From 1163b40e3ba776783e8b80323d23004e71a8872f Mon Sep 17 00:00:00 2001 From: cad-safe-bot Date: Mon, 15 Jan 2024 23:00:28 +0000 Subject: [PATCH] Auto-Update: 2024-01-15T23:00:24.743653+00:00 --- CVE-2023/CVE-2023-50xx/CVE-2023-5012.json | 10 +++++----- CVE-2023/CVE-2023-54xx/CVE-2023-5455.json | 10 +++++++++- README.md | 12 ++++++------ 3 files changed, 20 insertions(+), 12 deletions(-) diff --git a/CVE-2023/CVE-2023-50xx/CVE-2023-5012.json b/CVE-2023/CVE-2023-50xx/CVE-2023-5012.json index c6be3d81f83..a7d0e19a0fe 100644 --- a/CVE-2023/CVE-2023-50xx/CVE-2023-5012.json +++ b/CVE-2023/CVE-2023-50xx/CVE-2023-5012.json @@ -2,12 +2,12 @@ "id": "CVE-2023-5012", "sourceIdentifier": "cna@vuldb.com", "published": "2023-09-16T21:15:47.887", - "lastModified": "2023-11-07T04:23:18.157", + "lastModified": "2024-01-15T21:15:08.010", "vulnStatus": "Modified", "descriptions": [ { "lang": "en", - "value": "A vulnerability, which was classified as problematic, was found in Topaz OFD 2.11.0.201. This affects an unknown part of the file C:\\Program Files\\Topaz OFD\\Warsaw\\core.exe of the component Protection Module Warsaw. The manipulation leads to unquoted search path. Attacking locally is a requirement. The identifier VDB-239853 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way." + "value": "A vulnerability, which was classified as problematic, was found in Topaz OFD 2.11.0.201. This affects an unknown part of the file C:\\Program Files\\Topaz OFD\\Warsaw\\core.exe of the component Protection Module Warsaw. The manipulation leads to unquoted search path. Attacking locally is a requirement. Upgrading to version 2.12.0.259 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-239853 was assigned to this vulnerability." }, { "lang": "es", @@ -37,7 +37,7 @@ "impactScore": 5.9 }, { - "source": "1af790b2-7ee1-4545-860a-a788eba489b5", + "source": "cna@vuldb.com", "type": "Secondary", "cvssData": { "version": "3.1", @@ -59,7 +59,7 @@ ], "cvssMetricV2": [ { - "source": "1af790b2-7ee1-4545-860a-a788eba489b5", + "source": "cna@vuldb.com", "type": "Secondary", "cvssData": { "version": "2.0", @@ -85,7 +85,7 @@ }, "weaknesses": [ { - "source": "1af790b2-7ee1-4545-860a-a788eba489b5", + "source": "cna@vuldb.com", "type": "Primary", "description": [ { diff --git a/CVE-2023/CVE-2023-54xx/CVE-2023-5455.json b/CVE-2023/CVE-2023-54xx/CVE-2023-5455.json index 6718653a2f2..eb1164b32ae 100644 --- a/CVE-2023/CVE-2023-54xx/CVE-2023-5455.json +++ b/CVE-2023/CVE-2023-54xx/CVE-2023-5455.json @@ -2,12 +2,16 @@ "id": "CVE-2023-5455", "sourceIdentifier": "secalert@redhat.com", "published": "2024-01-10T13:15:48.643", - "lastModified": "2024-01-10T15:15:09.970", + "lastModified": "2024-01-15T21:15:08.147", "vulnStatus": "Awaiting Analysis", "descriptions": [ { "lang": "en", "value": "A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt." + }, + { + "lang": "es", + "value": "Existe una vulnerabilidad de Cross-site request forgery en ipa/session/login_password en todas las versiones compatibles de IPA. Este fallo permite a un atacante enga\u00f1ar al usuario para que env\u00ede una solicitud que podr\u00eda realizar acciones como el usuario, lo que resulta en una p\u00e9rdida de confidencialidad e integridad del sistema. Durante las pruebas de penetraci\u00f3n de la comunidad, se descubri\u00f3 que para ciertos endpoints HTTP, FreeIPA no garantizan la protecci\u00f3n CSRF. Debido a los detalles de implementaci\u00f3n, no se puede utilizar este fallo para reflejar una cookie que represente a un usuario que ya inici\u00f3 sesi\u00f3n. Un atacante siempre tendr\u00eda que realizar un nuevo intento de autenticaci\u00f3n." } ], "metrics": { @@ -83,6 +87,10 @@ "url": "https://access.redhat.com/errata/RHSA-2024:0145", "source": "secalert@redhat.com" }, + { + "url": "https://access.redhat.com/errata/RHSA-2024:0252", + "source": "secalert@redhat.com" + }, { "url": "https://access.redhat.com/security/cve/CVE-2023-5455", "source": "secalert@redhat.com" diff --git a/README.md b/README.md index 394c446ae9a..c0d009883f1 100644 --- a/README.md +++ b/README.md @@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2024-01-15T21:00:24.921794+00:00 +2024-01-15T23:00:24.743653+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2024-01-15T20:15:43.630000+00:00 +2024-01-15T21:15:08.147000+00:00 ``` ### Last Data Feed Release @@ -34,16 +34,16 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/ ### CVEs added in the last Commit -Recently added CVEs: `2` +Recently added CVEs: `0` -* [CVE-2024-0562](CVE-2024/CVE-2024-05xx/CVE-2024-0562.json) (`2024-01-15T19:15:08.120`) -* [CVE-2024-0565](CVE-2024/CVE-2024-05xx/CVE-2024-0565.json) (`2024-01-15T20:15:43.630`) ### CVEs modified in the last Commit -Recently modified CVEs: `0` +Recently modified CVEs: `2` +* [CVE-2023-5012](CVE-2023/CVE-2023-50xx/CVE-2023-5012.json) (`2024-01-15T21:15:08.010`) +* [CVE-2023-5455](CVE-2023/CVE-2023-54xx/CVE-2023-5455.json) (`2024-01-15T21:15:08.147`) ## Download and Usage