admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-08-04 08:44:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

"-Synchronized-Data."

Browse Source
This commit is contained in:
CVE Team 2023-11-16 21:00:37 +00:00
parent 60f42bc7d8
commit d63ac6de03
No known key found for this signature in database
GPG Key ID: E3252B3D49582C98
2 changed files with 168 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

91
2023/46xxx/CVE-2023-46213.json
View File

@ -1,17 +1,100 @@
{
"data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2023-46213",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ASSIGNER": "prodsec@splunk.com",
"STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the \u201cShow syntax Highlighted\u201d feature can result in the execution of unauthorized code in a user\u2019s web browser."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.",
"cweId": "CWE-79"
}
]
}
]
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Splunk",
"product": {
"product_data": [
{
"product_name": "Splunk Enterprise",
"version": {
"version_data": [
{
"version_affected": "<",
"version_name": "9.0",
"version_value": "9.0.7"
},
{
"version_affected": "<",
"version_name": "9.1",
"version_value": "9.1.2"
}
]
}
},
{
"product_name": "Splunk Cloud",
"version": {
"version_data": [
{
"version_affected": "<",
"version_name": "-",
"version_value": "9.1.2308"
}
]
}
}
]
}
}
]
}
},
"references": {
"reference_data": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2023-1103",
"refsource": "MISC",
"name": "https://advisory.splunk.com/advisories/SVD-2023-1103"
}
]
},
"source": {
"advisory": "SVD-2023-1103"
},
"credits": [
{
"lang": "en",
"value": "Joshua Neubecker"
}
],
"impact": {
"cvss": [
{
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1",
"baseScore": 4.8,
"baseSeverity": "MEDIUM"
}
]
}

85
2023/46xxx/CVE-2023-46214.json
View File

@ -1,17 +1,94 @@
{
"data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2023-46214",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ASSIGNER": "prodsec@splunk.com",
"STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code execution on the Splunk Enterprise instance."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.",
"cweId": "CWE-91"
}
]
}
]
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Splunk",
"product": {
"product_data": [
{
"product_name": "Splunk Enterprise",
"version": {
"version_data": [
{
"version_affected": "<",
"version_name": "9.0",
"version_value": "9.0.7"
},
{
"version_affected": "<",
"version_name": "9.1",
"version_value": "9.1.2"
}
]
}
},
{
"product_name": "Splunk Cloud",
"version": {
"version_data": [
{
"version_affected": "<",
"version_name": "-",
"version_value": "9.1.2308"
}
]
}
}
]
}
}
]
}
},
"references": {
"reference_data": [
{
"url": "https://advisory.splunk.com/advisories/SVD-2023-1104",
"refsource": "MISC",
"name": "https://advisory.splunk.com/advisories/SVD-2023-1104"
}
]
},
"source": {
"advisory": "SVD-2023-1104"
},
"impact": {
"cvss": [
{
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1",
"baseScore": 8,
"baseSeverity": "HIGH"
}
]
}