admin/nvd-json-data-feeds
1
0
Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2025-07-09 16:05:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2023-12-06T07:00:18.214519+00:00

Browse Source
This commit is contained in:
cad-safe-bot 2023-12-06 07:00:21 +00:00
parent 9a60827b6b
commit 039266d214
6 changed files with 317 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
CVE-2023/CVE-2023-225xx/CVE-2023-22522.json Normal file
View File

@ -0,0 +1,47 @@
{
"id": "CVE-2023-22522",
"sourceIdentifier": "security@atlassian.com",
"published": "2023-12-06T05:15:09.587",
"lastModified": "2023-12-06T05:15:09.587",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the advisory for additional details\n\nAtlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue."
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "security@atlassian.com",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL"
},
"exploitabilityScore": 2.2,
"impactScore": 6.0
}
]
},
"references": [
{
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1319570362",
"source": "security@atlassian.com"
},
{
"url": "https://jira.atlassian.com/browse/CONFSERVER-93415",
"source": "security@atlassian.com"
}
]
}

51
CVE-2023/CVE-2023-225xx/CVE-2023-22523.json Normal file
View File

@ -0,0 +1,51 @@
{
"id": "CVE-2023-22523",
"sourceIdentifier": "security@atlassian.com",
"published": "2023-12-06T05:15:10.087",
"lastModified": "2023-12-06T05:15:10.087",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent.\n\nAssets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or Server. It detects hardware and software that is connected to your local network and extracts detailed information about each asset. This data can then be imported into Assets in Jira Service Management to help you manage all of the devices and configuration items within your local network."
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "security@atlassian.com",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://jira.atlassian.com/browse/JSDSERVER-14893",
"source": "security@atlassian.com"
},
{
"url": "https://support.atlassian.com/jira-service-management-cloud/docs/install-asset-discovery-agents/",
"source": "security@atlassian.com"
},
{
"url": "https://support.atlassian.com/jira-service-management-cloud/docs/what-are-asset-discovery-agents/",
"source": "security@atlassian.com"
}
]
}

43
CVE-2023/CVE-2023-225xx/CVE-2023-22524.json Normal file
View File

@ -0,0 +1,43 @@
{
"id": "CVE-2023-22524",
"sourceIdentifier": "security@atlassian.com",
"published": "2023-12-06T05:15:10.267",
"lastModified": "2023-12-06T05:15:10.267",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion\u2019s blocklist and MacOS Gatekeeper to allow execution of code."
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "security@atlassian.com",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL"
},
"exploitabilityScore": 2.8,
"impactScore": 6.0
}
]
},
"references": [
{
"url": "https://jira.atlassian.com/browse/CONFSERVER-93453",
"source": "security@atlassian.com"
}
]
}

119
CVE-2023/CVE-2023-261xx/CVE-2023-26154.json Normal file
View File

@ -0,0 +1,119 @@
{
"id": "CVE-2023-26154",
"sourceIdentifier": "report@snyk.io",
"published": "2023-12-06T05:15:10.437",
"lastModified": "2023-12-06T05:15:10.437",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file.\r\r**Note:**\r\rIn order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "report@snyk.io",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "report@snyk.io",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-331"
}
]
}
],
"references": [
{
"url": "https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0",
"source": "report@snyk.io"
},
{
"url": "https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70",
"source": "report@snyk.io"
},
{
"url": "https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119",
"source": "report@snyk.io"
},
{
"url": "https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384",
"source": "report@snyk.io"
},
{
"url": "https://security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372",
"source": "report@snyk.io"
},
{
"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373",
"source": "report@snyk.io"
},
{
"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374",
"source": "report@snyk.io"
},
{
"url": "https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371",
"source": "report@snyk.io"
},
{
"url": "https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098380",
"source": "report@snyk.io"
},
{
"url": "https://security.snyk.io/vuln/SNYK-JS-PUBNUB-5840690",
"source": "report@snyk.io"
},
{
"url": "https://security.snyk.io/vuln/SNYK-PHP-PUBNUBPUBNUB-6098376",
"source": "report@snyk.io"
},
{
"url": "https://security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385",
"source": "report@snyk.io"
},
{
"url": "https://security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375",
"source": "report@snyk.io"
},
{
"url": "https://security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377",
"source": "report@snyk.io"
},
{
"url": "https://security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378",
"source": "report@snyk.io"
},
{
"url": "https://security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381",
"source": "report@snyk.io"
},
{
"url": "https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379",
"source": "report@snyk.io"
}
]
}

