mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-06-19 17:31:42 +00:00
Auto-Update: 2024-11-23T17:01:05.402126+00:00
This commit is contained in:
cad-safe-bot
parent
9520a58032
commit
e22b954fe3
@ -2,20 +2,138 @@
|
|||||||
"id": "CVE-2018-9338",
|
"id": "CVE-2018-9338",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T18:15:18.707",
|
"published": "2024-11-19T18:15:18.707",
|
||||||
"lastModified": "2024-11-19T21:56:45.533",
|
"lastModified": "2024-11-22T15:48:50.737",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "In ResStringPool::setTo of ResourceTypes.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
|
"value": "In ResStringPool::setTo of ResourceTypes.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "En ResStringPool::setTo de ResourceTypes.cpp, existe una posible escritura fuera de los l\u00edmites debido a una verificaci\u00f3n de los l\u00edmites faltante. Esto podr\u00eda provocar una escalada local de privilegios sin necesidad de permisos de ejecuci\u00f3n adicionales. No se necesita la interacci\u00f3n del usuario para la explotaci\u00f3n."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "E70C6D8D-C9C3-4D92-8DFC-71F59E068295"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "691FA41B-C2CE-413F-ABB1-0B22CB322807"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {},
|
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9339",
|
"id": "CVE-2018-9339",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T19:15:05.677",
|
"published": "2024-11-19T19:15:05.677",
|
||||||
"lastModified": "2024-11-20T17:35:03.690",
|
"lastModified": "2024-11-22T16:02:38.047",
|
||||||
"vulnStatus": "Undergoing Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -18,11 +17,13 @@
|
|||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
"attackVector": "LOCAL",
|
"attackVector": "LOCAL",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -30,9 +31,27 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 7.8,
|
"baseScore": 7.8,
|
||||||
"baseSeverity": "HIGH"
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 1.8,
|
"exploitabilityScore": 1.8,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -40,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-843"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +80,36 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9340",
|
"id": "CVE-2018-9340",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T19:15:05.743",
|
"published": "2024-11-19T19:15:05.743",
|
||||||
"lastModified": "2024-11-20T17:35:05.083",
|
"lastModified": "2024-11-22T16:05:09.423",
|
||||||
"vulnStatus": "Undergoing Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -17,12 +16,34 @@
|
|||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 5.5,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 3.6
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "NONE",
|
"privilegesRequired": "NONE",
|
||||||
@ -30,9 +51,7 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "NONE",
|
"integrityImpact": "NONE",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
"baseScore": 7.5,
|
|
||||||
"baseSeverity": "HIGH"
|
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 3.9,
|
"exploitabilityScore": 3.9,
|
||||||
"impactScore": 3.6
|
"impactScore": 3.6
|
||||||
@ -40,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-125"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +80,61 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "E70C6D8D-C9C3-4D92-8DFC-71F59E068295"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "691FA41B-C2CE-413F-ABB1-0B22CB322807"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9341",
|
"id": "CVE-2018-9341",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T19:15:05.817",
|
"published": "2024-11-19T19:15:05.817",
|
||||||
"lastModified": "2024-11-20T17:35:06.453",
|
"lastModified": "2024-11-22T16:14:05.937",
|
||||||
"vulnStatus": "Undergoing Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -17,12 +16,34 @@
|
|||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 9.8,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "NONE",
|
"privilegesRequired": "NONE",
|
||||||
@ -30,9 +51,7 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
"baseScore": 9.8,
|
|
||||||
"baseSeverity": "CRITICAL"
|
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 3.9,
|
"exploitabilityScore": 3.9,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -40,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +80,61 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "E70C6D8D-C9C3-4D92-8DFC-71F59E068295"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "691FA41B-C2CE-413F-ABB1-0B22CB322807"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9344",
|
"id": "CVE-2018-9344",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T19:15:05.877",
|
"published": "2024-11-19T19:15:05.877",
|
||||||
"lastModified": "2024-11-20T17:35:07.810",
|
"lastModified": "2024-11-22T16:24:25.747",
|
||||||
"vulnStatus": "Undergoing Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -18,11 +17,13 @@
|
|||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
"attackVector": "LOCAL",
|
"attackVector": "LOCAL",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -30,9 +31,27 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 7.8,
|
"baseScore": 7.8,
|
||||||
"baseSeverity": "HIGH"
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 1.8,
|
"exploitabilityScore": 1.8,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -40,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-667"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +80,31 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9345",
|
"id": "CVE-2018-9345",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T19:15:05.937",
|
"published": "2024-11-19T19:15:05.937",
|
||||||
"lastModified": "2024-11-20T17:35:09.167",
|
"lastModified": "2024-11-22T16:25:45.430",
|
||||||
"vulnStatus": "Undergoing Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -18,11 +17,13 @@
|
|||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 5.5,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "LOCAL",
|
"attackVector": "LOCAL",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -30,9 +31,27 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "NONE",
|
"integrityImpact": "NONE",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 3.6
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||||
"baseScore": 5.5,
|
"baseScore": 5.5,
|
||||||
"baseSeverity": "MEDIUM"
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 1.8,
|
"exploitabilityScore": 1.8,
|
||||||
"impactScore": 3.6
|
"impactScore": 3.6
|
||||||
@ -40,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-908"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +80,61 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "E70C6D8D-C9C3-4D92-8DFC-71F59E068295"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "691FA41B-C2CE-413F-ABB1-0B22CB322807"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9346",
|
"id": "CVE-2018-9346",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T19:15:06.000",
|
"published": "2024-11-19T19:15:06.000",
|
||||||
"lastModified": "2024-11-20T17:35:10.507",
|
"lastModified": "2024-11-22T16:26:16.143",
|
||||||
"vulnStatus": "Undergoing Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -18,11 +17,13 @@
|
|||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 5.5,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "LOCAL",
|
"attackVector": "LOCAL",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -30,9 +31,27 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "NONE",
|
"integrityImpact": "NONE",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 3.6
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||||
"baseScore": 5.5,
|
"baseScore": 5.5,
|
||||||
"baseSeverity": "MEDIUM"
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 1.8,
|
"exploitabilityScore": 1.8,
|
||||||
"impactScore": 3.6
|
"impactScore": 3.6
|
||||||
@ -40,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-908"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +80,61 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "E70C6D8D-C9C3-4D92-8DFC-71F59E068295"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "691FA41B-C2CE-413F-ABB1-0B22CB322807"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9348",
|
"id": "CVE-2018-9348",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T20:15:27.427",
|
"published": "2024-11-19T20:15:27.427",
|
||||||
"lastModified": "2024-11-20T16:35:02.590",
|
"lastModified": "2024-11-22T21:14:05.813",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -17,12 +16,34 @@
|
|||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
|
||||||
|
"baseScore": 6.5,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 3.6
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "NONE",
|
"privilegesRequired": "NONE",
|
||||||
@ -30,9 +51,7 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "NONE",
|
"confidentialityImpact": "NONE",
|
||||||
"integrityImpact": "NONE",
|
"integrityImpact": "NONE",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
"baseScore": 7.5,
|
|
||||||
"baseSeverity": "HIGH"
|
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 3.9,
|
"exploitabilityScore": 3.9,
|
||||||
"impactScore": 3.6
|
"impactScore": 3.6
|
||||||
@ -40,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-190"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +80,60 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "E70C6D8D-C9C3-4D92-8DFC-71F59E068295"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "691FA41B-C2CE-413F-ABB1-0B22CB322807"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9364",
|
"id": "CVE-2018-9364",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T20:15:27.493",
|
"published": "2024-11-19T20:15:27.493",
|
||||||
"lastModified": "2024-11-20T16:35:03.457",
|
"lastModified": "2024-11-22T21:22:14.020",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -18,11 +17,13 @@
|
|||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "NONE",
|
"privilegesRequired": "NONE",
|
||||||
@ -30,9 +31,27 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "NONE",
|
"confidentialityImpact": "NONE",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 3.6
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
||||||
"baseScore": 7.5,
|
"baseScore": 7.5,
|
||||||
"baseSeverity": "HIGH"
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 3.9,
|
"exploitabilityScore": 3.9,
|
||||||
"impactScore": 3.6
|
"impactScore": 3.6
|
||||||
@ -40,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "NVD-CWE-noinfo"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +80,30 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9366",
|
"id": "CVE-2018-9366",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T20:15:27.550",
|
"published": "2024-11-19T20:15:27.550",
|
||||||
"lastModified": "2024-11-20T16:35:04.323",
|
"lastModified": "2024-11-22T21:23:11.303",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -18,11 +17,13 @@
|
|||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
"attackVector": "LOCAL",
|
"attackVector": "LOCAL",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -30,9 +31,27 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 7.8,
|
"baseScore": 7.8,
|
||||||
"baseSeverity": "HIGH"
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 1.8,
|
"exploitabilityScore": 1.8,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -40,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-190"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +80,30 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,20 +2,108 @@
|
|||||||
"id": "CVE-2018-9367",
|
"id": "CVE-2018-9367",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T20:15:27.607",
|
"published": "2024-11-19T20:15:27.607",
|
||||||
"lastModified": "2024-11-19T21:56:45.533",
|
"lastModified": "2024-11-22T21:23:04.237",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "In FT_ACDK_CCT_V2_OP_ISP_SET_TUNING_PARAS of Meta_CCAP_Para.cpp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
|
"value": "In FT_ACDK_CCT_V2_OP_ISP_SET_TUNING_PARAS of Meta_CCAP_Para.cpp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "En FT_ACDK_CCT_V2_OP_ISP_SET_TUNING_PARAS de Meta_CCAP_Para.cpp, existe una posible escritura fuera de los l\u00edmites debido a una validaci\u00f3n de entrada incorrecta. Esto podr\u00eda provocar una escalada local de privilegios sin necesidad de permisos de ejecuci\u00f3n adicionales. No se necesita interacci\u00f3n del usuario para la explotaci\u00f3n."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {},
|
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,20 +2,108 @@
|
|||||||
"id": "CVE-2018-9368",
|
"id": "CVE-2018-9368",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T20:15:27.667",
|
"published": "2024-11-19T20:15:27.667",
|
||||||
"lastModified": "2024-11-19T21:56:45.533",
|
"lastModified": "2024-11-22T21:23:32.820",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "In mtkscoaudio debugfs there is a possible arbitrary kernel memory write due to missing bounds check and weakened SELinux policies. This could lead to local escalation of privilege with system \u00a0execution privileges needed. User interaction is not needed for exploitation."
|
"value": "In mtkscoaudio debugfs there is a possible arbitrary kernel memory write due to missing bounds check and weakened SELinux policies. This could lead to local escalation of privilege with system \u00a0execution privileges needed. User interaction is not needed for exploitation."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "En el debugfs de mtkscoaudio existe una posible escritura arbitraria en la memoria del kernel debido a la falta de verificaci\u00f3n de los l\u00edmites y a pol\u00edticas de SELinux debilitadas. Esto podr\u00eda provocar una escalada local de privilegios con privilegios de ejecuci\u00f3n del sistema necesarios. No se necesita interacci\u00f3n del usuario para la explotaci\u00f3n."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 6.7,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 0.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {},
|
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,20 +2,108 @@
|
|||||||
"id": "CVE-2018-9369",
|
"id": "CVE-2018-9369",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T20:15:27.723",
|
"published": "2024-11-19T20:15:27.723",
|
||||||
"lastModified": "2024-11-19T21:56:45.533",
|
"lastModified": "2024-11-22T21:24:18.323",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "In bootloader there is fastboot command allowing user specified kernel command line arguments. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation."
|
"value": "In bootloader there is fastboot command allowing user specified kernel command line arguments. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "En el gestor de arranque hay un comando fastboot que permite utilizar argumentos de l\u00ednea de comandos del kernel especificados por el usuario. Esto podr\u00eda provocar una escalada local de privilegios sin necesidad de permisos de ejecuci\u00f3n adicionales. Se necesita la interacci\u00f3n del usuario para la explotaci\u00f3n."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.3,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.3,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "NVD-CWE-noinfo"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-276"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {},
|
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,20 +2,108 @@
|
|||||||
"id": "CVE-2018-9370",
|
"id": "CVE-2018-9370",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T20:15:27.787",
|
"published": "2024-11-19T20:15:27.787",
|
||||||
"lastModified": "2024-11-19T21:56:45.533",
|
"lastModified": "2024-11-22T21:24:57.467",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "In download.c there is a special mode allowing user to download data into memory and causing possible memory corruptions due to missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation."
|
"value": "In download.c there is a special mode allowing user to download data into memory and causing possible memory corruptions due to missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "En download.c hay un modo especial que permite al usuario descargar datos en la memoria y provocar posibles corrupciones de memoria debido a la falta de verificaci\u00f3n de los l\u00edmites. Esto podr\u00eda provocar una escalada local de privilegios sin necesidad de permisos de ejecuci\u00f3n adicionales. Se necesita la interacci\u00f3n del usuario para la explotaci\u00f3n."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.3,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.3,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {},
|
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9371",
|
"id": "CVE-2018-9371",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T20:15:27.843",
|
"published": "2024-11-19T20:15:27.843",
|
||||||
"lastModified": "2024-11-20T20:35:02.730",
|
"lastModified": "2024-11-22T21:25:48.853",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -17,12 +16,34 @@
|
|||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 6.4,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "PHYSICAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 0.5,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
"attackVector": "LOCAL",
|
"attackVector": "LOCAL",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -30,9 +51,7 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
"baseScore": 7.8,
|
|
||||||
"baseSeverity": "HIGH"
|
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 1.8,
|
"exploitabilityScore": 1.8,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -40,6 +59,20 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-125"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -55,10 +88,30 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
"url": "https://source.android.com/security/bulletin/2018-06-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,20 +2,114 @@
|
|||||||
"id": "CVE-2018-9410",
|
"id": "CVE-2018-9410",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T21:15:05.657",
|
"published": "2024-11-19T21:15:05.657",
|
||||||
"lastModified": "2024-11-19T21:56:45.533",
|
"lastModified": "2024-11-22T22:28:51.533",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "In analyzeAxes of FontUtils.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."
|
"value": "In analyzeAxes of FontUtils.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "En analyzeAxes de FontUtils.cpp, existe una posible lectura fuera de los l\u00edmites debido a una verificaci\u00f3n de los l\u00edmites faltante. Esto podr\u00eda provocar la divulgaci\u00f3n de informaci\u00f3n local sin necesidad de privilegios de ejecuci\u00f3n adicionales. No se necesita la interacci\u00f3n del usuario para la explotaci\u00f3n."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 5.5,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 3.6
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 5.5,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-125"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-125"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {},
|
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9411",
|
"id": "CVE-2018-9411",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T22:15:18.750",
|
"published": "2024-11-19T22:15:18.750",
|
||||||
"lastModified": "2024-11-20T16:35:05.247",
|
"lastModified": "2024-11-22T22:30:25.617",
|
||||||
"vulnStatus": "Received",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -18,11 +17,13 @@
|
|||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 8.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "NONE",
|
"privilegesRequired": "NONE",
|
||||||
@ -30,9 +31,27 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 8.8,
|
"baseScore": 8.8,
|
||||||
"baseSeverity": "HIGH"
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 2.8,
|
"exploitabilityScore": 2.8,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -40,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +80,36 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,20 +2,109 @@
|
|||||||
"id": "CVE-2018-9412",
|
"id": "CVE-2018-9412",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T22:15:18.813",
|
"published": "2024-11-19T22:15:18.813",
|
||||||
"lastModified": "2024-11-19T22:15:18.813",
|
"lastModified": "2024-11-23T00:56:14.623",
|
||||||
"vulnStatus": "Received",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "In removeUnsynchronization of ID3.cpp there is a possible resource exhaustion due to improper input validation. This could lead to denial of service with no additional execution privileges needed. User interaction is needed for exploitation."
