admin/nvd-json-data-feeds
1
0
Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2025-05-07 11:07:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2024-11-04T19:00:20.374735+00:00

Browse Source
This commit is contained in:
cad-safe-bot 2024-11-04 19:03:21 +00:00
parent 4f60c2481e
commit 69ef8fe1b0
187 changed files with 3039 additions and 684 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
CVE-2014/CVE-2014-98xx/CVE-2014-9825.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2014-9825",
"sourceIdentifier": "cve@mitre.org",
"published": "2017-03-30T15:59:00.983",
"lastModified": "2017-04-10T22:31:05.007",
"lastModified": "2024-11-04T18:55:24.060",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@ -16,13 +16,13 @@
}
],
"metrics": {
"cvssMetricV30": [
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
@ -85,8 +85,9 @@
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagemagick:imagemagick:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6E6BE7A5-6FF7-4916-B671-9EE11CA54F65"
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.4-0",
"matchCriteriaId": "CFC2C780-A54E-4426-9C52-46A20216339E"
}
]
}

11
CVE-2014/CVE-2014-98xx/CVE-2014-9827.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2014-9827",
"sourceIdentifier": "cve@mitre.org",
"published": "2017-08-07T20:29:00.293",
"lastModified": "2017-08-08T16:22:13.923",
"lastModified": "2024-11-04T18:55:06.360",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@ -16,13 +16,13 @@
}
],
"metrics": {
"cvssMetricV30": [
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
@ -86,7 +86,8 @@
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE6EA542-A222-4E6A-869B-F3805CAFCDD0"
"versionEndExcluding": "6.9.4-0",
"matchCriteriaId": "CFC2C780-A54E-4426-9C52-46A20216339E"
}
]
}

11
CVE-2014/CVE-2014-98xx/CVE-2014-9828.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2014-9828",
"sourceIdentifier": "cve@mitre.org",
"published": "2017-08-07T20:29:00.323",
"lastModified": "2017-08-08T16:20:52.673",
"lastModified": "2024-11-04T18:53:21.077",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@ -16,13 +16,13 @@
}
],
"metrics": {
"cvssMetricV30": [
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
@ -86,7 +86,8 @@
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE6EA542-A222-4E6A-869B-F3805CAFCDD0"
"versionEndExcluding": "6.9.4-0",
"matchCriteriaId": "CFC2C780-A54E-4426-9C52-46A20216339E"
}
]
}

13
CVE-2014/CVE-2014-98xx/CVE-2014-9829.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2014-9829",
"sourceIdentifier": "cve@mitre.org",
"published": "2017-04-05T17:59:00.150",
"lastModified": "2017-05-09T12:40:33.057",
"lastModified": "2024-11-04T18:53:00.827",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@ -16,13 +16,13 @@
}
],
"metrics": {
"cvssMetricV30": [
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
@ -85,8 +85,9 @@
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagemagick:imagemagick:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6E6BE7A5-6FF7-4916-B671-9EE11CA54F65"
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.4-0",
"matchCriteriaId": "CFC2C780-A54E-4426-9C52-46A20216339E"
}
]
}

11
CVE-2014/CVE-2014-98xx/CVE-2014-9830.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2014-9830",
"sourceIdentifier": "cve@mitre.org",
"published": "2017-08-07T20:29:00.370",
"lastModified": "2017-08-08T16:28:54.523",
"lastModified": "2024-11-04T18:52:34.957",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@ -16,13 +16,13 @@
}
],
"metrics": {
"cvssMetricV30": [
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
@ -86,7 +86,8 @@
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE6EA542-A222-4E6A-869B-F3805CAFCDD0"
"versionEndExcluding": "6.9.4-0",
"matchCriteriaId": "CFC2C780-A54E-4426-9C52-46A20216339E"
}
]
}

11
CVE-2014/CVE-2014-98xx/CVE-2014-9831.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2014-9831",
"sourceIdentifier": "cve@mitre.org",
"published": "2017-08-07T20:29:00.403",
"lastModified": "2017-08-08T16:24:53.473",
"lastModified": "2024-11-04T18:50:14.833",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@ -16,13 +16,13 @@
}
],
"metrics": {
"cvssMetricV30": [
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
@ -86,7 +86,8 @@
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE6EA542-A222-4E6A-869B-F3805CAFCDD0"
"versionEndExcluding": "6.9.4-0",
"matchCriteriaId": "CFC2C780-A54E-4426-9C52-46A20216339E"
}
]
}

13
CVE-2014/CVE-2014-98xx/CVE-2014-9848.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2014-9848",
"sourceIdentifier": "cve@mitre.org",
"published": "2017-03-20T16:59:01.110",
"lastModified": "2018-10-30T16:27:37.467",
"lastModified": "2024-11-04T18:49:53.660",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@ -16,13 +16,13 @@
}
],
"metrics": {
"cvssMetricV30": [
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
@ -185,8 +185,9 @@
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagemagick:imagemagick:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6E6BE7A5-6FF7-4916-B671-9EE11CA54F65"
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.4-0",
"matchCriteriaId": "CFC2C780-A54E-4426-9C52-46A20216339E"
}
]
}

13
CVE-2014/CVE-2014-98xx/CVE-2014-9852.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2014-9852",
"sourceIdentifier": "cve@mitre.org",
"published": "2017-03-17T14:59:00.500",
"lastModified": "2018-10-30T16:27:37.467",
"lastModified": "2024-11-04T18:49:46.877",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@ -16,13 +16,13 @@
}
],
"metrics": {
"cvssMetricV30": [
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
@ -85,8 +85,9 @@
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagemagick:imagemagick:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6E6BE7A5-6FF7-4916-B671-9EE11CA54F65"
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.4-0",
"matchCriteriaId": "CFC2C780-A54E-4426-9C52-46A20216339E"
}
]
}

13
CVE-2014/CVE-2014-98xx/CVE-2014-9853.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2014-9853",
"sourceIdentifier": "cve@mitre.org",
"published": "2017-03-17T14:59:00.547",
"lastModified": "2018-10-30T16:27:37.467",
"lastModified": "2024-11-04T18:49:37.570",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@ -16,13 +16,13 @@
}
],
"metrics": {
"cvssMetricV30": [
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
@ -85,8 +85,9 @@
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagemagick:imagemagick:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6E6BE7A5-6FF7-4916-B671-9EE11CA54F65"
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.4-0",
"matchCriteriaId": "CFC2C780-A54E-4426-9C52-46A20216339E"
}
]
}

13
CVE-2014/CVE-2014-98xx/CVE-2014-9854.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2014-9854",
"sourceIdentifier": "cve@mitre.org",
"published": "2017-03-17T14:59:00.610",
"lastModified": "2018-10-30T16:27:37.717",
"lastModified": "2024-11-04T18:49:30.603",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@ -16,13 +16,13 @@
}
],
"metrics": {
"cvssMetricV30": [
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
@ -85,8 +85,9 @@
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagemagick:imagemagick:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6E6BE7A5-6FF7-4916-B671-9EE11CA54F65"
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.4-0",
"matchCriteriaId": "CFC2C780-A54E-4426-9C52-46A20216339E"
}
]
}

11
CVE-2014/CVE-2014-99xx/CVE-2014-9907.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2014-9907",
"sourceIdentifier": "security@debian.org",
"published": "2017-04-19T14:59:00.147",
"lastModified": "2017-05-09T12:40:25.760",
"lastModified": "2024-11-04T18:49:20.907",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@ -16,13 +16,13 @@
}
],
"metrics": {
"cvssMetricV30": [
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
@ -86,7 +86,8 @@
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE6EA542-A222-4E6A-869B-F3805CAFCDD0"
"versionEndExcluding": "6.9.4-0",
"matchCriteriaId": "CFC2C780-A54E-4426-9C52-46A20216339E"
}
]
}

