admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-07-29 05:56:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

- Synchronized data.

Browse Source
This commit is contained in:
CVE Team 2018-01-04 10:02:55 -05:00
parent 5a73194168
commit d829acbad7
No known key found for this signature in database
GPG Key ID: 3504EC0FB4B2FE56
3 changed files with 16 additions and 52 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
2017/1000xxx/CVE-2017-1000479.json
View File

@ -36,7 +36,7 @@
"description_data" : [
{
"lang" : "eng",
"value" : "pfSense versions 2.4.1 and lower are vulnerable to a clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code. See first reference URL for full details. Credits are Yorick Koster. OPNsense, a 2015 fork of pfSense, was not vulnerable since version 16.1.16 released on June 06, 2016. The unprotected web form was removed from the code during an internal security audit under \"possibly insecure\" suspicions."
"value" : "pfSense versions 2.4.1 and lower are vulnerable to clickjacking attacks in the CSRF error page resulting in privileged execution of arbitrary code, because the error detection occurs before an X-Frame-Options header is set. This is fixed in 2.4.2-RELEASE. OPNsense, a 2015 fork of pfSense, was not vulnerable since version 16.1.16 released on June 06, 2016. The unprotected web form was removed from the code during an internal security audit under \"possibly insecure\" suspicions."
}
]
},
@ -57,11 +57,20 @@
{
"url" : "http://www.openwall.com/lists/oss-security/2017/11/22/7"
},
{
"url" : "https://doc.pfsense.org/index.php/2.4.2_New_Features_and_Changes"
},
{
"url" : "https://github.com/opnsense/core/commit/d218b225"
},
{
"url" : "https://github.com/pfsense/pfsense/commit/386d89b07"
},
{
"url" : "https://www.netgate.com/blog/pfsense-2-4-2-release-p1-and-2-3-5-release-p1-now-available.html"
},
{
"url" : "https://www.securify.nl/en/advisory/SFY20171101/clickjacking-vulnerability-in-csrf-error-page-pfsense.html"
}
]
}

5
2017/17xxx/CVE-2017-17837.json
View File

@ -54,7 +54,10 @@
"references" : {
"reference_data" : [
{
"url" : "https://lists.apache.org/thread.html/b02a4ee54b069f852a102078241be07bf18fc134ca9720e97df69a09@%3Cannounce.apache.org%3E"
"url" : "https://git-wip-us.apache.org/repos/asf?p=deltaspike.git;h=4e25023"
},
{
"url" : "https://issues.apache.org/jira/browse/DELTASPIKE-1307"
}
]
}

52
2018/5xxx/CVE-2018-5191.json
View File

@ -2,30 +2,7 @@
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ID" : "CVE-2018-5191",
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "n/a",
"version" : {
"version_data" : [
{
"version_value" : "n/a"
}
]
}
}
]
},
"vendor_name" : "n/a"
}
]
}
"STATE" : "REJECT"
},
"data_format" : "MITRE",
"data_type" : "CVE",
@ -34,32 +11,7 @@
"description_data" : [
{
"lang" : "eng",
"value" : "/usr/local/www/csrf/csrf-magic.php in the WebGUI in pfSense before 2.4.2-RELEASE allows Clickjacking on the CSRF error page because the error detection occurs before an X-Frame-Options header is set."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "n/a"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"url" : "https://doc.pfsense.org/index.php/2.4.2_New_Features_and_Changes"
},
{
"url" : "https://www.netgate.com/blog/pfsense-2-4-2-release-p1-and-2-3-5-release-p1-now-available.html"
},
{
"url" : "https://www.securify.nl/en/advisory/SFY20171101/clickjacking-vulnerability-in-csrf-error-page-pfsense.html"
"value" : "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-1000479. Reason: This candidate is a reservation duplicate of CVE-2017-1000479. Notes: All CVE users should reference CVE-2017-1000479 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage."
}
]
}