admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-07-29 05:56:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'master' into cna/Oracle/CPU2022Jul3rd

Browse Source
This commit is contained in:
bsitu 2022-07-20 07:56:14 -07:00 committed by GitHub
commit d65c6a81ab
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
71 changed files with 4634 additions and 215 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
2021/31xxx/CVE-2021-31858.json
View File

@ -1,17 +1,66 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-31858",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ID": "CVE-2021-31858",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "DotNetNuke (DNN) 9.9.1 CMS is vulnerable to a Stored Cross-Site Scripting vulnerability in the user profile biography section which allows remote authenticated users to inject arbitrary code via a crafted payload."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://www.dnnsoftware.com/community/security/security-center",
"refsource": "MISC",
"name": "https://www.dnnsoftware.com/community/security/security-center"
},
{
"refsource": "MISC",
"name": "https://labs.integrity.pt/advisories/cve-2021-31858/",
"url": "https://labs.integrity.pt/advisories/cve-2021-31858/"
}
]
}

62
2021/46xxx/CVE-2021-46828.json Normal file
View File

@ -0,0 +1,62 @@
{
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-46828",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lead to an svc_run infinite loop without accepting new connections."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "http://git.linux-nfs.org/?p=steved/libtirpc.git;a=commit;h=86529758570cef4c73fb9b9c4104fdc510f701ed",
"refsource": "MISC",
"name": "http://git.linux-nfs.org/?p=steved/libtirpc.git;a=commit;h=86529758570cef4c73fb9b9c4104fdc510f701ed"
}
]
}
}

192
2022/22xxx/CVE-2022-22202.json
View File

@ -1,18 +1,196 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "sirt@juniper.net",
"DATE_PUBLIC": "2022-07-13T16:00:00.000Z",
"ID": "CVE-2022-22202",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Junos OS: PTX Series: FPCs may restart unexpectedly upon receipt of specific MPLS packets with certain multi-unit interface configurations"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Junos OS",
"version": {
"version_data": [
{
"platform": "PTX Series",
"version_affected": "<",
"version_value": "19.1R3-S9"
},
{
"platform": "PTX Series",
"version_affected": "<",
"version_name": "19.2",
"version_value": "19.2R3-S6"
},
{
"platform": "PTX Series",
"version_affected": "<",
"version_name": "19.3",
"version_value": "19.3R3-S6"
},
{
"platform": "PTX Series",
"version_affected": "<",
"version_name": "19.4",
"version_value": "19.4R3-S8"
},
{
"platform": "PTX Series",
"version_affected": "<",
"version_name": "20.1",
"version_value": "20.1R3-S4"
},
{
"platform": "PTX Series",
"version_affected": "<",
"version_name": "20.2",
"version_value": "20.2R3-S5"
},
{
"platform": "PTX Series",
"version_affected": "<",
"version_name": "20.3",
"version_value": "20.3R3-S4"
},
{
"platform": "PTX Series",
"version_affected": "<",
"version_name": "20.4",
"version_value": "20.4R3-S4"
},
{
"platform": "PTX Series",
"version_affected": "<",
"version_name": "21.1",
"version_value": "21.1R3-S2"
},
{
"platform": "PTX Series",
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R3-S1"
},
{
"platform": "PTX Series",
"version_affected": "<",
"version_name": "21.3",
"version_value": "21.3R3"
},
{
"platform": "PTX Series",
"version_affected": "<",
"version_name": "21.4",
"version_value": "21.4R2"
},
{
"platform": "PTX Series",
"version_affected": "<",
"version_name": "22.1",
"version_value": "22.1R2"
}
]
}
}
]
},
"vendor_name": "Juniper Networks"
}
]
}
},
"configuration": [
{
"lang": "eng",
"value": "The FPC crash only occurs if specific MPLS packets are received on an interface with multiple units configured and at least one unit has 'family mpls' not configured. Also, the first unit with family mpls configured is not the lowest numerical unit on that interface.\n\nA sample vulnerable configuration utilizing multiple units on an interface with MPLS enabled is shown below:\n\n set interfaces et-0/0/37:2 vlan-tagging\n set interfaces et-0/0/37:2 unit 0 vlan-id 0 <<< 'family mpls' not configured\n set interfaces et-0/0/37:2 unit 5 vlan-id 3000\n set interfaces et-0/0/37:2 unit 5 family inet6 address fe80::ce1/64\n set interfaces et-0/0/37:2 unit 7 vlan-id 3032\n set interfaces et-0/0/37:2 unit 7 family inet address 169.254.101.23/31\n set interfaces et-0/0/37:2 unit 7 family inet6\n set interfaces et-0/0/37:2 unit 7 family mpls <<< 'family' mpls configured, but not the lowest unit number\n set interfaces et-0/0/37:2 unit 10 vlan-id 10\n set interfaces et-0/0/37:2 unit 10 family inet address 192.168.10.1/24\n set interfaces et-0/0/37:2 unit 10 family iso\n set interfaces et-0/0/37:2 unit 10 family mpls\n..."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "An Improper Handling of Exceptional Conditions vulnerability on specific PTX Series devices, including the PTX1000, PTX3000 (NextGen), PTX5000, PTX10002-60C, PTX10008, and PTX10016 Series, in Juniper Networks Junos OS allows an unauthenticated MPLS-based attacker to cause a Denial of Service (DoS) by triggering the dcpfe process to crash and FPC to restart. On affected PTX Series devices, processing specific MPLS packets received on an interface with multiple units configured may cause FPC to restart unexpectedly. Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.\n\nThis issue only affects PTX Series devices utilizing specific FPCs found on PTX1000, PTX3000 (NextGen), PTX5000, PTX10002-60C, PTX10008, and PTX10016 Series devices, only if multiple units are configured on the ingress interface, and at least one unit has 'family mpls' *not* configured. See the configuration sample below for more information.\n\nNo other platforms are affected by this vulnerability.\nThis issue affects:\nJuniper Networks Junos OS on PTX Series:\nAll versions prior to 19.1R3-S9;\n19.2 versions prior to 19.2R3-S6;\n19.3 versions prior to 19.3R3-S6;\n19.4 versions prior to 19.4R3-S8;\n20.1 versions prior to 20.1R3-S4;\n20.2 versions prior to 20.2R3-S5;\n20.3 versions prior to 20.3R3-S4;\n20.4 versions prior to 20.4R3-S4;\n21.1 versions prior to 21.1R3-S2;\n21.2 versions prior to 21.2R3-S1;\n21.3 versions prior to 21.3R3;\n21.4 versions prior to 21.4R2;\n22.1 versions prior to 22.1R2.\n"
}
]
}
},
"exploit": [
{
"lang": "eng",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-755 Improper Handling of Exceptional Conditions"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (DoS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kb.juniper.net/JSA69706",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA69706"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The following software releases have been updated to resolve this specific issue: Junos OS 19.1R3-S9, 19.2R3-S6, 19.3R3-S6, 19.4R3-S8, 20.1R3-S4, 20.2R3-S5, 20.3R3-S4, 20.4R3-S4, 21.1R3-S2, 21.2R3-S1, 21.3R3, 21.4R2, 22.1R2, 22.2R1, and all subsequent releases."
}
],
"source": {
"advisory": "JSA69706",
"defect": [
"1649586"
],
"discovery": "USER"
},
"work_around": [
{
"lang": "eng",
"value": "The FPC crash only occurs if specific MPLS packets are received on an interface with multiple units configured and at least one unit has family mpls not configured. Also, the first unit with family mpls configured is not the lowest numerical unit on that interface.\n\nA viable config-based workaround would be to reorder the unit numbers on core-facing interfaces to ensure the numerically lowest unit has 'family mpls' configured.\n"
}
]
}

120
2022/22xxx/CVE-2022-22203.json
View File

@ -1,18 +1,124 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "sirt@juniper.net",
"DATE_PUBLIC": "2022-07-13T16:00:00.000Z",
"ID": "CVE-2022-22203",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Junos OS: EX4600 Series and QFX5000 Series: Receipt of specific traffic will lead to an fxpc process crash followed by an FPC reboot "
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Junos OS",
"version": {
"version_data": [
{
"platform": "EX4600 Series, QFX5000 Series",
"version_affected": "<",
"version_name": "19.4",
"version_value": "19.4R3-S5"
},
{
"platform": "EX4600 Series, QFX5000 Series",
"version_affected": "!<",
"version_value": "19.4R3-S4"
}
]
}
}
]
},
"vendor_name": "Juniper Networks"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "An Incorrect Comparison vulnerability in PFE of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a Denial of Service (DoS).\n\nOn QFX5000 Series, and EX4600 and EX4650 platforms, the fxpc process will crash followed by the FPC reboot upon receipt of a specific hostbound packet. Continued receipt of these specific packets will create a sustained Denial of Service (DoS) condition.\nThis issue only affects Juniper Networks Junos OS 19.4 version 19.4R3-S4."
}
]
}
},
"exploit": [
{
"lang": "eng",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-697 Incorrect Comparison"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (DoS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kb.juniper.net/JSA69707",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA69707"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The following software releases have been updated to resolve this specific issue: 19.4R3-S5, and all subsequent releases."
}
],
"source": {
"advisory": "JSA69707",
"defect": [
"1629178"
],
"discovery": "USER"
},
"work_around": [
{
"lang": "eng",
"value": "There are no viable workarounds for this issue."
}
]
}

