From bc06e10a5efa070ebcd1f2bf5d2f63e111bf17cc Mon Sep 17 00:00:00 2001 From: cad-safe-bot Date: Tue, 10 Sep 2024 04:03:16 +0000 Subject: [PATCH] Auto-Update: 2024-09-10T04:00:17.954746+00:00 --- CVE-2024/CVE-2024-382xx/CVE-2024-38270.json | 56 ++++++++++++++++++ CVE-2024/CVE-2024-417xx/CVE-2024-41729.json | 64 +++++++++++++++++++++ CVE-2024/CVE-2024-423xx/CVE-2024-42371.json | 60 +++++++++++++++++++ CVE-2024/CVE-2024-423xx/CVE-2024-42378.json | 60 +++++++++++++++++++ CVE-2024/CVE-2024-423xx/CVE-2024-42380.json | 60 +++++++++++++++++++ CVE-2024/CVE-2024-441xx/CVE-2024-44113.json | 60 +++++++++++++++++++ CVE-2024/CVE-2024-441xx/CVE-2024-44114.json | 60 +++++++++++++++++++ CVE-2024/CVE-2024-441xx/CVE-2024-44115.json | 60 +++++++++++++++++++ CVE-2024/CVE-2024-441xx/CVE-2024-44116.json | 60 +++++++++++++++++++ CVE-2024/CVE-2024-63xx/CVE-2024-6342.json | 63 ++++++++++++++++++++ CVE-2024/CVE-2024-82xx/CVE-2024-8268.json | 64 +++++++++++++++++++++ CVE-2024/CVE-2024-84xx/CVE-2024-8478.json | 64 +++++++++++++++++++++ README.md | 25 +++++--- _state.csv | 18 +++++- 14 files changed, 763 insertions(+), 11 deletions(-) create mode 100644 CVE-2024/CVE-2024-382xx/CVE-2024-38270.json create mode 100644 CVE-2024/CVE-2024-417xx/CVE-2024-41729.json create mode 100644 CVE-2024/CVE-2024-423xx/CVE-2024-42371.json create mode 100644 CVE-2024/CVE-2024-423xx/CVE-2024-42378.json create mode 100644 CVE-2024/CVE-2024-423xx/CVE-2024-42380.json create mode 100644 CVE-2024/CVE-2024-441xx/CVE-2024-44113.json create mode 100644 CVE-2024/CVE-2024-441xx/CVE-2024-44114.json create mode 100644 CVE-2024/CVE-2024-441xx/CVE-2024-44115.json create mode 100644 CVE-2024/CVE-2024-441xx/CVE-2024-44116.json create mode 100644 CVE-2024/CVE-2024-63xx/CVE-2024-6342.json create mode 100644 CVE-2024/CVE-2024-82xx/CVE-2024-8268.json create mode 100644 CVE-2024/CVE-2024-84xx/CVE-2024-8478.json diff --git a/CVE-2024/CVE-2024-382xx/CVE-2024-38270.json b/CVE-2024/CVE-2024-382xx/CVE-2024-38270.json new file mode 100644 index 00000000000..64a291eabf9 --- /dev/null +++ b/CVE-2024/CVE-2024-382xx/CVE-2024-38270.json @@ -0,0 +1,56 @@ +{ + "id": "CVE-2024-38270", + "sourceIdentifier": "security@zyxel.com.tw", + "published": "2024-09-10T02:15:09.780", + "lastModified": "2024-09-10T02:15:09.780", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "An insufficient entropy vulnerability caused by the improper use of a randomness function with low entropy for web authentication tokens generation exists in the Zyxel GS1900-10HP firmware version V2.80(AAZI.0)C0. This vulnerability could allow a LAN-based attacker a slight chance to gain a valid session token if multiple authenticated sessions are alive." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security@zyxel.com.tw", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", + "attackVector": "ADJACENT_NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "baseScore": 5.3, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 1.6, + "impactScore": 3.6 + } + ] + }, + "weaknesses": [ + { + "source": "security@zyxel.com.tw", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-331" + } + ] + } + ], + "references": [ + { + "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-insufficient-entropy-vulnerability-for-web-authentication-tokens-generation-in-gs1900-series-switches-09-10-2024", + "source": "security@zyxel.com.tw" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-417xx/CVE-2024-41729.json b/CVE-2024/CVE-2024-417xx/CVE-2024-41729.json new file mode 100644 index 00000000000..3b04e850514 --- /dev/null +++ b/CVE-2024/CVE-2024-417xx/CVE-2024-41729.json @@ -0,0 +1,64 @@ +{ + "id": "CVE-2024-41729", + "sourceIdentifier": "cna@sap.com", + "published": "2024-09-10T03:15:02.033", + "lastModified": "2024-09-10T03:15:02.033", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "cna@sap.