From 4d83a86ca44f55b674172e745fc2a10cacfe0433 Mon Sep 17 00:00:00 2001 From: cad-safe-bot Date: Tue, 13 Feb 2024 07:00:28 +0000 Subject: [PATCH] Auto-Update: 2024-02-13T07:00:24.763665+00:00 --- CVE-2022/CVE-2022-486xx/CVE-2022-48623.json | 32 ++++++++++ CVE-2023/CVE-2023-524xx/CVE-2023-52431.json | 24 ++++++++ CVE-2024/CVE-2024-214xx/CVE-2024-21491.json | 67 +++++++++++++++++++++ CVE-2024/CVE-2024-259xx/CVE-2024-25914.json | 55 +++++++++++++++++ README.md | 26 +++----- 5 files changed, 186 insertions(+), 18 deletions(-) create mode 100644 CVE-2022/CVE-2022-486xx/CVE-2022-48623.json create mode 100644 CVE-2023/CVE-2023-524xx/CVE-2023-52431.json create mode 100644 CVE-2024/CVE-2024-214xx/CVE-2024-21491.json create mode 100644 CVE-2024/CVE-2024-259xx/CVE-2024-25914.json diff --git a/CVE-2022/CVE-2022-486xx/CVE-2022-48623.json b/CVE-2022/CVE-2022-486xx/CVE-2022-48623.json new file mode 100644 index 00000000000..e0391729c42 --- /dev/null +++ b/CVE-2022/CVE-2022-486xx/CVE-2022-48623.json @@ -0,0 +1,32 @@ +{ + "id": "CVE-2022-48623", + "sourceIdentifier": "cve@mitre.org", + "published": "2024-02-13T05:15:08.530", + "lastModified": "2024-02-13T05:15:08.530", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/briandfoy/cpan-security-advisory/blob/9374f98bef51e1ae887f293234050551c079776f/cpansa/CPANSA-Cpanel-JSON-XS.yml#L25-L36", + "source": "cve@mitre.org" + }, + { + "url": "https://github.com/rurban/Cpanel-JSON-XS/commit/41f32396eee9395a40f9ed80145c37622560de9b", + "source": "cve@mitre.org" + }, + { + "url": "https://github.com/rurban/Cpanel-JSON-XS/issues/208", + "source": "cve@mitre.org" + }, + { + "url": "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.33/changes", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-524xx/CVE-2023-52431.json b/CVE-2023/CVE-2023-524xx/CVE-2023-52431.json new file mode 100644 index 00000000000..59c1a13a11b --- /dev/null +++ b/CVE-2023/CVE-2023-524xx/CVE-2023-52431.json @@ -0,0 +1,24 @@ +{ + "id": "CVE-2023-52431", + "sourceIdentifier": "cve@mitre.org", + "published": "2024-02-13T05:15:08.797", + "lastModified": "2024-02-13T05:15:08.797", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "The Plack::Middleware::XSRFBlock package before 0.0.19 for Perl allows attackers to bypass a CSRF protection mechanism via an empty form value and an empty cookie (if signed cookies are disabled)." + } + ], + "metrics": {}, + "references": [ + { + "url": "https://github.com/briandfoy/cpan-security-advisory/blob/9374f98bef51e1ae887f293234050551c079776f/cpansa/CPANSA-Plack-Middleware-XSRFBlock.yml#L2-L15", + "source": "cve@mitre.org" + }, + { + "url": "https://metacpan.org/release/DAKKAR/Plack-Middleware-XSRFBlock-0.0.19/source/Changes", + "source": "cve@mitre.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-214xx/CVE-2024-21491.json b/CVE-2024/CVE-2024-214xx/CVE-2024-21491.json new file mode 100644 index 00000000000..446818c15be --- /dev/null +++ b/CVE-2024/CVE-2024-214xx/CVE-2024-21491.json @@ -0,0 +1,67 @@ +{ + "id": "CVE-2024-21491", + "sourceIdentifier": "report@snyk.io", + "published": "2024-02-13T05:15:08.873", + "lastModified": "2024-02-13T05:15:08.873", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures of different lengths are incorrectly compared. An attacker can bypass signature verification by providing a shorter signature that matches the beginning of the actual signature.\r\r**Note:**\r\rThe attacker would need to know a victim uses the Rust library for verification,no easy way to automatically check that; and uses webhooks by a service that uses Svix, and then figure out a way to craft a malicious payload that will actually include all of the correct identifiers needed to trick the receivers to cause actual issues." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "report@snyk.io", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE", + "baseScore": 6.8, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 1.6, + "impactScore": 5.2 + } + ] + }, + "weaknesses": [ + { + "source": "report@snyk.io", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-288" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/svix/svix-webhooks/commit/958821bd3b956d1436af65f70a0964d4ffb7daf6", + "source": "report@snyk.io" + }, + { + "url": "https://github.com/svix/svix-webhooks/pull/1190", + "source": "report@snyk.io" + }, + { + "url": "https://rustsec.org/advisories/RUSTSEC-2024-0010.html", + "source": "report@snyk.io" + }, + { + "url": "https://security.snyk.io/vuln/SNYK-RUST-SVIX-6230729", + "source": "report@snyk.io" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-259xx/CVE-2024-25914.json b/CVE-2024/CVE-2024-259xx/CVE-2024-25914.json new file mode 100644 index 00000000000..2eae54a6e8d --- /dev/null +++ b/CVE-2024/CVE-2024-259xx/CVE-2024-25914.json @@ -0,0 +1,55 @@ +{ + "id": "CVE-2024-25914", + "sourceIdentifier": "audit@patchstack.com", + "published": "2024-02-13T05:15:09.320", + "lastModified": "2024-02-13T05:15:09.320", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Cross-Site Request Forgery (CSRF) vulnerability in Photoboxone SMTP Mail.This issue affects SMTP Mail: from n/a through 1.3.20.\n\n" + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "audit@patchstack.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 4.3, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 1.4 + } + ] + }, + "weaknesses": [ + { + "source": "audit@patchstack.com", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-352" + } + ] + } + ], + "references": [ + { + "url": "https://patchstack.com/database/vulnerability/smtp-mail/wordpress-smtp-mail-plugin-1-3-20-cross-site-request-forgery-csrf-vulnerability?_s_id=cve", + "source": "audit@patchstack.com" + } + ] +} \ No newline at end of file diff --git a/README.md b/README.md index 175be6b2da7..665ecfd0d83 100644 --- a/README.md +++ b/README.md @@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2024-02-13T05:00:24.783317+00:00 +2024-02-13T07:00:24.763665+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2024-02-13T04:15:08.590000+00:00 +2024-02-13T05:15:09.320000+00:00 ``` ### Last Data Feed Release @@ -29,27 +29,17 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/ ### Total Number of included CVEs ```plain -238236 +238240 ``` ### CVEs added in the last Commit -Recently added CVEs: `14` +Recently added CVEs: `4` -* [CVE-2023-47218](CVE-2023/CVE-2023-472xx/CVE-2023-47218.json) (`2024-02-13T03:15:07.700`) -* [CVE-2023-50358](CVE-2023/CVE-2023-503xx/CVE-2023-50358.json) (`2024-02-13T03:15:07.963`) -* [CVE-2024-22130](CVE-2024/CVE-2024-221xx/CVE-2024-22130.json) (`2024-02-13T03:15:08.163`) -* [CVE-2024-22131](CVE-2024/CVE-2024-221xx/CVE-2024-22131.json) (`2024-02-13T03:15:08.363`) -* [CVE-2024-22132](CVE-2024/CVE-2024-221xx/CVE-2024-22132.json) (`2024-02-13T03:15:08.570`) -* [CVE-2024-24739](CVE-2024/CVE-2024-247xx/CVE-2024-24739.json) (`2024-02-13T03:15:08.780`) -* [CVE-2024-24740](CVE-2024/CVE-2024-247xx/CVE-2024-24740.json) (`2024-02-13T03:15:08.987`) -* [CVE-2024-24742](CVE-2024/CVE-2024-247xx/CVE-2024-24742.json) (`2024-02-13T03:15:09.187`) -* [CVE-2024-24743](CVE-2024/CVE-2024-247xx/CVE-2024-24743.json) (`2024-02-13T03:15:09.393`) -* [CVE-2024-25642](CVE-2024/CVE-2024-256xx/CVE-2024-25642.json) (`2024-02-13T03:15:09.613`) -* [CVE-2024-22024](CVE-2024/CVE-2024-220xx/CVE-2024-22024.json) (`2024-02-13T04:15:07.943`) -* [CVE-2024-22129](CVE-2024/CVE-2024-221xx/CVE-2024-22129.json) (`2024-02-13T04:15:08.133`) -* [CVE-2024-24741](CVE-2024/CVE-2024-247xx/CVE-2024-24741.json) (`2024-02-13T04:15:08.340`) -* [CVE-2024-25643](CVE-2024/CVE-2024-256xx/CVE-2024-25643.json) (`2024-02-13T04:15:08.590`) +* [CVE-2022-48623](CVE-2022/CVE-2022-486xx/CVE-2022-48623.json) (`2024-02-13T05:15:08.530`) +* [CVE-2023-52431](CVE-2023/CVE-2023-524xx/CVE-2023-52431.json) (`2024-02-13T05:15:08.797`) +* [CVE-2024-21491](CVE-2024/CVE-2024-214xx/CVE-2024-21491.json) (`2024-02-13T05:15:08.873`) +* [CVE-2024-25914](CVE-2024/CVE-2024-259xx/CVE-2024-25914.json) (`2024-02-13T05:15:09.320`) ### CVEs modified in the last Commit