mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-06-19 17:32:41 +00:00
"-Synchronized-Data."
This commit is contained in:
CVE Team
parent
cb5f3c6f3d
commit
f9ca42a064
@ -1,17 +1,61 @@
|
|||||||
{
|
{
|
||||||
"data_type": "CVE",
|
|
||||||
"data_format": "MITRE",
|
|
||||||
"data_version": "4.0",
|
|
||||||
"CVE_data_meta": {
|
"CVE_data_meta": {
|
||||||
"ID": "CVE-2020-26708",
|
|
||||||
"ASSIGNER": "cve@mitre.org",
|
"ASSIGNER": "cve@mitre.org",
|
||||||
"STATE": "RESERVED"
|
"ID": "CVE-2020-26708",
|
||||||
|
"STATE": "PUBLIC"
|
||||||
},
|
},
|
||||||
|
"affects": {
|
||||||
|
"vendor": {
|
||||||
|
"vendor_data": [
|
||||||
|
{
|
||||||
|
"product": {
|
||||||
|
"product_data": [
|
||||||
|
{
|
||||||
|
"product_name": "n/a",
|
||||||
|
"version": {
|
||||||
|
"version_data": [
|
||||||
|
{
|
||||||
|
"version_value": "n/a"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"vendor_name": "n/a"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"data_format": "MITRE",
|
||||||
|
"data_type": "CVE",
|
||||||
|
"data_version": "4.0",
|
||||||
"description": {
|
"description": {
|
||||||
"description_data": [
|
"description_data": [
|
||||||
{
|
{
|
||||||
"lang": "eng",
|
"lang": "eng",
|
||||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
"value": "requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file."
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"problemtype": {
|
||||||
|
"problemtype_data": [
|
||||||
|
{
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "eng",
|
||||||
|
"value": "n/a"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"references": {
|
||||||
|
"reference_data": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/erinxocon/requests-xml/issues/7",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://github.com/erinxocon/requests-xml/issues/7"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|||||||
@ -1,17 +1,61 @@
|
|||||||
{
|
{
|
||||||
"data_type": "CVE",
|
|
||||||
"data_format": "MITRE",
|
|
||||||
"data_version": "4.0",
|
|
||||||
"CVE_data_meta": {
|
"CVE_data_meta": {
|
||||||
"ID": "CVE-2020-26709",
|
|
||||||
"ASSIGNER": "cve@mitre.org",
|
"ASSIGNER": "cve@mitre.org",
|
||||||
"STATE": "RESERVED"
|
"ID": "CVE-2020-26709",
|
||||||
|
"STATE": "PUBLIC"
|
||||||
},
|
},
|
||||||
|
"affects": {
|
||||||
|
"vendor": {
|
||||||
|
"vendor_data": [
|
||||||
|
{
|
||||||
|
"product": {
|
||||||
|
"product_data": [
|
||||||
|
{
|
||||||
|
"product_name": "n/a",
|
||||||
|
"version": {
|
||||||
|
"version_data": [
|
||||||
|
{
|
||||||
|
"version_value": "n/a"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"vendor_name": "n/a"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"data_format": "MITRE",
|
||||||
|
"data_type": "CVE",
|
||||||
|
"data_version": "4.0",
|
||||||
"description": {
|
"description": {
|
||||||
"description_data": [
|
"description_data": [
|
||||||
{
|
{
|
||||||
"lang": "eng",
|
"lang": "eng",
|
||||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
"value": "py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file."
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"problemtype": {
|
||||||
|
"problemtype_data": [
|
||||||
|
{
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "eng",
|
||||||
|
"value": "n/a"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"references": {
|
||||||
|
"reference_data": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/PinaeOS/py-xml/issues/2",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://github.com/PinaeOS/py-xml/issues/2"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|||||||
@ -1,17 +1,61 @@
|
|||||||
{
|
{
|
||||||
"data_type": "CVE",
|
|
||||||
"data_format": "MITRE",
|
|
||||||
"data_version": "4.0",
|
|
||||||
"CVE_data_meta": {
|
"CVE_data_meta": {
|
||||||
"ID": "CVE-2020-26710",
|
|
||||||
"ASSIGNER": "cve@mitre.org",
|
"ASSIGNER": "cve@mitre.org",
|
||||||
"STATE": "RESERVED"
|
"ID": "CVE-2020-26710",
|
||||||
|
"STATE": "PUBLIC"
|
||||||
},
|
},
|
||||||
|
"affects": {
|
||||||
|
"vendor": {
|
||||||
|
"vendor_data": [
|
||||||
|
{
|
||||||
|
"product": {
|
||||||
|
"product_data": [
|
||||||
|
{
|
||||||
|
"product_name": "n/a",
|
||||||
|
"version": {
|
||||||
|
"version_data": [
|
||||||
|
{
|
||||||
|
"version_value": "n/a"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"vendor_name": "n/a"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"data_format": "MITRE",
|
||||||
|
"data_type": "CVE",
|
||||||
|
"data_version": "4.0",
|
||||||
"description": {
|
"description": {
|
||||||
"description_data": [
|
"description_data": [
|
||||||
{
|
{
|
||||||
"lang": "eng",
|
"lang": "eng",
|
||||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
"value": "easy-parse v0.1.1 was discovered to contain a XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file."
