Auto-Update: 2023-09-18T22:00:24.660915+00:00

2025-07-09 16:05:11 +00:00 · 2023-09-18 22:00:28 +00:00 · 2023-09-18 22:00:28 +00:00 · 1f555b245b
commit 1f555b245b
parent cf10622891
20 changed files with 699 additions and 32 deletions
--- a/CVE-2023/CVE-2023-338xx/CVE-2023-33831.json
+++ b/CVE-2023/CVE-2023-338xx/CVE-2023-33831.json
@ -0,0 +1,24 @@
+{
+  "id": "CVE-2023-33831",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-09-18T20:15:09.377",
+  "lastModified": "2023-09-18T20:15:09.377",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "https://github.com/rodolfomarianocy/Unauthenticated-RCE-FUXA-CVE-2023-33831",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://youtu.be/Xxa6yRB2Fpw",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-362xx/CVE-2023-36255.json
+++ b/CVE-2023/CVE-2023-362xx/CVE-2023-36255.json
@ -2,12 +2,12 @@
  "id": "CVE-2023-36255",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2023-08-03T02:15:09.577",
-  "lastModified": "2023-08-05T03:50:06.877",
-  "vulnStatus": "Analyzed",
+  "lastModified": "2023-09-18T20:15:09.513",
+  "vulnStatus": "Modified",
  "descriptions": [
    {
      "lang": "en",
-      "value": "An issue in Eramba Limited Eramba Enterprise v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL."
+      "value": "An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL."
    }
  ],
  "metrics": {
@ -71,6 +71,10 @@
        "Broken Link"
      ]
    },
+    {
+      "url": "https://trovent.github.io/security-advisories/TRSA-2303-01/TRSA-2303-01.txt",
+      "source": "cve@mitre.org"
+    },
    {
      "url": "https://trovent.io/security-advisory-2303-01/",
      "source": "cve@mitre.org",
@ -78,6 +82,10 @@
        "Exploit",
        "Third Party Advisory"
      ]
+    },
+    {
+      "url": "https://www.eramba.org",
+      "source": "cve@mitre.org"
    }
  ]
 }
--- a/CVE-2023/CVE-2023-382xx/CVE-2023-38255.json
+++ b/CVE-2023/CVE-2023-382xx/CVE-2023-38255.json
@ -0,0 +1,55 @@
+{
+  "id": "CVE-2023-38255",
+  "sourceIdentifier": "ics-cert@hq.dhs.gov",
+  "published": "2023-09-18T21:15:53.000",
+  "lastModified": "2023-09-18T21:15:53.000",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "** UNSUPPPORTED WHEN ASSIGNED ** \n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nA potential attacker with or without (cookie theft) access to the device would be able to include malicious code (XSS) when uploading new device configuration that could affect the intended function of the device.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n"
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "ics-cert@hq.dhs.gov",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "NONE",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "LOW",
+          "integrityImpact": "LOW",
+          "availabilityImpact": "NONE",
+          "baseScore": 6.5,
+          "baseSeverity": "MEDIUM"
+        },
+        "exploitabilityScore": 3.9,
+        "impactScore": 2.5
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "ics-cert@hq.dhs.gov",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-79"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03",
+      "source": "ics-cert@hq.dhs.gov"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-385xx/CVE-2023-38582.json
+++ b/CVE-2023/CVE-2023-385xx/CVE-2023-38582.json
@ -0,0 +1,55 @@
+{
+  "id": "CVE-2023-38582",
+  "sourceIdentifier": "ics-cert@hq.dhs.gov",
+  "published": "2023-09-18T21:15:54.693",
+  "lastModified": "2023-09-18T21:15:54.693",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "** UNSUPPPORTED WHEN ASSIGNED ** \n\n\n\n\n\n\n\n\nPersistent cross-site scripting (XSS) in the web application of MOD3GP-SY-120K allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the field MAIL_RCV. When a legitimate user attempts to access to the vulnerable page of the web application, the XSS payload will be executed.\n\n\n\n\n\n\n\n\n\n"
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "ics-cert@hq.dhs.gov",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "REQUIRED",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "LOW",
+          "integrityImpact": "LOW",
+          "availabilityImpact": "LOW",
+          "baseScore": 6.3,
+          "baseSeverity": "MEDIUM"
+        },
+        "exploitabilityScore": 2.8,
+        "impactScore": 3.4
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "ics-cert@hq.dhs.gov",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-79"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03",
+      "source": "ics-cert@hq.dhs.gov"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-389xx/CVE-2023-38912.json
+++ b/CVE-2023/CVE-2023-389xx/CVE-2023-38912.json
@ -2,16 +2,24 @@
  "id": "CVE-2023-38912",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2023-09-14T21:15:10.560",
-  "lastModified": "2023-09-15T00:31:20.767",
-  "vulnStatus": "Awaiting Analysis",
+  "lastModified": "2023-09-18T20:15:09.637",
+  "vulnStatus": "Undergoing Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter."
