mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-08 19:47:09 +00:00
Auto-Update: 2024-01-30T11:00:24.962970+00:00
This commit is contained in:
parent
95063802e6
commit
a26fd0f591
28
CVE-2023/CVE-2023-362xx/CVE-2023-36259.json
Normal file
28
CVE-2023/CVE-2023-362xx/CVE-2023-36259.json
Normal file
@ -0,0 +1,28 @@
|
||||
{
|
||||
"id": "CVE-2023-36259",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2024-01-30T09:15:47.377",
|
||||
"lastModified": "2024-01-30T09:15:47.377",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Una vulnerabilidad de Cross Site Scripting (XSS) en Craft CMS Audit Plugin anterior a la versi\u00f3n 3.0.2 permite a los atacantes ejecutar c\u00f3digo arbitrario durante la creaci\u00f3n de usuarios."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/sjelfull/craft-audit/pull/73",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D",
|
||||
"source": "cve@mitre.org"
|
||||
}
|
||||
]
|
||||
}
|
28
CVE-2023/CVE-2023-362xx/CVE-2023-36260.json
Normal file
28
CVE-2023/CVE-2023-362xx/CVE-2023-36260.json
Normal file
@ -0,0 +1,28 @@
|
||||
{
|
||||
"id": "CVE-2023-36260",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2024-01-30T09:15:47.440",
|
||||
"lastModified": "2024-01-30T09:15:47.440",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "An issue discovered in Craft CMS version 4.6.1. allows remote attackers to cause a denial of service (DoS) via crafted string to Feed-Me Name and Feed-Me URL fields due to saving a feed using an Asset element type with no volume selected."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Un problema descubierto en Craft CMS versi\u00f3n 4.6.1. permite a atacantes remotos provocar una denegaci\u00f3n de servicio (DoS) a trav\u00e9s de una cadena manipulada en los campos Feed-Me Name y Feed-Me URL debido a que se guarda un feed utilizando un tipo de elemento Asset sin volumen seleccionado."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/craftcms/feed-me/commit/b5d6ede51848349bd91bc95fec288b6793f15e28%29",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://www.linkedin.com/pulse/threat-briefing-craftcms-amrcybersecurity-emi0e/?trackingId=E75GttWvQp6gfvPiJDDUBA%3D%3D",
|
||||
"source": "cve@mitre.org"
|
||||
}
|
||||
]
|
||||
}
|
63
CVE-2023/CVE-2023-63xx/CVE-2023-6374.json
Normal file
63
CVE-2023/CVE-2023-63xx/CVE-2023-6374.json
Normal file
@ -0,0 +1,63 @@
|
||||
{
|
||||
"id": "CVE-2023-6374",
|
||||
"sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
|
||||
"published": "2024-01-30T09:15:47.520",
|
||||
"lastModified": "2024-01-30T09:15:47.520",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unauthenticated attacker to bypass authentication by capture-replay attack and illegally login to the affected module. As a result, the remote attacker who has logged in illegally may be able to disclose or tamper with the programs and parameters in the modules."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n mediante Capture-replay en Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200, todos los n\u00fameros de serie permite a un atacante remoto no autenticado omitir la autenticaci\u00f3n mediante un ataque de Capture-replay e iniciar sesi\u00f3n ilegalmente en el m\u00f3dulo afectado. Como resultado, el atacante remoto que ha iniciado sesi\u00f3n ilegalmente puede revelar o alterar los programas y par\u00e1metros de los m\u00f3dulos."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 5.9,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 2.2,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-294"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://jvn.jp/vu/JVNVU99497477",
|
||||
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
|
||||
},
|
||||
{
|
||||
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-019_en.pdf",