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"problemtype": {
|
||||||
|
"problemtype_data": [
|
||||||
|
{
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "eng",
|
||||||
|
"value": "n/a"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"references": {
|
||||||
|
"reference_data": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/uncmath25/easy-parse/issues/3",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://github.com/uncmath25/easy-parse/issues/3"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|||||||
@ -11,7 +11,7 @@
|
|||||||
"description_data": [
|
"description_data": [
|
||||||
{
|
{
|
||||||
"lang": "eng",
|
"lang": "eng",
|
||||||
"value": "The External Visitor Manager portal of HID\u2019s SAFE versions 5.8.0 through\n 5.11.3 are vulnerable to manipulation within web fields in the \napplication programmable interface (API). An attacker could log in using\n account credentials available through a request generated by an \ninternal user and then manipulate the visitor-id within the web API to \naccess the personal data of other users. There is no limit on the number\n of requests that can be made to the HID SAFE Web Server, so an attacker\n could also exploit this vulnerability to create a denial-of-service \ncondition.\n\n"
|
"value": "The External Visitor Manager portal of HID\u2019s SAFE versions 5.8.0 through 5.11.3 are vulnerable to manipulation within web fields in the application programmable interface (API). An attacker could log in using account credentials available through a request generated by an internal user and then manipulate the visitor-id within the web API to access the personal data of other users. There is no limit on the number of requests that can be made to the HID SAFE Web Server, so an attacker could also exploit this vulnerability to create a denial-of-service condition.\n\n"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
@ -21,7 +21,7 @@
|
|||||||
"description": [
|
"description": [
|
||||||
{
|
{
|
||||||
"lang": "eng",
|
"lang": "eng",
|
||||||
"value": "CWE-471: Modification of Assumed-Immutable Data",
|
"value": "CWE-471 Modification of Assumed-Immutable Data",
|
||||||
"cweId": "CWE-471"
|
"cweId": "CWE-471"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
@ -59,55 +59,15 @@
|
|||||||
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-152-02",
|
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-152-02",
|
||||||
"refsource": "MISC",
|
"refsource": "MISC",
|
||||||
"name": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-152-02"
|
"name": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-152-02"
|
||||||
},
|
|
||||||
{
|
|
||||||
"url": "https://www.hidglobal.com/security-center",
|
|
||||||
"refsource": "MISC",
|
|
||||||
"name": "https://www.hidglobal.com/security-center"
|
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"generator": {
|
"generator": {
|
||||||
"engine": "Vulnogram 0.1.0-dev"
|
"engine": "VINCE 2.1.2",
|
||||||
|
"env": "prod",
|
||||||
|
"origin": "https://cveawg.mitre.org/api/cve/CVE-2023-2904"
|
||||||
},
|
},
|
||||||
"source": {
|
"source": {
|
||||||
"discovery": "EXTERNAL"
|
"discovery": "UNKNOWN"
|
||||||
},
|
|
||||||
"solution": [
|
|
||||||
{
|
|
||||||
"lang": "en",
|
|
||||||
"supportingMedia": [
|
|
||||||
{
|
|
||||||
"base64": false,
|
|
||||||
"type": "text/html",
|
|
||||||
"value": "\n<p>The External Visitor Management feature is licensed and deployed \nseparately from the HID SAFE core software. Users not using this feature\n are not affected. According to HID Global, the number of affected \nsystems is limited and all affected systems have been patched.</p>\n<p>Please see HID\u2019s <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.hidglobal.com/security-center\">security advisory</a> for more information.\n\n</p>"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"value": "The External Visitor Management feature is licensed and deployed \nseparately from the HID SAFE core software. Users not using this feature\n are not affected. According to HID Global, the number of affected \nsystems is limited and all affected systems have been patched.\n\n\nPlease see HID\u2019s security advisory https://www.hidglobal.com/security-center for more information.\n\n\n\n"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"credits": [
|
|
||||||
{
|
|
||||||
"lang": "en",
|
|
||||||
"value": "CISA internal research reported this vulnerability to HID."
