Auto-Update: 2023-10-10T04:00:24.974096+00:00

This commit is contained in:
cad-safe-bot 2023-10-10 04:00:28 +00:00
parent 1b03512ea7
commit 8e3ec9c20b
16 changed files with 515 additions and 19 deletions

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2020-18336",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-10-10T03:15:09.430",
"lastModified": "2023-10-10T03:15:09.430",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting (XSS) vulnerability found in Typora v.0.9.65 allows a remote attacker to obtain sensitive information via the PDF file exporting function."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/typora/typora-issues/issues/2232",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-40310",
"sourceIdentifier": "cna@sap.com",
"published": "2023-10-10T02:15:10.680",
"lastModified": "2023-10-10T02:15:10.680",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "SAP PowerDesigner\u00a0Client\u00a0- version 16.7, does not sufficiently validate BPMN2\u00a0XML document imported from an untrusted source. As a result, URLs of\u00a0external entities in BPMN2 file, although not used, would be accessed\u00a0during import.\u00a0A successful attack could impact availability of SAP PowerDesigner\u00a0Client.\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "cna@sap.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "cna@sap.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-112"
}
]
}
],
"references": [
{
"url": "https://me.sap.com/notes/3357154",
"source": "cna@sap.com"
},
{
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
"source": "cna@sap.com"
}
]
}

View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-41365",
"sourceIdentifier": "cna@sap.com",
"published": "2023-10-10T02:15:10.777",
"lastModified": "2023-10-10T02:15:10.777",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. After successful exploitation, an attacker can cause limited impact on the confidentiality and no impact to the integrity and availability.\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "cna@sap.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "cna@sap.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-209"
}
]
}
],
"references": [
{
"url": "https://me.sap.com/notes/3338380",
"source": "cna@sap.com"
},
{
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
"source": "cna@sap.com"
}
]
}

View File

@ -0,0 +1,28 @@
{
"id": "CVE-2023-42189",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-10-10T03:15:09.530",
"lastModified": "2023-10-10T03:15:09.530",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue hub v.1.59.1959097030, and yeelight smart lamp v.1.12.69 allows a remote attacker to cause a denial of service via a crafted script to the KeySetRemove function."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/IoT-Fuzz/IoT-Fuzz/blob/main/Remove%20Key%20Set%20Vulnerability%20Report.pdf",
"source": "cve@mitre.org"
},
{
"url": "https://github.com/project-chip/connectedhomeip/issues/28518",
"source": "cve@mitre.org"
},
{
"url": "https://github.com/project-chip/connectedhomeip/issues/28679",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-42473",
"sourceIdentifier": "cna@sap.com",
"published": "2023-10-10T02:15:10.860",
"lastModified": "2023-10-10T02:15:10.860",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "S/4HANA Manage (Withholding Tax Items) - version 106,\u00a0does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges which has low impact on the confidentiality and integrity of the application.\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "cna@sap.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 2.5
}
]
},
"weaknesses": [
{
"source": "cna@sap.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"references": [
{
"url": "https://me.sap.com/notes/3219846",
"source": "cna@sap.com"
},
{
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
"source": "cna@sap.com"
}
]
}

View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-42474",
"sourceIdentifier": "cna@sap.com",
"published": "2023-10-10T02:15:10.940",
"lastModified": "2023-10-10T02:15:10.940",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information.\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "cna@sap.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.3,
"impactScore": 4.0
}
]
},
"weaknesses": [
{
"source": "cna@sap.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://me.sap.com/notes/3372991",
"source": "cna@sap.com"
},
{
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
"source": "cna@sap.com"
}
]
}

View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-42475",
"sourceIdentifier": "cna@sap.com",
"published": "2023-10-10T02:15:11.020",
"lastModified": "2023-10-10T02:15:11.020",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality.\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "cna@sap.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "cna@sap.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"references": [
{
"url": "https://me.sap.com/notes/3222121",
"source": "cna@sap.com"
},
{
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
"source": "cna@sap.com"
}
]
}

View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-42477",
"sourceIdentifier": "cna@sap.com",
"published": "2023-10-10T02:15:11.103",
"lastModified": "2023-10-10T02:15:11.103",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50,\u00a0allows an attacker to send a crafted request from a vulnerable web application, causing limited impact on confidentiality and integrity of the application.\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "cna@sap.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5
}
]
},
"weaknesses": [
{
"source": "cna@sap.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-918"
}
]
}
],
"references": [
{
"url": "https://me.sap.com/notes/3333426",
"source": "cna@sap.com"
},
{
"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
"source": "cna@sap.com"
}
]
}