|
||||
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
|
||||
}
|
||||
]
|
||||
}
|
63
CVE-2023/CVE-2023-69xx/CVE-2023-6942.json
Normal file
63
CVE-2023/CVE-2023-69xx/CVE-2023-6942.json
Normal file
@ -0,0 +1,63 @@
|
||||
{
|
||||
"id": "CVE-2023-6942",
|
||||
"sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
|
||||
"published": "2024-01-30T09:15:47.757",
|
||||
"lastModified": "2024-01-30T09:15:47.757",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 and later, FR Configurator2 all versions, GT Designer3 Version1(GOT1000) all versions, GT Designer3 Version1(GOT2000) all versions, GX Works2 versions 1.11M and later, GX Works3 all versions, MELSOFT Navigator versions 1.04E and later, MT Works2 all versions, MX Component versions 4.00A and later and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to bypass authentication by sending specially crafted packets and connect to the products illegally."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Autenticaci\u00f3n faltante para vulnerabilidad de funci\u00f3n cr\u00edtica en Mitsubishi Electric Corporation EZSocket versiones 3.0 y posteriores, FR Configurator2 todas las versiones, GT Designer3 Versi\u00f3n1(GOT1000) todas las versiones, GT Designer3 Versi\u00f3n1(GOT2000) todas las versiones, GX Works2 versiones 1.11M y posteriores, GX Works3 todas versiones, MELSOFT Navigator versiones 1.04E y posteriores, MT Works2 todas las versiones, MX Component versiones 4.00A y posteriores y MX OPC Server DA/UA todas las versiones permiten a un atacante remoto no autenticado eludir la autenticaci\u00f3n enviando paquetes especialmente manipulados y conect\u00e1ndose a los productos ilegalmente."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 7.5,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-306"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://jvn.jp/vu/JVNVU95103362",
|
||||
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
|
||||
},
|
||||
{
|
||||
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-020_en.pdf",
|
||||
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
|
||||
}
|
||||
]
|
||||
}
|
63
CVE-2023/CVE-2023-69xx/CVE-2023-6943.json
Normal file
63
CVE-2023/CVE-2023-69xx/CVE-2023-6943.json
Normal file
@ -0,0 +1,63 @@
|
||||
{
|
||||
"id": "CVE-2023-6943",
|
||||
"sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
|
||||
"published": "2024-01-30T09:15:47.960",
|
||||
"lastModified": "2024-01-30T09:15:47.960",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 and later, FR Configurator2 all versions, GT Designer3 Version1(GOT1000) all versions, GT Designer3 Version1(GOT2000) all versions, GX Works2 versions 1.11M and later, GX Works3 all versions, MELSOFT Navigator versions 1.04E and later, MT Works2 all versions, MX Component versions 4.00A and later and MX OPC Server DA/UA all versions allows a remote unauthenticated attacker to execute a malicious code by RPC with a path to a malicious library while connected to the products."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Vulnerabilidad de uso de entrada controlada externamente para seleccionar clases o c\u00f3digo (\"Reflexi\u00f3n insegura\") en Mitsubishi Electric Corporation EZSocket versiones 3.0 y posteriores, FR Configurator2 todas las versiones, GT Designer3 Versi\u00f3n1(GOT1000) todas las versiones, GT Designer3 Versi\u00f3n1(GOT2000) todas las versiones , GX Works2 versiones 1.11M y posteriores, GX Works3 todas las versiones, MELSOFT Navigator versiones 1.04E y posteriores, MT Works2 todas las versiones, MX Component versiones 4.00A y posteriores y MX OPC Server DA/UA todas las versiones permiten que un atacante remoto no autenticado ejecute un c\u00f3digo malicioso por RPC con una ruta a una librer\u00eda maliciosa mientras est\u00e1 conectado a los productos."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 9.8,
