Auto-Update: 2024-02-05T07:00:24.888388+00:00

This commit is contained in:
cad-safe-bot 2024-02-05 07:00:28 +00:00
parent f58a3d4178
commit 814491bf26
20 changed files with 550 additions and 11 deletions

View File

@ -0,0 +1,15 @@
{
"id": "CVE-2023-47170",
"sourceIdentifier": "disclosures@gallagher.com",
"published": "2024-02-05T05:15:07.730",
"lastModified": "2024-02-05T05:15:07.730",
"vulnStatus": "Rejected",
"descriptions": [
{
"lang": "en",
"value": "Rejected reason: This candidate was in a CNA pool that was not assigned to any issues during 2023."
}
],
"metrics": {},
"references": []
}

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2023-51504",
"sourceIdentifier": "audit@patchstack.com",
"published": "2024-02-05T06:15:46.400",
"lastModified": "2024-02-05T06:15:46.400",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Dulaney Dan's Embedder for Google Calendar allows Stored XSS.This issue affects Dan's Embedder for Google Calendar: from n/a through 1.2.\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "audit@patchstack.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.3,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "audit@patchstack.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/vulnerability/dans-gcal/wordpress-dan-s-embedder-for-google-calendar-plugin-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "audit@patchstack.com"
}
]
}

View File

@ -0,0 +1,43 @@
{
"id": "CVE-2023-5677",
"sourceIdentifier": "product-security@axis.com",
"published": "2024-02-05T06:15:46.690",
"lastModified": "2024-02-05T06:15:46.690",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Brandon\nRothel from QED Secure Solutions has found that the VAPIX API tcptest.cgi\ndid not have a sufficient input validation allowing for a possible remote code\nexecution. This flaw can only be exploited after authenticating with an\noperator- or administrator-privileged service account. The impact of exploiting\nthis vulnerability is lower with operator-privileges compared to\nadministrator-privileges service accounts. Axis has released patched AXIS OS\nversions for the highlighted flaw. Please refer to the Axis security advisory\nfor more information and solution. \n\n\n\n\n\n\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "product-security@axis.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 3.4
}
]
},
"references": [
{
"url": "https://www.axis.com/dam/public/a9/dd/f1/cve-2023-5677-en-US-424335.pdf",
"source": "product-security@axis.com"
}
]
}

