Auto-Update: 2023-12-01T00:57:09.268935+00:00

This commit is contained in:
cad-safe-bot 2023-12-01 00:57:12 +00:00
parent 85a229fbe9
commit d917fa03c6
14 changed files with 356 additions and 42 deletions

View File

@ -0,0 +1,28 @@
{
"id": "CVE-2023-42916",
"sourceIdentifier": "product-security@apple.com",
"published": "2023-11-30T23:15:07.223",
"lastModified": "2023-11-30T23:15:07.223",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1."
}
],
"metrics": {},
"references": [
{
"url": "https://support.apple.com/en-us/HT214031",
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/en-us/HT214032",
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/en-us/HT214033",
"source": "product-security@apple.com"
}
]
}

View File

@ -0,0 +1,28 @@
{
"id": "CVE-2023-42917",
"sourceIdentifier": "product-security@apple.com",
"published": "2023-11-30T23:15:07.280",
"lastModified": "2023-11-30T23:15:07.280",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1."
}
],
"metrics": {},
"references": [
{
"url": "https://support.apple.com/en-us/HT214031",
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/en-us/HT214032",
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/en-us/HT214033",
"source": "product-security@apple.com"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2023-46326",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-11-30T23:15:07.330",
"lastModified": "2023-11-30T23:15:07.330",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the session ID for each of these. This leads to privilege escalation."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/zstackio/zstack/security/advisories/GHSA-w2rv-x3pp-h67q",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,24 @@
{
"id": "CVE-2023-46383",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-11-30T23:15:07.377",
"lastModified": "2023-11-30T23:15:07.377",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "LOYTEC electronics GmbH LINX Configurator 7.4.10 uses HTTP Basic Authentication, which transmits usernames and passwords in base64-encoded cleartext and allows remote attackers to steal the password and gain full control of Loytec device configuration."
}
],
"metrics": {},
"references": [
{
"url": "https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html",
"source": "cve@mitre.org"
},
{
"url": "https://seclists.org/fulldisclosure/2023/Nov/6",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,24 @@
{
"id": "CVE-2023-46384",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-11-30T23:15:07.423",
"lastModified": "2023-11-30T23:15:07.423",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "LOYTEC electronics GmbH LINX Configurator 7.4.10 is vulnerable to Insecure Permissions. Cleartext storage of credentials allows remote attackers to disclose admin password and bypass an authentication to login Loytec device."
}
],
"metrics": {},
"references": [
{
"url": "https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html",
"source": "cve@mitre.org"
},
{
"url": "https://seclists.org/fulldisclosure/2023/Nov/6",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,24 @@
{
"id": "CVE-2023-46385",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-11-30T23:15:07.473",
"lastModified": "2023-11-30T23:15:07.473",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "LOYTEC electronics GmbH LINX Configurator 7.4.10 is vulnerable to Insecure Permissions. An admin credential is passed as a value of URL parameters without encryption, so it allows remote attackers to steal the password and gain full control of Loytec device configuration."
}
],
"metrics": {},
"references": [
{
"url": "https://packetstormsecurity.com/files/175951/Loytec-LINX-Configurator-7.4.10-Insecure-Transit-Cleartext-Secrets.html",
"source": "cve@mitre.org"
},
{
"url": "https://seclists.org/fulldisclosure/2023/Nov/6",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,24 @@
{
"id": "CVE-2023-46386",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-11-30T23:15:07.520",
"lastModified": "2023-11-30T23:15:07.520",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "LOYTEC electronics GmbH LINX-212 firmware 6.2.4 and LINX-151 firmware 7.2.4 are vulnerable to Insecure Permissions via registry.xml file. This vulnerability allows remote attackers to disclose smtp client account credentials and bypass email authentication."
