Auto-Update: 2023-04-27T13:02:44.285971+00:00

This commit is contained in:
René Helmke 2023-04-27 15:02:47 +02:00
parent 6480426654
commit 97154e69fc
12 changed files with 659 additions and 15 deletions

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2023-1778",
"sourceIdentifier": "vdisclose@cert-in.org.in",
"published": "2023-04-27T10:15:09.160",
"lastModified": "2023-04-27T10:15:09.160",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to insecure default credentials which allows remote attacker to login as superuser by using default username/password via web-based management interface and/or exposed SSH port thereby enabling remote attackers to execute arbitrary commands with administrative/superuser privileges on the targeted systems.\n\nThe vulnerability has been addressed by forcing the user to change their default password to a new non-default password.\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "vdisclose@cert-in.org.in",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0
}
]
},
"weaknesses": [
{
"source": "vdisclose@cert-in.org.in",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-287"
}
]
}
],
"references": [
{
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2023-0119",
"source": "vdisclose@cert-in.org.in"
}
]
}

View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-2322",
"sourceIdentifier": "security@huntr.dev",
"published": "2023-04-27T09:15:09.927",
"lastModified": "2023-04-27T09:15:09.927",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21."
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "security@huntr.dev",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "HIGH",
"baseScore": 5.2,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 0.9,
"impactScore": 4.2
}
]
},
"weaknesses": [
{
"source": "security@huntr.dev",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://github.com/pimcore/pimcore/commit/9fc674892b8b53103098b9524705074a45e7f773",
"source": "security@huntr.dev"
},
{
"url": "https://huntr.dev/bounties/f7228f3f-3bef-46fe-b0e3-56c432048a67",
"source": "security@huntr.dev"
}
]
}

View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-2323",
"sourceIdentifier": "security@huntr.dev",
"published": "2023-04-27T09:15:10.007",
"lastModified": "2023-04-27T09:15:10.007",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21."
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "security@huntr.dev",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.3,
"impactScore": 4.0
}
]
},
"weaknesses": [
{
"source": "security@huntr.dev",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://github.com/pimcore/pimcore/commit/e88fa79de7b5903fb58ddbc231130b04d937d79e",
"source": "security@huntr.dev"
},
{
"url": "https://huntr.dev/bounties/41edf190-f6bf-4a29-a237-7ff1b2d048d3",
"source": "security@huntr.dev"
}
]
}

View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-2327",
"sourceIdentifier": "security@huntr.dev",
"published": "2023-04-27T10:15:09.603",
"lastModified": "2023-04-27T10:15:09.603",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21."
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "security@huntr.dev",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 0.6,
"impactScore": 3.4
}
]
},
"weaknesses": [
{
"source": "security@huntr.dev",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://github.com/pimcore/pimcore/commit/fb3056a21d439135480ee299bf1ab646867b5f4f",
"source": "security@huntr.dev"
},
{
"url": "https://huntr.dev/bounties/7336b71f-a36f-4ce7-a26d-c8335ac713d6",
"source": "security@huntr.dev"
}
]
}

View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-2328",
"sourceIdentifier": "security@huntr.dev",
"published": "2023-04-27T10:15:09.670",
"lastModified": "2023-04-27T10:15:09.670",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21."
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "security@huntr.dev",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 5.2,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 1.1,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "security@huntr.dev",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://github.com/pimcore/pimcore/commit/e3562bfe249c557d15474c9a0acd5e06628521fe",
"source": "security@huntr.dev"
},
{
"url": "https://huntr.dev/bounties/01a44584-e36b-46f4-ad94-53af488397f6",
"source": "security@huntr.dev"
}
]
}

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2023-2331",
"sourceIdentifier": "security@42gears.com",
"published": "2023-04-27T12:15:09.070",
"lastModified": "2023-04-27T12:15:09.070",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Unquoted Search Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows allows Privilege Escalation, Local Execution of Code.This issue affects Surelock Windows : 2.40.0.\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@42gears.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "security@42gears.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-428"
}
]
}
],
"references": [
{
"url": "https://www.42gears.com/security-and-compliance",
"source": "security@42gears.com"
}
]
}