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"impact": {
|
|
||||||
"cvss": [
|
|
||||||
{
|
|
||||||
"attackComplexity": "LOW",
|
|
||||||
"attackVector": "NETWORK",
|
|
||||||
"availabilityImpact": "HIGH",
|
|
||||||
"baseScore": 7.3,
|
|
||||||
"baseSeverity": "HIGH",
|
|
||||||
"confidentialityImpact": "HIGH",
|
|
||||||
"integrityImpact": "NONE",
|
|
||||||
"privilegesRequired": "LOW",
|
|
||||||
"scope": "UNCHANGED",
|
|
||||||
"userInteraction": "REQUIRED",
|
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H",
|
|
||||||
"version": "3.1"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -5,101 +5,13 @@
|
|||||||
"CVE_data_meta": {
|
"CVE_data_meta": {
|
||||||
"ID": "CVE-2023-35170",
|
"ID": "CVE-2023-35170",
|
||||||
"ASSIGNER": "security-advisories@github.com",
|
"ASSIGNER": "security-advisories@github.com",
|
||||||
"STATE": "PUBLIC"
|
"STATE": "REJECT"
|
||||||
},
|
},
|
||||||
"description": {
|
"description": {
|
||||||
"description_data": [
|
"description_data": [
|
||||||
{
|
{
|
||||||
"lang": "eng",
|
"lang": "eng",
|
||||||
"value": "Sliver is an open source cross-platform adversary emulation/red team framework. The cryptography implementation in Sliver up to and including version 1.5.39 allows a man in the middle (MitM) attack with access to the corresponding implant binary to execute arbitrary codes on implanted devices via intercepted and crafted responses. A successful attack grants the attacker permission to execute arbitrary code on the implanted device. Users are advised to upgrade. There are no known workarounds for this vulnerability."
|
"value": "** REJECT ** This CVE is a duplicate of another CVE."
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"problemtype": {
|
|
||||||
"problemtype_data": [
|
|
||||||
{
|
|
||||||
"description": [
|
|
||||||
{
|
|
||||||
"lang": "eng",
|
|
||||||
"value": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
|
|
||||||
"cweId": "CWE-327"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"affects": {
|
|
||||||
"vendor": {
|
|
||||||
"vendor_data": [
|
|
||||||
{
|
|
||||||
"vendor_name": "BishopFox",
|
|
||||||
"product": {
|
|
||||||
"product_data": [
|
|
||||||
{
|
|
||||||
"product_name": "sliver",
|
|
||||||
"version": {
|
|
||||||
"version_data": [
|
|
||||||
{
|
|
||||||
"version_affected": "=",
|
|
||||||
"version_value": ">= 1.5.0, < 1.5.40"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"references": {
|
|
||||||
"reference_data": [
|
|
||||||
{
|
|
||||||
"url": "https://github.com/BishopFox/sliver/security/advisories/GHSA-8jxm-xp43-qh3q",
|
|
||||||
"refsource": "MISC",
|
|
||||||
"name": "https://github.com/BishopFox/sliver/security/advisories/GHSA-8jxm-xp43-qh3q"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"url": "https://github.com/BishopFox/sliver/commit/2d1ea6192cac2ff9d6450b2d96043fdbf8561516",
|
|
||||||
"refsource": "MISC",
|
|
||||||
"name": "https://github.com/BishopFox/sliver/commit/2d1ea6192cac2ff9d6450b2d96043fdbf8561516"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"url": "https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go",
|
|
||||||
"refsource": "MISC",
|
|
||||||
"name": "https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"url": "https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go",
|
|
||||||
"refsource": "MISC",
|
|
||||||
"name": "https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"url": "https://github.com/BishopFox/sliver/releases/tag/v1.5.40",
|
|
||||||
"refsource": "MISC",
|
|
||||||
"name": "https://github.com/BishopFox/sliver/releases/tag/v1.5.40"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"source": {
|
|
||||||
"advisory": "GHSA-8jxm-xp43-qh3q",
|
|
||||||
"discovery": "UNKNOWN"
|
|
||||||
},
|
|
||||||
"impact": {
|
|
||||||
"cvss": [
|
|
||||||
{
|
|
||||||
"attackComplexity": "HIGH",
|
|
||||||
"attackVector": "NETWORK",
|
|
||||||
"availabilityImpact": "HIGH",
|
|
||||||
"baseScore": 8.1,
|
|
||||||
"baseSeverity": "HIGH",
|
|
||||||
"confidentialityImpact": "HIGH",
|
|
||||||
"integrityImpact": "HIGH",
|
|
||||||
"privilegesRequired": "NONE",
|
|
||||||
"scope": "UNCHANGED",
|
|
||||||
"userInteraction": "NONE",
|
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
||||||
"version": "3.1"
|
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|||||||
@ -1,17 +1,104 @@
|
|||||||
{
|
{
|
||||||
|
"data_version": "4.0",
|
||||||
