Auto-Update: 2023-07-26T08:00:27.530071+00:00

This commit is contained in:
cad-safe-bot 2023-07-26 08:00:30 +00:00
parent f689501c77
commit 10498828ab
15 changed files with 370 additions and 63 deletions

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2022-2502",
"sourceIdentifier": "cybersecurity@hitachienergy.com",
"published": "2023-07-26T06:15:09.760",
"lastModified": "2023-07-26T06:15:09.760",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability exists in the HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only be exploited, if the HCI 60870-5-104 is configured with support for IEC 62351-5 and the CMU contains the license feature \u2018Advanced security\u2019 which must be ordered separately. If these preconditions are fulfilled, an attacker could exploit the vulnerability by sending a specially crafted message to the RTU500, causing the targeted RTU500 CMU to reboot. The vulnerability is caused by a missing input data validation which eventually if exploited causes an internal buffer to overflow in the HCI IEC 60870-5-104 function."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "cybersecurity@hitachienergy.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "cybersecurity@hitachienergy.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-120"
}
]
}
],
"references": [
{
"url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000121&LanguageCode=en&DocumentPartId=&Action=Launch",
"source": "cybersecurity@hitachienergy.com"
}
]
}

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2022-4608",
"sourceIdentifier": "cybersecurity@hitachienergy.com",
"published": "2023-07-26T06:15:10.220",
"lastModified": "2023-07-26T06:15:10.220",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability exists in HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. The vulnerability can only be exploited, if the HCI 60870-5-104 is configured with support for IEC 62351-3. After session resumption interval is expired an RTU500 initiated update of session parameters causes an unexpected restart due to a stack overflow."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "cybersecurity@hitachienergy.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "cybersecurity@hitachienergy.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-120"
}
]
}
],
"references": [
{
"url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000121&LanguageCode=en&DocumentPartId=&Action=Launch",
"source": "cybersecurity@hitachienergy.com"
}
]
}

View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-1401",
"sourceIdentifier": "cve@gitlab.com",
"published": "2023-07-26T07:15:09.103",
"lastModified": "2023-07-26T07:15:09.103",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies on redirect during authorization."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "cve@gitlab.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 3.1,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "cve@gitlab.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"references": [
{
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/396533",
"source": "cve@gitlab.com"
},
{
"url": "https://hackerone.com/reports/1889255",
"source": "cve@gitlab.com"
}
]
}

View File

@ -2,7 +2,7 @@
"id": "CVE-2023-20593",
"sourceIdentifier": "psirt@amd.com",
"published": "2023-07-24T20:15:10.237",
"lastModified": "2023-07-25T21:15:10.333",
"lastModified": "2023-07-26T07:15:09.327",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
@ -12,6 +12,10 @@
],
"metrics": {},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Jul/43",
"source": "psirt@amd.com"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/07/24/3",
"source": "psirt@amd.com"

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2023-20891",
"sourceIdentifier": "security@vmware.com",
"published": "2023-07-26T06:15:10.637",
"lastModified": "2023-07-26T06:15:10.637",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs.\u00a0A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment non-admin users do not have access to the platform system audit logs."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@vmware.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "security@vmware.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-532"
}
]
}
],
"references": [
{
"url": "https://www.vmware.com/security/advisories/VMSA-2023-0016.html",
"source": "security@vmware.com"
}
]
}

View File

@ -2,8 +2,8 @@
"id": "CVE-2023-32046",
"sourceIdentifier": "secure@microsoft.com",
"published": "2023-07-11T18:15:13.313",
"lastModified": "2023-07-13T20:00:12.013",
"vulnStatus": "Analyzed",
"lastModified": "2023-07-26T07:15:09.427",
"vulnStatus": "Modified",
"cisaExploitAdd": "2023-07-11",
"cisaActionDue": "2023-08-01",
"cisaRequiredAction": "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.",
@ -140,6 +140,10 @@
}
],
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Jul/43",
"source": "secure@microsoft.com"
},
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-32046",
"source": "secure@microsoft.com",

View File

@ -2,7 +2,7 @@
"id": "CVE-2023-34434",
"sourceIdentifier": "security@apache.org",
"published": "2023-07-25T08:15:10.147",
"lastModified": "2023-07-25T13:00:59.687",
"lastModified": "2023-07-26T07:15:09.590",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
@ -24,6 +24,10 @@
}
],
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Jul/43",
"source": "security@apache.org"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/07/25/3",
"source": "security@apache.org"

