Auto-Update: 2023-05-11T12:00:24.564436+00:00

2025-05-08 03:27:17 +00:00 · 2023-05-11 14:00:27 +02:00 · 2023-05-11 14:00:27 +02:00 · 019d5843e5
commit 019d5843e5
parent 822bb137db
6 changed files with 168 additions and 10 deletions
--- a/CVE-2023/CVE-2023-24xx/CVE-2023-2490.json
+++ b/CVE-2023/CVE-2023-24xx/CVE-2023-2490.json
@ -0,0 +1,55 @@
+{
+  "id": "CVE-2023-2490",
+  "sourceIdentifier": "audit@patchstack.com",
+  "published": "2023-05-11T10:15:09.080",
+  "lastModified": "2023-05-11T10:15:09.080",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fernando Briano UserAgent-Spy plugin <=\u00a01.3.1 versions."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "audit@patchstack.com",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "HIGH",
+          "userInteraction": "REQUIRED",
+          "scope": "CHANGED",
+          "confidentialityImpact": "LOW",
+          "integrityImpact": "LOW",
+          "availabilityImpact": "LOW",
+          "baseScore": 5.9,
+          "baseSeverity": "MEDIUM"
+        },
+        "exploitabilityScore": 1.7,
+        "impactScore": 3.7
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "audit@patchstack.com",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-79"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://patchstack.com/database/vulnerability/useragent-spy/wordpress-useragent-spy-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve",
+      "source": "audit@patchstack.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-302xx/CVE-2023-30256.json
+++ b/CVE-2023/CVE-2023-302xx/CVE-2023-30256.json
@ -0,0 +1,28 @@
+{
+  "id": "CVE-2023-30256",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-05-11T11:15:09.047",
+  "lastModified": "2023-05-11T11:15:09.047",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the AuthController.php file."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/ahrixia/CVE-2023-30256",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/webkul/hotelcommerce",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://qloapps.com/",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-314xx/CVE-2023-31473.json
+++ b/CVE-2023/CVE-2023-314xx/CVE-2023-31473.json
@ -0,0 +1,24 @@
+{
+  "id": "CVE-2023-31473",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-05-11T11:15:09.100",
+  "lastModified": "2023-05-11T11:15:09.100",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to read an arbitrary file name while using root privileges. The -f option can be used with a configuration file."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Read.md",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://www.gl-inet.com",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-314xx/CVE-2023-31475.json
+++ b/CVE-2023/CVE-2023-314xx/CVE-2023-31475.json
@ -0,0 +1,24 @@
+{
+  "id": "CVE-2023-31475",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-05-11T11:15:09.147",
+  "lastModified": "2023-05-11T11:15:09.147",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "An issue was discovered on GL.iNet devices before 3.216. The function guci2_get() found in libglutil.so has a buffer overflow when an item is requested from a UCI context, and the value is pasted into a char pointer to a buffer without checking the size of the buffer."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Buffer_Overflow.md",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://www.gl-inet.com",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-314xx/CVE-2023-31498.json
+++ b/CVE-2023/CVE-2023-314xx/CVE-2023-31498.json
@ -0,0 +1,28 @@
+{
+  "id": "CVE-2023-31498",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-05-11T11:15:09.193",
+  "lastModified": "2023-05-11T11:15:09.193",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to execute arbitrary code and access sensitive information via the session token parameter."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://gist.github.com/captain-noob/aff11542477ddd0a92ad8b94ec75f832",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/captain-noob",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://twitter.com/captain__noob",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/README.md
+++ b/README.md
@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
 ### Last Repository Update

 ```plain
-2023-05-11T10:00:24.218333+00:00
+2023-05-11T12:00:24.564436+00:00
 ```

 ### Most recent CVE Modification Timestamp synchronized with NVD

 ```plain
-2023-05-11T09:15:09.723000+00:00
+2023-05-11T11:15:09.193000+00:00
 ```

 ### Last Data Feed Release
@ -29,19 +29,18 @@ Download and Changelog: [Click](releases/latest)
 ### Total Number of included CVEs

 ```plain
-214888
+214893
 ```

 ### CVEs added in the last Commit

-Recently added CVEs: `6`
+Recently added CVEs: `5`

-* [CVE-2023-2646](CVE-2023/CVE-2023-26xx/CVE-2023-2646.json) (`2023-05-11T08:15:08.620`)
-* [CVE-2023-2647](CVE-2023/CVE-2023-26xx/CVE-2023-2647.json) (`2023-05-11T08:15:08.700`)
-* [CVE-2023-2648](CVE-2023/CVE-2023-26xx/CVE-2023-2648.json) (`2023-05-11T08:15:08.773`)
-* [CVE-2023-2649](CVE-2023/CVE-2023-26xx/CVE-2023-2649.json) (`2023-05-11T08:15:08.843`)
-* [CVE-2023-2652](CVE-2023/CVE-2023-26xx/CVE-2023-2652.json) (`2023-05-11T09:15:09.313`)
-* [CVE-2023-2653](CVE-2023/CVE-2023-26xx/CVE-2023-2653.json) (`2023-05-11T09:15:09.723`)
+* [CVE-2023-2490](CVE-2023/CVE-2023-24xx/CVE-2023-2490.json) (`2023-05-11T10:15:09.080`)
+* [CVE-2023-30256](CVE-2023/CVE-2023-302xx/CVE-2023-30256.json) (`2023-05-11T11:15:09.047`)
+* [CVE-2023-31473](CVE-2023/CVE-2023-314xx/CVE-2023-31473.json) (`2023-05-11T11:15:09.100`)
+* [CVE-2023-31475](CVE-2023/CVE-2023-314xx/CVE-2023-31475.json) (`2023-05-11T11:15:09.147`)
+* [CVE-2023-31498](CVE-2023/CVE-2023-314xx/CVE-2023-31498.json) (`2023-05-11T11:15:09.193`)


 ### CVEs modified in the last Commit