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "baseScore": 4.3, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 1.4 + } + ] + }, + "weaknesses": [ + { + "source": "cna@sap.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-359" + }, + { + "lang": "en", + "value": "CWE-862" + } + ] + } + ], + "references": [ + { + "url": "https://me.sap.com/notes/3481588", + "source": "cna@sap.com" + }, + { + "url": "https://url.sap/sapsecuritypatchday", + "source": "cna@sap.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-423xx/CVE-2024-42371.json b/CVE-2024/CVE-2024-423xx/CVE-2024-42371.json new file mode 100644 index 00000000000..0820c02e7c6 --- /dev/null +++ b/CVE-2024/CVE-2024-423xx/CVE-2024-42371.json @@ -0,0 +1,60 @@ +{ + "id": "CVE-2024-42371", + "sourceIdentifier": "cna@sap.com", + "published": "2024-09-10T03:15:02.240", + "lastModified": "2024-09-10T03:15:02.240", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "The RFC enabled function module allows a low privileged user to delete the workplace favourites of any user. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces and nodes. There is low impact on integrity and availability of the application." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "cna@sap.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "LOW", + "baseScore": 5.4, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 2.5 + } + ] + }, + "weaknesses": [ + { + "source": "cna@sap.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-862" + } + ] + } + ], + "references": [ + { + "url": "https://me.sap.com/notes/3488039", + "source": "cna@sap.com" + }, + { + "url": "https://url.sap/sapsecuritypatchday", + "source": "cna@sap.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-423xx/CVE-2024-42378.json b/CVE-2024/CVE-2024-423xx/CVE-2024-42378.json new file mode 100644 index 00000000000..50a046c6772 --- /dev/null +++ b/CVE-2024/CVE-2024-423xx/CVE-2024-42378.json @@ -0,0 +1,60 @@ +{ + "id": "CVE-2024-42378", + "sourceIdentifier": "cna@sap.com", + "published": "2024-09-10T03:15:02.443", + "lastModified": "2024-09-10T03:15:02.443", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, potentially leading to a Reflected Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application, but it can have some minor impact on its confidentiality and integrity." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "cna@sap.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 6.1, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 2.7 + } + ] + }, + "weaknesses": [ + { + "source": "cna@sap.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-79" + } + ] + } + ], + "references": [ + { + "url": "https://me.sap.com/notes/3497347", + "source": "cna@sap.com" + }, + { + "url": "https://url.sap/sapsecuritypatchday", + "source": "cna@sap.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-423xx/CVE-2024-42380.json b/CVE-2024/CVE-2024-423xx/CVE-2024-42380.json new file mode 100644 index 00000000000..3c3c36fe5ca --- /dev/null +++ b/CVE-2024/CVE-2024-423xx/CVE-2024-42380.json @@ -0,0 +1,60 @@ +{ + "id": "CVE-2024-42380", + "sourceIdentifier": "cna@sap.com", + "published": "2024-09-10T03:15:02.653", + "lastModified": "2024-09-10T03:15:02.653", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "The RFC enabled function module allows a low privileged user to read any user's workplace favourites and user menu along with all the specific data of each node. Usernames can be enumerated by exploiting vulnerability. There is low impact on confidentiality of the application." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "cna@sap.