Auto-Update: 2024-02-28T23:00:24.424262+00:00

This commit is contained in:
cad-safe-bot 2024-02-28 23:00:28 +00:00
parent 81154de26e
commit e2a4119c96
16 changed files with 497 additions and 16 deletions

View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-25922",
"sourceIdentifier": "psirt@us.ibm.com",
"published": "2024-02-28T22:15:25.683",
"lastModified": "2024-02-28T22:15:25.683",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247621."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "psirt@us.ibm.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
]
},
"weaknesses": [
{
"source": "psirt@us.ibm.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-434"
}
]
}
],
"references": [
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/247621",
"source": "psirt@us.ibm.com"
},
{
"url": "https://www.ibm.com/support/pages/node/6964516",
"source": "psirt@us.ibm.com"
}
]
}

View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-25925",
"sourceIdentifier": "psirt@us.ibm.com",
"published": "2024-02-28T22:15:25.883",
"lastModified": "2024-02-28T22:15:25.883",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 247632."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "psirt@us.ibm.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 6.0
}
]
},
"weaknesses": [
{
"source": "psirt@us.ibm.com",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"references": [
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/247632",
"source": "psirt@us.ibm.com"
},
{
"url": "https://www.ibm.com/support/pages/node/6964516",
"source": "psirt@us.ibm.com"
}
]
}

View File

@ -0,0 +1,24 @@
{
"id": "CVE-2023-45859",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-02-28T22:15:26.070",
"lastModified": "2024-02-28T22:15:26.070",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/hazelcast/hazelcast/pull/25509",
"source": "cve@mitre.org"
},
{
"url": "https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,28 @@
{
"id": "CVE-2023-45873",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-02-28T22:15:26.107",
"lastModified": "2024-02-28T22:15:26.107",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (application exist) because of the OOM killer."
}
],
"metrics": {},
"references": [
{
"url": "https://docs.couchbase.com/server/current/release-notes/relnotes.html",
"source": "cve@mitre.org"
},
{
"url": "https://forums.couchbase.com/tags/security",
"source": "cve@mitre.org"
},
{
"url": "https://www.couchbase.com/alerts/",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,28 @@
{
"id": "CVE-2023-49338",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-02-28T22:15:26.170",
"lastModified": "2024-02-28T22:15:26.170",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost."
}
],
"metrics": {},
"references": [
{
"url": "https://docs.couchbase.com/server/current/release-notes/relnotes.html",
"source": "cve@mitre.org"
},
{
"url": "https://forums.couchbase.com/tags/security",
"source": "cve@mitre.org"
},
{
"url": "https://www.couchbase.com/alerts/",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,88 @@
{
"id": "CVE-2024-1972",
"sourceIdentifier": "cna@vuldb.com",
"published": "2024-02-28T22:15:26.210",
"lastModified": "2024-02-28T22:15:26.210",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in SourceCodester Online Job Portal 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Employer/EditProfile.php. The manipulation of the argument Address leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-255128."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW"
},
"exploitabilityScore": 2.1,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "SINGLE",
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"availabilityImpact": "NONE",
"baseScore": 4.0
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "cna@vuldb.com",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"references": [
{
"url": "https://prnt.sc/gtk7Fj43Qwy9",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?ctiid.255128",
"source": "cna@vuldb.com"
},
{
"url": "https://vuldb.com/?id.255128",
"source": "cna@vuldb.com"
}
]
}

View File

@ -0,0 +1,28 @@
{
"id": "CVE-2024-22983",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-02-28T22:15:26.453",
"lastModified": "2024-02-28T22:15:26.453",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in the myform.php endpoint."
}
],
"metrics": {},
"references": [
{
"url": "http://projectworlds.com",
"source": "cve@mitre.org"
},
{
"url": "http://visitor.com",
"source": "cve@mitre.org"
},
{
"url": "https://github.com/keru6k/CVE-2024-22983/blob/main/CVE-2024-22983.md",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-25350",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-02-28T22:15:26.493",
"lastModified": "2024-02-28T22:15:26.493",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "SQL Injection vulnerability in /zms/admin/edit-ticket.php in PHPGurukul Zoo Management System 1.0 via tickettype and tprice parameters."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/ZooManagementSystem-SQL_Injection_Edit_Ticket.md",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-25351",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-02-28T22:15:26.533",
"lastModified": "2024-02-28T22:15:26.533",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "SQL Injection vulnerability in /zms/admin/changeimage.php in PHPGurukul Zoo Management System 1.0 allows attackers to run arbitrary SQL commands via the editid parameter."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/ZooManagementSystem-SQL_Injection_Change_Image.md",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-25866",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-02-28T22:15:26.573",
"lastModified": "2024-02-28T22:15:26.573",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the email parameter in the index.php component."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-SQL_Injection_Login.md",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-25867",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-02-28T22:15:26.617",
"lastModified": "2024-02-28T22:15:26.617",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the membershipType and membershipAmount parameters in the add_type.php component."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-SQL_Injection_Add_Type.md",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-25868",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-02-28T22:15:26.657",
"lastModified": "2024-02-28T22:15:26.657",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "A Cross Site Scripting (XSS) vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via the membershipType parameter in the add_type.php component."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-Stored_XSS_Add_Type.md",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-25869",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-02-28T22:15:26.690",
"lastModified": "2024-02-28T22:15:26.690",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via upload of a crafted php file in the settings.php component."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-Unrestricted_Fileupload.md",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,20 @@
{
"id": "CVE-2024-26450",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-02-28T22:15:26.730",
"lastModified": "2024-02-28T22:15:26.730",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "Cross Site Scripting vulnerability in Piwigo before v.14.2.0 allows a remote attacker to escalate privileges via the batch function on the admin page."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/Piwigo/Piwigo/security/advisories/GHSA-p362-cfpj-q55f",
"source": "cve@mitre.org"
}
]
}