24
CVE-2016/CVE-2016-101xx/CVE-2016-10144.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2016-10144",
"sourceIdentifier": "security@debian.org",
"published": "2017-03-24T15:59:00.403",
"lastModified": "2017-11-04T01:29:15.677",
"vulnStatus": "Modified",
"lastModified": "2024-11-04T18:48:46.350",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@ -16,13 +16,13 @@
}
],
"metrics": {
"cvssMetricV30": [
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
@ -86,7 +86,8 @@
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE6EA542-A222-4E6A-869B-F3805CAFCDD0"
"versionEndExcluding": "6.9.7-1",
"matchCriteriaId": "EBEF639E-3E7F-40F9-B624-B05E65A37E2C"
}
]
}
@ -96,7 +97,11 @@
"references": [
{
"url": "http://www.debian.org/security/2017/dsa-3799",
"source": "security@debian.org"
"source": "security@debian.org",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "http://www.openwall.com/lists/oss-security/2017/01/16/6",
@ -144,7 +149,10 @@
},
{
"url": "https://security.gentoo.org/glsa/201702-09",
"source": "security@debian.org"
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
]
}
]
}

24
CVE-2016/CVE-2016-101xx/CVE-2016-10145.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2016-10145",
"sourceIdentifier": "security@debian.org",
"published": "2017-03-24T15:59:00.433",
"lastModified": "2017-11-04T01:29:15.740",
"vulnStatus": "Modified",
"lastModified": "2024-11-04T18:45:24.470",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
@ -16,13 +16,13 @@
}
],
"metrics": {
"cvssMetricV30": [
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
@ -86,7 +86,8 @@
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE6EA542-A222-4E6A-869B-F3805CAFCDD0"
"versionEndExcluding": "6.9.7-1",
"matchCriteriaId": "EBEF639E-3E7F-40F9-B624-B05E65A37E2C"
}
]
}
@ -96,7 +97,11 @@
"references": [
{
"url": "http://www.debian.org/security/2017/dsa-3799",
"source": "security@debian.org"
"source": "security@debian.org",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "http://www.openwall.com/lists/oss-security/2017/01/16/6",
@ -144,7 +149,10 @@
},
{
"url": "https://security.gentoo.org/glsa/201702-09",
"source": "security@debian.org"
"source": "security@debian.org",
"tags": [
"Third Party Advisory"
]
}
]
}

13
CVE-2016/CVE-2016-75xx/CVE-2016-7532.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2016-7532",
"sourceIdentifier": "security@debian.org",
"published": "2017-04-20T18:59:01.310",
"lastModified": "2017-05-09T12:39:12.837",
"lastModified": "2024-11-04T18:55:38.580",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
@ -16,13 +16,13 @@
}
],
"metrics": {
"cvssMetricV30": [
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
@ -85,8 +85,9 @@
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:imagemagick:imagemagick:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6E6BE7A5-6FF7-4916-B671-9EE11CA54F65"
"criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.4-0",
"matchCriteriaId": "CFC2C780-A54E-4426-9C52-46A20216339E"
}
]
}

27
CVE-2021/CVE-2021-469xx/CVE-2021-46978.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2021-46978",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-02-28T09:15:37.183",
"lastModified": "2024-02-28T14:06:45.783",
"lastModified": "2024-11-04T18:35:00.933",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: KVM: nVMX: siempre intente asignar eVMCS despu\u00e9s de la migraci\u00f3n Cuando se utiliza VMCS iluminado y el estado anidado se migra con vmx_get_nested_state()/vmx_set_nested_state() KVM no puede asignar evmcs p\u00e1gina de inmediato: evmcs gpa no es 'struct kvm_vmx_nested_state_hdr' y no podemos leerlo desde la p\u00e1gina de asistencia de VP porque el espacio de usuario puede decidir restaurar HV_X64_MSR_VP_ASSIST_PAGE despu\u00e9s de restaurar el estado anidado (y QEMU, por ejemplo, hace exactamente eso). Para asegurarse de que eVMCS est\u00e9 asignado, /vmx_set_nested_state() genera la solicitud KVM_REQ_GET_NESTED_STATE_PAGES. el commit f2c7ef3ba955 (\"KVM: nSVM: cancelar KVM_REQ_GET_NESTED_STATE_PAGES en vmexit anidado\") agreg\u00f3 la limpieza KVM_REQ_GET_NESTED_STATE_PAGES a nested_vmx_vmexit() para asegurarse de que el mapa de bits del permiso MSR no se cambie cuando ocurre una salida inmediata de L2 a L1 justo despu\u00e9s de la migraci\u00f3n (causada por un evento pendiente, Por ejemplo). Desafortunadamente, en exactamente la misma situaci\u00f3n todav\u00eda necesitamos tener eVMCS mapeado para que nested_sync_vmcs12_to_shadow() refleje los cambios en VMCS12 a eVMCS. Como curita, restaure nested_get_evmcs_page() al borrar KVM_REQ_GET_NESTED_STATE_PAGES en nested_vmx_vmexit(). La \"soluci\u00f3n\" est\u00e1 lejos de ser ideal, ya que no podemos propagar f\u00e1cilmente posibles fallas e incluso si pudi\u00e9ramos, lo m\u00e1s probable es que ya sea demasiado tarde para hacerlo. Toda la idea 'KVM_REQ_GET_NESTED_STATE_PAGES' para mapear eVMCS despu\u00e9s de la migraci\u00f3n parece ser fr\u00e1gil ya que nos desviamos demasiado de la ruta 'nativa' cuando la carga de vmptr ocurre en vmx_set_nested_state()."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/200a45649ab7361bc80c70aebf7165b64f9a6c9f",

27
CVE-2021/CVE-2021-469xx/CVE-2021-46989.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2021-46989",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-02-28T09:15:37.687",
"lastModified": "2024-02-28T14:06:45.783",
"lastModified": "2024-11-04T17:35:01.073",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: hfsplus: evita la corrupci\u00f3n al reducir y truncar Creo que hay algunos problemas introducidos por el commit 31651c607151 (\"hfsplus: evita el punto muerto en el truncamiento de archivos\") HFS+ tiene registros de extensi\u00f3n que siempre contienen 8 extensiones. En caso de que el primer registro de extensi\u00f3n en el archivo de cat\u00e1logo se llene, se asignan nuevos registros desde el archivo de desbordamiento de extensiones. En caso de que se produzca un truncamiento reducido en la mitad de un registro de extensi\u00f3n que se ubica en un archivo de desbordamiento de extensiones, la l\u00f3gica en hfsplus_file_truncate() se cambi\u00f3 para que la llamada a hfs_brec_remove() ya no est\u00e9 protegida. La acci\u00f3n correcta ser\u00eda simplemente liberar las extensiones que exceden el nuevo tama\u00f1o dentro del registro de extensi\u00f3n llamando a hfsplus_free_extents() y luego verificar si se debe eliminar todo el registro de extensi\u00f3n. Sin embargo, dado que la guardia (blk_cnt > start) est\u00e1 ahora despu\u00e9s de la llamada a hfs_brec_remove(), esto tiene el efecto desafortunado de que el \u00faltimo registro de extensi\u00f3n coincidente se elimina incondicionalmente. Para reproducir este problema, cree un archivo que tenga al menos 10 extensiones y luego realice un truncamiento reducido hasta la mitad del \u00faltimo registro de extensi\u00f3n, de modo que el n\u00famero de extensiones restantes no sea menor o divisible por 8. Esto hace que el \u00faltimo registro de extensi\u00f3n ( 8 extensiones) para eliminarse por completo en lugar de truncarse a la mitad. Por tanto, esto provoca corrupci\u00f3n y p\u00e9rdida de datos. La soluci\u00f3n para esto es simplemente verificar si el nuevo final truncado est\u00e1 debajo del inicio de este registro de extensi\u00f3n, lo que hace que sea seguro eliminar el registro de extensi\u00f3n completo. Sin embargo, la llamada a hfs_brec_remove() no se puede mover a su lugar anterior ya que estamos eliminando ->tree_lock y puede provocar una condici\u00f3n de ejecuci\u00f3n y la invalidaci\u00f3n de la informaci\u00f3n almacenada en cach\u00e9, posiblemente corrompiendo los datos del nodo. Otro tema est\u00e1 relacionado con \u00e9ste. Al ingresar al bloque (blk_cnt > start) no mantenemos ->tree_lock. Salimos del bucle sin mantener el bloqueo, pero hfs_find_exit() lo desbloquea. No estoy seguro de si es posible que otra persona tome el bloqueo bajo nuestros pies, pero puede causar errores dif\u00edciles de depurar y desbloqueo prematuro. Aunque no exista ning\u00fan riesgo real, el bloqueo siempre debe mantenerse en equilibrio. Tomando as\u00ed el candado ahora justo antes del control."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/52dde855663e5db824af51db39b5757d2ef3e28a",