47
CVE-2023/CVE-2023-65xx/CVE-2023-6527.json Normal file
View File

@ -0,0 +1,47 @@
{
"id": "CVE-2023-6527",
"sourceIdentifier": "security@wordfence.com",
"published": "2023-12-06T05:15:10.750",
"lastModified": "2023-12-06T05:15:10.750",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Email Subscription Popup plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the HTTP_REFERER header in all versions up to, and including, 1.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/email-subscribe/tags/1.2.19/wp-email-subscription.php?rev=3005188#L2125",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5f84814e-f7b7-4228-b331-63027a0770af?source=cve",
"source": "security@wordfence.com"
}
]
}

27
README.md
View File

@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2023-12-06T05:00:18.025041+00:00
2023-12-06T07:00:18.214519+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2023-12-06T04:15:07.773000+00:00
2023-12-06T05:15:10.750000+00:00
```
### Last Data Feed Release
@ -29,31 +29,24 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
232381
232386
```
### CVEs added in the last Commit
Recently added CVEs: `2`
Recently added CVEs: `5`
* [CVE-2023-40053](CVE-2023/CVE-2023-400xx/CVE-2023-40053.json) (`2023-12-06T04:15:07.523`)
* [CVE-2023-41268](CVE-2023/CVE-2023-412xx/CVE-2023-41268.json) (`2023-12-06T04:15:07.773`)
* [CVE-2023-22522](CVE-2023/CVE-2023-225xx/CVE-2023-22522.json) (`2023-12-06T05:15:09.587`)
* [CVE-2023-22523](CVE-2023/CVE-2023-225xx/CVE-2023-22523.json) (`2023-12-06T05:15:10.087`)
* [CVE-2023-22524](CVE-2023/CVE-2023-225xx/CVE-2023-22524.json) (`2023-12-06T05:15:10.267`)
* [CVE-2023-26154](CVE-2023/CVE-2023-261xx/CVE-2023-26154.json) (`2023-12-06T05:15:10.437`)
* [CVE-2023-6527](CVE-2023/CVE-2023-65xx/CVE-2023-6527.json) (`2023-12-06T05:15:10.750`)
### CVEs modified in the last Commit
Recently modified CVEs: `10`
Recently modified CVEs: `0`
* [CVE-2020-12965](CVE-2020/CVE-2020-129xx/CVE-2020-12965.json) (`2023-12-06T03:15:06.827`)
* [CVE-2023-48272](CVE-2023/CVE-2023-482xx/CVE-2023-48272.json) (`2023-12-06T03:01:23.517`)
* [CVE-2023-48278](CVE-2023/CVE-2023-482xx/CVE-2023-48278.json) (`2023-12-06T03:09:04.530`)
* [CVE-2023-48317](CVE-2023/CVE-2023-483xx/CVE-2023-48317.json) (`2023-12-06T03:11:49.693`)
* [CVE-2023-34872](CVE-2023/CVE-2023-348xx/CVE-2023-34872.json) (`2023-12-06T03:15:07.057`)
* [CVE-2023-43788](CVE-2023/CVE-2023-437xx/CVE-2023-43788.json) (`2023-12-06T03:15:07.133`)
* [CVE-2023-43789](CVE-2023/CVE-2023-437xx/CVE-2023-43789.json) (`2023-12-06T03:15:07.273`)
* [CVE-2023-45283](CVE-2023/CVE-2023-452xx/CVE-2023-45283.json) (`2023-12-06T03:15:07.377`)
* [CVE-2023-48320](CVE-2023/CVE-2023-483xx/CVE-2023-48320.json) (`2023-12-06T03:16:01.150`)
* [CVE-2023-48321](CVE-2023/CVE-2023-483xx/CVE-2023-48321.json) (`2023-12-06T03:23:01.210`)
## Download and Usage