From e7e19fddced365efbf4f12d672e2d4b2cfc7b649 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Thu, 17 Oct 2024 15:00:30 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2005/10xxx/CVE-2005-10003.json | 112 +++++++++++++++++++++++++++++++-- 2024/10xxx/CVE-2024-10084.json | 18 ++++++ 2024/10xxx/CVE-2024-10085.json | 18 ++++++ 2024/47xxx/CVE-2024-47459.json | 103 ++++++++++++++++++++++++++++-- 2024/48xxx/CVE-2024-48920.json | 86 +++++++++++++++++++++++-- 2024/6xxx/CVE-2024-6333.json | 4 +- 2024/9xxx/CVE-2024-9683.json | 85 +++++++++++++++++++++++-- 7 files changed, 408 insertions(+), 18 deletions(-) create mode 100644 2024/10xxx/CVE-2024-10084.json create mode 100644 2024/10xxx/CVE-2024-10085.json diff --git a/2005/10xxx/CVE-2005-10003.json b/2005/10xxx/CVE-2005-10003.json index 64ea020c925..742bedb9fa8 100644 --- a/2005/10xxx/CVE-2005-10003.json +++ b/2005/10xxx/CVE-2005-10003.json @@ -1,17 +1,121 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2005-10003", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "cna@vuldb.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "** UNSUPPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in mikexstudios Xcomic up to 0.8.2. This affects an unknown part. The manipulation of the argument cmd leads to os command injection. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 0.8.3 is able to address this issue. The patch is named 6ed8e3cc336e29f09c7e791863d0559939da98bf. It is recommended to upgrade the affected component." + }, + { + "lang": "deu", + "value": "** UNSUPPPORTED WHEN ASSIGNED ** Es wurde eine Schwachstelle in mikexstudios Xcomic bis 0.8.2 entdeckt. Sie wurde als kritisch eingestuft. Betroffen hiervon ist ein unbekannter Ablauf. Mit der Manipulation des Arguments cmd mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie ist schwierig auszunutzen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Ein Aktualisieren auf die Version 0.8.3 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 6ed8e3cc336e29f09c7e791863d0559939da98bf bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "OS Command Injection", + "cweId": "CWE-78" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "mikexstudios", + "product": { + "product_data": [ + { + "product_name": "Xcomic", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "0.8.0" + }, + { + "version_affected": "=", + "version_value": "0.8.1" + }, + { + "version_affected": "=", + "version_value": "0.8.2" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://vuldb.com/?id.280359", + "refsource": "MISC", + "name": "https://vuldb.com/?id.280359" + }, + { + "url": "https://vuldb.com/?ctiid.280359", + "refsource": "MISC", + "name": "https://vuldb.com/?ctiid.280359" + }, + { + "url": "http://xcomic.mikexstudios.com/forum/viewtopic.php?id=130", + "refsource": "MISC", + "name": "http://xcomic.mikexstudios.com/forum/viewtopic.php?id=130" + }, + { + "url": "https://github.com/mikexstudios/xcomic/commit/6ed8e3cc336e29f09c7e791863d0559939da98bf", + "refsource": "MISC", + "name": "https://github.com/mikexstudios/xcomic/commit/6ed8e3cc336e29f09c7e791863d0559939da98bf" + }, + { + "url": "https://github.com/mikexstudios/xcomic/releases/tag/v0.8.3", + "refsource": "MISC", + "name": "https://github.com/mikexstudios/xcomic/releases/tag/v0.8.3" + }, + { + "url": "https://web.archive.org/web/20071218144304/http://xcomic.mikexstudios.com/forum/viewtopic.php?id=130", + "refsource": "MISC", + "name": "https://web.archive.org/web/20071218144304/http://xcomic.mikexstudios.com/forum/viewtopic.php?id=130" + } + ] + }, + "impact": { + "cvss": [ + { + "version": "3.1", + "baseScore": 5.6, + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "3.0", + "baseScore": 5.6, + "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + }, + { + "version": "2.0", + "baseScore": 5.1, + "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P" } ] } diff --git a/2024/10xxx/CVE-2024-10084.json b/2024/10xxx/CVE-2024-10084.json new file mode 100644 index 00000000000..8fb8fc4b8ce --- /dev/null +++ b/2024/10xxx/CVE-2024-10084.