39
CVE-2021/CVE-2021-470xx/CVE-2021-47044.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2021-47044",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-02-28T09:15:40.173",
"lastModified": "2024-02-28T14:06:45.783",
"lastModified": "2024-11-04T17:35:01.323",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,42 @@
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: sched/fair: corrigi\u00f3 el desplazamiento fuera de los l\u00edmites en load_balance() Syzbot inform\u00f3 sobre varios casos en los que sd->nr_balance_failed puede crecer a valores mucho m\u00e1s altos de lo que uno esperar\u00eda. . Un load_balance() exitoso lo restablece a 0; uno fallido lo incrementa. Una vez que llegue a sd->cache_nice_tries + 3, esto *deber\u00eda* activar un saldo activo, que lo establecer\u00e1 en sd->cache_nice_tries+1 o lo restablecer\u00e1 a 0. Sin embargo, en caso de que el saldo est\u00e9 activo La tarea no puede ejecutarse en env->dst_cpu, entonces el incremento se realiza sin ninguna modificaci\u00f3n adicional. Esto podr\u00eda repetirse hasta la saciedad y explicar\u00eda los valores absurdamente altos informados por syzbot (86, 149). VincentG se\u00f1al\u00f3 que es valioso dejar que sd->cache_nice_tries crezca, por lo que el cambio en s\u00ed deber\u00eda corregirse. Eso significa evitar: \"\"\" Si el valor del operando derecho es negativo o es mayor o igual que el ancho del operando izquierdo promocionado, el comportamiento no est\u00e1 definido. \"\"\" Por lo tanto, debemos limitar el exponente de desplazamiento a BITS_PER_TYPE( typeof(lefthand)) - 1. Ech\u00e9 un vistazo a otros casos similares a trav\u00e9s de coccinelle: @expr@ position pos; expresi\u00f3n E1; expresi\u00f3n E2; @@ ( E1 >> E2@pos | E1 >> E2@pos ) @cst depende de expr@ posici\u00f3n pos; expresi\u00f3n expr.E1; cst constante; @@ ( E1 >> cst@pos | E1 << cst@pos ) @script:python depende de !cst@ pos << expr.pos; exp << expr.E2; @@ # Truco sucio para ignorar constexpr if exp.upper() != exp: coccilib.report.print_report(pos[0], \"Posible cambio de UB aqu\u00ed\") La \u00fanica otra coincidencia en kernel/sched es rq_clock_thermal() que emplea sched_thermal_decay_shift, y ese exponente ya est\u00e1 limitado a 10, por lo que ese est\u00e1 bien."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 2.5,
"impactScore": 5.2
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/2f3eab368e313dba35fc2f51ede778bf7b030b54",

27
CVE-2021/CVE-2021-471xx/CVE-2021-47130.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2021-47130",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-03-15T21:15:07.577",
"lastModified": "2024-03-17T22:38:29.433",
"lastModified": "2024-11-04T17:35:02.347",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: nvmet: soluci\u00f3n que libera p2pmem no asignado En caso de que se encuentre un dispositivo p2p pero el grupo p2p est\u00e9 vac\u00edo, el objetivo nvme todav\u00eda est\u00e1 intentando liberar el sgl del grupo p2p en lugar del sgl normal. pool y provocando un bloqueo (se llama a BUG()). En su lugar, asigne p2p_dev para la solicitud solo si se asign\u00f3 desde el grupo p2p. Este es el accidente que se provoc\u00f3: [domingo 30 de mayo 19:13:53 2021] ------------[ cortar aqu\u00ed ]------------ [domingo de mayo 30 19:13:53 2021] \u00a1ERROR del kernel en lib/genalloc.c:518! [domingo 30 de mayo 19:13:53 2021] c\u00f3digo de operaci\u00f3n no v\u00e1lido: 0000 [#1] SMP PTI... [domingo 30 de mayo 19:13:53 2021] ERROR del kernel en lib/genalloc.c:518. ... [dom 30 de mayo 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0 ... [dom 30 de mayo 19:13:53 2021] Seguimiento de llamadas: [dom 30 de mayo 19:13:53 2021 ] ------------[ cortar aqu\u00ed ]------------ [domingo 30 de mayo 19:13:53 2021] pci_free_p2pmem+0x2b/0x70 [domingo 30 de mayo 19 :13:53 2021] pci_p2pmem_free_sgl+0x4f/0x80 [domingo 30 de mayo 19:13:53 2021] nvmet_req_free_sgls+0x1e/0x80 [nvmet] [domingo 30 de mayo 19:13:53 2021] ERROR del kernel en lib/genalloc.c: 518! [dom 30 de mayo 19:13:53 2021] nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma] [dom 30 de mayo 19:13:53 2021] nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 4.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 0.8,
"impactScore": 3.6
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8a452d62e7cea3c8a2676a3b89a9118755a1a271",

27
CVE-2021/CVE-2021-472xx/CVE-2021-47271.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2021-47271",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-05-21T15:15:15.610",
"lastModified": "2024-05-21T16:54:26.047",
"lastModified": "2024-11-04T18:35:01.380",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: cdnsp: soluciona el problema de interbloqueo en cdnsp_thread_irq_handler. El parche corrige el siguiente problema cr\u00edtico causado por el interbloqueo que se detect\u00f3 durante las pruebas Clase NCM: smp: csd: se detect\u00f3 un bloqueo CSD que no responde ( #1) en CPU#0 smp: csd: el bloqueo CSD (#1) no responde. .... RIP: 0010:native_queued_spin_lock_slowpath+0x61/0x1d0 RSP: 0018:ffffbc494011cde0 EFLAGS: 00000002 RAX: 0000000000000101 RBX: ffff9ee8116b4a68 RCX: 0000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9ee8116b4658 RBP: ffffbc494011cde0 R08: 0000000000000001 R09: 00000000000000000 R 10: ffff9ee8116b4670 R11: 0000000000000000 R12: ffff9ee8116b4658 R13: ffff9ee8116b4670 R14: 00000000000000246 R15: ffff9ee8116b4658 CS: 0010 DS: 0 ES: 0000 CR0: 0000000080050033 CR2: 00007f7bcc41a830 CR3: 000000007a612003 CR4: 00000000001706e0 Seguimiento de llamadas: do_raw_spin_lock+0xc0/0xd0 _raw_spin_lock_irqsave + 0x95/0xa0 cdnsp_gadget_ep_queue.cold+0x88/0x107 [cdnsp_udc_pci] usb_ep_queue+0x35/0x110 eth_start_xmit+0x220/0x3d0 [u_ether] ncm_tx_timeout+0x34/0x40 [usb_f_ncm] ? ncm_free_inst+0x50/0x50 [usb_f_ncm] __hrtimer_run_queues+0xac/0x440 hrtimer_run_softirq+0x8c/0xb0 __do_softirq+0xcf/0x428 asm_call_irq_on_stack+0x12/0x20 +0x61/0x70 irq_exit_rcu+0xc1/0xd0 sysvec_apic_timer_interrupt+0x52/0xb0 asm_sysvec_apic_timer_interrupt+0x12 /0x20 RIP: 0010:do_raw_spin_trylock+0x18/0x40 RSP: 0018:ffffbc494138bda8 EFLAGS: 00000246 RAX: 00000000000000000 RBX: ffff9ee8116b4658 RCX: 0000000000000 000 RDX: 0000000000000001 RSI: 00000000000000000 RDI: ffff9ee8116b4658 RBP: ffffbc494138bda8 R08: 00000000000000001 R09: 0000000000000000 R10: ffff9ee8116b4670 R11 : 0000000000000000 R12: ffff9ee8116b4658 R13: ffff9ee8116b4670 R14: ffff9ee7b5c73d80 R15: ffff9ee8116b4000 _raw_spin_lock+0x3d/0x70 ? cdnsp_thread_irq_handler.cold+0x32/0x112c [cdnsp_udc_pci] cdnsp_thread_irq_handler.cold+0x32/0x112c [cdnsp_udc_pci] ? cdnsp_remove_request+0x1f0/0x1f0 [cdnsp_udc_pci] ? cdnsp_thread_irq_handler+0x5/0xa0 [cdnsp_udc_pci] ? irq_thread+0xa0/0x1c0 irq_thread_fn+0x28/0x60 irq_thread+0x105/0x1c0 ? __kthread_parkme+0x42/0x90 ? irq_forced_thread_fn+0x90/0x90? wake_threads_waitq+0x30/0x30? irq_thread_check_affinity+0xe0/0xe0 kthread+0x12a/0x160 ? kthread_park+0x90/0x90 ret_from_fork+0x22/0x30 La causa principal del problema es la instrucci\u00f3n spin_lock/spin_unlock en lugar de spin_lock_irqsave/spin_lock_irqrestore en la funci\u00f3n cdnsp_thread_irq_handler."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a9aecef198faae3240921b707bc09b602e966fce",

