From e24b319bca8faa9a2b4fb7d50c9c633c2e36443e Mon Sep 17 00:00:00 2001 From: cad-safe-bot Date: Tue, 25 Jul 2023 10:00:32 +0000 Subject: [PATCH] Auto-Update: 2023-07-25T10:00:28.960660+00:00 --- CVE-2022/CVE-2022-08xx/CVE-2022-0828.json | 12 +-- CVE-2022/CVE-2022-08xx/CVE-2022-0837.json | 10 +-- CVE-2022/CVE-2022-14xx/CVE-2022-1412.json | 10 +-- CVE-2022/CVE-2022-15xx/CVE-2022-1551.json | 12 +-- CVE-2022/CVE-2022-20xx/CVE-2022-2083.json | 10 +-- CVE-2022/CVE-2022-317xx/CVE-2022-31781.json | 10 +-- CVE-2022/CVE-2022-338xx/CVE-2022-33891.json | 10 +-- CVE-2022/CVE-2022-374xx/CVE-2022-37400.json | 10 +-- CVE-2022/CVE-2022-374xx/CVE-2022-37401.json | 14 ++-- CVE-2022/CVE-2022-374xx/CVE-2022-37435.json | 10 +-- CVE-2023/CVE-2023-214xx/CVE-2023-21405.json | 43 ++++++++++ CVE-2023/CVE-2023-214xx/CVE-2023-21406.json | 43 ++++++++++ CVE-2023/CVE-2023-341xx/CVE-2023-34189.json | 32 ++++++++ CVE-2023/CVE-2023-344xx/CVE-2023-34434.json | 32 ++++++++ CVE-2023/CVE-2023-350xx/CVE-2023-35088.json | 32 ++++++++ CVE-2023/CVE-2023-38xx/CVE-2023-3886.json | 88 +++++++++++++++++++++ CVE-2023/CVE-2023-38xx/CVE-2023-3887.json | 88 +++++++++++++++++++++ CVE-2023/CVE-2023-38xx/CVE-2023-3888.json | 88 +++++++++++++++++++++ CVE-2023/CVE-2023-38xx/CVE-2023-3890.json | 88 +++++++++++++++++++++ CVE-2023/CVE-2023-38xx/CVE-2023-3897.json | 55 +++++++++++++ README.md | 41 ++++++---- 21 files changed, 666 insertions(+), 72 deletions(-) create mode 100644 CVE-2023/CVE-2023-214xx/CVE-2023-21405.json create mode 100644 CVE-2023/CVE-2023-214xx/CVE-2023-21406.json create mode 100644 CVE-2023/CVE-2023-341xx/CVE-2023-34189.json create mode 100644 CVE-2023/CVE-2023-344xx/CVE-2023-34434.json create mode 100644 CVE-2023/CVE-2023-350xx/CVE-2023-35088.json create mode 100644 CVE-2023/CVE-2023-38xx/CVE-2023-3886.json create mode 100644 CVE-2023/CVE-2023-38xx/CVE-2023-3887.json create mode 100644 CVE-2023/CVE-2023-38xx/CVE-2023-3888.json create mode 100644 CVE-2023/CVE-2023-38xx/CVE-2023-3890.json create mode 100644 CVE-2023/CVE-2023-38xx/CVE-2023-3897.json diff --git a/CVE-2022/CVE-2022-08xx/CVE-2022-0828.json b/CVE-2022/CVE-2022-08xx/CVE-2022-0828.json index 5e06bbe9518..041885578e2 100644 --- a/CVE-2022/CVE-2022-08xx/CVE-2022-0828.json +++ b/CVE-2022/CVE-2022-08xx/CVE-2022-0828.json @@ -2,12 +2,12 @@ "id": "CVE-2022-0828", "sourceIdentifier": "contact@wpscan.com", "published": "2022-04-11T15:15:08.480", - "lastModified": "2023-07-24T13:45:40.633", - "vulnStatus": "Analyzed", + "lastModified": "2023-07-25T08:15:09.387", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", - "value": "The Download Manager WordPress plugin before 3.2.39 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download." + "value": "The Download Manager WordPress plugin before 3.2.34 uses the uniqid php function to generate the master key for a download, allowing an attacker to brute force the key with reasonable resources giving direct download access regardless of role based restrictions or password protections set for the download." }, { "lang": "es", @@ -65,7 +65,7 @@ }, "weaknesses": [ { - "source": "nvd@nist.gov", + "source": "contact@wpscan.com", "type": "Primary", "description": [ { @@ -75,12 +75,12 @@ ] }, { - "source": "contact@wpscan.com", + "source": "nvd@nist.gov", "type": "Secondary", "description": [ { "lang": "en", - "value": "CWE-326" + "value": "CWE-338" } ] } diff --git a/CVE-2022/CVE-2022-08xx/CVE-2022-0837.json b/CVE-2022/CVE-2022-08xx/CVE-2022-0837.json index 85e5c8eabfd..1a3bcaa79f9 100644 --- a/CVE-2022/CVE-2022-08xx/CVE-2022-0837.json +++ b/CVE-2022/CVE-2022-08xx/CVE-2022-0837.json @@ -2,8 +2,8 @@ "id": "CVE-2022-0837", "sourceIdentifier": "contact@wpscan.com", "published": "2022-04-04T16:15:09.797", - "lastModified": "2023-07-24T13:46:04.643", - "vulnStatus": "Analyzed", + "lastModified": "2023-07-25T08:15:09.523", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", @@ -65,7 +65,7 @@ }, "weaknesses": [ { - "source": "nvd@nist.gov", + "source": "contact@wpscan.com", "type": "Primary", "description": [ { @@ -75,12 +75,12 @@ ] }, { - "source": "contact@wpscan.com", + "source": "nvd@nist.gov", "type": "Secondary", "description": [ { "lang": "en", - "value": "CWE-863" + "value": "CWE-862" } ] } diff --git a/CVE-2022/CVE-2022-14xx/CVE-2022-1412.json b/CVE-2022/CVE-2022-14xx/CVE-2022-1412.json index 7dbb615c408..3880bf61bfb 100644 --- a/CVE-2022/CVE-2022-14xx/CVE-2022-1412.json +++ b/CVE-2022/CVE-2022-14xx/CVE-2022-1412.json @@ -2,8 +2,8 @@ "id": "CVE-2022-1412", "sourceIdentifier": "contact@wpscan.com", "published": "2022-06-13T13:15:10.890", - "lastModified": "2023-07-24T13:30:52.937", - "vulnStatus": "Analyzed", + "lastModified": "2023-07-25T08:15:09.627", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", @@ -65,7 +65,7 @@ }, "weaknesses": [ { - "source": "nvd@nist.gov", + "source": "contact@wpscan.com", "type": "Primary", "description": [ { @@ -75,12 +75,12 @@ ] }, { - "source": "contact@wpscan.com", + "source": "nvd@nist.gov", "type": "Secondary", "description": [ { "lang": "en", - "value": "CWE-200" + "value": "CWE-732" } ] } diff --git a/CVE-2022/CVE-2022-15xx/CVE-2022-1551.json b/CVE-2022/CVE-2022-15xx/CVE-2022-1551.json index 3ef90d3feda..babdfbb7c3d 100644 --- a/CVE-2022/CVE-2022-15xx/CVE-2022-1551.json +++ b/CVE-2022/CVE-2022-15xx/CVE-2022-1551.json @@ -2,12 +2,12 @@ "id": "CVE-2022-1551", "sourceIdentifier": "contact@wpscan.com", "published": "2022-07-25T13:15:08.217", - "lastModified": "2023-07-24T13:08:19.833", - "vulnStatus": "Analyzed", + "lastModified": "2023-07-25T08:15:09.720", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", - "value": "The SP Project & Document Manager WordPress plugin through 4.57 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files." + "value": "The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files." }, { "lang": "es", @@ -40,7 +40,7 @@ }, "weaknesses": [ { - "source": "nvd@nist.gov", + "source": "contact@wpscan.com", "type": "Primary", "description": [ { @@ -50,12 +50,12 @@ ] }, { - "source": "contact@wpscan.com", + "source": "nvd@nist.gov", "type": "Secondary", "description": [ { "lang": "en", - "value": "CWE-200" + "value": "CWE-425" } ] } diff --git a/CVE-2022/CVE-2022-20xx/CVE-2022-2083.json b/CVE-2022/CVE-2022-20xx/CVE-2022-2083.json index ae0ef82b496..81f673ac5e8 100644 --- a/CVE-2022/CVE-2022-20xx/CVE-2022-2083.json +++ b/CVE-2022/CVE-2022-20xx/CVE-2022-2083.json @@ -2,8 +2,8 @@ "id": "CVE-2022-2083", "sourceIdentifier": "contact@wpscan.com", "published": "2022-09-05T13:15:08.167", - "lastModified": "2023-07-24T13:07:02.373", - "vulnStatus": "Analyzed", + "lastModified": "2023-07-25T08:15:09.820", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", @@ -40,7 +40,7 @@ }, "weaknesses": [ { - "source": "nvd@nist.gov", + "source": "contact@wpscan.com", "type": "Primary", "description": [ { @@ -50,12 +50,12 @@ ] }, { - "source": "contact@wpscan.com", + "source": "nvd@nist.gov", "type": "Secondary", "description": [ { "lang": "en", - "value": "CWE-326" + "value": "CWE-319" } ] } diff --git a/CVE-2022/CVE-2022-317xx/CVE-2022-31781.json b/CVE-2022/CVE-2022-317xx/CVE-2022-31781.json index 2653ac13c9b..7a4f9ef37e0 100644 --- a/CVE-2022/CVE-2022-317xx/CVE-2022-31781.json +++ b/CVE-2022/CVE-2022-317xx/CVE-2022-31781.json @@ -2,8 +2,8 @@ "id": "CVE-2022-31781", "sourceIdentifier": "security@apache.org", "published": "2022-07-13T08:15:07.213", - "lastModified": "2023-07-24T13:16:36.337", - "vulnStatus": "Analyzed", + "lastModified": "2023-07-25T09:15:10.383", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", @@ -40,7 +40,7 @@ }, "weaknesses": [ { - "source": "nvd@nist.gov", + "source": "security@apache.org", "type": "Primary", "description": [ { @@ -50,12 +50,12 @@ ] }, { - "source": "security@apache.org", + "source": "nvd@nist.gov", "type": "Secondary", "description": [ { "lang": "en", - "value": "CWE-400" + "value": "CWE-1333" } ] } diff --git a/CVE-2022/CVE-2022-338xx/CVE-2022-33891.json b/CVE-2022/CVE-2022-338xx/CVE-2022-33891.json index 13bed53bd0c..c1f447672af 100644 --- a/CVE-2022/CVE-2022-338xx/CVE-2022-33891.json +++ b/CVE-2022/CVE-2022-338xx/CVE-2022-33891.json @@ -2,8 +2,8 @@ "id": "CVE-2022-33891", "sourceIdentifier": "security@apache.org", "published": "2022-07-18T07:15:07.600", - "lastModified": "2023-07-21T17:47:52.123", - "vulnStatus": "Analyzed", + "lastModified": "2023-07-25T09:15:11.037", + "vulnStatus": "Modified", "cisaExploitAdd": "2023-03-07", "cisaActionDue": "2023-03-28", "cisaRequiredAction": "Apply updates per vendor instructions.", @@ -44,7 +44,7 @@ }, "weaknesses": [ { - "source": "nvd@nist.gov", + "source": "security@apache.org", "type": "Primary", "description": [ { @@ -54,12 +54,12 @@ ] }, { - "source": "security@apache.org", + "source": "nvd@nist.gov", "type": "Secondary", "description": [ { "lang": "en", - "value": "CWE-77" + "value": "CWE-78" } ] } diff --git a/CVE-2022/CVE-2022-374xx/CVE-2022-37400.json b/CVE-2022/CVE-2022-374xx/CVE-2022-37400.json index 883dc7607be..103b591e2a7 100644 --- a/CVE-2022/CVE-2022-374xx/CVE-2022-37400.json +++ b/CVE-2022/CVE-2022-374xx/CVE-2022-37400.json @@ -2,8 +2,8 @@ "id": "CVE-2022-37400", "sourceIdentifier": "security@apache.org", "published": "2022-08-15T11:21:41.653", - "lastModified": "2023-07-21T19:18:37.977", - "vulnStatus": "Analyzed", + "lastModified": "2023-07-25T09:15:11.170", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", @@ -40,7 +40,7 @@ }, "weaknesses": [ { - "source": "nvd@nist.gov", + "source": "security@apache.org", "type": "Primary", "description": [ { @@ -50,12 +50,12 @@ ] }, { - "source": "security@apache.org", + "source": "nvd@nist.gov", "type": "Secondary", "description": [ { "lang": "en", - "value": "CWE-326" + "value": "CWE-330" } ] } diff --git a/CVE-2022/CVE-2022-374xx/CVE-2022-37401.json b/CVE-2022/CVE-2022-374xx/CVE-2022-37401.json index 0e72941eee6..454003e11f3 100644 --- a/CVE-2022/CVE-2022-374xx/CVE-2022-37401.json +++ b/CVE-2022/CVE-2022-374xx/CVE-2022-37401.json @@ -2,8 +2,8 @@ "id": "CVE-2022-37401", "sourceIdentifier": "security@apache.org", "published": "2022-08-15T11:21:42.117", - "lastModified": "2023-07-21T19:18:45.120", - "vulnStatus": "Analyzed", + "lastModified": "2023-07-25T09:15:11.327", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", @@ -40,7 +40,7 @@ }, "weaknesses": [ { - "source": "nvd@nist.gov", + "source": "security@apache.org", "type": "Primary", "description": [ { @@ -50,16 +50,12 @@ ] }, { - "source": "security@apache.org", + "source": "nvd@nist.gov", "type": "Secondary", "description": [ { "lang": "en", - "value": "CWE-312" - }, - { - "lang": "en", - "value": "CWE-326" + "value": "CWE-331" } ] } diff --git a/CVE-2022/CVE-2022-374xx/CVE-2022-37435.json b/CVE-2022/CVE-2022-374xx/CVE-2022-37435.json index 1e793dd7cea..dec0d0f197f 100644 --- a/CVE-2022/CVE-2022-374xx/CVE-2022-37435.json +++ b/CVE-2022/CVE-2022-374xx/CVE-2022-37435.json @@ -2,8 +2,8 @@ "id": "CVE-2022-37435", "sourceIdentifier": "security@apache.org", "published": "2022-09-01T14:15:10.427", - "lastModified": "2023-07-21T19:21:40.787", - "vulnStatus": "Analyzed", + "lastModified": "2023-07-25T09:15:11.423", + "vulnStatus": "Modified", "descriptions": [ { "lang": "en", @@ -40,7 +40,7 @@ }, "weaknesses": [ { - "source": "nvd@nist.gov", + "source": "security@apache.org", "type": "Primary", "description": [ { @@ -50,12 +50,12 @@ ] }, { - "source": "security@apache.org", + "source": "nvd@nist.gov", "type": "Secondary", "description": [ { "lang": "en", - "value": "CWE-269" + "value": "CWE-732" } ] } diff --git a/CVE-2023/CVE-2023-214xx/CVE-2023-21405.json b/CVE-2023/CVE-2023-214xx/CVE-2023-21405.json new file mode 100644 index 00000000000..19b53cd5e7a --- /dev/null +++ b/CVE-2023/CVE-2023-214xx/CVE-2023-21405.json @@ -0,0 +1,43 @@ +{ + "id": "CVE-2023-21405", + "sourceIdentifier": "product-security@axis.com", + "published": "2023-07-25T08:15:09.927", + "lastModified": "2023-07-25T08:15:09.927", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "\nKnud from Fraktal.fi has found a flaw in some Axis Network Door Controllers and Axis Network\nIntercoms when communicating over OSDP, highlighting that the OSDP message parser crashes\nthe pacsiod process, causing a temporary unavailability of the door-controlling functionalities\nmeaning that doors cannot be opened or closed. No sensitive or customer data can be extracted\nas the Axis device is not further compromised. Please refer to the Axis security advisory for more information, mitigation and affected products and software versions." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "product-security@axis.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", + "attackVector": "ADJACENT_NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "HIGH", + "baseScore": 6.5, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 2.8, + "impactScore": 3.6 + } + ] + }, + "references": [ + { + "url": "https://www.axis.com/dam/public/7f/3a/ed/cve-2023-21405-en-US-407244.pdf", + "source": "product-security@axis.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-214xx/CVE-2023-21406.json b/CVE-2023/CVE-2023-214xx/CVE-2023-21406.json new file mode 100644 index 00000000000..59ec18dd652 --- /dev/null +++ b/CVE-2023/CVE-2023-214xx/CVE-2023-21406.json @@ -0,0 +1,43 @@ +{ + "id": "CVE-2023-21406", + "sourceIdentifier": "product-security@axis.com", + "published": "2023-07-25T08:15:10.003", + "lastModified": "2023-07-25T08:15:10.003", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "\nAriel Harush and Roy Hodir from OTORIO have found a flaw in the AXIS A1001 when\ncommunicating over OSDP. A heap-based buffer overflow was found in the pacsiod process which\nis handling the OSDP communication allowing to write outside of the allocated buffer. By\nappending invalid data to an OSDP message it was possible to write data beyond the heap\nallocated buffer. The data written outside the buffer could be used to execute arbitrary code.\u00a0\n\nlease refer to the Axis security advisory for more information, mitigation and affected products and software versions.\n\n" + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "product-security@axis.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H", + "attackVector": "ADJACENT_NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 7.1, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 1.6, + "impactScore": 5.5 + } + ] + }, + "references": [ + { + "url": "https://www.axis.com/dam/public/1b/21/5f/cve-2023-21406-en-US-407245.pdf", + "source": "product-security@axis.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-341xx/CVE-2023-34189.json b/CVE-2023/CVE-2023-341xx/CVE-2023-34189.json new file mode 100644 index 00000000000..2c913cf0119 --- /dev/null +++ b/CVE-2023/CVE-2023-341xx/CVE-2023-34189.json @@ -0,0 +1,32 @@ +{ + "id": "CVE-2023-34189", + "sourceIdentifier": "security@apache.org", + "published": "2023-07-25T08:15:10.077", + "lastModified": "2023-07-25T08:15:10.077", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could use general users to delete and update the process, which only the admin can operate occurrences.