admin/nvd-json-data-feeds
1
0
Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2025-07-09 16:05:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2023-10-09T22:00:24.883787+00:00

Browse Source
This commit is contained in:
cad-safe-bot 2023-10-09 22:00:28 +00:00
parent 236d93ba38
commit 8c97ab3703
13 changed files with 476 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
CVE-2022/CVE-2022-362xx/CVE-2022-36228.json Normal file
View File

@ -0,0 +1,20 @@
{
"id": "CVE-2022-36228",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-10-09T21:15:09.850",
"lastModified": "2023-10-09T21:15:09.850",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions. By sending a request, you can add any device and set the device password in the Nokelock app."
}
],
"metrics": {},
"references": [
{
"url": "https://gist.github.com/YTrick/59c06611052d3fdae034e7087293bbc0",
"source": "cve@mitre.org"
}
]
}

55
CVE-2022/CVE-2022-37xx/CVE-2022-3728.json Normal file
View File

@ -0,0 +1,55 @@
{
"id": "CVE-2022-3728",
"sourceIdentifier": "psirt@lenovo.com",
"published": "2023-10-09T21:15:09.910",
"lastModified": "2023-10-09T21:15:09.910",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "\nA vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access. \n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "psirt@lenovo.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 0.9,
"impactScore": 5.2
}
]
},
"weaknesses": [
{
"source": "psirt@lenovo.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-1263"
}
]
}
],
"references": [
{
"url": "https://support.lenovo.com/us/en/product_security/LEN-106014",
"source": "psirt@lenovo.com"
}
]
}

55
CVE-2022/CVE-2022-481xx/CVE-2022-48182.json Normal file
View File

@ -0,0 +1,55 @@
{
"id": "CVE-2022-48182",
"sourceIdentifier": "psirt@lenovo.com",
"published": "2023-10-09T21:15:10.003",
"lastModified": "2023-10-09T21:15:10.003",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "\nA vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access. \n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "psirt@lenovo.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 0.9,
"impactScore": 5.2
}
]
},
"weaknesses": [
{
"source": "psirt@lenovo.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-1263"
}
]
}
],
"references": [
{
"url": "https://support.lenovo.com/us/en/product_security/LEN-106014",
"source": "psirt@lenovo.com"
}
]
}

55
CVE-2022/CVE-2022-481xx/CVE-2022-48183.json Normal file
View File

@ -0,0 +1,55 @@
{
"id": "CVE-2022-48183",
"sourceIdentifier": "psirt@lenovo.com",
"published": "2023-10-09T21:15:10.080",
"lastModified": "2023-10-09T21:15:10.080",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "\nA vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access. \n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "psirt@lenovo.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"attackVector": "PHYSICAL",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 0.9,
"impactScore": 5.2
}
]
},
"weaknesses": [
{
"source": "psirt@lenovo.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-1263"
}
]
}
],
"references": [
{
"url": "https://support.lenovo.com/us/en/product_security/LEN-106014",
"source": "psirt@lenovo.com"
}
]
}

24
CVE-2023/CVE-2023-432xx/CVE-2023-43271.json Normal file
View File

@ -0,0 +1,24 @@
{
"id": "CVE-2023-43271",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-10-09T21:15:10.173",
"lastModified": "2023-10-09T21:15:10.173",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder through ftp and other protocols."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/Question-h/vuln/blob/master/70mai_a500s_backdoor.md",
"source": "cve@mitre.org"
},
{
"url": "https://github.com/Question-h/vuln/blob/master/CVE-2023-43271.md",
"source": "cve@mitre.org"
}
]
}