14
CVE-2021/CVE-2021-475xx/CVE-2021-47551.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2021-47551",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-05-24T15:15:19.927",
"lastModified": "2024-07-03T01:38:09.747",
"lastModified": "2024-11-04T18:35:01.610",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -39,6 +39,18 @@
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/06c6f8f86ec243b89e52f0c3dc7062bcb9de74df",

14
CVE-2023/CVE-2023-205xx/CVE-2023-20509.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2023-20509",
"sourceIdentifier": "psirt@amd.com",
"published": "2024-08-13T17:15:18.590",
"lastModified": "2024-08-14T02:07:05.410",
"lastModified": "2024-11-04T18:35:02.490",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -39,6 +39,18 @@
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html",

14
CVE-2023/CVE-2023-313xx/CVE-2023-31304.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2023-31304",
"sourceIdentifier": "psirt@amd.com",
"published": "2024-08-13T17:15:20.110",
"lastModified": "2024-08-14T02:07:05.410",
"lastModified": "2024-11-04T17:35:02.577",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -39,6 +39,18 @@
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-1284"
}
]
}
],
"references": [
{
"url": "https://www.amd.com/en/resources/product-security/bulletin/amd-sb-6005.html",

39
CVE-2023/CVE-2023-401xx/CVE-2023-40124.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2023-40124",
"sourceIdentifier": "security@android.com",
"published": "2024-02-15T23:15:08.743",
"lastModified": "2024-02-16T13:37:55.033",
"lastModified": "2024-11-04T17:35:03.337",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,42 @@
"value": "En varias ubicaciones, existe una posible lectura entre usuarios debido a un agente confundido. Esto podr\u00eda dar lugar a la divulgaci\u00f3n de informaci\u00f3n local de fotograf\u00edas u otras im\u00e1genes sin necesidad de privilegios de ejecuci\u00f3n adicionales. La interacci\u00f3n del usuario no es necesaria para la explotaci\u00f3n."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"references": [
{
"url": "https://android.googlesource.com/platform/frameworks/base/+/86c8421c1181816b6cb333eb62a78e32290c4b17",

39
CVE-2023/CVE-2023-428xx/CVE-2023-42823.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2023-42823",
"sourceIdentifier": "product-security@apple.com",
"published": "2024-02-21T07:15:47.540",
"lastModified": "2024-02-22T19:07:37.840",
"lastModified": "2024-11-04T17:35:04.180",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,42 @@
"value": "El problema se resolvi\u00f3 sanitizando el registro. Este problema se solucion\u00f3 en watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 y iPadOS 16.7.2, iOS 17.1 y iPadOS 17.1, macOS Ventura 13.6.1. Es posible que una aplicaci\u00f3n pueda acceder a datos confidenciales del usuario."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"baseSeverity": "LOW"
},
"exploitabilityScore": 1.2,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-922"
}
]
}
],
"references": [
{
"url": "https://support.apple.com/en-us/HT213981",

39
CVE-2023/CVE-2023-428xx/CVE-2023-42843.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2023-42843",
"sourceIdentifier": "product-security@apple.com",
"published": "2024-02-21T07:15:48.940",
"lastModified": "2024-05-07T06:15:06.573",
"lastModified": "2024-11-04T17:35:05.077",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,42 @@
"value": "Se solucion\u00f3 un problema de interfaz de usuario inconsistente con una gesti\u00f3n de estado mejorada. Este problema se solucion\u00f3 en iOS 16.7.2 y iPadOS 16.7.2, iOS 17.1 y iPadOS 17.1, Safari 17.1, macOS Sonoma 14.1. Visitar un sitio web malicioso puede provocar una suplantaci\u00f3n de la barra de direcciones."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-290"
}
]
}
],
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2024/03/26/1",

39
CVE-2023/CVE-2023-462xx/CVE-2023-46294.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2023-46294",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-05-01T20:15:12.267",
"lastModified": "2024-05-02T13:27:25.103",
"lastModified": "2024-11-04T17:35:06.003",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,42 @@
"value": "Se descubri\u00f3 un problema en Teledyne FLIR M300 2.00-19. Las contrase\u00f1as de las cuentas de usuario se cifran localmente y se pueden descifrar en contrase\u00f1as de texto plano mediante la utilidad umSetup. Esta utilidad requiere permisos de root para ejecutarse."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 3.4,
"baseSeverity": "LOW"
},
"exploitabilityScore": 0.8,
"impactScore": 2.5
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-312"
}
]
}
],
"references": [
{
"url": "https://Loudmouth.io",

39
CVE-2023/CVE-2023-48xx/CVE-2023-4826.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2023-4826",
"sourceIdentifier": "contact@wpscan.com",
"published": "2024-02-23T10:15:07.680",
"lastModified": "2024-02-23T16:14:43.447",
"lastModified": "2024-11-04T17:35:07.100",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,42 @@
"value": "El tema SocialDriver de WordPress anterior a la versi\u00f3n 2024 tiene un prototipo de vulnerabilidad de contaminaci\u00f3n que podr\u00eda permitir a un atacante inyectar propiedades arbitrarias, lo que resultar\u00eda en un ataque de cross site scripting (XSS)."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "http://socialdriver.com",

39
CVE-2023/CVE-2023-523xx/CVE-2023-52343.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2023-52343",
"sourceIdentifier": "security@unisoc.com",
"published": "2024-04-08T03:15:08.363",
"lastModified": "2024-04-08T18:48:40.217",
"lastModified": "2024-11-04T17:35:08.043",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,42 @@
"value": "En el mensaje SecurityCommand despu\u00e9s de que se haya activado la seguridad, existe una posible validaci\u00f3n de entrada incorrecta. Esto podr\u00eda conducir a la divulgaci\u00f3n remota de informaci\u00f3n, sin necesidad de privilegios de ejecuci\u00f3n adicionales."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:L",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 5.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 0.7,
"impactScore": 4.7
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-1284"
}
]
}
],
"references": [
{
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1777143682512781313",

39
CVE-2023/CVE-2023-523xx/CVE-2023-52346.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2023-52346",
"sourceIdentifier": "security@unisoc.com",
"published": "2024-04-08T03:15:08.503",
"lastModified": "2024-04-08T18:48:40.217",
"lastModified": "2024-11-04T18:35:03.567",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,42 @@
"value": "En el controlador del m\u00f3dem, existe una posible falla del sistema debido a una validaci\u00f3n de entrada incorrecta. Esto podr\u00eda conducir a la divulgaci\u00f3n de informaci\u00f3n local con privilegios de ejecuci\u00f3n del System necesarios."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 0.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-120"
}
]
}
],
"references": [
{
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1777143682512781313",

27
CVE-2023/CVE-2023-525xx/CVE-2023-52561.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2023-52561",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-03-02T22:15:48.803",
"lastModified": "2024-03-04T13:58:23.447",
"lastModified": "2024-11-04T18:35:04.423",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: arm64: dts: qcom: sdm845-db845c: marcar la regi\u00f3n de memoria de inicio continua como reservada Agregar una regi\u00f3n de memoria reservada para la memoria framebuffer (la regi\u00f3n de memoria de inicio configurada por el gestor de arranque). Soluciona un problema de p\u00e1nico en el kernel (arm-smmu: fallo de contexto no controlado en esta regi\u00f3n de memoria en particular) informado en DB845c que ejecuta v5.10.y."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/110e70fccce4f22b53986ae797d665ffb1950aa6",