|
||||
"baseSeverity": "CRITICAL"
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-470"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://jvn.jp/vu/JVNVU95103362",
|
||||
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
|
||||
},
|
||||
{
|
||||
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-020_en.pdf",
|
||||
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
|
||||
}
|
||||
]
|
||||
}
|
@ -2,12 +2,16 @@
|
||||
"id": "CVE-2024-1014",
|
||||
"sourceIdentifier": "cve-coordination@incibe.es",
|
||||
"published": "2024-01-29T14:15:09.437",
|
||||
"lastModified": "2024-01-29T14:25:21.047",
|
||||
"lastModified": "2024-01-30T09:15:48.173",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could interrupt the availability of the administration panel by sending multiple ICMP packets."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Vulnerabilidad de consumo descontrolado de recursos en SE-elektronic GmbH E-DDC3.3 que afecta a las versiones 03.07.03 y superiores. Un atacante podr\u00eda interrumpir la disponibilidad del panel de administraci\u00f3n enviando m\u00faltiples paquetes ICMP."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
@ -47,6 +51,10 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.hackplayers.com/2024/01/cve-2024-1014-and-cve-2024-1015.html",
|
||||
"source": "cve-coordination@incibe.es"
|
||||
},
|
||||
{
|
||||
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-se-elektronic-gmbh-products",
|
||||
"source": "cve-coordination@incibe.es"
|
||||
|
@ -2,12 +2,16 @@
|
||||
"id": "CVE-2024-1015",
|
||||
"sourceIdentifier": "cve-coordination@incibe.es",
|
||||
"published": "2024-01-29T14:15:09.657",
|
||||
"lastModified": "2024-01-29T14:25:21.047",
|
||||
"lastModified": "2024-01-30T09:15:48.277",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": " Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could send different commands from the operating system to the system via the web configuration functionality of the device."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Vulnerabilidad de ejecuci\u00f3n remota de comandos en SE-elektronic GmbH E-DDC3.3 que afecta a las versiones 03.07.03 y superiores. Un atacante podr\u00eda enviar diferentes comandos desde el sistema operativo al sistema a trav\u00e9s de la funcionalidad de configuraci\u00f3n web del dispositivo."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
@ -47,6 +51,10 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.hackplayers.com/2024/01/cve-2024-1014-and-cve-2024-1015.html",
|
||||
"source": "cve-coordination@incibe.es"
|
||||
},
|
||||
{
|
||||
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-se-elektronic-gmbh-products",
|
||||
"source": "cve-coordination@incibe.es"
|
||||
|
84
CVE-2024/CVE-2024-10xx/CVE-2024-1030.json
Normal file
84
CVE-2024/CVE-2024-10xx/CVE-2024-1030.json
Normal file
@ -0,0 +1,84 @@
|
||||
{
|
||||
"id": "CVE-2024-1030",
|
||||
"sourceIdentifier": "cna@vuldb.com",
|
||||
"published": "2024-01-30T10:15:08.467",
|
||||
"lastModified": "2024-01-30T10:15:08.467",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A vulnerability was found in Cogites eReserv 7.7.58. It has been classified as problematic. This affects an unknown part of the file /front/admin/tenancyDetail.php. The manipulation of the argument id leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-252303."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "cna@vuldb.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 3.5,
|
||||
"baseSeverity": "LOW"
|
||||
},
|
||||
"exploitabilityScore": 2.1,
|
||||
"impactScore": 1.4
|
||||
}
|
||||
],
|
||||
"cvssMetricV2": [
|
||||
{
|
||||
