Auto-Update: 2023-11-16T00:55:17.664090+00:00

This commit is contained in:
cad-safe-bot 2023-11-16 00:55:21 +00:00
parent a007f43a04
commit 875c6dfaeb
12 changed files with 409 additions and 43 deletions

View File

@ -2,8 +2,8 @@
"id": "CVE-2023-1108", "id": "CVE-2023-1108",
"sourceIdentifier": "secalert@redhat.com", "sourceIdentifier": "secalert@redhat.com",
"published": "2023-09-14T15:15:08.293", "published": "2023-09-14T15:15:08.293",
"lastModified": "2023-11-07T04:02:31.040", "lastModified": "2023-11-16T00:46:36.607",
"vulnStatus": "Undergoing Analysis", "vulnStatus": "Analyzed",
"descriptions": [ "descriptions": [
{ {
"lang": "en", "lang": "en",
@ -37,7 +37,7 @@
"impactScore": 3.6 "impactScore": 3.6
}, },
{ {
"source": "53f830b8-0a3f-465b-8143-3b8a9948e749", "source": "secalert@redhat.com",
"type": "Secondary", "type": "Secondary",
"cvssData": { "cvssData": {
"version": "3.1", "version": "3.1",
@ -70,7 +70,7 @@
] ]
}, },
{ {
"source": "53f830b8-0a3f-465b-8143-3b8a9948e749", "source": "secalert@redhat.com",
"type": "Secondary", "type": "Secondary",
"description": [ "description": [
{ {
@ -284,6 +284,21 @@
] ]
} }
] ]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3"
}
]
}
]
} }
], ],
"references": [ "references": [
@ -394,7 +409,10 @@
}, },
{ {
"url": "https://security.netapp.com/advisory/ntap-20231020-0002/", "url": "https://security.netapp.com/advisory/ntap-20231020-0002/",
"source": "secalert@redhat.com" "source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
]
} }
] ]
} }

View File

@ -2,8 +2,8 @@
"id": "CVE-2023-39323", "id": "CVE-2023-39323",
"sourceIdentifier": "security@golang.org", "sourceIdentifier": "security@golang.org",
"published": "2023-10-05T21:15:11.283", "published": "2023-10-05T21:15:11.283",
"lastModified": "2023-11-03T22:15:09.943", "lastModified": "2023-11-16T00:54:23.620",
"vulnStatus": "Undergoing Analysis", "vulnStatus": "Analyzed",
"descriptions": [ "descriptions": [
{ {
"lang": "en", "lang": "en",
@ -73,6 +73,31 @@
] ]
} }
] ]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
"matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*",
"matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
"matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646"
}
]
}
]
} }
], ],
"references": [ "references": [
@ -101,15 +126,27 @@
}, },
{ {
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/",
"source": "security@golang.org" "source": "security@golang.org",
"tags": [
"Mailing List",
"Third Party Advisory"
]
}, },
{ {
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/",
"source": "security@golang.org" "source": "security@golang.org",
"tags": [
"Mailing List",
"Third Party Advisory"
]
}, },
{ {
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/",
"source": "security@golang.org" "source": "security@golang.org",
"tags": [
"Mailing List",
"Third Party Advisory"
]
}, },
{ {
"url": "https://pkg.go.dev/vuln/GO-2023-2095", "url": "https://pkg.go.dev/vuln/GO-2023-2095",
@ -120,7 +157,10 @@
}, },
{ {
"url": "https://security.netapp.com/advisory/ntap-20231020-0001/", "url": "https://security.netapp.com/advisory/ntap-20231020-0001/",
"source": "security@golang.org" "source": "security@golang.org",
"tags": [
"Third Party Advisory"
]
} }
] ]
} }

