mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-08 19:47:09 +00:00
Auto-Update: 2023-09-18T20:00:24.900037+00:00
This commit is contained in:
parent
920314e21f
commit
cf10622891
@ -2,27 +2,91 @@
|
||||
"id": "CVE-2021-45811",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-09-08T02:15:07.877",
|
||||
"lastModified": "2023-09-08T12:58:39.247",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"lastModified": "2023-09-18T18:55:34.450",
|
||||
"vulnStatus": "Analyzed",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A SQL injection vulnerability in the \"Search\" functionality of \"tickets.php\" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the \"keywords\" and \"topic_id\" URL parameters combination."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 6.5,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-89"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:enhancesoft:osticket:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "1.15",
|
||||
"versionEndIncluding": "1.15.8",
|
||||
"matchCriteriaId": "763E683C-D2EC-4E03-9362-23CA5F34E9C6"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "http://enhancesoft.com",
|
||||
"source": "cve@mitre.org"
|
||||
"source": "cve@mitre.org",
|
||||
"tags": [
|
||||
"Product"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "http://osticket.com",
|
||||
"source": "cve@mitre.org"
|
||||
"source": "cve@mitre.org",
|
||||
"tags": [
|
||||
"Product"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://members.backbox.org/osticket-sql-injection/",
|
||||
"source": "cve@mitre.org"
|
||||
"source": "cve@mitre.org",
|
||||
"tags": [
|
||||
"Exploit",
|
||||
"Third Party Advisory"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
@ -2,15 +2,42 @@
|
||||
"id": "CVE-2023-4022",
|
||||
"sourceIdentifier": "contact@wpscan.com",
|
||||
"published": "2023-09-11T20:15:11.240",
|
||||
"lastModified": "2023-09-12T11:52:17.333",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"lastModified": "2023-09-18T18:56:14.823",
|
||||
"vulnStatus": "Analyzed",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Herd Effects WordPress plugin before 5.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)"
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "El complemento Herd Effects de WordPress anterior a 5.2.3 no sanitiza ni escapa a algunas de sus configuraciones, lo que podr\u00eda permitir a usuarios con privilegios elevados, como el administrador, realizar ataques de Stored Cross-Site Scripting incluso cuando la capacidad unfiltered_html no est\u00e1 permitida (por ejemplo, en una configuraci\u00f3n multisitio)."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.8,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.7,
|
||||
"impactScore": 2.7
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "contact@wpscan.com",
|
||||
@ -23,10 +50,32 @@
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:wow-company:herd_effects:*:*:*:*:*:wordpress:*:*",
|
||||
"versionEndExcluding": "5.2.3",
|
||||
"matchCriteriaId": "0E70A8B2-85B1-4BB1-BD6B-E90D807B2752"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://wpscan.com/vulnerability/c4ac0b19-58b1-4620-b3b7-fbe6dd6c8dd5",
|
||||
"source": "contact@wpscan.com"
|
||||
"source": "contact@wpscan.com",
|
||||
"tags": [
|
||||
"Exploit",
|
||||
"Third Party Advisory"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
@ -2,15 +2,42 @@
|
||||
"id": "CVE-2023-4060",
|
||||
"sourceIdentifier": "contact@wpscan.com",
|
||||
"published": "2023-09-11T20:15:11.483",
|
||||
"lastModified": "2023-09-12T11:52:17.333",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"lastModified": "2023-09-18T18:56:39.010",
|
||||
"vulnStatus": "Analyzed",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The WP Adminify WordPress plugin before 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)"
