mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-07 19:16:29 +00:00
Auto-Update: 2023-04-24T12:55:25.799125+00:00
This commit is contained in:
René Helmke
parent
1e5b8d65a1
commit
b8e6e6c29b
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2020-15858",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2020-08-21T21:15:11.777",
|
||||
"lastModified": "2020-09-03T16:32:53.413",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2023-04-24T11:15:06.920",
|
||||
"vulnStatus": "Modified",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
@ -350,6 +350,10 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "http://seclists.org/fulldisclosure/2023/Apr/11",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://www.thalesgroup.com/en/markets/digital-identity-and-security/iot/resources/security-updates-cinterion-iot-modules",
|
||||
"source": "cve@mitre.org",
|
||||
|
||||
71
CVE-2023/CVE-2023-251xx/CVE-2023-25133.json
Normal file
71
CVE-2023/CVE-2023-251xx/CVE-2023-25133.json
Normal file
@ -0,0 +1,71 @@
|
||||
{
|
||||
"id": "CVE-2023-25133",
|
||||
"sourceIdentifier": "ART@zuso.ai",
|
||||
"published": "2023-04-24T11:15:07.097",
|
||||
"lastModified": "2023-04-24T11:15:07.097",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 64bit v4.8.6 and earlier, PowerPanel Business Management for Linux 32bit v4.8.6 and earlier, PowerPanel Business Management for Linux 64bit v4.8.6 and earlier, PowerPanel Business Local/Remote for MacOS v4.8.6 and earlier, and PowerPanel Business Management for MacOS v4.8.6 and earlier allows remote attackers to execute operation system commands via unspecified vectors."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "ART@zuso.ai",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 9.1,
|
||||
"baseSeverity": "CRITICAL"
|
||||
},
|
||||
"exploitabilityScore": 2.3,
|
||||
"impactScore": 6.0
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "ART@zuso.ai",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-269"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_linux#downloads",
|
||||
"source": "ART@zuso.ai"
|
||||
},
|
||||
{
|
||||
"url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_mac#downloads",
|
||||
"source": "ART@zuso.ai"
|
||||
},
|
||||
{
|
||||
"url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_virtual_machine#downloads",
|
||||
"source": "ART@zuso.ai"
|
||||
},
|
||||
{
|
||||
"url": "https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads",
|
||||
"source": "ART@zuso.ai"
|
||||
},
|
||||
{
|
||||
"url": "https://zuso.ai/Advisory/",
|
||||
"source": "ART@zuso.ai"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,7 +2,7 @@
|
||||
"id": "CVE-2023-28427",
|
||||
"sourceIdentifier": "security-advisories@github.com",
|
||||
"published": "2023-03-28T21:15:11.057",
|
||||
"lastModified": "2023-04-23T12:15:13.873",
|
||||
"lastModified": "2023-04-24T11:15:07.147",
|
||||
"vulnStatus": "Modified",
|
||||
"descriptions": [
|
||||
{
|
||||
@ -92,6 +92,10 @@
|
||||
"Vendor Advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00027.html",
|
||||
"source": "security-advisories@github.com"
|
||||
},
|
||||
{
|
||||
"url": "https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0",
|
||||
"source": "security-advisories@github.com",
|
||||
|
||||
166
README.md
166
README.md
@ -1 +1,167 @@
|
||||
# nvd-json-datafeeds
|
||||
|
||||
Community reconstruction of the soon-to-be deprecated JSON NVD Data Feeds.
|
||||
[Releases](https://github.com/fkie-cad/nvd-json-datafeeds/releases/latest) each day at 02:00 AM UTC.
|
||||
Repository synchronizes with the NVD in 2 hour periods.
|
||||
|
||||
## Repository at a glance
|
||||
|
||||
### Last repository update
|
||||
|
||||
```plain
|
||||
2023-04-24T12:55:25.799125+00:00
|
||||
```
|
||||
|
||||
### Most recent CVE modification timestamp synchronized with NVD
|
||||
|
||||
```plain
|
||||
2023-04-24T11:15:07.147000+00:00
|
||||
```
|
||||
|
||||
### Last Data Feed release
|
||||
|
||||
Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-datafeeds/releases/latest)
|
||||
|
||||
```plain
|
||||
1970-01-01T00:00:00.000+00:00
|
||||
```
|
||||
|
||||
### Total numbers of included CVEs
|
||||
|
||||
```plain
|
||||
213380
|
||||
```
|
||||
|
||||
### CVEs added in the last commit
|
||||
|
||||
Recently added CVEs: `1`
|
||||
|
||||
Past 10:
|
||||
|
||||
* [CVE-2023-25133](2023-04-24T11:15:07.097) (**)
|
||||
|
||||
|
||||
### CVEs modified in the last commit
|
||||
|
||||
Recently modified CVEs: `2`
|
||||
|
||||
Past 10:
|
||||
|
||||
* [CVE-2020-15858](2023-04-24T11:15:06.920) (**)
|
||||
* [CVE-2023-28427](2023-04-24T11:15:07.147) (**)
|
||||
|
||||
|
||||
## Download and Usage
|
||||
|
||||
There are several ways you can work with the data in this repository:
|
||||
|
||||
### 1) Release Data Feed Packages
|
||||
|
||||
The most straightforward approach is to obtain the latest Data Feed release packages [here](https://github.com/fkie-cad/nvd-json-datafeeds/releases/latest).