27
CVE-2023/CVE-2023-526xx/CVE-2023-52623.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2023-52623",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-03-26T18:15:08.930",
"lastModified": "2024-11-04T13:16:42.057",
"lastModified": "2024-11-04T17:35:08.873",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: SUNRPC: corrija una advertencia de uso sospechoso de RCU Recib\u00ed la siguiente advertencia mientras ejecutaba cthon en un servidor ontap que ejecutaba pNFS: [ 57.202521] ============ ================= [ 57.202522] ADVERTENCIA: uso sospechoso de RCU [ 57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 No contaminado [ 57.202525] -------- --------------------- [ 57.202525] net/sunrpc/xprtmultipath.c:349 \u00a1\u00a1Lista de RCU atravesada en la secci\u00f3n que no es de lectura!! [57.202527] otra informaci\u00f3n que podr\u00eda ayudarnos a depurar esto: [57.202528] rcu_scheduler_active = 2, debug_locks = 1 [57.202529] no hay bloqueos retenidos por test5/3567. [ 57.202530] seguimiento de pila: [ 57.202532] CPU: 0 PID: 3567 Comm: test5 No contaminado 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e [ 57.20253 4] Nombre del hardware: PC est\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS desconocido 2 /2/2022 [ 57.202536] Seguimiento de llamadas: [ 57.202537] [ 57.202540] dump_stack_lvl+0x77/0xb0 [ 57.202551] lockdep_rcu_suspicious+0x154/0x1a0 [ 57.202556] rpc_xprt_sw itch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202596] rpc_clnt_setup_test_and_add_xprt+0x50 /0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202621] ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202646] rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d 98e71675af20c19bdb1f6] [57.202671]? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6] [ 57.202696] nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c71 6d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202728] ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202754] nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e 3a4187f18ae8a27b630f9feae6831b584a9360a] [ 57.202760] filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a] [ 57.202765] pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202788] __nfs_pageio_add_request+ 0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202813] nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965 514a828e6902] [ 57.202831] nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202849] nfs_writepages_callback+0x13/0x30 [n fs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202866] write_cache_pages+0x265/ 0x450 [57.202870]? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202891] nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f 5a0aeb4965514a828e6902] [ 57.202913] do_writepages+0xd2/0x230 [ 57.202917] ? filemap_fdatawrite_wbc+0x5c/0x80 [ 57.202921] filemap_fdatawrite_wbc+0x67/0x80 [ 57.202924] filemap_write_and_wait_range+0xd9/0x170 [ 57.202930] nfs_wb_all+0x49/0x180 [nfs 6c97 6fa593a7c2976f5a0aeb4965514a828e6902] [ 57.202947] nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9] [ 57.202969] __se_s ys_cerrar+ 0x46/0xd0 [57.202972] do_syscall_64+0x68/0x100 [57.202975]? do_syscall_64+0x77/0x100 [57.202976]? do_syscall_64+0x77/0x100 [ 57.202979] Entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 57.202982] RIP: 0033:0x7fe2b12e4a94 [ 57.202985] C\u00f3digo: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3 [ 57.202987] RSP : 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 00000000000000003 [ 57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94 [ 57.202991] RDX: 00000000 00002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003 [ 57.202992] RBP: 00007ffe857dfc50 R08: 7ffffffffffffffff R09: 0000000065650f49 [ 57.202993] R10 : 00007f -- -truncado---"
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/31b62908693c90d4d07db597e685d9f25a120073",

27
CVE-2023/CVE-2023-526xx/CVE-2023-52627.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2023-52627",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-03-26T18:15:09.140",
"lastModified": "2024-11-04T13:16:42.313",
"lastModified": "2024-11-04T17:35:09.073",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: iio: adc: ad7091r: permitir a los usuarios configurar eventos de dispositivo Los dispositivos AD7091R-5 son compatibles con el controlador ad7091r-5 junto con el controlador ad7091r-base. Esos controladores declararon eventos iio para notificar al espacio del usuario cuando las lecturas de ADC caen por debajo de los umbrales de los registros de l\u00edmite bajo o por encima de los valores establecidos en los registros de l\u00edmite alto. Sin embargo, para configurar los eventos de iio y sus umbrales, se debe implementar un conjunto de funciones de devoluci\u00f3n de llamada que no estaban presentes hasta ahora. La consecuencia de intentar configurar eventos ad7091r-5 sin las funciones de devoluci\u00f3n de llamada adecuadas fue una desreferencia del puntero nulo en el kernel porque los punteros a las funciones de devoluci\u00f3n de llamada no estaban configurados. Implemente devoluciones de llamadas de configuraci\u00f3n de eventos que permitan a los usuarios leer/escribir umbrales de eventos y habilitar/deshabilitar la generaci\u00f3n de eventos. Dado que las estructuras de especificaciones de eventos son gen\u00e9ricas para los dispositivos AD7091R, tambi\u00e9n mueva las del controlador ad7091r-5 al controlador base para que puedan reutilizarse cuando se agregue soporte para ad7091r-2/-4/-8."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/020e71c7ffc25dfe29ed9be6c2d39af7bd7f661f",

4
CVE-2024/CVE-2024-100xx/CVE-2024-10035.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10035",
"sourceIdentifier": "iletisim@usom.gov.tr",
"published": "2024-11-04T12:16:08.880",
"lastModified": "2024-11-04T12:16:08.880",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [
{
"sourceIdentifier": "iletisim@usom.gov.tr",

20
CVE-2024/CVE-2024-100xx/CVE-2024-10041.json
View File

@ -2,13 +2,17 @@
"id": "CVE-2024-10041",
"sourceIdentifier": "secalert@redhat.com",
"published": "2024-10-23T14:15:03.970",
"lastModified": "2024-10-23T15:12:34.673",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2024-11-04T17:35:09.270",
"vulnStatus": "Undergoing Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."
},
{
"lang": "es",
"value": "Se encontr\u00f3 una vulnerabilidad en PAM. La informaci\u00f3n secreta se almacena en la memoria, donde el atacante puede hacer que el programa v\u00edctima se ejecute enviando caracteres a su entrada est\u00e1ndar (stdin). Mientras esto ocurre, el atacante puede entrenar al predictor de bifurcaciones para que ejecute una cadena ROP de manera especulativa. Esta falla podr\u00eda provocar la filtraci\u00f3n de contrase\u00f1as, como las que se encuentran en /etc/shadow mientras se realizan autenticaciones."
}
],
"metrics": {
@ -35,6 +39,18 @@
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-922"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2024-10041",

4
CVE-2024/CVE-2024-103xx/CVE-2024-10389.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10389",
"sourceIdentifier": "cve-coordination@google.com",
"published": "2024-11-04T11:15:04.647",
"lastModified": "2024-11-04T16:35:03.007",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-105xx/CVE-2024-10523.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10523",
"sourceIdentifier": "vdisclose@cert-in.org.in",
"published": "2024-11-04T12:16:09.217",
"lastModified": "2024-11-04T12:16:09.217",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-107xx/CVE-2024-10750.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10750",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-11-04T02:15:14.667",
"lastModified": "2024-11-04T02:15:14.667",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-107xx/CVE-2024-10751.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10751",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-11-04T02:15:14.993",
"lastModified": "2024-11-04T02:15:14.993",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-107xx/CVE-2024-10752.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10752",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-11-04T02:15:15.310",
"lastModified": "2024-11-04T13:17:04.067",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-107xx/CVE-2024-10753.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10753",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-11-04T02:15:15.613",
"lastModified": "2024-11-04T02:15:15.613",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-107xx/CVE-2024-10754.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10754",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-11-04T03:15:03.513",
"lastModified": "2024-11-04T03:15:03.513",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-107xx/CVE-2024-10755.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10755",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-11-04T03:15:03.800",
"lastModified": "2024-11-04T03:15:03.800",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-107xx/CVE-2024-10756.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10756",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-11-04T03:15:04.107",
"lastModified": "2024-11-04T03:15:04.107",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-107xx/CVE-2024-10757.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10757",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-11-04T03:15:04.400",
"lastModified": "2024-11-04T03:15:04.400",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-107xx/CVE-2024-10758.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10758",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-11-04T04:15:02.970",
"lastModified": "2024-11-04T04:15:02.970",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-107xx/CVE-2024-10759.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10759",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-11-04T04:15:03.273",
"lastModified": "2024-11-04T04:15:03.273",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-107xx/CVE-2024-10760.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10760",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-11-04T05:15:03.810",
"lastModified": "2024-11-04T05:15:03.810",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-107xx/CVE-2024-10761.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10761",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-11-04T05:15:04.693",
"lastModified": "2024-11-04T07:15:06.913",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-107xx/CVE-2024-10764.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10764",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-11-04T16:15:04.497",
"lastModified": "2024-11-04T16:15:04.497",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-107xx/CVE-2024-10765.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-10765",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-11-04T16:15:04.890",
"lastModified": "2024-11-04T16:15:04.890",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