View File

@ -2,7 +2,7 @@
"id": "CVE-2023-35088",
"sourceIdentifier": "security@apache.org",
"published": "2023-07-25T08:15:10.213",
"lastModified": "2023-07-25T13:00:59.687",
"lastModified": "2023-07-26T07:15:09.787",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
@ -24,6 +24,10 @@
}
],
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Jul/43",
"source": "security@apache.org"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/07/25/4",
"source": "security@apache.org"

View File

@ -2,8 +2,12 @@
"id": "CVE-2023-36884",
"sourceIdentifier": "secure@microsoft.com",
"published": "2023-07-11T19:15:09.623",
"lastModified": "2023-07-17T19:21:42.307",
"vulnStatus": "Analyzed",
"lastModified": "2023-07-26T07:15:09.887",
"vulnStatus": "Modified",
"cisaExploitAdd": "2023-07-17",
"cisaActionDue": "2023-08-07",
"cisaRequiredAction": "Follow \"CVE-2023-36884 Specific Recommendations\" per vendor instructions. [https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/]",
"cisaVulnerabilityName": "Microsoft Office and Windows HTML Remote Code Execution Vulnerability",
"descriptions": [
{
"lang": "en",
@ -12,29 +16,9 @@
],
"metrics": {
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
},
{
"source": "secure@microsoft.com",
"type": "Secondary",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N",
@ -51,6 +35,26 @@
},
"exploitabilityScore": 0.1,
"impactScore": 0.0
},
{
"source": "nvd@nist.gov",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
]
},
@ -229,6 +233,10 @@
}
],
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Jul/43",
"source": "secure@microsoft.com"
},
{
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884",
"source": "secure@microsoft.com",

View File

@ -2,7 +2,7 @@
"id": "CVE-2023-37895",
"sourceIdentifier": "security@apache.org",
"published": "2023-07-25T15:15:13.587",
"lastModified": "2023-07-25T17:22:14.780",
"lastModified": "2023-07-26T07:15:10.047",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
@ -24,6 +24,10 @@
}
],
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Jul/43",
"source": "security@apache.org"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/07/25/8",
"source": "security@apache.org"

View File

@ -2,7 +2,7 @@
"id": "CVE-2023-38334",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-07-20T18:15:12.170",
"lastModified": "2023-07-24T16:15:12.137",
"lastModified": "2023-07-26T07:15:10.157",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
@ -20,6 +20,10 @@
"url": "http://seclists.org/fulldisclosure/2023/Jul/42",
"source": "cve@mitre.org"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Jul/43",
"source": "cve@mitre.org"
},
{
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-006.txt",
"source": "cve@mitre.org"

View File

@ -2,7 +2,7 @@
"id": "CVE-2023-38335",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-07-20T18:15:12.227",
"lastModified": "2023-07-24T16:15:12.193",
"lastModified": "2023-07-26T07:15:10.240",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
@ -20,6 +20,10 @@
"url": "http://seclists.org/fulldisclosure/2023/Jul/41",
"source": "cve@mitre.org"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Jul/43",
"source": "cve@mitre.org"
},
{
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-005.txt",
"source": "cve@mitre.org"

View File

@ -2,7 +2,7 @@
"id": "CVE-2023-38435",
"sourceIdentifier": "security@apache.org",
"published": "2023-07-25T16:15:11.500",
"lastModified": "2023-07-25T18:15:11.087",
"lastModified": "2023-07-26T07:15:10.323",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
@ -24,6 +24,10 @@
}
],
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Jul/43",
"source": "security@apache.org"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/07/25/10",
"source": "security@apache.org"

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2023-3946",
"sourceIdentifier": "trellixpsirt@trellix.com",
"published": "2023-07-26T06:15:11.080",
"lastModified": "2023-07-26T06:15:11.080",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "\nA reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO.\n\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "trellixpsirt@trellix.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
}
]
},
"weaknesses": [
{
"source": "trellixpsirt@trellix.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://kcm.trellix.com/corporate/index?page=content&id=SB10402",
"source": "trellixpsirt@trellix.com"
}
]
}

