From 039266d214902368726381ff6cfd21fa91a16a84 Mon Sep 17 00:00:00 2001 From: cad-safe-bot Date: Wed, 6 Dec 2023 07:00:21 +0000 Subject: [PATCH] Auto-Update: 2023-12-06T07:00:18.214519+00:00 --- CVE-2023/CVE-2023-225xx/CVE-2023-22522.json | 47 ++++++++ CVE-2023/CVE-2023-225xx/CVE-2023-22523.json | 51 +++++++++ CVE-2023/CVE-2023-225xx/CVE-2023-22524.json | 43 +++++++ CVE-2023/CVE-2023-261xx/CVE-2023-26154.json | 119 ++++++++++++++++++++ CVE-2023/CVE-2023-65xx/CVE-2023-6527.json | 47 ++++++++ README.md | 27 ++--- 6 files changed, 317 insertions(+), 17 deletions(-) create mode 100644 CVE-2023/CVE-2023-225xx/CVE-2023-22522.json create mode 100644 CVE-2023/CVE-2023-225xx/CVE-2023-22523.json create mode 100644 CVE-2023/CVE-2023-225xx/CVE-2023-22524.json create mode 100644 CVE-2023/CVE-2023-261xx/CVE-2023-26154.json create mode 100644 CVE-2023/CVE-2023-65xx/CVE-2023-6527.json diff --git a/CVE-2023/CVE-2023-225xx/CVE-2023-22522.json b/CVE-2023/CVE-2023-225xx/CVE-2023-22522.json new file mode 100644 index 00000000000..05348c28aff --- /dev/null +++ b/CVE-2023/CVE-2023-225xx/CVE-2023-22522.json @@ -0,0 +1,47 @@ +{ + "id": "CVE-2023-22522", + "sourceIdentifier": "security@atlassian.com", + "published": "2023-12-06T05:15:09.587", + "lastModified": "2023-12-06T05:15:09.587", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input into a Confluence page. Using this approach, an attacker is able to achieve Remote Code Execution (RCE) on an affected instance. Publicly accessible Confluence Data Center and Server versions as listed below are at risk and require immediate attention. See the advisory for additional details\n\nAtlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue." + } + ], + "metrics": { + "cvssMetricV30": [ + { + "source": "security@atlassian.com", + "type": "Secondary", + "cvssData": { + "version": "3.0", + "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "CHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 9.0, + "baseSeverity": "CRITICAL" + }, + "exploitabilityScore": 2.2, + "impactScore": 6.0 + } + ] + }, + "references": [ + { + "url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1319570362", + "source": "security@atlassian.com" + }, + { + "url": "https://jira.atlassian.com/browse/CONFSERVER-93415", + "source": "security@atlassian.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-225xx/CVE-2023-22523.json b/CVE-2023/CVE-2023-225xx/CVE-2023-22523.json new file mode 100644 index 00000000000..127d0f84cbe --- /dev/null +++ b/CVE-2023/CVE-2023-225xx/CVE-2023-22523.json @@ -0,0 +1,51 @@ +{ + "id": "CVE-2023-22523", + "sourceIdentifier": "security@atlassian.com", + "published": "2023-12-06T05:15:10.087", + "lastModified": "2023-12-06T05:15:10.087", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application (formerly known as Insight Discovery) and the Assets Discovery agent.\n\nAssets Discovery, which can be downloaded via Atlassian Marketplace, is a network scanning tool that can be used with or without an agent with Jira Service Management Cloud, Data Center or Server. It detects hardware and software that is connected to your local network and extracts detailed information about each asset. This data can then be imported into Assets in Jira Service Management to help you manage all of the devices and configuration items within your local network." + } + ], + "metrics": { + "cvssMetricV30": [ + { + "source": "security@atlassian.com", + "type": "Secondary", + "cvssData": { + "version": "3.0", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 9.8, + "baseSeverity": "CRITICAL" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.9 + } + ] + }, + "references": [ + { + "url": "https://jira.atlassian.com/browse/JSDSERVER-14893", + "source": "security@atlassian.com" + }, + { + "url": "https://support.atlassian.com/jira-service-management-cloud/docs/install-asset-discovery-agents/", + "source": "security@atlassian.com" + }, + { + "url": "https://support.atlassian.com/jira-service-management-cloud/docs/what-are-asset-discovery-agents/", + "source": "security@atlassian.