|
"value": "In removeUnsynchronization of ID3.cpp there is a possible resource exhaustion due to improper input validation. This could lead to denial of service with no additional execution privileges needed. User interaction is needed for exploitation."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "En removeUnsynchronization of ID3.cpp, existe la posibilidad de que se agoten los recursos debido a una validaci\u00f3n de entrada incorrecta. Esto podr\u00eda provocar la denegaci\u00f3n del servicio sin necesidad de privilegios de ejecuci\u00f3n adicionales. Para su explotaci\u00f3n, se necesita la interacci\u00f3n del usuario."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
|
||||||
|
"baseScore": 5.5,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "NVD-CWE-noinfo"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "E70C6D8D-C9C3-4D92-8DFC-71F59E068295"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "691FA41B-C2CE-413F-ABB1-0B22CB322807"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {},
|
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9417",
|
"id": "CVE-2018-9417",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T22:15:18.880",
|
"published": "2024-11-19T22:15:18.880",
|
||||||
"lastModified": "2024-11-20T16:35:06.213",
|
"lastModified": "2024-11-22T22:08:46.630",
|
||||||
"vulnStatus": "Received",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -18,11 +17,13 @@
|
|||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
"attackVector": "LOCAL",
|
"attackVector": "LOCAL",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -30,9 +31,27 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 7.8,
|
"baseScore": 7.8,
|
||||||
"baseSeverity": "HIGH"
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 1.8,
|
"exploitabilityScore": 1.8,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -40,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-416"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +80,31 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9419",
|
"id": "CVE-2018-9419",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T22:15:18.943",
|
"published": "2024-11-19T22:15:18.943",
|
||||||
"lastModified": "2024-11-20T16:35:07.070",
|
"lastModified": "2024-11-22T22:07:33.540",
|
||||||
"vulnStatus": "Received",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -18,11 +17,13 @@
|
|||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "NONE",
|
"privilegesRequired": "NONE",
|
||||||
@ -30,9 +31,27 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "NONE",
|
"integrityImpact": "NONE",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 3.6
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||||||
"baseScore": 7.5,
|
"baseScore": 7.5,
|
||||||
"baseSeverity": "HIGH"
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 3.9,
|
"exploitabilityScore": 3.9,
|
||||||
"impactScore": 3.6
|
"impactScore": 3.6
|
||||||
@ -40,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-125"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +80,51 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9420",
|
"id": "CVE-2018-9420",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T22:15:19.010",
|
"published": "2024-11-19T22:15:19.010",
|
||||||
"lastModified": "2024-11-20T16:35:07.940",
|
"lastModified": "2024-11-22T22:06:41.107",
|
||||||
"vulnStatus": "Received",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -18,11 +17,13 @@
|
|||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 5.5,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "LOCAL",
|
"attackVector": "LOCAL",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -30,9 +31,27 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "NONE",
|
"integrityImpact": "NONE",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 3.6
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||||
"baseScore": 5.5,
|
"baseScore": 5.5,
|
||||||
"baseSeverity": "MEDIUM"
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 1.8,
|
"exploitabilityScore": 1.8,
|
||||||
"impactScore": 3.6
|
"impactScore": 3.6
|
||||||
@ -40,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-908"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +80,61 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "E70C6D8D-C9C3-4D92-8DFC-71F59E068295"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "691FA41B-C2CE-413F-ABB1-0B22CB322807"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9421",
|
"id": "CVE-2018-9421",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T22:15:19.070",
|
"published": "2024-11-19T22:15:19.070",
|
||||||
"lastModified": "2024-11-20T16:35:08.780",
|
"lastModified": "2024-11-22T22:05:41.297",
|
||||||
"vulnStatus": "Received",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -18,11 +17,13 @@
|
|||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 5.5,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "LOCAL",
|
"attackVector": "LOCAL",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -30,9 +31,27 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "NONE",
|
"integrityImpact": "NONE",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 3.6
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||||
"baseScore": 5.5,
|
"baseScore": 5.5,
|
||||||
"baseSeverity": "MEDIUM"
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 1.8,
|
"exploitabilityScore": 1.8,
|
||||||
"impactScore": 3.6
|
"impactScore": 3.6
|
||||||
@ -40,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-908"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +80,61 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "E70C6D8D-C9C3-4D92-8DFC-71F59E068295"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "691FA41B-C2CE-413F-ABB1-0B22CB322807"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch",
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9424",
|
"id": "CVE-2018-9424",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T22:15:19.130",
|
"published": "2024-11-19T22:15:19.130",
|
||||||
"lastModified": "2024-11-20T16:35:09.627",
|
"lastModified": "2024-11-22T21:26:59.867",
|
||||||
"vulnStatus": "Received",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -18,11 +17,13 @@
|
|||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
"attackVector": "LOCAL",
|
"attackVector": "LOCAL",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -30,9 +31,27 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 7.8,
|
"baseScore": 7.8,
|
||||||
"baseSeverity": "HIGH"
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 1.8,
|
"exploitabilityScore": 1.8,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -40,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +80,35 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9428",
|
"id": "CVE-2018-9428",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T22:15:19.190",
|
"published": "2024-11-19T22:15:19.190",
|
||||||
"lastModified": "2024-11-20T16:35:10.460",
|
"lastModified": "2024-11-22T22:04:52.717",
|
||||||
"vulnStatus": "Received",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -17,12 +16,34 @@
|
|||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 8.4,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
"attackVector": "LOCAL",
|
"attackVector": "LOCAL",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "NONE",
|
"privilegesRequired": "NONE",
|
||||||
@ -30,9 +51,7 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
"baseScore": 8.4,
|
|
||||||
"baseSeverity": "HIGH"
|
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 2.5,
|
"exploitabilityScore": 2.5,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -40,6 +59,20 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-416"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +84,30 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2018-9432",
|
"id": "CVE-2018-9432",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T22:15:19.247",
|
"published": "2024-11-19T22:15:19.247",
|
||||||
"lastModified": "2024-11-20T16:35:11.280",
|
"lastModified": "2024-11-22T21:11:15.770",
|
||||||
"vulnStatus": "Received",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -17,12 +16,34 @@
|
|||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
"attackVector": "LOCAL",
|
"attackVector": "LOCAL",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -30,9 +51,7 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
"baseScore": 7.8,
|
|
||||||
"baseSeverity": "HIGH"
|
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 1.8,
|
"exploitabilityScore": 1.8,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -40,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "NVD-CWE-noinfo"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -51,10 +80,60 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "E70C6D8D-C9C3-4D92-8DFC-71F59E068295"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "691FA41B-C2CE-413F-ABB1-0B22CB322807"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,20 +2,128 @@
|
|||||||
"id": "CVE-2018-9433",
|
"id": "CVE-2018-9433",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T22:15:19.307",
|
"published": "2024-11-19T22:15:19.307",
|
||||||
"lastModified": "2024-11-19T22:15:19.307",
|
"lastModified": "2024-11-22T21:13:28.557",
|
||||||
"vulnStatus": "Received",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "In ArrayConcatVisitor of builtins-array.cc, there is a possible type confusion due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation."
|
"value": "In ArrayConcatVisitor of builtins-array.cc, there is a possible type confusion due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "En ArrayConcatVisitor de builtins-array.cc, existe una posible confusi\u00f3n de tipos debido a una validaci\u00f3n de entrada incorrecta. Esto podr\u00eda provocar la ejecuci\u00f3n remota de c\u00f3digo sin necesidad de privilegios de ejecuci\u00f3n adicionales. Se necesita la interacci\u00f3n del usuario para su explotaci\u00f3n."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 8.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 9.8,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "NVD-CWE-noinfo"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-116"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "E70C6D8D-C9C3-4D92-8DFC-71F59E068295"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "691FA41B-C2CE-413F-ABB1-0B22CB322807"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {},
|
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
"url": "https://source.android.com/security/bulletin/2018-07-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,20 +2,123 @@
|
|||||||
"id": "CVE-2018-9440",
|
"id": "CVE-2018-9440",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T23:15:04.020",
|
"published": "2024-11-19T23:15:04.020",
|
||||||
"lastModified": "2024-11-19T23:15:04.020",
|
"lastModified": "2024-11-22T21:30:26.993",
|
||||||
"vulnStatus": "Received",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "In parse of M3UParser.cpp there is a possible resource exhaustion due to improper input validation. This could lead to denial of service with no additional execution privileges needed. User interaction is needed for exploitation."
|
"value": "In parse of M3UParser.cpp there is a possible resource exhaustion due to improper input validation. This could lead to denial of service with no additional execution privileges needed. User interaction is needed for exploitation."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "En el an\u00e1lisis de M3UParser.cpp existe un posible agotamiento de recursos debido a una validaci\u00f3n de entrada incorrecta. Esto podr\u00eda provocar una denegaci\u00f3n de servicio sin necesidad de privilegios de ejecuci\u00f3n adicionales. Se necesita la interacci\u00f3n del usuario para su explotaci\u00f3n."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
|
||||||
|
"baseScore": 6.5,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 3.6
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
|
||||||
|
"baseScore": 6.5,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "NVD-CWE-noinfo"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "8DFAAD08-36DA-4C95-8200-C29FE5B6B854"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {},
|
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-09-01",
|
"url": "https://source.android.com/security/bulletin/2018-09-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,20 +2,128 @@
|
|||||||
"id": "CVE-2018-9456",
|
"id": "CVE-2018-9456",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T23:15:04.100",
|
"published": "2024-11-19T23:15:04.100",
|
||||||
"lastModified": "2024-11-19T23:15:04.100",
|
"lastModified": "2024-11-22T21:29:34.833",
|
||||||
"vulnStatus": "Received",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "In sdpu_extract_attr_seq of sdp_utils.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."
|
"value": "In sdpu_extract_attr_seq of sdp_utils.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "En sdpu_extract_attr_seq de sdp_utils.cc, existe una posible lectura fuera de los l\u00edmites debido a una verificaci\u00f3n de los l\u00edmites incorrecta. Esto podr\u00eda provocar una denegaci\u00f3n de servicio remota sin necesidad de privilegios de ejecuci\u00f3n adicionales. No se necesita la interacci\u00f3n del usuario para la explotaci\u00f3n."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 3.6
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-125"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-125"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {},
|
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-09-01",
|
"url": "https://source.android.com/security/bulletin/2018-09-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,23 +2,28 @@
|
|||||||
"id": "CVE-2018-9466",
|
"id": "CVE-2018-9466",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-19T23:15:04.170",
|
"published": "2024-11-19T23:15:04.170",
|
||||||
"lastModified": "2024-11-20T16:35:12.150",
|
"lastModified": "2024-11-22T21:29:09.617",
|
||||||
"vulnStatus": "Received",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "In the xmlSnprintfElementContent function of valid.c, there is a possible out of bounds write. This could lead to remote escalation of privilege in an unprivileged app with no additional execution privileges needed. User interaction is needed for exploitation."
|
"value": "In the xmlSnprintfElementContent function of valid.c, there is a possible out of bounds write. This could lead to remote escalation of privilege in an unprivileged app with no additional execution privileges needed. User interaction is needed for exploitation."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "En la funci\u00f3n xmlSnprintfElementContent de valid.c, existe una posible escritura fuera de los l\u00edmites. Esto podr\u00eda provocar una escalada remota de privilegios en una aplicaci\u00f3n sin privilegios sin necesidad de privilegios de ejecuci\u00f3n adicionales. Se necesita la interacci\u00f3n del usuario para la explotaci\u00f3n."
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 8.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "NONE",
|
"privilegesRequired": "NONE",
|
||||||
@ -26,9 +31,27 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 8.8,
|
"baseScore": 8.8,
|
||||||
"baseSeverity": "HIGH"
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 2.8,
|
"exploitabilityScore": 2.8,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -36,6 +59,16 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -47,10 +80,50 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-09-01",
|
"url": "https://source.android.com/security/bulletin/2018-09-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,20 +2,133 @@
|
|||||||
"id": "CVE-2018-9467",
|
"id": "CVE-2018-9467",
|
||||||
"sourceIdentifier": "security@android.com",
|
"sourceIdentifier": "security@android.com",
|
||||||
"published": "2024-11-20T00:15:16.820",
|
"published": "2024-11-20T00:15:16.820",
|
||||||
"lastModified": "2024-11-20T00:15:16.820",
|
"lastModified": "2024-11-22T21:27:26.783",
|
||||||
"vulnStatus": "Received",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could lead to incorrect security decisions with no additional execution privileges needed. User interaction is not needed for exploitation."
