Auto-Update: 2024-02-29T09:00:28.133069+00:00

This commit is contained in:
cad-safe-bot 2024-02-29 09:00:31 +00:00
parent a8e70454f5
commit de1d34886e
14 changed files with 504 additions and 36 deletions

View File

@ -2,12 +2,16 @@
"id": "CVE-2024-1885",
"sourceIdentifier": "product.security@lge.com",
"published": "2024-02-26T16:27:54.720",
"lastModified": "2024-02-26T16:32:25.577",
"lastModified": "2024-02-29T07:15:06.293",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage TV.\n"
"value": "This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage.\n"
},
{
"lang": "es",
"value": "Esta vulnerabilidad permite a atacantes remotos ejecutar c\u00f3digo arbitrario en el webOS afectado de LG Signage TV."
}
],
"metrics": {

View File

@ -2,12 +2,16 @@
"id": "CVE-2024-1886",
"sourceIdentifier": "product.security@lge.com",
"published": "2024-02-26T16:27:54.937",
"lastModified": "2024-02-26T16:32:25.577",
"lastModified": "2024-02-29T07:15:06.520",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "\n\n\nThis vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage TV.\n\n\n\n"
"value": "\n\n\nThis vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage.\n\n\n\n"
},
{
"lang": "es",
"value": "Esta vulnerabilidad permite a atacantes remotos atravesar el directorio en el webOS afectado de LG Signage TV."
}
],
"metrics": {

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2024-1887",
"sourceIdentifier": "responsibledisclosure@mattermost.com",
"published": "2024-02-29T08:15:46.437",
"lastModified": "2024-02-29T08:15:46.437",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Mattermost fails to check if compliance export is enabled when fetching posts of public channels allowing a user that is not a member of the public channel to fetch the posts, which will not be audited in the compliance export.\u00a0\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "responsibledisclosure@mattermost.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "responsibledisclosure@mattermost.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"references": [
{
"url": "https://mattermost.com/security-updates",
"source": "responsibledisclosure@mattermost.com"
}
]
}

View File

@ -0,0 +1,51 @@
{
"id": "CVE-2024-1978",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-02-29T07:15:06.603",
"lastModified": "2024-02-29T07:15:06.603",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Friends plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.5 via the discover_available_feeds function. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7
}
]
},
"references": [
{
"url": "https://github.com/akirk/friends/pull/290",
"source": "security@wordfence.com"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3036987%40friends&new=3036987%40friends&sfp_email=&sfph_mail=",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72e1fbce-86ae-4518-a613-7c322193acf4?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,51 @@
{
"id": "CVE-2024-1981",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-02-29T07:15:06.930",
"lastModified": "2024-02-29T07:15:06.930",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Migration, Backup, Staging \u2013 WPvivid plugin for WordPress is vulnerable to SQL Injection via the 'table_prefix' parameter in version 0.9.68 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fwpvivid-backuprestore%2Ftrunk&old=2667839&new_path=%2Fwpvivid-backuprestore%2Ftrunk&new=2667839",
"source": "security@wordfence.com"
},
{
"url": "https://research.hisolutions.com/2024/01/multiple-vulnerabilities-in-wordpress-plugin-wpvivid-backup-and-migration/",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ef8bfb38-4f20-4f9f-bb30-a88f3be2d2d3?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -0,0 +1,51 @@
{
"id": "CVE-2024-1982",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-02-29T07:15:07.197",
"lastModified": "2024-02-29T07:15:07.197",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Migration, Backup, Staging \u2013 WPvivid plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the get_restore_progress() and restore() functions in all versions up to, and including, 0.9.68. This makes it possible for unauthenticated attackers to exploit a SQL injection vulnerability or trigger a DoS."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 3.9,
"impactScore": 2.5
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fwpvivid-backuprestore%2Ftrunk&old=2667839&new_path=%2Fwpvivid-backuprestore%2Ftrunk&new=2667839",
"source": "security@wordfence.com"
},
{
"url": "https://research.hisolutions.com/2024/01/multiple-vulnerabilities-in-wordpress-plugin-wpvivid-backup-and-migration/",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4f17976e-d6b9-40fb-b2fb-d60bcfd68d12?source=cve",
"source": "security@wordfence.com"
}
]
}

View File

@ -2,8 +2,8 @@
"id": "CVE-2024-23222",
"sourceIdentifier": "product-security@apple.com",
"published": "2024-01-23T01:15:11.500",
"lastModified": "2024-02-26T18:25:58.083",
"vulnStatus": "Analyzed",
"lastModified": "2024-02-29T08:15:46.907",
"vulnStatus": "Modified",
"cisaExploitAdd": "2024-01-23",
"cisaActionDue": "2024-02-13",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
@ -197,6 +197,10 @@
"Release Notes",
"Vendor Advisory"
]
},
{
"url": "https://support.apple.com/kb/HT214070",
"source": "product-security@apple.com"
}
]
}

