diff --git a/CVE-2022/CVE-2022-433xx/CVE-2022-43358.json b/CVE-2022/CVE-2022-433xx/CVE-2022-43358.json index 20fde48c211..b475371f0c2 100644 --- a/CVE-2022/CVE-2022-433xx/CVE-2022-43358.json +++ b/CVE-2022/CVE-2022-433xx/CVE-2022-43358.json @@ -2,27 +2,91 @@ "id": "CVE-2022-43358", "sourceIdentifier": "cve@mitre.org", "published": "2023-08-22T19:16:29.603", - "lastModified": "2023-08-22T20:10:36.537", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-08-30T19:34:51.023", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", "value": "Stack overflow vulnerability in ast_selectors.cpp: in function Sass::ComplexSelector::has_placeholder in libsass:3.6.5-8-g210218, which can be exploited by attackers to cause a denial of service (DoS)." } ], - "metrics": {}, + "metrics": { + "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "HIGH", + "baseScore": 7.5, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + } + ] + }, + "weaknesses": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-787" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:sass-lang:libsass:3.6.5-8-g210218:*:*:*:*:*:*:*", + "matchCriteriaId": "DD554F0E-70F8-4860-8F1A-292E60E0F9A3" + } + ] + } + ] + } + ], "references": [ { "url": "https://drive.google.com/file/d/1j5fkPjWH9zQeTdO_4dMcZ-FpOBzP0MaI/", - "source": "cve@mitre.org" + "source": "cve@mitre.org", + "tags": [ + "Permissions Required", + "Third Party Advisory" + ] }, { "url": "https://github.com/sass/libsass", - "source": "cve@mitre.org" + "source": "cve@mitre.org", + "tags": [ + "Product" + ] }, { "url": "https://github.com/sass/libsass/issues/3178", - "source": "cve@mitre.org" + "source": "cve@mitre.org", + "tags": [ + "Exploit", + "Issue Tracking", + "Vendor Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-320xx/CVE-2023-32077.json b/CVE-2023/CVE-2023-320xx/CVE-2023-32077.json index acb8c89fece..42fce22afc2 100644 --- a/CVE-2023/CVE-2023-320xx/CVE-2023-32077.json +++ b/CVE-2023/CVE-2023-320xx/CVE-2023-32077.json @@ -2,8 +2,8 @@ "id": "CVE-2023-32077", "sourceIdentifier": "security-advisories@github.com", "published": "2023-08-24T22:15:08.077", - "lastModified": "2023-08-25T03:55:07.777", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-08-30T18:18:07.060", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", @@ -12,6 +12,26 @@ ], "metrics": { "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "baseScore": 7.5, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 3.9, + "impactScore": 3.6 + }, { "source": "security-advisories@github.com", "type": "Secondary", @@ -36,8 +56,18 @@ }, "weaknesses": [ { - "source": "security-advisories@github.com", + "source": "nvd@nist.gov", "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-798" + } + ] + }, + { + "source": "security-advisories@github.com", + "type": "Secondary", "description": [ { "lang": "en", @@ -46,22 +76,59 @@ ] } ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*", + "versionEndExcluding": "0.17.1", + "matchCriteriaId": "D271FC17-56AA-4851-846B-D7D174EBFB45" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*", + "versionStartIncluding": "0.18.0", + "versionEndIncluding": "0.18.5", + "matchCriteriaId": "249015D8-1590-4B85-A3F7-6F5F360CF0AD" + } + ] + } + ] + } + ], "references": [ { "url": "https://github.com/gravitl/netmaker/commit/1621c27c1d176b639e9768b2acad7693e387fd51", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Patch" + ] }, { "url": "https://github.com/gravitl/netmaker/commit/9362c39a9a822f0e07361aa7c77af2610597e657", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Patch" + ] }, { "url": "https://github.com/gravitl/netmaker/pull/2170", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Patch" + ] }, { "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-8x8h-hcq8-jwwx", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Vendor Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-320xx/CVE-2023-32079.json b/CVE-2023/CVE-2023-320xx/CVE-2023-32079.json index 1ba6a2de42a..bf9fae80c7b 100644 --- a/CVE-2023/CVE-2023-320xx/CVE-2023-32079.json +++ b/CVE-2023/CVE-2023-320xx/CVE-2023-32079.json @@ -2,8 +2,8 @@ "id": "CVE-2023-32079", "sourceIdentifier": "security-advisories@github.com", "published": "2023-08-24T23:15:08.570", - "lastModified": "2023-08-25T03:55:07.777", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-08-30T18:34:12.660", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", @@ -12,6 +12,26 @@ ], "metrics": { "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 2.8, + "impactScore": 5.9 + }, { "source": "security-advisories@github.com", "type": "Secondary", @@ -46,10 +66,38 @@ ] } ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*", + "versionEndExcluding": "0.17.1", + "matchCriteriaId": "D271FC17-56AA-4851-846B-D7D174EBFB45" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*", + "versionStartIncluding": "0.18.0", + "versionEndIncluding": "0.18.5", + "matchCriteriaId": "249015D8-1590-4B85-A3F7-6F5F360CF0AD" + } + ] + } + ] + } + ], "references": [ { "url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-826j-8wp2-4x6q", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Vendor Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-368xx/CVE-2023-36811.json b/CVE-2023/CVE-2023-368xx/CVE-2023-36811.json new file mode 100644 index 00000000000..40b644e8121 --- /dev/null +++ b/CVE-2023/CVE-2023-368xx/CVE-2023-36811.json @@ -0,0 +1,63 @@ +{ + "id": "CVE-2023-36811", + "sourceIdentifier": "security-advisories@github.com", + "published": "2023-08-30T18:15:09.487", + "lastModified": "2023-08-30T18:15:09.487", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives and potentially indirectly cause backup data loss in the repository. The attack requires an attacker to be able to: 1. insert files (with no additional headers) into backups and 2. gain write access to the repository. This vulnerability does not disclose plaintext to the attacker, nor does it affect the authenticity of existing archives. Creating plausible fake archives may be feasible for empty or small archives, but is unlikely for large archives. The issue has been fixed in borgbackup 1.2.5. Users are advised to upgrade. Additionally to installing the fixed code, users must follow the upgrade procedure as documented in the change log. Data loss after being attacked can be avoided by reviewing the archives (timestamp and contents valid and as expected) after any \"borg check --repair\" and before \"borg prune\". There are no known workarounds for this vulnerability." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security-advisories@github.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", + "attackVector": "LOCAL", + "attackComplexity": "HIGH", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "HIGH", + "availabilityImpact": "NONE", + "baseScore": 4.7, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 1.0, + "impactScore": 3.6 + } + ] + }, + "weaknesses": [ + { + "source": "security-advisories@github.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-347" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/borgbackup/borg/blob/1.2.5-cvedocs/docs/changes.rst#pre-125-archives-spoofing-vulnerability-cve-2023-36811", + "source": "security-advisories@github.com" + }, + { + "url": "https://github.com/borgbackup/borg/commit/3eb070191da10c2d3f7bc6484cf3d51c3045f884", + "source": "security-advisories@github.com" + }, + { + "url": "https://github.com/borgbackup/borg/security/advisories/GHSA-8fjr-hghr-4m99", + "source": "security-advisories@github.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-385xx/CVE-2023-38508.json b/CVE-2023/CVE-2023-385xx/CVE-2023-38508.json index 9b0b73c80c8..5936941e598 100644 --- a/CVE-2023/CVE-2023-385xx/CVE-2023-38508.json +++ b/CVE-2023/CVE-2023-385xx/CVE-2023-38508.json @@ -2,8 +2,8 @@ "id": "CVE-2023-38508", "sourceIdentifier": "security-advisories@github.com", "published": "2023-08-24T23:15:08.803", - "lastModified": "2023-08-25T03:55:07.777", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-08-30T18:23:27.400", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", @@ -12,6 +12,26 @@ ], "metrics": { "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "baseScore": 