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "El complemento WP Adminify WordPress anterior a 3.1.6 no sanitiza ni escapa a algunas de sus configuraciones, lo que podr\u00eda permitir a usuarios con privilegios elevados, como el administrador, realizar ataques de Stored Cross-Site Scripting incluso cuando la capacidad unfiltered_html no est\u00e1 permitida (por ejemplo, en una configuraci\u00f3n multisitio)."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.8,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.7,
|
||||
"impactScore": 2.7
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "contact@wpscan.com",
|
||||
@ -23,10 +50,32 @@
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:wpadminify:wp_adminify:*:*:*:*:*:wordpress:*:*",
|
||||
"versionEndExcluding": "3.1.6",
|
||||
"matchCriteriaId": "036EBFF4-D3AC-41D9-8996-009D07B3FD55"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://wpscan.com/vulnerability/88745c9b-1c20-4004-89f6-d9ee223651f2",
|
||||
"source": "contact@wpscan.com"
|
||||
"source": "contact@wpscan.com",
|
||||
"tags": [
|
||||
"Exploit",
|
||||
"Third Party Advisory"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
55
CVE-2023/CVE-2023-410xx/CVE-2023-41030.json
Normal file
55
CVE-2023/CVE-2023-410xx/CVE-2023-41030.json
Normal file
@ -0,0 +1,55 @@
|
||||
{
|
||||
"id": "CVE-2023-41030",
|
||||
"sourceIdentifier": "disclosures@exodusintel.com",
|
||||
"published": "2023-09-18T19:15:43.060",
|
||||
"lastModified": "2023-09-18T19:15:43.060",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Hard-coded credentials in\u00a0Juplink RX4-1500 versions V1.0.2 through V1.0.5\u00a0allow unauthenticated attackers to log in to the web interface or telnet service as the 'user' user."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "disclosures@exodusintel.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 6.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 3.4
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "disclosures@exodusintel.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-259"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://blog.exodusintel.com/2023/09/18/juplink-rx4-1500-hard-coded-credential-vulnerability/",
|
||||
"source": "disclosures@exodusintel.com"
|
||||
}
|
||||
]
|
||||
}
|
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-41595",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-09-18T16:15:45.577",
|
||||
"lastModified": "2023-09-18T16:15:45.577",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2023-09-18T18:23:59.067",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
|
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-42320",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-09-18T16:15:45.797",
|
||||
"lastModified": "2023-09-18T16:15:45.797",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2023-09-18T18:23:59.067",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
|
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-42328",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-09-18T16:15:45.943",
|
||||
"lastModified": "2023-09-18T16:15:45.943",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2023-09-18T18:23:59.067",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
|
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-42371",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-09-18T15:15:46.870",
|
||||
"lastModified": "2023-09-18T15:15:46.870",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2023-09-18T18:23:59.067",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
|
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-42387",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-09-18T15:15:47.033",
|
||||