View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-2336",
"sourceIdentifier": "security@huntr.dev",
"published": "2023-04-27T12:15:09.173",
"lastModified": "2023-04-27T12:15:09.173",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21."
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "security@huntr.dev",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7
}
]
},
"weaknesses": [
{
"source": "security@huntr.dev",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"references": [
{
"url": "https://github.com/pimcore/pimcore/commit/498cadec2292f7842fb10612068ac78496e884b4",
"source": "security@huntr.dev"
},
{
"url": "https://huntr.dev/bounties/af764624-7746-4f53-8480-85348dbb4f14",
"source": "security@huntr.dev"
}
]
}

View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-2338",
"sourceIdentifier": "security@huntr.dev",
"published": "2023-04-27T12:15:09.237",
"lastModified": "2023-04-27T12:15:09.237",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.21."
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "security@huntr.dev",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "security@huntr.dev",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"references": [
{
"url": "https://github.com/pimcore/pimcore/commit/21e35af721c375ef4676ed50835e30d828e76520",
"source": "security@huntr.dev"
},
{
"url": "https://huntr.dev/bounties/bbf59fa7-cf5b-4945-81b0-328adc710462",
"source": "security@huntr.dev"
}
]
}

View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-2339",
"sourceIdentifier": "security@huntr.dev",
"published": "2023-04-27T12:15:09.300",
"lastModified": "2023-04-27T12:15:09.300",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21."
}
],
"metrics": {
"cvssMetricV30": [
{
"source": "security@huntr.dev",
"type": "Secondary",
"cvssData": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
]
},
"weaknesses": [
{
"source": "security@huntr.dev",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://github.com/pimcore/pimcore/commit/6946f8a5a0a93b516c49f17a5b45044eebd73480",
"source": "security@huntr.dev"
},
{
"url": "https://huntr.dev/bounties/bb1537a5-fe7b-4c77-a582-10a82435fbc2",
"source": "security@huntr.dev"
}
]
}

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2023-28769",
"sourceIdentifier": "security@zyxel.com.tw",
"published": "2023-04-27T09:15:09.057",
"lastModified": "2023-04-27T09:15:09.057",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The buffer overflow vulnerability in the library \u201clibclinkc.so\u201d of the web server \u201czhttpd\u201d in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to execute some OS commands or to cause denial-of-service (DoS) conditions on a vulnerable device."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@zyxel.com.tw",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "security@zyxel.com.tw",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-120"
}
]
}
],
"references": [
{
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities",
"source": "security@zyxel.com.tw"
}
]
}

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2023-28770",
"sourceIdentifier": "security@zyxel.com.tw",
"published": "2023-04-27T09:15:09.850",
"lastModified": "2023-04-27T09:15:09.850",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The sensitive information exposure vulnerability in the CGI \u201cExport_Log\u201d and the binary \u201czcmd\u201d in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to read the system files and to retrieve the password of the supervisor from the encrypted file."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@zyxel.com.tw",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "security@zyxel.com.tw",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"references": [
{
"url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities",
"source": "security@zyxel.com.tw"
}
]
}