"source": "cna@vuldb.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "2.0",
|
||||
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
|
||||
"accessVector": "NETWORK",
|
||||
"accessComplexity": "LOW",
|
||||
"authentication": "SINGLE",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "PARTIAL",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.0
|
||||
},
|
||||
"baseSeverity": "MEDIUM",
|
||||
"exploitabilityScore": 8.0,
|
||||
"impactScore": 2.9,
|
||||
"acInsufInfo": false,
|
||||
"obtainAllPrivilege": false,
|
||||
"obtainUserPrivilege": false,
|
||||
"obtainOtherPrivilege": false,
|
||||
"userInteractionRequired": false
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "cna@vuldb.com",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-79"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://vuldb.com/?ctiid.252303",
|
||||
"source": "cna@vuldb.com"
|
||||
},
|
||||
{
|
||||
"url": "https://vuldb.com/?id.252303",
|
||||
"source": "cna@vuldb.com"
|
||||
}
|
||||
]
|
||||
}
|
59
CVE-2024/CVE-2024-10xx/CVE-2024-1061.json
Normal file
59
CVE-2024/CVE-2024-10xx/CVE-2024-1061.json
Normal file
@ -0,0 +1,59 @@
|
||||
{
|
||||
"id": "CVE-2024-1061",
|
||||
"sourceIdentifier": "vulnreport@tenable.com",
|
||||
"published": "2024-01-30T09:15:48.367",
|
||||
"lastModified": "2024-01-30T09:15:48.367",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the \u00a0'get_view' function.\n"
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "El complemento de WordPress 'HTML5 Video Player', versi\u00f3n <2.5.25, se ve afectado por una vulnerabilidad de inyecci\u00f3n SQL no autenticada en el par\u00e1metro 'id' de la funci\u00f3n 'get_view'."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "vulnreport@tenable.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 8.6,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 4.0
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "vulnreport@tenable.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-89"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.tenable.com/security/research/tra-2024-02",
|
||||
"source": "vulnreport@tenable.com"
|
||||
}
|
||||
]
|
||||
}
|
55
CVE-2024/CVE-2024-10xx/CVE-2024-1063.json
Normal file
55
CVE-2024/CVE-2024-10xx/CVE-2024-1063.json
Normal file
@ -0,0 +1,55 @@
|
||||
{
|
||||
"id": "CVE-2024-1063",
|
||||
"sourceIdentifier": "vulnreport@tenable.com",
|
||||
"published": "2024-01-30T10:15:09.267",
|
||||
"lastModified": "2024-01-30T10:15:09.267",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159.\n"
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "vulnreport@tenable.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 1.4
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "vulnreport@tenable.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-918"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.tenable.com/security/research/tra-2024-03",
|
||||
"source": "vulnreport@tenable.com"
|
||||
}
|
||||
]
|
||||
}
|
24
CVE-2024/CVE-2024-225xx/CVE-2024-22523.json
Normal file
24
CVE-2024/CVE-2024-225xx/CVE-2024-22523.json
Normal file
@ -0,0 +1,24 @@
|
||||
{
|
||||
"id": "CVE-2024-22523",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2024-01-30T09:15:48.573",
|
||||
"lastModified": "2024-01-30T09:15:48.573",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Directory Traversal vulnerability in Qiyu iFair version 23.8_ad0 and before, allows remote attackers to obtain sensitive information via uploadimage component."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "La vulnerabilidad de Directory Traversal en Qiyu iFair versi\u00f3n 23.8_ad0 y anteriores permite a atacantes remotos obtener informaci\u00f3n confidencial a trav\u00e9s del componente de carga de im\u00e1genes."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.yuque.com/for82/vdzwqe/sc8ictw8poo8v5gl",