144
2022/22xxx/CVE-2022-22204.json
View File

@ -1,18 +1,148 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "sirt@juniper.net",
"DATE_PUBLIC": "2022-07-13T16:00:00.000Z",
"ID": "CVE-2022-22204",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Junos OS: MX Series and SRX Series: When receiving a specific SIP packets stale call table entries are created which eventually leads to a DoS for all SIP traffic"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Junos OS",
"version": {
"version_data": [
{
"platform": "SRX Series, MX Series",
"version_affected": "<",
"version_name": "20.4",
"version_value": "20.4R3-S2"
},
{
"platform": "SRX Series, MX Series",
"version_affected": "<",
"version_name": "21.1",
"version_value": "21.1R3-S2"
},
{
"platform": "SRX Series, MX Series",
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R2-S2"
},
{
"platform": "SRX Series, MX Series",
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R3"
},
{
"platform": "SRX Series, MX Series",
"version_affected": "<",
"version_name": "21.3",
"version_value": "21.3R2"
},
{
"platform": "SRX Series, MX Series",
"version_affected": "<",
"version_name": "21.4",
"version_value": "21.4R2"
},
{
"platform": "SRX Series, MX Series",
"version_affected": "!<",
"version_value": "20.4R1"
}
]
}
}
]
},
"vendor_name": "Juniper Networks"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "An Improper Release of Memory Before Removing Last Reference vulnerability in the Session Initiation Protocol (SIP) Application Layer Gateway (ALG) of Juniper Networks Junos OS allows unauthenticated network-based attacker to cause a partial Denial of Service (DoS).\n\nOn all MX and SRX platforms, if the SIP ALG is enabled, receipt of a specific SIP packet will create a stale SIP entry. Sustained receipt of such packets will cause the SIP call table to eventually fill up and cause a DoS for all SIP traffic.\nThe SIP call usage can be monitored by \"show security alg sip calls\".\n\nTo be affected the SIP ALG needs to be enabled, either implicitly / by default or by way of configuration. Please verify on SRX with:\n\n user@host> show security alg status | match sip\n SIP : Enabled\n\nPlease verify on MX whether the following is configured:\n\n [ services ... rule <rule-name> (term <term-name>) from/match application/application-set <name> ]\n\nwhere either\n\n a. name = junos-sip or\n\nan application or application-set refers to SIP:\n\n b. [ applications application <name> application-protocol sip ] or\n\n c. [ applications application-set <name> application junos-sip ]\nThis issue affects Juniper Networks Junos OS on SRX Series and MX Series:\n20.4 versions prior to 20.4R3-S2;\n21.1 versions prior to 21.1R3-S2;\n21.2 versions prior to 21.2R2-S2;\n21.2 versions prior to 21.2R3;\n21.3 versions prior to 21.3R2;\n21.4 versions prior to 21.4R2.\n\nThis issue does not affect Juniper Networks Junos OS versions prior to 20.4R1.\n\nJuniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
]
}
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-401 Improper Release of Memory Before Removing Last Reference"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (DoS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kb.juniper.net/JSA69708",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA69708"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The following software releases have been updated to resolve this specific issue: 20.4R3-S2, 21.1R3-S2, 21.2R2-S2, 21.2R3, 21.3R2, 21.4R2, 22.1R1, and all subsequent releases."
}
],
"source": {
"advisory": "JSA69708",
"defect": [
"1622455"
],
"discovery": "USER"
},
"work_around": [
{
"lang": "eng",
"value": "There are no known workarounds for this issue, but it should be considered to disable the SIP ALG if it's not strictly needed."
}
]
}

144
2022/22xxx/CVE-2022-22205.json
View File

@ -1,18 +1,148 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "sirt@juniper.net",
"DATE_PUBLIC": "2022-07-13T07:00:00.000Z",
"ID": "CVE-2022-22205",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Junos OS: SRX Series: An FPC memory leak can occur in an APBR scenario"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Junos OS",
"version": {
"version_data": [
{
"platform": "SRX Series",
"version_affected": "<",
"version_name": "20.3",
"version_value": "20.3R3-S2"
},
{
"platform": "SRX Series",
"version_affected": "<",
"version_name": "20.4",
"version_value": "20.4R3-S2"
},
{
"platform": "SRX Series",
"version_affected": "<",
"version_name": "21.1",
"version_value": "21.1R3"
},
{
"platform": "SRX Series",
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R2-S1, 21.2R3"
},
{
"platform": "SRX Series",
"version_affected": "<",
"version_name": "21.3",
"version_value": "21.3R1-S2, 21.3R2"
},
{
"platform": "SRX Series",
"version_affected": "!<",
"version_value": "20.3R1"
}
]
}
}
]
},
"vendor_name": "Juniper Networks"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "A Missing Release of Memory after Effective Lifetime vulnerability in the Application Quality of Experience (appqoe) subsystem of the PFE of Juniper Networks Junos OS on SRX Series allows an unauthenticated network based attacker to cause a Denial of Service (DoS).\n\nUpon receiving specific traffic a memory leak will occur. Sustained processing of such specific traffic will eventually lead to an out of memory condition that prevents all services from continuing to function, and requires a manual restart to recover.\n\nA device is only vulnerable when advance(d) policy based routing (APBR) is configured and AppQoE (sla rule) is not configured for these APBR rules.\nThis issue affects Juniper Networks Junos OS on SRX Series:\n20.3 versions prior to 20.3R3-S2;\n20.4 versions prior to 20.4R3-S2;\n21.1 versions prior to 21.1R3;\n21.2 versions prior to 21.2R2-S1, 21.2R3;\n21.3 versions prior to 21.3R1-S2, 21.3R2.\n\nThis issue does not affect Juniper Networks Junos OS versions prior to 20.3R1."
}
]
}
},
"exploit": [
{
"lang": "eng",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-401 Missing Release of Memory after Effective Lifetime"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (DoS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kb.juniper.net/JSA69709",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA69709"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The following software releases have been updated to resolve this specific issue: 20.3R3-S2, 20.4R3-S2, 21.1R3, 21.2R2-S1, 21.2R3, 21.3R1-S2, 21.3R2, 21.4R1, and all subsequent releases.\n"
}
],
"source": {
"advisory": "JSA69709",
"defect": [
"1628090"
],
"discovery": "USER"
},
"work_around": [
{
"lang": "eng",
"value": "There are no viable workarounds for this issue."
}
]
}

155
2022/22xxx/CVE-2022-22206.json
View File

@ -1,18 +1,159 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "sirt@juniper.net",
"DATE_PUBLIC": "2022-07-13T16:00:00.000Z",
"ID": "CVE-2022-22206",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Junos OS: SRX series: The PFE will crash when specific traffic is scanned by Enhanced Web Filtering safe-search"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Junos OS",
"version": {
"version_data": [
{
"platform": "SRX Series",
"version_affected": "<",
"version_name": "20.2",
"version_value": "20.2R3-S4"
},
{
"platform": "SRX Series",
"version_affected": "<",
"version_name": "20.3",
"version_value": "20.3R3-S3"
},
{
"platform": "SRX Series",
"version_affected": "<",
"version_name": "20.4",
"version_value": "20.4R3-S3"
},
{
"platform": "SRX Series",
"version_affected": "<",
"version_name": "21.1",
"version_value": "21.1R3-S1"
},
{
"platform": "SRX Series",
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R2-S2, 21.2R3"
},
{
"platform": "SRX Series",
"version_affected": "<",
"version_name": "21.3",
"version_value": "21.3R2"
},
{
"platform": "SRX Series",
"version_affected": "<",
"version_name": "21.4",
"version_value": "21.4R2"
},
{
"version_affected": "!<",
"version_value": "20.2R1"
}
]
}
}
]
},
"vendor_name": "Juniper Networks"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "A Buffer Overflow vulnerability in the PFE of Juniper Networks Junos OS on SRX series allows an unauthenticated network based attacker to cause a Denial of Service (DoS).\n\nThe PFE will crash when specific traffic is scanned by Enhanced Web Filtering safe-search feature of UTM (Unified Threat management). Continued receipt of this specific traffic will create a sustained Denial of Service (DoS) condition.\nThis issue affects Juniper Networks Junos OS:\n20.2 versions prior to 20.2R3-S4 on SRX Series;\n20.3 versions prior to 20.3R3-S3 on SRX Series;\n20.4 versions prior to 20.4R3-S3 on SRX Series;\n21.1 versions prior to 21.1R3-S1 on SRX Series;\n21.2 versions prior to 21.2R2-S2, 21.2R3 on SRX Series;\n21.3 versions prior to 21.3R2 on SRX Series;\n21.4 versions prior to 21.4R2 on SRX Series.\n\nThis issue does not affect Juniper Networks Junos OS versions prior to 20.2R1."
}
]
}
},
"exploit": [
{
"lang": "eng",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (DoS)"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-120 Buffer Overflow"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kb.juniper.net/JSA69710",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA69710"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The following software releases have been updated to resolve this specific issue: 20.2R3-S4, 20.3R3-S3, 20.4R3-S3, 21.1R3-S1, 21.2R2-S2, 21.2R3, 21.3R2, 21.4R2, 22.1R1, and all subsequent releases.\n\nNote: Only those releases listed in the PROBLEM section above are affected. This fix has also been proactively committed into other releases that are not vulnerable to this issue."
}
],
"source": {
"advisory": "JSA69710",
"defect": [
"1594638"
],
"discovery": "USER"
},
"work_around": [
{
"lang": "eng",
"value": "Disable UTM EWF safe-search by adding the no-safe-search config. Example:\n set security utm default-configuration web-filtering juniper-enhanced no-safe-search \n set security utm feature-profile web-filtering juniper-enhanced profile test-profile no-safe-search\n"
}
]
}

151
2022/22xxx/CVE-2022-22207.json
View File

@ -1,18 +1,155 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "sirt@juniper.net",
"DATE_PUBLIC": "2022-07-13T16:00:00.000Z",
"ID": "CVE-2022-22207",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Junos OS: MX Series with MPC11: In a GNF / node slicing scenario gathering AF interface statistics can lead to a kernel crash"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Junos OS",
"version": {
"version_data": [
{
"platform": "MX Series",
"version_affected": ">",
"version_name": "20.1",
"version_value": "20.1R1"
},
{
"platform": "MX Series",
"version_affected": "<",
"version_name": "20.2",
"version_value": "20.2R3-S5"
},
{
"platform": "MX Series",
"version_affected": "<",
"version_name": "20.3",
"version_value": "20.3R3-S4"
},
{
"platform": "MX Series",
"version_affected": "<",
"version_name": "20.4",
"version_value": "20.4R3"
},
{
"platform": "MX Series",
"version_affected": "<",
"version_name": "21.1",
"version_value": "21.1R2"
},
{
"platform": "MX Series",
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R2"
}
]
}
}
]
},
"vendor_name": "Juniper Networks"
}
]
}
},
"configuration": [
{
"lang": "eng",
"value": "For this issue to exist the following configuration is required:\n\n [ chassis network-slices ]"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "A Use After Free vulnerability in the Advanced Forwarding Toolkit (AFT) manager process (aftmand) of Juniper Networks Junos OS allows an unauthenticated networked attacker to cause a kernel crash due to intensive polling of Abstracted Fabric (AF) interface statistics and thereby a Denial of Service (DoS). Continued gathering of AF interface statistics will create a sustained Denial of Service (DoS) condition.\nThis issue affects Juniper Networks Junos OS on MX Series:\n20.1 versions later than 20.1R1;\n20.2 versions prior to 20.2R3-S5;\n20.3 versions prior to 20.3R3-S4;\n20.4 versions prior to 20.4R3;\n21.1 versions prior to 21.1R2;\n21.2 versions prior to 21.2R2."
}
]
}
},
"exploit": [
{
"lang": "eng",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-416 Use After Free"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (DoS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kb.juniper.net/JSA69711",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA69711"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The following Junos OS software releases have been updated to resolve this specific issue Junos OS: 20.2R3-S5, 20.3R3-S4, 20.4R3, 21.1R2, 21.2R2, 21.3R1, and all subsequent releases."
}
],
"source": {
"advisory": "JSA69711",
"defect": [
"1602531"
],
"discovery": "USER"
},
"work_around": [
{
"lang": "eng",
"value": "There are no viable workarounds for this issue.\nTo reduce the risk of exploitation of this issue, use access lists or firewall filters to limit access to only trusted networks, hosts and users."
}
]
}