4.3, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 1.4 + }, { "source": "security-advisories@github.com", "type": "Secondary", @@ -36,8 +56,18 @@ }, "weaknesses": [ { - "source": "security-advisories@github.com", + "source": "nvd@nist.gov", "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-862" + } + ] + }, + { + "source": "security-advisories@github.com", + "type": "Secondary", "description": [ { "lang": "en", @@ -50,22 +80,69 @@ ] } ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", + "versionEndExcluding": "14.10-6", + "matchCriteriaId": "02978410-E893-4658-8504-4E109A3E791E" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*", + "versionEndExcluding": "14.11.99.28", + "matchCriteriaId": "4DB1EBAE-50D3-4D68-B912-589685D5CF2E" + }, + { + "vulnerable": true, + "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", + "versionStartIncluding": "14.11", + "versionEndExcluding": "14.11-3", + "matchCriteriaId": "F85C9C17-E15B-4042-96B2-0F0F8B7CD6A7" + } + ] + } + ] + } + ], "references": [ { "url": "https://github.com/Enalean/tuleap/commit/307c1c8044522a2dcc711062b18a3b3f9059a6c3", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Patch" + ] }, { "url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-h637-g4xp-2992", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Patch", + "Vendor Advisory" + ] }, { "url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=307c1c8044522a2dcc711062b18a3b3f9059a6c3", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Patch" + ] }, { "url": "https://tuleap.net/plugins/tracker/?aid=33608", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Exploit", + "Issue Tracking", + "Patch", + "Vendor Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-396xx/CVE-2023-39699.json b/CVE-2023/CVE-2023-396xx/CVE-2023-39699.json index ba931459b22..c34ad45f18a 100644 --- a/CVE-2023/CVE-2023-396xx/CVE-2023-39699.json +++ b/CVE-2023/CVE-2023-396xx/CVE-2023-39699.json @@ -2,27 +2,89 @@ "id": "CVE-2023-39699", "sourceIdentifier": "cve@mitre.org", "published": "2023-08-25T00:15:09.283", - "lastModified": "2023-08-25T03:55:07.777", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-08-30T19:18:36.570", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", "value": "IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server." } ], - "metrics": {}, + "metrics": { + "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 9.8, + "baseSeverity": "CRITICAL" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.9 + } + ] + }, + "weaknesses": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-22" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:icewarp:mail_server:10.4.5:*:*:*:*:*:*:*", + "matchCriteriaId": "6B36217E-C6E5-4841-9B43-802B0D1474B4" + } + ] + } + ] + } + ], "references": [ { "url": "https://cwe.mitre.org/data/definitions/98.html", - "source": "cve@mitre.org" + "source": "cve@mitre.org", + "tags": [ + "Third Party Advisory" + ] }, { "url": "https://drive.google.com/file/d/1NkqL4ySJApyPy8B-zDC7vE-QMBQAu8OU", - "source": "cve@mitre.org" + "source": "cve@mitre.org", + "tags": [ + "Exploit", + "Third Party Advisory" + ] }, { "url": "https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion", - "source": "cve@mitre.org" + "source": "cve@mitre.org", + "tags": [ + "Third Party Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-397xx/CVE-2023-39700.json b/CVE-2023/CVE-2023-397xx/CVE-2023-39700.json index 0988b163c1f..2b123067241 100644 --- a/CVE-2023/CVE-2023-397xx/CVE-2023-39700.json +++ b/CVE-2023/CVE-2023-397xx/CVE-2023-39700.json @@ -2,27 +2,93 @@ "id": "CVE-2023-39700", "sourceIdentifier": "cve@mitre.org", "published": "2023-08-25T00:15:09.693", - "lastModified": "2023-08-25T03:55:07.777", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-08-30T19:08:43.877", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", "value": "IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter." + }, + { + "lang": "es", + "value": "Se ha descubierto que IceWarp Mail Server v10.4.5 contiene una vulnerabilidad de Cross-Site