mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-07-09 16:05:11 +00:00
Auto-Update: 2023-08-30T20:00:24.280143+00:00
This commit is contained in:
parent
302e812f12
commit
82269187cb
@ -2,27 +2,91 @@
|
|||||||
"id": "CVE-2022-43358",
|
"id": "CVE-2022-43358",
|
||||||
"sourceIdentifier": "cve@mitre.org",
|
"sourceIdentifier": "cve@mitre.org",
|
||||||
"published": "2023-08-22T19:16:29.603",
|
"published": "2023-08-22T19:16:29.603",
|
||||||
"lastModified": "2023-08-22T20:10:36.537",
|
"lastModified": "2023-08-30T19:34:51.023",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "Stack overflow vulnerability in ast_selectors.cpp: in function Sass::ComplexSelector::has_placeholder in libsass:3.6.5-8-g210218, which can be exploited by attackers to cause a denial of service (DoS)."
|
"value": "Stack overflow vulnerability in ast_selectors.cpp: in function Sass::ComplexSelector::has_placeholder in libsass:3.6.5-8-g210218, which can be exploited by attackers to cause a denial of service (DoS)."
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {},
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "HIGH",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:sass-lang:libsass:3.6.5-8-g210218:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "DD554F0E-70F8-4860-8F1A-292E60E0F9A3"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://drive.google.com/file/d/1j5fkPjWH9zQeTdO_4dMcZ-FpOBzP0MaI/",
|
"url": "https://drive.google.com/file/d/1j5fkPjWH9zQeTdO_4dMcZ-FpOBzP0MaI/",
|
||||||
"source": "cve@mitre.org"
|
"source": "cve@mitre.org",
|
||||||
|
"tags": [
|
||||||
|
"Permissions Required",
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://github.com/sass/libsass",
|
"url": "https://github.com/sass/libsass",
|
||||||
"source": "cve@mitre.org"
|
"source": "cve@mitre.org",
|
||||||
|
"tags": [
|
||||||
|
"Product"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://github.com/sass/libsass/issues/3178",
|
"url": "https://github.com/sass/libsass/issues/3178",
|
||||||
"source": "cve@mitre.org"
|
"source": "cve@mitre.org",
|
||||||
|
"tags": [
|
||||||
|
"Exploit",
|
||||||
|
"Issue Tracking",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
@ -2,8 +2,8 @@
|
|||||||
"id": "CVE-2023-32077",
|
"id": "CVE-2023-32077",
|
||||||
"sourceIdentifier": "security-advisories@github.com",
|
"sourceIdentifier": "security-advisories@github.com",
|
||||||
"published": "2023-08-24T22:15:08.077",
|
"published": "2023-08-24T22:15:08.077",
|
||||||
"lastModified": "2023-08-25T03:55:07.777",
|
"lastModified": "2023-08-30T18:18:07.060",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -12,6 +12,26 @@
|
|||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 3.6
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "security-advisories@github.com",
|
"source": "security-advisories@github.com",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -36,8 +56,18 @@
|
|||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
{
|
{
|
||||||
"source": "security-advisories@github.com",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Primary",
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-798"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "security-advisories@github.com",
|
||||||
|
"type": "Secondary",
|
||||||
"description": [
|
"description": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -46,22 +76,59 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndExcluding": "0.17.1",
|
||||||
|
"matchCriteriaId": "D271FC17-56AA-4851-846B-D7D174EBFB45"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*",
|
||||||
|
"versionStartIncluding": "0.18.0",
|
||||||
|
"versionEndIncluding": "0.18.5",
|
||||||
|
"matchCriteriaId": "249015D8-1590-4B85-A3F7-6F5F360CF0AD"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://github.com/gravitl/netmaker/commit/1621c27c1d176b639e9768b2acad7693e387fd51",
|
"url": "https://github.com/gravitl/netmaker/commit/1621c27c1d176b639e9768b2acad7693e387fd51",
|
||||||
"source": "security-advisories@github.com"
|
"source": "security-advisories@github.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://github.com/gravitl/netmaker/commit/9362c39a9a822f0e07361aa7c77af2610597e657",
|
"url": "https://github.com/gravitl/netmaker/commit/9362c39a9a822f0e07361aa7c77af2610597e657",
|
||||||
"source": "security-advisories@github.com"
|
"source": "security-advisories@github.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://github.com/gravitl/netmaker/pull/2170",
|
"url": "https://github.com/gravitl/netmaker/pull/2170",
|
||||||
"source": "security-advisories@github.com"
|