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "baseScore": 4.3, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 1.4 + } + ] + }, + "weaknesses": [ + { + "source": "cna@sap.com", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-862" + } + ] + } + ], + "references": [ + { + "url": "https://me.sap.com/notes/3488039", + "source": "cna@sap.com" + }, + { + "url": "https://url.sap/sapsecuritypatchday", + "source": "cna@sap.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-441xx/CVE-2024-44113.json b/CVE-2024/CVE-2024-441xx/CVE-2024-44113.json new file mode 100644 index 00000000000..1e35b0b1683 --- /dev/null +++ b/CVE-2024/CVE-2024-441xx/CVE-2024-44113.json @@ -0,0 +1,60 @@ +{ + "id": "CVE-2024-44113", + "sourceIdentifier": "cna@sap.com", + "published": "2024-09-10T03:15:02.860", + "lastModified": "2024-09-10T03:15:02.860", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confidentiality of the application." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "cna@sap.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "baseScore": 4.3, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 1.4 + } + ] + }, + "weaknesses": [ + { + "source": "cna@sap.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-359" + } + ] + } + ], + "references": [ + { + "url": "https://me.sap.com/notes/3481992", + "source": "cna@sap.com" + }, + { + "url": "https://url.sap/sapsecuritypatchday", + "source": "cna@sap.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-441xx/CVE-2024-44114.json b/CVE-2024/CVE-2024-441xx/CVE-2024-44114.json new file mode 100644 index 00000000000..ae7e8003b74 --- /dev/null +++ b/CVE-2024/CVE-2024-441xx/CVE-2024-44114.json @@ -0,0 +1,60 @@ +{ + "id": "CVE-2024-44114", + "sourceIdentifier": "cna@sap.com", + "published": "2024-09-10T03:15:03.077", + "lastModified": "2024-09-10T03:15:03.077", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "SAP NetWeaver Application Server for ABAP and ABAP Platform allow users with high privileges to execute a program that reveals data over the network. This results in a minimal impact on confidentiality of the application." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "cna@sap.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "HIGH", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "baseScore": 2.0, + "baseSeverity": "LOW" + }, + "exploitabilityScore": 0.5, + "impactScore": 1.4 + } + ] + }, + "weaknesses": [ + { + "source": "cna@sap.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-863" + } + ] + } + ], + "references": [ + { + "url": "https://me.sap.com/notes/3507252", + "source": "cna@sap.com" + }, + { + "url": "https://url.sap/sapsecuritypatchday", + "source": "cna@sap.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-441xx/CVE-2024-44115.json b/CVE-2024/CVE-2024-441xx/CVE-2024-44115.json new file mode 100644 index 00000000000..8a6afe67cdc --- /dev/null +++ b/CVE-2024/CVE-2024-441xx/CVE-2024-44115.json @@ -0,0 +1,60 @@ +{ + "id": "CVE-2024-44115", + "sourceIdentifier": "cna@sap.com", + "published": "2024-09-10T03:15:03.293", + "lastModified": "2024-09-10T03:15:03.293", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "The RFC enabled function module allows a low privileged user to add URLs to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces, and nodes. There is low impact on integrity of the application" + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "cna@sap.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 4.3, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 1.4 + } + ] + }, + "weaknesses": [ + { + "source": "cna@sap.