View File

@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2023-07-26T06:00:28.131999+00:00
2023-07-26T08:00:27.530071+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2023-07-26T04:24:59.167000+00:00
2023-07-26T07:15:10.323000+00:00
```
### Last Data Feed Release
@ -29,45 +29,33 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
221037
221042
```
### CVEs added in the last Commit
Recently added CVEs: `1`
Recently added CVEs: `5`
* [CVE-2023-3947](CVE-2023/CVE-2023-39xx/CVE-2023-3947.json) (`2023-07-26T04:15:11.117`)
* [CVE-2022-2502](CVE-2022/CVE-2022-25xx/CVE-2022-2502.json) (`2023-07-26T06:15:09.760`)
* [CVE-2022-4608](CVE-2022/CVE-2022-46xx/CVE-2022-4608.json) (`2023-07-26T06:15:10.220`)
* [CVE-2023-20891](CVE-2023/CVE-2023-208xx/CVE-2023-20891.json) (`2023-07-26T06:15:10.637`)
* [CVE-2023-3946](CVE-2023/CVE-2023-39xx/CVE-2023-3946.json) (`2023-07-26T06:15:11.080`)
* [CVE-2023-1401](CVE-2023/CVE-2023-14xx/CVE-2023-1401.json) (`2023-07-26T07:15:09.103`)
### CVEs modified in the last Commit
Recently modified CVEs: `49`
Recently modified CVEs: `9`
* [CVE-2023-36806](CVE-2023/CVE-2023-368xx/CVE-2023-36806.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-36826](CVE-2023/CVE-2023-368xx/CVE-2023-36826.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-39128](CVE-2023/CVE-2023-391xx/CVE-2023-39128.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-39129](CVE-2023/CVE-2023-391xx/CVE-2023-39129.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-39130](CVE-2023/CVE-2023-391xx/CVE-2023-39130.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-34798](CVE-2023/CVE-2023-347xx/CVE-2023-34798.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-37257](CVE-2023/CVE-2023-372xx/CVE-2023-37257.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-37258](CVE-2023/CVE-2023-372xx/CVE-2023-37258.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-37460](CVE-2023/CVE-2023-374xx/CVE-2023-37460.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-37677](CVE-2023/CVE-2023-376xx/CVE-2023-37677.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-3944](CVE-2023/CVE-2023-39xx/CVE-2023-3944.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-37902](CVE-2023/CVE-2023-379xx/CVE-2023-37902.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-37907](CVE-2023/CVE-2023-379xx/CVE-2023-37907.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-37919](CVE-2023/CVE-2023-379xx/CVE-2023-37919.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-37920](CVE-2023/CVE-2023-379xx/CVE-2023-37920.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-38493](CVE-2023/CVE-2023-384xx/CVE-2023-38493.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-38499](CVE-2023/CVE-2023-384xx/CVE-2023-38499.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-38500](CVE-2023/CVE-2023-385xx/CVE-2023-38500.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-38496](CVE-2023/CVE-2023-384xx/CVE-2023-38496.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-38501](CVE-2023/CVE-2023-385xx/CVE-2023-38501.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-38502](CVE-2023/CVE-2023-385xx/CVE-2023-38502.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-3945](CVE-2023/CVE-2023-39xx/CVE-2023-3945.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-38503](CVE-2023/CVE-2023-385xx/CVE-2023-38503.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-2640](CVE-2023/CVE-2023-26xx/CVE-2023-2640.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-32629](CVE-2023/CVE-2023-326xx/CVE-2023-32629.json) (`2023-07-26T04:24:59.167`)
* [CVE-2023-20593](CVE-2023/CVE-2023-205xx/CVE-2023-20593.json) (`2023-07-26T07:15:09.327`)
* [CVE-2023-32046](CVE-2023/CVE-2023-320xx/CVE-2023-32046.json) (`2023-07-26T07:15:09.427`)
* [CVE-2023-34434](CVE-2023/CVE-2023-344xx/CVE-2023-34434.json) (`2023-07-26T07:15:09.590`)
* [CVE-2023-35088](CVE-2023/CVE-2023-350xx/CVE-2023-35088.json) (`2023-07-26T07:15:09.787`)
* [CVE-2023-36884](CVE-2023/CVE-2023-368xx/CVE-2023-36884.json) (`2023-07-26T07:15:09.887`)
* [CVE-2023-37895](CVE-2023/CVE-2023-378xx/CVE-2023-37895.json) (`2023-07-26T07:15:10.047`)
* [CVE-2023-38334](CVE-2023/CVE-2023-383xx/CVE-2023-38334.json) (`2023-07-26T07:15:10.157`)
* [CVE-2023-38335](CVE-2023/CVE-2023-383xx/CVE-2023-38335.json) (`2023-07-26T07:15:10.240`)
* [CVE-2023-38435](CVE-2023/CVE-2023-384xx/CVE-2023-38435.json) (`2023-07-26T07:15:10.323`)
## Download and Usage