diff --git a/CVE-2022/CVE-2022-251xx/CVE-2022-25164.json b/CVE-2022/CVE-2022-251xx/CVE-2022-25164.json index 7123562032f..67012a438eb 100644 --- a/CVE-2022/CVE-2022-251xx/CVE-2022-25164.json +++ b/CVE-2022/CVE-2022-251xx/CVE-2022-25164.json @@ -2,12 +2,12 @@ "id": "CVE-2022-25164", "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "published": "2022-11-25T00:15:09.907", - "lastModified": "2022-11-28T21:04:08.380", - "vulnStatus": "Analyzed", + "lastModified": "2023-05-31T09:15:09.710", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", - "value": "Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 all versions and Mitsubishi Electric MX OPC UA Module Configurator-R all versions allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthorized users can gain unauthorized access to the CPU module and the OPC UA server module." + "value": "Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 all versions and Mitsubishi Electric MX OPC UA Module Configurator-R all versions allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users can gain unauthorized access to the MELSEC CPU module and the MELSEC OPC UA server module." } ], "metrics": { @@ -122,6 +122,10 @@ "VDB Entry" ] }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp" + }, { "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf", "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", diff --git a/CVE-2022/CVE-2022-298xx/CVE-2022-29825.json b/CVE-2022/CVE-2022-298xx/CVE-2022-29825.json index 696d3b468cd..05b7bfcedc3 100644 --- a/CVE-2022/CVE-2022-298xx/CVE-2022-29825.json +++ b/CVE-2022/CVE-2022-298xx/CVE-2022-29825.json @@ -2,12 +2,12 @@ "id": "CVE-2022-29825", "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "published": "2022-11-25T00:15:10.000", - "lastModified": "2022-11-28T21:03:51.290", - "vulnStatus": "Analyzed", + "lastModified": "2023-05-31T09:15:09.977", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", - "value": "Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 all versions allows an unauthenticated attacker to disclose sensitive information. As a result, unauthorized users may view or execute programs illegally." + "value": "Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U and GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C allows an unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally." } ], "metrics": { @@ -117,6 +117,10 @@ "VDB Entry" ] }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp" + }, { "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf", "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", diff --git a/CVE-2022/CVE-2022-298xx/CVE-2022-29826.json b/CVE-2022/CVE-2022-298xx/CVE-2022-29826.json index 5e4ac4ce122..3ee3cb36c32 100644 --- a/CVE-2022/CVE-2022-298xx/CVE-2022-29826.json +++ b/CVE-2022/CVE-2022-298xx/CVE-2022-29826.json @@ -2,12 +2,12 @@ "id": "CVE-2022-29826", "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "published": "2022-11-25T00:15:10.080", - "lastModified": "2022-11-28T21:01:05.267", - "vulnStatus": "Analyzed", + "lastModified": "2023-05-31T09:15:10.080", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", - "value": "Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions 1.086Q and prior allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthorized users may view or execute programs illegally." + "value": "Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.087R and Motion Control Setting(GX Works3 related software) versions from 1.000A to 1.042U allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally." } ], "metrics": { @@ -111,6 +111,10 @@ "VDB Entry" ] }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp" + }, { "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf", "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", diff --git a/CVE-2022/CVE-2022-298xx/CVE-2022-29827.json b/CVE-2022/CVE-2022-298xx/CVE-2022-29827.json index 96f7ae140ad..ec0149532d5 100644 --- a/CVE-2022/CVE-2022-298xx/CVE-2022-29827.json +++ b/CVE-2022/CVE-2022-298xx/CVE-2022-29827.json @@ -2,12 +2,12 @@ "id": "CVE-2022-29827", "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "published": "2022-11-25T00:15:10.157", - "lastModified": "2022-11-28T20:39:24.887", - "vulnStatus": "Analyzed", + "lastModified": "2023-05-31T09:15:10.160", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", - "value": "Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 all versions allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthorized users may view or execute programs illegally." + "value": "Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 all versions allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally." } ], "metrics": { @@ -117,6 +117,10 @@ "VDB Entry" ] }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp" + }, { "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf", "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", diff --git a/CVE-2022/CVE-2022-298xx/CVE-2022-29828.json b/CVE-2022/CVE-2022-298xx/CVE-2022-29828.json index bc61f5503b3..16fe1373b42 100644 --- a/CVE-2022/CVE-2022-298xx/CVE-2022-29828.json +++ b/CVE-2022/CVE-2022-298xx/CVE-2022-29828.json @@ -2,12 +2,12 @@ "id": "CVE-2022-29828", "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "published": "2022-11-25T00:15:10.230", - "lastModified": "2022-11-28T20:58:59.080", - "vulnStatus": "Analyzed", + "lastModified": "2023-05-31T09:15:10.253", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", - "value": "Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 all versions allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthorized users may view or execute programs illegally." + "value": "Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 all versions allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project file or execute programs illegally." } ], "metrics": { @@ -117,6 +117,10 @@ "VDB Entry" ] }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp" + }, { "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf", "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", diff --git a/CVE-2022/CVE-2022-298xx/CVE-2022-29829.json b/CVE-2022/CVE-2022-298xx/CVE-2022-29829.json index 721a3b1fdae..5b09d8e203a 100644 --- a/CVE-2022/CVE-2022-298xx/CVE-2022-29829.json +++ b/CVE-2022/CVE-2022-298xx/CVE-2022-29829.json @@ -2,12 +2,12 @@ "id": "CVE-2022-29829", "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "published": "2022-11-25T00:15:10.297", - "lastModified": "2022-11-28T20:58:47.393", - "vulnStatus": "Analyzed", + "lastModified": "2023-05-31T09:15:10.333", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", - "value": "Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 all versions allows a remote unauthenticated attacker to disclose sensitive information . As a result, unauthorized users may view or execute programs illegally." + "value": "Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C to 1.290C and Motion Control Setting(GX Works3 related software) versions from 1.035M to 1.042U allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users may view programs and project files or execute programs illegally." } ], "metrics": { @@ -117,6 +117,10 @@ "VDB Entry" ] }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp" + }, { "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf", "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", diff --git a/CVE-2022/CVE-2022-298xx/CVE-2022-29830.json b/CVE-2022/CVE-2022-298xx/CVE-2022-29830.json index 31e573e54c9..cb0137cbc69 100644 --- a/CVE-2022/CVE-2022-298xx/CVE-2022-29830.json +++ b/CVE-2022/CVE-2022-298xx/CVE-2022-29830.json @@ -2,12 +2,12 @@ "id": "CVE-2022-29830", "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "published": "2022-11-25T00:15:10.367", - "lastModified": "2022-11-28T20:58:36.463", - "vulnStatus": "Analyzed", + "lastModified": "2023-05-31T09:15:10.403", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", - "value": "Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 all versions allows a remote unauthenticated attacker to disclose or tamper with sensitive information. As a result, unauthorized users may obtain information about project files illegally." + "value": "Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 