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-862" + } + ] + } + ], + "references": [ + { + "url": "https://me.sap.com/notes/3488039", + "source": "cna@sap.com" + }, + { + "url": "https://url.sap/sapsecuritypatchday", + "source": "cna@sap.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-441xx/CVE-2024-44116.json b/CVE-2024/CVE-2024-441xx/CVE-2024-44116.json new file mode 100644 index 00000000000..cb1099377d5 --- /dev/null +++ b/CVE-2024/CVE-2024-441xx/CVE-2024-44116.json @@ -0,0 +1,60 @@ +{ + "id": "CVE-2024-44116", + "sourceIdentifier": "cna@sap.com", + "published": "2024-09-10T03:15:03.490", + "lastModified": "2024-09-10T03:15:03.490", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "The RFC enabled function module allows a low privileged user to add any workbook to any user's workplace favourites. This vulnerability could be utilized to identify usernames and access information about targeted user's workplaces. There is low impact on integrity of the application." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "cna@sap.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 4.3, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 1.4 + } + ] + }, + "weaknesses": [ + { + "source": "cna@sap.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-862" + } + ] + } + ], + "references": [ + { + "url": "https://me.sap.com/notes/3488039", + "source": "cna@sap.com" + }, + { + "url": "https://url.sap/sapsecuritypatchday", + "source": "cna@sap.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-63xx/CVE-2024-6342.json b/CVE-2024/CVE-2024-63xx/CVE-2024-6342.json new file mode 100644 index 00000000000..78c6eaf21f7 --- /dev/null +++ b/CVE-2024/CVE-2024-63xx/CVE-2024-6342.json @@ -0,0 +1,63 @@ +{ + "id": "CVE-2024-6342", + "sourceIdentifier": "security@zyxel.com.tw", + "published": "2024-09-10T02:15:10.063", + "lastModified": "2024-09-10T02:15:10.063", + "vulnStatus": "Received", + "cveTags": [ + { + "sourceIdentifier": "security@zyxel.com.tw", + "tags": [ + "unsupported-when-assigned" + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 firmware versions through V5.21(ABAG.15)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security@zyxel.com.tw", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 9.8, + "baseSeverity": "CRITICAL" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.9 + } + ] + }, + "weaknesses": [ + { + "source": "security@zyxel.com.tw", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-78" + } + ] + } + ], + "references": [ + { + "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-os-command-injection-vulnerability-in-nas-products-09-10-2024", + "source": "security@zyxel.com.tw" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-82xx/CVE-2024-8268.json b/CVE-2024/CVE-2024-82xx/CVE-2024-8268.json new file mode 100644 index 00000000000..23c695fa4a5 --- /dev/null +++ b/CVE-2024/CVE-2024-82xx/CVE-2024-8268.json @@ -0,0 +1,64 @@ +{ + "id": "CVE-2024-8268", + "sourceIdentifier": "security@wordfence.com", + "published": "2024-09-10T03:15:03.690", + "lastModified": "2024-09-10T03:15:03.690", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "The Frontend Dashboard plugin for WordPress is vulnerable to unauthorized code execution due to insufficient filtering on callable methods/functions via the ajax_request() function in all versions up to, and including, 2.2.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to call arbitrary functions that can be leverage for privilege escalation by changing user's passwords." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security@wordfence.com", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 2.8, + "impactScore": 5.9 + } + ] + }, + "weaknesses": [ + { + "source": "security@wordfence.