122
2022/22xxx/CVE-2022-22209.json
View File

@ -1,18 +1,126 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "sirt@juniper.net",
"DATE_PUBLIC": "2022-07-13T16:00:00.000Z",
"ID": "CVE-2022-22209",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Junos OS: RIB and PFEs can get out of sync due to a memory leak caused by interface flaps or route churn"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Junos OS",
"version": {
"version_data": [
{
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R3"
},
{
"version_affected": "<",
"version_name": "21.3",
"version_value": "21.3R2-S1, 21.3R3"
},
{
"version_affected": "<",
"version_name": "21.4",
"version_value": "21.4R1-S2, 21.4R2"
},
{
"version_affected": "!<",
"version_value": "21.2R1"
}
]
}
}
]
},
"vendor_name": "Juniper Networks"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "A Missing Release of Memory after Effective Lifetime vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated network based attacker to cause a Denial of Service (DoS).\n\nOn all Junos platforms, the Kernel Routing Table (KRT) queue can get stuck due to a memory leak triggered by interface flaps or route churn leading to RIB and PFEs getting out of sync. The memory leak causes RTNEXTHOP/route and next-hop memory pressure issue and the KRT queue will eventually get stuck with the error- 'ENOMEM -- Cannot allocate memory'. The out-of-sync state between RIB and FIB can be seen with the \"show route\" and \"show route forwarding-table\" command. This issue will lead to failures for adding new routes.\n\nThe KRT queue status can be checked using the CLI command \"show krt queue\": \n \n user@host > show krt state \n High-priority add queue: 1 queued \n ADD nhtype Router index 0 (31212) \n error 'ENOMEM -- Cannot allocate memory' \n kqp '0x8ad5e40' \n \nThe following messages will be observed in /var/log/messages, which indicate high memory for routes/nexthops: \n\n host rpd[16279]: RPD_RT_HWM_NOTICE: New RIB highwatermark for routes: 266 [2022-03-04 05:06:07] \n host rpd[16279]: RPD_KRT_Q_RETRIES: nexthop ADD: Cannot allocate memory \n host rpd[16279]: RPD_KRT_Q_RETRIES: nexthop ADD: Cannot allocate memory \n host kernel: rts_veto_net_delayed_unref_limit: Route/nexthop memory is severe pressure. User Application to perform recovery actions. O p 8 err 12, rtsm_id 0:-1, msg type 10, veto simulation: 0. \n host kernel: rts_veto_net_delayed_unref_limit: Memory usage of M_RTNEXTHOP type = (806321208) Max size possible for M_RTNEXTHOP type = (689432176) Current delayed unref = (0), Max delayed unref on this platform = (120000) Current delayed weight unref = (0) Max delayed weight unref on this platform = (400000) curproc = rpd.\nThis issue affects:\nJuniper Networks Junos OS\n21.2 versions prior to 21.2R3;\n21.3 versions prior to 21.3R2-S1, 21.3R3;\n21.4 versions prior to 21.4R1-S2, 21.4R2;\n\nThis issue does not affect Juniper Networks Junos OS versions prior to 21.2R1."
}
]
}
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-401 Improper Release of Memory Before Removing Last Reference"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (DoS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kb.juniper.net/JSA69713",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA69713"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The following software releases have been updated to resolve this specific issue: 21.2R3, 21.3R2-S1, 21.3R3, 21.4R1-S2, 21.4R2, 22.1R1, and all subsequent releases.\nNote: Only those releases listed in the PROBLEM section above are affected. This fix has also been proactively committed into other releases that are not vulnerable to this issue."
}
],
"source": {
"advisory": "JSA69713",
"defect": [
"1642172"
],
"discovery": "USER"
},
"work_around": [
{
"lang": "eng",
"value": "There are no known workarounds for this issue."
}
]
}

142
2022/22xxx/CVE-2022-22210.json
View File

@ -1,18 +1,146 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "sirt@juniper.net",
"DATE_PUBLIC": "2022-07-13T16:00:00.000Z",
"ID": "CVE-2022-22210",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Junos OS: QFX5000 Series and MX Series: An l2alm crash leading to an FPC crash can be observed in VxLAN scenario"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Junos OS",
"version": {
"version_data": [
{
"platform": "QFX5000 Series, MX Series",
"version_affected": "<",
"version_name": "20.3",
"version_value": "20.3R3-S3"
},
{
"platform": "QFX5000 Series, MX Series",
"version_affected": "<",
"version_name": "20.4",
"version_value": "20.4R3-S2"
},
{
"platform": "QFX5000 Series, MX Series",
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R2-S1"
},
{
"version_affected": "!<",
"version_value": "20.3R1"
},
{
"version_affected": "!>=",
"version_name": "21.1",
"version_value": "21.1R1"
}
]
}
}
]
},
"vendor_name": "Juniper Networks"
}
]
}
},
"configuration": [
{
"lang": "eng",
"value": "For a device to be affected a VxLAN configuration like in the following examples will need to be present:\n\n [ vlans vlan-name vxlan … ]\nor\n [ bridge-domains bridge-domain-name vxlan… ]\n"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "A NULL Pointer Dereference vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on QFX5000 Series and MX Series allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS).\n\nOn QFX5K Series and MX Series, when the PFE receives a specific VxLAN packet the Layer 2 Address Learning Manager (L2ALM) process will crash leading to an FPC reboot. Continued receipt of this specific packet will create a sustained Denial of Service (DoS) condition.\nThis issue affects Juniper Networks Junos OS on QFX5000 Series, MX Series:\n20.3 versions prior to 20.3R3-S3;\n20.4 versions prior to 20.4R3-S2;\n21.2 versions prior to 21.2R2-S1.\n\nThis issue does not affect Juniper Networks Junos OS:\nAll versions prior to 20.3R1;\n21.1 version 21.1R1 and later versions."
}
]
}
},
"exploit": [
{
"lang": "eng",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-476 NULL Pointer Dereference"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (DoS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kb.juniper.net/JSA69714",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA69714"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The following software releases have been updated to resolve this specific issue: 20.3R3-S3, 20.4R3-S2, 21.2R2-S1, and all subsequent releases.\n"
}
],
"source": {
"advisory": "JSA69714",
"defect": [
"1636853"
],
"discovery": "USER"
},
"work_around": [
{
"lang": "eng",
"value": "There are no viable workarounds for this issue."
}
]
}

123
2022/22xxx/CVE-2022-22212.json
View File

@ -1,18 +1,127 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "sirt@juniper.net",
"DATE_PUBLIC": "2022-07-13T16:00:00.000Z",
"ID": "CVE-2022-22212",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Junos OS Evolved: A high rate of specific hostbound traffic will cause unexpected hostbound traffic delays or drops "
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Junos OS Evolved",
"version": {
"version_data": [
{
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R3-EVO"
},
{
"version_affected": "<",
"version_name": "21.3",
"version_value": "21.3R2-EVO"
},
{
"version_affected": "!<",
"version_value": "21.2R1-EVO"
}
]
}
}
]
},
"vendor_name": "Juniper Networks"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "An Allocation of Resources Without Limits or Throttling vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved allows unauthenticated network based attacker to cause a Denial of Service (DoS).\nOn all Junos Evolved platforms hostbound protocols will be impacted by a high rate of specific hostbound traffic from ports on a PFE. Continued receipt of this amount of traffic will create a sustained Denial of Service (DoS) condition.\nThis issue affects Juniper Networks Junos OS Evolved:\n21.2 versions prior to 21.2R3-EVO;\n21.3 versions prior to 21.3R2-EVO.\n\nThis issue does not affect Juniper Networks Junos OS Evolved versions prior to 21.2R1."
}
]
}
},
"exploit": [
{
"lang": "eng",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-770 Allocation of Resources Without Limits or Throttling"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (DoS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kb.juniper.net/JSA69716",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA69716"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The following software releases have been updated to resolve this specific issue: 21.2R3-EVO, 21.3R2-EVO, 21.4R1-EVO, and all subsequent releases."
}
],
"source": {
"advisory": "JSA69716",
"defect": [
"1627344"
],
"discovery": "USER"
},
"work_around": [
{
"lang": "eng",
"value": "There are no viable workarounds for this issue.\nTo reduce the risk of exploitation of this issue, use access lists or firewall filters to limit access to only trusted networks, hosts and users."
}
]
}