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-225xx/CVE-2023-22524.json b/CVE-2023/CVE-2023-225xx/CVE-2023-22524.json new file mode 100644 index 00000000000..5098ec43814 --- /dev/null +++ b/CVE-2023/CVE-2023-225xx/CVE-2023-22524.json @@ -0,0 +1,43 @@ +{ + "id": "CVE-2023-22524", + "sourceIdentifier": "security@atlassian.com", + "published": "2023-12-06T05:15:10.267", + "lastModified": "2023-12-06T05:15:10.267", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An attacker could utilize WebSockets to bypass Atlassian Companion\u2019s blocklist and MacOS Gatekeeper to allow execution of code." + } + ], + "metrics": { + "cvssMetricV30": [ + { + "source": "security@atlassian.com", + "type": "Secondary", + "cvssData": { + "version": "3.0", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 9.6, + "baseSeverity": "CRITICAL" + }, + "exploitabilityScore": 2.8, + "impactScore": 6.0 + } + ] + }, + "references": [ + { + "url": "https://jira.atlassian.com/browse/CONFSERVER-93453", + "source": "security@atlassian.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-261xx/CVE-2023-26154.json b/CVE-2023/CVE-2023-261xx/CVE-2023-26154.json new file mode 100644 index 00000000000..e3251d0f7d1 --- /dev/null +++ b/CVE-2023/CVE-2023-261xx/CVE-2023-26154.json @@ -0,0 +1,119 @@ +{ + "id": "CVE-2023-26154", + "sourceIdentifier": "report@snyk.io", + "published": "2023-12-06T05:15:10.437", + "lastModified": "2023-12-06T05:15:10.437", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; all versions of the package github.com/pubnub/go; versions of the package github.com/pubnub/go/v7 before 7.2.0; versions of the package pubnub before 7.3.0; versions of the package pubnub/pubnub before 6.1.0; versions of the package pubnub before 5.3.0; versions of the package pubnub before 0.4.0; versions of the package pubnub/c-core before 4.5.0; versions of the package com.pubnub:pubnub-kotlin before 7.7.0; versions of the package pubnub/swift before 6.2.0; versions of the package pubnub before 5.2.0; versions of the package pubnub before 4.3.0 are vulnerable to Insufficient Entropy via the getKey function, due to inefficient implementation of the AES-256-CBC cryptographic algorithm. The provided encrypt function is less secure when hex encoding and trimming are applied, leaving half of the bits in the key always the same for every encoded message or file.\r\r**Note:**\r\rIn order to exploit this vulnerability, the attacker needs to invest resources in preparing the attack and brute-force the encryption." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "report@snyk.io", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "baseScore": 5.9, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.2, + "impactScore": 3.6 + } + ] + }, + "weaknesses": [ + { + "source": "report@snyk.io", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-331" + } + ] + } + ], + "references": [ + { + "url": "https://gist.github.com/vargad/20237094fce7a0a28f0723d7ce395bb0", + "source": "report@snyk.io" + }, + { + "url": "https://github.com/pubnub/javascript/blob/master/src/crypto/modules/web.js%23L70", + "source": "report@snyk.io" + }, + { + "url": "https://github.com/pubnub/javascript/commit/fb6cd0417cbb4ba87ea2d5d86a9c94774447e119", + "source": "report@snyk.io" + }, + { + "url": "https://security.snyk.io/vuln/SNYK-COCOAPODS-PUBNUB-6098384", + "source": "report@snyk.io" + }, + { + "url": "https://security.snyk.io/vuln/SNYK-DOTNET-PUBNUB-6098372", + "source": "report@snyk.io" + }, + { + "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGO-6098373", + "source": "report@snyk.io" + }, + { + "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPUBNUBGOV7-6098374", + "source": "report@snyk.io" + }, + { + "url": "https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098371", + "source": "report@snyk.io" + }, + { + "url": "https://security.snyk.io/vuln/SNYK-JAVA-COMPUBNUB-6098380", + "source": "report@snyk.io" + }, + { + "url": "https://security.snyk.io/vuln/SNYK-JS-PUBNUB-5840690", + "source": "report@snyk.io" + }, + { + "url": "https://security.snyk.io/vuln/SNYK-PHP-PUBNUBPUBNUB-6098376", + "source": "report@snyk.io" + }, + { + "