From e574bd3894d77907c41f0c040409a577c3fa35b3 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Wed, 16 Aug 2023 20:00:33 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2023/28xxx/CVE-2023-28075.json | 78 +++++++++++++++++++++++++-- 2023/32xxx/CVE-2023-32453.json | 78 +++++++++++++++++++++++++-- 2023/4xxx/CVE-2023-4382.json | 91 ++++++++++++++++++++++++++++++-- 2023/4xxx/CVE-2023-4383.json | 96 ++++++++++++++++++++++++++++++++-- 2023/4xxx/CVE-2023-4384.json | 96 ++++++++++++++++++++++++++++++++-- 5 files changed, 419 insertions(+), 20 deletions(-) diff --git a/2023/28xxx/CVE-2023-28075.json b/2023/28xxx/CVE-2023-28075.json index bd7d82e9d5a..4649615240b 100644 --- a/2023/28xxx/CVE-2023-28075.json +++ b/2023/28xxx/CVE-2023-28075.json @@ -1,17 +1,87 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-28075", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "secure@dell.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "\nDell BIOS contain a Time-of-check Time-of-use vulnerability in BIOS. A local authenticated malicious user with physical access to the system could potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI in order to gain arbitrary code execution on the system.\n\n" + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition", + "cweId": "CWE-367" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Dell", + "product": { + "product_data": [ + { + "product_name": "CPG BIOS", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "All Versions" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.dell.com/support/kbdoc/en-us/000212817/dsa-2023-152-security-update-for-a-dell-client-bios-vulnerability", + "refsource": "MISC", + "name": "https://www.dell.com/support/kbdoc/en-us/000212817/dsa-2023-152-security-update-for-a-dell-client-bios-vulnerability" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "HIGH", + "attackVector": "PHYSICAL", + "availabilityImpact": "HIGH", + "baseScore": 6.9, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "CHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", + "version": "3.1" } ] } diff --git a/2023/32xxx/CVE-2023-32453.json b/2023/32xxx/CVE-2023-32453.json index ff544a81e44..f8cdd68d608 100644 --- a/2023/32xxx/CVE-2023-32453.json +++ b/2023/32xxx/CVE-2023-32453.json @@ -1,17 +1,87 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-32453", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "secure@dell.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "\nDell BIOS contains an improper authentication vulnerability. A malicious user with physical access to the system may potentially exploit this vulnerability in order to modify a security-critical UEFI variable without knowledge of the BIOS administrator.\n\n" + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-287: Improper Authentication", + "cweId": "CWE-287" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Dell", + "product": { + "product_data": [ + { + "product_name": "CPG BIOS", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "All versions" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.dell.com/support/kbdoc/en-us/000215217/dsa-2023-190-dell-client-bios", + "refsource": "MISC", + "name": "https://www.dell.com/support/kbdoc/en-us/000215217/dsa-2023-190-dell-client-bios" + } + ] + }, + "generator": { + "engine": "Vulnogram 0.1.0-dev" + }, + "source": { + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "PHYSICAL", + "availabilityImpact": "LOW", + "baseScore": 4.6, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "privilegesRequired": "HIGH", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L", + "version": "3.1" } ] } diff --git a/2023/4xxx/CVE-2023-4382.json b/2023/4xxx/CVE-2023-4382.json index 8c04c3cb233..c56fa95bdd9 100644 --- a/2023/4xxx/CVE-2023-4382.json +++ b/2023/4xxx/CVE-2023-4382.json @@ -1,17 +1,100 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-4382", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability, which was classified as problematic, has been found in tdevs Hyip Rio 2.1. Affected by this issue is some unknown functionality of the file /user/settings of the component Profile Settings. The manipulation of the argument avatar leads to cross site scripting. The attack may be launched remotely. VDB-237314 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way." + }, + { + "lang": "deu", + "value": "Eine problematische Schwachstelle wurde in tdevs Hyip Rio 2.1 entdeckt. Hierbei geht es um eine nicht exakt ausgemachte Funktion der Datei /user/settings der Komponente Profile Settings. Dank der Manipulation des Arguments avatar mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Cross Site Scripting", + "cweId": "CWE-79" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "tdevs", + "product": { + "product_data": [ + { + "product_name": "Hyip Rio", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "2.1" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.237314", + "refsource": "MISC", + "name": "https://vuldb.com/?id.237314" + }, + { + "url": "https://vuldb.com/?ctiid.237314", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.237314" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "skalvin (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 3.5, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "baseSeverity": "LOW" + }, + { + "version": "3.0", + "baseScore": 3.5, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "baseSeverity": "LOW" + }, + { + "version": "2.0", + "baseScore": 4, + "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", + "baseSeverity": "MEDIUM" } ] } diff --git a/2023/4xxx/CVE-2023-4383.json b/2023/4xxx/CVE-2023-4383.json index f5198f817d8..43928fcc4b0 100644 --- a/2023/4xxx/CVE-2023-4383.json +++ b/2023/4xxx/CVE-2023-4383.json @@ -1,17 +1,105 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-4383", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability, which was classified as critical, was found in MicroWorld eScan Anti-Virus 7.0.32 on Linux. This affects an unknown part of the file runasroot. The manipulation leads to incorrect execution-assigned permissions. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-237315. NOTE: The vendor was contacted early about this disclosure but did not respond in any way." + }, + { + "lang": "deu", + "value": "Es wurde eine kritische Schwachstelle in MicroWorld eScan Anti-Virus 7.0.32 f\u00fcr Linux gefunden. Es betrifft eine unbekannte Funktion der Datei runasroot. Dank Manipulation mit unbekannten Daten kann eine incorrect execution-assigned permissions-Schwachstelle ausgenutzt werden. Der Angriff muss lokal erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-279 Incorrect Execution-Assigned Permissions", + "cweId": "CWE-279" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "MicroWorld", + "product": { + "product_data": [ + { + "product_name": "eScan Anti-Virus", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "7.0.32" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.237315", + "refsource": "MISC", + "name": "https://vuldb.com/?id.237315" + }, + { + "url": "https://vuldb.com/?ctiid.237315", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.237315" + }, + { + "url": "https://gist.github.com/dmknght/ac489cf3605ded09b3925521afee3003", + "refsource": "MISC", + "name": "https://gist.github.com/dmknght/ac489cf3605ded09b3925521afee3003" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "dmknght (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 7.8, + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "baseSeverity": "HIGH" + }, + { + "version": "3.0", + "baseScore": 7.8, + "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "baseSeverity": "HIGH" + }, + { + "version": "2.0", + "baseScore": 6.8, + "vectorString": "AV:L/AC:L/Au:S/C:C/I:C/A:C", + "baseSeverity": "MEDIUM" } ] } diff --git a/2023/4xxx/CVE-2023-4384.json b/2023/4xxx/CVE-2023-4384.json index 7d4bd1f77e8..9110e1f411a 100644 --- a/2023/4xxx/CVE-2023-4384.json +++ b/2023/4xxx/CVE-2023-4384.json @@ -1,17 +1,105 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2023-4384", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability has been found in MaximaTech Portal Executivo 21.9.1.140 and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The manipulation leads to missing encryption of sensitive data. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-237316. NOTE: The vendor was contacted early about this disclosure but did not respond in any way." + }, + { + "lang": "deu", + "value": "In MaximaTech Portal Executivo 21.9.1.140 wurde eine problematische Schwachstelle gefunden. Das betrifft eine unbekannte Funktionalit\u00e4t der Komponente Cookie Handler. Mit der Manipulation mit unbekannten Daten kann eine missing encryption of sensitive data-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Das Ausnutzen gilt als schwierig. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-311 Missing Encryption of Sensitive Data", + "cweId": "CWE-311" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "MaximaTech", + "product": { + "product_data": [ + { + "product_name": "Portal Executivo", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "21.9.1.140" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.237316", + "refsource": "MISC", + "name": "https://vuldb.com/?id.237316" + }, + { + "url": "https://vuldb.com/?ctiid.237316", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.237316" + }, + { + "url": "https://l6x.notion.site/PoC-7041cf9625554273b17148de85705d06?pvs=4", + "refsource": "MISC", + "name": "https://l6x.notion.site/PoC-7041cf9625554273b17148de85705d06?pvs=4" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "LuigiSoftwall (VulDB User)" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 3.7, + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", + "baseSeverity": "LOW" + }, + { + "version": "3.0", + "baseScore": 3.7, + "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", + "baseSeverity": "LOW" + }, + { + "version": "2.0", + "baseScore": 2.6, + "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", + "baseSeverity": "LOW" } ] }