+    },
+    {
+      "lang": "es",
+      "value": "Vulnerabilidad de inyecci\u00f3n SQL en Super Store Finder PHP Script v.3.6 permite a un atacante remoto ejecutar c\u00f3digo arbitrario a trav\u00e9s de un payload manipulado en el par\u00e1metro de nombre de usuario."
    }
  ],
  "metrics": {},
  "references": [
+    {
+      "url": "https://codecanyon.net/item/super-store-finder/3630922",
+      "source": "cve@mitre.org"
+    },
    {
      "url": "https://packetstormsecurity.com/files/173302/Super-Store-Finder-PHP-Script-3.6-SQL-Injection.html",
      "source": "cve@mitre.org"
--- a/CVE-2023/CVE-2023-390xx/CVE-2023-39039.json
+++ b/CVE-2023/CVE-2023-390xx/CVE-2023-39039.json
@ -0,0 +1,24 @@
+{
+  "id": "CVE-2023-39039",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-09-18T21:15:54.923",
+  "lastModified": "2023-09-18T21:15:54.923",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "http://camp.com",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39039.md",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-390xx/CVE-2023-39040.json
+++ b/CVE-2023/CVE-2023-390xx/CVE-2023-39040.json
@ -0,0 +1,24 @@
+{
+  "id": "CVE-2023-39040",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-09-18T21:15:54.987",
+  "lastModified": "2023-09-18T21:15:54.987",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "http://cheese.com",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39040.md",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-390xx/CVE-2023-39043.json
+++ b/CVE-2023/CVE-2023-390xx/CVE-2023-39043.json
@ -0,0 +1,28 @@
+{
+  "id": "CVE-2023-39043",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-09-18T21:15:55.047",
+  "lastModified": "2023-09-18T21:15:55.047",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "http://tokushimaawayokocho.com",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "http://ykc.com",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39043.md",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-390xx/CVE-2023-39058.json
+++ b/CVE-2023/CVE-2023-390xx/CVE-2023-39058.json
@ -0,0 +1,24 @@
+{
+  "id": "CVE-2023-39058",
+  "sourceIdentifier": "cve@mitre.org",
+  "published": "2023-09-18T21:15:55.103",
+  "lastModified": "2023-09-18T21:15:55.103",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages."
