From 37d5424f18516a35adf2c372fd947862491f115e Mon Sep 17 00:00:00 2001 From: cad-safe-bot Date: Fri, 1 Sep 2023 18:00:29 +0000 Subject: [PATCH] Auto-Update: 2023-09-01T18:00:25.460342+00:00 --- CVE-2018/CVE-2018-250xx/CVE-2018-25089.json | 76 ++++- CVE-2020/CVE-2020-226xx/CVE-2020-22612.json | 20 ++ CVE-2021/CVE-2021-369xx/CVE-2021-36978.json | 6 +- CVE-2022/CVE-2022-275xx/CVE-2022-27597.json | 15 +- CVE-2022/CVE-2022-275xx/CVE-2022-27598.json | 20 +- CVE-2022/CVE-2022-34xx/CVE-2022-3407.json | 55 ++++ CVE-2023/CVE-2023-233xx/CVE-2023-23355.json | 12 +- CVE-2023/CVE-2023-276xx/CVE-2023-27604.json | 59 +++- CVE-2023/CVE-2023-283xx/CVE-2023-28366.json | 32 +++ CVE-2023/CVE-2023-325xx/CVE-2023-32559.json | 80 +++++- CVE-2023/CVE-2023-360xx/CVE-2023-36076.json | 20 ++ CVE-2023/CVE-2023-360xx/CVE-2023-36088.json | 28 ++ CVE-2023/CVE-2023-361xx/CVE-2023-36100.json | 20 ++ CVE-2023/CVE-2023-361xx/CVE-2023-36187.json | 20 ++ CVE-2023/CVE-2023-363xx/CVE-2023-36326.json | 24 ++ CVE-2023/CVE-2023-363xx/CVE-2023-36327.json | 24 ++ CVE-2023/CVE-2023-363xx/CVE-2023-36328.json | 20 ++ CVE-2023/CVE-2023-37xx/CVE-2023-3704.json | 295 +++++++++++++++++++- CVE-2023/CVE-2023-395xx/CVE-2023-39582.json | 20 ++ CVE-2023/CVE-2023-396xx/CVE-2023-39600.json | 11 +- CVE-2023/CVE-2023-396xx/CVE-2023-39631.json | 24 ++ CVE-2023/CVE-2023-401xx/CVE-2023-40195.json | 58 +++- CVE-2023/CVE-2023-405xx/CVE-2023-40572.json | 100 ++++++- CVE-2023/CVE-2023-405xx/CVE-2023-40573.json | 113 +++++++- CVE-2023/CVE-2023-407xx/CVE-2023-40771.json | 20 ++ CVE-2023/CVE-2023-409xx/CVE-2023-40968.json | 20 ++ CVE-2023/CVE-2023-409xx/CVE-2023-40980.json | 20 ++ CVE-2023/CVE-2023-410xx/CVE-2023-41028.json | 70 ++++- CVE-2023/CVE-2023-416xx/CVE-2023-41627.json | 20 ++ CVE-2023/CVE-2023-416xx/CVE-2023-41628.json | 20 ++ CVE-2023/CVE-2023-42xx/CVE-2023-4230.json | 69 ++++- CVE-2023/CVE-2023-47xx/CVE-2023-4720.json | 59 ++++ CVE-2023/CVE-2023-47xx/CVE-2023-4721.json | 59 ++++ CVE-2023/CVE-2023-47xx/CVE-2023-4722.json | 59 ++++ README.md | 63 +++-- 35 files changed, 1535 insertions(+), 96 deletions(-) create mode 100644 CVE-2020/CVE-2020-226xx/CVE-2020-22612.json create mode 100644 CVE-2022/CVE-2022-34xx/CVE-2022-3407.json create mode 100644 CVE-2023/CVE-2023-283xx/CVE-2023-28366.json create mode 100644 CVE-2023/CVE-2023-360xx/CVE-2023-36076.json create mode 100644 CVE-2023/CVE-2023-360xx/CVE-2023-36088.json create mode 100644 CVE-2023/CVE-2023-361xx/CVE-2023-36100.json create mode 100644 CVE-2023/CVE-2023-361xx/CVE-2023-36187.json create mode 100644 CVE-2023/CVE-2023-363xx/CVE-2023-36326.json create mode 100644 CVE-2023/CVE-2023-363xx/CVE-2023-36327.json create mode 100644 CVE-2023/CVE-2023-363xx/CVE-2023-36328.json create mode 100644 CVE-2023/CVE-2023-395xx/CVE-2023-39582.json create mode 100644 CVE-2023/CVE-2023-396xx/CVE-2023-39631.json create mode 100644 CVE-2023/CVE-2023-407xx/CVE-2023-40771.json create mode 100644 CVE-2023/CVE-2023-409xx/CVE-2023-40968.json create mode 100644 CVE-2023/CVE-2023-409xx/CVE-2023-40980.json create mode 100644 CVE-2023/CVE-2023-416xx/CVE-2023-41627.json create mode 100644 CVE-2023/CVE-2023-416xx/CVE-2023-41628.json create mode 100644 CVE-2023/CVE-2023-47xx/CVE-2023-4720.json create mode 100644 CVE-2023/CVE-2023-47xx/CVE-2023-4721.json create mode 100644 CVE-2023/CVE-2023-47xx/CVE-2023-4722.json diff --git a/CVE-2018/CVE-2018-250xx/CVE-2018-25089.json b/CVE-2018/CVE-2018-250xx/CVE-2018-25089.json index 23802c22835..51deaa6ab2b 100644 --- a/CVE-2018/CVE-2018-250xx/CVE-2018-25089.json +++ b/CVE-2018/CVE-2018-250xx/CVE-2018-25089.json @@ -2,8 +2,8 @@ "id": "CVE-2018-25089", "sourceIdentifier": "cna@vuldb.com", "published": "2023-08-28T13:15:09.100", - "lastModified": "2023-08-28T19:28:54.370", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-09-01T17:25:13.760", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", @@ -11,6 +11,28 @@ } ], "metrics": { + "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 5.3, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + } + ], "cvssMetricV30": [ { "source": "cna@vuldb.com", @@ -61,8 +83,18 @@ }, "weaknesses": [ { - "source": "cna@vuldb.com", + "source": "nvd@nist.gov", "type": "Primary", + "description": [ + { + "lang": "en", + "value": "NVD-CWE-noinfo" + } + ] + }, + { + "source": "cna@vuldb.com", + "type": "Secondary", "description": [ { "lang": "en", @@ -71,22 +103,52 @@ ] } ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:glb:meetup_tag:0.1:*:*:*:*:mediawiki:*:*", + "matchCriteriaId": "4DAAE57B-A3A8-4EC1-AAD6-F778F80D71A9" + } + ] + } + ] + } + ], "references": [ { "url": "https://github.com/glb/mediawiki-tag-extension-meetup/commit/850c726d6bbfe0bf270801fbb92a30babea4155c", - "source": "cna@vuldb.com" + "source": "cna@vuldb.com", + "tags": [ + "Patch" + ] }, { "url": "https://github.com/glb/mediawiki-tag-extension-meetup/releases/tag/v0.2", - "source": "cna@vuldb.com" + "source": "cna@vuldb.com", + "tags": [ + "Release Notes" + ] }, { "url": "https://vuldb.com/?ctiid.238157", - "source": "cna@vuldb.com" + "source": "cna@vuldb.com", + "tags": [ + "Permissions Required", + "Third Party Advisory" + ] }, { "url": "https://vuldb.com/?id.238157", - "source": "cna@vuldb.com" + "source": "cna@vuldb.com", + "tags": [ + "Third Party Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2020/CVE-2020-226xx/CVE-2020-22612.json b/CVE-2020/CVE-2020-226xx/CVE-2020-22612.json new file mode 100644 index 00000000000..1762ebfb2e9 --- /dev/null +++ b/CVE-2020/CVE-2020-226xx/CVE-2020-22612.json @@ -0,0 +1,20 @@ +{ + "id": "CVE-2020-22612", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-09-01T16:15:07.533", + "lastModified": "2023-09-01T16:15:07.533", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Installer RCE on settings file write in MyBB before 1.8.22." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://mybb.com/versions/1.8.22/", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2021/CVE-2021-369xx/CVE-2021-36978.json b/CVE-2021/CVE-2021-369xx/CVE-2021-36978.json index ea8e730c929..ec72c392cca 100644 --- a/CVE-2021/CVE-2021-369xx/CVE-2021-36978.json +++ b/CVE-2021/CVE-2021-369xx/CVE-2021-36978.json @@ -2,7 +2,7 @@ "id": "CVE-2021-36978", "sourceIdentifier": "cve@mitre.org", "published": "2021-07-20T07:15:08.030", - "lastModified": "2023-08-30T01:15:27.953", + "lastModified": "2023-09-01T16:15:07.650", "vulnStatus": "Modified", "descriptions": [ { @@ -125,6 +125,10 @@ "Third Party Advisory" ] }, + { + "url": "https://github.com/qpdf/qpdf/issues/492", + "source": "cve@mitre.org" + }, { "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00037.html", "source": "cve@mitre.org" diff --git a/CVE-2022/CVE-2022-275xx/CVE-2022-27597.json b/CVE-2022/CVE-2022-275xx/CVE-2022-27597.json index ec47ffa0bc9..1336869c689 100644 --- a/CVE-2022/CVE-2022-275xx/CVE-2022-27597.json +++ b/CVE-2022/CVE-2022-275xx/CVE-2022-27597.json @@ -2,8 +2,8 @@ "id": "CVE-2022-27597", "sourceIdentifier": "security@qnapsecurity.com.tw", "published": "2023-03-29T07:15:08.403", - "lastModified": "2023-04-20T14:15:07.853", - "vulnStatus": "Modified", + "lastModified": "2023-09-01T17:10:13.670", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", @@ -17,19 +17,19 @@ "type": "Primary", "cvssData": { "version": "3.1", - "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", - "privilegesRequired": "LOW", + "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", - "baseScore": 4.3, - "baseSeverity": "MEDIUM" + "baseScore": 2.7, + "baseSeverity": "LOW" }, - "exploitabilityScore": 2.8, + "exploitabilityScore": 1.2, "impactScore": 1.4 }, { @@ -86,7 +86,6 @@ ], "configurations": [ { - "operator": "AND", "nodes": [ { "operator": "OR", diff --git a/CVE-2022/CVE-2022-275xx/CVE-2022-27598.json b/CVE-2022/CVE-2022-275xx/CVE-2022-27598.json index c5e5b21ae09..8e5b70f9ce0 100644 --- a/CVE-2022/CVE-2022-275xx/CVE-2022-27598.json +++ b/CVE-2022/CVE-2022-275xx/CVE-2022-27598.json @@ -2,8 +2,8 @@ "id": "CVE-2022-27598", "sourceIdentifier": "security@qnapsecurity.com.tw", "published": "2023-03-29T07:15:08.613", - "lastModified": "2023-04-20T14:15:08.017", - "vulnStatus": "Modified", + "lastModified": "2023-09-01T17:10:25.797", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", @@ -17,19 +17,19 @@ "type": "Primary", "cvssData": { "version": "3.1", - "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", - "privilegesRequired": "LOW", + "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", - "baseScore": 4.3, - "baseSeverity": "MEDIUM" + "baseScore": 2.7, + "baseSeverity": "LOW" }, - "exploitabilityScore": 2.8, + "exploitabilityScore": 1.2, "impactScore": 1.4 }, { @@ -78,7 +78,6 @@ ], "configurations": [ { - "operator": "AND", "nodes": [ { "operator": "OR", @@ -298,7 +297,10 @@ "references": [ { "url": "https://www.qnap.com/en/security-advisory/qsa-23-06", - "source": "security@qnapsecurity.com.tw" + "source": "security@qnapsecurity.com.tw", + "tags": [ + "Vendor Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2022/CVE-2022-34xx/CVE-2022-3407.json b/CVE-2022/CVE-2022-34xx/CVE-2022-3407.json new file mode 100644 index 00000000000..da0c3a5a92a --- /dev/null +++ b/CVE-2022/CVE-2022-34xx/CVE-2022-3407.json @@ -0,0 +1,55 @@ +{ + "id": "CVE-2022-3407", + "sourceIdentifier": "psirt@lenovo.com", + "published": "2023-09-01T17:15:07.463", + "lastModified": "2023-09-01T17:15:07.463", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "I some cases, when the device is USB-tethered to a host PC, and the device is sharing its mobile network connection with the host PC, if the user originates a call on the device, then the device's modem may reset and cause the phone call to not succeed. This may block the user from dialing emergency services. This patch resolves the device's modem reset issue." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "psirt@lenovo.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H", + "attackVector": "PHYSICAL", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "HIGH", + "baseScore": 4.9, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 0.5, + "impactScore": 4.0 + } + ] + }, + "weaknesses": [ + { + "source": "psirt@lenovo.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-404" + } + ] + } + ], + "references": [ + { + "url": "https://en-us.support.motorola.com/app/answers/detail/a_id/175354", + "source": "psirt@lenovo.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-233xx/CVE-2023-23355.json b/CVE-2023/CVE-2023-233xx/CVE-2023-23355.json index b79cf65257d..d603216dd80 100644 --- a/CVE-2023/CVE-2023-233xx/CVE-2023-23355.json +++ b/CVE-2023/CVE-2023-233xx/CVE-2023-23355.json @@ -2,8 +2,8 @@ "id": "CVE-2023-23355", "sourceIdentifier": "security@qnapsecurity.com.tw", "published": "2023-03-29T05:15:07.563", - "lastModified": "2023-08-30T04:15:11.343", - "vulnStatus": "Modified", + "lastModified": "2023-09-01T17:10:05.397", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", @@ -17,19 +17,19 @@ "type": "Primary", "cvssData": { "version": "3.1", - "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", - "privilegesRequired": "LOW", + "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", - "baseScore": 8.8, + "baseScore": 7.2, "baseSeverity": "HIGH" }, - "exploitabilityScore": 2.8, + "exploitabilityScore": 1.2, "impactScore": 5.9 }, { diff --git a/CVE-2023/CVE-2023-276xx/CVE-2023-27604.json b/CVE-2023/CVE-2023-276xx/CVE-2023-27604.json index d6e4d3456d2..e27e8c42924 100644 --- a/CVE-2023/CVE-2023-276xx/CVE-2023-27604.json +++ b/CVE-2023/CVE-2023-276xx/CVE-2023-27604.json @@ -2,15 +2,38 @@ "id": "CVE-2023-27604", "sourceIdentifier": "security@apache.org", "published": "2023-08-28T08:15:14.697", - "lastModified": "2023-08-28T13:07:56.260", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-09-01T17:11:03.007", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", "value": "Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via \u2018sqoop import --connect\u2019, obtain airflow server permissions, etc. The attacker needs to be logged in and have authorization (permissions) to create/edit connections.\n\n It is recommended to upgrade to a version that is not affected.