View File

@ -2,7 +2,7 @@
"id": "CVE-2023-42754",
"sourceIdentifier": "secalert@redhat.com",
"published": "2023-10-05T19:15:11.413",
"lastModified": "2023-10-10T00:15:10.430",
"lastModified": "2023-10-10T03:15:09.583",
"vulnStatus": "Undergoing Analysis",
"descriptions": [
{
@ -47,6 +47,14 @@
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2239845",
"source": "secalert@redhat.com"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GISYSL3F6WIEVGHJGLC2MFNTUXHPTKQH/",
"source": "secalert@redhat.com"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GPMICQ2HVZO5UAM5KPXHAZKA2U3ZDOO6/",
"source": "secalert@redhat.com"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V5PDNWPKAP3WL5RQZ4RIDS6MG32OHH5R/",
"source": "secalert@redhat.com"

View File

@ -2,7 +2,7 @@
"id": "CVE-2023-42756",
"sourceIdentifier": "secalert@redhat.com",
"published": "2023-09-28T14:15:21.037",
"lastModified": "2023-10-10T00:15:10.507",
"lastModified": "2023-10-10T03:15:09.663",
"vulnStatus": "Modified",
"descriptions": [
{
@ -147,6 +147,14 @@
"Third Party Advisory"
]
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GISYSL3F6WIEVGHJGLC2MFNTUXHPTKQH/",
"source": "secalert@redhat.com"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GPMICQ2HVZO5UAM5KPXHAZKA2U3ZDOO6/",
"source": "secalert@redhat.com"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V5PDNWPKAP3WL5RQZ4RIDS6MG32OHH5R/",
"source": "secalert@redhat.com"

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2023-44826",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-10-10T03:15:09.753",
"lastModified": "2023-10-10T03:15:09.753",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain sensitive information via a crafted script."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/jacyyang52/chandaoxss/",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2023-44827",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-10-10T03:15:09.873",
"lastModified": "2023-10-10T03:15:09.873",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execute arbitrary code via a crafted script to the Office Conversion Settings function."
}
],
"metrics": {},
"references": [
{
"url": "https://spotted-topaz-6aa.notion.site/Zentao-Authorized-Remote-Code-Execution-Vulnerability-CVE-2023-44827-be731cbe8607496cae35c08cb9ba2436",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2023-44959",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-10-10T03:15:09.923",
"lastModified": "2023-10-10T03:15:09.923",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "An issue found in D-Link DSL-3782 v.1.03 and before allows remote authenticated users to execute arbitrary code as root via the Router IP Address fields of the network settings page."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/FzBacon/CVE-2023-27216_D-Link_DSL-3782_Router_command_injection/blob/master/CVE-2023-27216_D-Link_DSL-3782_Router_command_injection.md#cve-2023-27216_d-link_dsl-3782_router_command_injection",
"source": "cve@mitre.org"
}
]
}

View File

@ -2,7 +2,7 @@
"id": "CVE-2023-5345",
"sourceIdentifier": "cve-coordination@google.com",
"published": "2023-10-03T03:15:09.750",
"lastModified": "2023-10-10T00:15:10.663",
"lastModified": "2023-10-10T03:15:09.970",
"vulnStatus": "Modified",
"descriptions": [
{
@ -130,6 +130,14 @@
"Patch"
]
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GISYSL3F6WIEVGHJGLC2MFNTUXHPTKQH/",
"source": "cve-coordination@google.com"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GPMICQ2HVZO5UAM5KPXHAZKA2U3ZDOO6/",
"source": "cve-coordination@google.com"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V5PDNWPKAP3WL5RQZ4RIDS6MG32OHH5R/",
"source": "cve-coordination@google.com"

View File

@ -2,8 +2,8 @@
"id": "CVE-2023-5346",
"sourceIdentifier": "chrome-cve-admin@google.com",
"published": "2023-10-05T18:15:13.270",
"lastModified": "2023-10-07T03:18:22.887",
"vulnStatus": "Analyzed",
"lastModified": "2023-10-10T03:15:10.050",
"vulnStatus": "Modified",
"descriptions": [
{
"lang": "en",
@ -83,6 +83,10 @@
"tags": [
"Permissions Required"
]
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BMFDRMWMT6ZBLGLLWSWHHRAUBOSUXQDR/",
"source": "chrome-cve-admin@google.com"
}
]
}