all versions and Motion Control Setting(GX Works3 related software) all versions allows a remote unauthenticated attacker to disclose or tamper with sensitive information. As a result, unauthenticated users may obtain information about project files illegally." } ], "metrics": { @@ -117,6 +117,10 @@ "VDB Entry" ] }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp" + }, { "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf", "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", diff --git a/CVE-2022/CVE-2022-298xx/CVE-2022-29831.json b/CVE-2022/CVE-2022-298xx/CVE-2022-29831.json index 54127121212..8de250daf5c 100644 --- a/CVE-2022/CVE-2022-298xx/CVE-2022-29831.json +++ b/CVE-2022/CVE-2022-298xx/CVE-2022-29831.json @@ -2,12 +2,12 @@ "id": "CVE-2022-29831", "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "published": "2022-11-25T00:15:10.437", - "lastModified": "2022-11-28T20:58:14.547", - "vulnStatus": "Analyzed", + "lastModified": "2023-05-31T07:15:08.930", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", - "value": "Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later allows a remote unauthorized attacker to obtain information about the project file for MELSEC safety CPU modules." + "value": "Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later allows a remote unauthenticated attacker to obtain information about the project file for MELSEC safety CPU modules." } ], "metrics": { @@ -110,6 +110,10 @@ "VDB Entry" ] }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp" + }, { "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf", "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", diff --git a/CVE-2022/CVE-2022-298xx/CVE-2022-29832.json b/CVE-2022/CVE-2022-298xx/CVE-2022-29832.json index 449c931a3dd..0be05fd9634 100644 --- a/CVE-2022/CVE-2022-298xx/CVE-2022-29832.json +++ b/CVE-2022/CVE-2022-298xx/CVE-2022-29832.json @@ -2,12 +2,12 @@ "id": "CVE-2022-29832", "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "published": "2022-11-25T00:15:10.507", - "lastModified": "2022-11-28T20:57:35.480", - "vulnStatus": "Analyzed", + "lastModified": "2023-05-31T07:15:09.880", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", - "value": "Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later allows a remote unauthorized attacker to disclose sensitive information. As a result, unauthorized users could obtain information about the project file for MELSEC safety CPU modules." + "value": "Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, GX Works2 all versions and GX Developer versions 8.40S and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users could obtain information about the project file for MELSEC safety CPU modules or project file for MELSEC Q/FX/L series with security setting." } ], "metrics": { @@ -110,6 +110,10 @@ "VDB Entry" ] }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp" + }, { "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf", "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", diff --git a/CVE-2022/CVE-2022-298xx/CVE-2022-29833.json b/CVE-2022/CVE-2022-298xx/CVE-2022-29833.json index e8eca447bc6..83d4e8163f9 100644 --- a/CVE-2022/CVE-2022-298xx/CVE-2022-29833.json +++ b/CVE-2022/CVE-2022-298xx/CVE-2022-29833.json @@ -2,12 +2,12 @@ "id": "CVE-2022-29833", "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "published": "2022-11-25T00:15:10.580", - "lastModified": "2022-11-28T20:57:13.653", - "vulnStatus": "Analyzed", + "lastModified": "2023-05-31T07:15:10.850", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", - "value": "Insufficiently Protected Credentials vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later allows a remote unauthorized attacker to disclose sensitive information. As a result, unauthorized users could access to MELSEC safety CPU modules illgally." + "value": "Insufficiently Protected Credentials vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated users could access to MELSEC safety CPU modules illgally." } ], "metrics": { @@ -110,6 +110,10 @@ "VDB