63
CVE-2023/CVE-2023-443xx/CVE-2023-44392.json Normal file
View File

@ -0,0 +1,63 @@
{
"id": "CVE-2023-44392",
"sourceIdentifier": "security-advisories@github.com",
"published": "2023-10-09T20:15:10.393",
"lastModified": "2023-10-09T20:15:10.393",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is vulnerable to code injection due to an insecure implementation of deserialization. Garden stores serialized objects using cryo in the Kubernetes `ConfigMap` resources prefixed with `test-result` and `run-result` to cache Garden test and run results. These `ConfigMaps` are stored either in the `garden-system` namespace or the configured user namespace. When a user invokes the command `garden test` or `garden run` objects stored in the `ConfigMap` are retrieved and deserialized. This can be used by an attacker with access to the Kubernetes cluster to store malicious objects in the `ConfigMap`, which can trigger a remote code execution on the users machine when cryo deserializes the object. In order to exploit this vulnerability, an attacker must have access to the Kubernetes cluster used to deploy garden remote environments. Further, a user must actively invoke either a `garden test` or `garden run` which has previously cached results. The issue has been patched in Garden versions `0.13.17` (Bonsai) and `0.12.65` (Acorn). Only Garden versions prior to these are vulnerable. No known workarounds are available."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security-advisories@github.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 1.5,
"impactScore": 6.0
}
]
},
"weaknesses": [
{
"source": "security-advisories@github.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-502"
},
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"references": [
{
"url": "https://github.com/garden-io/garden/commit/3117964da40d3114f129a6131b4ada89eaa4eb8c",
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/garden-io/garden/security/advisories/GHSA-hm75-6vc9-8rpr",
"source": "security-advisories@github.com"
}
]
}

20
CVE-2023/CVE-2023-444xx/CVE-2023-44467.json Normal file
View File

@ -0,0 +1,20 @@
{
"id": "CVE-2023-44467",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-10-09T20:15:10.480",
"lastModified": "2023-10-09T20:15:10.480",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "langchain_experimental 0.0.14 allows an attacker to bypass the CVE-2023-36258 fix and execute arbitrary code via the PALChain in the python exec method."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/langchain-ai/langchain/commit/4c97a10bd0d9385cfee234a63b5bd826a295e483",
"source": "cve@mitre.org"
}
]
}

20
CVE-2023/CVE-2023-448xx/CVE-2023-44811.json Normal file
View File

@ -0,0 +1,20 @@
{
"id": "CVE-2023-44811",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-10-09T20:15:10.533",
"lastModified": "2023-10-09T20:15:10.533",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the admin Password Change Function."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/ahrixia/CVE-2023-44811",
"source": "cve@mitre.org"
}
]
}

20
CVE-2023/CVE-2023-448xx/CVE-2023-44812.json Normal file
View File

@ -0,0 +1,20 @@
{
"id": "CVE-2023-44812",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-10-09T21:15:10.227",
"lastModified": "2023-10-09T21:15:10.227",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the admin_redirect_url parameter of the user login function."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/ahrixia/CVE-2023-44812",
"source": "cve@mitre.org"
}
]
}

20
CVE-2023/CVE-2023-448xx/CVE-2023-44813.json Normal file
View File

@ -0,0 +1,20 @@
{
"id": "CVE-2023-44813",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-10-09T21:15:10.273",
"lastModified": "2023-10-09T21:15:10.273",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/ahrixia/CVE-2023-44813",
"source": "cve@mitre.org"
}
]
}

20
CVE-2023/CVE-2023-448xx/CVE-2023-44821.json Normal file
View File

@ -0,0 +1,20 @@
{
"id": "CVE-2023-44821",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-10-09T20:15:10.583",
"lastModified": "2023-10-09T20:15:10.583",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Buffer Overflow vulnerability in gifsicle v.1.92 allows a remote attacker to cause a denial of service via the --crop parameter in the command line parameters."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/kohler/gifsicle/issues/195",
"source": "cve@mitre.org"
}
]
}

88
CVE-2023/CVE-2023-54xx/CVE-2023-5461.json Normal file
View File

@ -0,0 +1,88 @@
{
"id": "CVE-2023-5461",
"sourceIdentifier": "cna@vuldb.com",
"published": "2023-10-09T20:15:10.633",
"lastModified": "2023-10-09T20:15:10.633",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Delta Electronics WPLSoft 2.51. It has been classified as problematic. Affected is an unknown function of the component Modbus Handler. The manipulation leads to cleartext transmission of sensitive information. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-241584. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW"
},
"exploitabilityScore": 2.2,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
"accessVector": "NETWORK",
"accessComplexity": "HIGH",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6
},
"baseSeverity": "LOW",
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "cna@vuldb.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-319"
}
]
}
],
"references": [
{
"url": "https://drive.google.com/drive/folders/17nBJt3tejqipE_L-lMEhYXeGhG0eii-_",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?ctiid.241584",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?id.241584",
"source": "cna@vuldb.com"
}
]
}