"source": "security-advisories@github.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-8x8h-hcq8-jwwx",
|
"url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-8x8h-hcq8-jwwx",
|
||||||
"source": "security-advisories@github.com"
|
"source": "security-advisories@github.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
@ -2,8 +2,8 @@
|
|||||||
"id": "CVE-2023-32079",
|
"id": "CVE-2023-32079",
|
||||||
"sourceIdentifier": "security-advisories@github.com",
|
"sourceIdentifier": "security-advisories@github.com",
|
||||||
"published": "2023-08-24T23:15:08.570",
|
"published": "2023-08-24T23:15:08.570",
|
||||||
"lastModified": "2023-08-25T03:55:07.777",
|
"lastModified": "2023-08-30T18:34:12.660",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -12,6 +12,26 @@
|
|||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH",
|
||||||
|
"baseScore": 8.8,
|
||||||
|
"baseSeverity": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "security-advisories@github.com",
|
"source": "security-advisories@github.com",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -46,10 +66,38 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndExcluding": "0.17.1",
|
||||||
|
"matchCriteriaId": "D271FC17-56AA-4851-846B-D7D174EBFB45"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:gravitl:netmaker:*:*:*:*:*:*:*:*",
|
||||||
|
"versionStartIncluding": "0.18.0",
|
||||||
|
"versionEndIncluding": "0.18.5",
|
||||||
|
"matchCriteriaId": "249015D8-1590-4B85-A3F7-6F5F360CF0AD"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-826j-8wp2-4x6q",
|
"url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-826j-8wp2-4x6q",
|
||||||
"source": "security-advisories@github.com"
|
"source": "security-advisories@github.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
63
CVE-2023/CVE-2023-368xx/CVE-2023-36811.json
Normal file
63
CVE-2023/CVE-2023-368xx/CVE-2023-36811.json
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-36811",
|
||||||
|
"sourceIdentifier": "security-advisories@github.com",
|
||||||
|
"published": "2023-08-30T18:15:09.487",
|
||||||
|
"lastModified": "2023-08-30T18:15:09.487",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. A flaw in the cryptographic authentication scheme in borgbackup allowed an attacker to fake archives and potentially indirectly cause backup data loss in the repository. The attack requires an attacker to be able to: 1. insert files (with no additional headers) into backups and 2. gain write access to the repository. This vulnerability does not disclose plaintext to the attacker, nor does it affect the authenticity of existing archives. Creating plausible fake archives may be feasible for empty or small archives, but is unlikely for large archives. The issue has been fixed in borgbackup 1.2.5. Users are advised to upgrade. Additionally to installing the fixed code, users must follow the upgrade procedure as documented in the change log. Data loss after being attacked can be avoided by reviewing the archives (timestamp and contents valid and as expected) after any \"borg check --repair\" and before \"borg prune\". There are no known workarounds for this vulnerability."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security-advisories@github.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "HIGH",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "NONE",
|
||||||
|
"baseScore": 4.7,
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.0,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security-advisories@github.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-347"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/borgbackup/borg/blob/1.2.5-cvedocs/docs/changes.rst#pre-125-archives-spoofing-vulnerability-cve-2023-36811",
|
||||||
|
"source": "security-advisories@github.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/borgbackup/borg/commit/3eb070191da10c2d3f7bc6484cf3d51c3045f884",
|
||||||
|
"source": "security-advisories@github.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/borgbackup/borg/security/advisories/GHSA-8fjr-hghr-4m99",
|
||||||
|
"source": "security-advisories@github.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
@ -2,8 +2,8 @@
|
|||||||
"id": "CVE-2023-38508",
|
"id": "CVE-2023-38508",
|
||||||
"sourceIdentifier": "security-advisories@github.com",
|
"sourceIdentifier": "security-advisories@github.com",
|
||||||
"published": "2023-08-24T23:15:08.803",
|
"published": "2023-08-24T23:15:08.803",
|
||||||
"lastModified": "2023-08-25T03:55:07.777",
|
"lastModified": "2023-08-30T18:23:27.400",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -12,6 +12,26 @@
|
|||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE",
