mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-08 11:37:26 +00:00
Auto-Update: 2024-03-06T15:16:46.191626+00:00
This commit is contained in:
cad-safe-bot
parent
b96146f235
commit
4137c8140f
32
CVE-2023/CVE-2023-507xx/CVE-2023-50740.json
Normal file
32
CVE-2023/CVE-2023-507xx/CVE-2023-50740.json
Normal file
@ -0,0 +1,32 @@
|
||||
{
|
||||
"id": "CVE-2023-50740",
|
||||
"sourceIdentifier": "security@apache.org",
|
||||
"published": "2024-03-06T14:15:47.407",
|
||||
"lastModified": "2024-03-06T14:15:47.407",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module.\u00a0\nWe recommend users upgrade the version of Linkis to version 1.5.0\n"
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "security@apache.org",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-532"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://lists.apache.org/thread/5o342chnpyd6rps68ygzfkzycxl998yo",
|
||||
"source": "security@apache.org"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,12 +2,12 @@
|
||||
"id": "CVE-2024-21484",
|
||||
"sourceIdentifier": "report@snyk.io",
|
||||
"published": "2024-01-22T05:15:08.720",
|
||||
"lastModified": "2024-02-27T16:15:46.300",
|
||||
"lastModified": "2024-03-06T14:15:47.533",
|
||||
"vulnStatus": "Modified",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting this vulnerability. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key.\r\r Workaround \r\rThe vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library."
|
||||
"value": "Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. An attacker can decrypt ciphertexts by exploiting the Marvin security flaw. Exploiting this vulnerability requires the attacker to have access to a large number of ciphertexts encrypted with the same key.\r\r Workaround \r\rThe vulnerability can be mitigated by finding and replacing RSA and RSAOAEP decryption with another crypto library."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
|
||||
@ -2,12 +2,12 @@
|
||||
"id": "CVE-2024-21485",
|
||||
"sourceIdentifier": "report@snyk.io",
|
||||
"published": "2024-02-02T05:15:09.510",
|
||||
"lastModified": "2024-02-10T04:08:45.640",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-03-06T14:15:47.760",
|
||||
"vulnStatus": "Modified",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Versions of the package dash-core-components before 2.13.0; all versions of the package dash-core-components; versions of the package dash before 2.15.0; all versions of the package dash-html-components; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site Scripting (XSS) when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the data that's visible to another user who opens that view - not just the data already included on the page, but they could also, in theory, make additional requests and access other data accessible to this user. In some cases, they could also steal the access tokens of that user, which would allow the attacker to act as that user, including viewing other apps and resources hosted on the same server.\r\r**Note:**\r\rThis is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user."
|
||||
"value": "Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site Scripting (XSS) when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the data that's visible to another user who opens that view - not just the data already included on the page, but they could also, in theory, make additional requests and access other data accessible to this user. In some cases, they could also steal the access tokens of that user, which would allow the attacker to act as that user, including viewing other apps and resources hosted on the same server.\r\r**Note:**\r\rThis is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
|
||||
@ -2,12 +2,12 @@
|
||||
"id": "CVE-2024-21490",
|
||||
"sourceIdentifier": "report@snyk.io",
|
||||
"published": "2024-02-10T05:15:08.650",
|
||||
"lastModified": "2024-02-16T13:42:54.890",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-03-06T14:15:47.900",
|
||||
"vulnStatus": "Modified",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. \r\r\r**Note:**\r\rThis package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core)."
