mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-07 19:16:29 +00:00
Auto-Update: 2023-11-20T11:00:17.501036+00:00
This commit is contained in:
cad-safe-bot
parent
f74ded35d1
commit
8b43e5863d
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2020-8968",
|
||||
"sourceIdentifier": "cve-coordination@incibe.es",
|
||||
"published": "2021-12-17T17:15:10.663",
|
||||
"lastModified": "2022-09-20T17:17:02.567",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2023-11-20T10:15:20.693",
|
||||
"vulnStatus": "Modified",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
@ -41,20 +41,20 @@
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 8.0,
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 7.1,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.5,
|
||||
"impactScore": 5.5
|
||||
"exploitabilityScore": 1.8,
|
||||
"impactScore": 5.2
|
||||
}
|
||||
],
|
||||
"cvssMetricV2": [
|
||||
@ -126,11 +126,8 @@
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.incibe-cert.es/en/early-warning/security-advisories/parallels-remote-application-server-credentials-management-errors",
|
||||
"source": "cve-coordination@incibe.es",
|
||||
"tags": [
|
||||
"Third Party Advisory"
|
||||
]
|
||||
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/parallels-remote-application-server-credentials-management-errors",
|
||||
"source": "cve-coordination@incibe.es"
|
||||
}
|
||||
]
|
||||
}
|
||||
20
CVE-2022/CVE-2022-463xx/CVE-2022-46337.json
Normal file
20
CVE-2022/CVE-2022-463xx/CVE-2022-46337.json
Normal file
@ -0,0 +1,20 @@
|
||||
{
|
||||
"id": "CVE-2022-46337",
|
||||
"sourceIdentifier": "security@apache.org",
|
||||
"published": "2023-11-20T09:15:07.180",
|
||||
"lastModified": "2023-11-20T09:15:07.180",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A cleverly devised username might bypass LDAP authentication checks. In \nLDAP-authenticated Derby installations, this could let an attacker fill \nup the disk by creating junk Derby databases. In LDAP-authenticated \nDerby installations, this could also allow the attacker to execute \nmalware which was visible to and executable by the account which booted \nthe Derby server. In LDAP-protected databases which weren't also \nprotected by SQL GRANT/REVOKE authorization, this vulnerability could \nalso let an attacker view and corrupt sensitive data and run sensitive \ndatabase functions and procedures.\n\nMitigation:\n\nUsers should upgrade to Java 21 and Derby 10.17.1.0.\n\nAlternatively, users who wish to remain on older Java versions should \nbuild their own Derby distribution from one of the release families to \nwhich the fix was backported: 10.16, 10.15, and 10.14. Those are the \nreleases which correspond, respectively, with Java LTS versions 17, 11, \nand 8.\n\n"
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://lists.apache.org/thread/q23kvvtoohgzwybxpwozmvvk17rp0td3",
|
||||
"source": "security@apache.org"
|
||||
}
|
||||
]
|
||||
}
|
||||
40
CVE-2023/CVE-2023-463xx/CVE-2023-46302.json
Normal file
40
CVE-2023/CVE-2023-463xx/CVE-2023-46302.json
Normal file
@ -0,0 +1,40 @@
|
||||
{
|
||||
"id": "CVE-2023-46302",
|
||||
"sourceIdentifier": "security@apache.org",
|
||||
"published": "2023-11-20T09:15:07.293",
|
||||
"lastModified": "2023-11-20T09:15:07.293",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 .\n\nApache Submarine uses JAXRS to define REST endpoints. In order to\nhandle YAML requests (using application/yaml content-type), it defines\na YamlEntityProvider entity provider that will process all incoming\nYAML requests. In order to unmarshal the request, the readFrom method\nis invoked, passing the entityStream containing the user-supplied data in `submarine-server/server-core/src/main/java/org/apache/submarine/server/utils/YamlUtils.java`.\n \nWe have now fixed this issue in the new version by replacing to `jackson-dataformat-yaml`.\nThis issue affects Apache Submarine: from 0.7.0 before 0.8.0.\u00a0Users are recommended to upgrade to version 0.8.0, which fixes this issue.\nIf using the version smaller than 0.8.0 and not want to upgrade, you can try cherry-pick PR https://github.com/apache/submarine/pull/1054 and rebuild the submart-server image to fix this.\n\n"
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "security@apache.org",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-502"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/apache/submarine/pull/1054",
|
||||
"source": "security@apache.org"
|
||||
},
|
||||
{
|
||||
"url": "https://issues.apache.org/jira/browse/SUBMARINE-1371",
|
||||
"source": "security@apache.org"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.apache.org/thread/zf0wppzh239j4h131hm1dbswfnztxrr5",
|
||||
"source": "security@apache.org"
|
||||
}
|
||||
]
|
||||
}
|
||||
14
README.md
14
README.md
@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
|
||||
### Last Repository Update
|
||||
|
||||
```plain
|
||||
2023-11-20T09:00:18.405935+00:00
|
||||
2023-11-20T11:00:17.501036+00:00
|
||||
```
|
||||
|
||||
### Most recent CVE Modification Timestamp synchronized with NVD
|
||||
|
||||
```plain
|
||||
2023-11-20T08:15:44.280000+00:00
|
||||
2023-11-20T10:15:20.693000+00:00
|
||||
```
|
||||
|
||||
### Last Data Feed Release
|
||||
@ -29,20 +29,22 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
|
||||
### Total Number of included CVEs
|
||||
|
||||
```plain
|
||||
231120
|
||||
231122
|
||||
```
|
||||
|
||||
### CVEs added in the last Commit
|
||||
|
||||
Recently added CVEs: `1`
|
||||
Recently added CVEs: `2`
|
||||
|
||||
* [CVE-2023-3379](CVE-2023/CVE-2023-33xx/CVE-2023-3379.json) (`2023-11-20T08:15:44.280`)
|
||||
* [CVE-2022-46337](CVE-2022/CVE-2022-463xx/CVE-2022-46337.json) (`2023-11-20T09:15:07.180`)
|
||||
* [CVE-2023-46302](CVE-2023/CVE-2023-463xx/CVE-2023-46302.json) (`2023-11-20T09:15:07.293`)
|
||||
|
||||
|
||||
### CVEs modified in the last Commit
|
||||
|
||||
Recently modified CVEs: `0`
|
||||
Recently modified CVEs: `1`
|
||||
|
||||
* [CVE-2020-8968](CVE-2020/CVE-2020-89xx/CVE-2020-8968.json) (`2023-11-20T10:15:20.693`)
|
||||
|
||||
|
||||
## Download and Usage
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user