|
||||||
|
"baseScore": 4.3,
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 1.4
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "security-advisories@github.com",
|
"source": "security-advisories@github.com",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -36,8 +56,18 @@
|
|||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
{
|
{
|
||||||
"source": "security-advisories@github.com",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Primary",
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-862"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "security-advisories@github.com",
|
||||||
|
"type": "Secondary",
|
||||||
"description": [
|
"description": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -50,22 +80,69 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
|
||||||
|
"versionEndExcluding": "14.10-6",
|
||||||
|
"matchCriteriaId": "02978410-E893-4658-8504-4E109A3E791E"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*",
|
||||||
|
"versionEndExcluding": "14.11.99.28",
|
||||||
|
"matchCriteriaId": "4DB1EBAE-50D3-4D68-B912-589685D5CF2E"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
|
||||||
|
"versionStartIncluding": "14.11",
|
||||||
|
"versionEndExcluding": "14.11-3",
|
||||||
|
"matchCriteriaId": "F85C9C17-E15B-4042-96B2-0F0F8B7CD6A7"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://github.com/Enalean/tuleap/commit/307c1c8044522a2dcc711062b18a3b3f9059a6c3",
|
"url": "https://github.com/Enalean/tuleap/commit/307c1c8044522a2dcc711062b18a3b3f9059a6c3",
|
||||||
"source": "security-advisories@github.com"
|
"source": "security-advisories@github.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-h637-g4xp-2992",
|
"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-h637-g4xp-2992",
|
||||||
"source": "security-advisories@github.com"
|
"source": "security-advisories@github.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=307c1c8044522a2dcc711062b18a3b3f9059a6c3",
|
"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=307c1c8044522a2dcc711062b18a3b3f9059a6c3",
|
||||||
"source": "security-advisories@github.com"
|
"source": "security-advisories@github.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://tuleap.net/plugins/tracker/?aid=33608",
|
"url": "https://tuleap.net/plugins/tracker/?aid=33608",
|
||||||
"source": "security-advisories@github.com"
|
"source": "security-advisories@github.com",
|
||||||
|
"tags": [
|
||||||
|
"Exploit",
|
||||||
|
"Issue Tracking",
|
||||||
|
"Patch",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
@ -2,27 +2,89 @@
|
|||||||
"id": "CVE-2023-39699",
|
"id": "CVE-2023-39699",
|
||||||
"sourceIdentifier": "cve@mitre.org",
|
"sourceIdentifier": "cve@mitre.org",
|
||||||
"published": "2023-08-25T00:15:09.283",
|
"published": "2023-08-25T00:15:09.283",
|
||||||
"lastModified": "2023-08-25T03:55:07.777",
|
"lastModified": "2023-08-30T19:18:36.570",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server."
|
"value": "IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server."
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {},
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH",
|
||||||
|
"baseScore": 9.8,
|
||||||
|
"baseSeverity": "CRITICAL"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-22"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:icewarp:mail_server:10.4.5:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "6B36217E-C6E5-4841-9B43-802B0D1474B4"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://cwe.mitre.org/data/definitions/98.html",
|
"url": "https://cwe.mitre.org/data/definitions/98.html",
|
||||||
"source": "cve@mitre.org"
|
"source": "cve@mitre.org",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://drive.google.com/file/d/1NkqL4ySJApyPy8B-zDC7vE-QMBQAu8OU",
|
"url": "https://drive.google.com/file/d/1NkqL4ySJApyPy8B-zDC7vE-QMBQAu8OU",
|
||||||
"source": "cve@mitre.org"
|
"source": "cve@mitre.org",
|
||||||
|
"tags": [
|
||||||
|
"Exploit",
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion",
|
"url": "https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion",
|
||||||
"source": "cve@mitre.org"
|
"source": "cve@mitre.org",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
@ -2,27 +2,93 @@
|
|||||||
"id": "CVE-2023-39700",
|
"id": "CVE-2023-39700",
|
||||||
"sourceIdentifier": "cve@mitre.org",
|
"sourceIdentifier": "cve@mitre.org",
|
||||||
"published": "2023-08-25T00:15:09.693",
|
"published": "2023-08-25T00:15:09.693",
|
||||||
"lastModified": "2023-08-25T03:55:07.777",
|
"lastModified": "2023-08-30T19:08:43.877",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter."