145
CVE-2024/CVE-2024-107xx/CVE-2024-10766.json Normal file
View File

@ -0,0 +1,145 @@
{
"id": "CVE-2024-10766",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-11-04T18:15:04.330",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as critical, has been found in Codezips Free Exam Hall Seating Management System 1.0. This issue affects some unknown processing of the file /pages/save_user.php. The manipulation of the argument image leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher disclosure contains confusing vulnerability classes and file names."
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnerableSystemConfidentiality": "LOW",
"vulnerableSystemIntegrity": "LOW",
"vulnerableSystemAvailability": "LOW",
"subsequentSystemConfidentiality": "NONE",
"subsequentSystemIntegrity": "NONE",
"subsequentSystemAvailability": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirements": "NOT_DEFINED",
"integrityRequirements": "NOT_DEFINED",
"availabilityRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnerableSystemConfidentiality": "NOT_DEFINED",
"modifiedVulnerableSystemIntegrity": "NOT_DEFINED",
"modifiedVulnerableSystemAvailability": "NOT_DEFINED",
"modifiedSubsequentSystemConfidentiality": "NOT_DEFINED",
"modifiedSubsequentSystemIntegrity": "NOT_DEFINED",
"modifiedSubsequentSystemAvailability": "NOT_DEFINED",
"safety": "NOT_DEFINED",
"automatable": "NOT_DEFINED",
"recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
}
],
"cvssMetricV31": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "cna@vuldb.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-266"
},
{
"lang": "en",
"value": "CWE-284"
},
{
"lang": "en",
"value": "CWE-434"
}
]
}
],
"references": [
{
"url": "https://github.com/Charlotte008/cve/issues/3",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?ctiid.282953",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?id.282953",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?submit.436478",
"source": "cna@vuldb.com"
}
]
}

4
CVE-2024/CVE-2024-201xx/CVE-2024-20104.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20104",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:15.940",
"lastModified": "2024-11-04T11:35:00.850",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20106.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20106",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:16.070",
"lastModified": "2024-11-04T11:35:01.303",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20107.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20107",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:16.163",
"lastModified": "2024-11-04T11:35:01.503",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20108.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20108",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:16.273",
"lastModified": "2024-11-04T11:35:01.713",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20109.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20109",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:16.387",
"lastModified": "2024-11-04T11:35:01.923",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20110.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20110",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:16.480",
"lastModified": "2024-11-04T11:35:02.163",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20111.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20111",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:16.567",
"lastModified": "2024-11-04T02:15:16.567",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20112.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20112",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:16.653",
"lastModified": "2024-11-04T11:35:02.463",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20113.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20113",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:16.743",
"lastModified": "2024-11-04T11:35:02.667",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20114.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20114",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:16.830",
"lastModified": "2024-11-04T02:15:16.830",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20115.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20115",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:16.923",
"lastModified": "2024-11-04T11:35:02.960",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20117.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20117",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:17.017",
"lastModified": "2024-11-04T11:35:03.160",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20118.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20118",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:17.097",
"lastModified": "2024-11-04T11:35:03.373",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20119.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20119",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:17.190",
"lastModified": "2024-11-04T11:35:03.570",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20120.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20120",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:17.280",
"lastModified": "2024-11-04T11:35:03.770",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20121.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20121",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:17.383",
"lastModified": "2024-11-04T11:35:03.967",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20122.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20122",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:17.473",
"lastModified": "2024-11-04T02:15:17.473",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20123.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20123",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:17.567",
"lastModified": "2024-11-04T11:35:04.170",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-201xx/CVE-2024-20124.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-20124",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-11-04T02:15:17.647",
"lastModified": "2024-11-04T11:35:04.363",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

34
CVE-2024/CVE-2024-222xx/CVE-2024-22255.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-22255",
"sourceIdentifier": "security@vmware.com",
"published": "2024-03-05T18:15:48.277",
"lastModified": "2024-03-05T18:50:18.333",
"lastModified": "2024-11-04T18:35:06.477",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -36,9 +36,41 @@
},
"exploitabilityScore": 2.5,
"impactScore": 4.0
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 2.5,
"impactScore": 4.0
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
}
],
"references": [
{
"url": "https://www.vmware.com/security/advisories/VMSA-2024-0006.html",

4
CVE-2024/CVE-2024-233xx/CVE-2024-23377.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-23377",
"sourceIdentifier": "product-security@qualcomm.com",
"published": "2024-11-04T10:15:04.100",
"lastModified": "2024-11-04T10:15:04.100",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-233xx/CVE-2024-23385.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-23385",
"sourceIdentifier": "product-security@qualcomm.com",
"published": "2024-11-04T10:15:04.500",
"lastModified": "2024-11-04T10:15:04.500",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-233xx/CVE-2024-23386.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-23386",
"sourceIdentifier": "product-security@qualcomm.com",
"published": "2024-11-04T10:15:04.760",
"lastModified": "2024-11-04T10:15:04.760",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-235xx/CVE-2024-23590.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-23590",
"sourceIdentifier": "security@apache.org",
"published": "2024-11-04T10:15:04.990",
"lastModified": "2024-11-04T10:15:04.990",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

27
CVE-2024/CVE-2024-266xx/CVE-2024-26666.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-26666",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-04-02T07:15:43.500",
"lastModified": "2024-04-02T12:50:42.233",
"lastModified": "2024-11-04T17:35:11.477",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: wifi: mac80211: corrige el uso de RCU en TDLS fast-xmit Esto busca el enlace bajo protecci\u00f3n de RCU, pero no se garantiza que realmente tenga protecci\u00f3n. Arregla eso."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9480adfe4e0f0319b9da04b44e4eebd5ad07e0cd",

39
CVE-2024/CVE-2024-267xx/CVE-2024-26758.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-26758",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-04-03T17:15:52.263",
"lastModified": "2024-04-03T17:24:18.150",
"lastModified": "2024-11-04T18:35:07.610",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,42 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: md: No ignorar la matriz suspendida en md_check_recovery() mddev_suspend() nunca detiene sync_thread, por lo tanto, no tiene sentido ignorar la matriz suspendida en md_check_recovery(), lo que podr\u00eda causar sync_thread no se puede cancelar el registro. Despu\u00e9s de commit f52f5c71f3d4 (\"md: arreglar la detenci\u00f3n del hilo de sincronizaci\u00f3n\"), el siguiente bloqueo se puede activar mediante test shell/integrity-caching.sh: 1) suspender la matriz: raid_postsuspend mddev_suspend 2) detener la matriz: raid_dtr md_stop __md_stop_writes stop_sync_thread set_bit(MD_RECOVERY_INTR , &mddev->recuperaci\u00f3n); md_wakeup_thread_directly(mddev->sync_thread); wait_event(..., !test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)) 3) hilo de sincronizaci\u00f3n realizado: md_do_sync set_bit(MD_RECOVERY_DONE, &mddev->recovery); md_wakeup_thread(mddev->thread); 4) el hilo del demonio no puede cancelar el registro del hilo de sincronizaci\u00f3n: md_check_recovery si (mddev->suspended) regresa; -> devolver directamente md_read_sync_thread clear_bit(MD_RECOVERY_RUNNING, &mddev->recovery); -> MD_RECOVERY_RUNNING no se puede borrar, por lo tanto el paso 2 se bloquea; Este problema no solo est\u00e1 relacionado con dm-raid; solucionelo ignorando la matriz suspendida en md_check_recovery(). Y los parches de seguimiento mejorar\u00e1n mejor dm-raid para congelar el hilo de sincronizaci\u00f3n durante la suspensi\u00f3n."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-129"
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/1baae052cccd08daf9a9d64c3f959d8cdb689757",

