "SUSE",
|
||||
"name": "openSUSE-SU-2020:1628",
|
||||
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00013.html"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,61 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-4325",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-4325",
|
||||
"ASSIGNER": "psirt@hcl.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "n/a",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "\"HCL AppScan Enterprise \"",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "\"10.0.1 and below\""
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "\"Security Misconfiguration\""
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0082503",
|
||||
"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0082503"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "\"HCL AppScan Enterprise makes use of broken or risky cryptographic algorithm to store REST API user details.\""
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,61 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"ID": "CVE-2019-4326",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2019-4326",
|
||||
"ASSIGNER": "psirt@hcl.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "n/a",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "\"HCL AppScan Enterprise \"",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "\"10.0.0 and below\""
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "\"Security Misconfiguration\""
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0082505",
|
||||
"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0082505"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "\"HCL AppScan Enterprise security rules update administration section of the web application console is missing HTTP Strict-Transport-Security Header.\""
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -41,7 +41,7 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites.\n\nThe issue is patched in versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1\n\nAs a workaround sandbox all your iframes using the sandbox attribute. This will prevent them creating top-frame navigations and is good practice anyway."
|
||||
"value": "In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 As a workaround sandbox all your iframes using the sandbox attribute. This will prevent them creating top-frame navigations and is good practice anyway."
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -1,17 +1,76 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-24807",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ID": "CVE-2020-24807",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "n/a",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "** UNSUPPORTED WHEN ASSIGNED ** The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.npmjs.com/package/socket.io-file",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.npmjs.com/package/socket.io-file"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/rico345100/socket.io-file",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/rico345100/socket.io-file"
|
||||
},
|
||||
{
|
||||
"url": "https://www.npmjs.com/advisories/1564",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.npmjs.com/advisories/1564"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/advisories/GHSA-6495-8jvh-f28x",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/advisories/GHSA-6495-8jvh-f28x"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,8 +1,10 @@
|
||||
{
|
||||
"CVE_data_meta": {
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"DATE_PUBLIC": "2020-09-17T00:00:00.000Z",
|
||||
"ID": "CVE-2020-8782",
|
||||
"STATE": "PUBLIC"
|
||||
"STATE": "PUBLIC",
|
||||
"TITLE": "ALEOS LAN-Side RPC Service Remote Code Execution"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
@ -27,6 +29,12 @@
|
||||
]
|
||||
}
|
||||
},
|
||||
"credit": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Sierra Wireless thanks Ruben Santamarta, Principal Security Consultant at IOActive for the responsible disclosure of these vulnerabilities."
|
||||
}
|
||||
],
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
@ -34,10 +42,29 @@
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "Sierra Wireless ALEOS through 4.4.8, through 4.9.4, and through 4.11 allows remote code execution."
|
||||
"value": "Unauthenticated RPC server on ALEOS before 4.4.9, 4.9.5, and 4.14.0 allows remote code execution."
|
||||
}
|
||||
]
|
||||
},
|
||||
"generator": {
|
||||
"engine": "Vulnogram 0.0.9"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": {
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.5,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"version": "3.1"
|
||||
}
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
@ -53,15 +80,18 @@
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://www.sierrawireless.com/company/security/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.sierrawireless.com/company/security/"
|
||||
"refsource": "CONFIRM",
|
||||
"name": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-005/",
|
||||
"url": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-005/"
|
||||
},
|
||||
{
|
||||
"url": "https://source.sierrawireless.com/resources/airlink/software_reference_docs/release-notes/aleos-4,-d-,12,-d-,0-release-notes/",
|
||||
"refsource": "MISC",
|
||||
"name": "https://source.sierrawireless.com/resources/airlink/software_reference_docs/release-notes/aleos-4,-d-,12,-d-,0-release-notes/"
|
||||
"url": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-005/",
|
||||
"name": "https://source.sierrawireless.com/resources/security-bulletins/sierra-wireless-technical-bulletin---swi-psa-2020-005/"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"discovery": "EXTERNAL"
|
||||
}
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user