\u00a0\n\nUsers are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8109 \u00a0to solve it.\n\n" + } + ], + "metrics": {}, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-668" + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/smxqyx43hxjvzv4w71n2n3rfho9p378s", + "source": "security@apache.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-344xx/CVE-2023-34434.json b/CVE-2023/CVE-2023-344xx/CVE-2023-34434.json new file mode 100644 index 00000000000..88fb370fc7c --- /dev/null +++ b/CVE-2023/CVE-2023-344xx/CVE-2023-34434.json @@ -0,0 +1,32 @@ +{ + "id": "CVE-2023-34434", + "sourceIdentifier": "security@apache.org", + "published": "2023-07-25T08:15:10.147", + "lastModified": "2023-07-25T08:15:10.147", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.\u00a0\n\nThe attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick https://github.com/apache/inlong/pull/8130 .\n\n" + } + ], + "metrics": {}, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-502" + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/7f1o71w5r732cspltmtdydn01gllf4jo", + "source": "security@apache.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-350xx/CVE-2023-35088.json b/CVE-2023/CVE-2023-350xx/CVE-2023-35088.json new file mode 100644 index 00000000000..e728dd57912 --- /dev/null +++ b/CVE-2023/CVE-2023-350xx/CVE-2023-35088.json @@ -0,0 +1,32 @@ +{ + "id": "CVE-2023-35088", + "sourceIdentifier": "security@apache.org", + "published": "2023-07-25T08:15:10.213", + "lastModified": "2023-07-25T08:15:10.213", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0.\u00a0\nIn the toAuditCkSql method, the groupId, streamId, auditId, and dt are directly concatenated into the SQL query statement, which may lead to SQL injection attacks.\nUsers are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it.\n\n[1] https://github.com/apache/inlong/pull/8198 \n\n" + } + ], + "metrics": {}, + "weaknesses": [ + { + "source": "security@apache.org", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-89" + } + ] + } + ], + "references": [ + { + "url": "https://lists.apache.org/thread/os7b66x4n8dbtrdpb7c6x37bb1vjb0tk", + "source": "security@apache.org" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-38xx/CVE-2023-3886.json b/CVE-2023/CVE-2023-38xx/CVE-2023-3886.json new file mode 100644 index 00000000000..6cc72480182 --- /dev/null +++ b/CVE-2023/CVE-2023-38xx/CVE-2023-3886.json @@ -0,0 +1,88 @@ +{ + "id": "CVE-2023-3886", + "sourceIdentifier": "cna@vuldb.com", + "published": "2023-07-25T08:15:10.280", + "lastModified": "2023-07-25T08:15:10.280", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability was found in Campcodes Beauty Salon Management System 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/invoice.php. The manipulation of the argument inv_id leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235248." + } + ], + "metrics": { + "cvssMetricV30": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "3.0", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 3.5, + "baseSeverity": "LOW" + }, + "exploitabilityScore": 2.1, + "impactScore": 1.4 + } + ], + "cvssMetricV2": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "2.0", + "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", + "accessVector": "NETWORK", + "accessComplexity": "LOW", + "authentication": "SINGLE", + "confidentialityImpact": "NONE", + "integrityImpact": "PARTIAL", + "availabilityImpact": "NONE", + "baseScore": 4.0 + }, + "baseSeverity": "MEDIUM", + "exploitabilityScore": 8.0, + "impactScore": 2.9, + "acInsufInfo": false, + "obtainAllPrivilege": false, + "obtainUserPrivilege": false, + "obtainOtherPrivilege": false, + "userInteractionRequired": false + } + ] + }, + "weaknesses": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-79" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/E1CHO/cve_hub/blob/main/Beauty%20Salon%20Management%20System/Beauty%20Salon%20Management%20System%20-%20vuln%2018.pdf", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?ctiid.235248", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?id.235248", + "source": "cna@vuldb.