|
"value": "IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "Se ha descubierto que IceWarp Mail Server v10.4.5 contiene una vulnerabilidad de Cross-Site Scripting reflejado (XSS) a trav\u00e9s del par\u00e1metro color. "
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE",
|
||||||
|
"baseScore": 6.1,
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 2.7
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-79"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:icewarp:mail_server:10.4.5:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "6B36217E-C6E5-4841-9B43-802B0D1474B4"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {},
|
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://cwe.mitre.org/data/definitions/79.html",
|
"url": "https://cwe.mitre.org/data/definitions/79.html",
|
||||||
"source": "cve@mitre.org"
|
"source": "cve@mitre.org",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://drive.google.com/file/d/1QL_517UbTFJox4CXKQpP9fehR1yXRJ-y",
|
"url": "https://drive.google.com/file/d/1QL_517UbTFJox4CXKQpP9fehR1yXRJ-y",
|
||||||
"source": "cve@mitre.org"
|
"source": "cve@mitre.org",
|
||||||
|
"tags": [
|
||||||
|
"Exploit",
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)",
|
"url": "https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS)",
|
||||||
"source": "cve@mitre.org"
|
"source": "cve@mitre.org",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
@ -2,8 +2,8 @@
|
|||||||
"id": "CVE-2023-40022",
|
"id": "CVE-2023-40022",
|
||||||
"sourceIdentifier": "security-advisories@github.com",
|
"sourceIdentifier": "security-advisories@github.com",
|
||||||
"published": "2023-08-24T23:15:09.177",
|
"published": "2023-08-24T23:15:09.177",
|
||||||
"lastModified": "2023-08-25T03:55:07.777",
|
"lastModified": "2023-08-30T19:50:45.640",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -12,6 +12,26 @@
|
|||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "security-advisories@github.com",
|
"source": "security-advisories@github.com",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -46,26 +66,60 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:rizin:rizin:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndExcluding": "0.6.1",
|
||||||
|
"matchCriteriaId": "08C366A2-96F0-48AF-9956-4D145431166F"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://github.com/rizinorg/rizin/pull/3753",
|
"url": "https://github.com/rizinorg/rizin/pull/3753",
|
||||||
"source": "security-advisories@github.com"
|
"source": "security-advisories@github.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-92h6-wwc2-53cq",
|
"url": "https://github.com/rizinorg/rizin/security/advisories/GHSA-92h6-wwc2-53cq",
|
||||||
"source": "security-advisories@github.com"
|
"source": "security-advisories@github.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://github.com/rizinorg/rz-libdemangle/blob/main/src/gnu_v2/cplus-dem.c#L419",
|
"url": "https://github.com/rizinorg/rz-libdemangle/blob/main/src/gnu_v2/cplus-dem.c#L419",
|
||||||
"source": "security-advisories@github.com"
|
"source": "security-advisories@github.com",
|
||||||
|
"tags": [
|
||||||
|
"Product"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://github.com/rizinorg/rz-libdemangle/commit/51d016750e704b27ab8ace23c0f72acabca67018",
|
"url": "https://github.com/rizinorg/rz-libdemangle/commit/51d016750e704b27ab8ace23c0f72acabca67018",
|
||||||
"source": "security-advisories@github.com"
|
"source": "security-advisories@github.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://github.com/rizinorg/rz-libdemangle/pull/54",
|
"url": "https://github.com/rizinorg/rz-libdemangle/pull/54",
|
||||||
"source": "security-advisories@github.com"
|