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2024-23488",
"sourceIdentifier": "responsibledisclosure@mattermost.com",
"published": "2024-02-29T08:15:47.110",
"lastModified": "2024-02-29T08:15:47.110",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Mattermost fails to properly restrict the access of files attached to posts in an archived channel, resulting in members being able to access files of archived channels even if the \u201cAllow users to view archived channels\u201d option is disabled.\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "responsibledisclosure@mattermost.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW"
},
"exploitabilityScore": 1.6,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "responsibledisclosure@mattermost.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"references": [
{
"url": "https://mattermost.com/security-updates",
"source": "responsibledisclosure@mattermost.com"
}
]
}

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2024-23493",
"sourceIdentifier": "responsibledisclosure@mattermost.com",
"published": "2024-02-29T08:15:47.380",
"lastModified": "2024-02-29T08:15:47.380",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Mattermost fails to properly authorize the requests fetching\u00a0team associated AD/LDAP groups, allowing a user to fetch details of\u00a0AD/LDAP groups of a team that they are not a member of.\u00a0\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "responsibledisclosure@mattermost.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "responsibledisclosure@mattermost.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"references": [
{
"url": "https://mattermost.com/security-updates",
"source": "responsibledisclosure@mattermost.com"
}
]
}

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2024-24988",
"sourceIdentifier": "responsibledisclosure@mattermost.com",
"published": "2024-02-29T08:15:47.640",
"lastModified": "2024-02-29T08:15:47.640",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Mattermost fails to properly validate the length of the emoji value in the custom user status, allowing an attacker to send\u00a0multiple times a very long string as an emoji value causing high resource consumption and possibly crashing the server.\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "responsibledisclosure@mattermost.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "responsibledisclosure@mattermost.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-400"
}
]
}
],
"references": [
{
"url": "https://mattermost.com/security-updates",
"source": "responsibledisclosure@mattermost.com"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-25291",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-02-29T07:15:07.453",
"lastModified": "2024-02-29T07:15:07.453",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Deskfiler v1.2.3 allows attackers to execute arbitrary code via uploading a crafted plugin."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/ji-zzang/EQST-PoC/tree/main/2024/RCE/CVE-2024-25291",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-25292",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-02-29T07:15:07.513",
"lastModified": "2024-02-29T07:15:07.513",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in RenderTune v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Upload Title parameter."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/ji-zzang/EQST-PoC/tree/main/2024/RCE/CVE-2024-25292",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,55 @@
{
"id": "CVE-2024-25594",
"sourceIdentifier": "audit@patchstack.com",
"published": "2024-02-29T07:15:07.587",
"lastModified": "2024-02-29T07:15:07.587",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Savvy Wordpress Development MyWaze allows Stored XSS.This issue affects MyWaze: from n/a through 1.6.\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "audit@patchstack.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.3,
"impactScore": 3.7
}
]
},
"weaknesses": [
{
"source": "audit@patchstack.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://patchstack.com/database/vulnerability/my-waze/wordpress-mywaze-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve",
"source": "audit@patchstack.com"
}
]
}