\nThis issue was reported independently by happyhacking-k, And Xie Jianming and LiuHui of Caiji Sec Team also reported it." } ], - "metrics": {}, + "metrics": { + "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 2.8, + "impactScore": 5.9 + } + ] + }, "weaknesses": [ { "source": "security@apache.org", @@ -23,14 +46,40 @@ ] } ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:airflow_sqoop_provider:*:*:*:*:*:*:*:*", + "versionEndExcluding": "4.0.0", + "matchCriteriaId": "971C1268-59CA-4A49-8726-81E0205595A8" + } + ] + } + ] + } + ], "references": [ { "url": "https://github.com/apache/airflow/pull/33039", - "source": "security@apache.org" + "source": "security@apache.org", + "tags": [ + "Patch", + "Vendor Advisory" + ] }, { "url": "https://lists.apache.org/thread/lswlxf11do51ob7f6xyyg8qp3n7wdrgd", - "source": "security@apache.org" + "source": "security@apache.org", + "tags": [ + "Mailing List", + "Vendor Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-283xx/CVE-2023-28366.json b/CVE-2023/CVE-2023-283xx/CVE-2023-28366.json new file mode 100644 index 00000000000..4869e3aa78f --- /dev/null +++ b/CVE-2023/CVE-2023-283xx/CVE-2023-28366.json @@ -0,0 +1,32 @@ +{ + "id": "CVE-2023-28366", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-09-01T16:15:07.790", + "lastModified": "2023-09-01T16:15:07.790", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/eclipse/mosquitto/commit/6113eac95a9df634fbc858be542c4a0456bfe7b9", + "source": "cve@mitre.org" + }, + { + "url": "https://github.com/eclipse/mosquitto/compare/v2.0.15...v2.0.16", + "source": "cve@mitre.org" + }, + { + "url": "https://mosquitto.org/blog/2023/08/version-2-0-16-released/", + "source": "cve@mitre.org" + }, + { + "url": "https://www.compass-security.com/fileadmin/Research/Advisories/2023_02_CSNC-2023-001_Eclipse_Mosquitto_Memory_Leak.txt", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-325xx/CVE-2023-32559.json b/CVE-2023/CVE-2023-325xx/CVE-2023-32559.json index f0d2bae4434..8631f8c37f0 100644 --- a/CVE-2023/CVE-2023-325xx/CVE-2023-32559.json +++ b/CVE-2023/CVE-2023-325xx/CVE-2023-32559.json @@ -2,19 +2,91 @@ "id": "CVE-2023-32559", "sourceIdentifier": "support@hackerone.com", "published": "2023-08-24T02:15:09.210", - "lastModified": "2023-08-24T12:55:22.900", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-09-01T17:05:35.170", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", "value": "A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. The use of the deprecated API `process.binding()` can bypass the policy mechanism by requiring internal modules and eventually take advantage of `process.binding('spawn_sync')` run arbitrary code, outside of the limits defined in a `policy.json` file. Please note that at the time this CVE was issued, the policy is an experimental feature of Node.js." } ], - "metrics": {}, + "metrics": { + "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 9.8, + "baseSeverity": "CRITICAL" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.9 + } + ] + }, + "weaknesses": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-269" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", + "versionStartIncluding": "16.0.0", + "versionEndIncluding": "16.20.1", + "matchCriteriaId": "F7394398-D1FA-4786-B962-7D0FFF50DB2D" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", + "versionStartIncluding": "18.0.0", + "versionEndIncluding": "18.17.0", + "matchCriteriaId": "7DAF267F-6FDD-4914-B37E-181B91BF8B64" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", + "versionStartIncluding": "20.0.0", + "versionEndIncluding": "20.5.0", + "matchCriteriaId": "145E971E-F0AF-49A7-8A9C-3AAFE01C076B" + } + ] + } + ] + } + ], "references": [ { "url": "https://hackerone.com/reports/1946470", - "source": "support@hackerone.com" + "source": "support@hackerone.com", + "tags": [ + "Exploit", + "Third Party Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-360xx/CVE-2023-36076.json b/CVE-2023/CVE-2023-360xx/CVE-2023-36076.json new file mode 100644 index 00000000000..5708967b880 --- /dev/null +++ b/CVE-2023/CVE-2023-360xx/CVE-2023-36076.json @@ -0,0 +1,20 @@ +{ + "id": "CVE-2023-36076", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-09-01T16:15:07.857", + "lastModified": "2023-09-01T16:15:07.857", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "SQL Injection vulnerability in smanga version 3.1.9 and earlier, allows remote attackers to execute arbitrary code and gain sensitive information via mediaId, mangaId, and userId parameters in php/history/add.php." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/lkw199711/smanga/issues/100", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-360xx/CVE-2023-36088.json b/CVE-2023/CVE-2023-360xx/CVE-2023-36088.json new file mode 100644 index 00000000000..f7007c0ac39 --- /dev/null +++ b/CVE-2023/CVE-2023-360xx/CVE-2023-36088.json @@ -0,0 +1,28 @@ +{ + "id": "CVE-2023-36088", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-09-01T16:15:07.910", + "lastModified": "2023-09-01T16:15:07.910", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Server Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information." + } + ], + "metrics": {}, + "references": [ + { + "url": "http://nebulagraph.com", + "source": "cve@mitre.org" + }, + { + "url": "https://github.com/vesoft-inc/nebula-studio", + "source": "cve@mitre.org" + }, + { + "url": "https://github.com/vesoft-inc/nebula-studio/issues/571", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-361xx/CVE-2023-36100.json b/CVE-2023/CVE-2023-361xx/CVE-2023-36100.json new file mode 100644 index 00000000000..1a635dffb85 --- /dev/null +++ b/CVE-2023/CVE-2023-361xx/CVE-2023-36100.json @@ -0,0 +1,20 @@ +{ + "id": "CVE-2023-36100", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-09-01T16:15:07.967", + "lastModified": "2023-09-01T16:15:07.967", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter in api/User/ChangeUser." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/Thecosy/IceCMS/issues/15", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-361xx/CVE-2023-36187.json b/CVE-2023/CVE-2023-361xx/CVE-2023-36187.json new file mode 100644 index 00000000000..a340ae002b3 --- /dev/null +++ b/CVE-2023/CVE-2023-361xx/CVE-2023-36187.json @@ -0,0 +1,20 @@ +{ + "id": "CVE-2023-36187", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-09-01T16:15:08.020", + "lastModified": "2023-09-01T16:15:08.020", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Buffer Overflow vulnerability in NETGEAR R6400v2 before version 1.0.4.118, allows remote unauthenticated attackers to execute arbitrary code via crafted URL to httpd." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://kb.netgear.com/000065571/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2020-0578", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-363xx/CVE-2023-36326.json b/CVE-2023/CVE-2023-363xx/CVE-2023-36326.json new file mode 100644 index 00000000000..af5963bcd41 --- /dev/null +++ b/CVE-2023/CVE-2023-363xx/CVE-2023-36326.json @@ -0,0 +1,24 @@ +{ + "id": "CVE-2023-36326", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-09-01T16:15:08.077", + "lastModified": "2023-09-01T16:15:08.077", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Integer Overflow vulnerability in RELIC before commit 34580d840469361ba9b5f001361cad659687b9ab, allows attackers to execute arbitrary code, cause a denial of service, and escalate privileges when calling realloc function in bn_grow function." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/relic-toolkit/relic/commit/34580d840469361ba9b5f001361cad659687b9ab", + "source": "cve@mitre.org" + }, + { + "url": "https://groups.google.com/g/relic-discuss/c/A_J2-ArVIAo/m/qgFiXsUJBQAJ?utm_medium=email&utm_source=footer", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-363xx/CVE-2023-36327.json b/CVE-2023/CVE-2023-363xx/CVE-2023-36327.json new file mode 100644 index 00000000000..c74c6c6fc66 --- /dev/null +++ b/CVE-2023/CVE-2023-363xx/CVE-2023-36327.json @@ -0,0 +1,24 @@ +{ + "id": "CVE-2023-36327", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-09-01T16:15:08.127", + "lastModified": "2023-09-01T16:15:08.127", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Integer Overflow vulnerability in RELIC before commit 421f2e91cf2ba42473d4d54daf24e295679e290e, allows attackers to execute arbitrary code and cause a denial of service in pos argument in bn_get_prime function." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/relic-toolkit/relic/commit/421f2e91cf2ba42473d4d54daf24e295679e290e", + "source": "cve@mitre.org" + }, + { + "url": "https://groups.google.com/g/relic-discuss/c/A_J2-ArVIAo/m/qgFiXsUJBQAJ?utm_medium=email&utm_source=footer", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-363xx/CVE-2023-36328.json b/CVE-2023/CVE-2023-363xx/CVE-2023-36328.json new file mode 100644 index 00000000000..be345e35c66 --- /dev/null +++ b/CVE-2023/CVE-2023-363xx/CVE-2023-36328.json @@ -0,0 +1,20 @@ +{ + "id": "CVE-2023-36328", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-09-01T16:15:08.177", + "lastModified": "2023-09-01T16:15:08.177", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS)." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/libtom/libtommath/pull/546", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-37xx/CVE-2023-3704.json b/CVE-2023/CVE-2023-37xx/CVE-2023-3704.json index 710d6250a2f..374b04370c8 100644 --- a/CVE-2023/CVE-2023-37xx/CVE-2023-3704.json +++ b/CVE-2023/CVE-2023-37xx/CVE-2023-3704.json @@ -2,8 +2,8 @@ "id": "CVE-2023-3704", "sourceIdentifier": "vdisclose@cert-in.org.in", "published": "2023-08-24T07:15:11.670", - "lastModified": "2023-08-24T12:55:22.900", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-09-01T17:12:08.027", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", @@ -12,6 +12,26 @@ ], "metrics": { "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 5.3, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, { "source": "vdisclose@cert-in.org.in", "type": "Secondary", @@ -34,10 +54,279 @@ } ] }, + "weaknesses": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-20" + } + ] + } + ], + "configurations": [ + { + "operator": "AND", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:o:cpplusworld:cp-uvr-1601e1-hc_firmware:*:*:*:*:*:*:*:*", + "versionEndExcluding": "4.000.00at008.0.0.r20230302", + "matchCriteriaId": "F50BFF3B-3529-46A3-B929-CACB95B006E7" + } + ] + }, + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": false, + "criteria": "cpe:2.3:h:cpplusworld:cp-uvr-1601e1-hc:-:*:*:*:*:*:*:*", + "matchCriteriaId": "84A45779-48D1-4595-A197-6CBB7EEC6121" + } + ] + } + ] + }, + { + "operator": "AND", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:o:cpplusworld:cp-uvr-0401l1-4kh_firmware:*:*:*:*:*:*:*:*", + "versionEndExcluding": "4.000.00at008.0.0.r20230302", + "matchCriteriaId": "C056636C-386E-441F-9674-AD952512B2DB" + } + ] + }, + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": false, + "criteria": "cpe:2.3:h:cpplusworld:cp-uvr-0401l1-4kh:-:*:*:*:*:*:*:*", + "matchCriteriaId": "2A3D4B69-934D-42D0-BA62-E9E0EDC44F2E" + } + ] + } + ] + }, + { + "operator": "AND", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:o:cpplusworld:cp-uvr-0401l1b-4kh_firmware:*:*:*:*:*:*:*:*", + "versionEndExcluding": "4.000.00at008.0.0.r20230302", + "matchCriteriaId": "B953B765-2340-4932-96E5-FD325046B16E" + } + ] + }, + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": false, + "criteria": "cpe:2.3:h:cpplusworld:cp-uvr-0401l1b-4kh:-:*:*:*:*:*:*:*", + "matchCriteriaId": "6838A98D-2C8F-4184-AB97-C332E63B8467" + } + ] + } + ] + }, + { + "operator": "AND", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:o:cpplusworld:cp-uvr-0801f1-hc_firmware:*:*:*:*:*:*:*:*", + "versionEndExcluding": "4.000.00at008.0.0.r20230302", + "matchCriteriaId": "8C2699B2-0EF7-4F71-867B-A606BC81E629" + } + ] + }, + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": false, + "criteria": "cpe:2.3:h:cpplusworld:cp-uvr-0801f1-hc:-:*:*:*:*:*:*:*", + "matchCriteriaId": "5F3E8529-C7EC-49A6-8956-3DDA9EB0A311" + } + ] + } + ] + }, + { + "operator": "AND", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:o:cpplusworld:cp-uvr-0801k1-h_firmware:*:*:*:*:*:*:*:*", + "versionEndExcluding": "4.000.00at008.0.0.r20230302", + "matchCriteriaId": "471365C3-84D0-4B8B-84A5-36BDE78CDA2A" + } + ] + }, + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": false, + "criteria": "cpe:2.3:h:cpplusworld:cp-uvr-0801k1-h:-:*:*:*:*:*:*:*", + "matchCriteriaId": "AB06A051-0017-4D7C-B0AB-8D549A534062" + } + ] + } + ] + }, + { + "operator": "AND", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:o:cpplusworld:cp-uvr-0801k1b-h_firmware:*:*:*:*:*:*:*:*", + "versionEndExcluding": "4.000.00at008.0.0.r20230302", + "matchCriteriaId": "B61D25A0-8FE8-4F5D-A15E-97F27DC24D4F" + } + ] + }, + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": false, + "criteria": "cpe:2.3:h:cpplusworld:cp-uvr-0801k1b-h:-:*:*:*:*:*:*:*", + "matchCriteriaId": "1CF0A8A0-84F9-411A-AC0F-4B8B4B804CF9" + } + ] + } + ] + }, + { + "operator": "AND", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:o:cpplusworld:cp-uvr-0808k1-h_firmware:*:*:*:*:*:*:*:*", + "versionEndExcluding": "4.000.00at008.0.0.r20230302", + "matchCriteriaId": "424EFCC3-244B-46A2-B229-DA8D0CC5B899" + } + ] + }, + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": false, + "criteria": "cpe:2.3:h:cpplusworld:cp-uvr-0808k1-h:-:*:*:*:*:*:*:*", + "matchCriteriaId": "79D02BBE-2CE9-4408-A2AD-D4968F56F445" + } + ] + } + ] + }, + { + "operator": "AND", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:o:cpplusworld:cp-uvr-1601e1-h_firmware:*:*:*:*:*:*:*:*", + "versionEndExcluding": "4.000.00at008.0.0.r20230302", + "matchCriteriaId": "54C23340-21A7-4E6C-BEF0-FABB766DCA58" + } + ] + }, + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": false, + "criteria": "cpe:2.3:h:cpplusworld:cp-uvr-1601e1-h:-:*:*:*:*:*:*:*", + "matchCriteriaId": "6535FC29-B508-4811-9BFB-513DBE17F01E" + } + ] + } + ] + }, + { + "operator": "AND", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:o:cpplusworld:cp-uvr-1601e2-h_firmware:*:*:*:*:*:*:*:*", + "versionEndExcluding": "4.000.00at008.0.0.r20230302", + "matchCriteriaId": "176C02FF-444E-4170-844F-33BEAD0575DB" + } + ] + }, + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": false, + "criteria": "cpe:2.3:h:cpplusworld:cp-uvr-1601e2-h:-:*:*:*:*:*:*:*", + "matchCriteriaId": "5FFC9164-EBE3-42CE-B3A3-D45FF042A5F6" + } + ] + } + ] + } + ], "references": [ { "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0240", - "source": "vdisclose@cert-in.org.in" + "source": "vdisclose@cert-in.org.in", + "tags": [ + "Vendor Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-395xx/CVE-2023-39582.json b/CVE-2023/CVE-2023-395xx/CVE-2023-39582.json new file mode 100644 index 00000000000..68429860da9 --- /dev/null +++ b/CVE-2023/CVE-2023-395xx/CVE-2023-39582.json @@ -0,0 +1,20 @@ +{ + "id": "CVE-2023-39582", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-09-01T16:15:08.230", + "lastModified": "2023-09-01T16:15:08.230", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the import sessions functions." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-126-2023-07-18-High-impact-Low-risk-SQL-injection-by-admin-users", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-396xx/CVE-2023-39600.json b/CVE-2023/CVE-2023-396xx/CVE-2023-39600.json index d6bb892e436..31059967ef2 100644 --- a/CVE-2023/CVE-2023-396xx/CVE-2023-39600.json +++ b/CVE-2023/CVE-2023-396xx/CVE-2023-39600.json @@ -2,8 +2,8 @@ "id": "CVE-2023-39600", "sourceIdentifier": "cve@mitre.org", "published": "2023-08-25T20:15:08.380", - "lastModified": "2023-08-29T20:51:52.543", - "vulnStatus": "Analyzed", + "lastModified": "2023-09-01T16:15:08.287", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", @@ -65,11 +65,8 @@ ], "references": [ { - "url": "http://icewrap.com", - "source": "cve@mitre.org", - "tags": [ - "Product" - ] + "url": "https://icewarp.com", + "source": "cve@mitre.org" }, { "url": "https://medium.com/@katikitala.sushmitha078/cross-site-scripting-reflected-xss-in-icewarp-server-cve-2023-39600-310a7e1c8817", diff --git a/CVE-2023/CVE-2023-396xx/CVE-2023-39631.json b/CVE-2023/CVE-2023-396xx/CVE-2023-39631.json new file mode 100644 index 00000000000..053f9945df6 --- /dev/null +++ b/CVE-2023/CVE-2023-396xx/CVE-2023-39631.json @@ -0,0 +1,24 @@ +{ + "id": "CVE-2023-39631", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-09-01T16:15:08.370", + "lastModified": "2023-09-01T16:15:08.370", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr library." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/langchain-ai/langchain/issues/8363", + "source": "cve@mitre.org" + }, + { + "url": "https://github.com/pydata/numexpr/issues/442", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-401xx/CVE-2023-40195.json b/CVE-2023/CVE-2023-401xx/CVE-2023-40195.json index 58a5f965c57..b2b025f0b19 100644 --- a/CVE-2023/CVE-2023-401xx/CVE-2023-40195.json +++ b/CVE-2023/CVE-2023-401xx/CVE-2023-40195.json @@ -2,15 +2,38 @@ "id": "CVE-2023-40195", "sourceIdentifier": "security@apache.org", "published": "2023-08-28T08:15:14.797", - "lastModified": "2023-08-28T13:07:56.260", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-09-01T17:14:19.163", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", "value": "Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider.\n\nWhen the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks can effectively run arbitrary code on the Airflow node by pointing it at a malicious Spark server. Prior to version 4.1.3, this was not called out in the documentation explicitly, so it is possible that administrators provided authorizations to configure Spark hooks without taking this into account. We recommend administrators to review their configurations to make sure the authorization to configure Spark hooks is only provided to fully trusted users.\n\nTo view the warning in the docs please visit\u00a0 https://airflow.apache.org/docs/apache-airflow-providers-apache-spark/4.1.3/connections/spark.html \n\n" } ], - "metrics": {}, + "metrics": { + "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 2.8, + "impactScore": 5.9 + } + ] + }, "weaknesses": [ { "source": "security@apache.org", @@ -27,14 +50,39 @@ ] } ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:apache:airflow_spark_provider:*:*:*:*:*:*:*:*", + "versionEndExcluding": "4.1.3", + "matchCriteriaId": "B4100137-C334-48A8-9C92-005AAF650B46" + } + ] + } + ] + } + ], "references": [ { "url": "https://github.com/apache/airflow/pull/33233", - "source": "security@apache.org" + "source": "security@apache.org", + "tags": [ + "Patch" + ] }, { "url": "https://lists.apache.org/thread/fzy95b1d6zv31j5wrx3znhzcscck2o24", - "source": "security@apache.org" + "source": "security@apache.org", + "tags": [ + "Mailing List", + "Vendor Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-405xx/CVE-2023-40572.json b/CVE-2023/CVE-2023-405xx/CVE-2023-40572.json index 74b87572a43..5e8e790e1e3 100644 --- a/CVE-2023/CVE-2023-405xx/CVE-2023-40572.json +++ b/CVE-2023/CVE-2023-405xx/CVE-2023-40572.json @@ -2,8 +2,8 @@ "id": "CVE-2023-40572", "sourceIdentifier": "security-advisories@github.com", "published": "2023-08-24T02:15:09.643", - "lastModified": "2023-08-24T12:55:22.900", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-09-01T17:07:35.057", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", @@ -12,6 +12,26 @@ ], "metrics": { "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 8.0, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 2.1, + "impactScore": 5.9 + }, { "source": "security-advisories@github.com", "type": "Secondary", @@ -46,18 +66,88 @@ ] } ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", + "versionEndExcluding": "14.10.9", + "matchCriteriaId": "11425A73-EEF4-4856-832E-B60154EC09EE" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:15.0:-:*:*:*:*:*:*", + "matchCriteriaId": "99329652-2907-4903-AAB1-1038F225C020" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:15.0:rc1:*:*:*:*:*:*", + "matchCriteriaId": "88E41345-F81E-401A-BD67-66AF4B3925D4" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:15.1:-:*:*:*:*:*:*", + "matchCriteriaId": "5D121BDB-D7C5-4B79-A904-3C4A76F38E6A" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:15.1:rc1:*:*:*:*:*:*", + "matchCriteriaId": "67322CAC-1F17-4453-BC7F-4262E436E307" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:15.2:-:*:*:*:*:*:*", + "matchCriteriaId": "047E048F-AB46-41FD-A074-2EC1D036DC92" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:15.2:rc1:*:*:*:*:*:*", + "matchCriteriaId": "355FF62B-1086-4F15-8CBC-33906F4A3589" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:15.3:-:*:*:*:*:*:*", + "matchCriteriaId": "D64558D4-26CC-44ED-9DDC-56979E569DA9" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:15.3:rc1:*:*:*:*:*:*", + "matchCriteriaId": "82B5066C-4F5D-4F7F-9EE3-9A926321F16A" + } + ] + } + ] + } + ], "references": [ { "url": "https://github.com/xwiki/xwiki-platform/commit/4b20528808d0c311290b0d9ab2cfc44063380ef7", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Patch" + ] }, { "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-4f8m-7h83-9f6m", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Patch", + "Vendor Advisory" + ] }, { "url": "https://jira.xwiki.org/browse/XWIKI-20849", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Exploit", + "Issue Tracking", + "Vendor Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-405xx/CVE-2023-40573.json b/CVE-2023/CVE-2023-405xx/CVE-2023-40573.json index fdbe67e561a..b94fdc82c18 100644 --- a/CVE-2023/CVE-2023-405xx/CVE-2023-40573.json +++ b/CVE-2023/CVE-2023-405xx/CVE-2023-40573.json @@ -2,8 +2,8 @@ "id": "CVE-2023-40573", "sourceIdentifier": "security-advisories@github.com", "published": "2023-08-24T02:15:09.973", - "lastModified": "2023-08-24T12:55:22.900", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-09-01T17:09:35.270", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", @@ -12,6 +12,26 @@ ], "metrics": { "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 2.8, + "impactScore": 5.9 + }, { "source": "security-advisories@github.com", "type": "Secondary", @@ -36,8 +56,18 @@ }, "weaknesses": [ { - "source": "security-advisories@github.com", + "source": "nvd@nist.gov", "type": "Primary", + "description": [ + { + "lang": "en", + "value": "NVD-CWE-noinfo" + } + ] + }, + { + "source": "security-advisories@github.com", + "type": "Secondary", "description": [ { "lang": "en", @@ -46,18 +76,89 @@ ] } ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:*:*:*:*:*:*:*:*", + "versionEndExcluding": "14.10.9", + "matchCriteriaId": "11425A73-EEF4-4856-832E-B60154EC09EE" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:15.0:-:*:*:*:*:*:*", + "matchCriteriaId": "99329652-2907-4903-AAB1-1038F225C020" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:15.0:rc1:*:*:*:*:*:*", + "matchCriteriaId": "88E41345-F81E-401A-BD67-66AF4B3925D4" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:15.1:-:*:*:*:*:*:*", + "matchCriteriaId": "5D121BDB-D7C5-4B79-A904-3C4A76F38E6A" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:15.1:rc1:*:*:*:*:*:*", + "matchCriteriaId": "67322CAC-1F17-4453-BC7F-4262E436E307" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:15.2:-:*:*:*:*:*:*", + "matchCriteriaId": "047E048F-AB46-41FD-A074-2EC1D036DC92" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:15.2:rc1:*:*:*:*:*:*", + "matchCriteriaId": "355FF62B-1086-4F15-8CBC-33906F4A3589" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:15.3:-:*:*:*:*:*:*", + "matchCriteriaId": "D64558D4-26CC-44ED-9DDC-56979E569DA9" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:xwiki:xwiki:15.3:rc1:*:*:*:*:*:*", + "matchCriteriaId": "82B5066C-4F5D-4F7F-9EE3-9A926321F16A" + } + ] + } + ] + } + ], "references": [ { "url": "https://github.com/xwiki/xwiki-platform/commit/fcdcfed3fe2e8a3cad66ae0610795a2d58ab9662", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Patch" + ] }, { "url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8xhr-x3v8-rghj", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Patch", + "Vendor Advisory" + ] }, { "url": "https://jira.xwiki.org/browse/XWIKI-20852", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Exploit", + "Issue Tracking", + "Patch", + "Vendor Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-407xx/CVE-2023-40771.json b/CVE-2023/CVE-2023-407xx/CVE-2023-40771.json new file mode 100644 index 00000000000..68b723c575c --- /dev/null +++ b/CVE-2023/CVE-2023-407xx/CVE-2023-40771.json @@ -0,0 +1,20 @@ +{ + "id": "CVE-2023-40771", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-09-01T16:15:08.423", + "lastModified": "2023-09-01T16:15:08.423", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of the blacklist function." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/dataease/dataease/issues/5861", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-409xx/CVE-2023-40968.json b/CVE-2023/CVE-2023-409xx/CVE-2023-40968.json new file mode 100644 index 00000000000..cac5194f2fd --- /dev/null +++ b/CVE-2023/CVE-2023-409xx/CVE-2023-40968.json @@ -0,0 +1,20 @@ +{ + "id": "CVE-2023-40968", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-09-01T16:15:08.473", + "lastModified": "2023-09-01T16:15:08.473", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Buffer Overflow vulnerability in hzeller timg v.1.5.2 and before allows a remote attacker to cause a denial of service via the 0x61200000045c address." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/hzeller/timg/issues/115", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-409xx/CVE-2023-40980.json b/CVE-2023/CVE-2023-409xx/CVE-2023-40980.json new file mode 100644 index 00000000000..d63063119fb --- /dev/null +++ b/CVE-2023/CVE-2023-409xx/CVE-2023-40980.json @@ -0,0 +1,20 @@ +{ + "id": "CVE-2023-40980", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-09-01T16:15:08.523", + "lastModified": "2023-09-01T16:15:08.523", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "File Upload vulnerability in DWSurvey DWSurvey-OSS v.3.2.0 and before allows a remote attacker to execute arbitrary code via the saveimage method and savveFile in the action/UploadAction.java file." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/wkeyuan/DWSurvey/issues/107", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-410xx/CVE-2023-41028.json b/CVE-2023/CVE-2023-410xx/CVE-2023-41028.json index 24bbebbdfde..98593d1ab19 100644 --- a/CVE-2023/CVE-2023-410xx/CVE-2023-41028.json +++ b/CVE-2023/CVE-2023-410xx/CVE-2023-41028.json @@ -2,8 +2,8 @@ "id": "CVE-2023-41028", "sourceIdentifier": "disclosures@exodusintel.com", "published": "2023-08-23T22:15:09.077", - "lastModified": "2023-08-24T02:02:17.167", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-09-01T17:31:30.300", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", @@ -12,6 +12,26 @@ ], "metrics": { "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 2.8, + "impactScore": 5.9 + }, { "source": "disclosures@exodusintel.com", "type": "Secondary", @@ -35,6 +55,16 @@ ] }, "weaknesses": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-787" + } + ] + }, { "source": "disclosures@exodusintel.com", "type": "Secondary", @@ -46,10 +76,44 @@ ] } ], + "configurations": [ + { + "operator": "AND", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:o:juplink:rx4-1500_firmware:*:*:*:*:*:*:*:*", + "versionStartIncluding": "1.0.2", + "versionEndIncluding": "1.0.5", + "matchCriteriaId": "CA845736-15E8-4786-861A-DFCCA287E384" + } + ] + }, + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": false, + "criteria": "cpe:2.3:h:juplink:rx4-1500:-:*:*:*:*:*:*:*", + "matchCriteriaId": "6D46885D-045C-476A-AADE-7045A5F9046A" + } + ] + } + ] + } + ], "references": [ { "url": "https://blog.exodusintel.com/2023/08/23/juplink-rx4-1500-stack-based-buffer-overflow-vulnerability/", - "source": "disclosures@exodusintel.com" + "source": "disclosures@exodusintel.com", + "tags": [ + "Third Party Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-416xx/CVE-2023-41627.json b/CVE-2023/CVE-2023-416xx/CVE-2023-41627.json new file mode 100644 index 00000000000..c209af5e23d --- /dev/null +++ b/CVE-2023/CVE-2023-416xx/CVE-2023-41627.json @@ -0,0 +1,20 @@ +{ + "id": "CVE-2023-41627", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-09-01T17:15:07.633", + "lastModified": "2023-09-01T17:15:07.633", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attackers to send forged routing tables to the device." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://jira.o-ran-sc.org/browse/RIC-1001", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-416xx/CVE-2023-41628.json b/CVE-2023/CVE-2023-416xx/CVE-2023-41628.json new file mode 100644 index 00000000000..f1966bb2edd --- /dev/null +++ b/CVE-2023/CVE-2023-416xx/CVE-2023-41628.json @@ -0,0 +1,20 @@ +{ + "id": "CVE-2023-41628", + "sourceIdentifier": "cve@mitre.org", + "published": "2023-09-01T17:15:07.690", + "lastModified": "2023-09-01T17:15:07.690", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "An issue in O-RAN Software Community E2 G-Release allows attackers to cause a Denial of Service (DoS) by incorrectly initiating the messaging procedure between the E2Node and E2Term components." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://jira.o-ran-sc.org/browse/RIC-1002", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-42xx/CVE-2023-4230.json b/CVE-2023/CVE-2023-42xx/CVE-2023-4230.json index 99a8862d2b6..8c4b45f8cb3 100644 --- a/CVE-2023/CVE-2023-42xx/CVE-2023-4230.json +++ b/CVE-2023/CVE-2023-42xx/CVE-2023-4230.json @@ -2,8 +2,8 @@ "id": "CVE-2023-4230", "sourceIdentifier": "psirt@moxa.com", "published": "2023-08-24T07:15:12.013", - "lastModified": "2023-08-24T12:55:22.900", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-09-01T17:12:36.097", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", @@ -12,6 +12,26 @@ ], "metrics": { "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "baseScore": 5.3, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, { "source": "psirt@moxa.com", "type": "Secondary", @@ -35,6 +55,16 @@ ] }, "weaknesses": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-668" + } + ] + }, { "source": "psirt@moxa.com", "type": "Secondary", @@ -46,10 +76,43 @@ ] } ], + "configurations": [ + { + "operator": "AND", + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:o:moxa:iologik_e4200_firmware:*:*:*:*:*:*:*:*", + "versionEndIncluding": "1.6", + "matchCriteriaId": "AEF12B05-ED1F-4200-95AA-04D902B38DD7" + } + ] + }, + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": false, + "criteria": "cpe:2.3:h:moxa:iologik_e4200:-:*:*:*:*:*:*:*", + "matchCriteriaId": "CDD86C52-2E62-4B05-B3A3-5EA4A97F9332" + } + ] + } + ] + } + ], "references": [ { "url": "https://www.moxa.com/en/support/product-support/security-advisory/mpsa-230310-iologik-4000-series-multiple-web-server-vulnerabilities-and-improper-access-control-vulnerability", - "source": "psirt@moxa.com" + "source": "psirt@moxa.com", + "tags": [ + "Vendor Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-47xx/CVE-2023-4720.json b/CVE-2023/CVE-2023-47xx/CVE-2023-4720.json new file mode 100644 index 00000000000..f5d0999c43a --- /dev/null +++ b/CVE-2023/CVE-2023-47xx/CVE-2023-4720.json @@ -0,0 +1,59 @@ +{ + "id": "CVE-2023-4720", + "sourceIdentifier": "security@huntr.dev", + "published": "2023-09-01T16:15:08.577", + "lastModified": "2023-09-01T16:15:08.577", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV." + } + ], + "metrics": { + "cvssMetricV30": [ + { + "source": "security@huntr.dev", + "type": "Secondary", + "cvssData": { + "version": "3.0", + "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "LOW", + "baseScore": 4.0, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.5, + "impactScore": 1.4 + } + ] + }, + "weaknesses": [ + { + "source": "security@huntr.dev", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-1077" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/gpac/gpac/commit/e396648e48c57e2d53988d3fd4465b068b96c89a", + "source": "security@huntr.dev" + }, + { + "url": "https://huntr.dev/bounties/1dc2954c-8497-49fa-b2af-113e1e9381ad", + "source": "security@huntr.dev" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-47xx/CVE-2023-4721.json b/CVE-2023/CVE-2023-47xx/CVE-2023-4721.json new file mode 100644 index 00000000000..209ec2a332e --- /dev/null +++ b/CVE-2023/CVE-2023-47xx/CVE-2023-4721.json @@ -0,0 +1,59 @@ +{ + "id": "CVE-2023-4721", + "sourceIdentifier": "security@huntr.dev", + "published": "2023-09-01T16:15:08.660", + "lastModified": "2023-09-01T16:15:08.660", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV." + } + ], + "metrics": { + "cvssMetricV30": [ + { + "source": "security@huntr.dev", + "type": "Secondary", + "cvssData": { + "version": "3.0", + "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "LOW", + "baseScore": 5.9, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.5, + "impactScore": 3.4 + } + ] + }, + "weaknesses": [ + { + "source": "security@huntr.dev", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-125" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/gpac/gpac/commit/3ec93d73d048ed7b46fe6e9f307cc7a0cc13db63", + "source": "security@huntr.dev" + }, + { + "url": "https://huntr.dev/bounties/f457dc62-3cff-47bd-8fd2-1cb2b4a832fc", + "source": "security@huntr.dev" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-47xx/CVE-2023-4722.json b/CVE-2023/CVE-2023-47xx/CVE-2023-4722.json new file mode 100644 index 00000000000..4affe685dbc --- /dev/null +++ b/CVE-2023/CVE-2023-47xx/CVE-2023-4722.json @@ -0,0 +1,59 @@ +{ + "id": "CVE-2023-4722", + "sourceIdentifier": "security@huntr.dev", + "published": "2023-09-01T16:15:08.737", + "lastModified": "2023-09-01T16:15:08.737", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.3-DEV." + } + ], + "metrics": { + "cvssMetricV30": [ + { + "source": "security@huntr.dev", + "type": "Secondary", + "cvssData": { + "version": "3.0", + "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "LOW", + "baseScore": 5.9, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.5, + "impactScore": 3.4 + } + ] + }, + "weaknesses": [ + { + "source": "security@huntr.dev", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-190" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/gpac/gpac/commit/de7f3a852bef72a52825fd307cf4e8f486401a76", + "source": "security@huntr.dev" + }, + { + "url": "https://huntr.dev/bounties/ddfdb41d-e708-4fec-afe5-68ff1f88f830", + "source": "security@huntr.dev" + } + ] +} \ No newline at end of file diff --git a/README.md b/README.md index 7592dc38bec..2fca189cf5f 100644 --- a/README.md +++ b/README.md @@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2023-09-01T16:00:25.186525+00:00 +2023-09-01T18:00:25.460342+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2023-09-01T15:15:07.620000+00:00 +2023-09-01T17:31:30.300000+00:00 ``` ### Last Data Feed Release @@ -29,38 +29,53 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/ ### Total Number of included CVEs ```plain -223910 +223930 ``` ### CVEs added in the last Commit -Recently added CVEs: `2` +Recently added CVEs: `20` -* [CVE-2023-39710](CVE-2023/CVE-2023-397xx/CVE-2023-39710.json) (`2023-09-01T14:15:07.777`) -* [CVE-2023-23763](CVE-2023/CVE-2023-237xx/CVE-2023-23763.json) (`2023-09-01T15:15:07.620`) +* [CVE-2020-22612](CVE-2020/CVE-2020-226xx/CVE-2020-22612.json) (`2023-09-01T16:15:07.533`) +* [CVE-2022-3407](CVE-2022/CVE-2022-34xx/CVE-2022-3407.json) (`2023-09-01T17:15:07.463`) +* [CVE-2023-28366](CVE-2023/CVE-2023-283xx/CVE-2023-28366.json) (`2023-09-01T16:15:07.790`) +* [CVE-2023-36076](CVE-2023/CVE-2023-360xx/CVE-2023-36076.json) (`2023-09-01T16:15:07.857`) +* [CVE-2023-36088](CVE-2023/CVE-2023-360xx/CVE-2023-36088.json) (`2023-09-01T16:15:07.910`) +* [CVE-2023-36100](CVE-2023/CVE-2023-361xx/CVE-2023-36100.json) (`2023-09-01T16:15:07.967`) +* [CVE-2023-36187](CVE-2023/CVE-2023-361xx/CVE-2023-36187.json) (`2023-09-01T16:15:08.020`) +* [CVE-2023-36326](CVE-2023/CVE-2023-363xx/CVE-2023-36326.json) (`2023-09-01T16:15:08.077`) +* [CVE-2023-36327](CVE-2023/CVE-2023-363xx/CVE-2023-36327.json) (`2023-09-01T16:15:08.127`) +* [CVE-2023-36328](CVE-2023/CVE-2023-363xx/CVE-2023-36328.json) (`2023-09-01T16:15:08.177`) +* [CVE-2023-39582](CVE-2023/CVE-2023-395xx/CVE-2023-39582.json) (`2023-09-01T16:15:08.230`) +* [CVE-2023-39631](CVE-2023/CVE-2023-396xx/CVE-2023-39631.json) (`2023-09-01T16:15:08.370`) +* [CVE-2023-40771](CVE-2023/CVE-2023-407xx/CVE-2023-40771.json) (`2023-09-01T16:15:08.423`) +* [CVE-2023-40968](CVE-2023/CVE-2023-409xx/CVE-2023-40968.json) (`2023-09-01T16:15:08.473`) +* [CVE-2023-40980](CVE-2023/CVE-2023-409xx/CVE-2023-40980.json) (`2023-09-01T16:15:08.523`) +* [CVE-2023-4720](CVE-2023/CVE-2023-47xx/CVE-2023-4720.json) (`2023-09-01T16:15:08.577`) +* [CVE-2023-4721](CVE-2023/CVE-2023-47xx/CVE-2023-4721.json) (`2023-09-01T16:15:08.660`) +* [CVE-2023-4722](CVE-2023/CVE-2023-47xx/CVE-2023-4722.json) (`2023-09-01T16:15:08.737`) +* [CVE-2023-41627](CVE-2023/CVE-2023-416xx/CVE-2023-41627.json) (`2023-09-01T17:15:07.633`) +* [CVE-2023-41628](CVE-2023/CVE-2023-416xx/CVE-2023-41628.json) (`2023-09-01T17:15:07.690`) ### CVEs modified in the last Commit -Recently modified CVEs: `17` +Recently modified CVEs: `14` -* [CVE-2020-24165](CVE-2020/CVE-2020-241xx/CVE-2020-24165.json) (`2023-09-01T15:06:01.737`) -* [CVE-2023-32457](CVE-2023/CVE-2023-324xx/CVE-2023-32457.json) (`2023-09-01T14:00:35.670`) -* [CVE-2023-39562](CVE-2023/CVE-2023-395xx/CVE-2023-39562.json) (`2023-09-01T14:15:59.310`) -* [CVE-2023-39522](CVE-2023/CVE-2023-395xx/CVE-2023-39522.json) (`2023-09-01T14:19:59.620`) -* [CVE-2023-39968](CVE-2023/CVE-2023-399xx/CVE-2023-39968.json) (`2023-09-01T14:23:47.410`) -* [CVE-2023-3252](CVE-2023/CVE-2023-32xx/CVE-2023-3252.json) (`2023-09-01T14:34:15.777`) -* [CVE-2023-3253](CVE-2023/CVE-2023-32xx/CVE-2023-3253.json) (`2023-09-01T14:34:21.617`) -* [CVE-2023-33320](CVE-2023/CVE-2023-333xx/CVE-2023-33320.json) (`2023-09-01T14:34:31.330`) -* [CVE-2023-4649](CVE-2023/CVE-2023-46xx/CVE-2023-4649.json) (`2023-09-01T14:37:08.443`) -* [CVE-2023-0654](CVE-2023/CVE-2023-06xx/CVE-2023-0654.json) (`2023-09-01T14:43:59.927`) -* [CVE-2023-3251](CVE-2023/CVE-2023-32xx/CVE-2023-3251.json) (`2023-09-01T14:44:35.340`) -* [CVE-2023-4569](CVE-2023/CVE-2023-45xx/CVE-2023-4569.json) (`2023-09-01T14:47:12.983`) -* [CVE-2023-38970](CVE-2023/CVE-2023-389xx/CVE-2023-38970.json) (`2023-09-01T14:47:20.170`) -* [CVE-2023-4654](CVE-2023/CVE-2023-46xx/CVE-2023-4654.json) (`2023-09-01T14:48:51.433`) -* [CVE-2023-4651](CVE-2023/CVE-2023-46xx/CVE-2023-4651.json) (`2023-09-01T14:50:55.347`) -* [CVE-2023-39678](CVE-2023/CVE-2023-396xx/CVE-2023-39678.json) (`2023-09-01T14:56:42.557`) -* [CVE-2023-4542](CVE-2023/CVE-2023-45xx/CVE-2023-4542.json) (`2023-09-01T15:15:04.877`) +* [CVE-2018-25089](CVE-2018/CVE-2018-250xx/CVE-2018-25089.json) (`2023-09-01T17:25:13.760`) +* [CVE-2021-36978](CVE-2021/CVE-2021-369xx/CVE-2021-36978.json) (`2023-09-01T16:15:07.650`) +* [CVE-2022-27597](CVE-2022/CVE-2022-275xx/CVE-2022-27597.json) (`2023-09-01T17:10:13.670`) +* [CVE-2022-27598](CVE-2022/CVE-2022-275xx/CVE-2022-27598.json) (`2023-09-01T17:10:25.797`) +* [CVE-2023-39600](CVE-2023/CVE-2023-396xx/CVE-2023-39600.json) (`2023-09-01T16:15:08.287`) +* [CVE-2023-32559](CVE-2023/CVE-2023-325xx/CVE-2023-32559.json) (`2023-09-01T17:05:35.170`) +* [CVE-2023-40572](CVE-2023/CVE-2023-405xx/CVE-2023-40572.json) (`2023-09-01T17:07:35.057`) +* [CVE-2023-40573](CVE-2023/CVE-2023-405xx/CVE-2023-40573.json) (`2023-09-01T17:09:35.270`) +* [CVE-2023-23355](CVE-2023/CVE-2023-233xx/CVE-2023-23355.json) (`2023-09-01T17:10:05.397`) +* [CVE-2023-27604](CVE-2023/CVE-2023-276xx/CVE-2023-27604.json) (`2023-09-01T17:11:03.007`) +* [CVE-2023-3704](CVE-2023/CVE-2023-37xx/CVE-2023-3704.json) (`2023-09-01T17:12:08.027`) +* [CVE-2023-4230](CVE-2023/CVE-2023-42xx/CVE-2023-4230.json) (`2023-09-01T17:12:36.097`) +* [CVE-2023-40195](CVE-2023/CVE-2023-401xx/CVE-2023-40195.json) (`2023-09-01T17:14:19.163`) +* [CVE-2023-41028](CVE-2023/CVE-2023-410xx/CVE-2023-41028.json) (`2023-09-01T17:31:30.300`) ## Download and Usage