+    }
+  ],
+  "metrics": {},
+  "references": [
+    {
+      "url": "http://thebmembers.com",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39058.md",
+      "source": "cve@mitre.org"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-393xx/CVE-2023-39363.json
+++ b/CVE-2023/CVE-2023-393xx/CVE-2023-39363.json
@ -2,12 +2,12 @@
  "id": "CVE-2023-39363",
  "sourceIdentifier": "security-advisories@github.com",
  "published": "2023-08-07T19:15:11.873",
-  "lastModified": "2023-08-11T17:55:07.917",
-  "vulnStatus": "Analyzed",
+  "lastModified": "2023-09-18T21:15:55.163",
+  "vulnStatus": "Modified",
  "descriptions": [
    {
      "lang": "en",
-      "value": "Vyer is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of conditions is required to result in misbehavior of affected contracts, specifically: a `.vy` contract compiled with `vyper` versions `0.2.15`, `0.2.16`, or `0.3.0`; a primary function that utilizes the `@nonreentrant` decorator with a specific `key` and does not strictly follow the check-effects-interaction pattern (i.e. contains an external call to an untrusted party before storage updates); and a secondary function that utilizes the same `key` and would be affected by the improper state caused by the primary function. Version 0.3.1 contains a fix for this issue."
+      "value": "Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In versions 0.2.15, 0.2.16 and 0.3.0, named re-entrancy locks are allocated incorrectly. Each function using a named re-entrancy lock gets a unique lock regardless of the key, allowing cross-function re-entrancy in contracts compiled with the susceptible versions. A specific set of conditions is required to result in misbehavior of affected contracts, specifically: a `.vy` contract compiled with `vyper` versions `0.2.15`, `0.2.16`, or `0.3.0`; a primary function that utilizes the `@nonreentrant` decorator with a specific `key` and does not strictly follow the check-effects-interaction pattern (i.e. contains an external call to an untrusted party before storage updates); and a secondary function that utilizes the same `key` and would be affected by the improper state caused by the primary function. Version 0.3.1 contains a fix for this issue."
    }
  ],
  "metrics": {
--- a/CVE-2023/CVE-2023-394xx/CVE-2023-39446.json
+++ b/CVE-2023/CVE-2023-394xx/CVE-2023-39446.json
@ -0,0 +1,55 @@
+{
+  "id": "CVE-2023-39446",
+  "sourceIdentifier": "ics-cert@hq.dhs.gov",
+  "published": "2023-09-18T21:15:56.117",
+  "lastModified": "2023-09-18T21:15:56.117",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "** UNSUPPPORTED WHEN ASSIGNED ** \n\n\n\n\n\n\nThanks to the weaknesses that the web application has at the user management level, an attacker could obtain the information from the headers that is necessary to create specially designed URLs and originate malicious actions when a legitimate user is logged into the web application.\n\n\n\n\n\n\n\n"
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "ics-cert@hq.dhs.gov",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "LOW",
+          "userInteraction": "REQUIRED",
+          "scope": "CHANGED",
+          "confidentialityImpact": "LOW",
+          "integrityImpact": "HIGH",
+          "availabilityImpact": "HIGH",
+          "baseScore": 8.9,
+          "baseSeverity": "HIGH"
+        },
+        "exploitabilityScore": 2.3,
+        "impactScore": 6.0
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "ics-cert@hq.dhs.gov",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-352"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03",
+      "source": "ics-cert@hq.dhs.gov"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-394xx/CVE-2023-39452.json
+++ b/CVE-2023/CVE-2023-394xx/CVE-2023-39452.json