Entry" ] }, + { + "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-333-05", + "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp" + }, { "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-015_en.pdf", "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", diff --git a/CVE-2022/CVE-2022-343xx/CVE-2022-34397.json b/CVE-2022/CVE-2022-343xx/CVE-2022-34397.json index 73fc30117dc..4968e4ccb40 100644 --- a/CVE-2022/CVE-2022-343xx/CVE-2022-34397.json +++ b/CVE-2022/CVE-2022-343xx/CVE-2022-34397.json @@ -2,12 +2,12 @@ "id": "CVE-2022-34397", "sourceIdentifier": "security_alert@emc.com", "published": "2023-02-13T10:15:13.470", - "lastModified": "2023-02-24T06:35:00.717", - "vulnStatus": "Analyzed", + "lastModified": "2023-05-31T06:15:09.527", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", - "value": "Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 10.0.0.5 and below contains an authorization bypass vulnerability, allowing users to perform actions in which they are not authorized." + "value": "\nDell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 10.0.0.5 and below contains an authorization bypass vulnerability, allowing users to perform actions in which they are not authorized.\n\n" } ], "metrics": { @@ -56,7 +56,7 @@ }, "weaknesses": [ { - "source": "nvd@nist.gov", + "source": "security_alert@emc.com", "type": "Primary", "description": [ { @@ -66,12 +66,12 @@ ] }, { - "source": "security_alert@emc.com", + "source": "nvd@nist.gov", "type": "Secondary", "description": [ { "lang": "en", - "value": "CWE-602" + "value": "CWE-863" } ] } diff --git a/CVE-2023/CVE-2023-259xx/CVE-2023-25934.json b/CVE-2023/CVE-2023-259xx/CVE-2023-25934.json index 3d05a92b4b0..03f751bf976 100644 --- a/CVE-2023/CVE-2023-259xx/CVE-2023-25934.json +++ b/CVE-2023/CVE-2023-259xx/CVE-2023-25934.json @@ -2,8 +2,8 @@ "id": "CVE-2023-25934", "sourceIdentifier": "security_alert@emc.com", "published": "2023-05-04T07:15:22.510", - "lastModified": "2023-05-10T18:12:48.667", - "vulnStatus": "Analyzed", + "lastModified": "2023-05-31T06:15:10.553", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", @@ -56,7 +56,7 @@ }, "weaknesses": [ { - "source": "nvd@nist.gov", + "source": "security_alert@emc.com", "type": "Primary", "description": [ { @@ -66,12 +66,12 @@ ] }, { - "source": "security_alert@emc.com", + "source": "nvd@nist.gov", "type": "Secondary", "description": [ { "lang": "en", - "value": "CWE-310" + "value": "CWE-347" } ] } diff --git a/CVE-2023/CVE-2023-27xx/CVE-2023-2749.json b/CVE-2023/CVE-2023-27xx/CVE-2023-2749.json new file mode 100644 index 00000000000..9bdf6d97efd --- /dev/null +++ b/CVE-2023/CVE-2023-27xx/CVE-2023-2749.json @@ -0,0 +1,55 @@ +{ + "id": "CVE-2023-2749", + "sourceIdentifier": "security@asustor.com", + "published": "2023-05-31T09:15:10.490", + "lastModified": "2023-05-31T09:15:10.490", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitive files or directories without appropriate permission restrictions. Download Center on ADM 4.0 and above will be affected. Affected products and versions include: Download Center 1.1.5.r1280 and below. " + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security@asustor.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "HIGH", + "availabilityImpact": "LOW", + "baseScore": 8.6, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 3.9, + "impactScore": 4.7 + } + ] + }, + "weaknesses": [ + { + "source": "security@asustor.com", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-200" + } + ] + } + ], + "references": [ + { + "url": "https://www.asustor.com/security/security_advisory_detail?id=24", + "source": "security@asustor.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-30xx/CVE-2023-3003.json b/CVE-2023/CVE-2023-30xx/CVE-2023-3003.json new file mode 100644 index 00000000000..97c7615cbbe --- /dev/null +++ b/CVE-2023/CVE-2023-30xx/CVE-2023-3003.json @@ -0,0 +1,88 @@ +{ + "id": "CVE-2023-3003", + "sourceIdentifier": "cna@vuldb.com", + "published": "2023-05-31T09:15:10.600", + "lastModified": "2023-05-31T09:15:10.600", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability classified as critical was found in SourceCodester Train Station Ticketing System 1.0. Affected by this vulnerability is an unknown functionality of the file manage_prices.