mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-07 19:16:29 +00:00
Auto-Update: 2023-10-17T02:00:25.170311+00:00
This commit is contained in:
parent
4784eb6712
commit
0a687ba7d9
88
CVE-2011/CVE-2011-100xx/CVE-2011-10004.json
Normal file
88
CVE-2011/CVE-2011-100xx/CVE-2011-10004.json
Normal file
@ -0,0 +1,88 @@
|
||||
{
|
||||
"id": "CVE-2011-10004",
|
||||
"sourceIdentifier": "cna@vuldb.com",
|
||||
"published": "2023-10-17T00:15:10.500",
|
||||
"lastModified": "2023-10-17T00:15:10.500",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A vulnerability was found in reciply Plugin up to 1.1.7 on WordPress. It has been rated as critical. This issue affects some unknown processing of the file uploadImage.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. Upgrading to version 1.1.8 is able to address this issue. The identifier of the patch is e3ff616dc08d3aadff9253f1085e13f677d0c676. It is recommended to upgrade the affected component. The identifier VDB-242189 was assigned to this vulnerability."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV30": [
|
||||
{
|
||||
"source": "cna@vuldb.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.0",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 6.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 3.4
|
||||
}
|
||||
],
|
||||
"cvssMetricV2": [
|
||||
{
|
||||
"source": "cna@vuldb.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "2.0",
|
||||
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
|
||||
"accessVector": "NETWORK",
|
||||
"accessComplexity": "LOW",
|
||||
"authentication": "SINGLE",
|
||||
"confidentialityImpact": "PARTIAL",
|
||||
"integrityImpact": "PARTIAL",
|
||||
"availabilityImpact": "PARTIAL",
|
||||
"baseScore": 6.5
|
||||
},
|
||||
"baseSeverity": "MEDIUM",
|
||||
"exploitabilityScore": 8.0,
|
||||
"impactScore": 6.4,
|
||||
"acInsufInfo": false,
|
||||
"obtainAllPrivilege": false,
|
||||
"obtainUserPrivilege": false,
|
||||
"obtainOtherPrivilege": false,
|
||||
"userInteractionRequired": false
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "cna@vuldb.com",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-434"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/wp-plugins/reciply/commit/e3ff616dc08d3aadff9253f1085e13f677d0c676",
|
||||
"source": "cna@vuldb.com"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?ctiid.242189",
|
||||
"source": "cna@vuldb.com"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?id.242189",
|
||||
"source": "cna@vuldb.com"
|
||||
}
|
||||
]
|
||||
}
|
88
CVE-2012/CVE-2012-100xx/CVE-2012-10016.json
Normal file
88
CVE-2012/CVE-2012-100xx/CVE-2012-10016.json
Normal file
@ -0,0 +1,88 @@
|
||||
{
|
||||
"id": "CVE-2012-10016",
|
||||
"sourceIdentifier": "cna@vuldb.com",
|
||||
"published": "2023-10-17T00:15:10.603",
|
||||
"lastModified": "2023-10-17T00:15:10.603",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress. Affected is an unknown function of the file simple-download-button_dl.php of the component Download Handler. The manipulation of the argument file leads to information disclosure. It is possible to launch the attack remotely. Upgrading to version 1.1 is able to address this issue. The patch is identified as e648a8706818297cf02a665ae0bae1c069dea5f1. It is recommended to upgrade the affected component. VDB-242190 is the identifier assigned to this vulnerability."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV30": [
|
||||
{
|
||||
"source": "cna@vuldb.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.0",
|
||||
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 1.4
|
||||
}
|
||||
],
|
||||
"cvssMetricV2": [
|
||||
{
|
||||