170
2022/22xxx/CVE-2022-22213.json
View File

@ -1,18 +1,174 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "sirt@juniper.net",
"DATE_PUBLIC": "2022-07-13T16:00:00.000Z",
"ID": "CVE-2022-22213",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Junos OS and Junos OS Evolved: Denial of Service (DoS) vulnerability in RPD upon receipt of specific BGP update"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Junos OS",
"version": {
"version_data": [
{
"version_affected": "<",
"version_name": "21.1",
"version_value": "21.1R3-S1"
},
{
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R2-S2, 21.2R3"
},
{
"version_affected": "<",
"version_name": "21.3",
"version_value": "21.3R2, 21.3R3"
},
{
"version_affected": "<",
"version_name": "21.4",
"version_value": "21.4R1-S1, 21.4R2"
},
{
"version_affected": "!<",
"version_value": "21.1"
}
]
}
},
{
"product_name": "Junos OS Evolved",
"version": {
"version_data": [
{
"version_affected": "<",
"version_name": "21.1",
"version_value": "21.1R3-S1-EVO"
},
{
"version_affected": ">=",
"version_name": "21.2",
"version_value": "21.2R1-EVO"
},
{
"version_affected": "<",
"version_name": "21.3",
"version_value": "21.3R3-EVO"
},
{
"version_affected": "<",
"version_name": "21.4",
"version_value": "21.4R1-S1-EVO, 21.4R2-EVO"
},
{
"version_affected": "!<",
"version_value": "21.1-EVO"
}
]
}
}
]
},
"vendor_name": "Juniper Networks"
}
]
}
},
"configuration": [
{
"lang": "eng",
"value": "A sample configuration of BGP multipath is shown below:\n\n set protocols bgp group external type external\n set protocols bgp group external peer-as 64501\n set protocols bgp group external multipath\n set protocols bgp group external neighbor 10.0.1.1\n set protocols bgp group external neighbor 10.0.0.2\n set policy-options policy-statement loadbal from route-filter 10.0.0.0/16 orlonger\n set policy-options policy-statement loadbal then load-balance per-packet\n set routing-options forwarding-table export loadbal\n set routing-options autonomous-system 64500"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "A vulnerability in Handling of Undefined Values in the routing protocol daemon (RPD) process of Juniper Networks Junos OS and Junos OS Evolved may allow an unauthenticated network-based attacker to crash the RPD process by sending a specific BGP update while the system is under heavy load, leading to a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition.\n\nMalicious exploitation of this issue requires a very specific combination of load, timing, and configuration of the vulnerable system which is beyond the direct control of the attacker. Internal reproduction has only been possible through artificially created load and specially instrumented source code.\n\nSystems are only vulnerable to this issue if BGP multipath is enabled. Routers not configured for BGP multipath are not vulnerable to this issue.\n\nThis issue affects:\nJuniper Networks Junos OS:\n21.1 versions prior to 21.1R3-S1;\n21.2 versions prior to 21.2R2-S2, 21.2R3;\n21.3 versions prior to 21.3R2, 21.3R3;\n21.4 versions prior to 21.4R1-S1, 21.4R2.\n\nJuniper Networks Junos OS Evolved:\n21.1 versions prior to 21.1R3-S1-EVO;\n21.2 version 21.2R1-EVO and later versions;\n21.3 versions prior to 21.3R3-EVO;\n21.4 versions prior to 21.4R1-S1-EVO, 21.4R2-EVO.\n\nThis issue does not affect:\nJuniper Networks Junos OS versions prior to 21.1.\nJuniper Networks Junos OS Evolved versions prior to 21.1-EVO."
}
]
}
},
"exploit": [
{
"lang": "eng",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-232 Improper Handling of Undefined Values"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (DoS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kb.juniper.net/JSA69717",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA69717"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The following software releases have been updated to resolve this specific issue: \n\nJunos OS Evolved: 21.1R3-S1-EVO, 21.3R3-EVO, 21.4R1-S1-EVO, 21.4R2-EVO, 22.1R1-EVO\nJunos OS: 21.1R3-S1, 21.2R2-S2, 21.2R3, 21.3R2, 21.4R1-S1, 21.4R2, 22.1R1, and all subsequent releases.\n"
}
],
"source": {
"advisory": "JSA69717",
"defect": [
"1642741"
],
"discovery": "USER"
},
"work_around": [
{
"lang": "eng",
"value": "Disable BGP multipath, or configure 'set protocols bgp multipath-build deferred'.\n"
}
]
}

211
2022/22xxx/CVE-2022-22214.json
View File

@ -1,18 +1,215 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "sirt@juniper.net",
"DATE_PUBLIC": "2022-07-13T16:00:00.000Z",
"ID": "CVE-2022-22214",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Junos OS and Junos OS Evolved: In an MPLS scenario upon receipt of a specific IPv6 packet an FPC will crash"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Junos OS",
"version": {
"version_data": [
{
"version_affected": "<",
"version_value": "12.3R12-S21"
},
{
"version_affected": "<",
"version_name": "15.1",
"version_value": "15.1R7-S10"
},
{
"version_affected": "<",
"version_name": "17.3",
"version_value": "17.3R3-S12"
},
{
"version_affected": "<",
"version_name": "18.3",
"version_value": "18.3R3-S6"
},
{
"version_affected": "<",
"version_name": "18.4",
"version_value": "18.4R2-S9, 18.4R3-S9"
},
{
"version_affected": "<",
"version_name": "19.1",
"version_value": "19.1R2-S3, 19.1R3-S7"
},
{
"version_affected": "<",
"version_name": "19.2",
"version_value": "19.2R1-S7, 19.2R3-S3"
},
{
"version_affected": "<",
"version_name": "19.3",
"version_value": "19.3R2-S7, 19.3R3-S4"
},
{
"version_affected": "<",
"version_name": "19.4",
"version_value": "19.4R3-S5"
},
{
"version_affected": "<",
"version_name": "20.1",
"version_value": "20.1R3"
},
{
"version_affected": "<",
"version_name": "20.2",
"version_value": "20.2R3-S2"
},
{
"version_affected": "<",
"version_name": "20.3",
"version_value": "20.3R3"
},
{
"version_affected": "<",
"version_name": "20.4",
"version_value": "20.4R2-S2, 20.4R3"
},
{
"version_affected": "<",
"version_name": "21.1",
"version_value": "21.1R2"
}
]
}
},
{
"product_name": "Junos OS Evolved",
"version": {
"version_data": [
{
"version_affected": "<",
"version_value": "20.4R3-S3-EVO"
},
{
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R3-EVO"
},
{
"version_affected": "<",
"version_name": "21.3",
"version_value": "21.3R2-S1-EVO, 21.3R3-EVO"
},
{
"version_affected": "<",
"version_name": "21.4",
"version_value": "21.4R2-EVO"
}
]
}
}
]
},
"vendor_name": "Juniper Networks"
}
]
}
},
"configuration": [
{
"lang": "eng",
"value": "For a device to be affected both of the following two lines of configuration need to be present on at least two revenue interfaces:\n\n [ interfaces <interface> family mpls ]\n [ interfaces <interface> family inet6 ]"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "An Improper Input Validation vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent attacker to cause a PFE crash and thereby a Denial of Service (DoS).\n\nAn FPC will crash and reboot after receiving a specific transit IPv6 packet over MPLS. Continued receipt of this packet will create a sustained Denial of Service (DoS) condition.\nThis issue does not affect systems configured for IPv4 only.\nThis issue affects:\nJuniper Networks Junos OS\nAll versions prior to 12.3R12-S21;\n15.1 versions prior to 15.1R7-S10;\n17.3 versions prior to 17.3R3-S12;\n18.3 versions prior to 18.3R3-S6;\n18.4 versions prior to 18.4R2-S9, 18.4R3-S9;\n19.1 versions prior to 19.1R2-S3, 19.1R3-S7;\n19.2 versions prior to 19.2R1-S7, 19.2R3-S3;\n19.3 versions prior to 19.3R2-S7, 19.3R3-S4;\n19.4 versions prior to 19.4R3-S5;\n20.1 versions prior to 20.1R3;\n20.2 versions prior to 20.2R3-S2;\n20.3 versions prior to 20.3R3;\n20.4 versions prior to 20.4R2-S2, 20.4R3;\n21.1 versions prior to 21.1R2.\n\nJuniper Networks Junos OS Evolved\nAll versions prior to 20.4R3-S3-EVO;\n21.2 versions prior to 21.2R3-EVO;\n21.3 versions prior to 21.3R2-S1-EVO, 21.3R3-EVO;\n21.4 versions prior to 21.4R2-EVO."
}
]
}
},
"exploit": [
{
"lang": "eng",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-20 Improper Input Validation"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (DoS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kb.juniper.net/JSA69718",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA69718"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The following software releases have been updated to resolve this specific issue: 12.3R12-S21, 15.1R7-S10, 17.3R3-S12, 18.3R3-S6, 18.4R2-S9, 18.4R3-S9, 19.1R2-S3, 19.1R3-S7, 19.2R1-S7, 19.2R3-S3, 19.3R2-S7, 19.3R3-S4, 19.4R3-S5, 20.1R3, 20.2R3-S2, 20.3R3, 20.4R2-S2, 20.4R3, 21.1R2, 21.2R1, and all subsequent releases.\nJunos OS Evolved: 20.4R3-S3-EVO, 21.2R3-EVO, 21.3R2-S1-EVO, 21.3R3-EVO, 21.4R2-EVO, 22.1R1-EVO, and all subsequent releases."
}
],
"source": {
"advisory": "JSA69718",
"defect": [
"1578481",
"1642721"
],
"discovery": "USER"
},
"work_around": [
{
"lang": "eng",
"value": "There are no viable workarounds for this issue."
}
]
}