View File

@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2023-10-10T02:00:25.290040+00:00
2023-10-10T04:00:24.974096+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2023-10-10T01:15:10.400000+00:00
2023-10-10T03:15:10.050000+00:00
```
### Last Data Feed Release
@ -29,28 +29,34 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
227270
227281
```
### CVEs added in the last Commit
Recently added CVEs: `4`
Recently added CVEs: `11`
* [CVE-2023-44846](CVE-2023/CVE-2023-448xx/CVE-2023-44846.json) (`2023-10-10T01:15:10.240`)
* [CVE-2023-44847](CVE-2023/CVE-2023-448xx/CVE-2023-44847.json) (`2023-10-10T01:15:10.300`)
* [CVE-2023-44848](CVE-2023/CVE-2023-448xx/CVE-2023-44848.json) (`2023-10-10T01:15:10.353`)
* [CVE-2023-5471](CVE-2023/CVE-2023-54xx/CVE-2023-5471.json) (`2023-10-10T01:15:10.400`)
* [CVE-2020-18336](CVE-2020/CVE-2020-183xx/CVE-2020-18336.json) (`2023-10-10T03:15:09.430`)
* [CVE-2023-40310](CVE-2023/CVE-2023-403xx/CVE-2023-40310.json) (`2023-10-10T02:15:10.680`)
* [CVE-2023-41365](CVE-2023/CVE-2023-413xx/CVE-2023-41365.json) (`2023-10-10T02:15:10.777`)
* [CVE-2023-42473](CVE-2023/CVE-2023-424xx/CVE-2023-42473.json) (`2023-10-10T02:15:10.860`)
* [CVE-2023-42474](CVE-2023/CVE-2023-424xx/CVE-2023-42474.json) (`2023-10-10T02:15:10.940`)
* [CVE-2023-42475](CVE-2023/CVE-2023-424xx/CVE-2023-42475.json) (`2023-10-10T02:15:11.020`)
* [CVE-2023-42477](CVE-2023/CVE-2023-424xx/CVE-2023-42477.json) (`2023-10-10T02:15:11.103`)
* [CVE-2023-42189](CVE-2023/CVE-2023-421xx/CVE-2023-42189.json) (`2023-10-10T03:15:09.530`)
* [CVE-2023-44826](CVE-2023/CVE-2023-448xx/CVE-2023-44826.json) (`2023-10-10T03:15:09.753`)
* [CVE-2023-44827](CVE-2023/CVE-2023-448xx/CVE-2023-44827.json) (`2023-10-10T03:15:09.873`)
* [CVE-2023-44959](CVE-2023/CVE-2023-449xx/CVE-2023-44959.json) (`2023-10-10T03:15:09.923`)
### CVEs modified in the last Commit
Recently modified CVEs: `5`
Recently modified CVEs: `4`
* [CVE-2022-41352](CVE-2022/CVE-2022-413xx/CVE-2022-41352.json) (`2023-10-10T00:15:10.297`)
* [CVE-2023-42754](CVE-2023/CVE-2023-427xx/CVE-2023-42754.json) (`2023-10-10T00:15:10.430`)
* [CVE-2023-42756](CVE-2023/CVE-2023-427xx/CVE-2023-42756.json) (`2023-10-10T00:15:10.507`)
* [CVE-2023-45239](CVE-2023/CVE-2023-452xx/CVE-2023-45239.json) (`2023-10-10T00:15:10.593`)
* [CVE-2023-5345](CVE-2023/CVE-2023-53xx/CVE-2023-5345.json) (`2023-10-10T00:15:10.663`)
* [CVE-2023-42754](CVE-2023/CVE-2023-427xx/CVE-2023-42754.json) (`2023-10-10T03:15:09.583`)
* [CVE-2023-42756](CVE-2023/CVE-2023-427xx/CVE-2023-42756.json) (`2023-10-10T03:15:09.663`)
* [CVE-2023-5345](CVE-2023/CVE-2023-53xx/CVE-2023-5345.json) (`2023-10-10T03:15:09.970`)
* [CVE-2023-5346](CVE-2023/CVE-2023-53xx/CVE-2023-5346.json) (`2023-10-10T03:15:10.050`)
## Download and Usage