|
||||
"source": "cve@mitre.org"
|
||||
}
|
||||
]
|
||||
}
|
24
CVE-2024/CVE-2024-228xx/CVE-2024-22894.json
Normal file
24
CVE-2024/CVE-2024-228xx/CVE-2024-22894.json
Normal file
@ -0,0 +1,24 @@
|
||||
{
|
||||
"id": "CVE-2024-22894",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2024-01-30T10:15:09.833",
|
||||
"lastModified": "2024-01-30T10:15:09.833",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "An issue in AIT-Deutschland Alpha Innotec Heatpumps wp2reg-V.3.88.0-9015 and Novelan Heatpumps wp2reg-V.3.88.0-9015, allows remote attackers to execute arbitrary code via the password component in the shadow file."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/Jaarden/AlphaInnotec-Password-Vulnerability/",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/Jaarden/CVE-2024-22894",
|
||||
"source": "cve@mitre.org"
|
||||
}
|
||||
]
|
||||
}
|
29
README.md
29
README.md
@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
|
||||
### Last Repository Update
|
||||
|
||||
```plain
|
||||
2024-01-30T09:00:25.998000+00:00
|
||||
2024-01-30T11:00:24.962970+00:00
|
||||
```
|
||||
|
||||
### Most recent CVE Modification Timestamp synchronized with NVD
|
||||
|
||||
```plain
|
||||
2024-01-30T08:15:41.373000+00:00
|
||||
2024-01-30T10:15:09.833000+00:00
|
||||
```
|
||||
|
||||
### Last Data Feed Release
|
||||
@ -29,26 +29,31 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
|
||||
### Total Number of included CVEs
|
||||
|
||||
```plain
|
||||
237104
|
||||
237114
|
||||
```
|
||||
|
||||
### CVEs added in the last Commit
|
||||
|
||||
Recently added CVEs: `7`
|
||||
Recently added CVEs: `10`
|
||||
|
||||
* [CVE-2023-52071](CVE-2023/CVE-2023-520xx/CVE-2023-52071.json) (`2024-01-30T07:15:07.787`)
|
||||
* [CVE-2023-7225](CVE-2023/CVE-2023-72xx/CVE-2023-7225.json) (`2024-01-30T08:15:40.090`)
|
||||
* [CVE-2024-22643](CVE-2024/CVE-2024-226xx/CVE-2024-22643.json) (`2024-01-30T07:15:07.950`)
|
||||
* [CVE-2024-22646](CVE-2024/CVE-2024-226xx/CVE-2024-22646.json) (`2024-01-30T07:15:08.027`)
|
||||
* [CVE-2024-22647](CVE-2024/CVE-2024-226xx/CVE-2024-22647.json) (`2024-01-30T07:15:08.103`)
|
||||
* [CVE-2024-22648](CVE-2024/CVE-2024-226xx/CVE-2024-22648.json) (`2024-01-30T07:15:08.200`)
|
||||
* [CVE-2024-21803](CVE-2024/CVE-2024-218xx/CVE-2024-21803.json) (`2024-01-30T08:15:41.373`)
|
||||
* [CVE-2023-36259](CVE-2023/CVE-2023-362xx/CVE-2023-36259.json) (`2024-01-30T09:15:47.377`)
|
||||
* [CVE-2023-36260](CVE-2023/CVE-2023-362xx/CVE-2023-36260.json) (`2024-01-30T09:15:47.440`)
|
||||
* [CVE-2023-6374](CVE-2023/CVE-2023-63xx/CVE-2023-6374.json) (`2024-01-30T09:15:47.520`)
|
||||
* [CVE-2023-6942](CVE-2023/CVE-2023-69xx/CVE-2023-6942.json) (`2024-01-30T09:15:47.757`)
|
||||
* [CVE-2023-6943](CVE-2023/CVE-2023-69xx/CVE-2023-6943.json) (`2024-01-30T09:15:47.960`)
|
||||
* [CVE-2024-1061](CVE-2024/CVE-2024-10xx/CVE-2024-1061.json) (`2024-01-30T09:15:48.367`)
|
||||
* [CVE-2024-22523](CVE-2024/CVE-2024-225xx/CVE-2024-22523.json) (`2024-01-30T09:15:48.573`)
|
||||
* [CVE-2024-1030](CVE-2024/CVE-2024-10xx/CVE-2024-1030.json) (`2024-01-30T10:15:08.467`)
|
||||
* [CVE-2024-1063](CVE-2024/CVE-2024-10xx/CVE-2024-1063.json) (`2024-01-30T10:15:09.267`)
|
||||
* [CVE-2024-22894](CVE-2024/CVE-2024-228xx/CVE-2024-22894.json) (`2024-01-30T10:15:09.833`)
|
||||
|
||||
|
||||
### CVEs modified in the last Commit
|
||||
|
||||
Recently modified CVEs: `0`
|
||||
Recently modified CVEs: `2`
|
||||
|
||||
* [CVE-2024-1014](CVE-2024/CVE-2024-10xx/CVE-2024-1014.json) (`2024-01-30T09:15:48.173`)
|
||||
* [CVE-2024-1015](CVE-2024/CVE-2024-10xx/CVE-2024-1015.json) (`2024-01-30T09:15:48.277`)
|
||||
|
||||
|
||||
## Download and Usage
|
||||
|
Loading…
x
Reference in New Issue
Block a user