Auto-Update: 2023-05-29T22:00:24.255114+00:00

This commit is contained in:
cad-safe-bot 2023-05-29 22:00:27 +00:00
parent 71c1bbb9f5
commit 29240ccf0a
15 changed files with 392 additions and 35 deletions

View File

@ -2,8 +2,8 @@
"id": "CVE-2021-3610",
"sourceIdentifier": "secalert@redhat.com",
"published": "2022-02-24T19:15:09.213",
"lastModified": "2022-03-07T13:33:58.293",
"vulnStatus": "Analyzed",
"lastModified": "2023-05-29T21:15:09.307",
"vulnStatus": "Modified",
"descriptions": [
{
"lang": "en",
@ -134,6 +134,10 @@
}
],
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2023/05/29/4",
"source": "secalert@redhat.com"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1973689",
"source": "secalert@redhat.com",

View File

@ -0,0 +1,15 @@
{
"id": "CVE-2022-24580",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-05-29T20:15:09.413",
"lastModified": "2023-05-29T20:15:09.413",
"vulnStatus": "Rejected",
"descriptions": [
{
"lang": "en",
"value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-24580. Reason: This candidate is a duplicate of CVE-2023-24580. A typo caused the wrong ID to be used. Notes: All CVE users should reference CVE-2023-24580 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage."
}
],
"metrics": {},
"references": []
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2022-24627",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-05-29T21:15:09.423",
"lastModified": "2023-05-29T21:15:09.423",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_login.php login form."
}
],
"metrics": {},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Feb/12",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2022-24628",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-05-29T21:15:09.477",
"lastModified": "2023-05-29T21:15:09.477",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection in the id parameter of IPPhoneFirmwareEdit.php."
}
],
"metrics": {},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Feb/12",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2022-24629",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-05-29T21:15:09.523",
"lastModified": "2023-05-29T21:15:09.523",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php. An attacker can upload a .php file to WebAdmin/admin/AudioCodes_files/ajax/."
}
],
"metrics": {},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Feb/12",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2022-24630",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-05-29T21:15:09.573",
"lastModified": "2023-05-29T21:15:09.573",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles.php allows a ?cmd=ssh POST request with an ssh_command field that is executed."
}
],
"metrics": {},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Feb/12",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2022-24631",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-05-29T21:15:09.630",
"lastModified": "2023-05-29T21:15:09.630",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is stored XSS via the ajaxTenants.php desc parameter."
}
],
"metrics": {},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Feb/12",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2022-24632",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-05-29T21:15:09.697",
"lastModified": "2023-05-29T21:15:09.697",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is directory traversal during file download via the BrowseFiles.php view parameter."
}
],
"metrics": {},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Feb/12",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2022-41766",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-05-29T21:15:09.757",
"lastModified": "2023-05-29T21:15:09.757",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. Upon an action=rollback operation, the alreadyrolled message can leak a user name (when the user has been revision deleted/suppressed)."
}
],
"metrics": {},
"references": [
{
"url": "https://phabricator.wikimedia.org/T307278",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,28 @@
{
"id": "CVE-2023-30253",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-05-29T21:15:09.813",
"lastModified": "2023-05-29T21:15:09.813",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/Dolibarr/dolibarr",
"source": "cve@mitre.org"
},
{
"url": "https://www.swascan.com/blog/",
"source": "cve@mitre.org"
},
{
"url": "https://www.swascan.com/security-advisory-dolibarr-17-0-0/",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,47 @@
{
"id": "CVE-2023-30571",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-05-29T20:15:09.513",
"lastModified": "2023-05-29T20:15:09.513",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "cve@mitre.org",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 3.9,
"baseSeverity": "LOW"
},
"exploitabilityScore": 0.8,
"impactScore": 2.7
}
]
},
"references": [
{
"url": "https://github.com/libarchive/libarchive/issues/1876",
"source": "cve@mitre.org"
},
{
"url": "https://groups.google.com/g/libarchive-announce",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,67 @@
{
"id": "CVE-2023-32072",
"sourceIdentifier": "security-advisories@github.com",
"published": "2023-05-29T21:15:09.893",
"lastModified": "2023-05-29T21:15:09.893",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Tuleap is an open source tool for end to end traceability of application and system developments. Tuleap Community Edition prior to version 14.8.99.60 and Tuleap Enterprise edition prior to 14.8-3 and 14.7-7, the logs of the triggered Jenkins job URLs are not properly escaped. A malicious Git administrator can setup a malicious Jenkins hook to make a victim, also a Git administrator, execute uncontrolled code. Tuleap Community Edition 14.8.99.60, Tuleap Enterprise Edition 14.8-3, and Tuleap Enterprise Edition 14.7-7 contain a patch for this issue."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security-advisories@github.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7
}
]
},
"weaknesses": [
{
"source": "security-advisories@github.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://github.com/Enalean/tuleap/commit/6840529def97f564844e810e5a7c5bf837cf58d5",
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-6prc-j58r-fmjq",
"source": "security-advisories@github.com"
},
{
"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=6840529def97f564844e810e5a7c5bf837cf58d5",
"source": "security-advisories@github.com"
},
{
"url": "https://tuleap.net/plugins/tracker/?aid=31929",
"source": "security-advisories@github.com"
}
]
}