}
],
"metrics": {},
"references": [
{
"url": "http://packetstormsecurity.com/files/175952/Loytec-L-INX-Automation-Servers-Information-Disclosure-Cleartext-Secrets.html",
"source": "cve@mitre.org"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Nov/7",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,24 @@
{
"id": "CVE-2023-46387",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-11-30T23:15:07.567",
"lastModified": "2023-11-30T23:15:07.567",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "LOYTEC electronics GmbH LINX-212 firmware 6.2.4 and LINX-151 firmware 7.2.4 are vulnerable to Incorrect Access Control via dpal_config.zml file. This vulnerability allows remote attackers to disclose sensitive information on Loytec device data point configuration."
}
],
"metrics": {},
"references": [
{
"url": "http://packetstormsecurity.com/files/175952/Loytec-L-INX-Automation-Servers-Information-Disclosure-Cleartext-Secrets.html",
"source": "cve@mitre.org"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Nov/7",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,24 @@
{
"id": "CVE-2023-46388",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-11-30T23:15:07.613",
"lastModified": "2023-11-30T23:15:07.613",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "LOYTEC electronics GmbH LINX-212 6.2.4 and LINX-151 7.2.4 are vulnerable to Insecure Permissions via dpal_config.zml file. This vulnerability allows remote attackers to disclose smtp client account credentials and bypass email authentication."
}
],
"metrics": {},
"references": [
{
"url": "http://packetstormsecurity.com/files/175952/Loytec-L-INX-Automation-Servers-Information-Disclosure-Cleartext-Secrets.html",
"source": "cve@mitre.org"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Nov/7",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,24 @@
{
"id": "CVE-2023-46389",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-11-30T23:15:07.660",
"lastModified": "2023-11-30T23:15:07.660",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "LOYTEC electronics GmbH LINX-212 firmware 6.2.4 and LINX-151 Firmware 7.2.4 are vulnerable to Incorrect Access Control via registry.xml file. This vulnerability allows remote attackers to disclose sensitive information on LINX configuration."
}
],
"metrics": {},
"references": [
{
"url": "http://packetstormsecurity.com/files/175952/Loytec-L-INX-Automation-Servers-Information-Disclosure-Cleartext-Secrets.html",
"source": "cve@mitre.org"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Nov/7",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2023-46956",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-11-30T23:15:07.717",
"lastModified": "2023-11-30T23:15:07.717",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in Packers and Movers Management System v.1.0 allows a remote attacker to execute arbitrary code via crafted payload to the /mpms/admin/?page=user/manage_user&id file."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/geilihan/bug_reports/blob/main/packers-and-movers-management-system/SQL-1.md",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2023-47279",
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"published": "2023-11-30T23:15:07.770",
"lastModified": "2023-11-30T23:15:07.770",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In Delta Electronics InfraSuite Device Master v.1.0.7, A vulnerability exists that allows an unauthenticated attacker to disclose user information through a single UDP packet, obtain plaintext credentials, or perform NTLM relaying."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-35"
}
]
}
],
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-331-01",
"source": "ics-cert@hq.dhs.gov"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2023-47307",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-11-30T23:15:07.953",
"lastModified": "2023-11-30T23:15:07.953",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Buffer Overflow vulnerability in /apply.cgi in Shenzhen Libituo Technology Co., Ltd LBT-T300-T310 v2.2.2.6 allows attackers to cause a denial of service via the ApCliAuthMode parameter."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/forever-more-cjy/overflow/blob/main/LBT-T310%20Buffer%20overflow.md",
"source": "cve@mitre.org"
}
]
}