"source": "cna@vuldb.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "2.0",
|
||||
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
|
||||
"accessVector": "NETWORK",
|
||||
"accessComplexity": "LOW",
|
||||
"authentication": "SINGLE",
|
||||
"confidentialityImpact": "PARTIAL",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.0
|
||||
},
|
||||
"baseSeverity": "MEDIUM",
|
||||
"exploitabilityScore": 8.0,
|
||||
"impactScore": 2.9,
|
||||
"acInsufInfo": false,
|
||||
"obtainAllPrivilege": false,
|
||||
"obtainUserPrivilege": false,
|
||||
"obtainOtherPrivilege": false,
|
||||
"userInteractionRequired": false
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "cna@vuldb.com",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-200"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/wp-plugins/simple-download-button-shortcode/commit/e648a8706818297cf02a665ae0bae1c069dea5f1",
|
||||
"source": "cna@vuldb.com"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?ctiid.242190",
|
||||
"source": "cna@vuldb.com"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?id.242190",
|
||||
"source": "cna@vuldb.com"
|
||||
}
|
||||
]
|
||||
}
|
59
CVE-2022/CVE-2022-223xx/CVE-2022-22377.json
Normal file
59
CVE-2022/CVE-2022-223xx/CVE-2022-22377.json
Normal file
@ -0,0 +1,59 @@
|
||||
{
|
||||
"id": "CVE-2022-22377",
|
||||
"sourceIdentifier": "psirt@us.ibm.com",
|
||||
"published": "2023-10-17T01:15:09.687",
|
||||
"lastModified": "2023-10-17T01:15:09.687",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 221827."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "psirt@us.ibm.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.6,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "psirt@us.ibm.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-311"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/221827",
|
||||
"source": "psirt@us.ibm.com"
|
||||
},
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7047202",
|
||||
"source": "psirt@us.ibm.com"
|
||||
}
|
||||
]
|
||||
}
|
59
CVE-2022/CVE-2022-223xx/CVE-2022-22384.json
Normal file
59
CVE-2022/CVE-2022-223xx/CVE-2022-22384.json
Normal file
@ -0,0 +1,59 @@
|
||||
{
|
||||
"id": "CVE-2022-22384",
|
||||
"sourceIdentifier": "psirt@us.ibm.com",
|
||||
"published": "2023-10-17T01:15:09.773",
|
||||
"lastModified": "2023-10-17T01:15:09.773",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "\nIBM Security Verify Privilege On-Premises 11.5 could allow an attacker to modify messages returned from the server due to hazardous input validation. IBM X-Force ID: 221961.\n\n"
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "psirt@us.ibm.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 1.4
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "psirt@us.ibm.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-20"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/221961",
|
||||
"source": "psirt@us.ibm.com"
|
||||
},
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7047202",
|
||||
"source": "psirt@us.ibm.com"
|
||||
}
|
||||
]
|
||||
}
|
59
CVE-2023/CVE-2023-387xx/CVE-2023-38719.json
Normal file
59
CVE-2023/CVE-2023-387xx/CVE-2023-38719.json
Normal file
@ -0,0 +1,59 @@
|
||||
{
|
||||
"id": "CVE-2023-38719",
|
||||
"sourceIdentifier": "psirt@us.ibm.com",
|
||||
"published": "2023-10-17T00:15:10.797",
|
||||
"lastModified": "2023-10-17T00:15:10.797",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Db2 11.5 could allow a local user with special privileges to cause a denial of service during database deactivation on DPF. IBM X-Force ID: 261607."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "psirt@us.ibm.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 5.1,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.4,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "psirt@us.ibm.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-20"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/261607",
