Auto-Update: 2023-11-28T00:55:17.995431+00:00

2025-05-08 19:47:09 +00:00 · 2023-11-28 00:55:21 +00:00 · 2023-11-28 00:55:21 +00:00 · 1e762b365c
commit 1e762b365c
parent 04554826c9
12 changed files with 295 additions and 39 deletions
--- a/CVE-2023/CVE-2023-297xx/CVE-2023-29770.json
+++ b/CVE-2023/CVE-2023-297xx/CVE-2023-29770.json
@ -0,0 +1,24 @@
+{
+  "id": "CVE-2023-29770",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-11-28T00:15:07.033",
+  "lastModified": "2023-11-28T00:15:07.033",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "In Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an authenticated attacker to upload any file without extension filtering."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/sapplica/sentrifugo",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/sapplica/sentrifugo/issues/384",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-423xx/CVE-2023-42364.json
+++ b/CVE-2023/CVE-2023-423xx/CVE-2023-42364.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-42364",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-11-27T23:15:07.313",
+  "lastModified": "2023-11-27T23:15:07.313",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://bugs.busybox.net/show_bug.cgi?id=15868",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-423xx/CVE-2023-42365.json
+++ b/CVE-2023/CVE-2023-423xx/CVE-2023-42365.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-42365",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-11-27T23:15:07.373",
+  "lastModified": "2023-11-27T23:15:07.373",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://bugs.busybox.net/show_bug.cgi?id=15871",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-423xx/CVE-2023-42366.json
+++ b/CVE-2023/CVE-2023-423xx/CVE-2023-42366.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-42366",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-11-27T23:15:07.420",
+  "lastModified": "2023-11-27T23:15:07.420",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://bugs.busybox.net/show_bug.cgi?id=15874",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-463xx/CVE-2023-46349.json
+++ b/CVE-2023/CVE-2023-463xx/CVE-2023-46349.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-46349",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-11-27T23:15:07.470",
+  "lastModified": "2023-11-27T23:15:07.470",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "In the module \"Product Catalog (CSV, Excel) Export/Update\" (updateproducts) < 3.8.5 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method `productsUpdateModel::getExportIds()` has sensitive SQL calls that can be executed with a trivial http call and exploited to forge a SQL injection."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://security.friendsofpresta.org/modules/2023/11/23/updateproducts.html",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-463xx/CVE-2023-46355.json
+++ b/CVE-2023/CVE-2023-463xx/CVE-2023-46355.json
@ -0,0 +1,20 @@
+{
+  "id": "CVE-2023-46355",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-11-27T23:15:07.520",
+  "lastModified": "2023-11-27T23:15:07.520",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "In the module \"CSV Feeds PRO\" (csvfeeds) < 2.6.1 from Bl Modules for PrestaShop, a guest can download personal information without restriction. Due to too permissive access control which does not force administrator to use password on feeds, a guest can access exports from the module which can lead to leaks of personal information from ps_customer / ps_order table such as name / surname / email / phone number / postal address."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://security.friendsofpresta.org/modules/2023/11/23/csvfeeds.html",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-464xx/CVE-2023-46480.json
+++ b/CVE-2023/CVE-2023-464xx/CVE-2023-46480.json
@ -0,0 +1,24 @@
+{
+  "id": "CVE-2023-46480",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-11-27T23:15:07.567",
+  "lastModified": "2023-11-27T23:15:07.567",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/owncast/owncast",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/shahzaibak96/CVE-2023-46480",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-474xx/CVE-2023-47437.json
+++ b/CVE-2023/CVE-2023-474xx/CVE-2023-47437.json
@ -0,0 +1,24 @@
+{
+  "id": "CVE-2023-47437",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-11-28T00:15:07.093",
+  "lastModified": "2023-11-28T00:15:07.093",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "A vulnerability has been identified in Pachno 1.0.6 allowing an authenticated attacker to execute a cross-site scripting (XSS) attack. The vulnerability exists due to inadequate input validation in the Project Description and comments, which enables an attacker to inject malicious java script."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/herombey/CVE-2023-47437",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/pachno/pachno",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-481xx/CVE-2023-48188.json
+++ b/CVE-2023/CVE-2023-481xx/CVE-2023-48188.json
@ -0,0 +1,43 @@
+{
+  "id": "CVE-2023-48188",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-11-27T23:15:07.613",
+  "lastModified": "2023-11-27T23:15:07.613",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "SQL injection vulnerability in PrestaShop opartdevis v.4.5.18 thru v.4.6.12 allows a remote attacker to execute arbitrary code via a crafted script to the getModuleTranslation function."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "cve@mitre.org",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "NONE",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "HIGH",
+          "integrityImpact": "HIGH",
+          "availabilityImpact": "HIGH",
+          "baseScore": 9.8,
+          "baseSeverity": "CRITICAL"
+        },
+        "exploitabilityScore": 3.9,
+        "impactScore": 5.9
+      }
+    ]
+  },
+  "references": [
+    {
+      "url": "https://security.friendsofpresta.org/modules/2023/11/23/opartdevis.html",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-491xx/CVE-2023-49145.json
+++ b/CVE-2023/CVE-2023-491xx/CVE-2023-49145.json
@ -0,0 +1,59 @@
+{
+  "id": "CVE-2023-49145",
+  "sourceIdentifier": "security@apache.org",
+  "published": "2023-11-27T23:15:07.780",
+  "lastModified": "2023-11-27T23:15:07.780",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-based cross-site scripting. If an authenticated user, who is authorized to configure a JoltTransformJSON Processor, visits a crafted URL, then arbitrary\nJavaScript code can be executed within the session context of the authenticated user. Upgrading to Apache NiFi 1.24.0 or 2.0.0-M1 is the recommended mitigation."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "security@apache.org",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L",
+          "attackVector": "NETWORK",
+          "attackComplexity": "HIGH",
+          "privilegesRequired": "LOW",
+          "userInteraction": "REQUIRED",
+          "scope": "CHANGED",
+          "confidentialityImpact": "HIGH",
+          "integrityImpact": "HIGH",
+          "availabilityImpact": "LOW",
+          "baseScore": 7.9,
+          "baseSeverity": "HIGH"
+        },
+        "exploitabilityScore": 1.3,
+        "impactScore": 6.0
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "security@apache.org",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-79"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://lists.apache.org/thread/j8rd0qsvgoj0khqck5f49jfbp0fm8r1o",
+      "source": "security@apache.org"
+    },
+    {
+      "url": "https://nifi.apache.org/security.html#CVE-2023-49145",
+      "source": "security@apache.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-62xx/CVE-2023-6265.json
+++ b/CVE-2023/CVE-2023-62xx/CVE-2023-6265.json
@ -2,7 +2,7 @@
  "id": "CVE-2023-6265",
  "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725",
  "published": "2023-11-22T20:15:09.600",
-  "lastModified": "2023-11-24T15:24:57.673",
+  "lastModified": "2023-11-27T23:15:07.973",
  "vulnStatus": "Awaiting Analysis",
  "descriptions": [
    {
@ -55,6 +55,10 @@
      "url": "https://github.com/xxy1126/Vuln/blob/main/Draytek/4.md",
      "source": "9119a7d8-5eab-497f-8521-727c672e3725"
    },
+    {
+      "url": "https://www.draytek.com/about/newsroom/2021/2021/end-of-life-notification-vigor2960",
+      "source": "9119a7d8-5eab-497f-8521-727c672e3725"
+    },
    {
      "url": "https://www.draytek.com/products/vigor2960/",
      "source": "9119a7d8-5eab-497f-8521-727c672e3725"
--- a/README.md
+++ b/README.md
@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
 ### Last Repository Update

 ```plain
-2023-11-27T23:00:18.303992+00:00
+2023-11-28T00:55:17.995431+00:00
 ```