View File

@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2023-11-30T23:00:18.115925+00:00
2023-12-01T00:57:09.268935+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2023-11-30T22:15:10.163000+00:00
2023-11-30T23:15:07.953000+00:00
```
### Last Data Feed Release
@ -29,57 +29,32 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
231910
231923
```
### CVEs added in the last Commit
Recently added CVEs: `13`
* [CVE-2021-35975](CVE-2021/CVE-2021-359xx/CVE-2021-35975.json) (`2023-11-30T22:15:07.530`)
* [CVE-2023-47452](CVE-2023/CVE-2023-474xx/CVE-2023-47452.json) (`2023-11-30T21:15:08.800`)
* [CVE-2023-47453](CVE-2023/CVE-2023-474xx/CVE-2023-47453.json) (`2023-11-30T21:15:08.847`)
* [CVE-2023-47454](CVE-2023/CVE-2023-474xx/CVE-2023-47454.json) (`2023-11-30T21:15:08.893`)
* [CVE-2023-6440](CVE-2023/CVE-2023-64xx/CVE-2023-6440.json) (`2023-11-30T21:15:09.530`)
* [CVE-2023-6442](CVE-2023/CVE-2023-64xx/CVE-2023-6442.json) (`2023-11-30T21:15:09.763`)
* [CVE-2023-39226](CVE-2023/CVE-2023-392xx/CVE-2023-39226.json) (`2023-11-30T22:15:07.907`)
* [CVE-2023-46690](CVE-2023/CVE-2023-466xx/CVE-2023-46690.json) (`2023-11-30T22:15:08.313`)
* [CVE-2023-47207](CVE-2023/CVE-2023-472xx/CVE-2023-47207.json) (`2023-11-30T22:15:08.873`)
* [CVE-2023-48894](CVE-2023/CVE-2023-488xx/CVE-2023-48894.json) (`2023-11-30T22:15:09.077`)
* [CVE-2023-49735](CVE-2023/CVE-2023-497xx/CVE-2023-49735.json) (`2023-11-30T22:15:09.123`)
* [CVE-2023-5908](CVE-2023/CVE-2023-59xx/CVE-2023-5908.json) (`2023-11-30T22:15:09.923`)
* [CVE-2023-5909](CVE-2023/CVE-2023-59xx/CVE-2023-5909.json) (`2023-11-30T22:15:10.163`)
* [CVE-2023-42916](CVE-2023/CVE-2023-429xx/CVE-2023-42916.json) (`2023-11-30T23:15:07.223`)
* [CVE-2023-42917](CVE-2023/CVE-2023-429xx/CVE-2023-42917.json) (`2023-11-30T23:15:07.280`)
* [CVE-2023-46326](CVE-2023/CVE-2023-463xx/CVE-2023-46326.json) (`2023-11-30T23:15:07.330`)
* [CVE-2023-46383](CVE-2023/CVE-2023-463xx/CVE-2023-46383.json) (`2023-11-30T23:15:07.377`)
* [CVE-2023-46384](CVE-2023/CVE-2023-463xx/CVE-2023-46384.json) (`2023-11-30T23:15:07.423`)
* [CVE-2023-46385](CVE-2023/CVE-2023-463xx/CVE-2023-46385.json) (`2023-11-30T23:15:07.473`)
* [CVE-2023-46386](CVE-2023/CVE-2023-463xx/CVE-2023-46386.json) (`2023-11-30T23:15:07.520`)
* [CVE-2023-46387](CVE-2023/CVE-2023-463xx/CVE-2023-46387.json) (`2023-11-30T23:15:07.567`)
* [CVE-2023-46388](CVE-2023/CVE-2023-463xx/CVE-2023-46388.json) (`2023-11-30T23:15:07.613`)
* [CVE-2023-46389](CVE-2023/CVE-2023-463xx/CVE-2023-46389.json) (`2023-11-30T23:15:07.660`)
* [CVE-2023-46956](CVE-2023/CVE-2023-469xx/CVE-2023-46956.json) (`2023-11-30T23:15:07.717`)