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-38xx/CVE-2023-3887.json b/CVE-2023/CVE-2023-38xx/CVE-2023-3887.json new file mode 100644 index 00000000000..2d5f6055168 --- /dev/null +++ b/CVE-2023/CVE-2023-38xx/CVE-2023-3887.json @@ -0,0 +1,88 @@ +{ + "id": "CVE-2023-3887", + "sourceIdentifier": "cna@vuldb.com", + "published": "2023-07-25T08:15:10.353", + "lastModified": "2023-07-25T08:15:10.353", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability was found in Campcodes Beauty Salon Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/search-appointment.php. The manipulation of the argument searchdata leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235249 was assigned to this vulnerability." + } + ], + "metrics": { + "cvssMetricV30": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "3.0", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 3.5, + "baseSeverity": "LOW" + }, + "exploitabilityScore": 2.1, + "impactScore": 1.4 + } + ], + "cvssMetricV2": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "2.0", + "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", + "accessVector": "NETWORK", + "accessComplexity": "LOW", + "authentication": "SINGLE", + "confidentialityImpact": "NONE", + "integrityImpact": "PARTIAL", + "availabilityImpact": "NONE", + "baseScore": 4.0 + }, + "baseSeverity": "MEDIUM", + "exploitabilityScore": 8.0, + "impactScore": 2.9, + "acInsufInfo": false, + "obtainAllPrivilege": false, + "obtainUserPrivilege": false, + "obtainOtherPrivilege": false, + "userInteractionRequired": false + } + ] + }, + "weaknesses": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-79" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/E1CHO/cve_hub/blob/main/Beauty%20Salon%20Management%20System/Beauty%20Salon%20Management%20System%20-%20vuln%2019.pdf", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?ctiid.235249", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?id.235249", + "source": "cna@vuldb.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-38xx/CVE-2023-3888.json b/CVE-2023/CVE-2023-38xx/CVE-2023-3888.json new file mode 100644 index 00000000000..a3d63a1d35c --- /dev/null +++ b/CVE-2023/CVE-2023-38xx/CVE-2023-3888.json @@ -0,0 +1,88 @@ +{ + "id": "CVE-2023-3888", + "sourceIdentifier": "cna@vuldb.com", + "published": "2023-07-25T08:15:10.420", + "lastModified": "2023-07-25T08:15:10.420", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability was found in Campcodes Beauty Salon Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/admin-profile.php. The manipulation of the argument adminname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-235250 is the identifier assigned to this vulnerability." + } + ], + "metrics": { + "cvssMetricV30": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "3.0", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 3.5, + "baseSeverity": "LOW" + }, + "exploitabilityScore": 2.1, + "impactScore": 1.4 + } + ], + "cvssMetricV2": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "2.0", + "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", + "accessVector": "NETWORK", + "accessComplexity": "LOW", + "authentication": "SINGLE", + "confidentialityImpact": "NONE", + "integrityImpact": "PARTIAL", + "availabilityImpact": "NONE", + "baseScore": 4.0 + }, + "baseSeverity": "MEDIUM", + "exploitabilityScore": 8.0, + "impactScore": 2.9, + "acInsufInfo": false, + "obtainAllPrivilege": false, + "obtainUserPrivilege": false, + "obtainOtherPrivilege": false, + "userInteractionRequired": false + } + ] + }, + "weaknesses": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-79" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/E1CHO/cve_hub/blob/main/Beauty%20Salon%20Management%20System/Beauty%20Salon%20Management%20System%20-%20vuln%2020.pdf", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?ctiid.235250", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?id.235250", + "source": "cna@vuldb.