admin/nvd-json-data-feeds
1
0
Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2025-07-09 16:05:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2024-03-30T13:00:38.462974+00:00

Browse Source
This commit is contained in:
cad-safe-bot 2024-03-30 13:03:30 +00:00
parent 4946c83ee0
commit df301ca5b7
7 changed files with 390 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
CVE-2024/CVE-2024-30xx/CVE-2024-3018.json Normal file
View File

@ -0,0 +1,47 @@
{
"id": "CVE-2024-3018",
"sourceIdentifier": "security@wordfence.com",
"published": "2024-03-30T12:15:07.543",
"lastModified": "2024-03-30T12:15:07.543",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "The Essential Addons for Elementor plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.9.13 via deserialization of untrusted input from the 'error_resetpassword' attribute of the \"Login | Register Form\" widget (disabled by default). This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "security@wordfence.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://plugins.trac.wordpress.org/changeset/3060417/essential-addons-for-elementor-lite",
"source": "security@wordfence.com"
},
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/342049e5-834e-4867-8174-01ca7bb0caa2?source=cve",
"source": "security@wordfence.com"
}
]
}

92
CVE-2024/CVE-2024-30xx/CVE-2024-3087.json Normal file
View File

@ -0,0 +1,92 @@
{
"id": "CVE-2024-3087",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-03-30T11:15:50.123",
"lastModified": "2024-03-30T11:15:50.123",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as critical, has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this issue is some unknown functionality of the file ambulance-tracking.php of the component Ambulance Tracking Page. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258680."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5
},
"baseSeverity": "HIGH",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "cna@vuldb.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"references": [
{
"url": "https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_rce.md",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?ctiid.258680",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?id.258680",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?submit.306961",
"source": "cna@vuldb.com"
}
]
}

92
CVE-2024/CVE-2024-30xx/CVE-2024-3088.json Normal file
View File

@ -0,0 +1,92 @@
{
"id": "CVE-2024-3088",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-03-30T11:15:50.483",
"lastModified": "2024-03-30T11:15:50.483",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as critical, was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. This affects an unknown part of the file /admin/forgot-password.php of the component Forgot Password Page. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258681 was assigned to this vulnerability."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5
},
"baseSeverity": "HIGH",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "cna@vuldb.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
],
"references": [
{
"url": "https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_forgotpasssqli.md",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?ctiid.258681",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?id.258681",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?submit.306962",
"source": "cna@vuldb.com"
}
]
}

92
CVE-2024/CVE-2024-30xx/CVE-2024-3089.json Normal file
View File

@ -0,0 +1,92 @@
{
"id": "CVE-2024-3089",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-03-30T12:15:07.730",
"lastModified": "2024-03-30T12:15:07.730",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/manage-ambulance.php of the component Manage Ambulance Page. The manipulation of the argument del leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258682 is the identifier assigned to this vulnerability."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"availabilityImpact": "NONE",
"baseScore": 5.0
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-352"
}
]
}
],
"references": [
{
"url": "https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/eahp_csrf.md",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?ctiid.258682",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?id.258682",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?submit.306963",
"source": "cna@vuldb.com"
}
]
}

50
CVE-2024/CVE-2024-30xx/CVE-2024-3094.json
View File

@ -2,7 +2,7 @@
"id": "CVE-2024-3094",
"sourceIdentifier": "secalert@redhat.com",
"published": "2024-03-29T17:15:21.150",
"lastModified": "2024-03-29T19:15:41.947",
"lastModified": "2024-03-30T11:15:50.713",
"vulnStatus": "Received",
"descriptions": [
{
@ -51,10 +51,50 @@
"url": "https://access.redhat.com/security/cve/CVE-2024-3094",
"source": "secalert@redhat.com"
},
{
"url": "https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/",
"source": "secalert@redhat.com"
},
{
"url": "https://aws.amazon.com/security/security-bulletins/AWS-2024-002/",
"source": "secalert@redhat.com"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272210",
"source": "secalert@redhat.com"
},
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1222124",
"source": "secalert@redhat.com"
},
{
"url": "https://news.ycombinator.com/item?id=39865810",
"source": "secalert@redhat.com"
},
{
"url": "https://openssf.org/blog/2024/03/30/xz-backdoor-cve-2024-3094/",
"source": "secalert@redhat.com"
},
{
"url": "https://security-tracker.debian.org/tracker/CVE-2024-3094",
"source": "secalert@redhat.com"
},
{
"url": "https://security.alpinelinux.org/vuln/CVE-2024-3094",
"source": "secalert@redhat.com"
},
{
"url": "https://security.archlinux.org/CVE-2024-3094",
"source": "secalert@redhat.com"
},
{
"url": "https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094",
"source": "secalert@redhat.com"
},
{
"url": "https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils",
"source": "secalert@redhat.com"
},
{
"url": "https://www.openwall.com/lists/oss-security/2024/03/29/4",
"source": "secalert@redhat.com"
@ -62,6 +102,14 @@
{
"url": "https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users",
"source": "secalert@redhat.com"
},
{
"url": "https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-supply-chain-backdoor-in-xz-utils",
"source": "secalert@redhat.com"
},
{
"url": "https://www.theregister.com/2024/03/29/malicious_backdoor_xz/",
"source": "secalert@redhat.com"
}
]
}

