mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-07-09 16:05:11 +00:00
Auto-Update: 2023-12-12T09:02:09.002881+00:00
This commit is contained in:
cad-safe-bot
parent
28b370d60c
commit
729bdf24e9
55
CVE-2022/CVE-2022-486xx/CVE-2022-48615.json
Normal file
55
CVE-2022/CVE-2022-486xx/CVE-2022-48615.json
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2022-48615",
|
||||||
|
"sourceIdentifier": "psirt@huawei.com",
|
||||||
|
"published": "2023-12-12T08:15:06.937",
|
||||||
|
"lastModified": "2023-12-12T08:15:06.937",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "An improper access control vulnerability exists in a Huawei datacom product. Attackers can exploit this vulnerability to obtain partial device information."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "psirt@huawei.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N",
|
||||||
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
|
"attackComplexity": "HIGH",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "NONE",
|
||||||
|
"baseScore": 4.8,
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 0.5,
|
||||||
|
"impactScore": 4.2
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "psirt@huawei.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-284"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://wr3nchsr.github.io/huawei-netengine-ar617vw-auth-root-rce/",
|
||||||
|
"source": "psirt@huawei.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
55
CVE-2022/CVE-2022-486xx/CVE-2022-48616.json
Normal file
55
CVE-2022/CVE-2022-486xx/CVE-2022-48616.json
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2022-48616",
|
||||||
|
"sourceIdentifier": "psirt@huawei.com",
|
||||||
|
"published": "2023-12-12T08:15:07.377",
|
||||||
|
"lastModified": "2023-12-12T08:15:07.377",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "A Huawei data communication product has a command injection vulnerability. Successful exploitation of this vulnerability may allow attackers to gain higher privileges."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "psirt@huawei.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
|
"attackComplexity": "HIGH",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH",
|
||||||
|
"baseScore": 6.4,
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 0.5,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "psirt@huawei.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-78"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://wr3nchsr.github.io/huawei-netengine-ar617vw-auth-root-rce/",
|
||||||
|
"source": "psirt@huawei.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
43
CVE-2023/CVE-2023-411xx/CVE-2023-41113.json
Normal file
43
CVE-2023/CVE-2023-411xx/CVE-2023-41113.json
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-41113",
|
||||||
|
"sourceIdentifier": "cve@mitre.org",
|
||||||
|
"published": "2023-12-12T07:15:42.150",
|
||||||
|
"lastModified": "2023-12-12T07:15:42.150",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It allows an authenticated user to to obtain information about whether certain files exist on disk, what errors if any occur when attempting to read them, and some limited information about their contents (regardless of permissions). This can occur when a superuser has configured one or more directories for filesystem access via CREATE DIRECTORY and adopted certain non-default settings for log_line_prefix and log_connections."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "cve@mitre.org",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE",
|
||||||
|
"baseScore": 4.3,
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 1.4
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.enterprisedb.com/docs/security/advisories/cve202341113/",
|
||||||
|
"source": "cve@mitre.org"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
43
CVE-2023/CVE-2023-411xx/CVE-2023-41114.json
Normal file
43
CVE-2023/CVE-2023-411xx/CVE-2023-41114.json
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-41114",
|
||||||
|
"sourceIdentifier": "cve@mitre.org",
|
||||||
|
"published": "2023-12-12T07:15:43.307",
|
||||||
|
"lastModified": "2023-12-12T07:15:43.307",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contains the functions get_url_as_text and get_url_as_bytea that are publicly executable, thus permitting an authenticated user to read any file from the local filesystem or remote system regardless of that user's permissions."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "cve@mitre.org",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE",
|
||||||
|
"baseScore": 6.5,
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.enterprisedb.com/docs/security/advisories/cve202341114/",
|
||||||
|
"source": "cve@mitre.org"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
43
CVE-2023/CVE-2023-411xx/CVE-2023-41115.json
Normal file
43
CVE-2023/CVE-2023-411xx/CVE-2023-41115.json
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-41115",
|
||||||