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-94" + } + ] + } + ], + "references": [ + { + "url": "https://plugins.trac.wordpress.org/browser/frontend-dashboard/tags/2.2.4/route/class-fed-request.php#L29", + "source": "security@wordfence.com" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset/3147868/frontend-dashboard/tags/2.2.5/route/class-fed-request.php?old=3048034&old_path=frontend-dashboard%2Ftags%2F2.2.4%2Froute%2Fclass-fed-request.php", + "source": "security@wordfence.com" + }, + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7d66694a-c99f-44f8-8004-1a47ad9f9250?source=cve", + "source": "security@wordfence.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-84xx/CVE-2024-8478.json b/CVE-2024/CVE-2024-84xx/CVE-2024-8478.json new file mode 100644 index 00000000000..4652bb245a7 --- /dev/null +++ b/CVE-2024/CVE-2024-84xx/CVE-2024-8478.json @@ -0,0 +1,64 @@ +{ + "id": "CVE-2024-8478", + "sourceIdentifier": "security@wordfence.com", + "published": "2024-09-10T03:15:03.903", + "lastModified": "2024-09-10T03:15:03.903", + "vulnStatus": "Received", + "cveTags": [], + "descriptions": [ + { + "lang": "en", + "value": "The The Affiliate Super Assistent plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.5.3. This is due to the software allowing users to supply arbitrary shortcodes in comments when the 'Parse comments' option is enabled. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security@wordfence.com", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "LOW", + "baseScore": 7.3, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 3.9, + "impactScore": 3.4 + } + ] + }, + "weaknesses": [ + { + "source": "security@wordfence.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-94" + } + ] + } + ], + "references": [ + { + "url": "https://plugins.trac.wordpress.org/browser/amazonsimpleadmin/trunk/AsaCore.php#L285", + "source": "security@wordfence.com" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3147740%40amazonsimpleadmin&new=3147740%40amazonsimpleadmin&sfp_email=&sfph_mail=", + "source": "security@wordfence.com" + }, + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7f50769c-77b8-42ff-b67d-b9b289fc51da?source=cve", + "source": "security@wordfence.com" + } + ] +} \ No newline at end of file diff --git a/README.md b/README.md index a9040d50de4..ef05723462a 100644 --- a/README.md +++ b/README.md @@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2024-09-10T02:00:18.134814+00:00 +2024-09-10T04:00:17.954746+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2024-09-10T01:00:01.537000+00:00 +2024-09-10T03:15:03.903000+00:00 ``` ### Last Data Feed Release @@ -33,22 +33,31 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/ ### Total Number of included CVEs ```plain -262246 +262258 ``` ### CVEs added in the last Commit -Recently added CVEs: `0` +Recently added CVEs: `12` +- [CVE-2024-38270](CVE-2024/CVE-2024-382xx/CVE-2024-38270.json) (`2024-09-10T02:15:09.780`) +- [CVE-2024-41729](CVE-2024/CVE-2024-417xx/CVE-2024-41729.json) (`2024-09-10T03:15:02.033`) +- [CVE-2024-42371](CVE-2024/CVE-2024-423xx/CVE-2024-42371.json) (`2024-09-10T03:15:02.240`) +- [CVE-2024-42378](CVE-2024/CVE-2024-423xx/CVE-2024-42378.json) (`2024-09-10T03:15:02.443`) +- [CVE-2024-42380](CVE-2024/CVE-2024-423xx/CVE-2024-42380.json) (`2024-09-10T03:15:02.653`) +- [CVE-2024-44113](CVE-2024/CVE-2024-441xx/CVE-2024-44113.json) (`2024-09-10T03:15:02.860`) +- [CVE-2024-44114](CVE-2024/CVE-2024-441xx/CVE-2024-44114.json) (`2024-09-10T03:15:03.077`) +- [CVE-2024-44115](CVE-2024/CVE-2024-441xx/CVE-2024-44115.json) (`2024-09-10T03:15:03.293`) +- [CVE-2024-44116](CVE-2024/CVE-2024-441xx/CVE-2024-44116.json) (`2024-09-10T03:15:03.490`) +- [CVE-2024-6342](CVE-2024/CVE-2024-63xx/CVE-2024-6342.json) (`2024-09-10T02:15:10.063`) +- [CVE-2024-8268](CVE-2024/CVE-2024-82xx/CVE-2024-8268.json) (`2024-09-10T03:15:03.690`) +- [CVE-2024-8478](CVE-2024/CVE-2024-84xx/CVE-2024-8478.json) (`2024-09-10T03:15:03.903`) ### CVEs