185
2022/22xxx/CVE-2022-22215.json
View File

@ -1,18 +1,189 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "sirt@juniper.net",
"DATE_PUBLIC": "2022-07-13T16:00:00.000Z",
"ID": "CVE-2022-22215",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Junos OS and Junos OS Evolved: /var/run/<pid>.env files are potentially not deleted during termination of a gRPC connection causing inode exhaustion"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Junos OS",
"version": {
"version_data": [
{
"version_affected": "<",
"version_value": "19.1R3-S8"
},
{
"version_affected": "<",
"version_name": "19.2",
"version_value": "19.2R3-S6"
},
{
"version_affected": "<",
"version_name": "19.3",
"version_value": "19.3R3-S5"
},
{
"version_affected": "<",
"version_name": "19.4",
"version_value": "19.4R2-S6, 19.4R3-S7"
},
{
"version_affected": ">=",
"version_name": "20.1",
"version_value": "20.1R1"
},
{
"version_affected": "<",
"version_name": "20.2",
"version_value": "20.2R3-S5"
},
{
"version_affected": "<",
"version_name": "20.3",
"version_value": "20.3R3-S4"
},
{
"version_affected": "<",
"version_name": "20.4",
"version_value": "20.4R3"
},
{
"version_affected": "<",
"version_name": "21.1",
"version_value": "21.1R3"
},
{
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R2"
}
]
}
},
{
"product_name": "Junos OS Evolved",
"version": {
"version_data": [
{
"version_affected": "<",
"version_value": "20.4R3-EVO"
},
{
"version_affected": "<",
"version_name": "21.1",
"version_value": "21.1R3-S1-EVO"
},
{
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R1-S1-EVO, 21.2R2-EVO"
}
]
}
}
]
},
"vendor_name": "Juniper Networks"
}
]
}
},
"configuration": [
{
"lang": "eng",
"value": "To be affected by this issue the system needs to be configured for gRPC:\n\n [ system services extension-service request-response grpc ]"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "A Missing Release of File Descriptor or Handle after Effective Lifetime vulnerability in plugable authentication module (PAM) of Juniper Networks Junos OS and Junos OS Evolved allows a locally authenticated attacker with low privileges to cause a Denial of Service (DoS).\n\nIt is possible that after the termination of a gRPC connection the respective/var/run/<pid>.env file is not getting deleted which if occurring repeatedly can cause inode exhaustion.\n\nInode exhaustion can present itself in two different ways:\n\n1. The following log message can be observed:\n host kernel: pid <pid> (<process>), uid <uid> inumber <number> on /.mount/var: out of inodes\nwhich by itself is a clear indication.\n\n2. The following log message can be observed:\n host <process>[<pid>]: ... : No space left on device\nwhich is not deterministic and just a representation of a write error which could have several reasons. So the following check needs to be done:\n\n user@host> show system storage no-forwarding\n Filesystem Size Used Avail Capacity Mounted on\n /dev/ada1p1 475M 300M 137M 69% /.mount/var\n\nwhich indicates that the write error is not actually due to a lack of disk space.\n\nIf either 1. or 2. has been confirmed, then the output of:\n\nuser@host> file list /var/run/*.env | count\n\nneed to be checked and if it indicates a high (>10000) number of files the system has been affected by this issue.\nThis issue affects:\nJuniper Networks Junos OS\nAll versions prior to 19.1R3-S8;\n19.2 versions prior to 19.2R3-S6;\n19.3 versions prior to 19.3R3-S5;\n19.4 versions prior to 19.4R2-S6, 19.4R3-S7;\n20.1 version 20.1R1 and later versions;\n20.2 versions prior to 20.2R3-S5;\n20.3 versions prior to 20.3R3-S4;\n20.4 versions prior to 20.4R3;\n21.1 versions prior to 21.1R3;\n21.2 versions prior to 21.2R2.\n\nJuniper Networks Junos OS Evolved\nAll versions prior to 20.4R3-EVO;\n21.1 versions prior to 21.1R3-S1-EVO;\n21.2 versions prior to 21.2R1-S1-EVO, 21.2R2-EVO."
}
]
}
},
"exploit": [
{
"lang": "eng",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "775"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (DoS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kb.juniper.net/JSA69719",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA69719"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The following software releases have been updated to resolve this specific issue: \nJunos OS: 19.1R3-S8, 19.2R3-S6, 19.3R3-S5, 19.4R2-S6, 19.4R3-S7, 20.2R3-S5, 20.3R3-S4, 20.4R3, 21.1R3, 21.2R2, 21.3R1, and all subsequent releases;\nJunos OS Evolved: 20.4R3-EVO, 21.1R3-S1-EVO, 21.2R1-S1-EVO, 21.2R2-EVO, 21.3R1-EVO, and all subsequent releases.\n"
}
],
"source": {
"advisory": "JSA69719",
"defect": [
"1604157"
],
"discovery": "USER"
},
"work_around": [
{
"lang": "eng",
"value": "There are no viable workarounds for this issue.\nTo reduce the risk of exploitation use access lists or firewall filters to the device only from trusted, administrative networks or hosts."
}
]
}

245
2022/22xxx/CVE-2022-22216.json
View File

@ -1,18 +1,249 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "sirt@juniper.net",
"DATE_PUBLIC": "2022-07-13T07:00:00.000Z",
"ID": "CVE-2022-22216",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Junos OS: PTX Series and QFX10000 Series: 'Etherleak' memory disclosure in Ethernet padding data "
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Junos OS",
"version": {
"version_data": [
{
"platform": "PTX1000, PTX10000 Series",
"version_affected": "<",
"version_value": "18.4R3-S11"
},
{
"platform": "PTX1000, PTX10000 Series",
"version_affected": "<",
"version_name": "19.1",
"version_value": "19.1R2-S3, 19.1R3-S7"
},
{
"platform": "PTX1000, PTX10000 Series",
"version_affected": "<",
"version_name": "19.2",
"version_value": "19.2R1-S8, 19.2R3-S4"
},
{
"platform": "PTX1000, PTX10000 Series",
"version_affected": "<",
"version_name": "19.3",
"version_value": "19.3R3-S4"
},
{
"platform": "PTX1000, PTX10000 Series",
"version_affected": "<",
"version_name": "19.4",
"version_value": "19.4R2-S5, 19.4R3-S6"
},
{
"platform": "PTX1000, PTX10000 Series",
"version_affected": "<",
"version_name": "20.1",
"version_value": "20.1R3-S2"
},
{
"platform": "PTX1000, PTX10000 Series",
"version_affected": "<",
"version_name": "20.2",
"version_value": "20.2R3-S3"
},
{
"platform": "PTX1000, PTX10000 Series",
"version_affected": "<",
"version_name": "20.3",
"version_value": "20.3R3-S2"
},
{
"platform": "PTX1000, PTX10000 Series",
"version_affected": "<",
"version_name": "20.4",
"version_value": "20.4R3-S4"
},
{
"platform": "PTX1000, PTX10000 Series",
"version_affected": "<",
"version_name": "21.1",
"version_value": "21.1R2-S1, 21.1R3"
},
{
"platform": "PTX1000, PTX10000 Series",
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R1-S1, 21.2R2"
}
]
}
},
{
"product_name": "Junos OS",
"version": {
"version_data": [
{
"platform": "QFX10000 Series, PTX5000 Series",
"version_affected": "<",
"version_value": "18.3R3-S6"
},
{
"platform": "QFX10000 Series, PTX5000 Series",
"version_affected": "<",
"version_name": "18.4",
"version_value": "18.4R2-S9, 18.4R3-S10"
},
{
"platform": "QFX10000 Series, PTX5000 Series",
"version_affected": "<",
"version_name": "19.1",
"version_value": "19.1R2-S3, 19.1R3-S7"
},
{
"platform": "QFX10000 Series, PTX5000 Series",
"version_affected": "<",
"version_name": "19.2",
"version_value": "19.2R1-S8, 19.2R3-S4"
},
{
"platform": "QFX10000 Series, PTX5000 Series",
"version_affected": "<",
"version_name": "19.3",
"version_value": "19.3R3-S4"
},
{
"platform": "QFX10000 Series, PTX5000 Series",
"version_affected": "<",
"version_name": "19.4",
"version_value": "19.4R2-S6, 19.4R3-S6"
},
{
"platform": "QFX10000 Series, PTX5000 Series",
"version_affected": "<",
"version_name": "20.1",
"version_value": "20.1R3-S2"
},
{
"platform": "QFX10000 Series, PTX5000 Series",
"version_affected": "<",
"version_name": "20.2",
"version_value": "20.2R3-S3"
},
{
"platform": "QFX10000 Series, PTX5000 Series",
"version_affected": "<",
"version_name": "20.3",
"version_value": "20.3R3-S1"
},
{
"platform": "QFX10000 Series, PTX5000 Series",
"version_affected": "<",
"version_name": "20.4",
"version_value": "20.4R3-S1"
},
{
"platform": "QFX10000 Series, PTX5000 Series",
"version_affected": "<",
"version_name": "21.1",
"version_value": "21.1R2-S1, 21.1R3"
},
{
"platform": "QFX10000 Series, PTX5000 Series",
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R2"
}
]
}
}
]
},
"vendor_name": "Juniper Networks"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the PFE of Juniper Networks Junos OS on PTX Series and QFX10k Series allows an adjacent unauthenticated attacker to gain access to sensitive information.\n\nPTX1000 and PTX10000 Series, and QFX10000 Series and PTX5000 Series devices sometimes do not reliably pad Ethernet packets, and thus some packets can contain fragments of system memory or data from previous packets. This issue is also known as 'Etherleak' and often detected as CVE-2003-0001.\nThis issue affects:\nJuniper Networks Junos OS on PTX1000 and PTX10000 Series:\nAll versions prior to 18.4R3-S11;\n19.1 versions prior to 19.1R2-S3, 19.1R3-S7;\n19.2 versions prior to 19.2R1-S8, 19.2R3-S4;\n19.3 versions prior to 19.3R3-S4;\n19.4 versions prior to 19.4R2-S5, 19.4R3-S6;\n20.1 versions prior to 20.1R3-S2;\n20.2 versions prior to 20.2R3-S3;\n20.3 versions prior to 20.3R3-S2;\n20.4 versions prior to 20.4R3-S4;\n21.1 versions prior to 21.1R2-S1, 21.1R3;\n21.2 versions prior to 21.2R1-S1, 21.2R2.\n\nJuniper Networks Junos OS on QFX10000 Series and PTX5000 Series:\nAll versions prior to 18.3R3-S6;\n18.4 versions prior to 18.4R2-S9, 18.4R3-S10;\n19.1 versions prior to 19.1R2-S3, 19.1R3-S7;\n19.2 versions prior to 19.2R1-S8, 19.2R3-S4;\n19.3 versions prior to 19.3R3-S4;\n19.4 versions prior to 19.4R2-S6, 19.4R3-S6;\n20.1 versions prior to 20.1R3-S2;\n20.2 versions prior to 20.2R3-S3;\n20.3 versions prior to 20.3R3-S1;\n20.4 versions prior to 20.4R3-S1;\n21.1 versions prior to 21.1R2-S1, 21.1R3;\n21.2 versions prior to 21.2R2."
}
]
}
},
"exploit": [
{
"lang": "eng",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kb.juniper.net/JSA69720",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA69720"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The following software releases have been updated to resolve this specific issue for Junos OS on PTX1000 and PTX10000 Series: 18.4R3-S11, 19.1R2-S3, 19.1R3-S7, 19.2R1-S8, 19.2R3-S4, 19.3R3-S4, 19.4R2-S5, 19.4R3-S6, 20.1R3-S2, 20.2R3-S3, 20.3R3-S2, 20.4R3-S4, 21.1R2-S1, 21.1R3, 21.2R1-S1, 21.2R2, 21.2R3, 21.3R1, and all subsequent releases.\n\nThe following software releases have been updated to resolve this specific issue for Junos OS on QFX10000 Series and PTX5000 Series: 18.3R3-S6 ,18.4R2-S9, 18.4R3-S10, 19.1R2-S3, 19.1R3-S7, 19.2R1-S8, 19.2R3-S4, 19.3R3-S4, 19.4R2-S6, 19.4R3-S6, 20.1R3-S2, 20.2R3-S3, 20.3R3-S1, 20.4R3-S1, 21.1R2-S1, 21.1R3, 21.2R2, 21.2R3, 21.3R1, and all subsequent releases."
}
],
"source": {
"advisory": "JSA69720",
"defect": [
"1603656",
"1609376"
],
"discovery": "USER"
},
"work_around": [
{
"lang": "eng",
"value": "There are no known workarounds for this issue."
}
]
}