 ### Most recent CVE Modification Timestamp synchronized with NVD

 ```plain
-2023-11-27T22:15:08.440000+00:00
+2023-11-28T00:15:07.183000+00:00
 ```

 ### Last Data Feed Release
@ -29,52 +29,30 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
 ### Total Number of included CVEs

 ```plain
-231577
+231589
 ```

 ### CVEs added in the last Commit

-Recently added CVEs: `8`
+Recently added CVEs: `10`

-* [CVE-2022-41951](CVE-2022/CVE-2022-419xx/CVE-2022-41951.json) (`2023-11-27T21:15:07.553`)
-* [CVE-2023-48034](CVE-2023/CVE-2023-480xx/CVE-2023-48034.json) (`2023-11-27T21:15:07.777`)
-* [CVE-2023-49030](CVE-2023/CVE-2023-490xx/CVE-2023-49030.json) (`2023-11-27T21:15:07.820`)
-* [CVE-2023-49044](CVE-2023/CVE-2023-490xx/CVE-2023-49044.json) (`2023-11-27T21:15:07.870`)
-* [CVE-2023-32062](CVE-2023/CVE-2023-320xx/CVE-2023-32062.json) (`2023-11-27T22:15:07.660`)
-* [CVE-2023-42363](CVE-2023/CVE-2023-423xx/CVE-2023-42363.json) (`2023-11-27T22:15:07.940`)
-* [CVE-2023-5773](CVE-2023/CVE-2023-57xx/CVE-2023-5773.json) (`2023-11-27T22:15:08.080`)
-* [CVE-2023-5885](CVE-2023/CVE-2023-58xx/CVE-2023-5885.json) (`2023-11-27T22:15:08.250`)
+* [CVE-2023-42364](CVE-2023/CVE-2023-423xx/CVE-2023-42364.json) (`2023-11-27T23:15:07.313`)
+* [CVE-2023-42365](CVE-2023/CVE-2023-423xx/CVE-2023-42365.json) (`2023-11-27T23:15:07.373`)
+* [CVE-2023-42366](CVE-2023/CVE-2023-423xx/CVE-2023-42366.json) (`2023-11-27T23:15:07.420`)
+* [CVE-2023-46349](CVE-2023/CVE-2023-463xx/CVE-2023-46349.json) (`2023-11-27T23:15:07.470`)
+* [CVE-2023-46355](CVE-2023/CVE-2023-463xx/CVE-2023-46355.json) (`2023-11-27T23:15:07.520`)
+* [CVE-2023-46480](CVE-2023/CVE-2023-464xx/CVE-2023-46480.json) (`2023-11-27T23:15:07.567`)
+* [CVE-2023-48188](CVE-2023/CVE-2023-481xx/CVE-2023-48188.json) (`2023-11-27T23:15:07.613`)
+* [CVE-2023-49145](CVE-2023/CVE-2023-491xx/CVE-2023-49145.json) (`2023-11-27T23:15:07.780`)
+* [CVE-2023-29770](CVE-2023/CVE-2023-297xx/CVE-2023-29770.json) (`2023-11-28T00:15:07.033`)
+* [CVE-2023-47437](CVE-2023/CVE-2023-474xx/CVE-2023-47437.json) (`2023-11-28T00:15:07.093`)