|
"value": "In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could lead to incorrect security decisions with no additional execution privileges needed. User interaction is not needed for exploitation."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "En la funci\u00f3n getHost() de UriTest.java, existe la posibilidad de una determinaci\u00f3n incorrecta del origen web. Esto podr\u00eda generar decisiones de seguridad incorrectas sin necesidad de privilegios de ejecuci\u00f3n adicionales. No se necesita la interacci\u00f3n del usuario para la explotaci\u00f3n."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 9.8,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 9.8,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "NVD-CWE-noinfo"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-276"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "8DFAAD08-36DA-4C95-8200-C29FE5B6B854"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {},
|
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://source.android.com/security/bulletin/2018-09-01",
|
"url": "https://source.android.com/security/bulletin/2018-09-01",
|
||||||
"source": "security@android.com"
|
"source": "security@android.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
55
CVE-2021/CVE-2021-381xx/CVE-2021-38116.json
Normal file
55
CVE-2021/CVE-2021-381xx/CVE-2021-38116.json
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2021-38116",
|
||||||
|
"sourceIdentifier": "security@opentext.com",
|
||||||
|
"published": "2024-11-22T16:15:18.663",
|
||||||
|
"lastModified": "2024-11-22T16:15:18.663",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Possible Elevation of Privilege Vulnerability\n\nin iManager has been discovered in\nOpenText\u2122 iManager. This impacts all versions before 3.2.5"
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 8.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-77"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.netiq.com/documentation/imanager-32/imanager325_releasenotes/data/imanager325_releasenotes.html",
|
||||||
|
"source": "security@opentext.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
55
CVE-2021/CVE-2021-381xx/CVE-2021-38117.json
Normal file
55
CVE-2021/CVE-2021-381xx/CVE-2021-38117.json
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2021-38117",
|
||||||
|
"sourceIdentifier": "security@opentext.com",
|
||||||
|
"published": "2024-11-22T16:15:18.823",
|
||||||
|
"lastModified": "2024-11-22T16:15:18.823",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Possible Command injection Vulnerability\n\nin iManager has been discovered in\nOpenText\u2122 iManager 3.2.4.0000."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 8.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-94"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.netiq.com/documentation/imanager-32/imanager325_releasenotes/data/imanager325_releasenotes.html",
|
||||||
|
"source": "security@opentext.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
55
CVE-2021/CVE-2021-381xx/CVE-2021-38118.json
Normal file
55
CVE-2021/CVE-2021-381xx/CVE-2021-38118.json
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2021-38118",
|
||||||
|
"sourceIdentifier": "security@opentext.com",
|
||||||
|
"published": "2024-11-22T16:15:18.950",
|
||||||
|
"lastModified": "2024-11-22T16:15:18.950",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Possible improper input validation Vulnerability\n\nin iManager has been discovered in\nOpenText\u2122 iManager 3.2.4.0000."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 5.5,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-250"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.netiq.com/documentation/imanager-32/imanager325_releasenotes/data/imanager325_releasenotes.html",
|
||||||
|
"source": "security@opentext.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
55
CVE-2021/CVE-2021-381xx/CVE-2021-38119.json
Normal file
55
CVE-2021/CVE-2021-381xx/CVE-2021-38119.json
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2021-38119",
|
||||||
|
"sourceIdentifier": "security@opentext.com",
|
||||||
|
"published": "2024-11-22T16:15:19.073",
|
||||||
|
"lastModified": "2024-11-22T16:15:19.073",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Possible Reflected Cross-Site Scripting (XSS) Vulnerability\n\nin iManager has been discovered in\nOpenText\u2122 iManager 3.2.4.0000."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||||||
|
"baseScore": 6.1,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 2.7
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-79"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.netiq.com/documentation/imanager-32/imanager325_releasenotes/data/imanager325_releasenotes.html",
|
||||||
|
"source": "security@opentext.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
55
CVE-2021/CVE-2021-381xx/CVE-2021-38134.json
Normal file
55
CVE-2021/CVE-2021-381xx/CVE-2021-38134.json
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2021-38134",
|
||||||
|
"sourceIdentifier": "security@opentext.com",
|
||||||
|
"published": "2024-11-22T16:15:19.197",
|
||||||
|
"lastModified": "2024-11-22T16:15:19.197",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Possible XSS in iManager URL for access Component has been discovered in\nOpenText\u2122 iManager 3.2.5.0000."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||||||
|
"baseScore": 6.1,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 2.7
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-79"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.netiq.com/documentation/imanager-32/imanager326_releasenotes/data/imanager326_releasenotes.html",
|
||||||
|
"source": "security@opentext.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2021/CVE-2021-381xx/CVE-2021-38135.json
Normal file
59
CVE-2021/CVE-2021-381xx/CVE-2021-38135.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2021-38135",
|
||||||
|
"sourceIdentifier": "security@opentext.com",
|
||||||
|
"published": "2024-11-22T16:15:19.327",
|
||||||
|
"lastModified": "2024-11-22T16:15:19.327",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Possible \nExternal Service Interaction attack\n\nin iManager has been discovered in\nOpenText\u2122 iManager 3.2.6.0000."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
|
||||||
|
"baseScore": 8.6,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 4.0
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-406"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-918"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.netiq.com/documentation/imanager-32/imanager326_releasenotes/data/imanager326_releasenotes.html",
|
||||||
|
"source": "security@opentext.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
55
CVE-2022/CVE-2022-263xx/CVE-2022-26324.json
Normal file
55
CVE-2022/CVE-2022-263xx/CVE-2022-26324.json
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2022-26324",
|
||||||
|
"sourceIdentifier": "security@opentext.com",
|
||||||
|
"published": "2024-11-22T16:15:19.470",
|
||||||
|
"lastModified": "2024-11-22T16:15:19.470",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Possible XSS in iManager URL for access Component has been discovered in\nOpenText\u2122 iManager 3.2.6.0000."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N",
|
||||||
|
"baseScore": 7.6,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.3,
|
||||||
|
"impactScore": 4.7
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-79"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.netiq.com/documentation/imanager-32/pdfdoc/imanager326_patch1_releasenotes/imanager326_patch1_releasenotes.pdf",
|
||||||
|
"source": "security@opentext.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
55
CVE-2023/CVE-2023-244xx/CVE-2023-24466.json
Normal file
55
CVE-2023/CVE-2023-244xx/CVE-2023-24466.json
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-24466",
|
||||||
|
"sourceIdentifier": "security@opentext.com",
|
||||||
|
"published": "2024-11-22T16:15:19.673",
|
||||||
|
"lastModified": "2024-11-22T16:15:19.673",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Possible XML External Entity Injection\n\n\n in iManager GET parameter has been discovered in\nOpenText\u2122 iManager 3.2.6.0200."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-611"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.netiq.com/documentation/imanager-32/pdfdoc/imanager326_patch3_releasenotes/imanager326_patch3_releasenotes.pdf",
|
||||||
|
"source": "security@opentext.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-244xx/CVE-2023-24467.json
Normal file
59
CVE-2023/CVE-2023-244xx/CVE-2023-24467.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-24467",
|
||||||
|
"sourceIdentifier": "security@opentext.com",
|
||||||
|
"published": "2024-11-22T16:15:19.810",
|
||||||
|
"lastModified": "2024-11-22T16:15:19.810",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Possible Command Injection\n\n\n in iManager GET parameter has been discovered in\nOpenText\u2122 iManager 3.2.6.0000."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 8.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-77"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-78"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.netiq.com/documentation/imanager-32/pdfdoc/imanager326_patch3_releasenotes/imanager326_patch3_releasenotes.pdf",
|
||||||
|
"source": "security@opentext.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2023-30306",
|
"id": "CVE-2023-30306",
|
||||||
"sourceIdentifier": "cve@mitre.org",
|
"sourceIdentifier": "cve@mitre.org",
|
||||||
"published": "2024-05-28T20:16:20.317",
|
"published": "2024-05-28T20:16:20.317",
|
||||||
"lastModified": "2024-05-29T13:02:09.280",
|
"lastModified": "2024-11-22T22:15:06.373",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Awaiting Analysis",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -15,11 +14,38 @@
|
|||||||
"value": "Un problema descubierto en los enrutadores Mercury x30g, Mercury YR1800XG, permite a los atacantes secuestrar sesiones TCP, lo que podr\u00eda provocar una denegaci\u00f3n de servicio."
|
"value": "Un problema descubierto en los enrutadores Mercury x30g, Mercury YR1800XG, permite a los atacantes secuestrar sesiones TCP, lo que podr\u00eda provocar una denegaci\u00f3n de servicio."
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {},
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
||||||
|
"baseScore": 4.3,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 1.4
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://www.ndss-symposium.org/ndss-paper/exploiting-sequence-number-leakage-tcp-hijacking-in-nat-enabled-wi-fi-networks/",
|
"url": "https://www.ndss-symposium.org/ndss-paper/exploiting-sequence-number-leakage-tcp-hijacking-in-nat-enabled-wi-fi-networks/",
|
||||||
"source": "cve@mitre.org"
|
"source": "cve@mitre.org"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.ndss-symposium.org/ndss-paper/exploiting-sequence-number-leakage-tcp-hijacking-in-nat-enabled-wi-fi-networks/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2023-36258",
|
"id": "CVE-2023-36258",
|
||||||
"sourceIdentifier": "cve@mitre.org",
|
"sourceIdentifier": "cve@mitre.org",
|
||||||
"published": "2023-07-03T21:15:09.797",
|
"published": "2023-07-03T21:15:09.797",
|
||||||
"lastModified": "2024-02-26T16:27:46.537",
|
"lastModified": "2024-11-22T17:15:05.750",
|
||||||
"vulnStatus": "Modified",
|
"vulnStatus": "Modified",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -19,6 +18,8 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 9.8,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "NONE",
|
"privilegesRequired": "NONE",
|
||||||
@ -26,9 +27,7 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
"baseScore": 9.8,
|
|
||||||
"baseSeverity": "CRITICAL"
|
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 3.9,
|
"exploitabilityScore": 3.9,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -45,6 +44,16 @@
|
|||||||
"value": "NVD-CWE-noinfo"
|
"value": "NVD-CWE-noinfo"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-94"
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"configurations": [
|
"configurations": [
|
||||||
@ -73,6 +82,15 @@
|
|||||||
"Issue Tracking",
|
"Issue Tracking",
|
||||||
"Mitigation"
|
"Mitigation"
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/hwchase17/langchain/issues/5872",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Exploit",
|
||||||
|
"Issue Tracking",
|
||||||
|
"Mitigation"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
59
CVE-2023/CVE-2023-394xx/CVE-2023-39470.json
Normal file
59
CVE-2023/CVE-2023-394xx/CVE-2023-39470.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-39470",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:05.487",
|
||||||
|
"lastModified": "2024-11-22T20:15:05.487",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut NG. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the management of the print.script.sandboxed setting. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20965."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.2,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.2,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-749"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.papercut.com/kb/Main/SecurityBulletinJune2023/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-786/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2023-40660",
|
"id": "CVE-2023-40660",
|
||||||
"sourceIdentifier": "secalert@redhat.com",
|
"sourceIdentifier": "secalert@redhat.com",
|
||||||
"published": "2023-11-06T17:15:11.757",
|
"published": "2023-11-06T17:15:11.757",
|
||||||
"lastModified": "2024-09-16T17:15:59.347",
|
"lastModified": "2024-11-23T04:15:04.593",
|
||||||
"vulnStatus": "Modified",
|
"vulnStatus": "Modified",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -17,32 +16,14 @@
|
|||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
|
||||||
"source": "nvd@nist.gov",
|
|
||||||
"type": "Primary",
|
|
||||||
"cvssData": {
|
|
||||||
"version": "3.1",
|
|
||||||
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
|
||||||
"attackVector": "PHYSICAL",
|
|
||||||
"attackComplexity": "LOW",
|
|
||||||
"privilegesRequired": "NONE",
|
|
||||||
"userInteraction": "REQUIRED",
|
|
||||||
"scope": "UNCHANGED",
|
|
||||||
"confidentialityImpact": "HIGH",
|
|
||||||
"integrityImpact": "HIGH",
|
|
||||||
"availabilityImpact": "HIGH",
|
|
||||||
"baseScore": 6.6,
|
|
||||||
"baseSeverity": "MEDIUM"
|
|
||||||
},
|
|
||||||
"exploitabilityScore": 0.7,
|
|
||||||
"impactScore": 5.9
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"source": "secalert@redhat.com",
|
"source": "secalert@redhat.com",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 6.6,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "PHYSICAL",
|
"attackVector": "PHYSICAL",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "NONE",
|
"privilegesRequired": "NONE",
|
||||||
@ -50,9 +31,27 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 0.7,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 6.6,
|
"baseScore": 6.6,
|
||||||
"baseSeverity": "MEDIUM"
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "PHYSICAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 0.7,
|
"exploitabilityScore": 0.7,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -61,17 +60,17 @@
|
|||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
{
|
{
|
||||||
"source": "nvd@nist.gov",
|
"source": "secalert@redhat.com",
|
||||||
"type": "Primary",
|
"type": "Primary",
|
||||||
"description": [
|
"description": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "CWE-287"
|
"value": "CWE-327"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"source": "secalert@redhat.com",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
"description": [
|
"description": [
|
||||||
{
|
{
|
||||||
@ -162,6 +161,65 @@
|
|||||||
"tags": [
|
"tags": [
|
||||||
"Vendor Advisory"
|
"Vendor Advisory"
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "http://www.openwall.com/lists/oss-security/2023/12/13/2",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2023:7876",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2023:7879",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/security/cve/CVE-2023-40660",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2240912",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Issue Tracking"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Issue Tracking"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Release Notes"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://lists.debian.org/debian-lts-announce/2023/11/msg00024.html",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3CPQOMCDWFRBMEFR5VK4N5MMXXU42ODE/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLYEFIBBA37TK3UNMZN5NOJ7IWCIXLQP/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2023-51614",
|
"id": "CVE-2023-51614",
|
||||||
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
"published": "2024-05-03T03:16:23.650",
|
"published": "2024-05-03T03:16:23.650",
|
||||||
"lastModified": "2024-05-03T12:48:41.067",
|
"lastModified": "2024-11-22T21:33:25.047",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -16,13 +15,15 @@
|
|||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV30": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "zdi-disclosures@trendmicro.com",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.0",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 6.8,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "ADJACENT_NETWORK",
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "HIGH",
|
"privilegesRequired": "HIGH",
|
||||||
@ -30,9 +31,29 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 0.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 6.8,
|
"baseScore": 6.8,
|
||||||
"baseSeverity": "MEDIUM"
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 0.9,
|
"exploitabilityScore": 0.9,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -49,16 +70,76 @@
|
|||||||
"value": "CWE-121"
|
"value": "CWE-121"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"operator": "AND",
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:dlink:dir-x3260_firmware:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndExcluding": "1.04b01",
|
||||||
|
"matchCriteriaId": "A248082B-DE99-46B4-A262-1F15FADB311F"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": false,
|
||||||
|
"criteria": "cpe:2.3:h:dlink:dir-x3260:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "9F0A3774-EAF9-4A3B-B259-F4297FBC82F5"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-034/",
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-034/",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-034/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2023-51615",
|
"id": "CVE-2023-51615",
|
||||||
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
"published": "2024-05-03T03:16:23.817",
|
"published": "2024-05-03T03:16:23.817",
|
||||||
"lastModified": "2024-05-03T12:48:41.067",
|
"lastModified": "2024-11-22T21:33:38.363",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -16,13 +15,15 @@
|
|||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV30": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "zdi-disclosures@trendmicro.com",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.0",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 6.8,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "ADJACENT_NETWORK",
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "HIGH",
|
"privilegesRequired": "HIGH",
|
||||||
@ -30,9 +31,29 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 0.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 6.8,
|
"baseScore": 6.8,
|
||||||
"baseSeverity": "MEDIUM"
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 0.9,
|
"exploitabilityScore": 0.9,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -49,16 +70,76 @@
|
|||||||
"value": "CWE-121"
|
"value": "CWE-121"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"operator": "AND",
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:dlink:dir-x3260_firmware:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndExcluding": "1.04b01",
|
||||||
|
"matchCriteriaId": "A248082B-DE99-46B4-A262-1F15FADB311F"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": false,
|
||||||
|
"criteria": "cpe:2.3:h:dlink:dir-x3260:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "9F0A3774-EAF9-4A3B-B259-F4297FBC82F5"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-035/",
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-035/",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-035/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2023-51616",
|
"id": "CVE-2023-51616",
|
||||||
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
"published": "2024-05-03T03:16:23.983",
|
"published": "2024-05-03T03:16:23.983",
|
||||||
"lastModified": "2024-05-03T12:48:41.067",
|
"lastModified": "2024-11-22T21:33:56.320",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -16,13 +15,15 @@
|
|||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV30": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "zdi-disclosures@trendmicro.com",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.0",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 6.8,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "ADJACENT_NETWORK",
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "HIGH",
|
"privilegesRequired": "HIGH",
|
||||||
@ -30,9 +31,29 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 0.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 6.8,
|
"baseScore": 6.8,
|
||||||
"baseSeverity": "MEDIUM"
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 0.9,
|
"exploitabilityScore": 0.9,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -49,16 +70,76 @@
|
|||||||
"value": "CWE-121"
|
"value": "CWE-121"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"operator": "AND",
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:dlink:dir-x3260_firmware:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndExcluding": "1.04b01",
|
||||||
|
"matchCriteriaId": "A248082B-DE99-46B4-A262-1F15FADB311F"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": false,
|
||||||
|
"criteria": "cpe:2.3:h:dlink:dir-x3260:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "9F0A3774-EAF9-4A3B-B259-F4297FBC82F5"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-036/",
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-036/",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-036/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2023-51617",
|
"id": "CVE-2023-51617",
|
||||||
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
"published": "2024-05-03T03:16:24.153",
|
"published": "2024-05-03T03:16:24.153",
|
||||||
"lastModified": "2024-05-03T12:48:41.067",
|
"lastModified": "2024-11-22T21:34:12.503",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -16,13 +15,15 @@
|
|||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV30": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "zdi-disclosures@trendmicro.com",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.0",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 6.8,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "ADJACENT_NETWORK",
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "HIGH",
|
"privilegesRequired": "HIGH",
|
||||||
@ -30,9 +31,29 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 0.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 6.8,
|
"baseScore": 6.8,
|
||||||
"baseSeverity": "MEDIUM"
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 0.9,
|
"exploitabilityScore": 0.9,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -49,16 +70,76 @@
|
|||||||
"value": "CWE-121"
|
"value": "CWE-121"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"operator": "AND",
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:dlink:dir-x3260_firmware:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndExcluding": "1.04b01",
|
||||||
|
"matchCriteriaId": "A248082B-DE99-46B4-A262-1F15FADB311F"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": false,
|
||||||
|
"criteria": "cpe:2.3:h:dlink:dir-x3260:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "9F0A3774-EAF9-4A3B-B259-F4297FBC82F5"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-037/",
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-037/",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-037/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2023-51618",
|
"id": "CVE-2023-51618",
|
||||||
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
"published": "2024-05-03T03:16:24.330",
|
"published": "2024-05-03T03:16:24.330",
|
||||||
"lastModified": "2024-05-03T12:48:41.067",
|
"lastModified": "2024-11-22T21:34:28.420",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -16,13 +15,15 @@
|
|||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV30": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "zdi-disclosures@trendmicro.com",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.0",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 6.8,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "ADJACENT_NETWORK",
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "HIGH",
|
"privilegesRequired": "HIGH",
|
||||||
@ -30,9 +31,29 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 0.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 6.8,
|
"baseScore": 6.8,
|
||||||
"baseSeverity": "MEDIUM"
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 0.9,
|