39
CVE-2024/CVE-2024-267xx/CVE-2024-26786.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-26786",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-04-04T09:15:08.247",
"lastModified": "2024-04-04T12:48:41.700",
"lastModified": "2024-11-04T17:35:11.680",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,42 @@
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: iommufd: corrige el error de sobrescritura de iopt_access_list_id Syzkaller inform\u00f3 lo siguiente WARN_ON: ADVERTENCIA: CPU: 1 PID: 4738 en drivers/iommu/iommufd/io_pagetable.c:1360 Seguimiento de llamadas: iommufd_access_change_ioas+0x2fe /0x4e0 iommufd_access_destroy_object+0x50/0xb0 iommufd_object_remove+0x2a3/0x490 iommufd_object_destroy_user iommufd_access_destroy+0x71/0xb0 iommufd_test_staccess_release+0x89/0xd0 __fput+0x272/0x b50 __fput_sync+0x4b/0x60 __do_sys_close __se_sys_close __x64_sys_close+0x8b/0x110 do_syscall_x64 La falta de coincidencia entre el puntero de acceso en la lista y el puntero pasado resulta de una sobrescritura de acceso->iopt_access_list_id, en iopt_add_access(). Llamado desde iommufd_access_change_ioas() cuando xa_alloc() tiene \u00e9xito pero iopt_calculate_iova_alignment() falla. Agregue un new_id en iopt_add_access() y actualice solo iopt_access_list_id cuando regrese exitosamente."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-476"
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/9526a46cc0c378d381560279bea9aa34c84298a0",

27
CVE-2024/CVE-2024-269xx/CVE-2024-26956.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-26956",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-05-01T06:15:11.837",
"lastModified": "2024-06-27T13:15:57.290",
"lastModified": "2024-11-04T17:35:12.510",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nilfs2: corrige el error al detectar da\u00f1os en DAT en btree y asignaciones directas Serie de parches \"nilfs2: corrige el error del kernel en submit_bh_wbc()\". Esto resuelve un ERROR del kernel informado por syzbot. Dado que hay dos fallas involucradas, hice un parche para cada uno por separado. El primer parche por s\u00ed solo resuelve el error reportado por syzbot, pero creo que ambas correcciones deber\u00edan enviarse a estable, as\u00ed que las etiquet\u00e9 como tales. Este parche (de 2): Syzbot ha informado de un error en el kernel en submit_bh_wbc() al escribir datos de archivos en un sistema de archivos nilfs2 cuyos metadatos est\u00e1n da\u00f1ados. Hay dos errores involucrados en este tema. El primer defecto es que cuando nilfs_get_block() localiza un bloque de datos usando btree o mapeo directo, si la rutina de traducci\u00f3n de direcciones de disco nilfs_dat_translate() falla con el c\u00f3digo interno -ENOENT debido a la corrupci\u00f3n de los metadatos DAT, se puede devolver a nilfs_get_block(). Esto hace que nilfs_get_block() identifique err\u00f3neamente un bloque existente como inexistente, lo que provoca que tanto la b\u00fasqueda como la inserci\u00f3n del bloque de datos fallen de manera inconsistente. El segundo defecto es que nilfs_get_block() devuelve un estado exitoso en este estado inconsistente. Esto hace que la persona que llama __block_write_begin_int() u otros soliciten una lectura aunque el b\u00fafer no est\u00e9 asignado, lo que resulta en una verificaci\u00f3n BUG_ON para el indicador BH_Mapped en submit_bh_wbc() que falla. Esto soluciona el primer problema cambiando el valor de retorno al c\u00f3digo -EINVAL cuando falla una conversi\u00f3n usando DAT con el c\u00f3digo -ENOENT, evitando la condici\u00f3n conflictiva que conduce al error del kernel descrito anteriormente. Aqu\u00ed, el c\u00f3digo -EINVAL indica que se detect\u00f3 corrupci\u00f3n de metadatos durante la b\u00fasqueda del bloque, lo que se manejar\u00e1 adecuadamente como un error del sistema de archivos y se convertir\u00e1 a -EIO al pasar a trav\u00e9s de la capa bmap nilfs2."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2e2619ff5d0def4bb6c2037a32a6eaa28dd95c84",

27
CVE-2024/CVE-2024-269xx/CVE-2024-26994.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-26994",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2024-05-01T06:15:17.207",
"lastModified": "2024-06-27T12:15:23.573",
"lastModified": "2024-11-04T17:35:12.723",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "En el kernel de Linux se ha solucionado la siguiente vulnerabilidad: Speakup: Evitar crash en palabras muy largas En caso de que una consola est\u00e9 configurada muy grande y contenga una palabra muy larga (>256 caracteres), tenemos que detenernos antes de la longitud de la palabra. b\u00fafer de palabras."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.5,
"impactScore": 3.4
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0d130158db29f5e0b3893154908cf618896450a8",

27
CVE-2024/CVE-2024-26xx/CVE-2024-2616.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-2616",
"sourceIdentifier": "security@mozilla.org",
"published": "2024-03-19T12:15:09.260",
"lastModified": "2024-03-25T17:15:52.007",
"lastModified": "2024-11-04T17:35:14.147",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "Para proteger a la UCI contra la explotaci\u00f3n, el comportamiento de las condiciones de falta de memoria se cambi\u00f3 para que falle en lugar de intentar continuar. Esta vulnerabilidad afecta a Firefox ESR <115.9 y Thunderbird <115.9."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW",
"baseScore": 2.7,
"baseSeverity": "LOW"
},
"exploitabilityScore": 1.2,
"impactScore": 1.4
}
]
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1846197",

27
CVE-2024/CVE-2024-272xx/CVE-2024-27234.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-27234",
"sourceIdentifier": "dsap-vuln-management@google.com",
"published": "2024-03-11T19:15:49.010",
"lastModified": "2024-03-12T12:40:13.500",
"lastModified": "2024-11-04T17:35:12.957",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "En fvp_set_target de fvp.c, hay una posible lectura fuera de los l\u00edmites debido a una verificaci\u00f3n de los l\u00edmites faltantes. Esto podr\u00eda dar lugar a la divulgaci\u00f3n de informaci\u00f3n local sin necesidad de privilegios de ejecuci\u00f3n adicionales. La interacci\u00f3n del usuario no es necesaria para la explotaci\u00f3n."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.5,
"impactScore": 3.4
}
]
},
"references": [
{
"url": "https://source.android.com/security/bulletin/pixel/2024-03-01",

14
CVE-2024/CVE-2024-288xx/CVE-2024-28820.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-28820",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-06-27T16:15:10.950",
"lastModified": "2024-10-25T18:35:04.300",
"lastModified": "2024-11-04T18:35:08.457",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -39,6 +39,18 @@
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"references": [
{
"url": "https://github.com/threerings/openvpn-auth-ldap/pull/92",

37
CVE-2024/CVE-2024-291xx/CVE-2024-29133.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-29133",
"sourceIdentifier": "security@apache.org",
"published": "2024-03-21T09:15:07.943",
"lastModified": "2024-05-01T17:15:31.283",
"lastModified": "2024-11-04T17:35:13.290",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "Vulnerabilidad de escritura fuera de los l\u00edmites en la configuraci\u00f3n de Apache Commons. Este problema afecta a la configuraci\u00f3n de Apache Commons: desde 2.0 antes de 2.10.1. Se recomienda a los usuarios actualizar a la versi\u00f3n 2.10.1, que soluciona el problema."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
}
]
},
"weaknesses": [
{
"source": "security@apache.org",
@ -26,6 +49,16 @@
"value": "CWE-787"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-787"
}
]
}
],
"references": [

39
CVE-2024/CVE-2024-302xx/CVE-2024-30204.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-30204",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-03-25T15:15:52.523",
"lastModified": "2024-05-01T18:15:19.670",
"lastModified": "2024-11-04T17:35:14.370",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,42 @@
"value": "En Emacs anterior a 29.3, la vista previa de LaTeX est\u00e1 habilitada de forma predeterminada para los archivos adjuntos de correo electr\u00f3nico."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW",
"baseScore": 2.8,
"baseSeverity": "LOW"
},
"exploitabilityScore": 1.3,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-276"
}
]
}
],
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2024/03/25/2",