* [CVE-2023-47279](CVE-2023/CVE-2023-472xx/CVE-2023-47279.json) (`2023-11-30T23:15:07.770`)
* [CVE-2023-47307](CVE-2023/CVE-2023-473xx/CVE-2023-47307.json) (`2023-11-30T23:15:07.953`)
### CVEs modified in the last Commit
Recently modified CVEs: `42`
Recently modified CVEs: `0`
* [CVE-2023-6375](CVE-2023/CVE-2023-63xx/CVE-2023-6375.json) (`2023-11-30T21:15:09.397`)
* [CVE-2023-6376](CVE-2023/CVE-2023-63xx/CVE-2023-6376.json) (`2023-11-30T21:15:09.463`)
* [CVE-2023-48107](CVE-2023/CVE-2023-481xx/CVE-2023-48107.json) (`2023-11-30T21:18:44.517`)
* [CVE-2023-49312](CVE-2023/CVE-2023-493xx/CVE-2023-49312.json) (`2023-11-30T21:30:33.500`)
* [CVE-2023-6309](CVE-2023/CVE-2023-63xx/CVE-2023-6309.json) (`2023-11-30T21:35:30.657`)
* [CVE-2023-35075](CVE-2023/CVE-2023-350xx/CVE-2023-35075.json) (`2023-11-30T21:40:10.447`)
* [CVE-2023-48952](CVE-2023/CVE-2023-489xx/CVE-2023-48952.json) (`2023-11-30T22:09:38.880`)
* [CVE-2023-48951](CVE-2023/CVE-2023-489xx/CVE-2023-48951.json) (`2023-11-30T22:09:47.687`)
* [CVE-2023-48950](CVE-2023/CVE-2023-489xx/CVE-2023-48950.json) (`2023-11-30T22:09:53.560`)
* [CVE-2023-48949](CVE-2023/CVE-2023-489xx/CVE-2023-48949.json) (`2023-11-30T22:10:26.553`)
* [CVE-2023-48948](CVE-2023/CVE-2023-489xx/CVE-2023-48948.json) (`2023-11-30T22:10:35.630`)
* [CVE-2023-48946](CVE-2023/CVE-2023-489xx/CVE-2023-48946.json) (`2023-11-30T22:10:42.030`)
* [CVE-2023-48947](CVE-2023/CVE-2023-489xx/CVE-2023-48947.json) (`2023-11-30T22:10:49.160`)
* [CVE-2023-31417](CVE-2023/CVE-2023-314xx/CVE-2023-31417.json) (`2023-11-30T22:15:07.717`)
* [CVE-2023-31418](CVE-2023/CVE-2023-314xx/CVE-2023-31418.json) (`2023-11-30T22:15:07.810`)
* [CVE-2023-3676](CVE-2023/CVE-2023-36xx/CVE-2023-3676.json) (`2023-11-30T22:15:08.147`)
* [CVE-2023-45853](CVE-2023/CVE-2023-458xx/CVE-2023-45853.json) (`2023-11-30T22:15:08.250`)
* [CVE-2023-46846](CVE-2023/CVE-2023-468xx/CVE-2023-46846.json) (`2023-11-30T22:15:08.547`)
* [CVE-2023-46847](CVE-2023/CVE-2023-468xx/CVE-2023-46847.json) (`2023-11-30T22:15:08.707`)
* [CVE-2023-4163](CVE-2023/CVE-2023-41xx/CVE-2023-4163.json) (`2023-11-30T22:15:09.203`)
* [CVE-2023-5367](CVE-2023/CVE-2023-53xx/CVE-2023-5367.json) (`2023-11-30T22:15:09.300`)
* [CVE-2023-5380](CVE-2023/CVE-2023-53xx/CVE-2023-5380.json) (`2023-11-30T22:15:09.483`)
* [CVE-2023-5574](CVE-2023/CVE-2023-55xx/CVE-2023-5574.json) (`2023-11-30T22:15:09.617`)
* [CVE-2023-5678](CVE-2023/CVE-2023-56xx/CVE-2023-5678.json) (`2023-11-30T22:15:09.723`)
* [CVE-2023-5824](CVE-2023/CVE-2023-58xx/CVE-2023-5824.json) (`2023-11-30T22:15:09.830`)
## Download and Usage