From fe71b6381f137ca9751e16c11f69a44d303737fc Mon Sep 17 00:00:00 2001 From: CVE Team Date: Wed, 5 Jun 2024 13:00:33 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2023/7xxx/CVE-2023-7267.json | 18 +++++++ 2024/2xxx/CVE-2024-2257.json | 30 +++++++++++- 2024/3xxx/CVE-2024-3469.json | 79 ++++++++++++++++++++++++++++-- 2024/4xxx/CVE-2024-4231.json | 30 +++++++++++- 2024/4xxx/CVE-2024-4232.json | 32 ++++++++++-- 2024/5xxx/CVE-2024-5459.json | 95 ++++++++++++++++++++++++++++++++++-- 6 files changed, 269 insertions(+), 15 deletions(-) create mode 100644 2023/7xxx/CVE-2023-7267.json diff --git a/2023/7xxx/CVE-2023-7267.json b/2023/7xxx/CVE-2023-7267.json new file mode 100644 index 00000000000..21b29439ee9 --- /dev/null +++ b/2023/7xxx/CVE-2023-7267.json @@ -0,0 +1,18 @@ +{ + "data_type": "CVE", + "data_format": "MITRE", + "data_version": "4.0", + "CVE_data_meta": { + "ID": "CVE-2023-7267", + "ASSIGNER": "cve@mitre.org", + "STATE": "RESERVED" + }, + "description": { + "description_data": [ + { + "lang": "eng", + "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + } + ] + } +} \ No newline at end of file diff --git a/2024/2xxx/CVE-2024-2257.json b/2024/2xxx/CVE-2024-2257.json index e12cdad3794..074a8e03e06 100644 --- a/2024/2xxx/CVE-2024-2257.json +++ b/2024/2xxx/CVE-2024-2257.json @@ -21,7 +21,8 @@ "description": [ { "lang": "eng", - "value": "CWE-20 Improper Input Validation" + "value": "CWE-20 Improper Input Validation", + "cweId": "CWE-20" } ] } @@ -59,5 +60,30 @@ "name": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0158" } ] - } + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "UNKNOWN" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Upgrade Digisol Router firmware to version v3.1.02-240311.
https://www.digisol.com/firmware/
" + } + ], + "value": "Upgrade Digisol Router firmware to version v3.1.02-240311.\n https://www.digisol.com/firmware/" + } + ], + "credits": [ + { + "lang": "en", + "value": "This vulnerability is discovered by Shravan Singh, Ganesh Bakare and Karan Patel from Redfox Cyber Security Inc, Toronto, Canada." + } + ] } \ No newline at end of file diff --git a/2024/3xxx/CVE-2024-3469.json b/2024/3xxx/CVE-2024-3469.json index 47a3291378b..359b3519f24 100644 --- a/2024/3xxx/CVE-2024-3469.json +++ b/2024/3xxx/CVE-2024-3469.json @@ -1,17 +1,88 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-3469", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@wordfence.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The GP Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "GeneratePress", + "product": { + "product_data": [ + { + "product_name": "GP Premium", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "*", + "version_value": "2.4.0" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1a697391-f30d-403f-9046-8fa219a49302?source=cve", + "refsource": "MISC", + "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1a697391-f30d-403f-9046-8fa219a49302?source=cve" + }, + { + "url": "https://generatepress.com/category/changelog/", + "refsource": "MISC", + "name": "https://generatepress.com/category/changelog/" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "1337_Wannabe" + }, + { + "lang": "en", + "value": "Mohamed Awad" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "baseScore": 6.1, + "baseSeverity": "MEDIUM" } ] } diff --git a/2024/4xxx/CVE-2024-4231.json b/2024/4xxx/CVE-2024-4231.json index 491d00a5c9c..f356f72c4ae 100644 --- a/2024/4xxx/CVE-2024-4231.json +++ b/2024/4xxx/CVE-2024-4231.json @@ -21,7 +21,8 @@ "description": [ { "lang": "eng", - "value": "CWE-1191: On-Chip Debug and Test Interface With Improper Access Control" + "value": "CWE-1191: On-Chip Debug and Test Interface With Improper Access Control", + "cweId": "CWE-1191" } ] } @@ -59,5 +60,30 @@ "name": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0158" } ] - } + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "UNKNOWN" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Upgrade Digisol Router firmware to version v3.1.02-240311.