View File

@ -1,7 +1,7 @@
# nvd-json-datafeeds
# nvd-json-data-feeds
Community reconstruction of the soon-to-be deprecated JSON NVD Data Feeds.
[Releases](https://github.com/fkie-cad/nvd-json-datafeeds/releases/latest) each day at 00:00 AM UTC.
[Releases](https://github.com/fkie-cad/nvd-json-data-feeds/releases/latest) each day at 00:00 AM UTC.
Repository synchronizes with the NVD in 2 hour periods.
## Repository at a glance
@ -9,18 +9,18 @@ Repository synchronizes with the NVD in 2 hour periods.
### Last repository update
```plain
2023-04-27T08:00:28.423840+00:00
2023-04-27T13:02:44.285971+00:00
```
### Most recent CVE modification timestamp synchronized with NVD
```plain
2023-04-27T05:15:08.807000+00:00
2023-04-27T12:15:09.300000+00:00
```
### Last Data Feed release
Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-datafeeds/releases/latest)
Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/releases/latest)
```plain
2023-04-27T00:00:20.965588+00:00
@ -28,8 +28,8 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-datafeeds/r
### Total numbers of included CVEs
```plai#n
213652
```plain
213663
```
### CVEs added in the last commit
@ -40,9 +40,19 @@ Recently added CVEs: `0`
### CVEs modified in the last commit
Recently modified CVEs: `1`
Recently modified CVEs: `11`
* CVE-2023-31290 (*2023-04-27T05:15:08.807*)
* CVE-2023-1778 (`2023-04-27T10:15:09.160`)
* CVE-2023-2322 (`2023-04-27T09:15:09.927`)
* CVE-2023-2323 (`2023-04-27T09:15:10.007`)
* CVE-2023-2327 (`2023-04-27T10:15:09.603`)
* CVE-2023-2328 (`2023-04-27T10:15:09.670`)
* CVE-2023-2331 (`2023-04-27T12:15:09.070`)
* CVE-2023-2336 (`2023-04-27T12:15:09.173`)
* CVE-2023-2338 (`2023-04-27T12:15:09.237`)
* CVE-2023-2339 (`2023-04-27T12:15:09.300`)
* CVE-2023-28769 (`2023-04-27T09:15:09.057`)
* CVE-2023-28770 (`2023-04-27T09:15:09.850`)
## Download and Usage
@ -51,7 +61,7 @@ There are several ways you can work with the data in this repository:
### 1) Release Data Feed Packages
The most straightforward approach is to obtain the latest Data Feed release packages [here](https://github.com/fkie-cad/nvd-json-datafeeds/releases/latest).
The most straightforward approach is to obtain the latest Data Feed release packages [here](https://github.com/fkie-cad/nvd-json-data-feeds/releases/latest).
Each day on 02:00 AM UTC we package and upload json files that aim to reconstruct the legacy NVD CVE Data Feeds.
Those are aggregated by the `year` part of the CVE identifier:
@ -66,7 +76,8 @@ CVE-2003.json
CVE-2023.json
```
Furthermore, we also upload the well-known `Recent` and `Modified` feeds.
We also upload the well-known `Recent` and `Modified` feeds.
Furthermore, we provide the `All` feed, which contains a recent snapshot of all NVD records.
Once your local copy is synced and the last sync was no older than 8 days, you can rely on these to stay up to date:
```plain
@ -87,13 +98,13 @@ xz -d -k <feed>.json.xz
You can fetch the latest releases for each package using the following static link layout:
```sh
https://github.com/fkie-cad/nvd-json-datafeeds/releases/latest/download/CVE-<YEAR>.json.xz
https://github.com/fkie-cad/nvd-json-data-feeds/releases/latest/download/CVE-<YEAR>.json.xz
```
Example:
```sh
wget https://github.com/fkie-cad/nvd-json-datafeeds/releases/latest/download/CVE-2023.json.xz
wget https://github.com/fkie-cad/nvd-json-data-feeds/releases/latest/download/CVE-2023.json.xz
xz -d -k CVE-2023.json.xz
```
@ -129,7 +140,7 @@ A byproduct of managing and continuously updating this dataset via git is that w
If you are interested in having the NVD data as organized above, including the historical data of changes, just clone this repo (large!):
```sh
git clone https://github.com/fkie-cad/nvd-json-datafeeds.git
git clone https://github.com/fkie-cad/nvd-json-data-feeds.git
```
### 3) Clone the repository (without git history)
@ -137,7 +148,7 @@ git clone https://github.com/fkie-cad/nvd-json-datafeeds.git
Don't need the history? Then create a shallow copy:
```sh
git clone --depth 1 -b main https://github.com/fkie-cad/nvd-json-datafeeds.git
git clone --depth 1 -b main https://github.com/fkie-cad/nvd-json-data-feeds.git
```
## Motivation