"source": "security-advisories@github.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
@ -2,8 +2,8 @@
|
|||||||
"id": "CVE-2023-40179",
|
"id": "CVE-2023-40179",
|
||||||
"sourceIdentifier": "security-advisories@github.com",
|
"sourceIdentifier": "security-advisories@github.com",
|
||||||
"published": "2023-08-25T01:15:08.777",
|
"published": "2023-08-25T01:15:08.777",
|
||||||
"lastModified": "2023-08-25T03:55:07.777",
|
"lastModified": "2023-08-30T18:41:19.897",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -12,6 +12,26 @@
|
|||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE",
|
||||||
|
"baseScore": 5.3,
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 1.4
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "security-advisories@github.com",
|
"source": "security-advisories@github.com",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -46,10 +66,31 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:silverwaregames:silverwaregames:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndExcluding": "1.3.6",
|
||||||
|
"matchCriteriaId": "8E3EACD4-859D-4B11-A8A7-185F6B51AD49"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-789j-chfj-58hr",
|
"url": "https://github.com/mesosoi/silverwaregames-io-issue-tracker/security/advisories/GHSA-789j-chfj-58hr",
|
||||||
"source": "security-advisories@github.com"
|
"source": "security-advisories@github.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
63
CVE-2023/CVE-2023-401xx/CVE-2023-40184.json
Normal file
63
CVE-2023/CVE-2023-401xx/CVE-2023-40184.json
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-40184",
|
||||||
|
"sourceIdentifier": "security-advisories@github.com",
|
||||||
|
"published": "2023-08-30T18:15:09.690",
|
||||||
|
"lastModified": "2023-08-30T18:15:09.690",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": " xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security-advisories@github.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "HIGH",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "LOW",
|
||||||
|
"baseScore": 2.6,
|
||||||
|
"baseSeverity": "LOW"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.2,
|
||||||
|
"impactScore": 1.4
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security-advisories@github.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-755"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/neutrinolabs/xrdp/blame/9bbb2ec68f390504c32f2062847aa3d821a0089a/sesman/sesexec/session.c#L571C5-L571C19",
|
||||||
|
"source": "security-advisories@github.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/neutrinolabs/xrdp/commit/a111a0fdfe2421ef600e40708b5f0168594cfb23",
|
||||||
|
"source": "security-advisories@github.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-f489-557v-47jq",
|
||||||
|
"source": "security-advisories@github.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
59
CVE-2023/CVE-2023-405xx/CVE-2023-40582.json
Normal file
59
CVE-2023/CVE-2023-405xx/CVE-2023-40582.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-40582",
|
||||||
|
"sourceIdentifier": "security-advisories@github.com",
|
||||||
|
"published": "2023-08-30T18:15:09.783",
|
||||||
|
"lastModified": "2023-08-30T18:15:09.783",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input and are vulnerable to Command Injection via an attacker controlled parameter. As a result, attackers may run malicious shell commands in the context of the running process. This issue has been addressed in version 1.0.3. users are advised to upgrade. Users unable to upgrade should ensure that all input passed to find-exec comes from a trusted source."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security-advisories@github.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH",