"exploitabilityScore": 0.9,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -49,16 +70,76 @@
|
|||||||
"value": "CWE-121"
|
"value": "CWE-121"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"operator": "AND",
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:dlink:dir-x3260_firmware:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndExcluding": "1.04b01",
|
||||||
|
"matchCriteriaId": "A248082B-DE99-46B4-A262-1F15FADB311F"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": false,
|
||||||
|
"criteria": "cpe:2.3:h:dlink:dir-x3260:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "9F0A3774-EAF9-4A3B-B259-F4297FBC82F5"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-038/",
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-038/",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-038/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2023-51619",
|
"id": "CVE-2023-51619",
|
||||||
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
"published": "2024-05-03T03:16:24.503",
|
"published": "2024-05-03T03:16:24.503",
|
||||||
"lastModified": "2024-05-03T12:48:41.067",
|
"lastModified": "2024-11-22T21:34:43.177",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -16,13 +15,15 @@
|
|||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV30": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "zdi-disclosures@trendmicro.com",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.0",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 6.8,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "ADJACENT_NETWORK",
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "HIGH",
|
"privilegesRequired": "HIGH",
|
||||||
@ -30,9 +31,29 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 0.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 6.8,
|
"baseScore": 6.8,
|
||||||
"baseSeverity": "MEDIUM"
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 0.9,
|
"exploitabilityScore": 0.9,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -49,16 +70,76 @@
|
|||||||
"value": "CWE-121"
|
"value": "CWE-121"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"operator": "AND",
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:dlink:dir-x3260_firmware:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndExcluding": "1.04b01",
|
||||||
|
"matchCriteriaId": "A248082B-DE99-46B4-A262-1F15FADB311F"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": false,
|
||||||
|
"criteria": "cpe:2.3:h:dlink:dir-x3260:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "9F0A3774-EAF9-4A3B-B259-F4297FBC82F5"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-039/",
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-039/",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-039/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2023-51620",
|
"id": "CVE-2023-51620",
|
||||||
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
"published": "2024-05-03T03:16:24.690",
|
"published": "2024-05-03T03:16:24.690",
|
||||||
"lastModified": "2024-05-03T12:48:41.067",
|
"lastModified": "2024-11-22T21:35:01.260",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -16,13 +15,15 @@
|
|||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV30": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "zdi-disclosures@trendmicro.com",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.0",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 6.8,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "ADJACENT_NETWORK",
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "HIGH",
|
"privilegesRequired": "HIGH",
|
||||||
@ -30,9 +31,29 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 0.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 6.8,
|
"baseScore": 6.8,
|
||||||
"baseSeverity": "MEDIUM"
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 0.9,
|
"exploitabilityScore": 0.9,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -49,16 +70,76 @@
|
|||||||
"value": "CWE-121"
|
"value": "CWE-121"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"operator": "AND",
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:dlink:dir-x3260_firmware:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndExcluding": "1.04b01",
|
||||||
|
"matchCriteriaId": "A248082B-DE99-46B4-A262-1F15FADB311F"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": false,
|
||||||
|
"criteria": "cpe:2.3:h:dlink:dir-x3260:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "9F0A3774-EAF9-4A3B-B259-F4297FBC82F5"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-040/",
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-040/",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-040/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2023-51621",
|
"id": "CVE-2023-51621",
|
||||||
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
"published": "2024-05-03T03:16:24.853",
|
"published": "2024-05-03T03:16:24.853",
|
||||||
"lastModified": "2024-05-03T12:48:41.067",
|
"lastModified": "2024-11-22T21:35:14.677",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -16,13 +15,15 @@
|
|||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV30": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "zdi-disclosures@trendmicro.com",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.0",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 6.8,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "ADJACENT_NETWORK",
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "HIGH",
|
"privilegesRequired": "HIGH",
|
||||||
@ -30,9 +31,29 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 0.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 6.8,
|
"baseScore": 6.8,
|
||||||
"baseSeverity": "MEDIUM"
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 0.9,
|
"exploitabilityScore": 0.9,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -49,16 +70,76 @@
|
|||||||
"value": "CWE-121"
|
"value": "CWE-121"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"operator": "AND",
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:dlink:dir-x3260_firmware:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndExcluding": "1.04b01",
|
||||||
|
"matchCriteriaId": "A248082B-DE99-46B4-A262-1F15FADB311F"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": false,
|
||||||
|
"criteria": "cpe:2.3:h:dlink:dir-x3260:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "9F0A3774-EAF9-4A3B-B259-F4297FBC82F5"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-041/",
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-041/",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-041/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2023-51622",
|
"id": "CVE-2023-51622",
|
||||||
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
"published": "2024-05-03T03:16:25.023",
|
"published": "2024-05-03T03:16:25.023",
|
||||||
"lastModified": "2024-05-03T12:48:41.067",
|
"lastModified": "2024-11-22T21:35:25.933",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -16,13 +15,15 @@
|
|||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV30": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "zdi-disclosures@trendmicro.com",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.0",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 6.8,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "ADJACENT_NETWORK",
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "HIGH",
|
"privilegesRequired": "HIGH",
|
||||||
@ -30,9 +31,29 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 0.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 6.8,
|
"baseScore": 6.8,
|
||||||
"baseSeverity": "MEDIUM"
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 0.9,
|
"exploitabilityScore": 0.9,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -49,16 +70,76 @@
|
|||||||
"value": "CWE-121"
|
"value": "CWE-121"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"operator": "AND",
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:dlink:dir-x3260_firmware:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndExcluding": "1.04b01",
|
||||||
|
"matchCriteriaId": "A248082B-DE99-46B4-A262-1F15FADB311F"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": false,
|
||||||
|
"criteria": "cpe:2.3:h:dlink:dir-x3260:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "9F0A3774-EAF9-4A3B-B259-F4297FBC82F5"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-042/",
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-042/",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-042/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2023-51623",
|
"id": "CVE-2023-51623",
|
||||||
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
"published": "2024-05-03T03:16:25.200",
|
"published": "2024-05-03T03:16:25.200",
|
||||||
"lastModified": "2024-05-03T12:48:41.067",
|
"lastModified": "2024-11-22T21:35:38.853",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -16,13 +15,15 @@
|
|||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV30": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "zdi-disclosures@trendmicro.com",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Primary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.0",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 6.8,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "ADJACENT_NETWORK",
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "HIGH",
|
"privilegesRequired": "HIGH",
|
||||||
@ -30,9 +31,29 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 0.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 6.8,
|
"baseScore": 6.8,
|
||||||
"baseSeverity": "MEDIUM"
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 0.9,
|
"exploitabilityScore": 0.9,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -49,16 +70,76 @@
|
|||||||
"value": "CWE-121"
|
"value": "CWE-121"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-787"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"operator": "AND",
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:o:dlink:dir-x3260_firmware:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndExcluding": "1.04b01",
|
||||||
|
"matchCriteriaId": "A248082B-DE99-46B4-A262-1F15FADB311F"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": false,
|
||||||
|
"criteria": "cpe:2.3:h:dlink:dir-x3260:-:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "9F0A3774-EAF9-4A3B-B259-F4297FBC82F5"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-043/",
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-043/",
|
||||||
"source": "zdi-disclosures@trendmicro.com"
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10365",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-043/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
59
CVE-2023/CVE-2023-516xx/CVE-2023-51634.json
Normal file
59
CVE-2023/CVE-2023-516xx/CVE-2023-51634.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-51634",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:06.050",
|
||||||
|
"lastModified": "2024-11-22T20:15:06.050",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "NETGEAR RAX30 Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the downloading of files via HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-19589."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
|
"attackComplexity": "HIGH",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.6,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-295"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://kb.netgear.com/000065928/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2023-0139",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-583/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-516xx/CVE-2023-51635.json
Normal file
59
CVE-2023/CVE-2023-516xx/CVE-2023-51635.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-51635",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:06.167",
|
||||||
|
"lastModified": "2024-11-22T20:15:06.167",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "NETGEAR RAX30 fing_dil Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within fing_dil service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19843."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 8.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-121"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://kb.netgear.com/000065928/Security-Advisory-for-Multiple-Vulnerabilities-on-the-RAX30-PSV-2023-0139",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-584/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-516xx/CVE-2023-51638.json
Normal file
59
CVE-2023/CVE-2023-516xx/CVE-2023-51638.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-51638",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:06.283",
|
||||||
|
"lastModified": "2024-11-22T20:15:06.283",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Allegra Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability. \n\nThe specific flaw exists within the configuration of a database. The issue results from the use of a hardcoded password. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-22360."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 9.8,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-798"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-111/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-516xx/CVE-2023-51639.json
Normal file
59
CVE-2023/CVE-2023-516xx/CVE-2023-51639.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-51639",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:06.400",
|
||||||
|
"lastModified": "2024-11-22T20:15:06.400",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Allegra downloadExportedChart Directory Traversal Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Allegra. Authentication is not required to exploit this vulnerability. \n\nThe specific flaw exists within the downloadExportedChart action. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-22361."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 9.8,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-22"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-110/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-516xx/CVE-2023-51640.json
Normal file
59
CVE-2023/CVE-2023-516xx/CVE-2023-51640.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-51640",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:06.523",
|
||||||
|
"lastModified": "2024-11-22T20:15:06.523",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Allegra extarctZippedFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the extarctZippedFile [sic] method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22504."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.2,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.2,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-22"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-107/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-516xx/CVE-2023-51641.json
Normal file
59
CVE-2023/CVE-2023-516xx/CVE-2023-51641.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-51641",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:06.643",
|
||||||
|
"lastModified": "2024-11-22T20:15:06.643",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Allegra renderFieldMatch Deserialization of Unstrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, product implements a registration mechanism that can be used to create a user with a sufficient privilege level.\n\nThe specific flaw exists within the renderFieldMatch method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22505."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 9.8,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-502"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-106/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-516xx/CVE-2023-51642.json
Normal file
59
CVE-2023/CVE-2023-516xx/CVE-2023-51642.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-51642",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:06.757",
|
||||||
|
"lastModified": "2024-11-22T20:15:06.757",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, product implements a registration mechanism that can be used to create a user with a sufficient privilege level.\n\nThe specific flaw exists within the loadFieldMatch method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22506."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 9.8,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-502"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-105/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-516xx/CVE-2023-51643.json
Normal file
59
CVE-2023/CVE-2023-516xx/CVE-2023-51643.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-51643",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:06.870",
|
||||||
|
"lastModified": "2024-11-22T20:15:06.870",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Allegra uploadFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the uploadFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22510."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.2,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.2,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-22"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-103/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-516xx/CVE-2023-51644.json
Normal file
59
CVE-2023/CVE-2023-516xx/CVE-2023-51644.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-51644",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:06.987",
|
||||||
|
"lastModified": "2024-11-22T20:15:06.987",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Allegra SiteConfigAction Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is not required to exploit this vulnerability. \n\nThe specific flaw exists within the configuration of Struts. The issue results from improper access control. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22512."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 9.8,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-284"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-102/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-516xx/CVE-2023-51645.json
Normal file
59
CVE-2023/CVE-2023-516xx/CVE-2023-51645.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-51645",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:07.103",
|
||||||
|
"lastModified": "2024-11-22T20:15:07.103",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the unzipFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22513."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.2,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.2,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-22"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-101/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-516xx/CVE-2023-51646.json
Normal file
59
CVE-2023/CVE-2023-516xx/CVE-2023-51646.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-51646",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:07.230",
|
||||||
|
"lastModified": "2024-11-22T20:15:07.230",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Allegra uploadSimpleFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the uploadSimpleFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22527."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.2,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.2,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-22"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-109/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-516xx/CVE-2023-51647.json
Normal file
59
CVE-2023/CVE-2023-516xx/CVE-2023-51647.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-51647",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:07.337",
|
||||||
|
"lastModified": "2024-11-22T20:15:07.337",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Allegra saveInlineEdit Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.\n\nThe specific flaw exists within the saveInlineEdit method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22528."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.2,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "HIGH",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.2,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-22"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-108/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-516xx/CVE-2023-51648.json
Normal file
59
CVE-2023/CVE-2023-516xx/CVE-2023-51648.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-51648",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:07.447",
|
||||||
|
"lastModified": "2024-11-22T20:15:07.447",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Allegra getFileContentAsString Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the product implements a registration mechanism that can be used to create a new user with a sufficient privilege level.\n\nThe specific flaw exists within the getFileContentAsString method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22530."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-22"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-099/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-523xx/CVE-2023-52332.json
Normal file
59
CVE-2023/CVE-2023-523xx/CVE-2023-52332.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-52332",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:07.560",
|
||||||
|
"lastModified": "2024-11-22T20:15:07.560",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Allegra serveMathJaxLibraries Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Allegra. Authentication is not required to exploit this vulnerability. \n\nThe specific flaw exists within the serveMathJaxLibraries method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22532."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-22"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-100/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-523xx/CVE-2023-52333.json
Normal file
59
CVE-2023/CVE-2023-523xx/CVE-2023-52333.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-52333",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:07.670",
|
||||||
|
"lastModified": "2024-11-22T20:15:07.670",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Allegra saveFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, product implements a registration mechanism that can be used to create a user with a sufficient privilege level.\n\nThe specific flaw exists within the saveFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22548."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 9.8,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-22"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-104/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-523xx/CVE-2023-52334.json
Normal file
59
CVE-2023/CVE-2023-523xx/CVE-2023-52334.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-52334",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:07.793",
|
||||||
|
"lastModified": "2024-11-22T20:15:07.793",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Allegra downloadAttachmentGlobal Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Allegra. Although authentication is required to exploit this vulnerability, product implements a registration mechanism that can be used to create a user with a sufficient privilege level.\n\nThe specific flaw exists within the downloadAttachmentGlobal action. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-22507."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-22"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.trackplus.com/en/service/release-notes-reader/7-5-1-release-notes-2.html",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-112/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2023/CVE-2023-523xx/CVE-2023-52335.json
Normal file
59
CVE-2023/CVE-2023-523xx/CVE-2023-52335.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-52335",
|
||||||
|
"sourceIdentifier": "zdi-disclosures@trendmicro.com",
|
||||||
|
"published": "2024-11-22T20:15:07.927",
|
||||||
|
"lastModified": "2024-11-22T20:15:07.927",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the ConfigurationServlet servlet, which listens on TCP port 8080 by default. When parsing the column_value element, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-17863."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV30": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.0",
|
||||||
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "zdi-disclosures@trendmicro.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-89"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://www.advantech.com/zh-tw/support/details/firmware?id=1-HIPU-183",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-610/",
|
||||||
|
"source": "zdi-disclosures@trendmicro.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2023-52368",
|
"id": "CVE-2023-52368",
|
||||||
"sourceIdentifier": "psirt@huawei.com",
|
"sourceIdentifier": "psirt@huawei.com",
|
||||||
"published": "2024-02-18T04:15:07.690",
|
"published": "2024-02-18T04:15:07.690",
|
||||||
"lastModified": "2024-02-20T19:50:53.960",
|
"lastModified": "2024-11-22T19:15:05.250",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Awaiting Analysis",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -15,7 +14,30 @@
|
|||||||
"value": "Vulnerabilidad de verificaci\u00f3n de entrada en el m\u00f3dulo de cuenta. La explotaci\u00f3n exitosa de esta vulnerabilidad puede causar que las funciones funcionen de manera anormal."
|
"value": "Vulnerabilidad de verificaci\u00f3n de entrada en el m\u00f3dulo de cuenta. La explotaci\u00f3n exitosa de esta vulnerabilidad puede causar que las funciones funcionen de manera anormal."