modified in the last Commit -Recently modified CVEs: `3` +Recently modified CVEs: `0` -- [CVE-2016-3714](CVE-2016/CVE-2016-37xx/CVE-2016-3714.json) (`2024-09-10T01:00:01.537`) -- [CVE-2017-1000253](CVE-2017/CVE-2017-10002xx/CVE-2017-1000253.json) (`2024-09-10T01:00:01.537`) -- [CVE-2024-40766](CVE-2024/CVE-2024-407xx/CVE-2024-40766.json) (`2024-09-10T01:00:01.537`) ## Download and Usage diff --git a/_state.csv b/_state.csv index 714ed01ea89..90d4d946766 100644 --- a/_state.csv +++ b/_state.csv @@ -86975,7 +86975,7 @@ CVE-2016-3710,0,0,f9e59617883b323f95ff6f5a7a03da9d298f637e07e1bc0d7501f309b1a739 CVE-2016-3711,0,0,c83a67f72aa4c2861ef346c90cac54d305f88ed90f7be93aa656fb4e4c2c38f0,2023-02-12T23:19:22.177000 CVE-2016-3712,0,0,c7f8b4f08f7e1f6b1a1ea7bea5477b9261472b30b06cc0735ec9663f83a435d4,2023-02-12T23:19:25.750000 CVE-2016-3713,0,0,a0fd3a736659e40bc6953eb2ee96f88b830db73527d62c25a6b3e9fd4b3aae3c,2016-06-27T17:57:26.057000 -CVE-2016-3714,0,1,8593f55096b69ae82013c3e0cc8347ed77eb693221beec9ec253aed97dcf64f1,2024-09-10T01:00:01.537000 +CVE-2016-3714,0,0,8593f55096b69ae82013c3e0cc8347ed77eb693221beec9ec253aed97dcf64f1,2024-09-10T01:00:01.537000 CVE-2016-3715,0,0,41a429bb9cd4e58bec46c18da65f864fbf1003189981e9643c46c4b6d44f1441,2024-07-24T17:06:03.347000 CVE-2016-3716,0,0,2d621eca38580eb36b12da03d5052a9d202f297848297f9114ec53c77580c3f4,2023-02-12T23:20:02.797000 CVE-2016-3717,0,0,578985c683d019d0063f96d744b7323756592c56c56d5244a232b553f341441d,2023-02-12T23:20:04.043000 @@ -93922,7 +93922,7 @@ CVE-2017-1000249,0,0,3140698e470efa540827b2fcefa473861882638ae3d9d2c44ca64cf092a CVE-2017-1000250,0,0,21cccbdb024260a84237111cb83289e4c7e8c636b7b840bf370bab1c371ee906,2018-02-17T02:29:02.283000 CVE-2017-1000251,0,0,e83929b0cc760c5c9618969d4ee424f2ddfc5bd92a9caca156ec7f5d6fbb8de6,2023-01-19T15:53:39.780000 CVE-2017-1000252,0,0,9eea6472d04eeaf32df8b8fd22d143af69543d35d1254252d432260f2ebb8018,2019-10-03T00:03:26.223000 -CVE-2017-1000253,0,1,2f1242319b5967bfb66878e09e8a0b016ce261230b54f3b34cfb6c11fb47b274,2024-09-10T01:00:01.537000 +CVE-2017-1000253,0,0,2f1242319b5967bfb66878e09e8a0b016ce261230b54f3b34cfb6c11fb47b274,2024-09-10T01:00:01.537000 CVE-2017-1000254,0,0,2c437201d4072ed57e29421c399393b6fc19b110c7cd6c9df970aa004560ef63,2023-11-07T02:37:56.077000 CVE-2017-1000255,0,0,64c86fde651745d2a520f25af2dd721f03cb9d4867f5aedc3c0057d889738a48,2018-04-11T01:29:00.540000 CVE-2017-1000256,0,0,1ba938b667acbbdb5a5a82ad18f7e44094d40463d59112d0f41ca2b5aa05b499,2023-11-07T02:37:56.177000 @@ -255643,6 +255643,7 @@ CVE-2024-3824,0,0,e8430e8e74668eaaf1515aab02bbd50450b435f6ff0c9f12ee70566d9f9578 CVE-2024-3825,0,0,0797baa725c3e17399d5d91a8de7a7a1a558d256247589a07a334c4f415b4b15,2024-04-17T15:31:50.160000 CVE-2024-3826,0,0,121760e16d238bf81106004c4251c8d93e688e0e085277d4609f0e751627011d,2024-07-02T17:44:45.700000 CVE-2024-3827,0,0,fe9452c74994fbdb1f4a1edea576f588d513e300bcd491a382890605454b836b,2024-08-02T12:59:43.990000 +CVE-2024-38270,1,1,88494ff7e92eeb00b1d3cd2553698f6361d76d9fdef9b73186cd2b1c0321bbb8,2024-09-10T02:15:09.780000 CVE-2024-38271,0,0,a55d517f1e451a20db301f87d88d99f6d0173df1fa03dd913b12a59d024f897d,2024-07-29T22:15:04.757000 CVE-2024-38272,0,0,0d362d9df49b138200ab4f12d59df7df286d43127ca17e43b2d79b45065d1568,2024-07-29T22:15:04.883000 CVE-2024-38273,0,0,98139fcc5d27706ddcb6f85d322a9c3ffe167225916ac0c861ab393656c9d382,2024-06-27T03:15:50.130000 @@ -256994,7 +256995,7 @@ CVE-2024-4075,0,0,29d19ea935c989efa2e770180ba61eb06fe49f0b181d6d812a7498d3145b98 CVE-2024-40750,0,0,123c568c4a271c6bb023f9091df0f00fec1f937f3d0585148d7948581d7b9455,2024-07-11T13:06:13.187000 