"data_type": "CVE",
|
"data_type": "CVE",
|
||||||
"data_format": "MITRE",
|
"data_format": "MITRE",
|
||||||
"data_version": "4.0",
|
|
||||||
"CVE_data_meta": {
|
"CVE_data_meta": {
|
||||||
"ID": "CVE-2023-36468",
|
"ID": "CVE-2023-36468",
|
||||||
"ASSIGNER": "cve@mitre.org",
|
"ASSIGNER": "security-advisories@github.com",
|
||||||
"STATE": "RESERVED"
|
"STATE": "PUBLIC"
|
||||||
},
|
},
|
||||||
"description": {
|
"description": {
|
||||||
"description_data": [
|
"description_data": [
|
||||||
{
|
{
|
||||||
"lang": "eng",
|
"lang": "eng",
|
||||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
"value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgraded and that upgrade contains a fix for a bug in a document, just a new version of that document is added. In some cases, it's still possible to exploit the vulnerability that was fixed in the new version. The severity of this depends on the fixed vulnerability, for the purpose of this advisory take CVE-2022-36100/GHSA-2g5c-228j-p52x as example - it is easily exploitable with just view rights and critical. When XWiki is upgraded from a version before the fix for it (e.g., 14.3) to a version including the fix (e.g., 14.4), the vulnerability can still be reproduced by adding `rev=1.1` to the URL used in the reproduction steps so remote code execution is possible even after upgrading. Therefore, this affects the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability also affects manually added script macros that contained security vulnerabilities that were later fixed by changing the script macro without deleting the versions with the security vulnerability from the history. This vulnerability doesn't affect freshly installed versions of XWiki. Further, this vulnerability doesn't affect content that is only loaded from the current version of a document like the code of wiki macros or UI extensions. This vulnerability has been patched in XWiki 14.10.7 and 15.2RC1 by forcing old revisions to be executed in a restricted mode that disables all script macros. As a workaround, admins can manually delete old revisions of affected documents. A script could be used to identify all installed documents and delete the history for them. However, also manually added and later corrected code may be affected by this vulnerability so it is easy to miss documents."
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"problemtype": {
|
||||||
|
"problemtype_data": [
|
||||||
|
{
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "eng",
|
||||||
|
"value": "CWE-459: Incomplete Cleanup",
|
||||||
|
"cweId": "CWE-459"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"affects": {
|
||||||
|
"vendor": {
|
||||||
|
"vendor_data": [
|
||||||
|
{
|
||||||
|
"vendor_name": "xwiki",
|
||||||
|
"product": {
|
||||||
|
"product_data": [
|
||||||
|
{
|
||||||
|
"product_name": "xwiki-platform",
|
||||||
|
"version": {
|
||||||
|
"version_data": [
|
||||||
|
{
|
||||||
|
"version_affected": "=",
|
||||||
|
"version_value": ">= 2.0, < 14.10.7"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version_affected": "=",
|
||||||
|
"version_value": ">= 15.0-rc-1, < 15.2-rc-1"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"references": {
|
||||||
|
"reference_data": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8q9q-r9v2-644m",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8q9q-r9v2-644m"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2g5c-228j-p52x",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2g5c-228j-p52x"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://jira.xwiki.org/browse/XWIKI-20594",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://jira.xwiki.org/browse/XWIKI-20594"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"source": {
|
||||||
|
"advisory": "GHSA-8q9q-r9v2-644m",
|
||||||
|
"discovery": "UNKNOWN"
|
||||||
|
},
|
||||||
|
"impact": {
|
||||||
|
"cvss": [
|
||||||
|
{
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"availabilityImpact": "HIGH",
|
||||||
|
"baseScore": 10,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
||||||
|
"version": "3.1"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|||||||
@ -1,17 +1,109 @@
|
|||||||
{
|
{
|
||||||
|
"data_version": "4.0",
|
||||||
"data_type": "CVE",
|
"data_type": "CVE",
|
||||||
"data_format": "MITRE",
|
"data_format": "MITRE",
|
||||||
"data_version": "4.0",
|
|
||||||
"CVE_data_meta": {