|
||||
"source": "psirt@us.ibm.com"
|
||||
},
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7047558",
|
||||
"source": "psirt@us.ibm.com"
|
||||
}
|
||||
]
|
||||
}
|
59
CVE-2023/CVE-2023-403xx/CVE-2023-40372.json
Normal file
59
CVE-2023/CVE-2023-403xx/CVE-2023-40372.json
Normal file
@ -0,0 +1,59 @@
|
||||
{
|
||||
"id": "CVE-2023-40372",
|
||||
"sourceIdentifier": "psirt@us.ibm.com",
|
||||
"published": "2023-10-17T00:15:10.887",
|
||||
"lastModified": "2023-10-17T00:15:10.887",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to denial of service with a specially crafted SQL statement using External Tables. IBM X-Force ID: 263499."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "psirt@us.ibm.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.6,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "psirt@us.ibm.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-20"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/263499",
|
||||
"source": "psirt@us.ibm.com"
|
||||
},
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7047561",
|
||||
"source": "psirt@us.ibm.com"
|
||||
}
|
||||
]
|
||||
}
|
59
CVE-2023/CVE-2023-403xx/CVE-2023-40373.json
Normal file
59
CVE-2023/CVE-2023-403xx/CVE-2023-40373.json
Normal file
@ -0,0 +1,59 @@
|
||||
{
|
||||
"id": "CVE-2023-40373",
|
||||
"sourceIdentifier": "psirt@us.ibm.com",
|
||||
"published": "2023-10-17T00:15:10.970",
|
||||
"lastModified": "2023-10-17T00:15:10.970",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) is vulnerable to denial of service with a specially crafted query containing common table expressions. IBM X-Force ID: 263574."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "psirt@us.ibm.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.6,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "psirt@us.ibm.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-20"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/263574",
|
||||
"source": "psirt@us.ibm.com"
|
||||
},
|
||||
{
|
||||
"url": "https://www.ibm.com/support/pages/node/7047563",
|
||||
"source": "psirt@us.ibm.com"
|
||||
}
|
||||
]
|
||||
}
|
@ -2,12 +2,12 @@
|
||||
"id": "CVE-2023-41419",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-09-25T12:15:11.210",
|
||||
"lastModified": "2023-09-25T18:44:06.973",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2023-10-17T00:15:11.057",
|
||||
"vulnStatus": "Modified",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "An issue in Gevent Gevent before version 23.9.1 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component."
|
||||
"value": "An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
|
55
CVE-2023/CVE-2023-42xx/CVE-2023-4215.json
Normal file
55
CVE-2023/CVE-2023-42xx/CVE-2023-4215.json
Normal file
@ -0,0 +1,55 @@
|
||||
{
|
||||
"id": "CVE-2023-4215",
|
||||
"sourceIdentifier": "ics-cert@hq.dhs.gov",
|
||||
"published": "2023-10-17T00:15:11.327",
|
||||
"lastModified": "2023-10-17T00:15:11.327",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Advantech WebAccess version 9.1.3 contains an exposure of sensitive information to an unauthorized actor vulnerability that could leak user credentials."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "ics-cert@hq.dhs.gov",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 6.5,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "ics-cert@hq.dhs.gov",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-200"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-15",