View File

@ -0,0 +1,43 @@
{
"id": "CVE-2023-5800",
"sourceIdentifier": "product-security@axis.com",
"published": "2024-02-05T06:15:46.863",
"lastModified": "2024-02-05T06:15:46.863",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Vintage,\nmember of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi\ndid not have a sufficient input validation allowing for a possible remote code\nexecution. This flaw can only be exploited after authenticating with an\noperator- or administrator-privileged service account. Axis has released patched AXIS OS\nversions for the highlighted flaw. Please refer to the Axis security advisory\nfor more information and solution.\n\n\n\n\n\n\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "product-security@axis.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
}
]
},
"references": [
{
"url": "https://www.axis.com/dam/public/89/d9/99/cve-2023-5800-en-US-424339.pdf",
"source": "product-security@axis.com"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-20001",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-02-05T06:15:47.027",
"lastModified": "2024-02-05T06:15:47.027",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03961601; Issue ID: DTV03961601."
}
],
"metrics": {},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/February-2024",
"source": "security@mediatek.com"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-20002",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-02-05T06:15:47.083",
"lastModified": "2024-02-05T06:15:47.083",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In TVAPI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: DTV03961715; Issue ID: DTV03961715."
}
],
"metrics": {},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/February-2024",
"source": "security@mediatek.com"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-20003",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-02-05T06:15:47.130",
"lastModified": "2024-02-05T06:15:47.130",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent invalid NR RRC Connection Setup message, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01191612; Issue ID: MOLY01191612 (MSV-981)."
}
],
"metrics": {},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/February-2024",
"source": "security@mediatek.com"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-20004",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-02-05T06:15:47.190",
"lastModified": "2024-02-05T06:15:47.190",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In Modem NL1, there is a possible system crash due to an improper input validation. This could lead to remote denial of service, if NW sent invalid NR RRC Connection Setup message, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01191612; Issue ID: MOLY01195812 (MSV-985)."
}
],
"metrics": {},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/February-2024",
"source": "security@mediatek.com"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-20006",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-02-05T06:15:47.233",
"lastModified": "2024-02-05T06:15:47.233",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In da, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08477148; Issue ID: ALPS08477148."
}
],
"metrics": {},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/February-2024",
"source": "security@mediatek.com"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-20007",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-02-05T06:15:47.283",
"lastModified": "2024-02-05T06:15:47.283",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In mp3 decoder, there is a possible out of bounds write due to a race condition. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS08441369; Issue ID: ALPS08441369."
}
],
"metrics": {},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/February-2024",
"source": "security@mediatek.com"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-20009",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-02-05T06:15:47.330",
"lastModified": "2024-02-05T06:15:47.330",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In alac decoder, there is a possible out of bounds write due to an incorrect error handling. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS08441150; Issue ID: ALPS08441150."
}
],
"metrics": {},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/February-2024",
"source": "security@mediatek.com"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-20010",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-02-05T06:15:47.387",
"lastModified": "2024-02-05T06:15:47.387",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In keyInstall, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08358560; Issue ID: ALPS08358560."
}
],
"metrics": {},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/February-2024",
"source": "security@mediatek.com"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-20011",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-02-05T06:15:47.447",
"lastModified": "2024-02-05T06:15:47.447",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In alac decoder, there is a possible information disclosure due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08441146; Issue ID: ALPS08441146."
}
],
"metrics": {},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/February-2024",
"source": "security@mediatek.com"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-20012",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-02-05T06:15:47.490",
"lastModified": "2024-02-05T06:15:47.490",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In keyInstall, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08358566; Issue ID: ALPS08358566."
}
],
"metrics": {},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/February-2024",
"source": "security@mediatek.com"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-20013",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-02-05T06:15:47.530",
"lastModified": "2024-02-05T06:15:47.530",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08471742; Issue ID: ALPS08308608."
}
],
"metrics": {},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/February-2024",
"source": "security@mediatek.com"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-20015",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-02-05T06:15:47.580",
"lastModified": "2024-02-05T06:15:47.580",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In telephony, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08441419; Issue ID: ALPS08441419."
}
],
"metrics": {},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/February-2024",
"source": "security@mediatek.com"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-20016",
"sourceIdentifier": "security@mediatek.com",
"published": "2024-02-05T06:15:47.627",
"lastModified": "2024-02-05T06:15:47.627",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In ged, there is a possible out of bounds write due to an integer overflow. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation Patch ID: ALPS07835901; Issue ID: ALPS07835901."
}
],
"metrics": {},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/February-2024",
"source": "security@mediatek.com"
}
]
}

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2024-24866",
"sourceIdentifier": "audit@patchstack.com",
"published": "2024-02-05T06:15:47.677",
"lastModified": "2024-02-05T06:15:47.677",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Biteship Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo allows Reflected XSS.This issue affects Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo: from n/a through 2.2.24.\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "audit@patchstack.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "audit@patchstack.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/vulnerability/biteship/wordpress-biteship-plugin-2-2-24-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "audit@patchstack.com"
}
]
}

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2024-24870",
"sourceIdentifier": "audit@patchstack.com",
"published": "2024-02-05T06:15:47.870",
"lastModified": "2024-02-05T06:15:47.870",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Dempfle Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2023.10.\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "audit@patchstack.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.3,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "audit@patchstack.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/vulnerability/advanced-iframe/wordpress-advanced-iframe-plugin-2023-10-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "audit@patchstack.com"
}
]
}

