Auto-Update: 2023-05-11T12:00:24.564436+00:00

CVE-2023/CVE-2023-24xx/CVE-2023-2490.json

@@ -0,0 +1,55 @@
+{
+  "id": "CVE-2023-2490",
+  "sourceIdentifier": "audit@patchstack.com",
+  "published": "2023-05-11T10:15:09.080",
+  "lastModified": "2023-05-11T10:15:09.080",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fernando Briano UserAgent-Spy plugin <=\u00a01.3.1 versions."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "audit@patchstack.com",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "HIGH",
+          "userInteraction": "REQUIRED",
+          "scope": "CHANGED",
+          "confidentialityImpact": "LOW",
+          "integrityImpact": "LOW",
+          "availabilityImpact": "LOW",
+          "baseScore": 5.9,
+          "baseSeverity": "MEDIUM"
+        },
+        "exploitabilityScore": 1.7,
+        "impactScore": 3.7
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "audit@patchstack.com",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-79"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://patchstack.com/database/vulnerability/useragent-spy/wordpress-useragent-spy-plugin-1-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve",
+      "source": "audit@patchstack.com"
+    }
+  ]
+}

CVE-2023/CVE-2023-302xx/CVE-2023-30256.json

@@ -0,0 +1,28 @@
+{
+  "id": "CVE-2023-30256",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-05-11T11:15:09.047",
+  "lastModified": "2023-05-11T11:15:09.047",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the AuthController.php file."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/ahrixia/CVE-2023-30256",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/webkul/hotelcommerce",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://qloapps.com/",
+      "source": "cve@mitre.org"
+    }
+  ]
+}

CVE-2023/CVE-2023-314xx/CVE-2023-31473.json

@@ -0,0 +1,24 @@
+{
+  "id": "CVE-2023-31473",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-05-11T11:15:09.100",
+  "lastModified": "2023-05-11T11:15:09.100",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "An issue was discovered on GL.iNet devices before 3.216. There is an arbitrary file write in which an empty file can be created anywhere on the filesystem. This is caused by a command injection vulnerability with a filter applied. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to read an arbitrary file name while using root privileges. The -f option can be used with a configuration file."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Arbitrary_File_Read.md",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://www.gl-inet.com",
+      "source": "cve@mitre.org"
+    }
+  ]
+}

CVE-2023/CVE-2023-314xx/CVE-2023-31475.json

@@ -0,0 +1,24 @@
+{
+  "id": "CVE-2023-31475",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-05-11T11:15:09.147",
+  "lastModified": "2023-05-11T11:15:09.147",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "An issue was discovered on GL.iNet devices before 3.216. The function guci2_get() found in libglutil.so has a buffer overflow when an item is requested from a UCI context, and the value is pasted into a char pointer to a buffer without checking the size of the buffer."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/gl-inet/CVE-issues/blob/main/3.215/Buffer_Overflow.md",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://www.gl-inet.com",
+      "source": "cve@mitre.org"
+    }
+  ]
+}

CVE-2023/CVE-2023-314xx/CVE-2023-31498.json

@@ -0,0 +1,28 @@
+{
+  "id": "CVE-2023-31498",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-05-11T11:15:09.193",
+  "lastModified": "2023-05-11T11:15:09.193",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "A privilege escalation issue was found in PHP Gurukul Hospital Management System In v.4.0 allows a remote attacker to execute arbitrary code and access sensitive information via the session token parameter."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://gist.github.com/captain-noob/aff11542477ddd0a92ad8b94ec75f832",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/captain-noob",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://twitter.com/captain__noob",
+      "source": "cve@mitre.org"
+    }
+  ]
+}

README.md

@@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
 ### Last Repository Update
 
 ```plain
-2023-05-11T10:00:24.218333+00:00
+2023-05-11T12:00:24.564436+00:00
 ```
 
 ### Most recent CVE Modification Timestamp synchronized with NVD
 
 ```plain
-2023-05-11T09:15:09.723000+00:00
+2023-05-11T11:15:09.193000+00:00
 ```
 
 ### Last Data Feed Release
@@ -29,19 +29,18 @@ Download and Changelog: [Click](releases/latest)
 ### Total Number of included CVEs
 
 ```plain
-214888
+214893
 ```
 
 ### CVEs added in the last Commit
 
-Recently added CVEs: `6`
+Recently added CVEs: `5`
 
-* [CVE-2023-2646](CVE-2023/CVE-2023-26xx/CVE-2023-2646.json) (`2023-05-11T08:15:08.620`)
+* [CVE-2023-2490](CVE-2023/CVE-2023-24xx/CVE-2023-2490.json) (`2023-05-11T10:15:09.080`)
-* [CVE-2023-2647](CVE-2023/CVE-2023-26xx/CVE-2023-2647.json) (`2023-05-11T08:15:08.700`)
+* [CVE-2023-30256](CVE-2023/CVE-2023-302xx/CVE-2023-30256.json) (`2023-05-11T11:15:09.047`)
-* [CVE-2023-2648](CVE-2023/CVE-2023-26xx/CVE-2023-2648.json) (`2023-05-11T08:15:08.773`)
+* [CVE-2023-31473](CVE-2023/CVE-2023-314xx/CVE-2023-31473.json) (`2023-05-11T11:15:09.100`)
-* [CVE-2023-2649](CVE-2023/CVE-2023-26xx/CVE-2023-2649.json) (`2023-05-11T08:15:08.843`)
+* [CVE-2023-31475](CVE-2023/CVE-2023-314xx/CVE-2023-31475.json) (`2023-05-11T11:15:09.147`)
-* [CVE-2023-2652](CVE-2023/CVE-2023-26xx/CVE-2023-2652.json) (`2023-05-11T09:15:09.313`)
+* [CVE-2023-31498](CVE-2023/CVE-2023-314xx/CVE-2023-31498.json) (`2023-05-11T11:15:09.193`)
-* [CVE-2023-2653](CVE-2023/CVE-2023-26xx/CVE-2023-2653.json) (`2023-05-11T09:15:09.723`)
 
 
 ### CVEs modified in the last Commit