From e26dd1c637c05e7fc9080e82e5a32233cede7e74 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Thu, 21 Mar 2019 19:00:45 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2015/6xxx/CVE-2015-6461.json | 58 ++++++++++++++++++--- 2015/6xxx/CVE-2015-6462.json | 58 ++++++++++++++++++--- 2018/13xxx/CVE-2018-13798.json | 92 +++++++++++++++++++++++++++++++--- 2018/13xxx/CVE-2018-13805.json | 53 ++++++++++++-------- 2019/5xxx/CVE-2019-5490.json | 58 ++++++++++++++++++--- 2019/9xxx/CVE-2019-9905.json | 18 +++++++ 2019/9xxx/CVE-2019-9906.json | 18 +++++++ 2019/9xxx/CVE-2019-9907.json | 18 +++++++ 8 files changed, 325 insertions(+), 48 deletions(-) create mode 100644 2019/9xxx/CVE-2019-9905.json create mode 100644 2019/9xxx/CVE-2019-9906.json create mode 100644 2019/9xxx/CVE-2019-9907.json diff --git a/2015/6xxx/CVE-2015-6461.json b/2015/6xxx/CVE-2015-6461.json index 58aad6fde3e..57444155280 100644 --- a/2015/6xxx/CVE-2015-6461.json +++ b/2015/6xxx/CVE-2015-6461.json @@ -1,17 +1,61 @@ { - "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", - "ID": "CVE-2015-6461", - "STATE": "RESERVED" - }, - "data_format": "MITRE", "data_type": "CVE", + "data_format": "MITRE", "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2015-6461", + "ASSIGNER": "ics-cert@hq.dhs.gov", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "Schneider Electric Modicon PLC", + "version": { + "version_data": [ + { + "version_value": "BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, and BMXP342030H." + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Remote file inclusion CWE-98" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02", + "url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02" + } + ] + }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page." } ] } diff --git a/2015/6xxx/CVE-2015-6462.json b/2015/6xxx/CVE-2015-6462.json index 159a82e0e34..8948168049a 100644 --- a/2015/6xxx/CVE-2015-6462.json +++ b/2015/6xxx/CVE-2015-6462.json @@ -1,17 +1,61 @@ { - "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", - "ID": "CVE-2015-6462", - "STATE": "RESERVED" - }, - "data_format": "MITRE", "data_type": "CVE", + "data_format": "MITRE", "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2015-6462", + "ASSIGNER": "ics-cert@hq.dhs.gov", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "Schneider Electric Modicon PLC", + "version": { + "version_data": [ + { + "version_value": "BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, and BMXP342030H." + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Cross-site scripting CWE-79" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02", + "url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02" + } + ] + }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed on the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC client browser." } ] } diff --git a/2018/13xxx/CVE-2018-13798.json b/2018/13xxx/CVE-2018-13798.json index 6b34a83a98f..a21090ccd98 100644 --- a/2018/13xxx/CVE-2018-13798.json +++ b/2018/13xxx/CVE-2018-13798.json @@ -1,17 +1,95 @@ { - "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", - "ID": "CVE-2018-13798", - "STATE": "RESERVED" - }, - "data_format": "MITRE", "data_type": "CVE", + "data_format": "MITRE", "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2018-13798", + "ASSIGNER": "productcert@siemens.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Siemens AG", + "product": { + "product_data": [ + { + "product_name": "SICAM A8000 CP-8000, SICAM A8000 CP-802X, SICAM A8000 CP-8050", + "version": { + "version_data": [ + { + "version_value": "SICAM A8000 CP-8000 : All versions < V14" + } + ] + } + } + ] + } + }, + { + "vendor_name": "Siemens AG", + "product": { + "product_data": [ + { + "product_name": "SICAM A8000 CP-802X", + "version": { + "version_data": [ + { + "version_value": "SICAM A8000 CP-802X : All versions < V14" + } + ] + } + } + ] + } + }, + { + "vendor_name": "Siemens AG", + "product": { + "product_data": [ + { + "product_name": "SICAM A8000 CP-8050", + "version": { + "version_data": [ + { + "version_value": "All versions < V2.00" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Other" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "CONFIRM", + "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-579309.pdf", + "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-579309.pdf" + } + ] + }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability has been identified in SICAM A8000 CP-8000 (All versions < V14), SICAM A8000 CP-802X (All versions < V14), SICAM A8000 CP-8050 (All versions < V2.00). Specially crafted network packets sent to port 80/TCP or 443/TCP could allow an unauthenticated remote attacker to cause a Denial-of-Service condition of the web server. The security vulnerability could be exploited by an attacker with network access to the affected systems on port 80/TCP or 443/TCP. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise availability of the web server. A system reboot is required to recover the web service of the device. At the time of advisory update, exploit code for this security vulnerability is public." } ] } diff --git a/2018/13xxx/CVE-2018-13805.json b/2018/13xxx/CVE-2018-13805.json index 73388180d2a..4ab1657b3ff 100644 --- a/2018/13xxx/CVE-2018-13805.json +++ b/2018/13xxx/CVE-2018-13805.json @@ -1,14 +1,17 @@ { + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", "CVE_data_meta": { - "ASSIGNER": "productcert@siemens.com", - "DATE_PUBLIC": "2018-10-09T00:00:00", "ID": "CVE-2018-13805", + "ASSIGNER": "productcert@siemens.com", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { + "vendor_name": "Siemens AG", "product": { "product_data": [ { @@ -16,11 +19,18 @@ "version": { "version_data": [ { - "version_value": "All versions >= V2.0" + "version_value": "All versions >= V2.0 and < V2.1.6" } ] } - }, + } + ] + } + }, + { + "vendor_name": "Siemens AG", + "product": { + "product_data": [ { "product_name": "SIMATIC S7-1500 Software Controller", "version": { @@ -30,7 +40,14 @@ } ] } - }, + } + ] + } + }, + { + "vendor_name": "Siemens AG", + "product": { + "product_data": [ { "product_name": "SIMATIC S7-1500 incl. F", "version": { @@ -42,30 +59,18 @@ } } ] - }, - "vendor_name": "Siemens AG" + } } ] } }, - "data_format": "MITRE", - "data_type": "CVE", - "data_version": "4.0", - "description": { - "description_data": [ - { - "lang": "eng", - "value": "A vulnerability has been identified in SIMATIC ET 200SP Open Controller (All versions >= V2.0), SIMATIC S7-1500 Software Controller (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 incl. F (All versions >= V2.0 and < V2.5). An attacker can cause a denial-of-service condition on the network stack by sending a large number of specially crafted packets to the PLC. The PLC will lose its ability to communicate over the network. This vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no privileges and no user interaction. An attacker could use this vulnerability to compromise availability of the network connectivity." - } - ] - }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", - "value": "CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')" + "value": "Other" } ] } @@ -74,10 +79,18 @@ "references": { "reference_data": [ { - "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-347726.pdf", "refsource": "CONFIRM", + "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-347726.pdf", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-347726.pdf" } ] + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "A vulnerability has been identified in SIMATIC ET 200SP Open Controller (All versions >= V2.0 and < V2.1.6), SIMATIC S7-1500 Software Controller (All versions >= V2.0 and < V2.5), SIMATIC S7-1500 incl. F (All versions >= V2.0 and < V2.5). An attacker can cause a denial-of-service condition on the network stack by sending a large number of specially crafted packets to the PLC. The PLC will lose its ability to communicate over the network. This vulnerability could be exploited by an attacker with network access to the affected systems. Successful exploitation requires no privileges and no user interaction. An attacker could use this vulnerability to compromise availability of the network connectivity. At the time of advisory publication no public exploitation of this vulnerability was known." + } + ] } } \ No newline at end of file diff --git a/2019/5xxx/CVE-2019-5490.json b/2019/5xxx/CVE-2019-5490.json index c5d9b991aa8..07dd25e289b 100644 --- a/2019/5xxx/CVE-2019-5490.json +++ b/2019/5xxx/CVE-2019-5490.json @@ -1,17 +1,61 @@ { - "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", - "ID": "CVE-2019-5490", - "STATE": "RESERVED" - }, - "data_format": "MITRE", "data_type": "CVE", + "data_format": "MITRE", "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2019-5490", + "ASSIGNER": "security-alert@netapp.com", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "NetApp, Inc.", + "product": { + "product_data": [ + { + "product_name": "NetApp Service Processor", + "version": { + "version_data": [ + { + "version_value": "2.x-5.x - refer to advisory" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Default Configureation" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "CONFIRM", + "name": "https://security.netapp.com/advisory/ntap-20190305-0001/", + "url": "https://security.netapp.com/advisory/ntap-20190305-0001/" + } + ] + }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabled that could allow unauthorized arbitrary command execution. Any platform listed in the advisory Impact section may be affected and should be upgraded to a fixed version of Service Processor firmware IMMEDIATELY." } ] } diff --git a/2019/9xxx/CVE-2019-9905.json b/2019/9xxx/CVE-2019-9905.json new file mode 100644 index 00000000000..6495cade4a8 --- /dev/null +++ b/2019/9xxx/CVE-2019-9905.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2019-9905", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2019/9xxx/CVE-2019-9906.json b/2019/9xxx/CVE-2019-9906.json new file mode 100644 index 00000000000..de1adc04d40 --- /dev/null +++ b/2019/9xxx/CVE-2019-9906.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2019-9906", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2019/9xxx/CVE-2019-9907.json b/2019/9xxx/CVE-2019-9907.json new file mode 100644 index 00000000000..2a267e954f0 --- /dev/null +++ b/2019/9xxx/CVE-2019-9907.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2019-9907", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file