CVE-2024-4076,0,0,3600a7160ba6cb63d73da78d982aeb737757fd1783e0b44697873d9ae49c2d36,2024-08-01T13:59:24.073000 CVE-2024-40764,0,0,ab85577e2cb5d9a786ef6b191ba8264da7952ad06ab8f1b0e070c99f55710d56,2024-08-01T13:58:00.227000 -CVE-2024-40766,0,1,eff4b00cf0f55270aa38e0ff790e6ee6498c48000cd3eb1d26bf51c060a6a61b,2024-09-10T01:00:01.537000 +CVE-2024-40766,0,0,eff4b00cf0f55270aa38e0ff790e6ee6498c48000cd3eb1d26bf51c060a6a61b,2024-09-10T01:00:01.537000 CVE-2024-40767,0,0,0f0f227d49db4f76a18af060eeadd57ea0ca5da0ccc7bd26ef12905f9453740a,2024-07-30T19:19:40.767000 CVE-2024-4077,0,0,d4f08c4fa42913c8d00f3fecbe96233f1448e9383bf97ebcbeca4cc0f2c8ae2b,2024-04-25T13:18:02.660000 CVE-2024-40774,0,0,20f4c2f88088010929acd58158f18d58b2de8f6cd0c1c18a2a116c0b40766ad5,2024-08-20T15:16:40.210000 @@ -257571,6 +257572,7 @@ CVE-2024-41720,0,0,2d7bee1f981165f1c9cbab9643ce597269a916a15ed0d381724ec0dadf39a CVE-2024-41723,0,0,2fd6c172462641b542f047f7ff3bf2247bdc5b8b5f34ce988c43b2bfe1795c68,2024-08-20T19:26:24.033000 CVE-2024-41726,0,0,e325c72cd77b10fa79a0c73cd0bce9d67f9472d40dd3ab04f6437f9f2b06b815,2024-08-01T13:59:09.707000 CVE-2024-41727,0,0,f64de623c1f3cae418235db50af8da33c1315446224a7b8505bd8fc5343d1bad,2024-08-20T19:25:12.490000 +CVE-2024-41729,1,1,ac890e0f7f73249aca33143f86621c6e4fc49c322ed84484185656c9a23af937,2024-09-10T03:15:02.033000 CVE-2024-4173,0,0,47f39f3e8e603eac743ed4815cd724decf015716a2f0d9c17daf4d8fa3affc2d,2024-04-25T23:15:47.240000 CVE-2024-41730,0,0,c3a91737f2e086c1acf47dd27a2418a435b72c75c0ef95092d81c10a62890c2b,2024-08-13T12:58:25.437000 CVE-2024-41731,0,0,d5e6b6d25037e68a1f79c484f53ff7d64e1c1ae1a43b0c3615ae42e47ee6cc50,2024-08-13T12:58:25.437000 @@ -258040,13 +258042,16 @@ CVE-2024-42368,0,0,de4f48ab04f32dd7f3db383df19cc416867f89e8ecae60c2fdd0bef001ee0 CVE-2024-42369,0,0,2db0203d9e1c9ed86d7e5fe91c7527c5d07f66504aa58aae16d195697c2bea11,2024-08-21T16:01:03.147000 CVE-2024-4237,0,0,c38818d0c288b1eec57a9be9e655b05254cb3f3487787a1ecd91e69d9c20b38c,2024-05-17T02:40:19.580000 CVE-2024-42370,0,0,62e839a91edcd64bb21dabf32c60522dd52dc9540883662a6d8c03c0ecbecadd,2024-08-12T13:41:36.517000 +CVE-2024-42371,1,1,cd7ff869e93847fbb23784b57bfbf63bc575ad0ebff75f6b007cf865f374b683,2024-09-10T03:15:02.240000 CVE-2024-42373,0,0,295f57d389a740d58ca7f1197ba4847ae8998d712f5bf5435ce1e4024bfbdcde,2024-08-13T12:58:25.437000 CVE-2024-42374,0,0,fbac271476e1e2a5530eb62b051d58c9133aff05c9b2fa9d3a5620c40d2acb9c,2024-08-13T12:58:25.437000 CVE-2024-42375,0,0,e9725b5004889e50f9a6ac1c59e56febb5ad276cb9a721fc0c08aaaf3ebec84e,2024-08-13T12:58:25.437000 CVE-2024-42376,0,0,c4f07b2c8269cb92583efc852c36ba8aba70348295a5eb2d011adc15b060ded0,2024-08-13T12:58:25.437000 CVE-2024-42377,0,0,4524d9cd87be67a4dc2034064ca6271f613fad79df3daac39c5631e6926975fc,2024-08-13T12:58:25.437000 +CVE-2024-42378,1,1,75897fc94046d7ea6843a7213e3b0152685bd4850edda15bfa6dea4afdf49778,2024-09-10T03:15:02.443000 CVE-2024-42379,0,0,3df4e462d3527273fa2a98871af6d02d089a425040231b6521435b06449dcc55,2024-08-30T20:15:07.623000 CVE-2024-4238,0,0,188cceccdce16b8df034bef32fee010a6dd0f801c6690e1589421c7cadfb521c,2024-06-04T19:20:33.063000 +CVE-2024-42380,1,1,39822d2449019d03359db4654460d3e129092bfcfd74e542e36fc02ff5cd35fb,2024-09-10T03:15:02.653000 CVE-2024-42381,0,0,a5fa1277b5fe346d1dd5469d0c93ac780c7d0547ab1d06a7617c27606bb89aa8,2024-08-01T13:59:22.207000 CVE-2024-4239,0,0,cecc2be82896f12bf6cdae75a3b125d58c075d387f3da865cfaf565a2c454897,2024-06-04T19:20:33.163000 CVE-2024-42393,0,0,dccd6d06051b1376b790b00ce1bb00ad00ff605de076bb7cd98815c096883960,2024-08-12T18:22:45.023000 @@ -258854,6 +258859,10 @@ CVE-2024-44085,0,0,ecf5951d52699c6f64ad8e35ca78bb63c6655b58c6934de27f2c5efa7e11f