diff --git a/CVE-2012/CVE-2012-66xx/CVE-2012-6664.json b/CVE-2012/CVE-2012-66xx/CVE-2012-6664.json
index 4bb5fe4f301..54ac81ab79c 100644
--- a/CVE-2012/CVE-2012-66xx/CVE-2012-6664.json
+++ b/CVE-2012/CVE-2012-66xx/CVE-2012-6664.json
@@ -2,12 +2,16 @@
"id": "CVE-2012-6664",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-06-21T22:15:09.767",
- "lastModified": "2024-06-21T22:15:09.767",
- "vulnStatus": "Received",
+ "lastModified": "2024-06-24T12:57:36.513",
+ "vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read or write arbitrary files via a .. (dot dot) in the (1) get or (2) put commands."
+ },
+ {
+ "lang": "es",
+ "value": "M\u00faltiples vulnerabilidades de directory traversal en el servidor TFTP en Distinct Intranet Servers 3.10 y anteriores permiten a atacantes remotos leer o escribir archivos de su elecci\u00f3n mediante un .. (punto punto) en los comandos (1) get o (2) put."
}
],
"metrics": {},
diff --git a/CVE-2014/CVE-2014-54xx/CVE-2014-5470.json b/CVE-2014/CVE-2014-54xx/CVE-2014-5470.json
index 4510e03564a..9dc4ba0e714 100644
--- a/CVE-2014/CVE-2014-54xx/CVE-2014-5470.json
+++ b/CVE-2014/CVE-2014-54xx/CVE-2014-5470.json
@@ -2,12 +2,16 @@
"id": "CVE-2014-5470",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-06-21T22:15:10.417",
- "lastModified": "2024-06-21T22:15:10.417",
- "vulnStatus": "Received",
+ "lastModified": "2024-06-24T12:57:36.513",
+ "vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data passed to an eval operation."
+ },
+ {
+ "lang": "es",
+ "value": "Actual Analyzer hasta el 29 de agosto de 2014 permite la ejecuci\u00f3n de c\u00f3digo a trav\u00e9s de metacaracteres del shell porque se utilizan entradas que no son de confianza para parte de los datos de entrada pasados a una operaci\u00f3n de evaluaci\u00f3n."
}
],
"metrics": {},
diff --git a/CVE-2020/CVE-2020-273xx/CVE-2020-27352.json b/CVE-2020/CVE-2020-273xx/CVE-2020-27352.json
index 2e7cb03669a..6af14c078ae 100644
--- a/CVE-2020/CVE-2020-273xx/CVE-2020-27352.json
+++ b/CVE-2020/CVE-2020-273xx/CVE-2020-27352.json
@@ -2,12 +2,16 @@
"id": "CVE-2020-27352",
"sourceIdentifier": "security@ubuntu.com",
"published": "2024-06-21T20:15:10.630",
- "lastModified": "2024-06-21T20:15:10.630",
- "vulnStatus": "Received",
+ "lastModified": "2024-06-24T12:57:36.513",
+ "vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading system units. This may grant additional privileges to a container within the snap that were not originally intended."
+ },
+ {
+ "lang": "es",
+ "value": "Al generar las unidades de servicio systemd para el complemento de Docker (y otros complementos similares), snapd no especifica Delegate=yes; como resultado, systemd mover\u00e1 los procesos de los contenedores creados y administrados por estos complementos al grupo c del daemon principal dentro del se rompe al recargar las unidades del sistema. Esto puede otorgar privilegios adicionales a un contenedor dentro del complemento que no estaban previstos originalmente."