174
2022/22xxx/CVE-2022-22217.json
View File

@ -1,18 +1,178 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "sirt@juniper.net",
"DATE_PUBLIC": "2022-07-13T16:00:00.000Z",
"ID": "CVE-2022-22217",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Junos OS: QFX10K Series: Denial of Service (DoS) upon receipt of crafted MLD packets on multi-homing ESI in VXLAN"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Junos OS",
"version": {
"version_data": [
{
"platform": "QFX10K Series",
"version_affected": "<",
"version_value": "19.1R3-S9"
},
{
"platform": "QFX10K Series",
"version_affected": "<",
"version_name": "19.2",
"version_value": "19.2R1-S9, 19.2R3-S5"
},
{
"platform": "QFX10K Series",
"version_affected": "<",
"version_name": "19.3",
"version_value": "19.3R3-S6"
},
{
"platform": "QFX10K Series",
"version_affected": "<",
"version_name": "19.4",
"version_value": "19.4R2-S, 19.4R3-S8"
},
{
"platform": "QFX10K Series",
"version_affected": "<",
"version_name": "20.1",
"version_value": "20.1R3-S4"
},
{
"platform": "QFX10K Series",
"version_affected": "<",
"version_name": "20.2",
"version_value": "20.2R3-S4"
},
{
"platform": "QFX10K Series",
"version_affected": "<",
"version_name": "20.3",
"version_value": "20.3R3-S2"
},
{
"platform": "QFX10K Series",
"version_affected": "<",
"version_name": "20.4",
"version_value": "20.4R3-S2"
},
{
"platform": "QFX10K Series",
"version_affected": "<",
"version_name": "21.1",
"version_value": "21.1R3"
},
{
"platform": "QFX10K Series",
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R2-S1, 21.2R3"
},
{
"platform": "QFX10K Series",
"version_affected": "<",
"version_name": "21.3",
"version_value": "21.3R2"
}
]
}
}
]
},
"vendor_name": "Juniper Networks"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a Denial of Service (DoS).\n\nThe issue is caused by malformed MLD packets looping on a multi-homed Ethernet Segment Identifier (ESI) when VXLAN is configured. These MLD packets received on a multi-homed ESI are sent to the peer, and then incorrectly forwarded out the same ESI, violating the split horizon rule.\nThis issue only affects QFX10K Series switches, including the QFX10002, QFX10008, and QFX10016. Other products and platforms are unaffected by this vulnerability.\nThis issue affects Juniper Networks Junos OS on QFX10K Series:\nAll versions prior to 19.1R3-S9;\n19.2 versions prior to 19.2R1-S9, 19.2R3-S5;\n19.3 versions prior to 19.3R3-S6;\n19.4 versions prior to 19.4R2-S, 19.4R3-S8;\n20.1 versions prior to 20.1R3-S4;\n20.2 versions prior to 20.2R3-S4;\n20.3 versions prior to 20.3R3-S2;\n20.4 versions prior to 20.4R3-S2;\n21.1 versions prior to 21.1R3;\n21.2 versions prior to 21.2R2-S1, 21.2R3;\n21.3 versions prior to 21.3R2."
}
]
}
},
"exploit": [
{
"lang": "eng",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-754 Improper Check for Unusual or Exceptional Conditions"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "Denial of Service (DoS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kb.juniper.net/JSA69721",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA69721"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The following software releases have been updated to resolve this specific issue: Junos OS 19.1R3-S9, 19.2R1-S9, 19.2R3-S5, 19.3R3-S6, 19.4R3-S8, 20.1R3-S4, 20.2R3-S4, 20.3R3-S2, 20.4R3-S2, 21.1R3, 21.2R2-S1, 21.2R3, 21.3R2, 21.4R1, and all subsequent releases."
}
],
"source": {
"advisory": "JSA69721",
"defect": [
"1579014"
],
"discovery": "USER"
},
"work_around": [
{
"lang": "eng",
"value": "There are no viable workarounds for this issue.\nService may be temporarily restored by disabling/enabling the IRB interface affected by this issue. Note that this will cause a temporary service interruption as the interface is flapped."
}
]
}

172
2022/22xxx/CVE-2022-22221.json
View File

@ -1,18 +1,176 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "sirt@juniper.net",
"DATE_PUBLIC": "2022-07-13T07:00:00.000Z",
"ID": "CVE-2022-22221",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Junos OS: SRX and EX Series: Local privilege escalation flaw in \"download\" functionality"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Junos OS",
"version": {
"version_data": [
{
"platform": "SRX Series, EX Series",
"version_affected": "<",
"version_value": "19.1R3-S9"
},
{
"platform": "SRX Series, EX Series",
"version_affected": "<",
"version_name": "19.2",
"version_value": "19.2R1-S9, 19.2R3-S5"
},
{
"platform": "SRX Series, EX Series",
"version_affected": "<",
"version_name": "19.3",
"version_value": "19.3R3-S6"
},
{
"platform": "SRX Series, EX Series",
"version_affected": "<",
"version_name": "19.4",
"version_value": "19.4R3-S8"
},
{
"platform": "SRX Series, EX Series",
"version_affected": "<",
"version_name": "20.1",
"version_value": "20.1R3-S4"
},
{
"platform": "SRX Series, EX Series",
"version_affected": "<",
"version_name": "20.2",
"version_value": "20.2R3-S4"
},
{
"platform": "SRX Series, EX Series",
"version_affected": "<",
"version_name": "20.3",
"version_value": "20.3R3-S3"
},
{
"platform": "SRX Series, EX Series",
"version_affected": "<",
"version_name": "20.4",
"version_value": "20.4R3-S2, 20.4R3-S3"
},
{
"platform": "SRX Series, EX Series",
"version_affected": "<",
"version_name": "21.1",
"version_value": "21.1R3-S1"
},
{
"platform": "SRX Series, EX Series",
"version_affected": "<",
"version_name": "21.2",
"version_value": "21.2R2-S2, 21.2R3"
},
{
"platform": "SRX Series, EX Series",
"version_affected": "<",
"version_name": "21.3",
"version_value": "21.3R2, 21.3R3"
},
{
"platform": "SRX Series, EX Series",
"version_affected": "<",
"version_name": "21.4",
"version_value": "21.4R1-S1, 21.4R2"
}
]
}
}
]
},
"vendor_name": "Juniper Networks"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "An Improper Neutralization of Special Elements vulnerability in the download manager of Juniper Networks Junos OS on SRX Series and EX Series allows a locally authenticated attacker with low privileges to take full control over the device.\n\nOne aspect of this vulnerability is that the attacker needs to be able to execute any of the \"request ...\" or \"show system download ...\" commands.\nThis issue affects Juniper Networks Junos OS on SRX Series and EX Series:\nAll versions prior to 19.2R1-S9, 19.2R3-S5;\n19.3 versions prior to 19.3R3-S6;\n19.4 versions prior to 19.4R3-S8;\n20.1 versions prior to 20.1R3-S4;\n20.2 versions prior to 20.2R3-S4;\n20.3 versions prior to 20.3R3-S3;\n20.4 versions prior to 20.4R3-S2, 20.4R3-S3;\n21.1 versions prior to 21.1R3-S1;\n21.2 versions prior to 21.2R2-S2, 21.2R3;\n21.3 versions prior to 21.3R2, 21.3R3;\n21.4 versions prior to 21.4R1-S1, 21.4R2."
}
]
}
},
"exploit": [
{
"lang": "eng",
"value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
}
],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "78"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kb.juniper.net/JSA69725",
"refsource": "CONFIRM",
"url": "https://kb.juniper.net/JSA69725"
}
]
},
"solution": [
{
"lang": "eng",
"value": "The following software releases have been updated to resolve this specific issue: 19.1R3-S9, 19.2R1-S9, 19.2R3-S5, 19.4R3-S8, 20.2R3-S4, 20.3R3-S3, 20.4R3-S2, 20.4R3-S3, 21.1R3-S1, 21.2R2-S2, 21.2R3, 21.3R2, 21.3R3, 21.4R1-S1, 21.4R2, 22.1R1, and all subsequent releases.\n"
}
],
"source": {
"advisory": "JSA69725",
"defect": [
"1632136"
],
"discovery": "USER"
},
"work_around": [
{
"lang": "eng",
"value": "A workaround would be to deny users access to the \"request system download ...\" and \"show system download ...\" CLI commands."
}
]
}

61
2022/24xxx/CVE-2022-24657.json
View File

@ -1,17 +1,66 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-24657",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ID": "CVE-2022-24657",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "Goldshell ASIC Miners v2.1.x was discovered to contain hardcoded credentials which allow attackers to remotely connect via the SSH protocol (port 22)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://github.com/goldshellminer/firmware",
"refsource": "MISC",
"name": "https://github.com/goldshellminer/firmware"
},
{
"refsource": "MISC",
"name": "https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit/",
"url": "https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit/"
}
]
}

61
2022/24xxx/CVE-2022-24659.json
View File

@ -1,17 +1,66 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-24659",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ID": "CVE-2022-24659",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "Goldshell ASIC Miners v2.2.1 and below was discovered to contain a path traversal vulnerability which allows unauthenticated attackers to retrieve arbitrary files from the device."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://github.com/goldshellminer/firmware",
"refsource": "MISC",
"name": "https://github.com/goldshellminer/firmware"
},
{
"refsource": "MISC",
"name": "https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit/",
"url": "https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit/"
}
]
}

61
2022/24xxx/CVE-2022-24660.json
View File

@ -1,17 +1,66 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-24660",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ID": "CVE-2022-24660",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers to access passwords and other sensitive information in plaintext."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://github.com/goldshellminer/firmware",
"refsource": "MISC",
"name": "https://github.com/goldshellminer/firmware"
},
{
"refsource": "MISC",
"name": "https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit/",
"url": "https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit/"
}
]
}