27
CVE-2024/CVE-2024-317xx/CVE-2024-31747.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-31747",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-04-29T19:15:20.340",
"lastModified": "2024-04-30T13:11:16.690",
"lastModified": "2024-11-04T17:35:15.230",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "Un problema en Yealink VP59 Microsoft Teams Phone firmware 91.15.0.118 (fixed in 122.15.0.142) permite a un atacante f\u00edsicamente cercano desactivar el bloqueo del tel\u00e9fono a trav\u00e9s de la opci\u00f3n del men\u00fa Walkie Talkie."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW",
"baseScore": 2.1,
"baseSeverity": "LOW"
},
"exploitabilityScore": 0.7,
"impactScore": 1.4
}
]
},
"references": [
{
"url": "https://medium.com/%40deepsahu1/yealink-vp59-microsoft-teams-phone-lock-bypass-b7fee9dd9c8c",

27
CVE-2024/CVE-2024-318xx/CVE-2024-31868.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-31868",
"sourceIdentifier": "security@apache.org",
"published": "2024-04-09T16:15:08.413",
"lastModified": "2024-10-03T13:15:14.833",
"lastModified": "2024-11-04T17:35:15.470",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "Vulnerabilidad de codificaci\u00f3n o escape de salida inadecuados en Apache Zeppelin. Los atacantes pueden modificar helium.json y exponer ataques XSS a usuarios normales. Este problema afecta a Apache Zeppelin: desde 0.8.2 antes de 0.11.1. Se recomienda a los usuarios actualizar a la versi\u00f3n 0.11.1, que soluciona el problema."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
]
},
"weaknesses": [
{
"source": "security@apache.org",

39
CVE-2024/CVE-2024-319xx/CVE-2024-31951.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-31951",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-04-07T21:15:07.600",
"lastModified": "2024-04-08T18:48:40.217",
"lastModified": "2024-11-04T17:35:15.700",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,42 @@
"value": "En el analizador Opaque LSA Extended Link de FRRouting (FRR) hasta 9.1, puede haber un desbordamiento del b\u00fafer y una falla del daemon en ospf_te_parse_ext_link para paquetes OSPF LSA durante un intento de leer subTLV SID de adyacencia de enrutamiento de segmento (las longitudes no est\u00e1n validadas)."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-120"
}
]
}
],
"references": [
{
"url": "https://github.com/FRRouting/frr/pull/15674/",

4
CVE-2024/CVE-2024-319xx/CVE-2024-31975.json
View File

@ -2,13 +2,13 @@
"id": "CVE-2024-31975",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-10-30T18:15:06.967",
"lastModified": "2024-11-01T12:57:03.417",
"lastModified": "2024-11-04T17:15:07.030",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "EnGenius ESR580 devices through 1.1.30 allow a remote attacker to conduct stored XSS attacks via the Wi-Fi SSID parameters. JavaScript embedded into a vulnerable field is executed when the user clicks the SSID field's corresponding EDIT button."
"value": "EnGenius EWS356-Fit devices through 1.1.30 allow a remote attacker to conduct stored XSS attacks via the Wi-Fi SSID parameters. JavaScript embedded into a vulnerable field is executed when the user clicks the SSID field's corresponding EDIT button."
},
{
"lang": "es",

39
CVE-2024/CVE-2024-329xx/CVE-2024-32915.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-32915",
"sourceIdentifier": "dsap-vuln-management@google.com",
"published": "2024-06-13T21:15:55.467",
"lastModified": "2024-06-17T12:43:31.090",
"lastModified": "2024-11-04T18:35:09.293",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,42 @@
"value": "En CellInfoListParserV2::FillCellInfo() de protocolnetadapter.cpp, existe una posible lectura fuera de los l\u00edmites debido a una verificaci\u00f3n de los l\u00edmites faltantes. Esto podr\u00eda dar lugar a la divulgaci\u00f3n de informaci\u00f3n local y comprometer el firmware de banda base. La interacci\u00f3n del usuario no es necesaria para la explotaci\u00f3n."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"references": [
{
"url": "https://source.android.com/security/bulletin/pixel/2024-06-01",

27
CVE-2024/CVE-2024-329xx/CVE-2024-32916.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-32916",
"sourceIdentifier": "dsap-vuln-management@google.com",
"published": "2024-06-13T21:15:55.533",
"lastModified": "2024-06-17T12:43:31.090",
"lastModified": "2024-11-04T17:35:16.763",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "En fvp_freq_histogram_init de fvp.c, existe una posible Divulgaci\u00f3n de Informaci\u00f3n debido a datos no inicializados. Esto podr\u00eda dar lugar a la divulgaci\u00f3n de informaci\u00f3n local sin necesidad de privilegios de ejecuci\u00f3n adicionales. La interacci\u00f3n del usuario no es necesaria para la explotaci\u00f3n."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.5,
"impactScore": 3.4
}
]
},
"references": [
{
"url": "https://source.android.com/security/bulletin/pixel/2024-06-01",

4
CVE-2024/CVE-2024-330xx/CVE-2024-33029.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-33029",
"sourceIdentifier": "product-security@qualcomm.com",
"published": "2024-11-04T10:15:05.147",
"lastModified": "2024-11-04T10:15:05.147",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-330xx/CVE-2024-33030.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-33030",
"sourceIdentifier": "product-security@qualcomm.com",
"published": "2024-11-04T10:15:05.370",
"lastModified": "2024-11-04T10:15:05.370",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-330xx/CVE-2024-33031.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-33031",
"sourceIdentifier": "product-security@qualcomm.com",
"published": "2024-11-04T10:15:05.603",
"lastModified": "2024-11-04T10:15:05.603",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-330xx/CVE-2024-33032.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-33032",
"sourceIdentifier": "product-security@qualcomm.com",
"published": "2024-11-04T10:15:05.827",
"lastModified": "2024-11-04T10:15:05.827",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-330xx/CVE-2024-33033.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-33033",
"sourceIdentifier": "product-security@qualcomm.com",
"published": "2024-11-04T10:15:06.057",
"lastModified": "2024-11-04T10:15:06.057",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

4
CVE-2024/CVE-2024-330xx/CVE-2024-33068.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2024-33068",
"sourceIdentifier": "product-security@qualcomm.com",
"published": "2024-11-04T10:15:06.283",
"lastModified": "2024-11-04T10:15:06.283",
"vulnStatus": "Received",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{

39
CVE-2024/CVE-2024-335xx/CVE-2024-33528.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-33528",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-05-21T15:15:29.167",
"lastModified": "2024-05-23T17:15:29.213",
"lastModified": "2024-11-04T17:35:17.000",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,42 @@
"value": " Una vulnerabilidad de Cross Site Scripting Almacenado (XSS) en ILIAS 7 anterior a 7.30 e ILIAS 8 anterior a 8.11 permite a atacantes remotos autenticados con privilegios de tutor inyectar scripts web o HTML de su elecci\u00f3n mediante la carga de archivos XML."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://docu.ilias.de/ilias.php?baseClass=illmpresentationgui&cmd=layout&ref_id=1719&obj_id=170029",

27
CVE-2024/CVE-2024-341xx/CVE-2024-34155.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-34155",
"sourceIdentifier": "security@golang.org",
"published": "2024-09-06T21:15:11.947",
"lastModified": "2024-09-09T13:03:38.303",
"lastModified": "2024-11-04T17:35:17.887",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
@ -15,7 +15,30 @@
"value": "Llamar a cualquiera de las funciones Parse en el c\u00f3digo fuente de Go que contiene literales profundamente anidados puede provocar p\u00e1nico debido al agotamiento de la pila."
}
],
"metrics": {},
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"references": [
{
"url": "https://go.dev/cl/611238",

25
CVE-2024/CVE-2024-348xx/CVE-2024-34882.json Normal file
View File

@ -0,0 +1,25 @@
{
"id": "CVE-2024-34882",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-11-04T18:15:04.683",
"lastModified": "2024-11-04T18:50:05.607",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Insufficiently protected credentials in SMTP server settings in 1C-Bitrix Bitrix24 23.300.100 allows remote administrators to send SMTP account passwords to an arbitrary server via HTTP POST request."
}
],
"metrics": {},
"references": [
{
"url": "http://bitrix24.com",
"source": "cve@mitre.org"
},
{
"url": "https://github.com/DrieVlad/BitrixVulns",
"source": "cve@mitre.org"
}
]
}

Some files were not shown because too many files have changed in this diff Show More