|
"sourceIdentifier": "cve@mitre.org",
|
||||||
|
"published": "2023-12-12T07:15:43.780",
|
||||||
|
"lastModified": "2023-12-12T07:15:43.780",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. When using UTL_ENCODE, an authenticated user can read any large object, regardless of that user's permissions."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "cve@mitre.org",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE",
|
||||||
|
"baseScore": 6.5,
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.enterprisedb.com/docs/security/advisories/cve202341115/",
|
||||||
|
"source": "cve@mitre.org"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
43
CVE-2023/CVE-2023-411xx/CVE-2023-41116.json
Normal file
43
CVE-2023/CVE-2023-411xx/CVE-2023-41116.json
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-41116",
|
||||||
|
"sourceIdentifier": "cve@mitre.org",
|
||||||
|
"published": "2023-12-12T07:15:44.267",
|
||||||
|
"lastModified": "2023-12-12T07:15:44.267",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It allows an authenticated user to refresh any materialized view, regardless of that user's permissions."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "cve@mitre.org",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE",
|
||||||
|
"baseScore": 4.3,
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 1.4
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.enterprisedb.com/docs/security/advisories/cve202341116/",
|
||||||
|
"source": "cve@mitre.org"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
43
CVE-2023/CVE-2023-411xx/CVE-2023-41117.json
Normal file
43
CVE-2023/CVE-2023-411xx/CVE-2023-41117.json
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-41117",
|
||||||
|
"sourceIdentifier": "cve@mitre.org",
|
||||||
|
"published": "2023-12-12T07:15:44.727",
|
||||||
|
"lastModified": "2023-12-12T07:15:44.727",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contain packages, standalone packages, and functions that run SECURITY DEFINER but are inadequately secured against search_path attacks."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "cve@mitre.org",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH",
|
||||||
|
"baseScore": 8.8,
|
||||||
|
"baseSeverity": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.enterprisedb.com/docs/security/advisories/cve202341117/",
|
||||||
|
"source": "cve@mitre.org"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
20
CVE-2023/CVE-2023-411xx/CVE-2023-41118.json
Normal file
20
CVE-2023/CVE-2023-411xx/CVE-2023-41118.json
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-41118",
|
||||||
|
"sourceIdentifier": "cve@mitre.org",
|
||||||
|
"published": "2023-12-12T07:15:45.220",
|
||||||
|
"lastModified": "2023-12-12T07:15:45.220",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It may allow an authenticated user to bypass authorization requirements and access underlying implementation functions. When a superuser has configured file locations using CREATE DIRECTORY, these functions allow users to take a wide range of actions, including read, write, copy, rename, and delete."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {},
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.enterprisedb.com/docs/security/advisories/cve202341118/",
|
||||||
|
"source": "cve@mitre.org"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
43
CVE-2023/CVE-2023-411xx/CVE-2023-41119.json
Normal file
43
CVE-2023/CVE-2023-411xx/CVE-2023-41119.json
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-41119",
|
||||||
|
"sourceIdentifier": "cve@mitre.org",
|
||||||
|
"published": "2023-12-12T07:15:45.387",
|
||||||
|
"lastModified": "2023-12-12T07:15:45.387",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contains the function _dbms_aq_move_to_exception_queue that may be used to elevate a user's privileges to superuser. This function accepts the OID of a table, and then accesses that table as the superuser by using SELECT and DML commands."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "cve@mitre.org",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH",
|
||||||
|
"baseScore": 8.8,
|
||||||
|
"baseSeverity": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.enterprisedb.com/docs/security/advisories/cve202341119/",
|
||||||
|
"source": "cve@mitre.org"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
43
CVE-2023/CVE-2023-411xx/CVE-2023-41120.json
Normal file
43
CVE-2023/CVE-2023-411xx/CVE-2023-41120.json
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-41120",
|
||||||
|
"sourceIdentifier": "cve@mitre.org",
|
||||||
|
"published": "2023-12-12T07:15:45.860",
|
||||||
|
"lastModified": "2023-12-12T07:15:45.860",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It permits an authenticated user to use DBMS_PROFILER to remove all accumulated profiling data on a system-wide basis, regardless of that user's permissions."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "cve@mitre.org",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "NONE",