87
2022/2xxx/CVE-2022-2486.json Normal file
View File

@ -0,0 +1,87 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-2486",
"TITLE": "WAVLINK WN535K2/WN535K3 os command injection",
"REQUESTER": "cna@vuldb.com",
"ASSIGNER": "cna@vuldb.com",
"STATE": "PUBLIC"
},
"generator": "vuldb.com",
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "WAVLINK",
"product": {
"product_data": [
{
"product_name": "WN535K2",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
},
{
"product_name": "WN535K3",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
}
}
]
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78 OS Command Injection"
}
]
}
]
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade. The manipulation of the argument key leads to os command injection. The exploit has been disclosed to the public and may be used."
}
]
},
"impact": {
"cvss": {
"version": "3.1",
"baseScore": "8.0",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
},
"references": {
"reference_data": [
{
"url": "https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20mesh.cgi.md",
"refsource": "MISC",
"name": "https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20mesh.cgi.md"
},
{
"url": "https://vuldb.com/?id.204537",
"refsource": "MISC",
"name": "https://vuldb.com/?id.204537"
}
]
}
}

87
2022/2xxx/CVE-2022-2487.json Normal file
View File

@ -0,0 +1,87 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-2487",
"TITLE": "WAVLINK WN535K2/WN535K3 nightled.cgi os command injection",
"REQUESTER": "cna@vuldb.com",
"ASSIGNER": "cna@vuldb.com",
"STATE": "PUBLIC"
},
"generator": "vuldb.com",
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "WAVLINK",
"product": {
"product_data": [
{
"product_name": "WN535K2",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
},
{
"product_name": "WN535K3",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
}
}
]
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78 OS Command Injection"
}
]
}
]
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/nightled.cgi. The manipulation of the argument start_hour leads to os command injection. The exploit has been disclosed to the public and may be used."
}
]
},
"impact": {
"cvss": {
"version": "3.1",
"baseScore": "8.0",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
},
"references": {
"reference_data": [
{
"url": "https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20nightled.cgi%20.md",
"refsource": "MISC",
"name": "https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20nightled.cgi%20.md"
},
{
"url": "https://vuldb.com/?id.204538",
"refsource": "MISC",
"name": "https://vuldb.com/?id.204538"
}
]
}
}

87
2022/2xxx/CVE-2022-2488.json Normal file
View File

@ -0,0 +1,87 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-2488",
"TITLE": "WAVLINK WN535K2/WN535K3 touchlist_sync.cgi os command injection",
"REQUESTER": "cna@vuldb.com",
"ASSIGNER": "cna@vuldb.com",
"STATE": "PUBLIC"
},
"generator": "vuldb.com",
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "WAVLINK",
"product": {
"product_data": [
{
"product_name": "WN535K2",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
},
{
"product_name": "WN535K3",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
}
}
]
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78 OS Command Injection"
}
]
}
]
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlist_sync.cgi. The manipulation of the argument IP leads to os command injection. The exploit has been disclosed to the public and may be used."
}
]
},
"impact": {
"cvss": {
"version": "3.1",
"baseScore": "8.0",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
},
"references": {
"reference_data": [
{
"url": "https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20touchlist_sync.cgi.md",
"refsource": "MISC",
"name": "https://github.com/1angx/webray.com.cn/blob/main/Wavlink/Wavlink%20touchlist_sync.cgi.md"
},
{
"url": "https://vuldb.com/?id.204539",
"refsource": "MISC",
"name": "https://vuldb.com/?id.204539"
}
]
}
}

77
2022/2xxx/CVE-2022-2489.json Normal file
View File

@ -0,0 +1,77 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-2489",
"TITLE": "SourceCodester Simple E-Learning System classRoom.php sql injection",
"REQUESTER": "cna@vuldb.com",
"ASSIGNER": "cna@vuldb.com",
"STATE": "PUBLIC"
},
"generator": "vuldb.com",
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "SourceCodester",
"product": {
"product_data": [
{
"product_name": "Simple E-Learning System",
"version": {
"version_data": [
{
"version_value": "1.0"
}
]
}
}
]
}
}
]
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in SourceCodester Simple E-Learning System 1.0. It has been rated as critical. This issue affects some unknown processing of the file classRoom.php. The manipulation of the argument classCode with the input 1'||(SELECT 0x6770715a WHERE 8795=8795 AND (SELECT 8342 FROM(SELECT COUNT(*),CONCAT(0x7171786b71,(SELECT (ELT(8342=8342,1))),0x717a7a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a))||' leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used."
}
]
},
"impact": {
"cvss": {
"version": "3.1",
"baseScore": "6.3",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
},
"references": {
"reference_data": [
{
"url": "https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Simple-E-Learning-System.md",
"refsource": "MISC",
"name": "https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Simple-E-Learning-System.md"
},
{
"url": "https://vuldb.com/?id.204551",
"refsource": "MISC",
"name": "https://vuldb.com/?id.204551"
}
]
}
}

77
2022/2xxx/CVE-2022-2490.json Normal file
View File

@ -0,0 +1,77 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-2490",
"TITLE": "SourceCodester Simple E-Learning System search.php sql injection",
"REQUESTER": "cna@vuldb.com",
"ASSIGNER": "cna@vuldb.com",
"STATE": "PUBLIC"
},
"generator": "vuldb.com",
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "SourceCodester",
"product": {
"product_data": [
{
"product_name": "Simple E-Learning System",
"version": {
"version_data": [
{
"version_value": "1.0"
}
]
}
}
]
}
}
]
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability classified as critical has been found in SourceCodester Simple E-Learning System 1.0. Affected is an unknown function of the file search.php. The manipulation of the argument classCode with the input 1'||(SELECT 0x74666264 WHERE 5610=5610 AND (SELECT 7504 FROM(SELECT COUNT(*),CONCAT(0x7171627a71,(SELECT (ELT(7504=7504,1))),0x71717a7071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a))||' leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."
}
]
},
"impact": {
"cvss": {
"version": "3.1",
"baseScore": "6.3",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
},
"references": {
"reference_data": [
{
"url": "https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Simple-E-Learning-System.md#search.php",
"refsource": "MISC",
"name": "https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Simple-E-Learning-System.md#search.php"
},
{
"url": "https://vuldb.com/?id.204552",
"refsource": "MISC",
"name": "https://vuldb.com/?id.204552"
}
]
}
}

77
2022/2xxx/CVE-2022-2491.json Normal file
View File

@ -0,0 +1,77 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-2491",
"TITLE": "SourceCodester Library Management System lab.php sql injection",
"REQUESTER": "cna@vuldb.com",
"ASSIGNER": "cna@vuldb.com",
"STATE": "PUBLIC"
},
"generator": "vuldb.com",
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "SourceCodester",
"product": {
"product_data": [
{
"product_name": "Library Management System",
"version": {
"version_data": [
{
"version_value": "1.0"
}
]
}
}
]
}
}
]
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been found in SourceCodester Library Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file lab.php. The manipulation of the argument Section with the input 1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CONCAT(0x71716b7171,0x546e4444736b7743575a666d4873746a6450616261527a67627944426946507245664143694c6a4c,0x7162706b71),NULL,NULL,NULL,NULL# leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."
}
]
},
"impact": {
"cvss": {
"version": "3.1",
"baseScore": "6.3",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
},
"references": {
"reference_data": [
{
"url": "https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Library-Management-System-with-QR-code-Attendance-and-Auto-Generate-Library-Card.md",
"refsource": "MISC",
"name": "https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Library-Management-System-with-QR-code-Attendance-and-Auto-Generate-Library-Card.md"
},
{
"url": "https://vuldb.com/?id.204574",
"refsource": "MISC",
"name": "https://vuldb.com/?id.204574"
}
]
}
}

77
2022/2xxx/CVE-2022-2492.json Normal file
View File

@ -0,0 +1,77 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-2492",
"TITLE": "SourceCodester Library Management System index.php sql injection",
"REQUESTER": "cna@vuldb.com",
"ASSIGNER": "cna@vuldb.com",
"STATE": "PUBLIC"
},
"generator": "vuldb.com",
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "SourceCodester",
"product": {
"product_data": [
{
"product_name": "Library Management System",
"version": {
"version_data": [
{
"version_value": "1.0"
}
]
}
}
]
}
}
]
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-89 SQL Injection"
}
]
}
]
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in SourceCodester Library Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /index.php. The manipulation of the argument RollNo with the input admin' AND (SELECT 2625 FROM (SELECT(SLEEP(5)))MdIL) AND 'KXmq'='KXmq&Password=1231312312 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used."
}
]
},
"impact": {
"cvss": {
"version": "3.1",
"baseScore": "6.3",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
}
},
"references": {
"reference_data": [
{
"url": "https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Library-Management-System-with-QR-code-Attendance-and-Auto-Generate-Library-Card.md#index.php",
"refsource": "MISC",
"name": "https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/Library-Management-System-with-QR-code-Attendance-and-Auto-Generate-Library-Card.md#index.php"
},
{
"url": "https://vuldb.com/?id.204575",
"refsource": "MISC",
"name": "https://vuldb.com/?id.204575"
}
]
}
}

18
2022/2xxx/CVE-2022-2493.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-2493",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/2xxx/CVE-2022-2494.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-2494",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/2xxx/CVE-2022-2495.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-2495",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

92
2022/31xxx/CVE-2022-31250.json
View File

@ -1,18 +1,98 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "security@suse.com",
"DATE_PUBLIC": "2022-06-24T00:00:00.000Z",
"ID": "CVE-2022-31250",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "keylime %post scriplet allows for privilege escalation from keylime user to root"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Tumbleweed",
"version": {
"version_data": [
{
"version_affected": "<",
"version_name": "keylime",
"version_value": "6.4.2-1.1"
}
]
}
}
]
},
"vendor_name": "openSUSE"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Johannes Segitz from SUSE"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This issue affects: openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-61: UNIX Symbolic Link (Symlink) Following"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.suse.com/show_bug.cgi?id=1200885",
"refsource": "CONFIRM",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1200885"
}
]
},
"source": {
"advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1200885",
"defect": [
"1200885"
],
"discovery": "INTERNAL"
}
}

5
2022/32xxx/CVE-2022-32450.json
View File

@ -57,6 +57,11 @@
"refsource": "MISC",
"name": "http://anydesk.com"
},
{
"refsource": "MISC",
"name": "http://packetstormsecurity.com/files/167608/AnyDesk-7.0.9-Arbitrary-File-Write-Denial-Of-Service.html",
"url": "http://packetstormsecurity.com/files/167608/AnyDesk-7.0.9-Arbitrary-File-Write-Denial-Of-Service.html"
},
{
"refsource": "MISC",
"name": "https://seclists.org/fulldisclosure/2022/Jun/44",