|
||||||
|
"baseScore": 9.8,
|
||||||
|
"baseSeverity": "CRITICAL"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security-advisories@github.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-78"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/shime/find-exec/commit/74fb108097c229b03d6dba4cce81e36aa364b51c",
|
||||||
|
"source": "security-advisories@github.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/shime/find-exec/security/advisories/GHSA-95rp-6gqp-6622",
|
||||||
|
"source": "security-advisories@github.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
59
CVE-2023/CVE-2023-410xx/CVE-2023-41039.json
Normal file
59
CVE-2023/CVE-2023-410xx/CVE-2023-41039.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-41039",
|
||||||
|
"sourceIdentifier": "security-advisories@github.com",
|
||||||
|
"published": "2023-08-30T18:15:09.880",
|
||||||
|
"lastModified": "2023-08-30T18:15:09.880",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's \"format\" functionality allows someone controlling the format string to \"read\" all objects accessible through recursive attribute lookup and subscription from objects he can access. This can lead to critical information disclosure. With `RestrictedPython`, the format functionality is available via the `format` and `format_map` methods of `str` (and `unicode`) (accessed either via the class or its instances) and via `string.Formatter`. All known versions of `RestrictedPython` are vulnerable. This issue has been addressed in commit `4134aedcff1` which has been included in the 5.4 and 6.2 releases. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\n"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security-advisories@github.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "LOW",
|
||||||
|
"baseScore": 8.3,
|
||||||
|
"baseSeverity": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.7,
|
||||||
|
"impactScore": 6.0
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security-advisories@github.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-74"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/zopefoundation/RestrictedPython/commit/4134aedcff17c977da7717693ed89ce56d54c120",
|
||||||
|
"source": "security-advisories@github.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67",
|
||||||
|
"source": "security-advisories@github.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
@ -2,8 +2,8 @@
|
|||||||
"id": "CVE-2023-4520",
|
"id": "CVE-2023-4520",
|
||||||
"sourceIdentifier": "security@wordfence.com",
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
"published": "2023-08-25T03:15:09.223",
|
"published": "2023-08-25T03:15:09.223",
|
||||||
"lastModified": "2023-08-25T03:55:07.777",
|
"lastModified": "2023-08-30T19:46:28.673",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -13,8 +13,28 @@
|
|||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "security@wordfence.com",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Primary",
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE",
|
||||||
|
"baseScore": 6.1,
|
||||||
|
"baseSeverity": "MEDIUM"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 2.7
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Secondary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
|
||||||
@ -46,18 +66,45 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:foliovision:fv_flowplayer_video_player:*:*:*:*:*:wordpress:*:*",
|
||||||
|
"versionEndIncluding": "7.5.37.7212",
|
||||||
|
"matchCriteriaId": "8B131736-533B-4F60-84F6-B1EBB923B809"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/tags/7.5.36.7212/models/custom-videos.php#L341",
|