"lastModified": "2023-09-18T15:15:47.033",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2023-09-18T18:23:59.067",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
|
@ -2,31 +2,101 @@
|
||||
"id": "CVE-2023-42468",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-09-13T20:15:08.447",
|
||||
"lastModified": "2023-09-14T13:01:09.107",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"lastModified": "2023-09-18T18:36:35.480",
|
||||
"vulnStatus": "Analyzed",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application (without any permissions) can craft an intent targeting com.cutestudio.dialer.activities.DialerActivity via the android.intent.action.CALL action in conjunction with a tel: URI, thereby placing a phone call."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "La aplicaci\u00f3n com.cutestudio.colordialer hasta la versi\u00f3n 2.1.8-2 para Android permite a un atacante remoto iniciar llamadas telef\u00f3nicas sin el consentimiento del usuario, debido a una exportaci\u00f3n inadecuada del componente com.cutestudio.dialer.activities.DialerActivity. Una aplicaci\u00f3n de terceros (sin ning\u00fan permiso) puede crear una intenci\u00f3n dirigida a com.cutestudio.dialer.activities.DialerActivity a trav\u00e9s de la acci\u00f3n android.intent.action.CALL junto con un tel: URI, realizando as\u00ed una llamada telef\u00f3nica."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 1.4
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NVD-CWE-noinfo"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:azmobileapps:color_phone:*:*:*:*:*:android:*:*",
|
||||
"versionEndIncluding": "2.1.8-2",
|
||||
"matchCriteriaId": "6057B143-FE63-4997-BFD3-D3D720954DA0"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/actuator/com.cutestudio.colordialer/blob/main/CWE-284.md",
|
||||
"source": "cve@mitre.org"
|
||||
"source": "cve@mitre.org",
|
||||
"tags": [
|
||||
"Exploit",
|
||||
"Third Party Advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/actuator/com.cutestudio.colordialer/blob/main/dial.gif",
|
||||
"source": "cve@mitre.org"
|
||||
"source": "cve@mitre.org",
|
||||
"tags": [
|
||||
"Exploit"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/actuator/com.cutestudio.colordialer/blob/main/dialerPOC.apk",
|
||||
"source": "cve@mitre.org"
|
||||
"source": "cve@mitre.org",
|
||||
"tags": [
|
||||
"Exploit"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/actuator/cve/blob/main/CVE-2023-42468",
|
||||
"source": "cve@mitre.org"
|
||||
"source": "cve@mitre.org",
|
||||
"tags": [
|
||||
"Third Party Advisory"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
@ -2,15 +2,42 @@
|
||||
"id": "CVE-2023-4270",
|
||||
"sourceIdentifier": "contact@wpscan.com",
|
||||
"published": "2023-09-11T20:15:11.593",
|
||||
"lastModified": "2023-09-12T11:52:17.333",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"lastModified": "2023-09-18T18:57:26.613",
|
||||
"vulnStatus": "Analyzed",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Min Max Control WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "El complemento de WordPress Min Max Control anterior a 4.6 no sanitiza ni escapa un par\u00e1metro antes de devolverlo a la p\u00e1gina, conduciendo a un Cross-Site Scripting Reflejado que podr\u00eda usarse contra usuarios con altos privilegios, como el administrador."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 6.1,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 2.7
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "contact@wpscan.com",
|
||||
@ -23,10 +50,32 @@
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:codeastrology:min_max_control:*:*:*:*:*:wordpress:*:*",
|
||||
"versionEndExcluding": "4.6",
|
||||
"matchCriteriaId": "6C8DB610-EFD8-4833-BE56-04707A26D42F"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://wpscan.com/vulnerability/04560bf1-676b-46fb-9344-4150862f2686",