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230347." + } + ], + "metrics": { + "cvssMetricV30": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "3.0", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "LOW", + "baseScore": 6.3, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 3.4 + } + ], + "cvssMetricV2": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "2.0", + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", + "accessVector": "NETWORK", + "accessComplexity": "LOW", + "authentication": "SINGLE", + "confidentialityImpact": "PARTIAL", + "integrityImpact": "PARTIAL", + "availabilityImpact": "PARTIAL", + "baseScore": 6.5 + }, + "baseSeverity": "MEDIUM", + "exploitabilityScore": 8.0, + "impactScore": 6.4, + "acInsufInfo": false, + "obtainAllPrivilege": false, + "obtainUserPrivilege": false, + "obtainOtherPrivilege": false, + "userInteractionRequired": false + } + ] + }, + "weaknesses": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-89" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/shiyur14/bugReport/blob/main/SQL.md", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?ctiid.230347", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?id.230347", + "source": "cna@vuldb.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-30xx/CVE-2023-3004.json b/CVE-2023/CVE-2023-30xx/CVE-2023-3004.json new file mode 100644 index 00000000000..16558d3194c --- /dev/null +++ b/CVE-2023/CVE-2023-30xx/CVE-2023-3004.json @@ -0,0 +1,88 @@ +{ + "id": "CVE-2023-3004", + "sourceIdentifier": "cna@vuldb.com", + "published": "2023-05-31T09:15:10.677", + "lastModified": "2023-05-31T09:15:10.677", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability, which was classified as critical, has been found in SourceCodester Simple Chat System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=read_msg of the component POST Parameter Handler. The manipulation of the argument convo_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230348." + } + ], + "metrics": { + "cvssMetricV30": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "3.0", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "LOW", + "baseScore": 6.3, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 3.4 + } + ], + "cvssMetricV2": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "2.0", + "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", + "accessVector": "NETWORK", + "accessComplexity": "LOW", + "authentication": "SINGLE", + "confidentialityImpact": "PARTIAL", + "integrityImpact": "PARTIAL", + "availabilityImpact": "PARTIAL", + "baseScore": 6.5 + }, + "baseSeverity": "MEDIUM", + "exploitabilityScore": 8.0, + "impactScore": 6.4, + "acInsufInfo": false, + "obtainAllPrivilege": false, + "obtainUserPrivilege": false, + "obtainOtherPrivilege": false, + "userInteractionRequired": false + } + ] + }, + "weaknesses": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-89" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/sikii7/CVE/blob/main/SQL.md", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?ctiid.230348", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?id.230348", + "source": "cna@vuldb.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-30xx/CVE-2023-3005.json b/CVE-2023/CVE-2023-30xx/CVE-2023-3005.json new file mode 100644 index 00000000000..0514de9a621 --- /dev/null +++ b/CVE-2023/CVE-2023-30xx/CVE-2023-3005.json @@ -0,0 +1,88 @@ +{ + "id": "CVE-2023-3005", + "sourceIdentifier": "cna@vuldb.com", + "published": "2023-05-31T09:15:10.743", + "lastModified": "2023-05-31T09:15:10.743", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability, which was classified as problematic, was found in SourceCodester Local Service Search Engine Management System 1.0. This affects an unknown part of the file /admin/ajax.php?action=save_area of the component POST Parameter Handler. The manipulation of the argument area with the input leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-230349 was assigned to this vulnerability." + } + ], + "metrics": { + "cvssMetricV30": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "3.0", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 3.5, + "baseSeverity": "LOW" + }, + "exploitabilityScore": 2.1, + "impactScore": 1.4 + } + ], + "cvssMetricV2": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "2.0", + "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", + "accessVector": "NETWORK", + "accessComplexity": "LOW", + "authentication": "SINGLE", + "confidentialityImpact": "NONE", + "integrityImpact": "PARTIAL", + "availabilityImpact": "NONE", + "baseScore": 4.0 + }, + "baseSeverity": "MEDIUM", + "exploitabilityScore": 8.0, + "impactScore": 2.9, + "acInsufInfo": false, + "obtainAllPrivilege": false, + "obtainUserPrivilege": false, + "obtainOtherPrivilege": false, + "userInteractionRequired": false + } + ] + }, + "weaknesses": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-79" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/sikii7/CVE/blob/main/XSS.md", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?ctiid.230349", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?id.230349", + "source": "cna@vuldb.com" + } + ] +} \ No newline at end of file diff --git a/README.md b/README.md index 431d6ef6b6d..5856086ee7f 100644 --- a/README.md +++ b/README.md @@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2023-05-31T06:00:24.992806+00:00 +2023-05-31T10:00:29.317910+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2023-05-31T05:15:10.260000+00:00 +2023-05-31T09:15:10.743000+00:00 ``` ### Last Data Feed Release @@ -29,26 +29,35 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/ ### Total Number of included CVEs ```plain -216482 +216486 ``` ### CVEs added in the last Commit -Recently added CVEs: `6` +Recently added CVEs: `4` -* [CVE-2023-1661](CVE-2023/CVE-2023-16xx/CVE-2023-1661.json) (`2023-05-31T04:15:09.893`) -* [CVE-2023-2434](CVE-2023/CVE-2023-24xx/CVE-2023-2434.json) (`2023-05-31T04:15:10.070`) -* [CVE-2023-2836](CVE-2023/CVE-2023-28xx/CVE-2023-2836.json) (`2023-05-31T04:15:10.200`) -* [CVE-2023-25539](CVE-2023/CVE-2023-255xx/CVE-2023-25539.json) (`2023-05-31T05:15:09.537`) -* [CVE-2023-26131](CVE-2023/CVE-2023-261xx/CVE-2023-26131.json) (`2023-05-31T05:15:10.180`) -* [CVE-2023-2304](CVE-2023/CVE-2023-23xx/CVE-2023-2304.json) (`2023-05-31T05:15:10.260`) +* [CVE-2023-2749](CVE-2023/CVE-2023-27xx/CVE-2023-2749.json) (`2023-05-31T09:15:10.490`) +* [CVE-2023-3003](CVE-2023/CVE-2023-30xx/CVE-2023-3003.json) (`2023-05-31T09:15:10.600`) +* [CVE-2023-3004](CVE-2023/CVE-2023-30xx/CVE-2023-3004.json) (`2023-05-31T09:15:10.677`) +* [CVE-2023-3005](CVE-2023/CVE-2023-30xx/CVE-2023-3005.json) (`2023-05-31T09:15:10.743`) ### CVEs modified in the last Commit -Recently modified CVEs: `1` +Recently modified CVEs: `12` -* [CVE-2023-28488](CVE-2023/CVE-2023-284xx/CVE-2023-28488.json) (`2023-05-31T04:15:09.993`) +* [CVE-2022-34397](CVE-2022/CVE-2022-343xx/CVE-2022-34397.json) (`2023-05-31T06:15:09.527`) +* [CVE-2022-29831](CVE-2022/CVE-2022-298xx/CVE-2022-29831.json) (`2023-05-31T07:15:08.930`) +* [CVE-2022-29832](CVE-2022/CVE-2022-298xx/CVE-2022-29832.json) (`2023-05-31T07:15:09.880`) +* [CVE-2022-29833](CVE-2022/CVE-2022-298xx/CVE-2022-29833.json) (`2023-05-31T07:15:10.850`) +* [CVE-2022-25164](CVE-2022/CVE-2022-251xx/CVE-2022-25164.json) (`2023-05-31T09:15:09.710`) +* [CVE-2022-29825](CVE-2022/CVE-2022-298xx/CVE-2022-29825.json) (`2023-05-31T09:15:09.977`) +* [CVE-2022-29826](CVE-2022/CVE-2022-298xx/CVE-2022-29826.json) (`2023-05-31T09:15:10.080`) +* [CVE-2022-29827](CVE-2022/CVE-2022-298xx/CVE-2022-29827.json) (`2023-05-31T09:15:10.160`) +* [CVE-2022-29828](CVE-2022/CVE-2022-298xx/CVE-2022-29828.json) (`2023-05-31T09:15:10.253`) +* [CVE-2022-29829](CVE-2022/CVE-2022-298xx/CVE-2022-29829.json) (`2023-05-31T09:15:10.333`) +* [CVE-2022-29830](CVE-2022/CVE-2022-298xx/CVE-2022-29830.json) (`2023-05-31T09:15:10.403`) +* [CVE-2023-25934](CVE-2023/CVE-2023-259xx/CVE-2023-25934.json) (`2023-05-31T06:15:10.553`) ## Download and Usage