@ -0,0 +1,55 @@
+{
+  "id": "CVE-2023-39452",
+  "sourceIdentifier": "ics-cert@hq.dhs.gov",
+  "published": "2023-09-18T21:16:04.367",
+  "lastModified": "2023-09-18T21:16:04.367",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "** UNSUPPPORTED WHEN ASSIGNED ** \n\n\n\n\n\n\n\n\n\n\n\n\n\n\nThe web application that owns the device clearly stores the credentials within the user management section. Obtaining this information can be done remotely due to the incorrect management of the sessions in the web application.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n"
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "ics-cert@hq.dhs.gov",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "NONE",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "HIGH",
+          "integrityImpact": "NONE",
+          "availabilityImpact": "NONE",
+          "baseScore": 7.5,
+          "baseSeverity": "HIGH"
+        },
+        "exploitabilityScore": 3.9,
+        "impactScore": 3.6
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "ics-cert@hq.dhs.gov",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-256"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03",
+      "source": "ics-cert@hq.dhs.gov"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-395xx/CVE-2023-39551.json
+++ b/CVE-2023/CVE-2023-395xx/CVE-2023-39551.json
@ -2,8 +2,8 @@
  "id": "CVE-2023-39551",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2023-08-04T19:15:10.390",
-  "lastModified": "2023-08-08T17:22:39.600",
-  "vulnStatus": "Analyzed",
+  "lastModified": "2023-09-18T20:15:09.720",
+  "vulnStatus": "Modified",
  "descriptions": [
    {
      "lang": "en",
@ -71,6 +71,18 @@
        "Exploit",
        "Third Party Advisory"
      ]
+    },
+    {
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39551",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://www.chtsecurity.com/news/0dbe8e1d-0a6c-4604-9cf1-778ddc86a8c1",
+      "source": "cve@mitre.org"
+    },
+    {
+      "url": "https://www.chtsecurity.com/news/285b9375-ba65-4f61-a02a-a575337dc86c",
+      "source": "cve@mitre.org"
    }
  ]
 }
--- a/CVE-2023/CVE-2023-397xx/CVE-2023-39742.json
+++ b/CVE-2023/CVE-2023-397xx/CVE-2023-39742.json
@ -2,8 +2,8 @@
  "id": "CVE-2023-39742",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2023-08-25T14:15:09.763",
-  "lastModified": "2023-08-28T13:59:41.827",
-  "vulnStatus": "Analyzed",
+  "lastModified": "2023-09-18T20:15:09.817",
+  "vulnStatus": "Modified",
  "descriptions": [
    {
      "lang": "en",
@ -71,6 +71,10 @@
        "Third Party Advisory"
      ]
    },
+    {
+      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O4RLSFGPBPR3FMIUJCWPGVIYIU35YGQX/",
+      "source": "cve@mitre.org"
+    },
    {
      "url": "https://sourceforge.net/p/giflib/bugs/166/",
      "source": "cve@mitre.org",
--- a/CVE-2023/CVE-2023-402xx/CVE-2023-40221.json
+++ b/CVE-2023/CVE-2023-402xx/CVE-2023-40221.json
@ -0,0 +1,55 @@
+{
+  "id": "CVE-2023-40221",
+  "sourceIdentifier": "ics-cert@hq.dhs.gov",
+  "published": "2023-09-18T20:15:09.907",
+  "lastModified": "2023-09-18T20:15:09.907",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "** UNSUPPPORTED WHEN ASSIGNED ** \n\n\n\n\n\n\n\n\n\n\n\n\nThe absence of filters when loading some sections in the web application of the vulnerable device allows potential attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section (MAIL SERVER) where the information is displayed. Injection can be done on parameter MAIL_RCV. When a legitimate user attempts to review NOTIFICATION/MAIL SERVER, the injected code will be executed.\n\n\n\n\n\n\n\n\n\n\n\n\n\n"
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "ics-cert@hq.dhs.gov",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "REQUIRED",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "HIGH",