18
README.md
View File

@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2024-03-30T11:00:37.287447+00:00
2024-03-30T13:00:38.462974+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2024-03-30T10:15:07.460000+00:00
2024-03-30T12:15:07.730000+00:00
```
### Last Data Feed Release
@ -33,22 +33,24 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
243436
243440
```
### CVEs added in the last Commit
Recently added CVEs: `3`
Recently added CVEs: `4`
- [CVE-2024-2491](CVE-2024/CVE-2024-24xx/CVE-2024-2491.json) (`2024-03-30T10:15:07.460`)
- [CVE-2024-3085](CVE-2024/CVE-2024-30xx/CVE-2024-3085.json) (`2024-03-30T09:15:22.093`)
- [CVE-2024-3086](CVE-2024/CVE-2024-30xx/CVE-2024-3086.json) (`2024-03-30T09:15:22.367`)
- [CVE-2024-3018](CVE-2024/CVE-2024-30xx/CVE-2024-3018.json) (`2024-03-30T12:15:07.543`)
- [CVE-2024-3087](CVE-2024/CVE-2024-30xx/CVE-2024-3087.json) (`2024-03-30T11:15:50.123`)
- [CVE-2024-3088](CVE-2024/CVE-2024-30xx/CVE-2024-3088.json) (`2024-03-30T11:15:50.483`)
- [CVE-2024-3089](CVE-2024/CVE-2024-30xx/CVE-2024-3089.json) (`2024-03-30T12:15:07.730`)
### CVEs modified in the last Commit
Recently modified CVEs: `0`
Recently modified CVEs: `1`
- [CVE-2024-3094](CVE-2024/CVE-2024-30xx/CVE-2024-3094.json) (`2024-03-30T11:15:50.713`)
## Download and Usage