View File

@ -0,0 +1,51 @@
{
"id": "CVE-2023-4689",
"sourceIdentifier": "security@wordfence.com",
"published": "2023-11-15T23:15:09.087",
"lastModified": "2023-11-15T23:15:09.087",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing or incorrect nonce validation on the eae_save_elements function. This makes it possible for unauthenticated attackers to enable/disable elementor addon elements via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/inc/admin/admin-ui.php#L46",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2996185%40addon-elements-for-elementor-page-builder%2Ftrunk&old=2980987%40addon-elements-for-elementor-page-builder%2Ftrunk&sfp_email=&sfph_mail=#file15",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/472cdbc4-3bfa-4254-b35a-be7ae10782e6?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,51 @@
{
"id": "CVE-2023-4690",
"sourceIdentifier": "security@wordfence.com",
"published": "2023-11-15T23:15:09.257",
"lastModified": "2023-11-15T23:15:09.257",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing or incorrect nonce validation on the eae_save_config function. This makes it possible for unauthenticated attackers to change configuration settings for the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/inc/admin/admin-ui.php#L75",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2996185%40addon-elements-for-elementor-page-builder%2Ftrunk&old=2980987%40addon-elements-for-elementor-page-builder%2Ftrunk&sfp_email=&sfph_mail=#file15",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fd53b4e1-c6b7-4111-911a-04b14c7a9c4e?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,51 @@
{
"id": "CVE-2023-4723",
"sourceIdentifier": "security@wordfence.com",
"published": "2023-11-15T23:15:09.410",
"lastModified": "2023-11-15T23:15:09.410",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.12.7 via the ajax_eae_post_data function. This can allow unauthenticated attackers to extract sensitive data including post/page ids and titles including those of with pending/draft/future/private status."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/classes/helper.php#L20",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2996185%40addon-elements-for-elementor-page-builder%2Ftrunk&old=2980987%40addon-elements-for-elementor-page-builder%2Ftrunk&sfp_email=&sfph_mail=#file15",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/89489218-263f-4157-a5cd-a12bc6a0dfe6?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,24 @@
{
"id": "CVE-2023-48197",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-11-15T23:15:08.903",
"lastModified": "2023-11-15T23:15:08.903",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute arbitrary code and obtain sensitive information via the QR code function in the manageapikeys component."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/grocy/grocy",
"source": "cve@mitre.org"
},
{
"url": "https://nitipoom-jar.github.io/CVE-2023-48197/",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,24 @@
{
"id": "CVE-2023-48198",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-11-15T23:15:08.957",
"lastModified": "2023-11-15T23:15:08.957",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute arbitrary code and obtain sensitive information via the product description component in the api/stock/products endpoint."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/grocy/grocy",
"source": "cve@mitre.org"
},
{
"url": "https://nitipoom-jar.github.io/CVE-2023-48198",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,28 @@
{
"id": "CVE-2023-48199",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-11-15T23:15:09.000",
"lastModified": "2023-11-15T23:15:09.000",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "An issue in Grocy v.4.0.3 allows a local attacker to execute arbitrary code and obtain sensitive information via the QR code funciton in the manageapikeys component."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/grocy/grocy",
"source": "cve@mitre.org"
},
{
"url": "https://grocy.info",
"source": "cve@mitre.org"
},
{
"url": "https://nitipoom-jar.github.io/CVE-2023-48199/",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,24 @@
{
"id": "CVE-2023-48200",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-11-15T23:15:09.043",
"lastModified": "2023-11-15T23:15:09.043",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute arbitrary code and obtain sensitive information via the equipment description component within /equipment/ component."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/grocy/grocy",
"source": "cve@mitre.org"
},
{
"url": "https://nitipoom-jar.github.io/CVE-2023-48200/",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2023-48204",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-11-16T00:15:06.770",
"lastModified": "2023-11-16T00:15:06.770",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of the api/method/getHtml component."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/sanluan/PublicCMS/issues/77",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,51 @@
{