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {},
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
||||||
|
"baseScore": 5.3,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 1.4
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
{
|
{
|
||||||
"source": "psirt@huawei.com",
|
"source": "psirt@huawei.com",
|
||||||
@ -36,6 +58,14 @@
|
|||||||
{
|
{
|
||||||
"url": "https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-0000001834855405",
|
"url": "https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-0000001834855405",
|
||||||
"source": "psirt@huawei.com"
|
"source": "psirt@huawei.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://consumer.huawei.com/en/support/bulletin/2024/2/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202402-0000001834855405",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2023-7008",
|
"id": "CVE-2023-7008",
|
||||||
"sourceIdentifier": "secalert@redhat.com",
|
"sourceIdentifier": "secalert@redhat.com",
|
||||||
"published": "2023-12-23T13:15:07.573",
|
"published": "2023-12-23T13:15:07.573",
|
||||||
"lastModified": "2024-09-16T17:16:02.170",
|
"lastModified": "2024-11-22T12:15:17.590",
|
||||||
"vulnStatus": "Modified",
|
"vulnStatus": "Modified",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -17,32 +16,14 @@
|
|||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
|
||||||
"source": "nvd@nist.gov",
|
|
||||||
"type": "Primary",
|
|
||||||
"cvssData": {
|
|
||||||
"version": "3.1",
|
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
||||||
"attackVector": "NETWORK",
|
|
||||||
"attackComplexity": "HIGH",
|
|
||||||
"privilegesRequired": "NONE",
|
|
||||||
"userInteraction": "NONE",
|
|
||||||
"scope": "UNCHANGED",
|
|
||||||
"confidentialityImpact": "NONE",
|
|
||||||
"integrityImpact": "HIGH",
|
|
||||||
"availabilityImpact": "NONE",
|
|
||||||
"baseScore": 5.9,
|
|
||||||
"baseSeverity": "MEDIUM"
|
|
||||||
},
|
|
||||||
"exploitabilityScore": 2.2,
|
|
||||||
"impactScore": 3.6
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"source": "secalert@redhat.com",
|
"source": "secalert@redhat.com",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
||||||
|
"baseScore": 5.9,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "HIGH",
|
"attackComplexity": "HIGH",
|
||||||
"privilegesRequired": "NONE",
|
"privilegesRequired": "NONE",
|
||||||
@ -50,9 +31,27 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "NONE",
|
"confidentialityImpact": "NONE",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.2,
|
||||||
|
"impactScore": 3.6
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
||||||
"baseScore": 5.9,
|
"baseScore": 5.9,
|
||||||
"baseSeverity": "MEDIUM"
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "HIGH",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 2.2,
|
"exploitabilityScore": 2.2,
|
||||||
"impactScore": 3.6
|
"impactScore": 3.6
|
||||||
@ -60,16 +59,6 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
{
|
|
||||||
"source": "nvd@nist.gov",
|
|
||||||
"type": "Primary",
|
|
||||||
"description": [
|
|
||||||
{
|
|
||||||
"lang": "en",
|
|
||||||
"value": "NVD-CWE-Other"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"source": "secalert@redhat.com",
|
"source": "secalert@redhat.com",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
@ -79,6 +68,16 @@
|
|||||||
"value": "CWE-300"
|
"value": "CWE-300"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "NVD-CWE-Other"
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"configurations": [
|
"configurations": [
|
||||||
@ -151,6 +150,54 @@
|
|||||||
"tags": [
|
"tags": [
|
||||||
"Issue Tracking"
|
"Issue Tracking"
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2024:2463",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2024:3203",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/security/cve/CVE-2023-7008",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Vendor Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2222261",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Issue Tracking"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2222672",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Issue Tracking"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/systemd/systemd/issues/25676",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Issue Tracking"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GMDEG5PKONWNHOEYSUDRT6JEOISRMN2/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QHNBXGKJWISJETTTDTZKTBFIBJUOSLKL/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://security.netapp.com/advisory/ntap-20241122-0004/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2023-7252",
|
"id": "CVE-2023-7252",
|
||||||
"sourceIdentifier": "contact@wpscan.com",
|
"sourceIdentifier": "contact@wpscan.com",
|
||||||
"published": "2024-04-22T05:15:07.310",
|
"published": "2024-04-22T05:15:07.310",
|
||||||
"lastModified": "2024-07-03T01:44:29.993",
|
"lastModified": "2024-11-22T15:15:04.990",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Awaiting Analysis",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -22,20 +21,20 @@
|
|||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N",
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
||||||
|
"baseScore": 5.3,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "NONE",
|
||||||
"userInteraction": "NONE",
|
"userInteraction": "NONE",
|
||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "NONE",
|
"confidentialityImpact": "LOW",
|
||||||
"integrityImpact": "NONE",
|
"integrityImpact": "NONE",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
"baseScore": 0.0,
|
|
||||||
"baseSeverity": "NONE"
|
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 2.8,
|
"exploitabilityScore": 3.9,
|
||||||
"impactScore": 0.0
|
"impactScore": 1.4
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
@ -43,6 +42,10 @@
|
|||||||
{
|
{
|
||||||
"url": "https://wpscan.com/vulnerability/c452c5da-05a6-4a14-994d-e5049996d496/",
|
"url": "https://wpscan.com/vulnerability/c452c5da-05a6-4a14-994d-e5049996d496/",
|
||||||
"source": "contact@wpscan.com"
|
"source": "contact@wpscan.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://wpscan.com/vulnerability/c452c5da-05a6-4a14-994d-e5049996d496/",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
140
CVE-2023/CVE-2023-72xx/CVE-2023-7299.json
Normal file
140
CVE-2023/CVE-2023-72xx/CVE-2023-7299.json
Normal file
@ -0,0 +1,140 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2023-7299",
|
||||||
|
"sourceIdentifier": "cna@vuldb.com",
|
||||||
|
"published": "2024-11-23T13:15:04.547",
|
||||||
|
"lastModified": "2024-11-23T13:15:04.547",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "A vulnerability was found in DataGear up to 4.60. It has been declared as critical. This vulnerability affects unknown code of the file /dataSet/resolveSql. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. Upgrading to version 4.7.0 is able to address this issue. It is recommended to upgrade the affected component."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV40": [
|
||||||
|
{
|
||||||
|
"source": "cna@vuldb.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "4.0",
|
||||||
|
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
|
||||||
|
"baseScore": 5.3,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"attackRequirements": "NONE",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"vulnerableSystemConfidentiality": "LOW",
|
||||||
|
"vulnerableSystemIntegrity": "LOW",
|
||||||
|
"vulnerableSystemAvailability": "LOW",
|
||||||
|
"subsequentSystemConfidentiality": "NONE",
|
||||||
|
"subsequentSystemIntegrity": "NONE",
|
||||||
|
"subsequentSystemAvailability": "NONE",
|
||||||
|
"exploitMaturity": "NOT_DEFINED",
|
||||||
|
"confidentialityRequirements": "NOT_DEFINED",
|
||||||
|
"integrityRequirements": "NOT_DEFINED",
|
||||||
|
"availabilityRequirements": "NOT_DEFINED",
|
||||||
|
"modifiedAttackVector": "NOT_DEFINED",
|
||||||
|
"modifiedAttackComplexity": "NOT_DEFINED",
|
||||||
|
"modifiedAttackRequirements": "NOT_DEFINED",
|
||||||
|
"modifiedPrivilegesRequired": "NOT_DEFINED",
|
||||||
|
"modifiedUserInteraction": "NOT_DEFINED",
|
||||||
|
"modifiedVulnerableSystemConfidentiality": "NOT_DEFINED",
|
||||||
|
"modifiedVulnerableSystemIntegrity": "NOT_DEFINED",
|
||||||
|
"modifiedVulnerableSystemAvailability": "NOT_DEFINED",
|
||||||
|
"modifiedSubsequentSystemConfidentiality": "NOT_DEFINED",
|
||||||
|
"modifiedSubsequentSystemIntegrity": "NOT_DEFINED",
|
||||||
|
"modifiedSubsequentSystemAvailability": "NOT_DEFINED",
|
||||||
|
"safety": "NOT_DEFINED",
|
||||||
|
"automatable": "NOT_DEFINED",
|
||||||
|
"recovery": "NOT_DEFINED",
|
||||||
|
"valueDensity": "NOT_DEFINED",
|
||||||
|
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||||
|
"providerUrgency": "NOT_DEFINED"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "cna@vuldb.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
||||||
|
"baseScore": 6.3,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "LOW"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 3.4
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"cvssMetricV2": [
|
||||||
|
{
|
||||||
|
"source": "cna@vuldb.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "2.0",
|
||||||
|
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
|
||||||
|
"baseScore": 6.5,
|
||||||
|
"accessVector": "NETWORK",
|
||||||
|
"accessComplexity": "LOW",
|
||||||
|
"authentication": "SINGLE",
|
||||||
|
"confidentialityImpact": "PARTIAL",
|
||||||
|
"integrityImpact": "PARTIAL",
|
||||||
|
"availabilityImpact": "PARTIAL"
|
||||||
|
},
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"exploitabilityScore": 8.0,
|
||||||
|
"impactScore": 6.4,
|
||||||
|
"acInsufInfo": false,
|
||||||
|
"obtainAllPrivilege": false,
|
||||||
|
"obtainUserPrivilege": false,
|
||||||
|
"obtainOtherPrivilege": false,
|
||||||
|
"userInteractionRequired": false
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "cna@vuldb.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-74"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-89"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/datageartech/datagear/issues/29",
|
||||||
|
"source": "cna@vuldb.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://vuldb.com/?ctiid.285658",
|
||||||
|
"source": "cna@vuldb.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://vuldb.com/?id.285658",
|
||||||
|
"source": "cna@vuldb.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://vuldb.com/?submit.442943",
|
||||||
|
"source": "cna@vuldb.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
55
CVE-2024/CVE-2024-01xx/CVE-2024-0122.json
Normal file
55
CVE-2024/CVE-2024-01xx/CVE-2024-0122.json
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-0122",
|
||||||
|
"sourceIdentifier": "psirt@nvidia.com",
|
||||||
|
"published": "2024-11-23T00:15:04.223",
|
||||||
|
"lastModified": "2024-11-23T00:15:04.223",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker may cause an unauthorized action. A successful exploit of this vulnerability may lead to partial denial of service and confidential information disclosure."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "psirt@nvidia.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
|
||||||
|
"baseScore": 7.6,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "ADJACENT_NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "LOW"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 4.7
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "psirt@nvidia.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-862"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5570",
|
||||||
|
"source": "psirt@nvidia.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
55
CVE-2024/CVE-2024-01xx/CVE-2024-0138.json
Normal file
55
CVE-2024/CVE-2024-01xx/CVE-2024-0138.json
Normal file
@ -0,0 +1,55 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-0138",
|
||||||
|
"sourceIdentifier": "psirt@nvidia.com",
|
||||||
|
"published": "2024-11-23T00:15:04.367",
|
||||||
|
"lastModified": "2024-11-23T00:15:04.367",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "NVIDIA Base Command Manager contains a missing authentication vulnerability in the CMDaemon component. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "psirt@nvidia.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 9.8,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "psirt@nvidia.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-862"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5595",
|
||||||
|
"source": "psirt@nvidia.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2024-0229",
|
"id": "CVE-2024-0229",
|
||||||
"sourceIdentifier": "secalert@redhat.com",
|
"sourceIdentifier": "secalert@redhat.com",
|
||||||
"published": "2024-02-09T07:16:00.107",
|
"published": "2024-02-09T07:16:00.107",
|
||||||
"lastModified": "2024-10-18T13:49:32.090",
|
"lastModified": "2024-11-23T03:15:07.287",
|
||||||
"vulnStatus": "Analyzed",
|
"vulnStatus": "Modified",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -17,32 +16,14 @@
|
|||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
|
||||||
"source": "nvd@nist.gov",
|
|
||||||
"type": "Primary",
|
|
||||||
"cvssData": {
|
|
||||||
"version": "3.1",
|
|
||||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
||||||
"attackVector": "LOCAL",
|
|
||||||
"attackComplexity": "LOW",
|
|
||||||
"privilegesRequired": "LOW",
|
|
||||||
"userInteraction": "NONE",
|
|
||||||
"scope": "UNCHANGED",
|
|
||||||
"confidentialityImpact": "HIGH",
|
|
||||||
"integrityImpact": "HIGH",
|
|
||||||
"availabilityImpact": "HIGH",
|
|
||||||
"baseScore": 7.8,
|
|
||||||
"baseSeverity": "HIGH"
|
|
||||||
},
|
|
||||||
"exploitabilityScore": 1.8,
|
|
||||||
"impactScore": 5.9
|
|
||||||
},
|
|
||||||
{
|
{
|
||||||
"source": "secalert@redhat.com",
|
"source": "secalert@redhat.com",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 7.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
"attackVector": "LOCAL",
|
"attackVector": "LOCAL",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -50,9 +31,27 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "HIGH",
|
"confidentialityImpact": "HIGH",
|
||||||
"integrityImpact": "HIGH",
|
"integrityImpact": "HIGH",
|
||||||
"availabilityImpact": "HIGH",
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 1.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
"baseScore": 7.8,
|
"baseScore": 7.8,
|
||||||
"baseSeverity": "HIGH"
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "LOCAL",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 1.8,
|
"exploitabilityScore": 1.8,
|
||||||
"impactScore": 5.9
|
"impactScore": 5.9
|
||||||
@ -61,7 +60,7 @@
|
|||||||
},
|
},
|
||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
{
|
{
|
||||||
"source": "nvd@nist.gov",
|
"source": "secalert@redhat.com",
|
||||||
"type": "Primary",
|
"type": "Primary",
|
||||||
"description": [
|
"description": [
|
||||||
{
|
{
|
||||||
@ -71,12 +70,12 @@
|
|||||||
]
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"source": "secalert@redhat.com",
|
"source": "nvd@nist.gov",
|
||||||
"type": "Secondary",
|
"type": "Secondary",
|
||||||
"description": [
|
"description": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "CWE-788"
|
"value": "CWE-787"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -308,6 +307,119 @@
|
|||||||
"Issue Tracking",
|
"Issue Tracking",
|
||||||
"Third Party Advisory"
|
"Third Party Advisory"
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2024:0320",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2024:0557",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2024:0558",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2024:0597",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2024:0607",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2024:0614",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2024:0617",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2024:0621",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2024:0626",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2024:0629",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2024:2169",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2024:2170",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2024:2995",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/errata/RHSA-2024:2996",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://access.redhat.com/security/cve/CVE-2024-0229",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2256690",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108",
|
||||||
|
"tags": [
|
||||||
|
"Issue Tracking",
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
67
CVE-2024/CVE-2024-101xx/CVE-2024-10116.json
Normal file
67
CVE-2024/CVE-2024-101xx/CVE-2024-10116.json
Normal file
@ -0,0 +1,67 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-10116",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-11-23T04:15:07.360",