|
||||
|
||||
Each day on 02:00 AM UTC we package and upload json files that aim to reconstruct the legacy NVD CVE Data Feeds.
|
||||
Those are aggregated by the `year` part of the CVE identifier:
|
||||
|
||||
```
|
||||
# CVE-<YEAR>.json
|
||||
CVE-1999.json
|
||||
CVE-2001.json
|
||||
CVE-2002.json
|
||||
CVE-2003.json
|
||||
[...]
|
||||
CVE-2023.json
|
||||
```
|
||||
|
||||
Furthermore, we also upload the well-known `Recent` and `Modified` feeds.
|
||||
Once your local copy is synced and the last sync was no older than 8 days, you can rely on these to stay up to date:
|
||||
|
||||
```plain
|
||||
CVE-Recent.json # CVEs that were added in the previous eight days
|
||||
CVE-Modified.json # CVEs that were modified or added in the previous eight days
|
||||
```
|
||||
|
||||
Note that all feeds are distributed in `xz`-compressed format to save storage and bandwidth on Github.
|
||||
For decompression execute:
|
||||
|
||||
```sh
|
||||
xz -d -k <feed>.json.xz
|
||||
```
|
||||
|
||||
|
||||
#### Automation using Release Data Feed Packages
|
||||
|
||||
You can fetch the latest releases for each package using the following static link layout:
|
||||
|
||||
```sh
|
||||
https://github.com/fkie-cad/nvd-json-datafeeds/releases/latest/download/CVE-<YEAR>.json.xz
|
||||
```
|
||||
|
||||
Example:
|
||||
|
||||
```sh
|
||||
wget https://github.com/fkie-cad/nvd-json-datafeeds/releases/latest/download/CVE-2023.json.xz
|
||||
xz -d -k CVE-2023.json.xz
|
||||
```
|
||||
|
||||
### 2) Clone the repository (with git history)
|
||||
|
||||
As you can see by browsing this repository, there is a slight difference between the release packages format and the repo folder structure.
|
||||
This is because we want to maintain explorability of the dataset.
|
||||
|
||||
Each CVE gets its own json file, e.g., `CVE-1999-0001.json`.
|
||||
Here, each file is put into a folder layout that first sorts by CVE `year` identifier part and then by `number` part.
|
||||
We mask (`xx`) the last two digits to create easily navigable folders that hold a maximum of 100 CVE jsons:
|
||||
|
||||
```plain
|
||||
.
|
||||
├── CVE-1999
|
||||
│ ├── CVE-1999-00xx
|
||||
│ │ ├── CVE-1999-0001.json
|
||||
│ │ ├── CVE-1999-0002.json
|
||||
│ │ └── [...]
|
||||
│ ├── CVE-1999-01xx
|
||||
│ │ ├── CVE-1999-0101.json
|
||||
│ │ └── [...]
|
||||
│ └── [...]
|
||||
├── CVE-2000
|
||||
│ ├── CVE-2000-00xx
|
||||
│ ├── CVE-2000-01xx
|
||||
│ └── [...]
|
||||
└── [...]
|
||||
```
|
||||
|
||||
A byproduct of managing and continuously updating this dataset via git is that we can track changes over time through the git history.
|
||||
|
||||
If you are interested in having the NVD data as organized above, including the historical data of changes, just clone this repo (large!):
|
||||
|
||||
```sh
|
||||
git clone https://github.com/fkie-cad/nvd-json-datafeeds.git
|
||||
```
|
||||
|
||||
### 3) Clone the repository (without git history)
|
||||
|
||||
Don't need the history? Then create a shallow copy:
|
||||
|
||||
```sh
|
||||
git clone --depth 1 -b main https://github.com/fkie-cad/nvd-json-datafeeds.git
|
||||
```
|
||||
|
||||
## Motivation
|
||||
|
||||
As of Sept. 2023, the NIST will retire all [json-based NVD Data Feeds](https://nvd.nist.gov/vuln/data-feeds#divRetirementBanner-1).
|
||||
The new [NVD CVE API 2.0](https://nvd.nist.gov/developers/vulnerabilities) is, without a doubt, a great way to obtain CVE information.
|
||||
However, we from [Fraunhofer FKIE - Cyber Analysis and Defense](https://www.fkie.fraunhofer.de/en/departments/cad.html) believe that the API does not cover a variety of use cases.
|
||||
|
||||
The legacy NVD Data Feeds provided a convenient way to quickly obtain a complete, file-based offline database snapshot; just download the `CVE-<YEAR>.tar.gz`, decompress it, and use it as you please, e.g.:
|
||||
|
||||
* Put the json feed into a document-based database and quickly leverage upon that data in your software project, ...
|
||||
* Parse and analyze it using your favorite programming language, ...
|
||||
* Put it on a USB stick and transfer it to a system without internet access, or ...
|
||||
* Query the file using `jq`!
|
||||
|
||||
Unfortunately, the new NVD API 2.0 puts complexity into this process.
|
||||
We want to preserve ease of use by reconstructing these data sources.
|
||||
|
||||
## Non-Endorsement Clause
|
||||
|
||||
This project uses and redistributes data from the NVD API but is not endorsed or certified by the NVD.
|
||||
Loading…
x
Reference in New Issue
Block a user