From 019d5843e5c8b1520bd313f2e78ec38bfea32279 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Helmke?= Date: Thu, 11 May 2023 14:00:27 +0200 Subject: [PATCH] Auto-Update: 2023-05-11T12:00:24.564436+00:00 --- CVE-2023/CVE-2023-24xx/CVE-2023-2490.json | 55 +++++++++++++++++++++ CVE-2023/CVE-2023-302xx/CVE-2023-30256.json | 28 +++++++++++ CVE-2023/CVE-2023-314xx/CVE-2023-31473.json | 24 +++++++++ CVE-2023/CVE-2023-314xx/CVE-2023-31475.json | 24 +++++++++ CVE-2023/CVE-2023-314xx/CVE-2023-31498.json | 28 +++++++++++ README.md | 19 ++++--- 6 files changed, 168 insertions(+), 10 deletions(-) create mode 100644 CVE-2023/CVE-2023-24xx/CVE-2023-2490.json create mode 100644 CVE-2023/CVE-2023-302xx/CVE-2023-30256.json create mode 100644 CVE-2023/CVE-2023-314xx/CVE-2023-31473.json create mode 100644 CVE-2023/CVE-2023-314xx/CVE-2023-31475.json create mode 100644 CVE-2023/CVE-2023-314xx/CVE-2023-31498.json diff --git a/CVE-2023/CVE-2023-24xx/CVE-2023-2490.json b/CVE-2023/CVE-2023-24xx/CVE-2023-2490.json new file mode 100644 index 00000000000..24b3ea03952 --- /dev/null +++ b/CVE-2023/CVE-2023-24xx/CVE-2023-2490.json @@ -0,0 +1,55 @@ +{ + "id": "CVE-2023-2490", + "sourceIdentifier": "audit@patchstack.com", + "published": "2023-05-11T10:15:09.080", + "lastModified": "2023-05-11T10:15:09.080", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fernando Briano UserAgent-Spy plugin <=\u00a01.3.1 versions." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "audit@patchstack.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "HIGH", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "LOW", + "baseScore": 5.9, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 1.7, + "impactScore": 3.7 + } + ] + }, + "weaknesses": [ + { + "source": "audit@patchstack.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-79" + } + ] + } + ], + "references": [ + { + "url": "https://patchstack.com/database/vulnerability/useragent-spy/wordpress-useragent-spy-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve", + "source": "audit@patchstack.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-302xx/CVE-2023-30256.json b/CVE-2023/CVE-2023-302xx/CVE-2023-30256.json new file mode 100644 index 00000000000..ae98319e3e8 --- /dev/null +++ b/CVE-2023/CVE-2023-302xx/CVE-2023-30256.json @@ -0,0 +1,28 @@ +{ + "id": "CVE-2023-30256", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-05-11T11:15:09.047", + "lastModified": "2023-05-11T11:15:09.047", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the AuthController.php file." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/ahrixia/CVE-2023-30256", + "source": "cve@mitre.org" + }, + { + "url": "https://github.com/webkul/hotelcommerce", + "source": "cve@mitre.org" + }, + { + "url": "https://qloapps.com/", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-314xx/CVE-2023-31473.json b/CVE-2023/CVE-2023-314xx/CVE-2023-31473.json new file mode 100644 index 00000000000..37e1ab57a88 --- /dev/null +++ b/CVE-2023/CVE-2023-314xx/CVE-2023-31473.json @@ -0,0 +1,24 @@ +{ + "id": "CVE-2023-31473", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-05-11T11:15:09.100", + "lastModified": "2023-05-11T11:15:09.100", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to read an arbitrary file name while using root privileges. The -f option can be used with a configuration file." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Read.md", + "source": "cve@mitre.org" + }, + { + "url": "https://www.gl-inet.com", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-314xx/CVE-2023-31475.json b/CVE-2023/CVE-2023-314xx/CVE-2023-31475.json new file mode 100644 index 00000000000..dffa9daa7b5 --- /dev/null +++ b/CVE-2023/CVE-2023-314xx/CVE-2023-31475.json @@ -0,0 +1,24 @@ +{ + "id": "CVE-2023-31475", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-05-11T11:15:09.147", + "lastModified": "2023-05-11T11:15:09.147", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "An issue was discovered on GL.iNet devices before 3.216. The function guci2_get() found in libglutil.so has a buffer overflow when an item is requested from a UCI context, and the value is pasted into a char pointer to a buffer without checking the size of the buffer." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Buffer_Overflow.md", + "source": "cve@mitre.org" + }, + { + "url": "https://www.gl-inet.com", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-314xx/CVE-2023-31498.json b/CVE-2023/CVE-2023-314xx/CVE-2023-31498.json new file mode 100644 index 00000000000..02413cb947c --- /dev/null +++ b/CVE-2023/CVE-2023-314xx/CVE-2023-31498.json @@ -0,0 +1,28 @@ +{ + "id": "CVE-2023-31498", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-05-11T11:15:09.193", + "lastModified": "2023-05-11T11:15:09.193", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to execute arbitrary code and access sensitive information via the session token parameter." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://gist.github.com/captain-noob/aff11542477ddd0a92ad8b94ec75f832", + "source": "cve@mitre.org" + }, + { + "url": "https://github.com/captain-noob", + "source": "cve@mitre.org" + }, + { + "url": "https://twitter.com/captain__noob", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/README.md b/README.md index 9a775481f19..08c33ae3067 100644 --- a/README.md +++ b/README.md @@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2023-05-11T10:00:24.218333+00:00 +2023-05-11T12:00:24.564436+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2023-05-11T09:15:09.723000+00:00 +2023-05-11T11:15:09.193000+00:00 ``` ### Last Data Feed Release @@ -29,19 +29,18 @@ Download and Changelog: [Click](releases/latest) ### Total Number of included CVEs ```plain -214888 +214893 ``` ### CVEs added in the last Commit -Recently added CVEs: `6` +Recently added CVEs: `5` -* [CVE-2023-2646](CVE-2023/CVE-2023-26xx/CVE-2023-2646.json) (`2023-05-11T08:15:08.620`) -* [CVE-2023-2647](CVE-2023/CVE-2023-26xx/CVE-2023-2647.json) (`2023-05-11T08:15:08.700`) -* [CVE-2023-2648](CVE-2023/CVE-2023-26xx/CVE-2023-2648.json) (`2023-05-11T08:15:08.773`) -* [CVE-2023-2649](CVE-2023/CVE-2023-26xx/CVE-2023-2649.json) (`2023-05-11T08:15:08.843`) -* [CVE-2023-2652](CVE-2023/CVE-2023-26xx/CVE-2023-2652.json) (`2023-05-11T09:15:09.313`) -* [CVE-2023-2653](CVE-2023/CVE-2023-26xx/CVE-2023-2653.json) (`2023-05-11T09:15:09.723`) +* [CVE-2023-2490](CVE-2023/CVE-2023-24xx/CVE-2023-2490.json) (`2023-05-11T10:15:09.080`) +* [CVE-2023-30256](CVE-2023/CVE-2023-302xx/CVE-2023-30256.json) (`2023-05-11T11:15:09.047`) +* [CVE-2023-31473](CVE-2023/CVE-2023-314xx/CVE-2023-31473.json) (`2023-05-11T11:15:09.100`) +* [CVE-2023-31475](CVE-2023/CVE-2023-314xx/CVE-2023-31475.json) (`2023-05-11T11:15:09.147`) +* [CVE-2023-31498](CVE-2023/CVE-2023-314xx/CVE-2023-31498.json) (`2023-05-11T11:15:09.193`) ### CVEs modified in the last Commit