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-10084", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/10xxx/CVE-2024-10085.json b/2024/10xxx/CVE-2024-10085.json new file mode 100644 index 00000000000..257c30b3d24 --- /dev/null +++ b/2024/10xxx/CVE-2024-10085.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2024-10085", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/47xxx/CVE-2024-47459.json b/2024/47xxx/CVE-2024-47459.json index 23ce955f7bc..ad5c6dfc4ee 100644 --- a/2024/47xxx/CVE-2024-47459.json +++ b/2024/47xxx/CVE-2024-47459.json @@ -1,17 +1,112 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-47459", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "psirt@adobe.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Substance3D - Sampler versions 4.5 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to an application denial-of-service (DoS) condition. An attacker could exploit this vulnerability to crash the application, resulting in a DoS. Exploitation of this issue requires user interaction in that a victim must open a malicious file." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "NULL Pointer Dereference (CWE-476)", + "cweId": "CWE-476" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Adobe", + "product": { + "product_data": [ + { + "product_name": "Substance3D - Sampler", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "versions": [ + { + "lessThanOrEqual": "4.5", + "status": "affected", + "version": "0", + "versionType": "semver" + } + ], + "defaultStatus": "affected" + } + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://helpx.adobe.com/security/products/substance3d-sampler/apsb24-65.html", + "refsource": "MISC", + "name": "https://helpx.adobe.com/security/products/substance3d-sampler/apsb24-65.html" + } + ] + }, + "source": { + "discovery": "EXTERNAL" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "LOCAL", + "availabilityImpact": "HIGH", + "availabilityRequirement": "NOT_DEFINED", + "baseScore": 5.5, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "NONE", + "confidentialityRequirement": "NOT_DEFINED", + "environmentalScore": 5.5, + "environmentalSeverity": "MEDIUM", + "exploitCodeMaturity": "NOT_DEFINED", + "integrityImpact": "NONE", + "integrityRequirement": "NOT_DEFINED", + "modifiedAttackComplexity": "LOW", + "modifiedAttackVector": "LOCAL", + "modifiedAvailabilityImpact": "HIGH", + "modifiedConfidentialityImpact": "NONE", + "modifiedIntegrityImpact": "NONE", + "modifiedPrivilegesRequired": "NONE", + "modifiedScope": "UNCHANGED", + "modifiedUserInteraction": "REQUIRED", + "privilegesRequired": "NONE", + "remediationLevel": "NOT_DEFINED", + "reportConfidence": "NOT_DEFINED", + "scope": "UNCHANGED", + "temporalScore": 5.5, + "temporalSeverity": "MEDIUM", + "userInteraction": "REQUIRED", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", + "version": "3.1" } ] } diff --git a/2024/48xxx/CVE-2024-48920.json b/2024/48xxx/CVE-2024-48920.json index e34c8be0f0b..bd3a36046db 100644 --- a/2024/48xxx/CVE-2024-48920.json +++ b/2024/48xxx/CVE-2024-48920.json @@ -1,17 +1,95 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-48920", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security-advisories@github.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. This can lead to unauthorized access, enabling users to perform admin-level operations, potentially compromising sensitive data and system integrity. This problem has been fixed in v2.1.0.beta.1. As a workaround, one may apply the patch from commit `211dfe9` manually." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-306: Missing Authentication for Critical Function", + "cweId": "CWE-306" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "acm309", + "product": { + "product_data": [ + { + "product_name": "PutongOJ", + "version": { + "version_data": [ + { + "version_affected": "=", + "version_value": "< 2.1.0-beta.1" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://github.com/acm309/PutongOJ/security/advisories/GHSA-gj6h-73c5-xw6f", + "refsource": "MISC", + "name": "https://github.com/acm309/PutongOJ/security/advisories/GHSA-gj6h-73c5-xw6f" + }, + { + "url": "https://github.com/acm309/PutongOJ/commit/211dfe9ebf1c6618ce5396b0338de4f9b580715e#diff-782628b47d666d5d551e040815ca3f80c0704397258718f0e0f31164608ea7beL118-R120", + "refsource": "MISC", + "name": "https://github.com/acm309/PutongOJ/commit/211dfe9ebf1c6618ce5396b0338de4f9b580715e#diff-782628b47d666d5d551e040815ca3f80c0704397258718f0e0f31164608ea7beL118-R120" + }, + { + "url": "https://github.com/acm309/PutongOJ/releases/tag/v2.1.0-beta.1", + "refsource": "MISC", + "name": "https://github.com/acm309/PutongOJ/releases/tag/v2.1.0-beta.1" + } + ] + }, + "source": { + "advisory": "GHSA-gj6h-73c5-xw6f", + "discovery": "UNKNOWN" + }, + "impact": { + "cvss": [ + { + "attackComplexity": "LOW", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 9.1, + "baseSeverity": "CRITICAL", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", + "version": "3.1" } ] } diff --git a/2024/6xxx/CVE-2024-6333.json b/2024/6xxx/CVE-2024-6333.json index e50fbf08fa4..d67eea718a9 100644 --- a/2024/6xxx/CVE-2024-6333.json +++ b/2024/6xxx/CVE-2024-6333.json @@ -240,9 +240,9 @@ "references": { "reference_data": [ { - "url": "https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-015-for-CVE-2024-6333.pdf", + "url": "https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-015-for-Altalink-Versalink-and-WorkCentre-%E2%80%93-CVE-2024-6333-.pdf", "refsource": "MISC", - "name": "https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-015-for-CVE-2024-6333.pdf" + "name": "https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-015-for-Altalink-Versalink-and-WorkCentre-%E2%80%93-CVE-2024-6333-.pdf" } ] }, diff --git a/2024/9xxx/CVE-2024-9683.json b/2024/9xxx/CVE-2024-9683.json index 219cc05ee46..a2bf0fbe1a4 100644 --- a/2024/9xxx/CVE-2024-9683.json +++ b/2024/9xxx/CVE-2024-9683.json @@ -1,17 +1,94 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-9683", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "secalert@redhat.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A vulnerability was found in Quay, which allows successful authentication even when a truncated password version is provided. This flaw affects the authentication mechanism, reducing the overall security of password enforcement.\u00a0 While the risk is relatively low due to the typical length of the passwords used (73 characters), this vulnerability can still be exploited to reduce the complexity of brute-force or password-guessing attacks. The truncation of passwords weakens the overall authentication process, thereby reducing the effectiveness of password policies and potentially increasing the risk of unauthorized access in the future." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Authentication Bypass by Primary Weakness", + "cweId": "CWE-305" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Red Hat", + "product": { + "product_data": [ + { + "product_name": "Red Hat Quay 3", + "version": { + "version_data": [ + { + "version_value": "not down converted", + "x_cve_json_5_version_data": { + "defaultStatus": "affected" + } + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://access.redhat.com/security/cve/CVE-2024-9683", + "refsource": "MISC", + "name": "https://access.redhat.com/security/cve/CVE-2024-9683" + }, + { + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317559", + "refsource": "MISC", + "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2317559" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Red Hat would like to thank Alexander Pryor for reporting this issue." + } + ], + "impact": { + "cvss": [ + { + "attackComplexity": "HIGH", + "attackVector": "NETWORK", + "availabilityImpact": "NONE", + "baseScore": 4.8, + "baseSeverity": "MEDIUM", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "privilegesRequired": "NONE", + "scope": "UNCHANGED", + "userInteraction": "NONE", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", + "version": "3.1" } ] }