"url": "https://plugins.trac.wordpress.org/browser/fv-wordpress-flowplayer/tags/7.5.36.7212/models/custom-videos.php#L341",
|
||||||
"source": "security@wordfence.com"
|
"source": "security@wordfence.com",
|
||||||
|
"tags": [
|
||||||
|
"Product"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://plugins.trac.wordpress.org/changeset/2957322/fv-wordpress-flowplayer#file2",
|
"url": "https://plugins.trac.wordpress.org/changeset/2957322/fv-wordpress-flowplayer#file2",
|
||||||
"source": "security@wordfence.com"
|
"source": "security@wordfence.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c55ca7d4-6bc0-49c9-8ce0-50fff8775a76?source=cve",
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c55ca7d4-6bc0-49c9-8ce0-50fff8775a76?source=cve",
|
||||||
"source": "security@wordfence.com"
|
"source": "security@wordfence.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
62
README.md
62
README.md
@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
|
|||||||
### Last Repository Update
|
### Last Repository Update
|
||||||
|
|
||||||
```plain
|
```plain
|
||||||
2023-08-30T18:00:25.602909+00:00
|
2023-08-30T20:00:24.280143+00:00
|
||||||
```
|
```
|
||||||
|
|
||||||
### Most recent CVE Modification Timestamp synchronized with NVD
|
### Most recent CVE Modification Timestamp synchronized with NVD
|
||||||
|
|
||||||
```plain
|
```plain
|
||||||
2023-08-30T17:48:12.503000+00:00
|
2023-08-30T19:50:45.640000+00:00
|
||||||
```
|
```
|
||||||
|
|
||||||
### Last Data Feed Release
|
### Last Data Feed Release
|
||||||
@ -29,58 +29,32 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
|
|||||||
### Total Number of included CVEs
|
### Total Number of included CVEs
|
||||||
|
|
||||||
```plain
|
```plain
|
||||||
223745
|
223749
|
||||||
```
|
```
|
||||||
|
|
||||||
### CVEs added in the last Commit
|
### CVEs added in the last Commit
|
||||||
|
|
||||||
Recently added CVEs: `33`
|
Recently added CVEs: `4`
|
||||||
|
|
||||||
* [CVE-2023-32294](CVE-2023/CVE-2023-322xx/CVE-2023-32294.json) (`2023-08-30T16:15:10.153`)
|
* [CVE-2023-36811](CVE-2023/CVE-2023-368xx/CVE-2023-36811.json) (`2023-08-30T18:15:09.487`)
|
||||||
* [CVE-2023-34372](CVE-2023/CVE-2023-343xx/CVE-2023-34372.json) (`2023-08-30T16:15:10.363`)
|
* [CVE-2023-40184](CVE-2023/CVE-2023-401xx/CVE-2023-40184.json) (`2023-08-30T18:15:09.690`)
|
||||||
* [CVE-2023-35092](CVE-2023/CVE-2023-350xx/CVE-2023-35092.json) (`2023-08-30T16:15:10.600`)
|
* [CVE-2023-40582](CVE-2023/CVE-2023-405xx/CVE-2023-40582.json) (`2023-08-30T18:15:09.783`)
|
||||||
* [CVE-2023-35094](CVE-2023/CVE-2023-350xx/CVE-2023-35094.json) (`2023-08-30T16:15:10.873`)
|
* [CVE-2023-41039](CVE-2023/CVE-2023-410xx/CVE-2023-41039.json) (`2023-08-30T18:15:09.880`)
|
||||||
* [CVE-2023-20266](CVE-2023/CVE-2023-202xx/CVE-2023-20266.json) (`2023-08-30T17:15:08.357`)
|
|
||||||
* [CVE-2023-40592](CVE-2023/CVE-2023-405xx/CVE-2023-40592.json) (`2023-08-30T17:15:09.763`)
|
|
||||||
* [CVE-2023-40593](CVE-2023/CVE-2023-405xx/CVE-2023-40593.json) (`2023-08-30T17:15:09.853`)
|
|
||||||
* [CVE-2023-40594](CVE-2023/CVE-2023-405xx/CVE-2023-40594.json) (`2023-08-30T17:15:09.940`)
|
|
||||||
* [CVE-2023-40595](CVE-2023/CVE-2023-405xx/CVE-2023-40595.json) (`2023-08-30T17:15:10.027`)
|
|
||||||
* [CVE-2023-40596](CVE-2023/CVE-2023-405xx/CVE-2023-40596.json) (`2023-08-30T17:15:10.103`)
|
|
||||||
* [CVE-2023-40597](CVE-2023/CVE-2023-405xx/CVE-2023-40597.json) (`2023-08-30T17:15:10.180`)
|
|
||||||
* [CVE-2023-40598](CVE-2023/CVE-2023-405xx/CVE-2023-40598.json) (`2023-08-30T17:15:10.267`)
|
|
||||||
* [CVE-2023-40837](CVE-2023/CVE-2023-408xx/CVE-2023-40837.json) (`2023-08-30T17:15:10.337`)
|
|
||||||
* [CVE-2023-40838](CVE-2023/CVE-2023-408xx/CVE-2023-40838.json) (`2023-08-30T17:15:10.397`)
|
|