|
||||
"value": "This affects versions of the package angular from 1.3.0. A regular expression used to split the value of the ng-srcset directive is vulnerable to super-linear runtime due to backtracking. With large carefully-crafted input, this can result in catastrophic backtracking and cause a denial of service. \r\r\r**Note:**\r\rThis package is EOL and will not receive any updates to address this issue. Users should migrate to [@angular/core](https://www.npmjs.com/package/@angular/core)."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
@ -99,6 +99,14 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-6241746",
|
||||
"source": "report@snyk.io"
|
||||
},
|
||||
{
|
||||
"url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6241747",
|
||||
"source": "report@snyk.io"
|
||||
},
|
||||
{
|
||||
"url": "https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113",
|
||||
"source": "report@snyk.io",
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
"id": "CVE-2024-21491",
|
||||
"sourceIdentifier": "report@snyk.io",
|
||||
"published": "2024-02-13T05:15:08.873",
|
||||
"lastModified": "2024-02-13T14:01:07.747",
|
||||
"lastModified": "2024-03-06T14:15:48.020",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"descriptions": [
|
||||
{
|
||||
@ -21,20 +21,20 @@
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 6.8,
|
||||
"baseScore": 5.9,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.6,
|
||||
"impactScore": 5.2
|
||||
"impactScore": 4.2
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
@ -2,12 +2,16 @@
|
||||
"id": "CVE-2024-21501",
|
||||
"sourceIdentifier": "report@snyk.io",
|
||||
"published": "2024-02-24T05:15:44.310",
|
||||
"lastModified": "2024-02-26T13:42:22.567",
|
||||
"lastModified": "2024-03-06T14:15:48.343",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Las versiones del paquete sanitize-html anteriores a la 2.12.1 son vulnerables a la exposici\u00f3n de la informaci\u00f3n cuando se usan en el backend y con el atributo de estilo permitido, lo que permite la enumeraci\u00f3n de archivos en el sistema (incluidas las dependencias del proyecto). Un atacante podr\u00eda aprovechar esta vulnerabilidad para recopilar detalles sobre la estructura del sistema de archivos y las dependencias del servidor objetivo."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
@ -63,6 +67,10 @@
|
||||
"url": "https://github.com/apostrophecms/sanitize-html/pull/650",
|
||||
"source": "report@snyk.io"
|
||||
},
|
||||
{
|
||||
"url": "https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557",
|
||||
"source": "report@snyk.io"
|
||||
},
|
||||
{
|
||||
"url": "https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334",
|
||||
"source": "report@snyk.io"
|
||||
|
||||
22
README.md
22
README.md
@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
|
||||
### Last Repository Update
|
||||
|
||||
```plain
|
||||
2024-03-06T13:00:25.335903+00:00
|
||||
2024-03-06T15:16:46.191626+00:00
|
||||
```
|
||||
|
||||
### Most recent CVE Modification Timestamp synchronized with NVD
|
||||
|
||||
```plain
|
||||
2024-03-06T12:15:45.827000+00:00
|
||||
2024-03-06T14:15:48.343000+00:00
|
||||
```
|
||||
|
||||
### Last Data Feed Release
|
||||
@ -29,25 +29,25 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
|
||||
### Total Number of included CVEs
|
||||
|
||||
```plain
|
||||
240664
|
||||
240665
|
||||
```
|
||||
|
||||
### CVEs added in the last Commit
|
||||
|
||||
Recently added CVEs: `6`
|
||||
Recently added CVEs: `1`
|
||||
|
||||
* [CVE-2024-2211](CVE-2024/CVE-2024-22xx/CVE-2024-2211.json) (`2024-03-06T11:15:07.233`)
|
||||
* [CVE-2024-1224](CVE-2024/CVE-2024-12xx/CVE-2024-1224.json) (`2024-03-06T12:15:45.090`)
|
||||
* [CVE-2024-25102](CVE-2024/CVE-2024-251xx/CVE-2024-25102.json) (`2024-03-06T12:15:45.327`)
|
||||
* [CVE-2024-25103](CVE-2024/CVE-2024-251xx/CVE-2024-25103.json) (`2024-03-06T12:15:45.523`)
|
||||
* [CVE-2024-26580](CVE-2024/CVE-2024-265xx/CVE-2024-26580.json) (`2024-03-06T12:15:45.743`)
|
||||
* [CVE-2024-2005](CVE-2024/CVE-2024-20xx/CVE-2024-2005.json) (`2024-03-06T12:15:45.827`)
|
||||
* [CVE-2023-50740](CVE-2023/CVE-2023-507xx/CVE-2023-50740.json) (`2024-03-06T14:15:47.407`)
|
||||
|
||||
|
||||
### CVEs modified in the last Commit
|
||||
|
||||
Recently modified CVEs: `0`
|
||||
Recently modified CVEs: `5`
|
||||
|
||||
* [CVE-2024-21484](CVE-2024/CVE-2024-214xx/CVE-2024-21484.json) (`2024-03-06T14:15:47.533`)
|
||||
* [CVE-2024-21485](CVE-2024/CVE-2024-214xx/CVE-2024-21485.json) (`2024-03-06T14:15:47.760`)
|
||||
* [CVE-2024-21490](CVE-2024/CVE-2024-214xx/CVE-2024-21490.json) (`2024-03-06T14:15:47.900`)
|
||||
* [CVE-2024-21491](CVE-2024/CVE-2024-214xx/CVE-2024-21491.json) (`2024-03-06T14:15:48.020`)
|
||||
* [CVE-2024-21501](CVE-2024/CVE-2024-215xx/CVE-2024-21501.json) (`2024-03-06T14:15:48.343`)
|
||||
|
||||
|
||||
## Download and Usage
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user