|
||||||
|
"baseScore": 6.5,
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.enterprisedb.com/docs/security/advisories/cve202341120/",
|
||||||
|
"source": "cve@mitre.org"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
43
CVE-2023/CVE-2023-486xx/CVE-2023-48641.json
Normal file
43
CVE-2023/CVE-2023-486xx/CVE-2023-48641.json
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-48641",
|
||||||
|
"sourceIdentifier": "cve@mitre.org",
|
||||||
|
"published": "2023-12-12T08:15:07.693",
|
||||||
|
"lastModified": "2023-12-12T08:15:07.693",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Archer Platform 6.x before 6.14 P1 HF2 (6.14.0.1.2) contains an insecure direct object reference vulnerability. An authenticated malicious user in a multi-instance installation could potentially exploit this vulnerability by manipulating application resource references in user requests to bypass authorization checks, in order to gain execute access to AWF application resources."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "cve@mitre.org",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "HIGH",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "LOW",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.0,
|
||||||
|
"impactScore": 6.0
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/711859",
|
||||||
|
"source": "cve@mitre.org"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
20
CVE-2023/CVE-2023-486xx/CVE-2023-48642.json
Normal file
20
CVE-2023/CVE-2023-486xx/CVE-2023-48642.json
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-48642",
|
||||||
|
"sourceIdentifier": "cve@mitre.org",
|
||||||
|
"published": "2023-12-12T08:15:07.980",
|
||||||
|
"lastModified": "2023-12-12T08:15:07.980",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Archer Platform 6.x before 6.13 P2 (6.13.0.2) contains an authenticated HTML content injection vulnerability. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 6.14 (6.14.0) is also a fixed release."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {},
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/711859",
|
||||||
|
"source": "cve@mitre.org"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
23
README.md
23
README.md
@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
|
|||||||
### Last Repository Update
|
### Last Repository Update
|
||||||
|
|
||||||
```plain
|
```plain
|
||||||
2023-12-12T07:00:18.295904+00:00
|
2023-12-12T09:02:09.002881+00:00
|
||||||
```
|
```
|
||||||
|
|
||||||
### Most recent CVE Modification Timestamp synchronized with NVD
|
### Most recent CVE Modification Timestamp synchronized with NVD
|
||||||
|
|
||||||
```plain
|
```plain
|
||||||
2023-12-12T05:15:07.970000+00:00
|
2023-12-12T08:15:07.980000+00:00
|
||||||
```
|
```
|
||||||
|
|
||||||
### Last Data Feed Release
|
### Last Data Feed Release
|
||||||
@ -29,20 +29,31 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
|
|||||||
### Total Number of included CVEs
|
### Total Number of included CVEs
|
||||||
|
|
||||||
```plain
|
```plain
|
||||||
232793
|
232805
|
||||||
```
|
```
|
||||||
|
|
||||||
### CVEs added in the last Commit
|
### CVEs added in the last Commit
|
||||||
|
|
||||||
Recently added CVEs: `0`
|
Recently added CVEs: `12`
|
||||||
|
|
||||||
|
* [CVE-2022-48615](CVE-2022/CVE-2022-486xx/CVE-2022-48615.json) (`2023-12-12T08:15:06.937`)
|
||||||
|
* [CVE-2022-48616](CVE-2022/CVE-2022-486xx/CVE-2022-48616.json) (`2023-12-12T08:15:07.377`)
|
||||||
|
* [CVE-2023-41113](CVE-2023/CVE-2023-411xx/CVE-2023-41113.json) (`2023-12-12T07:15:42.150`)
|
||||||
|
* [CVE-2023-41114](CVE-2023/CVE-2023-411xx/CVE-2023-41114.json) (`2023-12-12T07:15:43.307`)
|
||||||
|
* [CVE-2023-41115](CVE-2023/CVE-2023-411xx/CVE-2023-41115.json) (`2023-12-12T07:15:43.780`)
|
||||||
|
* [CVE-2023-41116](CVE-2023/CVE-2023-411xx/CVE-2023-41116.json) (`2023-12-12T07:15:44.267`)
|
||||||
|
* [CVE-2023-41117](CVE-2023/CVE-2023-411xx/CVE-2023-41117.json) (`2023-12-12T07:15:44.727`)
|
||||||
|
* [CVE-2023-41118](CVE-2023/CVE-2023-411xx/CVE-2023-41118.json) (`2023-12-12T07:15:45.220`)
|
||||||
|
* [CVE-2023-41119](CVE-2023/CVE-2023-411xx/CVE-2023-41119.json) (`2023-12-12T07:15:45.387`)
|
||||||
|
* [CVE-2023-41120](CVE-2023/CVE-2023-411xx/CVE-2023-41120.json) (`2023-12-12T07:15:45.860`)
|
||||||
|
* [CVE-2023-48641](CVE-2023/CVE-2023-486xx/CVE-2023-48641.json) (`2023-12-12T08:15:07.693`)
|
||||||
|
* [CVE-2023-48642](CVE-2023/CVE-2023-486xx/CVE-2023-48642.json) (`2023-12-12T08:15:07.980`)
|
||||||
|
|
||||||
|
|
||||||
### CVEs modified in the last Commit
|
### CVEs modified in the last Commit
|
||||||
|
|
||||||
Recently modified CVEs: `1`
|
Recently modified CVEs: `0`
|
||||||
|
|
||||||
* [CVE-2023-5824](CVE-2023/CVE-2023-58xx/CVE-2023-5824.json) (`2023-12-12T05:15:07.970`)
|
|
||||||
|
|
||||||
|
|
||||||
## Download and Usage
|
## Download and Usage
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user