CVE-2024-4409,0,0,ef601ae22761768812ec6eb133885b7a6b08c5417903a944100f49b603e1172f,2024-05-24T13:03:11.993000 CVE-2024-4410,0,0,ca43b98286a78ab63b5139b50b93fc074ee9aec4c16e78097aa3514c43622322,2024-07-29T14:12:08.783000 CVE-2024-4411,0,0,9d1b27ccac7555d95c6be5f4488ca4d9772a0570efc26fe6a3f3d131fd0aea06,2024-05-14T16:11:39.510000 +CVE-2024-44113,1,1,c73975ce842e7aaf37d793d57c0d8cb768c550c2e24f6ba52399c7b838ee35cc,2024-09-10T03:15:02.860000 +CVE-2024-44114,1,1,7485fa213d8873fa4e777bbb54e3495c1f5ad9a0ae89db9bd88a75db8757a502,2024-09-10T03:15:03.077000 +CVE-2024-44115,1,1,827c635267c78d3e9e654741102b0d5d2f37a36cc75857dc8bad6547bc921cc6,2024-09-10T03:15:03.293000 +CVE-2024-44116,1,1,794e07caec118d7a39c9bcbae777b16a09607cfb7442f9b33d60d62947c59443,2024-09-10T03:15:03.490000 CVE-2024-4413,0,0,63e6df043fde5eb9cf937a1f1c34414009dec10f116b4c7a5421dbd8a403038d,2024-05-14T16:11:39.510000 CVE-2024-4417,0,0,9b4dc22c7f1e74f381016fafb921403ecdaeb7b3b80aa5fc2130db180ef5935c,2024-05-14T16:11:39.510000 CVE-2024-4418,0,0,da6c1eb4513de715971e2c985312b5242ea57c97376ea448b71f18893daf3366,2024-07-23T22:15:09.183000 @@ -260830,6 +260839,7 @@ CVE-2024-6338,0,0,8956384d5cc966970e625ecbde4127bb4f84d940fa059b7aaed0155a833fd9 CVE-2024-6339,0,0,900c18b99c3b938f801abc6ad5fe5a877c8e068ea7f11186df65574c46246a21,2024-08-21T12:30:33.697000 CVE-2024-6340,0,0,fd12f25a45d92fefbb8c0ec47428250f4f56bb9c686a12a52e54d86e24fec10a,2024-07-03T18:27:40.903000 CVE-2024-6341,0,0,528f4fdde1526d72477e90a767b2f2316b168f65b64effeddb9446d8a5cdcaf5,2024-07-02T18:15:03.900000 +CVE-2024-6342,1,1,30a7277b1df834a061a853c2081b82e404845761ff8d9940e7349ca7a4b67145,2024-09-10T02:15:10.063000 CVE-2024-6343,0,0,38ac9303003845967860125853ac4494a8fe1ecd1fc8d7c1fa719ce9a13c5dc8,2024-09-05T14:35:34.780000 CVE-2024-6344,0,0,ddc89c494afe0b7b80a518e0bed96070c096d29b8a0f403bdd242f60ce193de2,2024-06-27T00:15:13.360000 CVE-2024-6345,0,0,fc166d5e44485020c9b016f580b4f1c78befbdae01a9e6ec8b7e6b8d01a2e1ea,2024-07-15T13:00:34.853000 @@ -262108,6 +262118,7 @@ CVE-2024-8250,0,0,9b93a65d8c7dcee06e07a2e2b390d716b51503d05b493ec48aa5a8756ae94b CVE-2024-8252,0,0,36e1aa114a02ff2bf925a636a4ed4135ae0e6011078bf9fd8b3aff586823c205,2024-09-03T14:31:27.243000 CVE-2024-8255,0,0,c6874ac38c80acc73ad7edcdfa1b6810f24be9f578842829800024511d128d5a,2024-09-06T22:53:34.187000 CVE-2024-8260,0,0,812d2a62f9a14f293d2814006504d857c705848c99804aae9066abfa5d1408ba,2024-09-03T12:59:02.453000 +CVE-2024-8268,1,1,19698d2ff5d82db2ae743a122534da67a187f2f6f912961a5504ef6cf90e8b6b,2024-09-10T03:15:03.690000 CVE-2024-8274,0,0,81f15088246893eaf3249a3304ee5d5199071263c8883a7f9f22c293a16a376a,2024-09-03T14:28:06.853000 CVE-2024-8276,0,0,33cf21b53b41316bc2e568f752afa4e96bbe73b4ee966f9832ffdb8137ffcc10,2024-09-03T12:59:02.453000 CVE-2024-8285,0,0,44d06284adb5d71c65e8f3277866d5d546f57dcd495152060c7216923cd6bd07,2024-09-03T12:59:02.453000 @@ -262203,6 +262214,7 @@ CVE-2024-8470,0,0,bea6b0b968688b42b5644ab4cec20c893536d252388507a633ee5ebbe07507 CVE-2024-8471,0,0,d4cac4daadf018326a13905f788e8fc27e503497a3cff6ab0ea980773a6f76cb,2024-09-06T11:44:22.510000 CVE-2024-8472,0,0,a896e0fd54ff62d16feed47be0f08dd27e23a8a4def269ca8073766b75918cef,2024-09-06T11:44:34.543000 CVE-2024-8473,0,0,0d318dfea88475fed5cabdbe761e188358c3ae35cd6d226ef3fe46f2f9041c00,2024-09-06T11:44:45.017000 +CVE-2024-8478,1,1,181986e299f6363b073613ea52b26c04918963aa2f232a1a7ef542f1a98c13f6,2024-09-10T03:15:03.903000 CVE-2024-8480,0,0,6f63c0c2b913be669f1e72f74bb0555ea9046fdf00f5eabae51a6bc6bb95358b,2024-09-06T12:08:04.550000 CVE-2024-8509,0,0,72b678ade46a23d1db65e1dfb65526568e7875d83752ef0a47b4a7edfeaf5ddf,2024-09-09T19:15:14.837000 CVE-2024-8517,0,0,3800f6b128aab40f688c971c9a9e47c0b6a42cbdd5c8d94b7cf3eaf620f48fad,2024-09-09T16:15:03.053000