View File

@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2024-02-05T05:00:23.799758+00:00
2024-02-05T07:00:24.888388+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2024-02-05T04:15:08.090000+00:00
2024-02-05T06:15:47.870000+00:00
```
### Last Data Feed Release
@ -29,25 +29,38 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
237521
237540
```
### CVEs added in the last Commit
Recently added CVEs: `0`
Recently added CVEs: `19`
* [CVE-2023-47170](CVE-2023/CVE-2023-471xx/CVE-2023-47170.json) (`2024-02-05T05:15:07.730`)
* [CVE-2023-51504](CVE-2023/CVE-2023-515xx/CVE-2023-51504.json) (`2024-02-05T06:15:46.400`)
* [CVE-2023-5677](CVE-2023/CVE-2023-56xx/CVE-2023-5677.json) (`2024-02-05T06:15:46.690`)
* [CVE-2023-5800](CVE-2023/CVE-2023-58xx/CVE-2023-5800.json) (`2024-02-05T06:15:46.863`)
* [CVE-2024-20001](CVE-2024/CVE-2024-200xx/CVE-2024-20001.json) (`2024-02-05T06:15:47.027`)
* [CVE-2024-20002](CVE-2024/CVE-2024-200xx/CVE-2024-20002.json) (`2024-02-05T06:15:47.083`)
* [CVE-2024-20003](CVE-2024/CVE-2024-200xx/CVE-2024-20003.json) (`2024-02-05T06:15:47.130`)
* [CVE-2024-20004](CVE-2024/CVE-2024-200xx/CVE-2024-20004.json) (`2024-02-05T06:15:47.190`)
* [CVE-2024-20006](CVE-2024/CVE-2024-200xx/CVE-2024-20006.json) (`2024-02-05T06:15:47.233`)
* [CVE-2024-20007](CVE-2024/CVE-2024-200xx/CVE-2024-20007.json) (`2024-02-05T06:15:47.283`)
* [CVE-2024-20009](CVE-2024/CVE-2024-200xx/CVE-2024-20009.json) (`2024-02-05T06:15:47.330`)
* [CVE-2024-20010](CVE-2024/CVE-2024-200xx/CVE-2024-20010.json) (`2024-02-05T06:15:47.387`)
* [CVE-2024-20011](CVE-2024/CVE-2024-200xx/CVE-2024-20011.json) (`2024-02-05T06:15:47.447`)
* [CVE-2024-20012](CVE-2024/CVE-2024-200xx/CVE-2024-20012.json) (`2024-02-05T06:15:47.490`)
* [CVE-2024-20013](CVE-2024/CVE-2024-200xx/CVE-2024-20013.json) (`2024-02-05T06:15:47.530`)
* [CVE-2024-20015](CVE-2024/CVE-2024-200xx/CVE-2024-20015.json) (`2024-02-05T06:15:47.580`)
* [CVE-2024-20016](CVE-2024/CVE-2024-200xx/CVE-2024-20016.json) (`2024-02-05T06:15:47.627`)
* [CVE-2024-24866](CVE-2024/CVE-2024-248xx/CVE-2024-24866.json) (`2024-02-05T06:15:47.677`)
* [CVE-2024-24870](CVE-2024/CVE-2024-248xx/CVE-2024-24870.json) (`2024-02-05T06:15:47.870`)
### CVEs modified in the last Commit
Recently modified CVEs: `6`
Recently modified CVEs: `0`
* [CVE-2022-40896](CVE-2022/CVE-2022-408xx/CVE-2022-40896.json) (`2024-02-05T03:15:07.443`)
* [CVE-2023-52339](CVE-2023/CVE-2023-523xx/CVE-2023-52339.json) (`2024-02-05T03:15:07.563`)
* [CVE-2023-4001](CVE-2023/CVE-2023-40xx/CVE-2023-4001.json) (`2024-02-05T04:15:07.793`)
* [CVE-2024-1059](CVE-2024/CVE-2024-10xx/CVE-2024-1059.json) (`2024-02-05T04:15:07.960`)
* [CVE-2024-1060](CVE-2024/CVE-2024-10xx/CVE-2024-1060.json) (`2024-02-05T04:15:08.033`)
* [CVE-2024-1077](CVE-2024/CVE-2024-10xx/CVE-2024-1077.json) (`2024-02-05T04:15:08.090`)
## Download and Usage