|
"CVE_data_meta": {
|
||||||
"ID": "CVE-2023-36469",
|
"ID": "CVE-2023-36469",
|
||||||
"ASSIGNER": "cve@mitre.org",
|
"ASSIGNER": "security-advisories@github.com",
|
||||||
"STATE": "RESERVED"
|
"STATE": "PUBLIC"
|
||||||
},
|
},
|
||||||
"description": {
|
"description": {
|
||||||
"description_data": [
|
"description_data": [
|
||||||
{
|
{
|
||||||
"lang": "eng",
|
"lang": "eng",
|
||||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
"value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This has been patched in XWiki 14.10.6 and 15.2RC1. Users are advised to update. As a workaround the main security fix can be manually applied by patching the affected document `XWiki.Notifications.Code.NotificationRSSService`. This will break the link to the differences, though as this requires additional changes to Velocity templates as shown in the patch. While the default template is available in the instance and can be easily patched, the template for mentions is contained in a `.jar`-file and thus cannot be fixed without replacing that jar."
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"problemtype": {
|
||||||
|
"problemtype_data": [
|
||||||
|
{
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "eng",
|
||||||
|
"value": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')",
|
||||||
|
"cweId": "CWE-74"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"affects": {
|
||||||
|
"vendor": {
|
||||||
|
"vendor_data": [
|
||||||
|
{
|
||||||
|
"vendor_name": "xwiki",
|
||||||
|
"product": {
|
||||||
|
"product_data": [
|
||||||
|
{
|
||||||
|
"product_name": "xwiki-platform",
|
||||||
|
"version": {
|
||||||
|
"version_data": [
|
||||||
|
{
|
||||||
|
"version_affected": "=",
|
||||||
|
"version_value": ">= 9.6-rc-1, < 14.10.6"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version_affected": "=",
|
||||||
|
"version_value": ">= 15.0-rc-1, < 15.2-rc-1"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"references": {
|
||||||
|
"reference_data": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-94pf-92hw-2hjc",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-94pf-92hw-2hjc"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39c",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39c"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39c#diff-7221a548809fa2ba34348556f4b5bd436463c559ebdf691197932ee7ce4478ca",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39c#diff-7221a548809fa2ba34348556f4b5bd436463c559ebdf691197932ee7ce4478ca"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39c#diff-b261c6eac3108c3e6e734054c28a78f59d3439ab72fe8582dadf87670a0d15a4",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39c#diff-b261c6eac3108c3e6e734054c28a78f59d3439ab72fe8582dadf87670a0d15a4"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://jira.xwiki.org/browse/XWIKI-20610",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://jira.xwiki.org/browse/XWIKI-20610"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"source": {
|
||||||
|
"advisory": "GHSA-94pf-92hw-2hjc",
|
||||||
|
"discovery": "UNKNOWN"
|
||||||
|
},
|
||||||
|
"impact": {
|
||||||
|
"cvss": [
|
||||||
|
{
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"availabilityImpact": "HIGH",
|
||||||
|
"baseScore": 10,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
||||||
|
"version": "3.1"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|||||||
@ -1,17 +1,105 @@
|
|||||||
{
|
{
|
||||||
|
"data_version": "4.0",
|
||||||
"data_type": "CVE",
|
"data_type": "CVE",
|
||||||
"data_format": "MITRE",
|
"data_format": "MITRE",
|
||||||
"data_version": "4.0",
|
|
||||||
"CVE_data_meta": {
|
"CVE_data_meta": {
|
||||||
"ID": "CVE-2023-36470",
|
"ID": "CVE-2023-36470",
|
||||||
"ASSIGNER": "cve@mitre.org",
|
"ASSIGNER": "security-advisories@github.com",
|
||||||
"STATE": "RESERVED"
|
"STATE": "PUBLIC"
|
||||||
},
|
},
|
||||||
"description": {
|
"description": {
|
||||||
"description_data": [
|
"description_data": [
|
||||||
{
|
{
|
||||||
"lang": "eng",
|
"lang": "eng",
|
||||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