View File

@ -0,0 +1,63 @@
{
"id": "CVE-2023-32687",
"sourceIdentifier": "security-advisories@github.com",
"published": "2023-05-29T21:15:10.053",
"lastModified": "2023-05-29T21:15:10.053",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched in version 5.12.1. As a workaround, remove the list chat bots permission from users that should not have the ability to view connection strings. Invalidate any credentials previously stored for safety."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security-advisories@github.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 3.1,
"impactScore": 4.0
}
]
},
"weaknesses": [
{
"source": "security-advisories@github.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-522"
}
]
}
],
"references": [
{
"url": "https://github.com/tgstation/tgstation-server/pull/1487",
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/tgstation/tgstation-server/releases/tag/tgstation-server-v5.12.1",
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/tgstation/tgstation-server/security/advisories/GHSA-rv76-495p-g7cp",
"source": "security-advisories@github.com"
}
]
}

View File

@ -2,12 +2,12 @@
"id": "CVE-2023-33796",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-05-24T20:15:10.827",
"lastModified": "2023-05-27T03:42:05.720",
"vulnStatus": "Analyzed",
"lastModified": "2023-05-29T20:15:09.603",
"vulnStatus": "Modified",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to sensitive data stored in the database."
"value": "** DISPUTED ** A vulnerability in Netbox v3.5.1 allows unauthenticated attackers to execute queries against the GraphQL database, granting them access to sensitive data stored in the database. NOTE: the vendor disputes this because the reporter's only query was for the schema of the API, which is public; queries for database objects would have been denied."
}
],
"metrics": {
@ -71,6 +71,10 @@
"Exploit",
"Issue Tracking"
]
},
{
"url": "https://github.com/netbox-community/netbox/discussions/12729#discussioncomment-6008669",
"source": "cve@mitre.org"
}
]
}