}
],
"metrics": {
diff --git a/CVE-2022/CVE-2022-429xx/CVE-2022-42974.json b/CVE-2022/CVE-2022-429xx/CVE-2022-42974.json
index ddd7f87ce2d..2b93d0f916f 100644
--- a/CVE-2022/CVE-2022-429xx/CVE-2022-42974.json
+++ b/CVE-2022/CVE-2022-429xx/CVE-2022-42974.json
@@ -2,12 +2,16 @@
"id": "CVE-2022-42974",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-06-21T22:15:10.557",
- "lastModified": "2024-06-21T22:15:10.557",
- "vulnStatus": "Received",
+ "lastModified": "2024-06-24T12:57:36.513",
+ "vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "In Kostal PIKO 1.5-1 MP plus HMI OEM p 1.0.1, the web application for the Solar Panel is vulnerable to a Stored Cross-Site Scripting (XSS) attack on /file.bootloader.upload.html. The application fails to sanitize the parameter filename, in a POST request to /file.bootloader.upload.html for a system update, thus allowing one to inject HTML and/or JavaScript on the page that will then be processed and stored by the application. Any subsequent requests to pages that retrieve the malicious content will automatically exploit the vulnerability on the victim's browser. This also happens because the tag is loaded in the function innerHTML in the page HTML."
+ },
+ {
+ "lang": "es",
+ "value": "En Kostal PIKO 1.5-1 MP plus HMI OEM p 1.0.1, la aplicaci\u00f3n web para el panel solar es vulnerable a un ataque de Cross-Site Scripting Almacenado (XSS) en /file.bootloader.upload.html. La aplicaci\u00f3n no puede sanitizar el nombre del archivo del par\u00e1metro, en una solicitud POST a /file.bootloader.upload.html para una actualizaci\u00f3n del sistema, lo que permite inyectar HTML y/o JavaScript en la p\u00e1gina que luego ser\u00e1 procesada y almacenada por la aplicaci\u00f3n. Cualquier solicitud posterior a p\u00e1ginas que recuperen contenido malicioso explotar\u00e1 autom\u00e1ticamente la vulnerabilidad en el navegador de la v\u00edctima. Esto tambi\u00e9n sucede porque la etiqueta se carga en la funci\u00f3n InnerHTML en la p\u00e1gina HTML."
}
],
"metrics": {},
diff --git a/CVE-2023/CVE-2023-378xx/CVE-2023-37898.json b/CVE-2023/CVE-2023-378xx/CVE-2023-37898.json
index 7d696494b80..7163860ea56 100644
--- a/CVE-2023/CVE-2023-378xx/CVE-2023-37898.json
+++ b/CVE-2023/CVE-2023-378xx/CVE-2023-37898.json
@@ -2,12 +2,16 @@
"id": "CVE-2023-37898",
"sourceIdentifier": "security-advisories@github.com",
"published": "2024-06-21T20:15:11.583",
- "lastModified": "2024-06-21T20:15:11.583",
- "vulnStatus": "Received",
+ "lastModified": "2024-06-24T12:57:36.513",
+ "vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "Joplin is a free, open source note taking and to-do application. A Cross-site Scripting (XSS) vulnerability allows an untrusted note opened in safe mode to execute arbitrary code. `packages/renderer/MarkupToHtml.ts` renders note content in safe mode by surrounding it with and
, without escaping any interior HTML tags. Thus, an attacker can create a note that closes the opening tag, then includes HTML that runs JavaScript. Because the rendered markdown iframe has the same origin as the toplevel document and is not sandboxed, any scripts running in the preview iframe can access the top variable and, thus, access the toplevel NodeJS `require` function. `require` can then be used to import modules like fs or child_process and run arbitrary commands. This issue has been addressed in version 2.12.9 and all users are advised to upgrade. There are no known workarounds for this vulnerability."
