- Synchronized data.

This commit is contained in:
CVE Team 2018-01-09 15:06:36 -05:00
parent 93252f63f3
commit e653f2f4b1
No known key found for this signature in database
GPG Key ID: 3504EC0FB4B2FE56
8 changed files with 263 additions and 193 deletions

View File

@ -1 +1,65 @@
{"data_version":"4.0","references":{"reference_data":[{"url":"https://github.com/matrixssl/matrixssl/blob/master/doc/CHANGES.md"},{"url":"https://www.ieee-security.org/TC/SP2017/papers/231.pdf"},{"url":"https://www.youtube.com/watch?v=FW--c_F_cY8"}]},"description":{"description_data":[{"lang":"eng","value":"MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certificates have their expiration (beginning) year extended (delayed) by 100 years."}]},"data_type":"CVE","affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"version":{"version_data":[{"version_value":"3.7.2 and older"}]},"product_name":"MatrixSSL"}]},"vendor_name":"MatrixSSL"}]}},"CVE_data_meta":{"DATE_ASSIGNED":"2017-12-29","ID":"CVE-2017-1000415","ASSIGNER":"kurt@seifried.org","REQUESTER":"schau@purdue.edu"},"data_format":"MITRE","problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Incorrect date range validation"}]}]}}
{
"CVE_data_meta" : {
"ASSIGNER" : "cve-assign@distributedweaknessfiling.org",
"DATE_ASSIGNED" : "2017-12-29",
"ID" : "CVE-2017-1000415",
"REQUESTER" : "schau@purdue.edu",
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "MatrixSSL",
"version" : {
"version_data" : [
{
"version_value" : "3.7.2 and older"
}
]
}
}
]
},
"vendor_name" : "MatrixSSL"
}
]
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certificates have their expiration (beginning) year extended (delayed) by 100 years."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "Incorrect date range validation"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"url" : "https://www.ieee-security.org/TC/SP2017/papers/231.pdf"
},
{
"url" : "https://www.youtube.com/watch?v=FW--c_F_cY8"
}
]
}
}

View File

@ -1,23 +1,14 @@
{
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"value" : "Data Manipulation",
"lang" : "eng"
}
]
}
]
"CVE_data_meta" : {
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-01-04T00:00:00",
"ID" : "CVE-2017-1493",
"STATE" : "PUBLIC"
},
"data_format" : "MITRE",
"data_type" : "CVE",
"affects" : {
"vendor" : {
"vendor_data" : [
{
"vendor_name" : "IBM",
"product" : {
"product_data" : [
{
@ -139,36 +130,43 @@
}
}
]
}
},
"vendor_name" : "IBM"
}
]
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM UrbanCode Deploy (UCD) 6.1 and 6.2 could allow an authenticated user to edit objects that they should not have access to due to improper access controls. IBM X-Force ID: 128691."
"value" : "IBM UrbanCode Deploy (UCD) 6.1 and 6.2 could allow an authenticated user to edit objects that they should not have access to due to improper access controls. IBM X-Force ID: 128691."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "Data Manipulation"
}
]
}
]
},
"data_version" : "4.0",
"references" : {
"reference_data" : [
{
"url" : "http://www.ibm.com/support/docview.wss?uid=swg2C1000367",
"name" : "IBM Security Bulletin C1000367 (UrbanCode Deploy)"
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/128691"
},
{
"name" : "X-Force Vulnerability Report",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/128691"
"url" : "http://www.ibm.com/support/docview.wss?uid=swg2C1000367"
}
]
},
"CVE_data_meta" : {
"STATE" : "PUBLIC",
"ID" : "CVE-2017-1493",
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-01-04T00:00:00"
}
}

View File

@ -2,22 +2,8 @@
"CVE_data_meta" : {
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-01-04T00:00:00",
"STATE" : "PUBLIC",
"ID" : "CVE-2017-1612"
},
"data_type" : "CVE",
"data_version" : "4.0",
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"value" : "Gain Privileges",
"lang" : "eng"
}
]
}
]
"ID" : "CVE-2017-1612",
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
@ -26,6 +12,7 @@
"product" : {
"product_data" : [
{
"product_name" : "MQ",
"version" : {
"version_data" : [
{
@ -44,8 +31,7 @@
"version_value" : "9.0"
}
]
},
"product_name" : "MQ"
}
}
]
},
@ -55,23 +41,35 @@
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. IBM X-Force ID: 132953."
"value" : "IBM WebSphere MQ 7.0, 7.1, 7.5, 8.0, and 9.0 service trace module could be used to execute untrusted code under 'mqm' user. IBM X-Force ID: 132953."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "Gain Privileges"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"name" : "IBM Security Bulletin 2009918 (MQ)",
"url" : "http://www.ibm.com/support/docview.wss?uid=swg22009918"
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/132953"
},
{
"name" : "X-Force Vulnerability Report",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/132953"
"url" : "http://www.ibm.com/support/docview.wss?uid=swg22009918"
}
]
}