+          "integrityImpact": "HIGH",
+          "availabilityImpact": "HIGH",
+          "baseScore": 8.8,
+          "baseSeverity": "HIGH"
+        },
+        "exploitabilityScore": 2.8,
+        "impactScore": 5.9
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "ics-cert@hq.dhs.gov",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-94"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03",
+      "source": "ics-cert@hq.dhs.gov"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-410xx/CVE-2023-41084.json
+++ b/CVE-2023/CVE-2023-410xx/CVE-2023-41084.json
@ -0,0 +1,55 @@
+{
+  "id": "CVE-2023-41084",
+  "sourceIdentifier": "ics-cert@hq.dhs.gov",
+  "published": "2023-09-18T20:15:10.017",
+  "lastModified": "2023-09-18T20:15:10.017",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "** UNSUPPPORTED WHEN ASSIGNED ** \n\n\n\n\n\n\n\n\n\n\nSession management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device.\n\n\n\n\n\n\n\n\n\n\n\n"
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "ics-cert@hq.dhs.gov",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "NONE",
+          "scope": "CHANGED",
+          "confidentialityImpact": "HIGH",
+          "integrityImpact": "HIGH",
+          "availabilityImpact": "HIGH",
+          "baseScore": 10.0,
+          "baseSeverity": "CRITICAL"
+        },
+        "exploitabilityScore": 3.9,
+        "impactScore": 6.0
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "ics-cert@hq.dhs.gov",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-565"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03",
+      "source": "ics-cert@hq.dhs.gov"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-419xx/CVE-2023-41965.json
+++ b/CVE-2023/CVE-2023-419xx/CVE-2023-41965.json
@ -0,0 +1,55 @@
+{
+  "id": "CVE-2023-41965",
+  "sourceIdentifier": "ics-cert@hq.dhs.gov",
+  "published": "2023-09-18T20:15:10.120",
+  "lastModified": "2023-09-18T20:15:10.120",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "** UNSUPPPORTED WHEN ASSIGNED ** \n\n\n\n\nSending some requests in the web application of the vulnerable device allows information to be obtained due to the lack of security in the authentication process.\n\n\n\n\n\n"
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "ics-cert@hq.dhs.gov",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "NONE",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "HIGH",
+          "integrityImpact": "NONE",
+          "availabilityImpact": "NONE",
+          "baseScore": 7.5,
+          "baseSeverity": "HIGH"
+        },
+        "exploitabilityScore": 3.9,
+        "impactScore": 3.6
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "ics-cert@hq.dhs.gov",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-922"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-250-03",
+      "source": "ics-cert@hq.dhs.gov"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-424xx/CVE-2023-42441.json
+++ b/CVE-2023/CVE-2023-424xx/CVE-2023-42441.json
@ -0,0 +1,63 @@
+{
+  "id": "CVE-2023-42441",
+  "sourceIdentifier": "security-advisories@github.com",
+  "published": "2023-09-18T21:16:09.750",
+  "lastModified": "2023-09-18T21:16:09.750",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@nonreentrant(\"\")` or `@nonreentrant('')` do not produce reentrancy checks at runtime. This issue is fixed in version 0.3.10. As a workaround, ensure the lock name is a non-empty string."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "security-advisories@github.com",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "NONE",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "NONE",
+          "integrityImpact": "LOW",