|
||||
"source": "contact@wpscan.com"
|
||||
"source": "contact@wpscan.com",
|
||||
"tags": [
|
||||
"Exploit",
|
||||
"Third Party Advisory"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
@ -2,15 +2,42 @@
|
||||
"id": "CVE-2023-4318",
|
||||
"sourceIdentifier": "contact@wpscan.com",
|
||||
"published": "2023-09-11T20:15:12.463",
|
||||
"lastModified": "2023-09-12T11:52:17.333",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"lastModified": "2023-09-18T19:00:04.477",
|
||||
"vulnStatus": "Analyzed",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Herd Effects WordPress plugin before 5.2.4 does not have CSRF when deleting its items, which could allow attackers to make logged in admins delete arbitrary effects via a CSRF attack"
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "El complemento Herd Effects de WordPress anterior a 5.2.4 no tiene CSRF al eliminar sus elementos, lo que podr\u00eda permitir a los atacantes hacer que los administradores registrados eliminen efectos arbitrarios mediante un ataque CSRF"
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 1.4
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "contact@wpscan.com",
|
||||
@ -23,10 +50,32 @@
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:wow-company:herd_effects:*:*:*:*:*:wordpress:*:*",
|
||||
"versionEndExcluding": "5.2.4",
|
||||
"matchCriteriaId": "635D9866-DBCA-4AB2-A5E5-7AFD121EF3B4"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://wpscan.com/vulnerability/93b40030-3706-4063-bf59-4ec983afdbb6",
|
||||
"source": "contact@wpscan.com"
|
||||
"source": "contact@wpscan.com",
|
||||
"tags": [
|
||||
"Exploit",
|
||||
"Third Party Advisory"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-4527",
|
||||
"sourceIdentifier": "secalert@redhat.com",
|
||||
"published": "2023-09-18T17:15:55.067",
|
||||
"lastModified": "2023-09-18T17:15:55.067",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2023-09-18T18:23:59.067",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
|
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-4806",
|
||||
"sourceIdentifier": "secalert@redhat.com",
|
||||
"published": "2023-09-18T17:15:55.813",
|
||||
"lastModified": "2023-09-18T17:15:55.813",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2023-09-18T18:23:59.067",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
|
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-4879",
|
||||
"sourceIdentifier": "security@huntr.dev",
|
||||
"published": "2023-09-10T18:15:08.003",
|
||||
"lastModified": "2023-09-10T19:45:57.130",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"lastModified": "2023-09-18T18:58:43.767",
|
||||
"vulnStatus": "Analyzed",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
@ -11,6 +11,28 @@
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.8,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.7,
|
||||
"impactScore": 2.7
|
||||
}
|
||||
],
|
||||
"cvssMetricV30": [
|
||||
{
|
||||
"source": "security@huntr.dev",
|
||||
@ -46,14 +68,41 @@
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:instantcms:instantcms:*:*:*:*:*:*:*:*",
|
||||
"versionEndExcluding": "2.16.1",
|
||||
"matchCriteriaId": "56EF3F9B-6CDB-4568-AF80-EEF6D72B72F6"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/instantsoft/icms2/commit/d0aeeaf5979fbdbf80dc3a3227d6c58442ab7487",
|
||||
"source": "security@huntr.dev"
|
||||
"source": "security@huntr.dev",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://huntr.dev/bounties/7df6b167-3c39-4563-9b8a-33613e25cf27",
|
||||
"source": "security@huntr.dev"
|
||||
"source": "security@huntr.dev",
|
||||
"tags": [
|
||||
"Exploit",
|
||||
"Issue Tracking",
|
||||
"Patch",
|
||||