Scripting reflejado (XSS) a trav\u00e9s del par\u00e1metro color. " + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 6.1, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 2.7 + } + ] + }, + "weaknesses": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-79" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:icewarp:mail_server:10.4.5:*:*:*:*:*:*:*", + "matchCriteriaId": "6B36217E-C6E5-4841-9B43-802B0D1474B4" + } + ] + } + ] } ], - "metrics": {}, "references": [ { "url": "https://cwe.mitre.org/data/definitions/79.html", - "source": "cve@mitre.org" + "source": "cve@mitre.org", + "tags": [ + "Third Party Advisory" + ] }, { "url": "https://drive.google.com/file/d/1QL_517UbTFJox4CXKQpP9fehR1yXRJ-y", - "source": "cve@mitre.org" + "source": "cve@mitre.org", + "tags": [ + "Exploit", + "Third Party Advisory" + ] }, { "url": "https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)", - "source": "cve@mitre.org" + "source": "cve@mitre.org", + "tags": [ + "Third Party Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-400xx/CVE-2023-40022.json b/CVE-2023/CVE-2023-400xx/CVE-2023-40022.json index 910ea822217..20295b5b631 100644 --- a/CVE-2023/CVE-2023-400xx/CVE-2023-40022.json +++ b/CVE-2023/CVE-2023-400xx/CVE-2023-40022.json @@ -2,8 +2,8 @@ "id": "CVE-2023-40022", "sourceIdentifier": "security-advisories@github.com", "published": "2023-08-24T23:15:09.177", - "lastModified": "2023-08-25T03:55:07.777", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-08-30T19:50:45.640", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", @@ -12,6 +12,26 @@ ], "metrics": { "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "attackVector": "LOCAL", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 7.8, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 1.8, + "impactScore": 5.9 + }, { "source": "security-advisories@github.com", "type": "Secondary", @@ -46,26 +66,60 @@ ] } ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:rizin:rizin:*:*:*:*:*:*:*:*", + "versionEndExcluding": "0.6.1", + "matchCriteriaId": "08C366A2-96F0-48AF-9956-4D145431166F" + } + ] + } + ] + } + ], "references": [ { "url": "https://github.com/rizinorg/rizin/pull/3753", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Patch" + ] }, { "url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-92h6-wwc2-53cq", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Patch", + "Vendor Advisory" + ] }, { "url": "https://github.com/rizinorg/rz-libdemangle/blob/main/src/gnu_v2/cplus-dem.c#L419", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Product" + ] }, { "url": "https://github.com/rizinorg/rz-libdemangle/commit/51d016750e704b27ab8ace23c0f72acabca67018", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Patch" + ] }, { "url": "https://github.com/rizinorg/rz-libdemangle/pull/54", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Patch" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-401xx/CVE-2023-40179.json b/CVE-2023/CVE-2023-401xx/CVE-2023-40179.json index 20808ea5393..d52af34d806 100644 --- a/CVE-2023/CVE-2023-401xx/CVE-2023-40179.json +++ b/CVE-2023/CVE-2023-401xx/CVE-2023-40179.json @@ -2,8 +2,8 @@ "id": "CVE-2023-40179", "sourceIdentifier": "security-advisories@github.com", "published": "2023-08-25T01:15:08.777", - "lastModified": "2023-08-25T03:55:07.777", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-08-30T18:41:19.897", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", @@ -12,6 +12,26 @@ ], "metrics": { "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "baseScore": 5.3, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 3.9, + "impactScore": 1.4 + }, { "source": "security-advisories@github.com", "type": "Secondary", @@ -46,10 +66,31 @@ ] } ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:silverwaregames:silverwaregames:*:*:*:*:*:*:*:*", + "versionEndExcluding": "1.3.6", + "matchCriteriaId": "8E3EACD4-859D-4B11-A8A7-185F6B51AD49" + } + ] + } + ] + } + ], "references": [ { "url": "https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-789j-chfj-58hr", - "source": "security-advisories@github.com" + "source": "security-advisories@github.com", + "tags": [ + "Third Party Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-401xx/CVE-2023-40184.json b/CVE-2023/CVE-2023-401xx/CVE-2023-40184.json new file mode 100644 index 00000000000..6ed274b4b1b --- /dev/null +++ b/CVE-2023/CVE-2023-401xx/CVE-2023-40184.json @@ -0,0 +1,63 @@ +{ + "id": "CVE-2023-40184", + "sourceIdentifier": "security-advisories@github.com", + "published": "2023-08-30T18:15:09.690", + "lastModified": "2023-08-30T18:15:09.690", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": " xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security-advisories@github.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "LOW", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "LOW", + "baseScore": 2.6, + "baseSeverity": "LOW" + }, + "exploitabilityScore": 1.2, + "impactScore": 1.4 + } + ] + }, + "weaknesses": [ + { + "source": "security-advisories@github.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-755" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/neutrinolabs/xrdp/blame/9bbb2ec68f390504c32f2062847aa3d821a0089a/sesman/sesexec/session.c#L571C5-L571C19", + "source": "security-advisories@github.com" + }, + { + "url": "https://github.com/neutrinolabs/xrdp/commit/a111a0fdfe2421ef600e40708b5f0168594cfb23", + "source": "security-advisories@github.com" + }, + { + "url": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-f489-557v-47jq", + "source": "security-advisories@github.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-405xx/CVE-2023-40582.json b/CVE-2023/CVE-2023-405xx/CVE-2023-40582.json new file mode 100644 index 00000000000..778e942005f --- /dev/null +++ b/CVE-2023/CVE-2023-405xx/CVE-2023-40582.json @@ -0,0 +1,59 @@ +{ + "id": "CVE-2023-40582", + "sourceIdentifier": "security-advisories@github.com", + "published": "2023-08-30T18:15:09.783", + "lastModified": "2023-08-30T18:15:09.783", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input and are vulnerable to Command Injection via an attacker controlled parameter. As a result, attackers may run malicious shell commands in the context of the running process. This issue has been addressed in version 1.0.3. users are advised to upgrade. Users unable to upgrade should ensure that all input passed to find-exec comes from a trusted source." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security-advisories@github.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 9.8, + "baseSeverity": "CRITICAL" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.9 + } + ] + }, + "weaknesses": [ + { + "source": "security-advisories@github.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-78" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/shime/find-exec/commit/74fb108097c229b03d6dba4cce81e36aa364b51c", + "source": "security-advisories@github.com" + }, + { + "url": "https://github.com/shime/find-exec/security/advisories/GHSA-95rp-6gqp-6622", + "source": "security-advisories@github.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-410xx/CVE-2023-41039.json b/CVE-2023/CVE-2023-410xx/CVE-2023-41039.json new file mode 100644 index 00000000000..bdb19212071 --- /dev/null +++ b/CVE-2023/CVE-2023-410xx/CVE-2023-41039.json @@ -0,0 +1,59 @@ +{ + "id": "CVE-2023-41039", + "sourceIdentifier": "security-advisories@github.com", + "published": "2023-08-30T18:15:09.880", + "lastModified": "2023-08-30T18:15:09.880", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's \"format\" functionality allows someone controlling the format string to \"read\" all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to critical information disclosure. With `RestrictedPython`, the format functionality is available via the `format` and `format_map` methods of `str` (and `unicode`) (accessed either via the class or its instances) and via `string.Formatter`. All known versions of `RestrictedPython` are vulnerable. This issue has been addressed in commit `4134aedcff1` which has been included in the 5.4 and 6.2 releases. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\n" + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security-advisories@github.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "HIGH", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "LOW", + "baseScore": 8.3, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 1.7, + "impactScore": 6.0 + } + ] + }, + "weaknesses": [ + { + "source": "security-advisories@github.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-74" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/zopefoundation/RestrictedPython/commit/4134aedcff17c977da7717693ed89ce56d54c120", + "source": "security-advisories@github.com" + }, + { + "url": "https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67", + "source": "security-advisories@github.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-45xx/CVE-2023-4520.json b/CVE-2023/CVE-2023-45xx/CVE-2023-4520.json index 27ed8a8297d..b4e9c4fb710 100644 --- a/CVE-2023/CVE-2023-45xx/CVE-2023-4520.json +++ b/CVE-2023/CVE-2023-45xx/CVE-2023-4520.json @@ -2,8 +2,8 @@ "id": "CVE-2023-4520", "sourceIdentifier": "security@wordfence.com", "published": "2023-08-25T03:15:09.223", - "lastModified": "2023-08-25T03:55:07.777", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-08-30T19:46:28.673", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", @@ -13,8 +13,28 @@ "metrics": { "cvssMetricV31": [ { - "source": "security@wordfence.com", + "source": "nvd@nist.gov", "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 6.1, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 2.7 + }, + { + "source": "security@wordfence.com", + "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", @@ -46,18 +66,45 @@ ] } ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:foliovision:fv_flowplayer_video_player:*:*:*:*:*:wordpress:*:*", + "versionEndIncluding": "7.5.37.7212", + "matchCriteriaId": "8B131736-533B-4F60-84F6-B1EBB923B809" + } + ] + } + ] + } + ], "references": [ { "url": "https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/tags/7.5.36.7212/models/custom-videos.php#L341", - "source": "security@wordfence.com" + "source": "security@wordfence.com", + "tags": [ + "Product" + ] }, { "url": "https://plugins.trac.wordpress.org/changeset/2957322/fv-wordpress-flowplayer#file2", - "source": "security@wordfence.com" + "source": "security@wordfence.com", + "tags": [ + "Patch" + ] }, { "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c55ca7d4-6bc0-49c9-8ce0-50fff8775a76?source=cve", - "source": "security@wordfence.com" + "source": "security@wordfence.com", + "tags": [ + "Third Party Advisory" + ] } ] } \ No newline at end of file diff --git a/README.md b/README.md index fa684b9cb88..71735d57754 100644 --- a/README.md +++ b/README.md @@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2023-08-30T18:00:25.602909+00:00 +2023-08-30T20:00:24.280143+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2023-08-30T17:48:12.503000+00:00 +2023-08-30T19:50:45.640000+00:00 ``` ### Last Data Feed Release @@ -29,58 +29,32 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/ ### Total Number of included CVEs ```plain -223745 +223749 ``` ### CVEs added in the last Commit -Recently added CVEs: `33` +Recently added CVEs: `4` -* [CVE-2023-32294](CVE-2023/CVE-2023-322xx/CVE-2023-32294.json) (`2023-08-30T16:15:10.153`) -* [CVE-2023-34372](CVE-2023/CVE-2023-343xx/CVE-2023-34372.json) (`2023-08-30T16:15:10.363`) -* [CVE-2023-35092](CVE-2023/CVE-2023-350xx/CVE-2023-35092.json) (`2023-08-30T16:15:10.600`) -* [CVE-2023-35094](CVE-2023/CVE-2023-350xx/CVE-2023-35094.json) (`2023-08-30T16:15:10.873`) -* [CVE-2023-20266](CVE-2023/CVE-2023-202xx/CVE-2023-20266.json) (`2023-08-30T17:15:08.357`) -* [CVE-2023-40592](CVE-2023/CVE-2023-405xx/CVE-2023-40592.json) (`2023-08-30T17:15:09.763`) -* [CVE-2023-40593](CVE-2023/CVE-2023-405xx/CVE-2023-40593.json) (`2023-08-30T17:15:09.853`) -* [CVE-2023-40594](CVE-2023/CVE-2023-405xx/CVE-2023-40594.json) (`2023-08-30T17:15:09.940`) -* [CVE-2023-40595](CVE-2023/CVE-2023-405xx/CVE-2023-40595.json) (`2023-08-30T17:15:10.027`) -* [CVE-2023-40596](CVE-2023/CVE-2