 ### CVEs modified in the last Commit

-Recently modified CVEs: `32`
+Recently modified CVEs: `1`

-* [CVE-2023-47758](CVE-2023/CVE-2023-477xx/CVE-2023-47758.json) (`2023-11-27T21:37:09.707`)
-* [CVE-2023-39925](CVE-2023/CVE-2023-399xx/CVE-2023-39925.json) (`2023-11-27T21:37:20.403`)
-* [CVE-2023-47775](CVE-2023/CVE-2023-477xx/CVE-2023-47775.json) (`2023-11-27T21:37:28.437`)
-* [CVE-2023-47785](CVE-2023/CVE-2023-477xx/CVE-2023-47785.json) (`2023-11-27T21:37:43.020`)
-* [CVE-2023-47791](CVE-2023/CVE-2023-477xx/CVE-2023-47791.json) (`2023-11-27T21:38:49.060`)
-* [CVE-2023-5742](CVE-2023/CVE-2023-57xx/CVE-2023-5742.json) (`2023-11-27T21:40:48.237`)
-* [CVE-2023-28749](CVE-2023/CVE-2023-287xx/CVE-2023-28749.json) (`2023-11-27T22:08:00.970`)
-* [CVE-2023-43081](CVE-2023/CVE-2023-430xx/CVE-2023-43081.json) (`2023-11-27T22:08:21.640`)
-* [CVE-2023-26532](CVE-2023/CVE-2023-265xx/CVE-2023-26532.json) (`2023-11-27T22:08:32.057`)
-* [CVE-2023-27442](CVE-2023/CVE-2023-274xx/CVE-2023-27442.json) (`2023-11-27T22:08:45.050`)
-* [CVE-2023-27444](CVE-2023/CVE-2023-274xx/CVE-2023-27444.json) (`2023-11-27T22:08:57.333`)
-* [CVE-2023-27446](CVE-2023/CVE-2023-274xx/CVE-2023-27446.json) (`2023-11-27T22:09:08.697`)
-* [CVE-2023-27451](CVE-2023/CVE-2023-274xx/CVE-2023-27451.json) (`2023-11-27T22:09:24.270`)
-* [CVE-2023-4686](CVE-2023/CVE-2023-46xx/CVE-2023-4686.json) (`2023-11-27T22:09:43.227`)
-* [CVE-2023-4726](CVE-2023/CVE-2023-47xx/CVE-2023-4726.json) (`2023-11-27T22:09:55.103`)
-* [CVE-2023-5048](CVE-2023/CVE-2023-50xx/CVE-2023-5048.json) (`2023-11-27T22:10:05.503`)
-* [CVE-2023-5096](CVE-2023/CVE-2023-50xx/CVE-2023-5096.json) (`2023-11-27T22:10:14.173`)
-* [CVE-2023-5128](CVE-2023/CVE-2023-51xx/CVE-2023-5128.json) (`2023-11-27T22:10:28.460`)
-* [CVE-2023-5163](CVE-2023/CVE-2023-51xx/CVE-2023-5163.json) (`2023-11-27T22:10:37.123`)
-* [CVE-2023-5314](CVE-2023/CVE-2023-53xx/CVE-2023-5314.json) (`2023-11-27T22:11:02.433`)
-* [CVE-2023-5338](CVE-2023/CVE-2023-53xx/CVE-2023-5338.json) (`2023-11-27T22:11:12.553`)
-* [CVE-2023-41109](CVE-2023/CVE-2023-411xx/CVE-2023-41109.json) (`2023-11-27T22:15:07.867`)
-* [CVE-2023-47250](CVE-2023/CVE-2023-472xx/CVE-2023-47250.json) (`2023-11-27T22:15:07.997`)
-* [CVE-2023-47251](CVE-2023/CVE-2023-472xx/CVE-2023-47251.json) (`2023-11-27T22:15:08.037`)
-* [CVE-2023-6253](CVE-2023/CVE-2023-62xx/CVE-2023-6253.json) (`2023-11-27T22:15:08.440`)
+* [CVE-2023-6265](CVE-2023/CVE-2023-62xx/CVE-2023-6265.json) (`2023-11-27T23:15:07.973`)


 ## Download and Usage