View File

@ -1,49 +1,14 @@
{
"data_version" : "4.0",
"references" : {
"reference_data" : [
{
"url" : "http://www.ibm.com/support/docview.wss?uid=swg22011970",
"name" : "IBM Security Bulletin 2011970 (Security Key Lifecycle Manager)"
},
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/133560",
"name" : "X-Force Vulnerability Report"
}
]
},
"CVE_data_meta" : {
"ID" : "CVE-2017-1666",
"ASSIGNER" : "psirt@us.ibm.com",
"STATE" : "PUBLIC",
"DATE_PUBLIC" : "2018-01-05T00:00:00"
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "Obtain Information"
}
]
}
]
},
"data_type" : "CVE",
"description" : {
"description_data" : [
{
"value" : "IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 133540.",
"lang" : "eng"
}
]
"DATE_PUBLIC" : "2018-01-05T00:00:00",
"ID" : "CVE-2017-1666",
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"vendor_name" : "IBM",
"product" : {
"product_data" : [
{
@ -63,10 +28,43 @@
}
}
]
}
},
"vendor_name" : "IBM"
}
]
}
},
"data_format" : "MITRE"
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 133540."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "Obtain Information"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/133560"
},
{
"url" : "http://www.ibm.com/support/docview.wss?uid=swg22011970"
}
]
}
}

View File

@ -1,4 +1,10 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-01-05T00:00:00",
"ID" : "CVE-2017-1668",
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
@ -29,6 +35,16 @@
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 133562."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
@ -41,32 +57,14 @@
}
]
},
"data_version" : "4.0",
"data_type" : "CVE",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 133562."
}
]
},
"references" : {
"reference_data" : [
{
"name" : "IBM Security Bulletin 2012010 (Security Key Lifecycle Manager)",
"url" : "http://www.ibm.com/support/docview.wss?uid=swg22012010"
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/133562"
},
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/133562",
"name" : "X-Force Vulnerability Report"
"url" : "http://www.ibm.com/support/docview.wss?uid=swg22012010"
}
]
},
"CVE_data_meta" : {
"DATE_PUBLIC" : "2018-01-05T00:00:00",
"STATE" : "PUBLIC",
"ID" : "CVE-2017-1668",
"ASSIGNER" : "psirt@us.ibm.com"
}
}

View File

@ -1,52 +1,18 @@
{
"references" : {
"reference_data" : [
{
"url" : "http://www.ibm.com/support/docview.wss?uid=swg22012009",
"name" : "IBM Security Bulletin 2012009 (Security Key Lifecycle Manager)"
},
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/133637",
"name" : "X-Force Vulnerability Report"
}
]
},
"description" : {
"description_data" : [
{
"value" : "IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 133637.",
"lang" : "eng"
}
]
},
"CVE_data_meta" : {
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-01-05T00:00:00",
"ID" : "CVE-2017-1670",
"STATE" : "PUBLIC",
"ASSIGNER" : "psirt@us.ibm.com"
},
"data_format" : "MITRE",
"data_version" : "4.0",
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"value" : "Data Manipulation",
"lang" : "eng"
}
]
}
]
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"vendor_name" : "IBM",
"product" : {
"product_data" : [
{
"product_name" : "Security Key Lifecycle Manager",
"version" : {
"version_data" : [
{
@ -59,14 +25,46 @@
"version_value" : "2.7"
}
]
},
"product_name" : "Security Key Lifecycle Manager"
}
}
]
}
},
"vendor_name" : "IBM"
}
]
}
},
"data_type" : "CVE"
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 133637."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "Data Manipulation"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/133637"
},
{
"url" : "http://www.ibm.com/support/docview.wss?uid=swg22012009"
}
]
}
}

View File

@ -1,53 +1,18 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "psirt@us.ibm.com",
"DATE_PUBLIC" : "2018-01-05T00:00:00",
"ID" : "CVE-2017-1671",
"STATE" : "PUBLIC",
"DATE_PUBLIC" : "2018-01-05T00:00:00"
},
"data_version" : "4.0",
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"value" : "Obtain Information",
"lang" : "eng"
}
]
}
]
},
"data_type" : "CVE",
"data_format" : "MITRE",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 133638."
}
]
},
"references" : {
"reference_data" : [
{
"name" : "IBM Security Bulletin 2011967 (Security Key Lifecycle Manager)",
"url" : "http://www.ibm.com/support/docview.wss?uid=swg22011967"
},
{
"name" : "X-Force Vulnerability Report",
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/133638"
}
]
"STATE" : "PUBLIC"
},
"affects" : {
"vendor" : {
"vendor_data" : [
{
"vendor_name" : "IBM",
"product" : {
"product_data" : [
{
"product_name" : "Security Key Lifecycle Manager",
"version" : {
"version_data" : [
{
@ -60,13 +25,46 @@
"version_value" : "2.7"
}
]
},
"product_name" : "Security Key Lifecycle Manager"
}
}
]
}
},
"vendor_name" : "IBM"
}
]
}
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 133638."
}
]
},
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng",
"value" : "Obtain Information"
}
]
}
]
},
"references" : {
"reference_data" : [
{
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/133638"
},
{
"url" : "http://www.ibm.com/support/docview.wss?uid=swg22011967"
}
]
}
}

View File

@ -0,0 +1,18 @@
{
"CVE_data_meta" : {
"ASSIGNER" : "cve@mitre.org",
"ID" : "CVE-2018-5313",
"STATE" : "RESERVED"
},
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang" : "eng",
"value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
}
]
}
}