|
||||||
|
"lastModified": "2024-11-23T04:15:07.360",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "The Twitter Follow Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'username' parameter in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
|
||||||
|
"baseScore": 6.4,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.1,
|
||||||
|
"impactScore": 2.7
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-79"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/browser/twitter-follow/trunk/twitter-follow.php#L34",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3194573%40twitter-follow%2Ftrunk&old=1852833%40twitter-follow%2Ftrunk",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://wordpress.org/plugins/twitter-follow/#developers",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/fac89439-bd0a-4772-858d-d11dd0de54b6?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
67
CVE-2024/CVE-2024-102xx/CVE-2024-10216.json
Normal file
67
CVE-2024/CVE-2024-102xx/CVE-2024-10216.json
Normal file
@ -0,0 +1,67 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-10216",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-11-23T04:15:07.523",
|
||||||
|
"lastModified": "2024-11-23T04:15:07.523",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "The WP User Manager \u2013 User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'add_sidebar' and 'remove_sidebar' functions in all versions up to, and including, 2.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add or remove a Carbon Fields custom sidebar if the Carbon Fields (carbon-fields) plugin is installed."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
||||||
|
"baseScore": 4.3,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 1.4
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-862"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/browser/wp-user-manager/trunk/vendor-dist/htmlburger/carbon-fields/core/Libraries/Sidebar_Manager/Sidebar_Manager.php#L102",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/browser/wp-user-manager/trunk/vendor-dist/htmlburger/carbon-fields/core/Libraries/Sidebar_Manager/Sidebar_Manager.php#L79",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/changeset/3194404/wp-user-manager/trunk/includes/class-wp-user-manager.php",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3ab4e9c6-68b0-4113-bff0-c1d3c2d3dea4?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2024-10218",
|
"id": "CVE-2024-10218",
|
||||||
"sourceIdentifier": "security@tibco.com",
|
"sourceIdentifier": "security@tibco.com",
|
||||||
"published": "2024-11-12T20:15:05.913",
|
"published": "2024-11-12T20:15:05.913",
|
||||||
"lastModified": "2024-11-13T17:01:16.850",
|
"lastModified": "2024-11-22T21:15:07.950",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Awaiting Analysis",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -23,6 +22,8 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "4.0",
|
"version": "4.0",
|
||||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:L/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:X/U:Green",
|
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:L/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:X/U:Green",
|
||||||
|
"baseScore": 9.2,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"attackRequirements": "NONE",
|
"attackRequirements": "NONE",
|
||||||
@ -54,35 +55,23 @@
|
|||||||
"recovery": "USER",
|
"recovery": "USER",
|
||||||
"valueDensity": "CONCENTRATED",
|
"valueDensity": "CONCENTRATED",
|
||||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||||
"providerUrgency": "GREEN",
|
"providerUrgency": "GREEN"
|
||||||
"baseScore": 9.2,
|
|
||||||
"baseSeverity": "CRITICAL"
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
],
|
|
||||||
"cvssMetricV31": [
|
|
||||||
{
|
|
||||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
||||||
"type": "Secondary",
|
|
||||||
"cvssData": {
|
|
||||||
"version": "3.1",
|
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:H",
|
|
||||||
"attackVector": "NETWORK",
|
|
||||||
"attackComplexity": "LOW",
|
|
||||||
"privilegesRequired": "HIGH",
|
|
||||||
"userInteraction": "REQUIRED",
|
|
||||||
"scope": "UNCHANGED",
|
|
||||||
"confidentialityImpact": "LOW",
|
|
||||||
"integrityImpact": "NONE",
|
|
||||||
"availabilityImpact": "HIGH",
|
|
||||||
"baseScore": 5.2,
|
|
||||||
"baseSeverity": "MEDIUM"
|
|
||||||
},
|
|
||||||
"exploitabilityScore": 0.9,
|
|
||||||
"impactScore": 4.2
|
|
||||||
}
|
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-611"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://community.tibco.com/advisories",
|
"url": "https://community.tibco.com/advisories",
|
||||||
|
|||||||
63
CVE-2024/CVE-2024-102xx/CVE-2024-10220.json
Normal file
63
CVE-2024/CVE-2024-102xx/CVE-2024-10220.json
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-10220",
|
||||||
|
"sourceIdentifier": "jordan@liggitt.net",
|
||||||
|
"published": "2024-11-22T17:15:06.650",
|
||||||
|
"lastModified": "2024-11-22T17:15:06.650",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "jordan@liggitt.net",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
|
||||||
|
"baseScore": 8.1,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 5.2
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "jordan@liggitt.net",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-22"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/kubernetes/kubernetes/issues/128885",
|
||||||
|
"source": "jordan@liggitt.net"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://groups.google.com/g/kubernetes-security-announce/c/ptNgV5Necko",
|
||||||
|
"source": "jordan@liggitt.net"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "http://www.openwall.com/lists/oss-security/2024/11/20/1",
|
||||||
|
"source": "af854a3a-2127-422b-91ae-364da2661108"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2024-10450",
|
"id": "CVE-2024-10450",
|
||||||
"sourceIdentifier": "cna@vuldb.com",
|
"sourceIdentifier": "cna@vuldb.com",
|
||||||
"published": "2024-10-28T15:15:04.560",
|
"published": "2024-10-28T15:15:04.560",
|
||||||
"lastModified": "2024-10-29T14:34:50.257",
|
"lastModified": "2024-11-22T20:16:07.877",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -23,6 +22,8 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "4.0",
|
"version": "4.0",
|
||||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
|
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
|
||||||
|
"baseScore": 5.3,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"attackRequirements": "NONE",
|
"attackRequirements": "NONE",
|
||||||
@ -54,9 +55,7 @@
|
|||||||
"recovery": "NOT_DEFINED",
|
"recovery": "NOT_DEFINED",
|
||||||
"valueDensity": "NOT_DEFINED",
|
"valueDensity": "NOT_DEFINED",
|
||||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||||
"providerUrgency": "NOT_DEFINED",
|
"providerUrgency": "NOT_DEFINED"
|
||||||
"baseScore": 5.3,
|
|
||||||
"baseSeverity": "MEDIUM"
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
@ -67,6 +66,8 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
||||||
|
"baseScore": 6.3,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -74,12 +75,30 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "LOW",
|
"confidentialityImpact": "LOW",
|
||||||
"integrityImpact": "LOW",
|
"integrityImpact": "LOW",
|
||||||
"availabilityImpact": "LOW",
|
"availabilityImpact": "LOW"
|
||||||
"baseScore": 6.3,
|
|
||||||
"baseSeverity": "MEDIUM"
|
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 2.8,
|
"exploitabilityScore": 2.8,
|
||||||
"impactScore": 3.4
|
"impactScore": 3.4
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 9.8,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 5.9
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"cvssMetricV2": [
|
"cvssMetricV2": [
|
||||||
@ -89,13 +108,13 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "2.0",
|
"version": "2.0",
|
||||||
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
|
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
|
||||||
|
"baseScore": 6.5,
|
||||||
"accessVector": "NETWORK",
|
"accessVector": "NETWORK",
|
||||||
"accessComplexity": "LOW",
|
"accessComplexity": "LOW",
|
||||||
"authentication": "SINGLE",
|
"authentication": "SINGLE",
|
||||||
"confidentialityImpact": "PARTIAL",
|
"confidentialityImpact": "PARTIAL",
|
||||||
"integrityImpact": "PARTIAL",
|
"integrityImpact": "PARTIAL",
|
||||||
"availabilityImpact": "PARTIAL",
|
"availabilityImpact": "PARTIAL"
|
||||||
"baseScore": 6.5
|
|
||||||
},
|
},
|
||||||
"baseSeverity": "MEDIUM",
|
"baseSeverity": "MEDIUM",
|
||||||
"exploitabilityScore": 8.0,
|
"exploitabilityScore": 8.0,
|
||||||
@ -111,7 +130,7 @@
|
|||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
{
|
{
|
||||||
"source": "cna@vuldb.com",
|
"source": "cna@vuldb.com",
|
||||||
"type": "Primary",
|
"type": "Secondary",
|
||||||
"description": [
|
"description": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -120,26 +139,62 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:mayurik:advocate_office_management_system:1.0:*:*:*:*:*:*:*",
|
||||||
|
"matchCriteriaId": "D969EB85-DD8C-48DD-9D1F-58755EB5343A"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/Advocate-office-management-system.md",
|
"url": "https://github.com/will121351/wenqin.webray.com.cn/blob/main/CVE-project/Advocate-office-management-system.md",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Exploit",
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://vuldb.com/?ctiid.282010",
|
"url": "https://vuldb.com/?ctiid.282010",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Permissions Required",
|
||||||
|
"VDB Entry"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://vuldb.com/?id.282010",
|
"url": "https://vuldb.com/?id.282010",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory",
|
||||||
|
"VDB Entry"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://vuldb.com/?submit.432614",
|
"url": "https://vuldb.com/?submit.432614",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory",
|
||||||
|
"VDB Entry"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://www.sourcecodester.com/",
|
"url": "https://www.sourcecodester.com/",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Product"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
75
CVE-2024/CVE-2024-105xx/CVE-2024-10519.json
Normal file
75
CVE-2024/CVE-2024-105xx/CVE-2024-10519.json
Normal file
@ -0,0 +1,75 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-10519",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-11-23T10:15:03.600",
|
||||||
|
"lastModified": "2024-11-23T10:15:03.600",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "The Wishlist for WooCommerce: Multi Wishlists Per Customer PRO plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wtab' parameter in versions 3.0.8 to 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Note: Only WordPress installations with versions of PHP <=7.4 are affected by this vulnerability."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||||||
|
"baseScore": 6.1,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 2.7
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-79"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://github.com/wpcodefactory/wish-list-for-woocommerce/blame/master/templates/wish-list.php#L214",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://github.com/wpcodefactory/wish-list-for-woocommerce/blob/fafa2319a8907d3260a89a2a6b4fa9ea6602c7db/templates/wish-list.php#L94",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/browser/wish-list-for-woocommerce/trunk/templates/wish-list.php#L215",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/changeset/3189775/",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://wordpress.org/plugins/wish-list-for-woocommerce/#developers",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb14896f-7f0e-4168-8a2d-309bbaddbedc?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2024/CVE-2024-105xx/CVE-2024-10537.json
Normal file
59
CVE-2024/CVE-2024-105xx/CVE-2024-10537.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-10537",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-11-23T04:15:07.663",
|
||||||
|
"lastModified": "2024-11-23T04:15:07.663",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "The WP User Manager \u2013 User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the validate_user_meta_key() function in all versions up to, and including, 2.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate user meta keys."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
||||||
|
"baseScore": 4.3,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 1.4
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-862"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/changeset/3194404/wp-user-manager/trunk/includes/actions.php",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9e9a5b7e-db74-4c66-a659-85b2509fded4?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2024/CVE-2024-106xx/CVE-2024-10606.json
Normal file
59
CVE-2024/CVE-2024-106xx/CVE-2024-10606.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-10606",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-11-23T05:15:05.223",
|
||||||
|
"lastModified": "2024-11-23T05:15:05.223",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "The WP Travel Engine \u2013 Tour Booking Plugin \u2013 Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpte_onboard_save_function_callback() function in all versions up to, and including, 6.2.1. This makes it possible for authenticated attackers, with contributor-level access and above, to modify several settings that could have an impact such as lost revenue and page updates."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
||||||
|
"baseScore": 4.3,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 1.4
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-862"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/changeset/3193913/wp-travel-engine/tags/6.2.2/includes/class-wp-travel-engine-onboard.php",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c91d1ec0-0430-4ddd-b6b1-25af0b5cea9d?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2024/CVE-2024-108xx/CVE-2024-10803.json
Normal file
59
CVE-2024/CVE-2024-108xx/CVE-2024-10803.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-10803",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-11-23T08:15:03.413",
|
||||||
|
"lastModified": "2024-11-23T08:15:03.413",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "The MP3 Sticky Player plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.0 via the content/downloader.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Please note the vendor released the patched version as the same version as the affected version."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 7.5,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 3.6
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-22"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://codecanyon.net/item/mp3-sticky-player-wordpress-plugin/7930491",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3bcd4675-e930-44d9-8278-c4c9e877656a?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2024/CVE-2024-108xx/CVE-2024-10813.json
Normal file
59
CVE-2024/CVE-2024-108xx/CVE-2024-10813.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-10813",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-11-23T04:15:07.800",
|
||||||
|
"lastModified": "2024-11-23T04:15:07.800",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "The Product Table for WooCommerce by CodeAstrology (wooproducttable.com) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1 via the var_dump_table parameter. This makes it possible for unauthenticated attackers var data."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
||||||
|
"baseScore": 5.3,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 1.4
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-862"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/browser/woo-product-table/trunk/inc/shortcode-base.php",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e67f680a-8942-45fa-8458-a27c78045aa1?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
77
CVE-2024/CVE-2024-108xx/CVE-2024-10863.json
Normal file
77
CVE-2024/CVE-2024-108xx/CVE-2024-10863.json
Normal file
@ -0,0 +1,77 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-10863",
|
||||||
|
"sourceIdentifier": "security@opentext.com",
|
||||||
|
"published": "2024-11-22T16:15:21.257",
|
||||||
|
"lastModified": "2024-11-22T16:15:21.257",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": ": Insufficient Logging vulnerability in OpenText Secure Content Manager on Windows allows Audit Log Manipulation.This issue affects Secure Content Manager: from 10.1 before <24.4.\n\n\n\nEnd-users can potentially exploit the vulnerability to exclude audit trails from being recorded on the client side."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV40": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "4.0",
