diff --git a/CVE-2023/CVE-2023-375xx/CVE-2023-37581.json b/CVE-2023/CVE-2023-375xx/CVE-2023-37581.json new file mode 100644 index 00000000000..10f8ec8014b --- /dev/null +++ b/CVE-2023/CVE-2023-375xx/CVE-2023-37581.json @@ -0,0 +1,32 @@ +{ + "id": "CVE-2023-37581", + "sourceIdentifier": "security@apache.org", + "published": "2023-08-06T08:15:09.013", + "lastModified": "2023-08-06T08:15:09.013", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms allows an authenticated user to perform an XSS attack. Mitigation: if you do not have Roller configured for untrusted users, then you need to do nothing because you trust your users to author raw HTML and other web content. If you are running with untrusted users then you should upgrade to Roller 6.1.2 and you should disable Roller's File Upload feature.?\n\n" + } + ], + "metrics": {}, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-20" + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/n9mjhhlm7z7b7to646tkvf3otkf21flp", + "source": "security@apache.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-41xx/CVE-2023-4179.json b/CVE-2023/CVE-2023-41xx/CVE-2023-4179.json new file mode 100644 index 00000000000..55e7cdea929 --- /dev/null +++ b/CVE-2023/CVE-2023-41xx/CVE-2023-4179.json @@ -0,0 +1,88 @@ +{ + "id": "CVE-2023-4179", + "sourceIdentifier": "cna@vuldb.com", + "published": "2023-08-06T08:15:09.113", + "lastModified": "2023-08-06T08:15:09.113", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability classified as critical has been found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected is an unknown function of the file /vm/doctor/doctors.php?action=view. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-236214 is the identifier assigned to this vulnerability." + } + ], + "metrics": { + "cvssMetricV30": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "3.0", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "LOW", + "baseScore": 6.3, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 3.4 + } + ], + "cvssMetricV2": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "2.0", + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", + "accessVector": "NETWORK", + "accessComplexity": "LOW", + "authentication": "SINGLE", + "confidentialityImpact": "PARTIAL", + "integrityImpact": "PARTIAL", + "availabilityImpact": "PARTIAL", + "baseScore": 6.5 + }, + "baseSeverity": "MEDIUM", + "exploitabilityScore": 8.0, + "impactScore": 6.4, + "acInsufInfo": false, + "obtainAllPrivilege": false, + "obtainUserPrivilege": false, + "obtainOtherPrivilege": false, + "userInteractionRequired": false + } + ] + }, + "weaknesses": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-89" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/Yesec/Free-Hospital-Management-System-for-Small-Practices/blob/main/SQL%20Injection%20in%20doctors.php/vuln.md", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?ctiid.236214", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?id.236214", + "source": "cna@vuldb.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-41xx/CVE-2023-4180.json b/CVE-2023/CVE-2023-41xx/CVE-2023-4180.json new file mode 100644 index 00000000000..38a445c544c --- /dev/null +++ b/CVE-2023/CVE-2023-41xx/CVE-2023-4180.json @@ -0,0 +1,88 @@ +{ + "id": "CVE-2023-4180", + "sourceIdentifier": "cna@vuldb.com", + "published": "2023-08-06T08:15:09.213", + "lastModified": "2023-08-06T08:15:09.213", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability classified as critical was found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this vulnerability is an unknown functionality of the file /vm/login.php. The manipulation of the argument useremail/userpassword leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-236215." + } + ], + "metrics": { + "cvssMetricV30": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "3.0", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "LOW", + "baseScore": 7.3, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 3.9, + "impactScore": 3.4 + } + ], + "cvssMetricV2": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "2.0", + "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", + "accessVector": "NETWORK", + "accessComplexity": "LOW", + "authentication": "NONE", + "confidentialityImpact": "PARTIAL", + "integrityImpact": "PARTIAL", + "availabilityImpact": "PARTIAL", + "baseScore": 7.5 + }, + "baseSeverity": "HIGH", + "exploitabilityScore": 10.0, + "impactScore": 6.4, + "acInsufInfo": false, + "obtainAllPrivilege": false, + "obtainUserPrivilege": false, + "obtainOtherPrivilege": false, + "userInteractionRequired": false + } + ] + }, + "weaknesses": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-89" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/Yesec/Free-Hospital-Management-System-for-Small-Practices/blob/main/SQL%20Injection%20in%20login.php/vuln.md", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?ctiid.236215", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?id.236215", + "source": "cna@vuldb.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-41xx/CVE-2023-4181.json b/CVE-2023/CVE-2023-41xx/CVE-2023-4181.json new file mode 100644 index 00000000000..6d54f1bbbe6 --- /dev/null +++ b/CVE-2023/CVE-2023-41xx/CVE-2023-4181.json @@ -0,0 +1,88 @@ +{ + "id": "CVE-2023-4181", + "sourceIdentifier": "cna@vuldb.com", + "published": "2023-08-06T09:15:09.513", + "lastModified": "2023-08-06T09:15:09.513", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability, which was classified as critical, has been found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this issue is some unknown functionality of the file /vm/admin/delete-doctor.php?id=2 of the component Redirect Handler. The manipulation leads to enforcement of behavioral workflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-236216." + } + ], + "metrics": { + "cvssMetricV30": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "3.0", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "LOW", + "baseScore": 5.4, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 2.5 + } + ], + "cvssMetricV2": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "2.0", + "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", + "accessVector": "NETWORK", + "accessComplexity": "LOW", + "authentication": "SINGLE", + "confidentialityImpact": "NONE", + "integrityImpact": "PARTIAL", + "availabilityImpact": "PARTIAL", + "baseScore": 5.5 + }, + "baseSeverity": "MEDIUM", + "exploitabilityScore": 8.0, + "impactScore": 4.9, + "acInsufInfo": false, + "obtainAllPrivilege": false, + "obtainUserPrivilege": false, + "obtainOtherPrivilege": false, + "userInteractionRequired": false + } + ] + }, + "weaknesses": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-841" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/Yesec/Free-Hospital-Management-System-for-Small-Practices/blob/main/vertical%20privilege%20escalation/vuln.md", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?ctiid.236216", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?id.236216", + "source": "cna@vuldb.com" + } + ] +} \ No newline at end of file diff --git a/README.md b/README.md index c67a7ab7764..98797f6cc95 100644 --- a/README.md +++ b/README.md @@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2023-08-06T08:00:26.086731+00:00 +2023-08-06T10:00:30.417764+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2023-08-06T07:15:42.107000+00:00 +2023-08-06T09:15:09.513000+00:00 ``` ### Last Data Feed Release @@ -29,14 +29,17 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/ ### Total Number of included CVEs ```plain -221728 +221732 ``` ### CVEs added in the last Commit -Recently added CVEs: `1` +Recently added CVEs: `4` -* [CVE-2023-4177](CVE-2023/CVE-2023-41xx/CVE-2023-4177.json) (`2023-08-06T07:15:42.107`) +* [CVE-2023-37581](CVE-2023/CVE-2023-375xx/CVE-2023-37581.json) (`2023-08-06T08:15:09.013`) +* [CVE-2023-4179](CVE-2023/CVE-2023-41xx/CVE-2023-4179.json) (`2023-08-06T08:15:09.113`) +* [CVE-2023-4180](CVE-2023/CVE-2023-41xx/CVE-2023-4180.json) (`2023-08-06T08:15:09.213`) +* [CVE-2023-4181](CVE-2023/CVE-2023-41xx/CVE-2023-4181.json) (`2023-08-06T09:15:09.513`) ### CVEs modified in the last Commit