"Third Party Advisory"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
38
README.md
38
README.md
@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
|
||||
### Last Repository Update
|
||||
|
||||
```plain
|
||||
2023-09-18T18:00:24.997265+00:00
|
||||
2023-09-18T20:00:24.900037+00:00
|
||||
```
|
||||
|
||||
### Most recent CVE Modification Timestamp synchronized with NVD
|
||||
|
||||
```plain
|
||||
2023-09-18T17:57:01.887000+00:00
|
||||
2023-09-18T19:15:43.060000+00:00
|
||||
```
|
||||
|
||||
### Last Data Feed Release
|
||||
@ -29,32 +29,34 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
|
||||
### Total Number of included CVEs
|
||||
|
||||
```plain
|
||||
225766
|
||||
225767
|
||||
```
|
||||
|
||||
### CVEs added in the last Commit
|
||||
|
||||
Recently added CVEs: `5`
|
||||
Recently added CVEs: `1`
|
||||
|
||||
* [CVE-2023-41595](CVE-2023/CVE-2023-415xx/CVE-2023-41595.json) (`2023-09-18T16:15:45.577`)
|
||||
* [CVE-2023-42320](CVE-2023/CVE-2023-423xx/CVE-2023-42320.json) (`2023-09-18T16:15:45.797`)
|
||||
* [CVE-2023-42328](CVE-2023/CVE-2023-423xx/CVE-2023-42328.json) (`2023-09-18T16:15:45.943`)
|
||||
* [CVE-2023-4527](CVE-2023/CVE-2023-45xx/CVE-2023-4527.json) (`2023-09-18T17:15:55.067`)
|
||||
* [CVE-2023-4806](CVE-2023/CVE-2023-48xx/CVE-2023-4806.json) (`2023-09-18T17:15:55.813`)
|
||||
* [CVE-2023-41030](CVE-2023/CVE-2023-410xx/CVE-2023-41030.json) (`2023-09-18T19:15:43.060`)
|
||||
|
||||
|
||||
### CVEs modified in the last Commit
|
||||
|
||||
Recently modified CVEs: `8`
|
||||
Recently modified CVEs: `14`
|
||||
|
||||
* [CVE-2016-4992](CVE-2016/CVE-2016-49xx/CVE-2016-4992.json) (`2023-09-18T16:15:43.090`)
|
||||
* [CVE-2021-44226](CVE-2021/CVE-2021-442xx/CVE-2021-44226.json) (`2023-09-18T16:15:44.463`)
|
||||
* [CVE-2022-47631](CVE-2022/CVE-2022-476xx/CVE-2022-47631.json) (`2023-09-18T16:15:44.813`)
|
||||
* [CVE-2022-47632](CVE-2022/CVE-2022-476xx/CVE-2022-47632.json) (`2023-09-18T16:15:44.993`)
|
||||
* [CVE-2023-32560](CVE-2023/CVE-2023-325xx/CVE-2023-32560.json) (`2023-09-18T16:15:45.240`)
|
||||
* [CVE-2023-4296](CVE-2023/CVE-2023-42xx/CVE-2023-4296.json) (`2023-09-18T16:15:46.143`)
|
||||
* [CVE-2023-4863](CVE-2023/CVE-2023-48xx/CVE-2023-4863.json) (`2023-09-18T17:48:44.777`)
|
||||
* [CVE-2023-20588](CVE-2023/CVE-2023-205xx/CVE-2023-20588.json) (`2023-09-18T17:57:01.887`)
|
||||
* [CVE-2021-45811](CVE-2021/CVE-2021-458xx/CVE-2021-45811.json) (`2023-09-18T18:55:34.450`)
|
||||
* [CVE-2023-42371](CVE-2023/CVE-2023-423xx/CVE-2023-42371.json) (`2023-09-18T18:23:59.067`)
|
||||
* [CVE-2023-42387](CVE-2023/CVE-2023-423xx/CVE-2023-42387.json) (`2023-09-18T18:23:59.067`)
|
||||
* [CVE-2023-41595](CVE-2023/CVE-2023-415xx/CVE-2023-41595.json) (`2023-09-18T18:23:59.067`)
|
||||
* [CVE-2023-42320](CVE-2023/CVE-2023-423xx/CVE-2023-42320.json) (`2023-09-18T18:23:59.067`)
|
||||
* [CVE-2023-42328](CVE-2023/CVE-2023-423xx/CVE-2023-42328.json) (`2023-09-18T18:23:59.067`)
|
||||
* [CVE-2023-4527](CVE-2023/CVE-2023-45xx/CVE-2023-4527.json) (`2023-09-18T18:23:59.067`)
|
||||
* [CVE-2023-4806](CVE-2023/CVE-2023-48xx/CVE-2023-4806.json) (`2023-09-18T18:23:59.067`)
|
||||
* [CVE-2023-42468](CVE-2023/CVE-2023-424xx/CVE-2023-42468.json) (`2023-09-18T18:36:35.480`)
|
||||
* [CVE-2023-4022](CVE-2023/CVE-2023-40xx/CVE-2023-4022.json) (`2023-09-18T18:56:14.823`)
|
||||
* [CVE-2023-4060](CVE-2023/CVE-2023-40xx/CVE-2023-4060.json) (`2023-09-18T18:56:39.010`)
|
||||
* [CVE-2023-4270](CVE-2023/CVE-2023-42xx/CVE-2023-4270.json) (`2023-09-18T18:57:26.613`)
|
||||
* [CVE-2023-4879](CVE-2023/CVE-2023-48xx/CVE-2023-4879.json) (`2023-09-18T18:58:43.767`)
|
||||
* [CVE-2023-4318](CVE-2023/CVE-2023-43xx/CVE-2023-4318.json) (`2023-09-18T19:00:04.477`)
|
||||
|
||||
|
||||
## Download and Usage
|
||||
|
Loading…
x
Reference in New Issue
Block a user