||||||
* [CVE-2023-40839](CVE-2023/CVE-2023-408xx/CVE-2023-40839.json) (`2023-08-30T17:15:10.453`)
|
|
||||||
* [CVE-2023-40840](CVE-2023/CVE-2023-408xx/CVE-2023-40840.json) (`2023-08-30T17:15:10.517`)
|
|
||||||
* [CVE-2023-40841](CVE-2023/CVE-2023-408xx/CVE-2023-40841.json) (`2023-08-30T17:15:10.577`)
|
|
||||||
* [CVE-2023-40842](CVE-2023/CVE-2023-408xx/CVE-2023-40842.json) (`2023-08-30T17:15:10.640`)
|
|
||||||
* [CVE-2023-40843](CVE-2023/CVE-2023-408xx/CVE-2023-40843.json) (`2023-08-30T17:15:10.697`)
|
|
||||||
* [CVE-2023-40844](CVE-2023/CVE-2023-408xx/CVE-2023-40844.json) (`2023-08-30T17:15:10.757`)
|
|
||||||
* [CVE-2023-40845](CVE-2023/CVE-2023-408xx/CVE-2023-40845.json) (`2023-08-30T17:15:10.817`)
|
|
||||||
* [CVE-2023-40847](CVE-2023/CVE-2023-408xx/CVE-2023-40847.json) (`2023-08-30T17:15:10.877`)
|
|
||||||
* [CVE-2023-40848](CVE-2023/CVE-2023-408xx/CVE-2023-40848.json) (`2023-08-30T17:15:10.943`)
|
|
||||||
* [CVE-2023-4571](CVE-2023/CVE-2023-45xx/CVE-2023-4571.json) (`2023-08-30T17:15:11.080`)
|
|
||||||
* [CVE-2023-4640](CVE-2023/CVE-2023-46xx/CVE-2023-4640.json) (`2023-08-30T17:15:11.157`)
|
|
||||||
|
|
||||||
|
|
||||||
### CVEs modified in the last Commit
|
### CVEs modified in the last Commit
|
||||||
|
|
||||||
Recently modified CVEs: `14`
|
Recently modified CVEs: `9`
|
||||||
|
|
||||||
* [CVE-2020-22219](CVE-2020/CVE-2020-222xx/CVE-2020-22219.json) (`2023-08-30T16:57:28.420`)
|
* [CVE-2022-43358](CVE-2022/CVE-2022-433xx/CVE-2022-43358.json) (`2023-08-30T19:34:51.023`)
|
||||||
* [CVE-2022-45611](CVE-2022/CVE-2022-456xx/CVE-2022-45611.json) (`2023-08-30T17:09:59.217`)
|
* [CVE-2023-32077](CVE-2023/CVE-2023-320xx/CVE-2023-32077.json) (`2023-08-30T18:18:07.060`)
|
||||||
* [CVE-2022-45582](CVE-2022/CVE-2022-455xx/CVE-2022-45582.json) (`2023-08-30T17:12:38.817`)
|
* [CVE-2023-38508](CVE-2023/CVE-2023-385xx/CVE-2023-38508.json) (`2023-08-30T18:23:27.400`)
|
||||||
* [CVE-2023-40612](CVE-2023/CVE-2023-406xx/CVE-2023-40612.json) (`2023-08-30T17:06:11.897`)
|
* [CVE-2023-32079](CVE-2023/CVE-2023-320xx/CVE-2023-32079.json) (`2023-08-30T18:34:12.660`)
|
||||||
* [CVE-2023-32712](CVE-2023/CVE-2023-327xx/CVE-2023-32712.json) (`2023-08-30T17:15:08.477`)
|
* [CVE-2023-40179](CVE-2023/CVE-2023-401xx/CVE-2023-40179.json) (`2023-08-30T18:41:19.897`)
|
||||||
* [CVE-2023-34468](CVE-2023/CVE-2023-344xx/CVE-2023-34468.json) (`2023-08-30T17:15:08.617`)
|
* [CVE-2023-39700](CVE-2023/CVE-2023-397xx/CVE-2023-39700.json) (`2023-08-30T19:08:43.877`)
|
||||||
* [CVE-2023-36844](CVE-2023/CVE-2023-368xx/CVE-2023-36844.json) (`2023-08-30T17:15:08.727`)
|
* [CVE-2023-39699](CVE-2023/CVE-2023-396xx/CVE-2023-39699.json) (`2023-08-30T19:18:36.570`)
|
||||||
* [CVE-2023-36845](CVE-2023/CVE-2023-368xx/CVE-2023-36845.json) (`2023-08-30T17:15:08.980`)
|
* [CVE-2023-4520](CVE-2023/CVE-2023-45xx/CVE-2023-4520.json) (`2023-08-30T19:46:28.673`)
|
||||||
* [CVE-2023-36846](CVE-2023/CVE-2023-368xx/CVE-2023-36846.json) (`2023-08-30T17:15:09.300`)
|
* [CVE-2023-40022](CVE-2023/CVE-2023-400xx/CVE-2023-40022.json) (`2023-08-30T19:50:45.640`)
|
||||||
* [CVE-2023-36847](CVE-2023/CVE-2023-368xx/CVE-2023-36847.json) (`2023-08-30T17:15:09.530`)
|
|
||||||
* [CVE-2023-3899](CVE-2023/CVE-2023-38xx/CVE-2023-3899.json) (`2023-08-30T17:19:03.907`)
|
|
||||||
* [CVE-2023-40025](CVE-2023/CVE-2023-400xx/CVE-2023-40025.json) (`2023-08-30T17:28:42.677`)
|
|
||||||
* [CVE-2023-39521](CVE-2023/CVE-2023-395xx/CVE-2023-39521.json) (`2023-08-30T17:43:59.497`)
|
|
||||||
* [CVE-2023-40017](CVE-2023/CVE-2023-400xx/CVE-2023-40017.json) (`2023-08-30T17:48:12.503`)
|
|
||||||
|
|
||||||
|
|
||||||
## Download and Usage
|
## Download and Usage
|
||||||
|
Loading…
x
Reference in New Issue
Block a user