|
||||
"source": "ics-cert@hq.dhs.gov"
|
||||
}
|
||||
]
|
||||
}
|
@ -2,7 +2,7 @@
|
||||
"id": "CVE-2023-44487",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-10T14:15:10.883",
|
||||
"lastModified": "2023-10-16T19:15:10.740",
|
||||
"lastModified": "2023-10-17T01:15:09.887",
|
||||
"vulnStatus": "Modified",
|
||||
"cisaExploitAdd": "2023-10-10",
|
||||
"cisaActionDue": "2023-10-31",
|
||||
@ -593,6 +593,10 @@
|
||||
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/",
|
||||
"source": "cve@mitre.org"
|
||||
|
59
CVE-2023/CVE-2023-451xx/CVE-2023-45152.json
Normal file
59
CVE-2023/CVE-2023-451xx/CVE-2023-45152.json
Normal file
@ -0,0 +1,59 @@
|
||||
{
|
||||
"id": "CVE-2023-45152",
|
||||
"sourceIdentifier": "security-advisories@github.com",
|
||||
"published": "2023-10-17T00:15:11.140",
|
||||
"lastModified": "2023-10-17T00:15:11.140",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Engelsystem is a shift planning system for chaos events. A Blind SSRF in the \"Import schedule\" functionality makes it possible to perform a port scan against the local environment. This vulnerability has been fixed in commit ee7d30b33. If a patch cannot be deployed, operators should ensure that no HTTP(s) services listen on localhost and/or systems only reachable from the host running the engelsystem software. If such services are necessary, they should utilize additional authentication."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "security-advisories@github.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 2.0,
|
||||
"baseSeverity": "LOW"
|
||||
},
|
||||
"exploitabilityScore": 0.6,
|
||||
"impactScore": 1.4
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "security-advisories@github.com",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-918"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/engelsystem/engelsystem/commit/ee7d30b33935ea001705f438fec8ffd05734f295",
|
||||
"source": "security-advisories@github.com"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/engelsystem/engelsystem/security/advisories/GHSA-jj9g-75wf-6ppf",
|
||||
"source": "security-advisories@github.com"
|
||||
}
|
||||
]
|
||||
}
|
59
CVE-2023/CVE-2023-456xx/CVE-2023-45659.json
Normal file
59
CVE-2023/CVE-2023-456xx/CVE-2023-45659.json
Normal file
@ -0,0 +1,59 @@
|
||||
{
|
||||
"id": "CVE-2023-45659",
|
||||
"sourceIdentifier": "security-advisories@github.com",
|
||||
"published": "2023-10-17T00:15:11.233",
|
||||
"lastModified": "2023-10-17T00:15:11.233",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixed in the commit `dbb089315ff3d`. Users are advised to update their installations. There are no known workarounds for this vulnerability."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "security-advisories@github.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 3.6,
|
||||
"baseSeverity": "LOW"
|
||||
},
|
||||
"exploitabilityScore": 1.0,
|
||||
"impactScore": 2.5
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "security-advisories@github.com",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-613"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/engelsystem/engelsystem/commit/dbb089315ff3d8aabc11445e78fb50765208b27d",
|
||||
"source": "security-advisories@github.com"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/engelsystem/engelsystem/security/advisories/GHSA-f6mm-3v2h-jm6x",
|
||||
"source": "security-advisories@github.com"
|
||||
}
|
||||
]
|
||||
}
|
38
README.md
38
README.md
@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
|
||||
### Last Repository Update
|
