From f929793da169d6af09545af4736f6b269a15a40e Mon Sep 17 00:00:00 2001 From: CVE Team Date: Thu, 16 Jan 2020 18:01:11 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2010/3xxx/CVE-2010-3048.json | 50 +++++++++++++++++++++++++-- 2019/12xxx/CVE-2019-12423.json | 50 +++++++++++++++++++++++++-- 2019/13xxx/CVE-2019-13524.json | 62 ++++++++++++++++++++++++++++++++++ 2019/17xxx/CVE-2019-17573.json | 62 ++++++++++++++++++++++++++++++++++ 2019/1xxx/CVE-2019-1387.json | 5 +++ 2020/0xxx/CVE-2020-0601.json | 10 ++++++ 2020/0xxx/CVE-2020-0602.json | 5 +++ 2020/0xxx/CVE-2020-0603.json | 5 +++ 8 files changed, 243 insertions(+), 6 deletions(-) create mode 100644 2019/13xxx/CVE-2019-13524.json create mode 100644 2019/17xxx/CVE-2019-17573.json diff --git a/2010/3xxx/CVE-2010-3048.json b/2010/3xxx/CVE-2010-3048.json index f4a7bd51b06..cc5405277f6 100644 --- a/2010/3xxx/CVE-2010-3048.json +++ b/2010/3xxx/CVE-2010-3048.json @@ -1,8 +1,31 @@ { "CVE_data_meta": { - "ASSIGNER": "cve@mitre.org", + "ASSIGNER": "psirt@cisco.com", "ID": "CVE-2010-3048", - "STATE": "RESERVED" + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Cisco", + "product": { + "product_data": [ + { + "product_name": "Unified Personal Communicator", + "version": { + "version_data": [ + { + "version_value": "7.0 (1.13056)" + } + ] + } + } + ] + } + } + ] + } }, "data_format": "MITRE", "data_type": "CVE", @@ -11,7 +34,28 @@ "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Cisco Unified Personal Communicator 7.0 (1.13056) does not free allocated memory for received data and does not perform validation if memory allocation is successful, causing a remote denial of service condition." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Other" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "http://www.fuzzmyapp.com/advisories/FMA-2010-002/FMA-2010-002-EN.xml", + "refsource": "MISC", + "name": "http://www.fuzzmyapp.com/advisories/FMA-2010-002/FMA-2010-002-EN.xml" } ] } diff --git a/2019/12xxx/CVE-2019-12423.json b/2019/12xxx/CVE-2019-12423.json index 6fb23b6b8f6..42132f3edf0 100644 --- a/2019/12xxx/CVE-2019-12423.json +++ b/2019/12xxx/CVE-2019-12423.json @@ -4,14 +4,58 @@ "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2019-12423", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@apache.org", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Apache", + "product": { + "product_data": [ + { + "product_name": "CXF", + "version": { + "version_data": [ + { + "version_value": "All versions of Apache CXF prior to 3.3.5 and 3.2.12." + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Information Disclosure" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "CONFIRM", + "name": "http://cxf.apache.org/security-advisories.data/CVE-2019-12423.txt.asc?version=1&modificationDate=1579178393000&api=v2", + "url": "http://cxf.apache.org/security-advisories.data/CVE-2019-12423.txt.asc?version=1&modificationDate=1579178393000&api=v2" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter \"rs.security.keystore.type\" to \"jwk\". For this case all keys are returned in this file \"as is\", including all private key and secret key credentials. This is an obvious security risk if the user has configured the signature keystore file with private or secret key credentials. From CXF 3.3.5 and 3.2.12, it is mandatory to specify an alias corresponding to the id of the key in the JWK file, and only this key is returned. In addition, any private key information is omitted by default. \"oct\" keys, which contain secret keys, are not returned at all." } ] } diff --git a/2019/13xxx/CVE-2019-13524.json b/2019/13xxx/CVE-2019-13524.json new file mode 100644 index 00000000000..8c947c574b1 --- /dev/null +++ b/2019/13xxx/CVE-2019-13524.json @@ -0,0 +1,62 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2019-13524", + "ASSIGNER": "ics-cert@hq.dhs.gov", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "n/a", + "product": { + "product_data": [ + { + "product_name": "GE PACSystems RX3i", + "version": { + "version_data": [ + { + "version_value": "CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU320 All versions(End of Life)" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "IMPROPER INPUT VALIDATION CWE-20" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "MISC", + "name": "https://www.us-cert.gov/ics/advisories/icsa-20-014-01", + "url": "https://www.us-cert.gov/ics/advisories/icsa-20-014-01" + } + ] + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "GE PACSystems RX3i CPE100/115: All versions prior to R9.85,CPE302/305/310/330/400/410: All versions prior to R9.90,CRU/320 All versions(End of Life) may allow an attacker sending specially manipulated packets to cause the module state to change to halt-mode, resulting in a denial-of-service condition. An operator must reboot the CPU module after removing battery or energy pack to recover from halt-mode." + } + ] + } +} \ No newline at end of file diff --git a/2019/17xxx/CVE-2019-17573.json b/2019/17xxx/CVE-2019-17573.json new file mode 100644 index 00000000000..97de0467120 --- /dev/null +++ b/2019/17xxx/CVE-2019-17573.json @@ -0,0 +1,62 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2019-17573", + "ASSIGNER": "security@apache.org", + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "Apache", + "product": { + "product_data": [ + { + "product_name": "CXF", + "version": { + "version_data": [ + { + "version_value": "All versions of Apache CXF prior to 3.3.5 and 3.2.12." + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "Cross Site Scripting" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "CONFIRM", + "name": "http://cxf.apache.org/security-advisories.data/CVE-2019-17573.txt.asc?version=1&modificationDate=1579178542000&api=v2", + "url": "http://cxf.apache.org/security-advisories.data/CVE-2019-17573.txt.asc?version=1&modificationDate=1579178542000&api=v2" + } + ] + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable." + } + ] + } +} \ No newline at end of file diff --git a/2019/1xxx/CVE-2019-1387.json b/2019/1xxx/CVE-2019-1387.json index 8651d2f1f76..2a93ab8ba4a 100644 --- a/2019/1xxx/CVE-2019-1387.json +++ b/2019/1xxx/CVE-2019-1387.json @@ -93,6 +93,11 @@ "refsource": "FEDORA", "name": "FEDORA-2019-1cec196e20", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/" + }, + { + "refsource": "REDHAT", + "name": "RHSA-2020:0124", + "url": "https://access.redhat.com/errata/RHSA-2020:0124" } ] }, diff --git a/2020/0xxx/CVE-2020-0601.json b/2020/0xxx/CVE-2020-0601.json index 48a205f4c45..c52f93eee2b 100644 --- a/2020/0xxx/CVE-2020-0601.json +++ b/2020/0xxx/CVE-2020-0601.json @@ -194,6 +194,16 @@ "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601", "refsource": "MISC", "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601" + }, + { + "refsource": "MISC", + "name": "http://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html", + "url": "http://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html" + }, + { + "refsource": "MISC", + "name": "http://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html", + "url": "http://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.html" } ] } diff --git a/2020/0xxx/CVE-2020-0602.json b/2020/0xxx/CVE-2020-0602.json index 259e5db38df..141ee0754e3 100644 --- a/2020/0xxx/CVE-2020-0602.json +++ b/2020/0xxx/CVE-2020-0602.json @@ -62,6 +62,11 @@ "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0602", "refsource": "MISC", "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0602" + }, + { + "refsource": "REDHAT", + "name": "RHSA-2020:0130", + "url": "https://access.redhat.com/errata/RHSA-2020:0130" } ] } diff --git a/2020/0xxx/CVE-2020-0603.json b/2020/0xxx/CVE-2020-0603.json index 237c93b457b..b0b793c1793 100644 --- a/2020/0xxx/CVE-2020-0603.json +++ b/2020/0xxx/CVE-2020-0603.json @@ -62,6 +62,11 @@ "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603", "refsource": "MISC", "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0603" + }, + { + "refsource": "REDHAT", + "name": "RHSA-2020:0130", + "url": "https://access.redhat.com/errata/RHSA-2020:0130" } ] }