https://www.digisol.com/firmware/
" + } + ], + "value": "Upgrade Digisol Router firmware to version v3.1.02-240311.\n https://www.digisol.com/firmware/" + } + ], + "credits": [ + { + "lang": "en", + "value": "This vulnerability is discovered by Shravan Singh, Ganesh Bakare and Karan Patel from Redfox Cyber Security Inc, Toronto, Canada." + } + ] } \ No newline at end of file diff --git a/2024/4xxx/CVE-2024-4232.json b/2024/4xxx/CVE-2024-4232.json index 1bb5f4a2f79..4ca9551bc36 100644 --- a/2024/4xxx/CVE-2024-4232.json +++ b/2024/4xxx/CVE-2024-4232.json @@ -11,7 +11,7 @@ "description_data": [ { "lang": "eng", - "value": "This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to presence of root terminal access on a serial interface without proper access control. An\u00a0attacker\u00a0with\u00a0physical\u00a0access\u00a0could exploit this by identifying UART pins and accessing the root shell on the vulnerable system.\n\nSuccessful exploitation of this vulnerability could allow the attacker to access the sensitive information on the targeted system.This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to lack of encryption or hashing in storing of passwords within the router's firmware/ database. An\u00a0attacker\u00a0with\u00a0physical\u00a0access\u00a0could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext passwords on the vulnerable system.\n\nSuccessful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system." + "value": "This vulnerability exists in Digisol Router (DG-GR1321: Hardware version 3.7L; Firmware version : v3.2.02) due to lack of encryption or hashing in storing of passwords within the router's firmware/ database. An attacker with physical access could exploit this by extracting the firmware and reverse engineer the binary data to access the plaintext passwords on the vulnerable system.\n\nSuccessful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the targeted system." } ] }, @@ -21,7 +21,8 @@ "description": [ { "lang": "eng", - "value": "CWE-256: Plaintext Storage of a Password" + "value": "CWE-256: Plaintext Storage of a Password", + "cweId": "CWE-256" } ] } @@ -59,5 +60,30 @@ "name": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0158" } ] - } + }, + "generator": { + "engine": "Vulnogram 0.2.0" + }, + "source": { + "discovery": "UNKNOWN" + }, + "solution": [ + { + "lang": "en", + "supportingMedia": [ + { + "base64": false, + "type": "text/html", + "value": "Upgrade Digisol Router firmware to version v3.1.02-240311.
https://www.digisol.com/firmware/
" + } + ], + "value": "Upgrade Digisol Router firmware to version v3.1.02-240311.\n https://www.digisol.com/firmware/" + } + ], + "credits": [ + { + "lang": "en", + "value": "This vulnerability is discovered by Shravan Singh, Ganesh Bakare and Karan Patel from Redfox Cyber Security Inc, Toronto, Canada." + } + ] } \ No newline at end of file diff --git a/2024/5xxx/CVE-2024-5459.json b/2024/5xxx/CVE-2024-5459.json index 5a2c0da5051..666ddcd053c 100644 --- a/2024/5xxx/CVE-2024-5459.json +++ b/2024/5xxx/CVE-2024-5459.json @@ -1,17 +1,104 @@ { + "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { "ID": "CVE-2024-5459", - "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ASSIGNER": "security@wordfence.com", + "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on 'add_section', 'add_menu', 'add_menu_item', and 'add_menu_page' functions in all versions up to, and including, 2.4.16. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create menu sections, menus, food items, and new menu pages." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "CWE-862 Missing Authorization" + } + ] + } + ] + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "vendor_name": "rustaurius", + "product": { + "product_data": [ + { + "product_name": "Five Star Restaurant Menu and Food Ordering", + "version": { + "version_data": [ + { + "version_affected": "<=", + "version_name": "*", + "version_value": "2.4.16" + } + ] + } + } + ] + } + } + ] + } + }, + "references": { + "reference_data": [ + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/03f9d9bb-6a87-4da9-bbb0-65203d7250e9?source=cve", + "refsource": "MISC", + "name": "https://www.wordfence.com/threat-intel/vulnerabilities/id/03f9d9bb-6a87-4da9-bbb0-65203d7250e9?source=cve" + }, + { + "url": "https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrough.php#L62", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrough.php#L62" + }, + { + "url": "https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrough.php#L80", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrough.php#L80" + }, + { + "url": "https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrough.php#L111", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrough.php#L111" + }, + { + "url": "https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrough.php#L144", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/browser/food-and-drink-menu/trunk/includes/class-installation-walkthrough.php#L144" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset/3097599/", + "refsource": "MISC", + "name": "https://plugins.trac.wordpress.org/changeset/3097599/" + } + ] + }, + "credits": [ + { + "lang": "en", + "value": "Lucio S\u00e1" + } + ], + "impact": { + "cvss": [ + { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", + "baseScore": 4.3, + "baseSeverity": "MEDIUM" } ] }