33
README.md
View File

@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2023-10-09T20:00:24.723325+00:00
2023-10-09T22:00:24.883787+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2023-10-09T19:15:10.543000+00:00
2023-10-09T21:15:10.273000+00:00
```
### Last Data Feed Release
@ -29,32 +29,31 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
227250
227262
```
### CVEs added in the last Commit
Recently added CVEs: `12`
* [CVE-2022-3431](CVE-2022/CVE-2022-34xx/CVE-2022-3431.json) (`2023-10-09T19:15:09.987`)
* [CVE-2023-39189](CVE-2023/CVE-2023-391xx/CVE-2023-39189.json) (`2023-10-09T18:15:10.160`)
* [CVE-2023-39192](CVE-2023/CVE-2023-391xx/CVE-2023-39192.json) (`2023-10-09T18:15:10.233`)
* [CVE-2023-39193](CVE-2023/CVE-2023-391xx/CVE-2023-39193.json) (`2023-10-09T18:15:10.303`)
* [CVE-2023-39194](CVE-2023/CVE-2023-391xx/CVE-2023-39194.json) (`2023-10-09T18:15:10.367`)
* [CVE-2023-41667](CVE-2023/CVE-2023-416xx/CVE-2023-41667.json) (`2023-10-09T18:15:10.437`)
* [CVE-2023-41668](CVE-2023/CVE-2023-416xx/CVE-2023-41668.json) (`2023-10-09T18:15:10.527`)
* [CVE-2023-41669](CVE-2023/CVE-2023-416xx/CVE-2023-41669.json) (`2023-10-09T19:15:10.207`)
* [CVE-2023-41670](CVE-2023/CVE-2023-416xx/CVE-2023-41670.json) (`2023-10-09T19:15:10.293`)
* [CVE-2023-41672](CVE-2023/CVE-2023-416xx/CVE-2023-41672.json) (`2023-10-09T19:15:10.373`)
* [CVE-2023-5459](CVE-2023/CVE-2023-54xx/CVE-2023-5459.json) (`2023-10-09T19:15:10.457`)
* [CVE-2023-5460](CVE-2023/CVE-2023-54xx/CVE-2023-5460.json) (`2023-10-09T19:15:10.543`)
* [CVE-2022-36228](CVE-2022/CVE-2022-362xx/CVE-2022-36228.json) (`2023-10-09T21:15:09.850`)
* [CVE-2022-3728](CVE-2022/CVE-2022-37xx/CVE-2022-3728.json) (`2023-10-09T21:15:09.910`)
* [CVE-2022-48182](CVE-2022/CVE-2022-481xx/CVE-2022-48182.json) (`2023-10-09T21:15:10.003`)
* [CVE-2022-48183](CVE-2022/CVE-2022-481xx/CVE-2022-48183.json) (`2023-10-09T21:15:10.080`)
* [CVE-2023-44392](CVE-2023/CVE-2023-443xx/CVE-2023-44392.json) (`2023-10-09T20:15:10.393`)
* [CVE-2023-44467](CVE-2023/CVE-2023-444xx/CVE-2023-44467.json) (`2023-10-09T20:15:10.480`)
* [CVE-2023-44811](CVE-2023/CVE-2023-448xx/CVE-2023-44811.json) (`2023-10-09T20:15:10.533`)
* [CVE-2023-44821](CVE-2023/CVE-2023-448xx/CVE-2023-44821.json) (`2023-10-09T20:15:10.583`)
* [CVE-2023-5461](CVE-2023/CVE-2023-54xx/CVE-2023-5461.json) (`2023-10-09T20:15:10.633`)
* [CVE-2023-43271](CVE-2023/CVE-2023-432xx/CVE-2023-43271.json) (`2023-10-09T21:15:10.173`)
* [CVE-2023-44812](CVE-2023/CVE-2023-448xx/CVE-2023-44812.json) (`2023-10-09T21:15:10.227`)
* [CVE-2023-44813](CVE-2023/CVE-2023-448xx/CVE-2023-44813.json) (`2023-10-09T21:15:10.273`)
### CVEs modified in the last Commit
Recently modified CVEs: `1`
Recently modified CVEs: `0`
* [CVE-2023-39453](CVE-2023/CVE-2023-394xx/CVE-2023-39453.json) (`2023-10-09T19:15:10.103`)
## Download and Usage