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-38xx/CVE-2023-3890.json b/CVE-2023/CVE-2023-38xx/CVE-2023-3890.json new file mode 100644 index 00000000000..68e0b73e1e7 --- /dev/null +++ b/CVE-2023/CVE-2023-38xx/CVE-2023-3890.json @@ -0,0 +1,88 @@ +{ + "id": "CVE-2023-3890", + "sourceIdentifier": "cna@vuldb.com", + "published": "2023-07-25T09:15:11.557", + "lastModified": "2023-07-25T09:15:11.557", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability classified as problematic has been found in Campcodes Beauty Salon Management System 1.0. This affects an unknown part of the file /admin/edit-accepted-appointment.php. The manipulation of the argument id leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235251." + } + ], + "metrics": { + "cvssMetricV30": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "3.0", + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 3.5, + "baseSeverity": "LOW" + }, + "exploitabilityScore": 2.1, + "impactScore": 1.4 + } + ], + "cvssMetricV2": [ + { + "source": "cna@vuldb.com", + "type": "Secondary", + "cvssData": { + "version": "2.0", + "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", + "accessVector": "NETWORK", + "accessComplexity": "LOW", + "authentication": "SINGLE", + "confidentialityImpact": "NONE", + "integrityImpact": "PARTIAL", + "availabilityImpact": "NONE", + "baseScore": 4.0 + }, + "baseSeverity": "MEDIUM", + "exploitabilityScore": 8.0, + "impactScore": 2.9, + "acInsufInfo": false, + "obtainAllPrivilege": false, + "obtainUserPrivilege": false, + "obtainOtherPrivilege": false, + "userInteractionRequired": false + } + ] + }, + "weaknesses": [ + { + "source": "cna@vuldb.com", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-79" + } + ] + } + ], + "references": [ + { + "url": "https://github.com/E1CHO/cve_hub/blob/main/Beauty%20Salon%20Management%20System/Beauty%20Salon%20Management%20System%20-%20vuln%2021.pdf", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?ctiid.235251", + "source": "cna@vuldb.com" + }, + { + "url": "https://vuldb.com/?id.235251", + "source": "cna@vuldb.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2023/CVE-2023-38xx/CVE-2023-3897.json b/CVE-2023/CVE-2023-38xx/CVE-2023-3897.json new file mode 100644 index 00000000000..2c874cc89b5 --- /dev/null +++ b/CVE-2023/CVE-2023-38xx/CVE-2023-3897.json @@ -0,0 +1,55 @@ +{ + "id": "CVE-2023-3897", + "sourceIdentifier": "security@42gears.com", + "published": "2023-07-25T09:15:11.687", + "lastModified": "2023-07-25T09:15:11.687", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "User enumeration in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message.This issue affects SureMDM On-premise: 6.31 and below version\u00a0\n\n" + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security@42gears.com", + "type": "Secondary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", + "attackVector": "NETWORK", + "attackComplexity": "HIGH", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "NONE", + "availabilityImpact": "NONE", + "baseScore": 3.7, + "baseSeverity": "LOW" + }, + "exploitabilityScore": 2.2, + "impactScore": 1.4 + } + ] + }, + "weaknesses": [ + { + "source": "security@42gears.com", + "type": "Secondary", + "description": [ + { + "lang": "en", + "value": "CWE-203" + } + ] + } + ], + "references": [ + { + "url": "https://www.42gears.com/security-and-compliance", + "source": "security@42gears.com" + } + ] +} \ No newline at end of file diff --git a/README.md b/README.md index b241192b114..66aee15387e 100644 --- a/README.md +++ b/README.md @@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2023-07-25T08:00:26.402637+00:00 +2023-07-25T10:00:28.960660+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2023-07-25T07:15:11.550000+00:00 +2023-07-25T09:15:11.687000+00:00 ``` ### Last Data Feed Release @@ -29,30 +29,39 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/ ### Total Number of included CVEs ```plain -220962 +220972 ``` ### CVEs added in the last Commit -Recently added CVEs: `8` +Recently added CVEs: `10` -* [CVE-2023-32637](CVE-2023/CVE-2023-326xx/CVE-2023-32637.json) (`2023-07-25T06:15:10.893`) -* [CVE-2023-3046](CVE-2023/CVE-2023-30xx/CVE-2023-3046.json) (`2023-07-25T06:15:15.993`) -* [CVE-2023-3883](CVE-2023/CVE-2023-38xx/CVE-2023-3883.json) (`2023-07-25T06:15:16.410`) -* [CVE-2023-3884](CVE-2023/CVE-2023-38xx/CVE-2023-3884.json) (`2023-07-25T06:15:16.720`) -* [CVE-2023-35066](CVE-2023/CVE-2023-350xx/CVE-2023-35066.json) (`2023-07-25T07:15:10.627`) -* [CVE-2023-35067](CVE-2023/CVE-2023-350xx/CVE-2023-35067.json) (`2023-07-25T07:15:10.770`) -* [CVE-2023-35078](CVE-2023/CVE-2023-350xx/CVE-2023-35078.json) (`2023-07-25T07:15:10.897`) -* [CVE-2023-3885](CVE-2023/CVE-2023-38xx/CVE-2023-3885.json) (`2023-07-25T07:15:11.550`) +* [CVE-2023-21405](CVE-2023/CVE-2023-214xx/CVE-2023-21405.json) (`2023-07-25T08:15:09.927`) +* [CVE-2023-21406](CVE-2023/CVE-2023-214xx/CVE-2023-21406.json) (`2023-07-25T08:15:10.003`) +* [CVE-2023-34189](CVE-2023/CVE-2023-341xx/CVE-2023-34189.json) (`2023-07-25T08:15:10.077`) +* [CVE-2023-34434](CVE-2023/CVE-2023-344xx/CVE-2023-34434.json) (`2023-07-25T08:15:10.147`) +* [CVE-2023-35088](CVE-2023/CVE-2023-350xx/CVE-2023-35088.json) (`2023-07-25T08:15:10.213`) +* [CVE-2023-3886](CVE-2023/CVE-2023-38xx/CVE-2023-3886.json) (`2023-07-25T08:15:10.280`) +* [CVE-2023-3887](CVE-2023/CVE-2023-38xx/CVE-2023-3887.json) (`2023-07-25T08:15:10.353`) +* [CVE-2023-3888](CVE-2023/CVE-2023-38xx/CVE-2023-3888.json) (`2023-07-25T08:15:10.420`) +* [CVE-2023-3890](CVE-2023/CVE-2023-38xx/CVE-2023-3890.json) (`2023-07-25T09:15:11.557`) +* [CVE-2023-3897](CVE-2023/CVE-2023-38xx/CVE-2023-3897.json) (`2023-07-25T09:15:11.687`) ### CVEs modified in the last Commit -Recently modified CVEs: `3` +Recently modified CVEs: `10` -* [CVE-2023-33863](CVE-2023/CVE-2023-338xx/CVE-2023-33863.json) (`2023-07-25T07:15:10.100`) -* [CVE-2023-33864](CVE-2023/CVE-2023-338xx/CVE-2023-33864.json) (`2023-07-25T07:15:10.403`) -* [CVE-2023-33865](CVE-2023/CVE-2023-338xx/CVE-2023-33865.json) (`2023-07-25T07:15:10.527`) +* [CVE-2022-0828](CVE-2022/CVE-2022-08xx/CVE-2022-0828.json) (`2023-07-25T08:15:09.387`) +* [CVE-2022-0837](CVE-2022/CVE-2022-08xx/CVE-2022-0837.json) (`2023-07-25T08:15:09.523`) +* [CVE-2022-1412](CVE-2022/CVE-2022-14xx/CVE-2022-1412.json) (`2023-07-25T08:15:09.627`) +* [CVE-2022-1551](CVE-2022/CVE-2022-15xx/CVE-2022-1551.json) (`2023-07-25T08:15:09.720`) +* [CVE-2022-2083](CVE-2022/CVE-2022-20xx/CVE-2022-2083.json) (`2023-07-25T08:15:09.820`) +* [CVE-2022-31781](CVE-2022/CVE-2022-317xx/CVE-2022-31781.json) (`2023-07-25T09:15:10.383`) +* [CVE-2022-33891](CVE-2022/CVE-2022-338xx/CVE-2022-33891.json) (`2023-07-25T09:15:11.037`) +* [CVE-2022-37400](CVE-2022/CVE-2022-374xx/CVE-2022-37400.json) (`2023-07-25T09:15:11.170`) +* [CVE-2022-37401](CVE-2022/CVE-2022-374xx/CVE-2022-37401.json) (`2023-07-25T09:15:11.327`) +* [CVE-2022-37435](CVE-2022/CVE-2022-374xx/CVE-2022-37435.json) (`2023-07-25T09:15:11.423`) ## Download and Usage