"value": "XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By either creating a new or editing an existing document with an icon set, an attacker can inject XWiki syntax and Velocity code that is executed with programming rights and thus allows remote code execution. There are different attack vectors, the simplest is the Velocity code in the icon set's HTML or XWiki syntax definition. The [icon picker](https://extensions.xwiki.org/xwiki/bin/view/Extension/Icon%20Theme%20Application#HIconPicker) can be used to trigger the rendering of any icon set. The XWiki syntax variant of the icon set is also used without any escaping in some documents, allowing to inject XWiki syntax including script macros into a document that might have programming right, for this the currently used icon theme needs to be edited. Further, the HTML output of the icon set is output as JSON in the icon picker and this JSON is interpreted as XWiki syntax, allowing again the injection of script macros into a document with programming right and thus allowing remote code execution. This impacts the confidentiality, integrity and availability of the whole XWiki instance. This issue has been patched in XWiki 14.10.6 and 15.1. Icon themes now require script right and the code in the icon theme is executed within the context of the icon theme, preventing any rights escalation. A macro for displaying icons has been introduced to avoid injecting the raw wiki syntax of an icon set into another document. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"problemtype": {
|
||||||
|
"problemtype_data": [
|
||||||
|
{
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "eng",
|
||||||
|
"value": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')",
|
||||||
|
"cweId": "CWE-74"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"affects": {
|
||||||
|
"vendor": {
|
||||||
|
"vendor_data": [
|
||||||
|
{
|
||||||
|
"vendor_name": "xwiki",
|
||||||
|
"product": {
|
||||||
|
"product_data": [
|
||||||
|
{
|
||||||
|
"product_name": "xwiki-platform",
|
||||||
|
"version": {
|
||||||
|
"version_data": [
|
||||||
|
{
|
||||||
|
"version_affected": "=",
|
||||||
|
"version_value": ">= 6.2-milestone-1, < 14.10.6"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"references": {
|
||||||
|
"reference_data": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fm68-j7ww-h9xf",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fm68-j7ww-h9xf"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/xwiki/xwiki-platform/commit/46b542854978e9caa687a5c2b8817b8b17877d94",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://github.com/xwiki/xwiki-platform/commit/46b542854978e9caa687a5c2b8817b8b17877d94"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/xwiki/xwiki-platform/commit/79418dd92ca11941b46987ef881bf50424898ff4",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://github.com/xwiki/xwiki-platform/commit/79418dd92ca11941b46987ef881bf50424898ff4"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://github.com/xwiki/xwiki-platform/commit/b0cdfd893912baaa053d106a92e39fa1858843c7"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://jira.xwiki.org/browse/XWIKI-20524",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://jira.xwiki.org/browse/XWIKI-20524"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"source": {
|
||||||
|
"advisory": "GHSA-fm68-j7ww-h9xf",
|
||||||
|
"discovery": "UNKNOWN"
|
||||||
|
},
|
||||||
|
"impact": {
|
||||||
|
"cvss": [
|
||||||
|
{
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"availabilityImpact": "HIGH",
|
||||||
|
"baseScore": 10,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
||||||
|
"version": "3.1"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
|||||||
@ -1,18 +1,135 @@
|
|||||||
{
|
{
|
||||||
|
"data_version": "4.0",
|
||||||
"data_type": "CVE",
|
"data_type": "CVE",
|
||||||
"data_format": "MITRE",
|
"data_format": "MITRE",
|
||||||
"data_version": "4.0",
|
|
||||||
"CVE_data_meta": {
|
"CVE_data_meta": {
|
||||||
"ID": "CVE-2023-36607",
|
"ID": "CVE-2023-36607",
|
||||||
"ASSIGNER": "cve@mitre.org",
|
"ASSIGNER": "ics-cert@hq.dhs.gov",
|
||||||
"STATE": "RESERVED"
|
"STATE": "PUBLIC"
|
||||||
},
|
},
|
||||||
"description": {
|
"description": {
|
||||||
"description_data": [
|
"description_data": [
|
||||||
{
|
{
|
||||||
"lang": "eng",
|
"lang": "eng",
|
||||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
"value": "The affected TBox RTUs are missing authorization for running some API commands. An attacker running these commands could reveal sensitive information such as software versions and web server file contents.\n\n"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"problemtype": {
|