+          "availabilityImpact": "NONE",
+          "baseScore": 5.3,
+          "baseSeverity": "MEDIUM"
+        },
+        "exploitabilityScore": 3.9,
+        "impactScore": 1.4
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "security-advisories@github.com",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-833"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://github.com/vyperlang/vyper/commit/0b740280c1e3c5528a20d47b29831948ddcc6d83",
+      "source": "security-advisories@github.com"
+    },
+    {
+      "url": "https://github.com/vyperlang/vyper/pull/3605",
+      "source": "security-advisories@github.com"
+    },
+    {
+      "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-3hg2-r75x-g69m",
+      "source": "security-advisories@github.com"
+    }
+  ]
+}
--- a/CVE-2023/CVE-2023-424xx/CVE-2023-42443.json
+++ b/CVE-2023/CVE-2023-424xx/CVE-2023-42443.json
@ -0,0 +1,59 @@
+{
+  "id": "CVE-2023-42443",
+  "sourceIdentifier": "security-advisories@github.com",
+  "published": "2023-09-18T21:16:13.403",
+  "lastModified": "2023-09-18T21:16:13.403",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). In version 0.3.9 and prior, under certain conditions, the memory used by the builtins `raw_call`, `create_from_blueprint` and `create_copy_of` can be corrupted. For `raw_call`, the argument buffer of the call can be corrupted, leading to incorrect `calldata` in the sub-context. For `create_from_blueprint` and `create_copy_of`, the buffer for the to-be-deployed bytecode can be corrupted, leading to deploying incorrect bytecode.\n\nEach builtin has conditions that must be fulfilled for the corruption to happen. For `raw_call`, the `data` argument of the builtin must be `msg.data` and the `value` or `gas` passed to the builtin must be some complex expression that results in writing to the memory. For `create_copy_of`, the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory. For `create_from_blueprint`, either no constructor parameters should be passed to the builtin or `raw_args` should be set to True, and the `value` or `salt` passed to the builtin must be some complex expression that results in writing to the memory.\n\nAs of time of publication, no patched version exists. The issue is still being investigated, and there might be other cases where the corruption might happen. When the builtin is being called from an `internal` function `F`, the issue is not present provided that the function calling `F` wrote to memory before calling `F`. As a workaround, the complex expressions that are being passed as kwargs to the builtin should be cached in memory prior to the call to the builtin."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "security-advisories@github.com",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
+          "attackVector": "NETWORK",
+          "attackComplexity": "HIGH",
+          "privilegesRequired": "NONE",
+          "userInteraction": "NONE",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "HIGH",
+          "integrityImpact": "HIGH",
+          "availabilityImpact": "HIGH",
+          "baseScore": 8.1,
+          "baseSeverity": "HIGH"
+        },
+        "exploitabilityScore": 2.2,
+        "impactScore": 5.9
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "security-advisories@github.com",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-787"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://github.com/vyperlang/vyper/issues/3609",
+      "source": "security-advisories@github.com"
+    },
+    {
+      "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-c647-pxm2-c52w",
+      "source": "security-advisories@github.com"
+    }
+  ]
+}
--- a/README.md
+++ b/README.md
@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