+ },
+ {
+ "lang": "es",
+ "value": "Joplin es una aplicaci\u00f3n gratuita y de c\u00f3digo abierto para tomar notas y tareas pendientes. Una vulnerabilidad de Cross-Site Scripting (XSS) permite que una nota que no es de confianza abierta en modo seguro ejecute c\u00f3digo arbitrario. `packages/renderer/MarkupToHtml.ts` muestra el contenido de la nota en modo seguro rode\u00e1ndolo con y
, sin escapar de ninguna etiqueta HTML interior. Por lo tanto, un atacante puede crear una nota que cierre la etiqueta de apertura y luego incluya HTML que ejecute JavaScript. Debido a que el iframe de rebajas renderizado tiene el mismo origen que el documento de nivel superior y no est\u00e1 en un espacio aislado, cualquier script que se ejecute en el iframe de vista previa puede acceder a la variable superior y, por lo tanto, acceder a la funci\u00f3n `require` de NodeJS de nivel superior. Luego, `require` se puede usar para importar m\u00f3dulos como fs o child_process y ejecutar comandos arbitrarios. Este problema se solucion\u00f3 en la versi\u00f3n 2.12.9 y se recomienda a todos los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad.
"
}
],
"metrics": {
diff --git a/CVE-2023/CVE-2023-385xx/CVE-2023-38506.json b/CVE-2023/CVE-2023-385xx/CVE-2023-38506.json
index fcc6cb421c9..f49c7847492 100644
--- a/CVE-2023/CVE-2023-385xx/CVE-2023-38506.json
+++ b/CVE-2023/CVE-2023-385xx/CVE-2023-38506.json
@@ -2,12 +2,16 @@
"id": "CVE-2023-38506",
"sourceIdentifier": "security-advisories@github.com",
"published": "2024-06-21T20:15:12.003",
- "lastModified": "2024-06-21T20:15:12.003",
- "vulnStatus": "Received",
+ "lastModified": "2024-06-24T12:57:36.513",
+ "vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "Joplin is a free, open source note taking and to-do application. A Cross-site Scripting (XSS) vulnerability allows pasting untrusted data into the rich text editor to execute arbitrary code. HTML pasted into the rich text editor is not sanitized (or not sanitized properly). As such, the `onload` attribute of pasted images can execute arbitrary code. Because the TinyMCE editor frame does not use the `sandbox` attribute, such scripts can access NodeJS's `require` through the `top` variable. From this, an attacker can run arbitrary commands. This issue has been addressed in version 2.12.10 and users are advised to upgrade. There are no known workarounds for this vulnerability."
+ },
+ {
+ "lang": "es",
+ "value": "Joplin es una aplicaci\u00f3n gratuita y de c\u00f3digo abierto para tomar notas y tareas pendientes. Una vulnerabilidad de Cross-Site Scripting (XSS) permite pegar datos que no son de confianza en el editor de texto enriquecido para ejecutar c\u00f3digo arbitrario. El HTML pegado en el editor de texto enriquecido no se sanitiza (o no se sanitiza correctamente). Como tal, el atributo \"onload\" de las im\u00e1genes pegadas puede ejecutar c\u00f3digo arbitrario. Debido a que el marco del editor TinyMCE no utiliza el atributo `sandbox`, dichos scripts pueden acceder al `require` de NodeJS a trav\u00e9s de la variable `top`. A partir de esto, un atacante puede ejecutar comandos arbitrarios. Este problema se solucion\u00f3 en la versi\u00f3n 2.12.10 y se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."
}
],
"metrics": {
diff --git a/CVE-2023/CVE-2023-395xx/CVE-2023-39517.json b/CVE-2023/CVE-2023-395xx/CVE-2023-39517.json
index 6e6fbedd185..0bbcf3c2009 100644
--- a/CVE-2023/CVE-2023-395xx/CVE-2023-39517.json
+++ b/CVE-2023/CVE-2023-395xx/CVE-2023-39517.json
@@ -2,12 +2,16 @@
"id": "CVE-2023-39517",
"sourceIdentifier": "security-advisories@github.com",
"published": "2024-06-21T20:15:12.307",
- "lastModified": "2024-06-21T20:15:12.307",
- "vulnStatus": "Received",
+ "lastModified": "2024-06-24T12:57:36.513",
+ "vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "Joplin is a free, open source note taking and to-do application. A Cross site scripting (XSS) vulnerability in affected versions allows clicking on an untrusted image link to execute arbitrary shell commands. The HTML sanitizer (`packages/renderer/htmlUtils.ts::sanitizeHtml`) preserves `