"id": "CVE-2023-5381",
"sourceIdentifier": "security@wordfence.com",
"published": "2023-11-15T23:15:09.570",
"lastModified": "2023-11-15T23:15:09.570",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.12.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 1.3,
"impactScore": 2.7
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/browser/addon-elements-for-elementor-page-builder/trunk/inc/admin/admin-ui.php#L79",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2996185%40addon-elements-for-elementor-page-builder%2Ftrunk&old=2980987%40addon-elements-for-elementor-page-builder%2Ftrunk&sfp_email=&sfph_mail=#file15",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bd2bc2e7-960e-40db-9dcc-a6a60117bd83?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update ### Last Repository Update
```plain ```plain
2023-11-15T23:00:17.757023+00:00 2023-11-16T00:55:17.664090+00:00
``` ```
### Most recent CVE Modification Timestamp synchronized with NVD ### Most recent CVE Modification Timestamp synchronized with NVD
```plain ```plain
2023-11-15T22:32:21.157000+00:00 2023-11-16T00:54:23.620000+00:00
``` ```
### Last Data Feed Release ### Last Data Feed Release
@ -29,46 +29,30 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs ### Total Number of included CVEs
```plain ```plain
230872 230881
``` ```
### CVEs added in the last Commit ### CVEs added in the last Commit
Recently added CVEs: `8` Recently added CVEs: `9`
* [CVE-2023-47638](CVE-2023/CVE-2023-476xx/CVE-2023-47638.json) (`2023-11-15T21:15:08.050`) * [CVE-2023-48197](CVE-2023/CVE-2023-481xx/CVE-2023-48197.json) (`2023-11-15T23:15:08.903`)
* [CVE-2023-48224](CVE-2023/CVE-2023-482xx/CVE-2023-48224.json) (`2023-11-15T21:15:08.100`) * [CVE-2023-48198](CVE-2023/CVE-2023-481xx/CVE-2023-48198.json) (`2023-11-15T23:15:08.957`)
* [CVE-2023-6105](CVE-2023/CVE-2023-61xx/CVE-2023-6105.json) (`2023-11-15T21:15:08.490`) * [CVE-2023-48199](CVE-2023/CVE-2023-481xx/CVE-2023-48199.json) (`2023-11-15T23:15:09.000`)
* [CVE-2023-41442](CVE-2023/CVE-2023-414xx/CVE-2023-41442.json) (`2023-11-15T22:15:27.673`) * [CVE-2023-48200](CVE-2023/CVE-2023-482xx/CVE-2023-48200.json) (`2023-11-15T23:15:09.043`)
* [CVE-2023-47345](CVE-2023/CVE-2023-473xx/CVE-2023-47345.json) (`2023-11-15T22:15:27.877`) * [CVE-2023-4689](CVE-2023/CVE-2023-46xx/CVE-2023-4689.json) (`2023-11-15T23:15:09.087`)
* [CVE-2023-47347](CVE-2023/CVE-2023-473xx/CVE-2023-47347.json) (`2023-11-15T22:15:27.930`) * [CVE-2023-4690](CVE-2023/CVE-2023-46xx/CVE-2023-4690.json) (`2023-11-15T23:15:09.257`)
* [CVE-2023-47444](CVE-2023/CVE-2023-474xx/CVE-2023-47444.json) (`2023-11-15T22:15:27.977`) * [CVE-2023-4723](CVE-2023/CVE-2023-47xx/CVE-2023-4723.json) (`2023-11-15T23:15:09.410`)
* [CVE-2023-48365](CVE-2023/CVE-2023-483xx/CVE-2023-48365.json) (`2023-11-15T22:15:28.027`) * [CVE-2023-5381](CVE-2023/CVE-2023-53xx/CVE-2023-5381.json) (`2023-11-15T23:15:09.570`)
* [CVE-2023-48204](CVE-2023/CVE-2023-482xx/CVE-2023-48204.json) (`2023-11-16T00:15:06.770`)
### CVEs modified in the last Commit ### CVEs modified in the last Commit
Recently modified CVEs: `19` Recently modified CVEs: `2`
* [CVE-2021-31834](CVE-2021/CVE-2021-318xx/CVE-2021-31834.json) (`2023-11-15T21:02:01.610`) * [CVE-2023-1108](CVE-2023/CVE-2023-11xx/CVE-2023-1108.json) (`2023-11-16T00:46:36.607`)
* [CVE-2021-31833](CVE-2021/CVE-2021-318xx/CVE-2021-31833.json) (`2023-11-15T21:03:26.983`) * [CVE-2023-39323](CVE-2023/CVE-2023-393xx/CVE-2023-39323.json) (`2023-11-16T00:54:23.620`)
* [CVE-2021-23895](CVE-2021/CVE-2021-238xx/CVE-2021-23895.json) (`2023-11-15T21:17:04.447`)
* [CVE-2021-23887](CVE-2021/CVE-2021-238xx/CVE-2021-23887.json) (`2023-11-15T21:17:14.920`)
* [CVE-2022-46705](CVE-2022/CVE-2022-467xx/CVE-2022-46705.json) (`2023-11-15T21:15:07.583`)
* [CVE-2022-46725](CVE-2022/CVE-2022-467xx/CVE-2022-46725.json) (`2023-11-15T21:15:07.697`)
* [CVE-2023-32359](CVE-2023/CVE-2023-323xx/CVE-2023-32359.json) (`2023-11-15T21:15:07.783`)
* [CVE-2023-41983](CVE-2023/CVE-2023-419xx/CVE-2023-41983.json) (`2023-11-15T21:15:07.880`)
* [CVE-2023-42852](CVE-2023/CVE-2023-428xx/CVE-2023-42852.json) (`2023-11-15T21:15:07.957`)
* [CVE-2023-5217](CVE-2023/CVE-2023-52xx/CVE-2023-5217.json) (`2023-11-15T21:15:08.333`)
* [CVE-2023-43571](CVE-2023/CVE-2023-435xx/CVE-2023-43571.json) (`2023-11-15T21:15:32.450`)
* [CVE-2023-43572](CVE-2023/CVE-2023-435xx/CVE-2023-43572.json) (`2023-11-15T21:16:30.670`)
* [CVE-2023-43573](CVE-2023/CVE-2023-435xx/CVE-2023-43573.json) (`2023-11-15T21:24:40.690`)
* [CVE-2023-44760](CVE-2023/CVE-2023-447xx/CVE-2023-44760.json) (`2023-11-15T22:15:27.730`)
* [CVE-2023-44766](CVE-2023/CVE-2023-447xx/CVE-2023-44766.json) (`2023-11-15T22:15:27.807`)
* [CVE-2023-43755](CVE-2023/CVE-2023-437xx/CVE-2023-43755.json) (`2023-11-15T22:27:24.050`)
* [CVE-2023-4249](CVE-2023/CVE-2023-42xx/CVE-2023-4249.json) (`2023-11-15T22:31:21.747`)
* [CVE-2023-45225](CVE-2023/CVE-2023-452xx/CVE-2023-45225.json) (`2023-11-15T22:31:44.127`)
* [CVE-2023-43574](CVE-2023/CVE-2023-435xx/CVE-2023-43574.json) (`2023-11-15T22:32:21.157`)
## Download and Usage ## Download and Usage