url": "https://security.snyk.io/vuln/SNYK-PUB-PUBNUB-6098385", + "source": "report@snyk.io" + }, + { + "url": "https://security.snyk.io/vuln/SNYK-PYTHON-PUBNUB-6098375", + "source": "report@snyk.io" + }, + { + "url": "https://security.snyk.io/vuln/SNYK-RUBY-PUBNUB-6098377", + "source": "report@snyk.io" + }, + { + "url": "https://security.snyk.io/vuln/SNYK-RUST-PUBNUB-6098378", + "source": "report@snyk.io" + }, + { + "url": "https://security.snyk.io/vuln/SNYK-SWIFT-PUBNUBSWIFT-6098381", + "source": "report@snyk.io" + }, + { + "url": "https://security.snyk.io/vuln/SNYK-UNMANAGED-PUBNUBCCORE-6098379", + "source": "report@snyk.io" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-65xx/CVE-2023-6527.json b/CVE-2023/CVE-2023-65xx/CVE-2023-6527.json new file mode 100644 index 00000000000..5cf4fe71ab7 --- /dev/null +++ b/CVE-2023/CVE-2023-65xx/CVE-2023-6527.json @@ -0,0 +1,47 @@ +{ + "id": "CVE-2023-6527", + "sourceIdentifier": "security@wordfence.com", + "published": "2023-12-06T05:15:10.750", + "lastModified": "2023-12-06T05:15:10.750", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "The Email Subscription Popup plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the HTTP_REFERER header in all versions up to, and including, 1.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security@wordfence.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 6.1, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 2.7 + } + ] + }, + "references": [ + { + "url": "https://plugins.trac.wordpress.org/browser/email-subscribe/tags/1.2.19/wp-email-subscription.php?rev=3005188#L2125", + "source": "security@wordfence.com" + }, + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5f84814e-f7b7-4228-b331-63027a0770af?source=cve", + "source": "security@wordfence.com" + } + ] +} \ No newline at end of file diff --git a/README.md b/README.md index 5ae6d3e4ccf..77047d42bb8 100644 --- a/README.md +++ b/README.md @@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2023-12-06T05:00:18.025041+00:00 +2023-12-06T07:00:18.214519+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2023-12-06T04:15:07.773000+00:00 +2023-12-06T05:15:10.750000+00:00 ``` ### Last Data Feed Release @@ -29,31 +29,24 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/ ### Total Number of included CVEs ```plain -232381 +232386 ``` ### CVEs added in the last Commit -Recently added CVEs: `2` +Recently added CVEs: `5` -* [CVE-2023-40053](CVE-2023/CVE-2023-400xx/CVE-2023-40053.json) (`2023-12-06T04:15:07.523`) -* [CVE-2023-41268](CVE-2023/CVE-2023-412xx/CVE-2023-41268.json) (`2023-12-06T04:15:07.773`) +* [CVE-2023-22522](CVE-2023/CVE-2023-225xx/CVE-2023-22522.json) (`2023-12-06T05:15:09.587`) +* [CVE-2023-22523](CVE-2023/CVE-2023-225xx/CVE-2023-22523.json) (`2023-12-06T05:15:10.087`) +* [CVE-2023-22524](CVE-2023/CVE-2023-225xx/CVE-2023-22524.json) (`2023-12-06T05:15:10.267`) +* [CVE-2023-26154](CVE-2023/CVE-2023-261xx/CVE-2023-26154.json) (`2023-12-06T05:15:10.437`) +* [CVE-2023-6527](CVE-2023/CVE-2023-65xx/CVE-2023-6527.json) (`2023-12-06T05:15:10.750`) ### CVEs modified in the last Commit -Recently modified CVEs: `10` +Recently modified CVEs: `0` -* [CVE-2020-12965](CVE-2020/CVE-2020-129xx/CVE-2020-12965.json) (`2023-12-06T03:15:06.827`) -* [CVE-2023-48272](CVE-2023/CVE-2023-482xx/CVE-2023-48272.json) (`2023-12-06T03:01:23.517`) -* [CVE-2023-48278](CVE-2023/CVE-2023-482xx/CVE-2023-48278.json) (`2023-12-06T03:09:04.530`) -* [CVE-2023-48317](CVE-2023/CVE-2023-483xx/CVE-2023-48317.json) (`2023-12-06T03:11:49.693`) -* [CVE-2023-34872](CVE-2023/CVE-2023-348xx/CVE-2023-34872.json) (`2023-12-06T03:15:07.057`) -* [CVE-2023-43788](CVE-2023/CVE-2023-437xx/CVE-2023-43788.json) (`2023-12-06T03:15:07.133`) -* [CVE-2023-43789](CVE-2023/CVE-2023-437xx/CVE-2023-43789.json) (`2023-12-06T03:15:07.273`) -* [CVE-2023-45283](CVE-2023/CVE-2023-452xx/CVE-2023-45283.json) (`2023-12-06T03:15:07.377`) -* [CVE-2023-48320](CVE-2023/CVE-2023-483xx/CVE-2023-48320.json) (`2023-12-06T03:16:01.150`) -* [CVE-2023-48321](CVE-2023/CVE-2023-483xx/CVE-2023-48321.json) (`2023-12-06T03:23:01.210`) ## Download and Usage