 ### Last Repository Update

 ```plain
-2023-09-18T20:00:24.900037+00:00
+2023-09-18T22:00:24.660915+00:00
 ```

 ### Most recent CVE Modification Timestamp synchronized with NVD

 ```plain
-2023-09-18T19:15:43.060000+00:00
+2023-09-18T21:16:13.403000+00:00
 ```

 ### Last Data Feed Release
@ -29,34 +29,38 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
 ### Total Number of included CVEs

 ```plain
-225767
+225781
 ```

 ### CVEs added in the last Commit

-Recently added CVEs: `1`
+Recently added CVEs: `14`

-* [CVE-2023-41030](CVE-2023/CVE-2023-410xx/CVE-2023-41030.json) (`2023-09-18T19:15:43.060`)
+* [CVE-2023-33831](CVE-2023/CVE-2023-338xx/CVE-2023-33831.json) (`2023-09-18T20:15:09.377`)
+* [CVE-2023-40221](CVE-2023/CVE-2023-402xx/CVE-2023-40221.json) (`2023-09-18T20:15:09.907`)
+* [CVE-2023-41084](CVE-2023/CVE-2023-410xx/CVE-2023-41084.json) (`2023-09-18T20:15:10.017`)
+* [CVE-2023-41965](CVE-2023/CVE-2023-419xx/CVE-2023-41965.json) (`2023-09-18T20:15:10.120`)
+* [CVE-2023-38255](CVE-2023/CVE-2023-382xx/CVE-2023-38255.json) (`2023-09-18T21:15:53.000`)
+* [CVE-2023-38582](CVE-2023/CVE-2023-385xx/CVE-2023-38582.json) (`2023-09-18T21:15:54.693`)
+* [CVE-2023-39039](CVE-2023/CVE-2023-390xx/CVE-2023-39039.json) (`2023-09-18T21:15:54.923`)
+* [CVE-2023-39040](CVE-2023/CVE-2023-390xx/CVE-2023-39040.json) (`2023-09-18T21:15:54.987`)
+* [CVE-2023-39043](CVE-2023/CVE-2023-390xx/CVE-2023-39043.json) (`2023-09-18T21:15:55.047`)
+* [CVE-2023-39058](CVE-2023/CVE-2023-390xx/CVE-2023-39058.json) (`2023-09-18T21:15:55.103`)
+* [CVE-2023-39446](CVE-2023/CVE-2023-394xx/CVE-2023-39446.json) (`2023-09-18T21:15:56.117`)
+* [CVE-2023-39452](CVE-2023/CVE-2023-394xx/CVE-2023-39452.json) (`2023-09-18T21:16:04.367`)
+* [CVE-2023-42441](CVE-2023/CVE-2023-424xx/CVE-2023-42441.json) (`2023-09-18T21:16:09.750`)
+* [CVE-2023-42443](CVE-2023/CVE-2023-424xx/CVE-2023-42443.json) (`2023-09-18T21:16:13.403`)


 ### CVEs modified in the last Commit

-Recently modified CVEs: `14`
+Recently modified CVEs: `5`

-* [CVE-2021-45811](CVE-2021/CVE-2021-458xx/CVE-2021-45811.json) (`2023-09-18T18:55:34.450`)
-* [CVE-2023-42371](CVE-2023/CVE-2023-423xx/CVE-2023-42371.json) (`2023-09-18T18:23:59.067`)
-* [CVE-2023-42387](CVE-2023/CVE-2023-423xx/CVE-2023-42387.json) (`2023-09-18T18:23:59.067`)
-* [CVE-2023-41595](CVE-2023/CVE-2023-415xx/CVE-2023-41595.json) (`2023-09-18T18:23:59.067`)
-* [CVE-2023-42320](CVE-2023/CVE-2023-423xx/CVE-2023-42320.json) (`2023-09-18T18:23:59.067`)
-* [CVE-2023-42328](CVE-2023/CVE-2023-423xx/CVE-2023-42328.json) (`2023-09-18T18:23:59.067`)
-* [CVE-2023-4527](CVE-2023/CVE-2023-45xx/CVE-2023-4527.json) (`2023-09-18T18:23:59.067`)
-* [CVE-2023-4806](CVE-2023/CVE-2023-48xx/CVE-2023-4806.json) (`2023-09-18T18:23:59.067`)
-* [CVE-2023-42468](CVE-2023/CVE-2023-424xx/CVE-2023-42468.json) (`2023-09-18T18:36:35.480`)
-* [CVE-2023-4022](CVE-2023/CVE-2023-40xx/CVE-2023-4022.json) (`2023-09-18T18:56:14.823`)
-* [CVE-2023-4060](CVE-2023/CVE-2023-40xx/CVE-2023-4060.json) (`2023-09-18T18:56:39.010`)
-* [CVE-2023-4270](CVE-2023/CVE-2023-42xx/CVE-2023-4270.json) (`2023-09-18T18:57:26.613`)
-* [CVE-2023-4879](CVE-2023/CVE-2023-48xx/CVE-2023-4879.json) (`2023-09-18T18:58:43.767`)
-* [CVE-2023-4318](CVE-2023/CVE-2023-43xx/CVE-2023-4318.json) (`2023-09-18T19:00:04.477`)
+* [CVE-2023-36255](CVE-2023/CVE-2023-362xx/CVE-2023-36255.json) (`2023-09-18T20:15:09.513`)
+* [CVE-2023-38912](CVE-2023/CVE-2023-389xx/CVE-2023-38912.json) (`2023-09-18T20:15:09.637`)
+* [CVE-2023-39551](CVE-2023/CVE-2023-395xx/CVE-2023-39551.json) (`2023-09-18T20:15:09.720`)
+* [CVE-2023-39742](CVE-2023/CVE-2023-397xx/CVE-2023-39742.json) (`2023-09-18T20:15:09.817`)
+* [CVE-2023-39363](CVE-2023/CVE-2023-393xx/CVE-2023-39363.json) (`2023-09-18T21:15:55.163`)


 ## Download and Usage