mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-05-07 03:02:46 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
4714586d5b
commit
de6bf46f6e
18
2024/10xxx/CVE-2024-10390.json
Normal file
18
2024/10xxx/CVE-2024-10390.json
Normal file
@ -0,0 +1,18 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-10390",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
@ -1,17 +1,76 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-48428",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ID": "CVE-2024-48428",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "n/a",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format": "MITRE",
|
||||
"data_type": "CVE",
|
||||
"data_version": "4.0",
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "An issue in Olive VLE allows an attacker to obtain sensitive information via the reset password function."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "n/a"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://medium.com/h7w/full-account-takeover-via-password-reset-link-manipulation-840fb9402967",
|
||||
"refsource": "MISC",
|
||||
"name": "https://medium.com/h7w/full-account-takeover-via-password-reset-link-manipulation-840fb9402967"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://medium.com/@powerful-/account-takeover-ato-via-the-reset-password-cve-2024-48428-84892d6211d6",
|
||||
"url": "https://medium.com/@powerful-/account-takeover-ato-via-the-reset-password-cve-2024-48428-84892d6211d6"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.linkedin.com/posts/said-al-ghammari-301972285_0day-bugbountytips-bugbountytip-activity-7227418100034412544-2ocu/",
|
||||
"url": "https://www.linkedin.com/posts/said-al-ghammari-301972285_0day-bugbountytips-bugbountytip-activity-7227418100034412544-2ocu/"
|
||||
},
|
||||
{
|
||||
"refsource": "MISC",
|
||||
"name": "https://www.olivevle.com/",
|
||||
"url": "https://www.olivevle.com/"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,144 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-49753",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost (127.0.0.1). The isHostBlocked check, designed to prevent such requests, can be circumvented by creating a DNS record that resolves to 127.0.0.1. This enables actions to send requests to localhost despite the intended security measures. This vulnerability potentially allows unauthorized access to unsecured internal endpoints, which may contain sensitive information or functionalities. Versions 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-20: Improper Input Validation",
|
||||
"cweId": "CWE-20"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "zitadel",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "zitadel",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 2.64, < 2.64.1"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 2.63, < 2.63.6"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 2.62, < 2.62.8"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 2.61, < 2.61.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 2.60, < 2.60.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 2.59, < 2.59.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "< 2.58.7"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-6cf5-w9h3-4rqv",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-6cf5-w9h3-4rqv"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.58.7",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/zitadel/zitadel/releases/tag/v2.58.7"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.59.5",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/zitadel/zitadel/releases/tag/v2.59.5"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.60.4",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/zitadel/zitadel/releases/tag/v2.60.4"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.61.4",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/zitadel/zitadel/releases/tag/v2.61.4"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.62.8",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/zitadel/zitadel/releases/tag/v2.62.8"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.63.6",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/zitadel/zitadel/releases/tag/v2.63.6"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.64.1",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/zitadel/zitadel/releases/tag/v2.64.1"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-6cf5-w9h3-4rqv",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "HIGH",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 5.9,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"privilegesRequired": "HIGH",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -1,17 +1,140 @@
|
||||
{
|
||||
"data_version": "4.0",
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2024-49757",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
"ASSIGNER": "security-advisories@github.com",
|
||||
"STATE": "PUBLIC"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"value": "The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Due to a missing security check in versions prior to 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7, disabling the \"User Registration allowed\" option only hid the registration button on the login page. Users could bypass this restriction by directly accessing the registration URL (/ui/login/loginname) and register a user that way. Versions 2.64.0, 2.63.5, 2.62.7, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 contain a patch. No known workarounds are available."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype": {
|
||||
"problemtype_data": [
|
||||
{
|
||||
"description": [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "CWE-287: Improper Authentication",
|
||||
"cweId": "CWE-287"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects": {
|
||||
"vendor": {
|
||||
"vendor_data": [
|
||||
{
|
||||
"vendor_name": "zitadel",
|
||||
"product": {
|
||||
"product_data": [
|
||||
{
|
||||
"product_name": "zitadel",
|
||||
"version": {
|
||||
"version_data": [
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 2.63, < 2.63.5"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 2.62, < 2.62.7"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 2.61, < 2.61.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 2.60, < 2.60.3"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": ">= 2.59, < 2.59.4"
|
||||
},
|
||||
{
|
||||
"version_affected": "=",
|
||||
"version_value": "< 2.58.6"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references": {
|
||||
"reference_data": [
|
||||
{
|
||||
"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-3rmw-76m6-4gjc",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-3rmw-76m6-4gjc"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.58.7",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/zitadel/zitadel/releases/tag/v2.58.7"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.59.5",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/zitadel/zitadel/releases/tag/v2.59.5"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.60.4",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/zitadel/zitadel/releases/tag/v2.60.4"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.61.4",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/zitadel/zitadel/releases/tag/v2.61.4"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.62.7",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/zitadel/zitadel/releases/tag/v2.62.7"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.63.5",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/zitadel/zitadel/releases/tag/v2.63.5"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/zitadel/zitadel/releases/tag/v2.64.0",
|
||||
"refsource": "MISC",
|
||||
"name": "https://github.com/zitadel/zitadel/releases/tag/v2.64.0"
|
||||
}
|
||||
]
|
||||
},
|
||||
"source": {
|
||||
"advisory": "GHSA-3rmw-76m6-4gjc",
|
||||
"discovery": "UNKNOWN"
|
||||
},
|
||||
"impact": {
|
||||
"cvss": [
|
||||
{
|
||||
"attackComplexity": "LOW",
|
||||
"attackVector": "NETWORK",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 7.5,
|
||||
"baseSeverity": "HIGH",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"privilegesRequired": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"userInteraction": "NONE",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||||
"version": "3.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user