View File

@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2024-02-29T07:00:25.895772+00:00
2024-02-29T09:00:28.133069+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2024-02-29T06:15:47.827000+00:00
2024-02-29T08:15:47.640000+00:00
```
### Last Data Feed Release
@ -29,44 +29,32 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
240098
240108
```
### CVEs added in the last Commit
Recently added CVEs: `31`
Recently added CVEs: `10`
* [CVE-2023-47874](CVE-2023/CVE-2023-478xx/CVE-2023-47874.json) (`2024-02-29T06:15:45.390`)
* [CVE-2023-50905](CVE-2023/CVE-2023-509xx/CVE-2023-50905.json) (`2024-02-29T06:15:45.577`)
* [CVE-2023-52475](CVE-2023/CVE-2023-524xx/CVE-2023-52475.json) (`2024-02-29T06:15:45.763`)
* [CVE-2023-52476](CVE-2023/CVE-2023-524xx/CVE-2023-52476.json) (`2024-02-29T06:15:45.820`)
* [CVE-2023-52477](CVE-2023/CVE-2023-524xx/CVE-2023-52477.json) (`2024-02-29T06:15:45.870`)
* [CVE-2023-52478](CVE-2023/CVE-2023-524xx/CVE-2023-52478.json) (`2024-02-29T06:15:45.920`)
* [CVE-2023-52479](CVE-2023/CVE-2023-524xx/CVE-2023-52479.json) (`2024-02-29T06:15:45.973`)
* [CVE-2023-52480](CVE-2023/CVE-2023-524xx/CVE-2023-52480.json) (`2024-02-29T06:15:46.017`)
* [CVE-2023-52481](CVE-2023/CVE-2023-524xx/CVE-2023-52481.json) (`2024-02-29T06:15:46.060`)
* [CVE-2023-52482](CVE-2023/CVE-2023-524xx/CVE-2023-52482.json) (`2024-02-29T06:15:46.103`)
* [CVE-2023-52483](CVE-2023/CVE-2023-524xx/CVE-2023-52483.json) (`2024-02-29T06:15:46.147`)
* [CVE-2023-52484](CVE-2023/CVE-2023-524xx/CVE-2023-52484.json) (`2024-02-29T06:15:46.190`)
* [CVE-2023-6090](CVE-2023/CVE-2023-60xx/CVE-2023-6090.json) (`2024-02-29T06:15:46.237`)
* [CVE-2024-1341](CVE-2024/CVE-2024-13xx/CVE-2024-1341.json) (`2024-02-29T05:15:09.760`)
* [CVE-2024-1435](CVE-2024/CVE-2024-14xx/CVE-2024-1435.json) (`2024-02-29T05:15:09.960`)
* [CVE-2024-1434](CVE-2024/CVE-2024-14xx/CVE-2024-1434.json) (`2024-02-29T06:15:46.417`)
* [CVE-2024-1437](CVE-2024/CVE-2024-14xx/CVE-2024-1437.json) (`2024-02-29T06:15:46.593`)
* [CVE-2024-1976](CVE-2024/CVE-2024-19xx/CVE-2024-1976.json) (`2024-02-29T06:15:46.767`)
* [CVE-2024-1977](CVE-2024/CVE-2024-19xx/CVE-2024-1977.json) (`2024-02-29T06:15:46.917`)
* [CVE-2024-21752](CVE-2024/CVE-2024-217xx/CVE-2024-21752.json) (`2024-02-29T06:15:47.067`)
* [CVE-2024-23501](CVE-2024/CVE-2024-235xx/CVE-2024-23501.json) (`2024-02-29T06:15:47.250`)
* [CVE-2024-24525](CVE-2024/CVE-2024-245xx/CVE-2024-24525.json) (`2024-02-29T06:15:47.427`)
* [CVE-2024-25093](CVE-2024/CVE-2024-250xx/CVE-2024-25093.json) (`2024-02-29T06:15:47.470`)
* [CVE-2024-25094](CVE-2024/CVE-2024-250xx/CVE-2024-25094.json) (`2024-02-29T06:15:47.653`)
* [CVE-2024-25098](CVE-2024/CVE-2024-250xx/CVE-2024-25098.json) (`2024-02-29T06:15:47.827`)
* [CVE-2024-1978](CVE-2024/CVE-2024-19xx/CVE-2024-1978.json) (`2024-02-29T07:15:06.603`)
* [CVE-2024-1981](CVE-2024/CVE-2024-19xx/CVE-2024-1981.json) (`2024-02-29T07:15:06.930`)
* [CVE-2024-1982](CVE-2024/CVE-2024-19xx/CVE-2024-1982.json) (`2024-02-29T07:15:07.197`)
* [CVE-2024-25291](CVE-2024/CVE-2024-252xx/CVE-2024-25291.json) (`2024-02-29T07:15:07.453`)
* [CVE-2024-25292](CVE-2024/CVE-2024-252xx/CVE-2024-25292.json) (`2024-02-29T07:15:07.513`)
* [CVE-2024-25594](CVE-2024/CVE-2024-255xx/CVE-2024-25594.json) (`2024-02-29T07:15:07.587`)
* [CVE-2024-1887](CVE-2024/CVE-2024-18xx/CVE-2024-1887.json) (`2024-02-29T08:15:46.437`)
* [CVE-2024-23488](CVE-2024/CVE-2024-234xx/CVE-2024-23488.json) (`2024-02-29T08:15:47.110`)
* [CVE-2024-23493](CVE-2024/CVE-2024-234xx/CVE-2024-23493.json) (`2024-02-29T08:15:47.380`)
* [CVE-2024-24988](CVE-2024/CVE-2024-249xx/CVE-2024-24988.json) (`2024-02-29T08:15:47.640`)
### CVEs modified in the last Commit
Recently modified CVEs: `0`
Recently modified CVEs: `3`
* [CVE-2024-1885](CVE-2024/CVE-2024-18xx/CVE-2024-1885.json) (`2024-02-29T07:15:06.293`)
* [CVE-2024-1886](CVE-2024/CVE-2024-18xx/CVE-2024-1886.json) (`2024-02-29T07:15:06.520`)
* [CVE-2024-23222](CVE-2024/CVE-2024-232xx/CVE-2024-23222.json) (`2024-02-29T08:15:46.907`)
## Download and Usage