||||||
|
"problemtype_data": [
|
||||||
|
{
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "eng",
|
||||||
|
"value": "CWE-862 Missing Authorization",
|
||||||
|
"cweId": "CWE-862"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"affects": {
|
||||||
|
"vendor": {
|
||||||
|
"vendor_data": [
|
||||||
|
{
|
||||||
|
"vendor_name": "Ovarro",
|
||||||
|
"product": {
|
||||||
|
"product_data": [
|
||||||
|
{
|
||||||
|
"product_name": "TBox RM2",
|
||||||
|
"version": {
|
||||||
|
"version_data": [
|
||||||
|
{
|
||||||
|
"version_affected": "<=",
|
||||||
|
"version_name": "0",
|
||||||
|
"version_value": "1.50.598"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"product_name": "TBox TG2",
|
||||||
|
"version": {
|
||||||
|
"version_data": [
|
||||||
|
{
|
||||||
|
"version_affected": "<=",
|
||||||
|
"version_name": "0",
|
||||||
|
"version_value": "1.50.598"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"product_name": "TBox LT2",
|
||||||
|
"version": {
|
||||||
|
"version_data": [
|
||||||
|
{
|
||||||
|
"version_affected": "<=",
|
||||||
|
"version_name": "0",
|
||||||
|
"version_value": "1.50.598"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"product_name": "TBox MS-CPU32-S2",
|
||||||
|
"version": {
|
||||||
|
"version_data": [
|
||||||
|
{
|
||||||
|
"version_affected": "<=",
|
||||||
|
"version_name": "0",
|
||||||
|
"version_value": "1.50.598"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"product_name": "TBox MS-CPU32",
|
||||||
|
"version": {
|
||||||
|
"version_data": [
|
||||||
|
{
|
||||||
|
"version_affected": "<=",
|
||||||
|
"version_name": "0",
|
||||||
|
"version_value": "1.50.598"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"references": {
|
||||||
|
"reference_data": [
|
||||||
|
{
|
||||||
|
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-03"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"generator": {
|
||||||
|
"engine": "VINCE 2.1.2",
|
||||||
|
"env": "prod",
|
||||||
|
"origin": "https://cveawg.mitre.org/api/cve/CVE-2023-36607"
|
||||||
|
},
|
||||||
|
"source": {
|
||||||
|
"discovery": "UNKNOWN"
|
||||||
|
},
|
||||||
|
"credits": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Floris Hendriks"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Jeroen Wijenbergh"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Radboud University"
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
100
2023/3xxx/CVE-2023-3464.json
Normal file
100
2023/3xxx/CVE-2023-3464.json
Normal file
@ -0,0 +1,100 @@
|
|||||||
|
{
|
||||||
|
"data_version": "4.0",
|
||||||
|
"data_type": "CVE",
|
||||||
|
"data_format": "MITRE",
|
||||||
|
"CVE_data_meta": {
|
||||||
|
"ID": "CVE-2023-3464",
|
||||||
|
"ASSIGNER": "cna@vuldb.com",
|
||||||
|
"STATE": "PUBLIC"
|
||||||
|
},
|
||||||
|
"description": {
|
||||||
|
"description_data": [
|
||||||
|
{
|
||||||
|
"lang": "eng",
|
||||||
|
"value": "A vulnerability was found in SimplePHPscripts Classified Ads Script 1.8. It has been classified as problematic. Affected is an unknown function of the file /preview.php of the component URL Parameter Handler. The manipulation of the argument p leads to cross site scripting. It is possible to launch the attack remotely. It is recommended to upgrade the affected component. VDB-232710 is the identifier assigned to this vulnerability."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "deu",
|
||||||
|
"value": "Es wurde eine problematische Schwachstelle in SimplePHPscripts Classified Ads Script 1.8 ausgemacht. Es betrifft eine unbekannte Funktion der Datei /preview.php der Komponente URL Parameter Handler. Mittels dem Manipulieren des Arguments p mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"problemtype": {
|
||||||
|
"problemtype_data": [
|
||||||
|
{
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "eng",
|
||||||
|
"value": "CWE-79 Cross Site Scripting",
|
||||||
|
"cweId": "CWE-79"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"affects": {
|
||||||
|
"vendor": {
|
||||||
|
"vendor_data": [
|
||||||
|
{
|
||||||
|
"vendor_name": "SimplePHPscripts",
|
||||||
|
"product": {
|
||||||
|
"product_data": [
|
||||||
|
{
|
||||||
|
"product_name": "Classified Ads Script",
|
||||||
|
"version": {
|
||||||
|
"version_data": [
|
||||||
|
{
|
||||||
|
"version_affected": "=",
|
||||||
|
"version_value": "1.8"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"references": {