65
2022/33xxx/CVE-2022-33967.json
View File

@ -4,14 +4,73 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-33967",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ASSIGNER": "vultures@jpcert.or.jp",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "DENX Software Engineering",
"product": {
"product_data": [
{
"product_name": "U-Boot",
"version": {
"version_data": [
{
"version_value": "versions from v2020.10-rc2 to v2022.07-rc5"
}
]
}
}
]
}
}
]
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Denial-of-service (DoS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://www.denx.de/project/u-boot/",
"refsource": "MISC",
"name": "https://www.denx.de/project/u-boot/"
},
{
"url": "https://lists.denx.de/pipermail/u-boot/2022-June/487467.html",
"refsource": "MISC",
"name": "https://lists.denx.de/pipermail/u-boot/2022-June/487467.html"
},
{
"url": "https://source.denx.de/u-boot/u-boot/-/commit/7f7fb9937c6cb49dd35153bd6708872b390b0a44",
"refsource": "MISC",
"name": "https://source.denx.de/u-boot/u-boot/-/commit/7f7fb9937c6cb49dd35153bd6708872b390b0a44"
},
{
"url": "https://jvn.jp/en/vu/JVNVU97846460/index.html",
"refsource": "MISC",
"name": "https://jvn.jp/en/vu/JVNVU97846460/index.html"
}
]
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution."
}
]
}

14
2022/34xxx/CVE-2022-34169.json
View File

@ -87,8 +87,18 @@
"name": "[oss-security] 20220719 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
"url": "http://www.openwall.com/lists/oss-security/2022/07/19/6"
},
{
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
{
"refsource": "MLIST",
"name": "[oss-security] 20220719 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
"url": "http://www.openwall.com/lists/oss-security/2022/07/20/2"
},
{
"refsource": "MLIST",
"name": "[oss-security] 20220720 Re: CVE-2022-34169: Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets",
"url": "http://www.openwall.com/lists/oss-security/2022/07/20/3"
},
{
"url": "https://www.oracle.com/security-alerts/cpujul2022.html"
}
]
},

56
2022/34xxx/CVE-2022-34599.json
View File

@ -1,17 +1,61 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-34599",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ID": "CVE-2022-34599",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://github.com/Darry-lang1/vuln/tree/main/H3C/1",
"refsource": "MISC",
"name": "https://github.com/Darry-lang1/vuln/tree/main/H3C/1"
}
]
}

56
2022/34xxx/CVE-2022-34600.json
View File

@ -1,17 +1,61 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-34600",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ID": "CVE-2022-34600",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EditSTList interface at /goform/aspForm."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://github.com/Darry-lang1/vuln/tree/main/H3C/3",
"refsource": "MISC",
"name": "https://github.com/Darry-lang1/vuln/tree/main/H3C/3"
}
]
}

56
2022/34xxx/CVE-2022-34601.json
View File

@ -1,17 +1,61 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-34601",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ID": "CVE-2022-34601",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the Delstlist interface at /goform/aspForm."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://github.com/Darry-lang1/vuln/tree/main/H3C/2",
"refsource": "MISC",
"name": "https://github.com/Darry-lang1/vuln/tree/main/H3C/2"
}
]
}

56
2022/34xxx/CVE-2022-34602.json
View File

@ -1,17 +1,61 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-34602",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ID": "CVE-2022-34602",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspForm."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://github.com/Darry-lang1/vuln/tree/main/H3C/4",
"refsource": "MISC",
"name": "https://github.com/Darry-lang1/vuln/tree/main/H3C/4"
}
]
}

56
2022/34xxx/CVE-2022-34603.json
View File

@ -1,17 +1,61 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-34603",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ID": "CVE-2022-34603",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://github.com/Darry-lang1/vuln/tree/main/H3C/5",
"refsource": "MISC",
"name": "https://github.com/Darry-lang1/vuln/tree/main/H3C/5"
}
]
}

56
2022/34xxx/CVE-2022-34604.json
View File

@ -1,17 +1,61 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-34604",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ID": "CVE-2022-34604",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the INTF parameter at /dotrace.asp."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://github.com/Darry-lang1/vuln/tree/main/H3C/11",
"refsource": "MISC",
"name": "https://github.com/Darry-lang1/vuln/tree/main/H3C/11"
}
]
}

56
2022/34xxx/CVE-2022-34605.json
View File

@ -1,17 +1,61 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-34605",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ID": "CVE-2022-34605",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the HOST parameter at /dotrace.asp."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://github.com/Darry-lang1/vuln/tree/main/H3C/10",
"refsource": "MISC",
"name": "https://github.com/Darry-lang1/vuln/tree/main/H3C/10"
}
]
}

56
2022/34xxx/CVE-2022-34606.json
View File

@ -1,17 +1,61 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-34606",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ID": "CVE-2022-34606",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EditvsList parameter at /dotrace.asp."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://github.com/Darry-lang1/vuln/tree/main/H3C/6",
"refsource": "MISC",
"name": "https://github.com/Darry-lang1/vuln/tree/main/H3C/6"
}
]
}

56
2022/34xxx/CVE-2022-34607.json
View File

@ -1,17 +1,61 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-34607",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ID": "CVE-2022-34607",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the HOST parameter at /doping.asp."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://github.com/Darry-lang1/vuln/tree/main/H3C/8",
"refsource": "MISC",
"name": "https://github.com/Darry-lang1/vuln/tree/main/H3C/8"
}
]
}

56
2022/34xxx/CVE-2022-34608.json
View File

@ -1,17 +1,61 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-34608",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ID": "CVE-2022-34608",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the ajaxmsg parameter at /AJAX/ajaxget."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://github.com/Darry-lang1/vuln/tree/main/H3C/7",
"refsource": "MISC",
"name": "https://github.com/Darry-lang1/vuln/tree/main/H3C/7"
}
]
}

56
2022/34xxx/CVE-2022-34609.json
View File

@ -1,17 +1,61 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-34609",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ID": "CVE-2022-34609",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the INTF parameter at /doping.asp."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://github.com/Darry-lang1/vuln/tree/main/H3C/9",
"refsource": "MISC",
"name": "https://github.com/Darry-lang1/vuln/tree/main/H3C/9"
}
]
}

56
2022/34xxx/CVE-2022-34610.json
View File

@ -1,17 +1,61 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-34610",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ID": "CVE-2022-34610",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the URL /ihomers/app."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://github.com/Darry-lang1/vuln/tree/main/H3C/12",
"refsource": "MISC",
"name": "https://github.com/Darry-lang1/vuln/tree/main/H3C/12"
}
]
}

55
2022/34xxx/CVE-2022-34866.json
View File

@ -4,14 +4,63 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-34866",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"ASSIGNER": "vultures@jpcert.or.jp",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"vendor_name": "Yokogawa Rental & Lease Corporation",
"product": {
"product_data": [
{
"product_name": "Passage Drive",
"version": {
"version_data": [
{
"version_value": "Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0"
}
]
}
}
]
}
}
]
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Improper Input Validation"
}
]
}
]
},
"references": {
"reference_data": [
{
"url": "https://www.yrl.com/fwp_support/info/a1hrbt0000002037.html",
"refsource": "MISC",
"name": "https://www.yrl.com/fwp_support/info/a1hrbt0000002037.html"
},
{
"url": "https://jvn.jp/en/jp/JVN23766146/index.html",
"refsource": "MISC",
"name": "https://jvn.jp/en/jp/JVN23766146/index.html"
}
]
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verification vulnerability for interprocess communication. By running a malicious program, an arbitrary OS command may be executed with LocalSystem privilege of the Windows system where the product is running."
}
]
}

5
2022/35xxx/CVE-2022-35741.json
View File

@ -76,6 +76,11 @@
"refsource": "MLIST",
"name": "[oss-security] 20220718 [ADVISORY] Apache CloudStack SAML Single Sign-On XXE (CVE-2022-35741)",
"url": "http://www.openwall.com/lists/oss-security/2022/07/18/2"
},
{
"refsource": "MLIST",
"name": "[oss-security] 20220720 Re: [ADVISORY] Apache CloudStack SAML Single Sign-On XXE (CVE-2022-35741)",
"url": "http://www.openwall.com/lists/oss-security/2022/07/20/1"
}
]
},

18
2022/36xxx/CVE-2022-36313.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36313",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36314.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36314",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36315.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36315",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36316.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36316",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36317.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36317",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36318.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36318",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36319.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36319",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36320.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36320",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

89
2022/36xxx/CVE-2022-36321.json Normal file
View File

@ -0,0 +1,89 @@
{
"CVE_data_meta": {
"ASSIGNER": "security@jetbrains.com",
"ID": "CVE-2022-36321",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TeamCity",
"version": {
"version_data": [
{
"version_affected": "<",
"version_name": "2022.04.2",
"version_value": "2022.04.2"
}
]
}
}
]
},
"vendor_name": "JetBrains"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-532 Information Exposure Through Log Files"
}
]
}
]
},
"references": {
"reference_data": [
{
"refsource": "MISC",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed/",
"name": "https://www.jetbrains.com/privacy-security/issues-fixed/"
}
]
},
"source": {
"defect": [
"TW-76651"
],
"discovery": "INTERNAL"
}
}

95
2022/36xxx/CVE-2022-36322.json Normal file
View File

@ -0,0 +1,95 @@
{
"CVE_data_meta": {
"ASSIGNER": "security@jetbrains.com",
"ID": "CVE-2022-36322",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TeamCity",
"version": {
"version_data": [
{
"version_affected": "<",
"version_name": "2022.04.2",
"version_value": "2022.04.2"
}
]
}
}
]
},
"vendor_name": "JetBrains"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Micky Sung"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "In JetBrains TeamCity before 2022.04.2 build parameter injection was possible"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-88 Argument Injection or Modification"
}
]
}
]
},
"references": {
"reference_data": [
{
"refsource": "MISC",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed/",
"name": "https://www.jetbrains.com/privacy-security/issues-fixed/"
}
]
},
"source": {
"defect": [
"TW-76356"
],
"discovery": "EXTERNAL"
}
}

18
2022/36xxx/CVE-2022-36323.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36323",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36324.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36324",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36325.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36325",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36326.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36326",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36327.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36327",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36328.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36328",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36329.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36329",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36330.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36330",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36331.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36331",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36332.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36332",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36333.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36333",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36334.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36334",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}

18
2022/36xxx/CVE-2022-36335.json Normal file
View File

@ -0,0 +1,18 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-36335",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}