View File

@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2023-05-29T20:00:27.397393+00:00
2023-05-29T22:00:24.255114+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2023-05-29T19:15:09.527000+00:00
2023-05-29T21:15:10.053000+00:00
```
### Last Data Feed Release
@ -29,44 +29,33 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
216295
216307
```
### CVEs added in the last Commit
Recently added CVEs: `76`
Recently added CVEs: `12`
* [CVE-2022-32714](CVE-2022/CVE-2022-327xx/CVE-2022-32714.json) (`2023-05-29T18:15:12.823`)
* [CVE-2022-32715](CVE-2022/CVE-2022-327xx/CVE-2022-32715.json) (`2023-05-29T18:15:12.863`)
* [CVE-2022-32716](CVE-2022/CVE-2022-327xx/CVE-2022-32716.json) (`2023-05-29T18:15:12.907`)
* [CVE-2022-32717](CVE-2022/CVE-2022-327xx/CVE-2022-32717.json) (`2023-05-29T18:15:12.953`)
* [CVE-2022-32718](CVE-2022/CVE-2022-327xx/CVE-2022-32718.json) (`2023-05-29T18:15:12.993`)
* [CVE-2022-32719](CVE-2022/CVE-2022-327xx/CVE-2022-32719.json) (`2023-05-29T18:15:13.033`)
* [CVE-2022-32720](CVE-2022/CVE-2022-327xx/CVE-2022-32720.json) (`2023-05-29T18:15:13.077`)
* [CVE-2022-32721](CVE-2022/CVE-2022-327xx/CVE-2022-32721.json) (`2023-05-29T18:15:13.117`)
* [CVE-2022-32722](CVE-2022/CVE-2022-327xx/CVE-2022-32722.json) (`2023-05-29T18:15:13.157`)
* [CVE-2022-32723](CVE-2022/CVE-2022-327xx/CVE-2022-32723.json) (`2023-05-29T18:15:13.200`)
* [CVE-2022-32724](CVE-2022/CVE-2022-327xx/CVE-2022-32724.json) (`2023-05-29T18:15:13.243`)
* [CVE-2022-32725](CVE-2022/CVE-2022-327xx/CVE-2022-32725.json) (`2023-05-29T18:15:13.287`)
* [CVE-2022-32726](CVE-2022/CVE-2022-327xx/CVE-2022-32726.json) (`2023-05-29T18:15:13.330`)
* [CVE-2022-32727](CVE-2022/CVE-2022-327xx/CVE-2022-32727.json) (`2023-05-29T18:15:13.377`)
* [CVE-2022-32728](CVE-2022/CVE-2022-327xx/CVE-2022-32728.json) (`2023-05-29T18:15:13.417`)
* [CVE-2022-32729](CVE-2022/CVE-2022-327xx/CVE-2022-32729.json) (`2023-05-29T18:15:13.463`)
* [CVE-2022-32730](CVE-2022/CVE-2022-327xx/CVE-2022-32730.json) (`2023-05-29T18:15:13.507`)
* [CVE-2022-32731](CVE-2022/CVE-2022-327xx/CVE-2022-32731.json) (`2023-05-29T18:15:13.547`)
* [CVE-2022-32732](CVE-2022/CVE-2022-327xx/CVE-2022-32732.json) (`2023-05-29T18:15:13.587`)
* [CVE-2022-32733](CVE-2022/CVE-2022-327xx/CVE-2022-32733.json) (`2023-05-29T18:15:13.630`)
* [CVE-2022-32734](CVE-2022/CVE-2022-327xx/CVE-2022-32734.json) (`2023-05-29T18:15:13.673`)
* [CVE-2022-32735](CVE-2022/CVE-2022-327xx/CVE-2022-32735.json) (`2023-05-29T18:15:13.713`)
* [CVE-2022-32736](CVE-2022/CVE-2022-327xx/CVE-2022-32736.json) (`2023-05-29T18:15:13.753`)
* [CVE-2022-32737](CVE-2022/CVE-2022-327xx/CVE-2022-32737.json) (`2023-05-29T18:15:13.793`)
* [CVE-2022-32738](CVE-2022/CVE-2022-327xx/CVE-2022-32738.json) (`2023-05-29T18:15:13.830`)
* [CVE-2022-24580](CVE-2022/CVE-2022-245xx/CVE-2022-24580.json) (`2023-05-29T20:15:09.413`)
* [CVE-2022-24627](CVE-2022/CVE-2022-246xx/CVE-2022-24627.json) (`2023-05-29T21:15:09.423`)
* [CVE-2022-24628](CVE-2022/CVE-2022-246xx/CVE-2022-24628.json) (`2023-05-29T21:15:09.477`)
* [CVE-2022-24629](CVE-2022/CVE-2022-246xx/CVE-2022-24629.json) (`2023-05-29T21:15:09.523`)
* [CVE-2022-24630](CVE-2022/CVE-2022-246xx/CVE-2022-24630.json) (`2023-05-29T21:15:09.573`)
* [CVE-2022-24631](CVE-2022/CVE-2022-246xx/CVE-2022-24631.json) (`2023-05-29T21:15:09.630`)
* [CVE-2022-24632](CVE-2022/CVE-2022-246xx/CVE-2022-24632.json) (`2023-05-29T21:15:09.697`)
* [CVE-2022-41766](CVE-2022/CVE-2022-417xx/CVE-2022-41766.json) (`2023-05-29T21:15:09.757`)
* [CVE-2023-30571](CVE-2023/CVE-2023-305xx/CVE-2023-30571.json) (`2023-05-29T20:15:09.513`)
* [CVE-2023-30253](CVE-2023/CVE-2023-302xx/CVE-2023-30253.json) (`2023-05-29T21:15:09.813`)
* [CVE-2023-32072](CVE-2023/CVE-2023-320xx/CVE-2023-32072.json) (`2023-05-29T21:15:09.893`)
* [CVE-2023-32687](CVE-2023/CVE-2023-326xx/CVE-2023-32687.json) (`2023-05-29T21:15:10.053`)
### CVEs modified in the last Commit
Recently modified CVEs: `0`
Recently modified CVEs: `2`
* [CVE-2021-3610](CVE-2021/CVE-2021-36xx/CVE-2021-3610.json) (`2023-05-29T21:15:09.307`)
* [CVE-2023-33796](CVE-2023/CVE-2023-337xx/CVE-2023-33796.json) (`2023-05-29T20:15:09.603`)
## Download and Usage