|
||||||
|
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
|
||||||
|
"baseScore": 5.1,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"attackRequirements": "NONE",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "PASSIVE",
|
||||||
|
"vulnerableSystemConfidentiality": "NONE",
|
||||||
|
"vulnerableSystemIntegrity": "LOW",
|
||||||
|
"vulnerableSystemAvailability": "NONE",
|
||||||
|
"subsequentSystemConfidentiality": "NONE",
|
||||||
|
"subsequentSystemIntegrity": "NONE",
|
||||||
|
"subsequentSystemAvailability": "NONE",
|
||||||
|
"exploitMaturity": "NOT_DEFINED",
|
||||||
|
"confidentialityRequirements": "NOT_DEFINED",
|
||||||
|
"integrityRequirements": "NOT_DEFINED",
|
||||||
|
"availabilityRequirements": "NOT_DEFINED",
|
||||||
|
"modifiedAttackVector": "NOT_DEFINED",
|
||||||
|
"modifiedAttackComplexity": "NOT_DEFINED",
|
||||||
|
"modifiedAttackRequirements": "NOT_DEFINED",
|
||||||
|
"modifiedPrivilegesRequired": "NOT_DEFINED",
|
||||||
|
"modifiedUserInteraction": "NOT_DEFINED",
|
||||||
|
"modifiedVulnerableSystemConfidentiality": "NOT_DEFINED",
|
||||||
|
"modifiedVulnerableSystemIntegrity": "NOT_DEFINED",
|
||||||
|
"modifiedVulnerableSystemAvailability": "NOT_DEFINED",
|
||||||
|
"modifiedSubsequentSystemConfidentiality": "NOT_DEFINED",
|
||||||
|
"modifiedSubsequentSystemIntegrity": "NOT_DEFINED",
|
||||||
|
"modifiedSubsequentSystemAvailability": "NOT_DEFINED",
|
||||||
|
"safety": "NOT_DEFINED",
|
||||||
|
"automatable": "NOT_DEFINED",
|
||||||
|
"recovery": "NOT_DEFINED",
|
||||||
|
"valueDensity": "NOT_DEFINED",
|
||||||
|
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||||
|
"providerUrgency": "NOT_DEFINED"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@opentext.com",
|
||||||
|
"type": "Secondary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-778"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://portal.microfocus.com/s/article/KM000036389?",
|
||||||
|
"source": "security@opentext.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2024/CVE-2024-108xx/CVE-2024-10868.json
Normal file
59
CVE-2024/CVE-2024-108xx/CVE-2024-10868.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-10868",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-11-23T04:15:07.930",
|
||||||
|
"lastModified": "2024-11-23T04:15:07.930",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "The Enter Addons \u2013 Ultimate Template Builder for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.9 via the Advanced Tabs widget due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
||||||
|
"baseScore": 4.3,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 1.4
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-639"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://wordpress.org/plugins/enteraddons/",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ff8e8889-ec02-4b8d-9509-2c6335fdd9a4?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
63
CVE-2024/CVE-2024-108xx/CVE-2024-10869.json
Normal file
63
CVE-2024/CVE-2024-108xx/CVE-2024-10869.json
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-10869",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-11-23T04:15:08.073",
|
||||||
|
"lastModified": "2024-11-23T04:15:08.073",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "The WordPress Brute Force Protection \u2013 Stop Brute Force Attacks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.2.6. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||||||
|
"baseScore": 6.1,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 2.7
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-79"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/browser/guardgiant/tags/2.2.6/includes/class-guardgiant-table-login-activity-log.php#L483",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/browser/guardgiant/tags/2.2.6/includes/class-guardgiant-table-login-activity-log.php#L491",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0cca8b75-c4f5-47ef-90a1-c1270e2f37c1?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
@ -2,23 +2,28 @@
|
|||||||
"id": "CVE-2024-10872",
|
"id": "CVE-2024-10872",
|
||||||
"sourceIdentifier": "security@wordfence.com",
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
"published": "2024-11-20T11:15:04.927",
|
"published": "2024-11-20T11:15:04.927",
|
||||||
"lastModified": "2024-11-20T11:15:04.927",
|
"lastModified": "2024-11-23T00:59:11.440",
|
||||||
"vulnStatus": "Received",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
"value": "The Getwid \u2013 Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `template-post-custom-field` block in all versions up to, and including, 2.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
|
"value": "The Getwid \u2013 Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `template-post-custom-field` block in all versions up to, and including, 2.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"lang": "es",
|
||||||
|
"value": "El complemento Getwid \u2013 Gutenberg Blocks para WordPress es vulnerable a cross site scripting almacenado a trav\u00e9s del bloque `template-post-custom-field` en todas las versiones hasta la 2.0.12 incluida, debido a una desinfecci\u00f3n de entrada y un escape de salida insuficientes. Esto permite que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten secuencias de comandos web arbitrarias en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"metrics": {
|
"metrics": {
|
||||||
"cvssMetricV31": [
|
"cvssMetricV31": [
|
||||||
{
|
{
|
||||||
"source": "security@wordfence.com",
|
"source": "security@wordfence.com",
|
||||||
"type": "Primary",
|
"type": "Secondary",
|
||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
|
||||||
|
"baseScore": 6.4,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -26,12 +31,30 @@
|
|||||||
"scope": "CHANGED",
|
"scope": "CHANGED",
|
||||||
"confidentialityImpact": "LOW",
|
"confidentialityImpact": "LOW",
|
||||||
"integrityImpact": "LOW",
|
"integrityImpact": "LOW",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
"baseScore": 6.4,
|
|
||||||
"baseSeverity": "MEDIUM"
|
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 3.1,
|
"exploitabilityScore": 3.1,
|
||||||
"impactScore": 2.7
|
"impactScore": 2.7
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
||||||
|
"baseScore": 5.4,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.3,
|
||||||
|
"impactScore": 2.7
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
@ -47,18 +70,45 @@
|
|||||||
]
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:motopress:getwid:*:*:*:*:*:wordpress:*:*",
|
||||||
|
"versionEndIncluding": "2.0.12",
|
||||||
|
"matchCriteriaId": "91E52DC1-98EC-4F75-8EF1-CE62E84B1639"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://plugins.trac.wordpress.org/browser/getwid/trunk/includes/templates/template-parts/post-custom-field.php#L9",
|
"url": "https://plugins.trac.wordpress.org/browser/getwid/trunk/includes/templates/template-parts/post-custom-field.php#L9",
|
||||||
"source": "security@wordfence.com"
|
"source": "security@wordfence.com",
|
||||||
|
"tags": [
|
||||||
|
"Product"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://plugins.trac.wordpress.org/changeset/3188812#file1",
|
"url": "https://plugins.trac.wordpress.org/changeset/3188812#file1",
|
||||||
"source": "security@wordfence.com"
|
"source": "security@wordfence.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8ae0030f-af21-43fb-959a-8da04cab05bb?source=cve",
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8ae0030f-af21-43fb-959a-8da04cab05bb?source=cve",
|
||||||
"source": "security@wordfence.com"
|
"source": "security@wordfence.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
75
CVE-2024/CVE-2024-108xx/CVE-2024-10873.json
Normal file
75
CVE-2024/CVE-2024-108xx/CVE-2024-10873.json
Normal file
@ -0,0 +1,75 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-10873",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-11-23T05:15:06.010",
|
||||||
|
"lastModified": "2024-11-23T05:15:06.010",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the _load_template function. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 8.8,
|
||||||
|
"baseSeverity": "HIGH",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-98"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/browser/lastudio-element-kit/trunk/includes/base/class-widget-base.php#L118",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/browser/lastudio-element-kit/trunk/includes/base/class-widget-base.php#L141",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/browser/lastudio-element-kit/trunk/includes/extensions/albums/widget-templates/player/global/index.php",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/browser/lastudio-element-kit/trunk/includes/extensions/albums/widget-templates/player/global/index.php#L26",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3194361%40lastudio-element-kit&new=3194361%40lastudio-element-kit&sfp_email=&sfph_mail=",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/59415c36-e48a-4c05-ad22-8d55a9e13bcd?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2024/CVE-2024-108xx/CVE-2024-10874.json
Normal file
59
CVE-2024/CVE-2024-108xx/CVE-2024-10874.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-10874",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-11-23T04:15:08.207",
|
||||||
|
"lastModified": "2024-11-23T04:15:08.207",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "The Quotes llama plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quotes-llama' shortcode in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
|
||||||
|
"baseScore": 6.4,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.1,
|
||||||
|
"impactScore": 2.7
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-79"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/browser/quotes-llama/tags/3.0.0/includes/classes/class-quotesllama-search.php#L131",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e2f3abd-0a15-4bc1-966a-22d606f3e333?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
67
CVE-2024/CVE-2024-108xx/CVE-2024-10880.json
Normal file
67
CVE-2024/CVE-2024-108xx/CVE-2024-10880.json
Normal file
@ -0,0 +1,67 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-10880",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-11-23T05:15:06.207",
|
||||||
|
"lastModified": "2024-11-23T05:15:06.207",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "The JobBoardWP \u2013 Job Board Listings and Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||||||
|
"baseScore": 6.1,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 2.7
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-79"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/browser/jobboardwp/tags/1.2.8/includes/admin/class-emails-list-table.php#L168",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/browser/jobboardwp/tags/1.2.8/includes/admin/class-emails-list-table.php#L192",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3194143%40jobboardwp&new=3194143%40jobboardwp&sfp_email=&sfph_mail=",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/07b48c64-aa54-4b9b-b1ee-c0f065e2aaa4?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
59
CVE-2024/CVE-2024-108xx/CVE-2024-10886.json
Normal file
59
CVE-2024/CVE-2024-108xx/CVE-2024-10886.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-10886",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-11-23T04:15:08.340",
|
||||||
|
"lastModified": "2024-11-23T04:15:08.340",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "The Tribute Testimonials \u2013 WordPress Testimonial Grid/Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tribute_testimonials_slider' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
|
||||||
|
"baseScore": 6.4,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.1,
|
||||||
|
"impactScore": 2.7
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-79"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://plugins.trac.wordpress.org/browser/tribute-testimonial-gridslider/tags/1.0.4/includes/class-tribute-shortcode-generator.php",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e461095-8dce-4502-8bbf-8c985105cf24?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2024-10920",
|
"id": "CVE-2024-10920",
|
||||||
"sourceIdentifier": "cna@vuldb.com",
|
"sourceIdentifier": "cna@vuldb.com",
|
||||||
"published": "2024-11-06T16:15:05.930",
|
"published": "2024-11-06T16:15:05.930",
|
||||||
"lastModified": "2024-11-06T18:17:17.287",
|
"lastModified": "2024-11-22T20:05:52.530",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -23,6 +22,8 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "4.0",
|
"version": "4.0",
|
||||||
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
|
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
|
||||||
|
"baseScore": 2.3,
|
||||||
|
"baseSeverity": "LOW",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "HIGH",
|
"attackComplexity": "HIGH",
|
||||||
"attackRequirements": "NONE",
|
"attackRequirements": "NONE",
|
||||||
@ -54,9 +55,7 @@
|
|||||||
"recovery": "NOT_DEFINED",
|
"recovery": "NOT_DEFINED",
|
||||||
"valueDensity": "NOT_DEFINED",
|
"valueDensity": "NOT_DEFINED",
|
||||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||||
"providerUrgency": "NOT_DEFINED",
|
"providerUrgency": "NOT_DEFINED"
|
||||||
"baseScore": 2.3,
|
|
||||||
"baseSeverity": "LOW"
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
@ -67,6 +66,8 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
|
||||||
|
"baseScore": 3.1,
|
||||||
|
"baseSeverity": "LOW",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "HIGH",
|
"attackComplexity": "HIGH",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -74,12 +75,30 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "NONE",
|
"confidentialityImpact": "NONE",
|
||||||
"integrityImpact": "LOW",
|
"integrityImpact": "LOW",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
"baseScore": 3.1,
|
|
||||||
"baseSeverity": "LOW"
|
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 1.6,
|
"exploitabilityScore": 1.6,
|
||||||
"impactScore": 1.4
|
"impactScore": 1.4
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
||||||
|
"baseScore": 3.7,
|
||||||
|
"baseSeverity": "LOW",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "HIGH",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "NONE",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.2,
|
||||||
|
"impactScore": 1.4
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"cvssMetricV2": [
|
"cvssMetricV2": [
|
||||||
@ -89,13 +108,13 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "2.0",
|
"version": "2.0",
|
||||||
"vectorString": "AV:N/AC:H/Au:S/C:N/I:P/A:N",
|
"vectorString": "AV:N/AC:H/Au:S/C:N/I:P/A:N",
|
||||||
|
"baseScore": 2.1,
|
||||||
"accessVector": "NETWORK",
|
"accessVector": "NETWORK",
|
||||||
"accessComplexity": "HIGH",
|
"accessComplexity": "HIGH",
|
||||||
"authentication": "SINGLE",
|
"authentication": "SINGLE",
|
||||||
"confidentialityImpact": "NONE",
|
"confidentialityImpact": "NONE",
|
||||||
"integrityImpact": "PARTIAL",
|
"integrityImpact": "PARTIAL",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
"baseScore": 2.1
|
|
||||||
},
|
},
|
||||||
"baseSeverity": "LOW",
|
"baseSeverity": "LOW",
|
||||||
"exploitabilityScore": 3.9,
|
"exploitabilityScore": 3.9,
|
||||||
@ -111,7 +130,7 @@
|
|||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
{
|
{
|
||||||
"source": "cna@vuldb.com",
|
"source": "cna@vuldb.com",
|
||||||
"type": "Primary",
|
"type": "Secondary",
|
||||||
"description": [
|
"description": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -122,24 +141,65 @@
|
|||||||
"value": "CWE-321"
|
"value": "CWE-321"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-798"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:mariazevedo88:travels-java-api:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndIncluding": "5.0.1",
|
||||||
|
"matchCriteriaId": "DA8D4957-2DFF-4D2D-9BE0-1D7EE3E5C60F"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://github.com/mariazevedo88/travels-java-api/issues/23",
|
"url": "https://github.com/mariazevedo88/travels-java-api/issues/23",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Exploit",
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://vuldb.com/?ctiid.283316",
|
"url": "https://vuldb.com/?ctiid.283316",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Permissions Required"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://vuldb.com/?id.283316",
|
"url": "https://vuldb.com/?id.283316",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Permissions Required"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://vuldb.com/?submit.433458",
|