12
_state.csv
View File

@ -241421,7 +241421,7 @@ CVE-2024-24904,0,0,78ac0ecc337c1c3cf6e2760caf67e88b6e00a19c5576326a3f49c9a71b975
CVE-2024-24905,0,0,0364517ab894b73bf8c30cbe20b80273a93d4e9e263ab05b98b6931e08025cbd,2024-03-01T15:23:36.177000
CVE-2024-24906,0,0,b228b1520570950c7c3e86ac4523299ab67e1d327a9c2256213093954d2009dd,2024-03-01T14:04:04.827000
CVE-2024-24907,0,0,10281c2cdefacd19bcde83af128428b7182a3d780a05c7b0d1630f2ada3f8271,2024-03-01T15:23:36.177000
CVE-2024-2491,1,1,3a2cac36f3611f311c24b6e56ab4a32260a4f518dc4c29962fdd8b96ee6c7d9f,2024-03-30T10:15:07.460000
CVE-2024-2491,0,0,3a2cac36f3611f311c24b6e56ab4a32260a4f518dc4c29962fdd8b96ee6c7d9f,2024-03-30T10:15:07.460000
CVE-2024-24920,0,0,0c6e0a299c3dcb3e2c9c47cd3391320c9c9126b8fcb7683d54f65bff941cba09,2024-02-13T14:01:00.987000
CVE-2024-24921,0,0,2756f13f54e6771800d4e52f7442498e73a8fe2b3f97e730b1c320dbcf7f624d,2024-02-13T14:01:00.987000
CVE-2024-24922,0,0,680b15f3fa23668c58f8fb97e1903f0bb50dd4180870bdd41f68c0313884ae2b,2024-02-13T14:01:00.987000
@ -243238,6 +243238,7 @@ CVE-2024-30161,0,0,f6d00094643508d05d1e5626fca4ef83c82ab69ba4696adb329c49eff6d0a
CVE-2024-30177,0,0,ce7cec2fca67508ea4a8b86ac0339410ad9c9cb05c2afad1960db626913e7789,2024-03-27T12:29:30.307000
CVE-2024-30178,0,0,d11fc89cba6da171daf23dbb46df2a76bfb6083f334196d374e91e86d9976c38,2024-03-27T12:29:30.307000
CVE-2024-30179,0,0,35abc90ebe1a793047559644af343573def8da2ffc996aad9121641adf83cee8,2024-03-27T12:29:30.307000
CVE-2024-3018,1,1,6615e8a56060c257c4b67d69dbffd8f50c4c72bf28f00c301f68c19ea6625e89,2024-03-30T12:15:07.543000
CVE-2024-30180,0,0,f5fdb110c03fb97533c78472d1d528181074b53d825b1ba9ff6d4938f78491e3,2024-03-27T12:29:30.307000
CVE-2024-30181,0,0,8a2b0f53664e4096913cb3b2aaf99815ff9150b97170d5953fbe59ce6accb0af,2024-03-27T12:29:30.307000
CVE-2024-30182,0,0,556427d1450e23e4a4ecf72bf9048682fc7d0a52a02ad41567836d21fc584ba6,2024-03-27T12:29:30.307000
@ -243419,9 +243420,12 @@ CVE-2024-3077,0,0,764729ebf4e3dc3c20da54caae721047879db4db5e2887f4d077635ba39ad9
CVE-2024-3078,0,0,07ca6090eecfc88a41afb186ab370517deca7caa0d1280cb8ed031f58d59e15a,2024-03-29T13:28:22.880000
CVE-2024-3081,0,0,dffc68d1388aac08d9d9a9d84e2f2854f24235b2dd8bd2e907a0a195e3c85f14,2024-03-29T15:15:14.657000
CVE-2024-3084,0,0,feb04b6812a124315d1816b70ccdcdd41a89f3d42f26905fef1bc9732a4ee86a,2024-03-30T08:15:07.510000
CVE-2024-3085,1,1,f189393abcf3f39030a0b0c96f6cb9307d0bf6deb0ef88912d8e876c4692bd1c,2024-03-30T09:15:22.093000
CVE-2024-3086,1,1,cc5a01ab88ce423f04c8e499fc5c4ae76ca65b66c37b46eb53fe666ff0b26be5,2024-03-30T09:15:22.367000
CVE-2024-3094,0,0,c6fffd56cf4a81476425ca638ec856baec49e7641b48e65fcf99476d7346527a,2024-03-29T19:15:41.947000
CVE-2024-3085,0,0,f189393abcf3f39030a0b0c96f6cb9307d0bf6deb0ef88912d8e876c4692bd1c,2024-03-30T09:15:22.093000
CVE-2024-3086,0,0,cc5a01ab88ce423f04c8e499fc5c4ae76ca65b66c37b46eb53fe666ff0b26be5,2024-03-30T09:15:22.367000
CVE-2024-3087,1,1,58a2a50b13efdc9006ff609b1b35a4d1f9aa703f618a30d89033d50f7e02b844,2024-03-30T11:15:50.123000
CVE-2024-3088,1,1,75e336a30e6366575c15823fb5c1169d3c04cc034936f7f9923994a537b606f7,2024-03-30T11:15:50.483000
CVE-2024-3089,1,1,d9e6000375bc975d92e9af606a08c79464dd8df87e00cc3a7780d662edd5a1a0,2024-03-30T12:15:07.730000
CVE-2024-3094,0,1,c8cfb5d8db4948559902213da97949db9e528da393ca65060d5bc6149c3532fa,2024-03-30T11:15:50.713000
CVE-2024-31032,0,0,f6232fe0ef0534ba6d6e20ea0777fd8892cbb87efba42355deb8d8634b00d21e,2024-03-29T17:15:20.993000
CVE-2024-31061,0,0,3a611478260a969dc7c268c913c4f396b21e3b4ebcb9a4cb4b0ae2a352b58da0,2024-03-28T20:53:20.813000
CVE-2024-31062,0,0,952fafab14c88ef7f6d1b1ec6a2fcadf9629e538f73b776826c7478ea44a065b,2024-03-28T20:53:20.813000

Can't render this file because it is too large.