Auto-Update: 2024-01-18T11:00:24.450741+00:00

CVE-2024/CVE-2024-05xx/CVE-2024-0580.json

@@ -0,0 +1,59 @@
+{
+  "id": "CVE-2024-0580",
+  "sourceIdentifier": "cve-coordination@incibe.es",
+  "published": "2024-01-18T09:15:07.960",
+  "lastModified": "2024-01-18T09:15:07.960",
+  "vulnStatus": "Received",
+  "descriptions": [
+    {
+      "lang": "en",
+      "value": "Omission of user-controlled key authorization in the IDMSistemas platform, affecting the QSige product. This vulnerability allows an attacker to extract sensitive information from the API by making a request to the parameter '/qsige.locator/quotePrevious/centers/X', where X supports values 1,2,3, etc."
+    },
+    {
+      "lang": "es",
+      "value": "Omisi\u00f3n de autorizaci\u00f3n de clave controlada por el usuario en la plataforma IDMSistemas, afectando el producto QSige. Esta vulnerabilidad permite a un atacante extraer informaci\u00f3n confidencial de la API realizando una solicitud al par\u00e1metro '/qsige.locator/quotePrevious/centers/X', donde X admite los valores 1,2,3, etc."
+    }
+  ],
+  "metrics": {
+    "cvssMetricV31": [
+      {
+        "source": "cve-coordination@incibe.es",
+        "type": "Secondary",
+        "cvssData": {
+          "version": "3.1",
+          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
+          "attackVector": "NETWORK",
+          "attackComplexity": "LOW",
+          "privilegesRequired": "NONE",
+          "userInteraction": "REQUIRED",
+          "scope": "UNCHANGED",
+          "confidentialityImpact": "HIGH",
+          "integrityImpact": "NONE",
+          "availabilityImpact": "NONE",
+          "baseScore": 6.5,
+          "baseSeverity": "MEDIUM"
+        },
+        "exploitabilityScore": 2.8,
+        "impactScore": 3.6
+      }
+    ]
+  },
+  "weaknesses": [
+    {
+      "source": "cve-coordination@incibe.es",
+      "type": "Primary",
+      "description": [
+        {
+          "lang": "en",
+          "value": "CWE-639"
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/omission-key-controlled-authorization-qsige",
+      "source": "cve-coordination@incibe.es"
+    }
+  ]
+}

README.md

@@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
 ### Last Repository Update
 
 ```plain
-2024-01-18T09:00:24.854835+00:00
+2024-01-18T11:00:24.450741+00:00
 ```
 
 ### Most recent CVE Modification Timestamp synchronized with NVD
 
 ```plain
-2024-01-18T08:15:40+00:00
+2024-01-18T09:15:07.960000+00:00
 ```
 
 ### Last Data Feed Release
@@ -29,16 +29,14 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
 ### Total Number of included CVEs
 
 ```plain
-236285
+236286
 ```
 
 ### CVEs added in the last Commit
 
-Recently added CVEs: `3`
+Recently added CVEs: `1`
 
-* [CVE-2023-6958](CVE-2023/CVE-2023-69xx/CVE-2023-6958.json) (`2024-01-18T08:15:39.493`)
-* [CVE-2023-6970](CVE-2023/CVE-2023-69xx/CVE-2023-6970.json) (`2024-01-18T08:15:39.780`)
-* [CVE-2024-0381](CVE-2024/CVE-2024-03xx/CVE-2024-0381.json) (`2024-01-18T08:15:40.000`)
+* [CVE-2024-0580](CVE-2024/CVE-2024-05xx/CVE-2024-0580.json) (`2024-01-18T09:15:07.960`)
 
 
 ### CVEs modified in the last Commit