"url": "https://vuldb.com/?submit.433458",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2024-10927",
|
"id": "CVE-2024-10927",
|
||||||
"sourceIdentifier": "cna@vuldb.com",
|
"sourceIdentifier": "cna@vuldb.com",
|
||||||
"published": "2024-11-06T23:15:03.623",
|
"published": "2024-11-06T23:15:03.623",
|
||||||
"lastModified": "2024-11-08T19:01:25.633",
|
"lastModified": "2024-11-22T19:14:48.190",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -23,6 +22,8 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "4.0",
|
"version": "4.0",
|
||||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
|
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
|
||||||
|
"baseScore": 5.3,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"attackRequirements": "NONE",
|
"attackRequirements": "NONE",
|
||||||
@ -54,9 +55,7 @@
|
|||||||
"recovery": "NOT_DEFINED",
|
"recovery": "NOT_DEFINED",
|
||||||
"valueDensity": "NOT_DEFINED",
|
"valueDensity": "NOT_DEFINED",
|
||||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||||
"providerUrgency": "NOT_DEFINED",
|
"providerUrgency": "NOT_DEFINED"
|
||||||
"baseScore": 5.3,
|
|
||||||
"baseSeverity": "MEDIUM"
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
@ -67,6 +66,8 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
|
||||||
|
"baseScore": 3.5,
|
||||||
|
"baseSeverity": "LOW",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -74,12 +75,30 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "NONE",
|
"confidentialityImpact": "NONE",
|
||||||
"integrityImpact": "LOW",
|
"integrityImpact": "LOW",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
"baseScore": 3.5,
|
|
||||||
"baseSeverity": "LOW"
|
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 2.1,
|
"exploitabilityScore": 2.1,
|
||||||
"impactScore": 1.4
|
"impactScore": 1.4
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||||||
|
"baseScore": 6.1,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 2.7
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"cvssMetricV2": [
|
"cvssMetricV2": [
|
||||||
@ -89,13 +108,13 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "2.0",
|
"version": "2.0",
|
||||||
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
|
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
|
||||||
|
"baseScore": 4.0,
|
||||||
"accessVector": "NETWORK",
|
"accessVector": "NETWORK",
|
||||||
"accessComplexity": "LOW",
|
"accessComplexity": "LOW",
|
||||||
"authentication": "SINGLE",
|
"authentication": "SINGLE",
|
||||||
"confidentialityImpact": "NONE",
|
"confidentialityImpact": "NONE",
|
||||||
"integrityImpact": "PARTIAL",
|
"integrityImpact": "PARTIAL",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
"baseScore": 4.0
|
|
||||||
},
|
},
|
||||||
"baseSeverity": "MEDIUM",
|
"baseSeverity": "MEDIUM",
|
||||||
"exploitabilityScore": 8.0,
|
"exploitabilityScore": 8.0,
|
||||||
@ -111,7 +130,7 @@
|
|||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
{
|
{
|
||||||
"source": "cna@vuldb.com",
|
"source": "cna@vuldb.com",
|
||||||
"type": "Primary",
|
"type": "Secondary",
|
||||||
"description": [
|
"description": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -122,24 +141,65 @@
|
|||||||
"value": "CWE-79"
|
"value": "CWE-79"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-79"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:monocms:monocms:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndIncluding": "2024-05-28",
|
||||||
|
"matchCriteriaId": "0ED64D99-9DEE-4ECF-B9B8-C0F1078A3763"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://github.com/secuserx/CVE/blob/main/%5BXSS%20vulnerability%5D%20found%20in%20MonoCMS%2023-20240528%20-%20(account.php).md",
|
"url": "https://github.com/secuserx/CVE/blob/main/%5BXSS%20vulnerability%5D%20found%20in%20MonoCMS%2023-20240528%20-%20(account.php).md",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Exploit",
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://vuldb.com/?ctiid.283326",
|
"url": "https://vuldb.com/?ctiid.283326",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Permissions Required"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://vuldb.com/?id.283326",
|
"url": "https://vuldb.com/?id.283326",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://vuldb.com/?submit.434188",
|
"url": "https://vuldb.com/?submit.434188",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
@ -2,8 +2,8 @@
|
|||||||
"id": "CVE-2024-10928",
|
"id": "CVE-2024-10928",
|
||||||
"sourceIdentifier": "cna@vuldb.com",
|
"sourceIdentifier": "cna@vuldb.com",
|
||||||
"published": "2024-11-06T23:15:04.007",
|
"published": "2024-11-06T23:15:04.007",
|
||||||
"lastModified": "2024-11-08T19:01:25.633",
|
"lastModified": "2024-11-22T19:10:19.290",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [
|
"cveTags": [
|
||||||
{
|
{
|
||||||
"sourceIdentifier": "cna@vuldb.com",
|
"sourceIdentifier": "cna@vuldb.com",
|
||||||
@ -30,6 +30,8 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "4.0",
|
"version": "4.0",
|
||||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
|
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
|
||||||
|
"baseScore": 5.3,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"attackRequirements": "NONE",
|
"attackRequirements": "NONE",
|
||||||
@ -61,9 +63,7 @@
|
|||||||
"recovery": "NOT_DEFINED",
|
"recovery": "NOT_DEFINED",
|
||||||
"valueDensity": "NOT_DEFINED",
|
"valueDensity": "NOT_DEFINED",
|
||||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||||
"providerUrgency": "NOT_DEFINED",
|
"providerUrgency": "NOT_DEFINED"
|
||||||
"baseScore": 5.3,
|
|
||||||
"baseSeverity": "MEDIUM"
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
@ -74,6 +74,8 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
|
||||||
|
"baseScore": 3.5,
|
||||||
|
"baseSeverity": "LOW",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -81,12 +83,30 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "NONE",
|
"confidentialityImpact": "NONE",
|
||||||
"integrityImpact": "LOW",
|
"integrityImpact": "LOW",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
"baseScore": 3.5,
|
|
||||||
"baseSeverity": "LOW"
|
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 2.1,
|
"exploitabilityScore": 2.1,
|
||||||
"impactScore": 1.4
|
"impactScore": 1.4
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||||||
|
"baseScore": 6.1,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "REQUIRED",
|
||||||
|
"scope": "CHANGED",
|
||||||
|
"confidentialityImpact": "LOW",
|
||||||
|
"integrityImpact": "LOW",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 2.7
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"cvssMetricV2": [
|
"cvssMetricV2": [
|
||||||
@ -96,13 +116,13 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "2.0",
|
"version": "2.0",
|
||||||
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
|
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
|
||||||
|
"baseScore": 4.0,
|
||||||
"accessVector": "NETWORK",
|
"accessVector": "NETWORK",
|
||||||
"accessComplexity": "LOW",
|
"accessComplexity": "LOW",
|
||||||
"authentication": "SINGLE",
|
"authentication": "SINGLE",
|
||||||
"confidentialityImpact": "NONE",
|
"confidentialityImpact": "NONE",
|
||||||
"integrityImpact": "PARTIAL",
|
"integrityImpact": "PARTIAL",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
"baseScore": 4.0
|
|
||||||
},
|
},
|
||||||
"baseSeverity": "MEDIUM",
|
"baseSeverity": "MEDIUM",
|
||||||
"exploitabilityScore": 8.0,
|
"exploitabilityScore": 8.0,
|
||||||
@ -118,7 +138,7 @@
|
|||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
{
|
{
|
||||||
"source": "cna@vuldb.com",
|
"source": "cna@vuldb.com",
|
||||||
"type": "Primary",
|
"type": "Secondary",
|
||||||
"description": [
|
"description": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -129,24 +149,65 @@
|
|||||||
"value": "CWE-79"
|
"value": "CWE-79"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-79"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:monocms:monocms:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndIncluding": "2024-05-28",
|
||||||
|
"matchCriteriaId": "0ED64D99-9DEE-4ECF-B9B8-C0F1078A3763"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://github.com/secuserx/CVE/blob/main/%5BXSS%20vulnerability%5D%20found%20in%20MonoCMS%2023-20240528%20-%20(opensaved.php).md",
|
"url": "https://github.com/secuserx/CVE/blob/main/%5BXSS%20vulnerability%5D%20found%20in%20MonoCMS%2023-20240528%20-%20(opensaved.php).md",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Exploit",
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://vuldb.com/?ctiid.283327",
|
"url": "https://vuldb.com/?ctiid.283327",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Permissions Required"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://vuldb.com/?id.283327",
|
"url": "https://vuldb.com/?id.283327",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://vuldb.com/?submit.434189",
|
"url": "https://vuldb.com/?submit.434189",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
59
CVE-2024/CVE-2024-109xx/CVE-2024-10961.json
Normal file
59
CVE-2024/CVE-2024-109xx/CVE-2024-10961.json
Normal file
@ -0,0 +1,59 @@
|
|||||||
|
{
|
||||||
|
"id": "CVE-2024-10961",
|
||||||
|
"sourceIdentifier": "security@wordfence.com",
|
||||||
|
"published": "2024-11-23T04:15:08.470",
|
||||||
|
"lastModified": "2024-11-23T04:15:08.470",
|
||||||
|
"vulnStatus": "Received",
|
||||||
|
"descriptions": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "The Social Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.9.0. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token."
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"metrics": {
|
||||||
|
"cvssMetricV31": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||||
|
"baseScore": 9.8,
|
||||||
|
"baseSeverity": "CRITICAL",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "NONE",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "HIGH",
|
||||||
|
"availabilityImpact": "HIGH"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 3.9,
|
||||||
|
"impactScore": 5.9
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"weaknesses": [
|
||||||
|
{
|
||||||
|
"source": "security@wordfence.com",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "CWE-288"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"references": [
|
||||||
|
{
|
||||||
|
"url": "https://wordpress.org/plugins/oa-social-login/",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/43a64074-ca64-4c34-b467-06d1ad8c5aa0?source=cve",
|
||||||
|
"source": "security@wordfence.com"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
@ -2,9 +2,8 @@
|
|||||||
"id": "CVE-2024-10965",
|
"id": "CVE-2024-10965",
|
||||||
"sourceIdentifier": "cna@vuldb.com",
|
"sourceIdentifier": "cna@vuldb.com",
|
||||||
"published": "2024-11-07T17:15:06.890",
|
"published": "2024-11-07T17:15:06.890",
|
||||||
"lastModified": "2024-11-08T19:01:03.880",
|
"lastModified": "2024-11-23T01:45:14.267",
|
||||||
"vulnStatus": "Awaiting Analysis",
|
"vulnStatus": "Analyzed",
|
||||||
"cveTags": [],
|
|
||||||
"descriptions": [
|
"descriptions": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -23,6 +22,8 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "4.0",
|
"version": "4.0",
|
||||||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
|
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
|
||||||
|
"baseScore": 5.3,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"attackRequirements": "NONE",
|
"attackRequirements": "NONE",
|
||||||
@ -54,9 +55,7 @@
|
|||||||
"recovery": "NOT_DEFINED",
|
"recovery": "NOT_DEFINED",
|
||||||
"valueDensity": "NOT_DEFINED",
|
"valueDensity": "NOT_DEFINED",
|
||||||
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
"vulnerabilityResponseEffort": "NOT_DEFINED",
|
||||||
"providerUrgency": "NOT_DEFINED",
|
"providerUrgency": "NOT_DEFINED"
|
||||||
"baseScore": 5.3,
|
|
||||||
"baseSeverity": "MEDIUM"
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
@ -67,6 +66,8 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "3.1",
|
"version": "3.1",
|
||||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
|
||||||
|
"baseScore": 4.3,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
"attackVector": "NETWORK",
|
"attackVector": "NETWORK",
|
||||||
"attackComplexity": "LOW",
|
"attackComplexity": "LOW",
|
||||||
"privilegesRequired": "LOW",
|
"privilegesRequired": "LOW",
|
||||||
@ -74,12 +75,30 @@
|
|||||||
"scope": "UNCHANGED",
|
"scope": "UNCHANGED",
|
||||||
"confidentialityImpact": "LOW",
|
"confidentialityImpact": "LOW",
|
||||||
"integrityImpact": "NONE",
|
"integrityImpact": "NONE",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
"baseScore": 4.3,
|
|
||||||
"baseSeverity": "MEDIUM"
|
|
||||||
},
|
},
|
||||||
"exploitabilityScore": 2.8,
|
"exploitabilityScore": 2.8,
|
||||||
"impactScore": 1.4
|
"impactScore": 1.4
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"cvssData": {
|
||||||
|
"version": "3.1",
|
||||||
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||||
|
"baseScore": 6.5,
|
||||||
|
"baseSeverity": "MEDIUM",
|
||||||
|
"attackVector": "NETWORK",
|
||||||
|
"attackComplexity": "LOW",
|
||||||
|
"privilegesRequired": "LOW",
|
||||||
|
"userInteraction": "NONE",
|
||||||
|
"scope": "UNCHANGED",
|
||||||
|
"confidentialityImpact": "HIGH",
|
||||||
|
"integrityImpact": "NONE",
|
||||||
|
"availabilityImpact": "NONE"
|
||||||
|
},
|
||||||
|
"exploitabilityScore": 2.8,
|
||||||
|
"impactScore": 3.6
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"cvssMetricV2": [
|
"cvssMetricV2": [
|
||||||
@ -89,13 +108,13 @@
|
|||||||
"cvssData": {
|
"cvssData": {
|
||||||
"version": "2.0",
|
"version": "2.0",
|
||||||
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
|
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
|
||||||
|
"baseScore": 4.0,
|
||||||
"accessVector": "NETWORK",
|
"accessVector": "NETWORK",
|
||||||
"accessComplexity": "LOW",
|
"accessComplexity": "LOW",
|
||||||
"authentication": "SINGLE",
|
"authentication": "SINGLE",
|
||||||
"confidentialityImpact": "PARTIAL",
|
"confidentialityImpact": "PARTIAL",
|
||||||
"integrityImpact": "NONE",
|
"integrityImpact": "NONE",
|
||||||
"availabilityImpact": "NONE",
|
"availabilityImpact": "NONE"
|
||||||
"baseScore": 4.0
|
|
||||||
},
|
},
|
||||||
"baseSeverity": "MEDIUM",
|
"baseSeverity": "MEDIUM",
|
||||||
"exploitabilityScore": 8.0,
|
"exploitabilityScore": 8.0,
|
||||||
@ -111,7 +130,7 @@
|
|||||||
"weaknesses": [
|
"weaknesses": [
|
||||||
{
|
{
|
||||||
"source": "cna@vuldb.com",
|
"source": "cna@vuldb.com",
|
||||||
"type": "Primary",
|
"type": "Secondary",
|
||||||
"description": [
|
"description": [
|
||||||
{
|
{
|
||||||
"lang": "en",
|
"lang": "en",
|
||||||
@ -122,32 +141,81 @@
|
|||||||
"value": "CWE-284"
|
"value": "CWE-284"
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"source": "nvd@nist.gov",
|
||||||
|
"type": "Primary",
|
||||||
|
"description": [
|
||||||
|
{
|
||||||
|
"lang": "en",
|
||||||
|
"value": "NVD-CWE-noinfo"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"configurations": [
|
||||||
|
{
|
||||||
|
"nodes": [
|
||||||
|
{
|
||||||
|
"operator": "OR",
|
||||||
|
"negate": false,
|
||||||
|
"cpeMatch": [
|
||||||
|
{
|
||||||
|
"vulnerable": true,
|
||||||
|
"criteria": "cpe:2.3:a:emqx:neuron:*:*:*:*:*:*:*:*",
|
||||||
|
"versionEndIncluding": "2.10.0",
|
||||||
|
"matchCriteriaId": "E3F83EB1-2071-47DC-9382-73C637394004"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"references": [
|
"references": [
|
||||||
{
|
{
|
||||||
"url": "https://github.com/emqx/neuron/issues/2281",
|
"url": "https://github.com/emqx/neuron/issues/2281",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Exploit",
|
||||||
|
"Issue Tracking",
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://github.com/emqx/neuron/pull/2282",
|
"url": "https://github.com/emqx/neuron/pull/2282",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Issue Tracking",
|
||||||
|
"Patch"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://github.com/fengzeroz/neuron/commit/c9ce39747e0372aaa2157b2b56174914a12c06d8",
|
"url": "https://github.com/fengzeroz/neuron/commit/c9ce39747e0372aaa2157b2b56174914a12c06d8",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Patch"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://vuldb.com/?ctiid.283411",
|
"url": "https://vuldb.com/?ctiid.283411",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Permissions Required"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://vuldb.com/?id.283411",
|
"url": "https://vuldb.com/?id.283411",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
"url": "https://vuldb.com/?submit.435375",
|
"url": "https://vuldb.com/?submit.435375",
|
||||||
"source": "cna@vuldb.com"
|
"source": "cna@vuldb.com",
|
||||||
|
"tags": [
|
||||||
|
"Third Party Advisory"
|
||||||
|
]
|
||||||
}
|
}
|
||||||
]
|
]
|
||||||
}
|
}
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user