023-405xx/CVE-2023-40596.json) (`2023-08-30T17:15:10.103`) -* [CVE-2023-40597](CVE-2023/CVE-2023-405xx/CVE-2023-40597.json) (`2023-08-30T17:15:10.180`) -* [CVE-2023-40598](CVE-2023/CVE-2023-405xx/CVE-2023-40598.json) (`2023-08-30T17:15:10.267`) -* [CVE-2023-40837](CVE-2023/CVE-2023-408xx/CVE-2023-40837.json) (`2023-08-30T17:15:10.337`) -* [CVE-2023-40838](CVE-2023/CVE-2023-408xx/CVE-2023-40838.json) (`2023-08-30T17:15:10.397`) -* [CVE-2023-40839](CVE-2023/CVE-2023-408xx/CVE-2023-40839.json) (`2023-08-30T17:15:10.453`) -* [CVE-2023-40840](CVE-2023/CVE-2023-408xx/CVE-2023-40840.json) (`2023-08-30T17:15:10.517`) -* [CVE-2023-40841](CVE-2023/CVE-2023-408xx/CVE-2023-40841.json) (`2023-08-30T17:15:10.577`) -* [CVE-2023-40842](CVE-2023/CVE-2023-408xx/CVE-2023-40842.json) (`2023-08-30T17:15:10.640`) -* [CVE-2023-40843](CVE-2023/CVE-2023-408xx/CVE-2023-40843.json) (`2023-08-30T17:15:10.697`) -* [CVE-2023-40844](CVE-2023/CVE-2023-408xx/CVE-2023-40844.json) (`2023-08-30T17:15:10.757`) -* [CVE-2023-40845](CVE-2023/CVE-2023-408xx/CVE-2023-40845.json) (`2023-08-30T17:15:10.817`) -* [CVE-2023-40847](CVE-2023/CVE-2023-408xx/CVE-2023-40847.json) (`2023-08-30T17:15:10.877`) -* [CVE-2023-40848](CVE-2023/CVE-2023-408xx/CVE-2023-40848.json) (`2023-08-30T17:15:10.943`) -* [CVE-2023-4571](CVE-2023/CVE-2023-45xx/CVE-2023-4571.json) (`2023-08-30T17:15:11.080`) -* [CVE-2023-4640](CVE-2023/CVE-2023-46xx/CVE-2023-4640.json) (`2023-08-30T17:15:11.157`) +* [CVE-2023-36811](CVE-2023/CVE-2023-368xx/CVE-2023-36811.json) (`2023-08-30T18:15:09.487`) +* [CVE-2023-40184](CVE-2023/CVE-2023-401xx/CVE-2023-40184.json) (`2023-08-30T18:15:09.690`) +* [CVE-2023-40582](CVE-2023/CVE-2023-405xx/CVE-2023-40582.json) (`2023-08-30T18:15:09.783`) +* [CVE-2023-41039](CVE-2023/CVE-2023-410xx/CVE-2023-41039.json) (`2023-08-30T18:15:09.880`) ### CVEs modified in the last Commit -Recently modified CVEs: `14` +Recently modified CVEs: `9` -* [CVE-2020-22219](CVE-2020/CVE-2020-222xx/CVE-2020-22219.json) (`2023-08-30T16:57:28.420`) -* [CVE-2022-45611](CVE-2022/CVE-2022-456xx/CVE-2022-45611.json) (`2023-08-30T17:09:59.217`) -* [CVE-2022-45582](CVE-2022/CVE-2022-455xx/CVE-2022-45582.json) (`2023-08-30T17:12:38.817`) -* [CVE-2023-40612](CVE-2023/CVE-2023-406xx/CVE-2023-40612.json) (`2023-08-30T17:06:11.897`) -* [CVE-2023-32712](CVE-2023/CVE-2023-327xx/CVE-2023-32712.json) (`2023-08-30T17:15:08.477`) -* [CVE-2023-34468](CVE-2023/CVE-2023-344xx/CVE-2023-34468.json) (`2023-08-30T17:15:08.617`) -* [CVE-2023-36844](CVE-2023/CVE-2023-368xx/CVE-2023-36844.json) (`2023-08-30T17:15:08.727`) -* [CVE-2023-36845](CVE-2023/CVE-2023-368xx/CVE-2023-36845.json) (`2023-08-30T17:15:08.980`) -* [CVE-2023-36846](CVE-2023/CVE-2023-368xx/CVE-2023-36846.json) (`2023-08-30T17:15:09.300`) -* [CVE-2023-36847](CVE-2023/CVE-2023-368xx/CVE-2023-36847.json) (`2023-08-30T17:15:09.530`) -* [CVE-2023-3899](CVE-2023/CVE-2023-38xx/CVE-2023-3899.json) (`2023-08-30T17:19:03.907`) -* [CVE-2023-40025](CVE-2023/CVE-2023-400xx/CVE-2023-40025.json) (`2023-08-30T17:28:42.677`) -* [CVE-2023-39521](CVE-2023/CVE-2023-395xx/CVE-2023-39521.json) (`2023-08-30T17:43:59.497`) -* [CVE-2023-40017](CVE-2023/CVE-2023-400xx/CVE-2023-40017.json) (`2023-08-30T17:48:12.503`) +* [CVE-2022-43358](CVE-2022/CVE-2022-433xx/CVE-2022-43358.json) (`2023-08-30T19:34:51.023`) +* [CVE-2023-32077](CVE-2023/CVE-2023-320xx/CVE-2023-32077.json) (`2023-08-30T18:18:07.060`) +* [CVE-2023-38508](CVE-2023/CVE-2023-385xx/CVE-2023-38508.json) (`2023-08-30T18:23:27.400`) +* [CVE-2023-32079](CVE-2023/CVE-2023-320xx/CVE-2023-32079.json) (`2023-08-30T18:34:12.660`) +* [CVE-2023-40179](CVE-2023/CVE-2023-401xx/CVE-2023-40179.json) (`2023-08-30T18:41:19.897`) +* [CVE-2023-39700](CVE-2023/CVE-2023-397xx/CVE-2023-39700.json) (`2023-08-30T19:08:43.877`) +* [CVE-2023-39699](CVE-2023/CVE-2023-396xx/CVE-2023-39699.json) (`2023-08-30T19:18:36.570`) +* [CVE-2023-4520](CVE-2023/CVE-2023-45xx/CVE-2023-4520.json) (`2023-08-30T19:46:28.673`) +* [CVE-2023-40022](CVE-2023/CVE-2023-400xx/CVE-2023-40022.json) (`2023-08-30T19:50:45.640`) ## Download and Usage