|
||||||
|
"reference_data": [
|
||||||
|
{
|
||||||
|
"url": "https://vuldb.com/?id.232710",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://vuldb.com/?id.232710"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://vuldb.com/?ctiid.232710",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://vuldb.com/?ctiid.232710"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://simplephpscripts.com/guestbook-script-php/guestbook/preview.php",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://simplephpscripts.com/guestbook-script-php/guestbook/preview.php"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"impact": {
|
||||||
|
"cvss": [
|
||||||
|
{
|
||||||
|
"version": "3.1",
|
||||||
|
"baseScore": 3.5,
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
|
||||||
|
"baseSeverity": "LOW"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "3.0",
|
||||||
|
"baseScore": 3.5,
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
|
||||||
|
"baseSeverity": "LOW"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "2.0",
|
||||||
|
"baseScore": 4,
|
||||||
|
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
106
2023/3xxx/CVE-2023-3465.json
Normal file
106
2023/3xxx/CVE-2023-3465.json
Normal file
@ -0,0 +1,106 @@
|
|||||||
|
{
|
||||||
|
"data_version": "4.0",
|
||||||
|
"data_type": "CVE",
|
||||||
|
"data_format": "MITRE",
|
||||||
|
"CVE_data_meta": {
|
||||||
|
"ID": "CVE-2023-3465",
|
||||||
|
"ASSIGNER": "cna@vuldb.com",
|
||||||
|
"STATE": "PUBLIC"
|
||||||
|
},
|
||||||
|
"description": {
|
||||||
|
"description_data": [
|
||||||
|
{
|
||||||
|
"lang": "eng",
|
||||||
|
"value": "A vulnerability was found in SimplePHPscripts Classified Ads Script 1.8. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file user.php of the component HTTP POST Request Handler. The manipulation of the argument title leads to cross site scripting. The attack can be launched remotely. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-232711."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "deu",
|
||||||
|
"value": "In SimplePHPscripts Classified Ads Script 1.8 wurde eine problematische Schwachstelle ausgemacht. Das betrifft eine unbekannte Funktionalit\u00e4t der Datei user.php der Komponente HTTP POST Request Handler. Mittels Manipulieren des Arguments title mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"problemtype": {
|
||||||
|
"problemtype_data": [
|
||||||
|
{
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "eng",
|
||||||
|
"value": "CWE-79 Cross Site Scripting",
|
||||||
|
"cweId": "CWE-79"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"affects": {
|
||||||
|
"vendor": {
|
||||||
|
"vendor_data": [
|
||||||
|
{
|
||||||
|
"vendor_name": "SimplePHPscripts",
|
||||||
|
"product": {
|
||||||
|
"product_data": [
|
||||||
|
{
|
||||||
|
"product_name": "Classified Ads Script",
|
||||||
|
"version": {
|
||||||
|
"version_data": [
|
||||||
|
{
|
||||||
|
"version_affected": "=",
|
||||||
|
"version_value": "1.8"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"references": {
|
||||||
|
"reference_data": [
|
||||||
|
{
|
||||||
|
"url": "https://vuldb.com/?id.232711",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://vuldb.com/?id.232711"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://vuldb.com/?ctiid.232711",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://vuldb.com/?ctiid.232711"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://simplephpscripts.com/guestbook-script-php/guestbook/preview.php",
|
||||||
|
"refsource": "MISC",
|
||||||
|
"name": "https://simplephpscripts.com/guestbook-script-php/guestbook/preview.php"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"credits": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "skalvin (VulDB User)"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"impact": {
|
||||||
|
"cvss": [
|
||||||
|
{
|
||||||
|
"version": "3.1",
|
||||||
|
"baseScore": 3.5,
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
|
||||||
|
"baseSeverity": "LOW"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "3.0",
|
||||||
|
"baseScore": 3.5,
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
|
||||||
|
"baseSeverity": "LOW"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"version": "2.0",
|
||||||
|
"baseScore": 4,
|
||||||
|
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
Loading…
x
Reference in New Issue
Block a user