||||
|
||||
```plain
|
||||
2023-10-16T23:55:24.447141+00:00
|
||||
2023-10-17T02:00:25.170311+00:00
|
||||
```
|
||||
|
||||
### Most recent CVE Modification Timestamp synchronized with NVD
|
||||
|
||||
```plain
|
||||
2023-10-16T23:15:10.243000+00:00
|
||||
2023-10-17T01:15:09.887000+00:00
|
||||
```
|
||||
|
||||
### Last Data Feed Release
|
||||
@ -23,39 +23,37 @@ Repository synchronizes with the NVD every 2 hours.
|
||||
Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/releases/latest)
|
||||
|
||||
```plain
|
||||
2023-10-16T00:00:13.560662+00:00
|
||||
2023-10-17T00:00:13.595814+00:00
|
||||
```
|
||||
|
||||
### Total Number of included CVEs
|
||||
|
||||
```plain
|
||||
227986
|
||||
227996
|
||||
```
|
||||
|
||||
### CVEs added in the last Commit
|
||||
|
||||
Recently added CVEs: `13`
|
||||
Recently added CVEs: `10`
|
||||
|
||||
* [CVE-2023-38728](CVE-2023/CVE-2023-387xx/CVE-2023-38728.json) (`2023-10-16T22:15:11.957`)
|
||||
* [CVE-2023-38740](CVE-2023/CVE-2023-387xx/CVE-2023-38740.json) (`2023-10-16T22:15:12.057`)
|
||||
* [CVE-2023-43658](CVE-2023/CVE-2023-436xx/CVE-2023-43658.json) (`2023-10-16T22:15:12.143`)
|
||||
* [CVE-2023-43659](CVE-2023/CVE-2023-436xx/CVE-2023-43659.json) (`2023-10-16T22:15:12.237`)
|
||||
* [CVE-2023-43814](CVE-2023/CVE-2023-438xx/CVE-2023-43814.json) (`2023-10-16T22:15:12.317`)
|
||||
* [CVE-2023-44388](CVE-2023/CVE-2023-443xx/CVE-2023-44388.json) (`2023-10-16T22:15:12.397`)
|
||||
* [CVE-2023-44391](CVE-2023/CVE-2023-443xx/CVE-2023-44391.json) (`2023-10-16T22:15:12.477`)
|
||||
* [CVE-2023-44394](CVE-2023/CVE-2023-443xx/CVE-2023-44394.json) (`2023-10-16T22:15:12.560`)
|
||||
* [CVE-2023-45131](CVE-2023/CVE-2023-451xx/CVE-2023-45131.json) (`2023-10-16T22:15:12.650`)
|
||||
* [CVE-2023-45540](CVE-2023/CVE-2023-455xx/CVE-2023-45540.json) (`2023-10-16T22:15:12.733`)
|
||||
* [CVE-2023-45807](CVE-2023/CVE-2023-458xx/CVE-2023-45807.json) (`2023-10-16T22:15:12.790`)
|
||||
* [CVE-2023-30991](CVE-2023/CVE-2023-309xx/CVE-2023-30991.json) (`2023-10-16T23:15:10.147`)
|
||||
* [CVE-2023-40374](CVE-2023/CVE-2023-403xx/CVE-2023-40374.json) (`2023-10-16T23:15:10.243`)
|
||||
* [CVE-2011-10004](CVE-2011/CVE-2011-100xx/CVE-2011-10004.json) (`2023-10-17T00:15:10.500`)
|
||||
* [CVE-2012-10016](CVE-2012/CVE-2012-100xx/CVE-2012-10016.json) (`2023-10-17T00:15:10.603`)
|
||||
* [CVE-2022-22377](CVE-2022/CVE-2022-223xx/CVE-2022-22377.json) (`2023-10-17T01:15:09.687`)
|
||||
* [CVE-2022-22384](CVE-2022/CVE-2022-223xx/CVE-2022-22384.json) (`2023-10-17T01:15:09.773`)
|
||||
* [CVE-2023-38719](CVE-2023/CVE-2023-387xx/CVE-2023-38719.json) (`2023-10-17T00:15:10.797`)
|
||||
* [CVE-2023-40372](CVE-2023/CVE-2023-403xx/CVE-2023-40372.json) (`2023-10-17T00:15:10.887`)
|
||||
* [CVE-2023-40373](CVE-2023/CVE-2023-403xx/CVE-2023-40373.json) (`2023-10-17T00:15:10.970`)
|
||||
* [CVE-2023-45152](CVE-2023/CVE-2023-451xx/CVE-2023-45152.json) (`2023-10-17T00:15:11.140`)
|
||||
* [CVE-2023-45659](CVE-2023/CVE-2023-456xx/CVE-2023-45659.json) (`2023-10-17T00:15:11.233`)
|
||||
* [CVE-2023-4215](CVE-2023/CVE-2023-42xx/CVE-2023-4215.json) (`2023-10-17T00:15:11.327`)
|
||||
|
||||
|
||||
### CVEs modified in the last Commit
|
||||
|
||||
Recently modified CVEs: `1`
|
||||
Recently modified CVEs: `2`
|
||||
|
||||
* [CVE-2023-20198](CVE-2023/CVE-2023-201xx/CVE-2023-20198.json) (`2023-10-16T22:15:11.833`)
|
||||
* [CVE-2023-41419](CVE-2023/CVE-2023-414xx/CVE-2023-41419.json) (`2023-10-17T00:15:11.057`)
|
||||
* [CVE-2023-44487](CVE-2023/CVE-2023-444xx/CVE-2023-44487.json) (`2023-10-17T01:15:09.887`)
|
||||
|
||||
|
||||
## Download and Usage
|
||||
|
Loading…
x
Reference in New Issue
Block a user