View File

@ -0,0 +1,24 @@
{
"id": "CVE-2024-26476",
"sourceIdentifier": "cve@mitre.org",
"published": "2024-02-28T22:15:26.767",
"lastModified": "2024-02-28T22:15:26.767",
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereq_form.php component."
}
],
"metrics": {},
"references": [
{
"url": "https://github.com/c4v4r0n/Research/blob/main/openemr_BlindSSRF/README.md",
"source": "cve@mitre.org"
},
{
"url": "https://github.com/mpdf/mpdf/issues/867",
"source": "cve@mitre.org"
}
]
}

View File

@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2024-02-28T21:00:24.883582+00:00
2024-02-28T23:00:24.424262+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2024-02-28T20:15:41.940000+00:00
2024-02-28T22:15:26.767000+00:00
```
### Last Data Feed Release
@ -29,25 +29,28 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
239844
239859
```
### CVEs added in the last Commit
Recently added CVEs: `12`
Recently added CVEs: `15`
* [CVE-2023-51533](CVE-2023/CVE-2023-515xx/CVE-2023-51533.json) (`2024-02-28T19:15:09.963`)
* [CVE-2023-51692](CVE-2023/CVE-2023-516xx/CVE-2023-51692.json) (`2024-02-28T19:15:10.147`)
* [CVE-2023-52047](CVE-2023/CVE-2023-520xx/CVE-2023-52047.json) (`2024-02-28T20:15:41.590`)
* [CVE-2023-52048](CVE-2023/CVE-2023-520xx/CVE-2023-52048.json) (`2024-02-28T20:15:41.640`)
* [CVE-2024-27948](CVE-2024/CVE-2024-279xx/CVE-2024-27948.json) (`2024-02-28T19:15:11.357`)
* [CVE-2024-24148](CVE-2024/CVE-2024-241xx/CVE-2024-24148.json) (`2024-02-28T20:15:41.683`)
* [CVE-2024-25169](CVE-2024/CVE-2024-251xx/CVE-2024-25169.json) (`2024-02-28T20:15:41.723`)
* [CVE-2024-25170](CVE-2024/CVE-2024-251xx/CVE-2024-25170.json) (`2024-02-28T20:15:41.770`)
* [CVE-2024-25202](CVE-2024/CVE-2024-252xx/CVE-2024-25202.json) (`2024-02-28T20:15:41.810`)
* [CVE-2024-25435](CVE-2024/CVE-2024-254xx/CVE-2024-25435.json) (`2024-02-28T20:15:41.857`)
* [CVE-2024-25859](CVE-2024/CVE-2024-258xx/CVE-2024-25859.json) (`2024-02-28T20:15:41.900`)
* [CVE-2024-27285](CVE-2024/CVE-2024-272xx/CVE-2024-27285.json) (`2024-02-28T20:15:41.940`)
* [CVE-2023-25922](CVE-2023/CVE-2023-259xx/CVE-2023-25922.json) (`2024-02-28T22:15:25.683`)
* [CVE-2023-25925](CVE-2023/CVE-2023-259xx/CVE-2023-25925.json) (`2024-02-28T22:15:25.883`)
* [CVE-2023-45859](CVE-2023/CVE-2023-458xx/CVE-2023-45859.json) (`2024-02-28T22:15:26.070`)
* [CVE-2023-45873](CVE-2023/CVE-2023-458xx/CVE-2023-45873.json) (`2024-02-28T22:15:26.107`)
* [CVE-2023-49338](CVE-2023/CVE-2023-493xx/CVE-2023-49338.json) (`2024-02-28T22:15:26.170`)
* [CVE-2024-1972](CVE-2024/CVE-2024-19xx/CVE-2024-1972.json) (`2024-02-28T22:15:26.210`)
* [CVE-2024-22983](CVE-2024/CVE-2024-229xx/CVE-2024-22983.json) (`2024-02-28T22:15:26.453`)
* [CVE-2024-25350](CVE-2024/CVE-2024-253xx/CVE-2024-25350.json) (`2024-02-28T22:15:26.493`)
* [CVE-2024-25351](CVE-2024/CVE-2024-253xx/CVE-2024-25351.json) (`2024-02-28T22:15:26.533`)
* [CVE-2024-25866](CVE-2024/CVE-2024-258xx/CVE-2024-25866.json) (`2024-02-28T22:15:26.573`)
* [CVE-2024-25867](CVE-2024/CVE-2024-258xx/CVE-2024-25867.json) (`2024-02-28T22:15:26.617`)
* [CVE-2024-25868](CVE-2024/CVE-2024-258xx/CVE-2024-25868.json) (`2024-02-28T22:15:26.657`)
* [CVE-2024-25869](CVE-2024/CVE-2024-258xx/CVE-2024-25869.json) (`2024-02-28T22:15:26.690`)
* [CVE-2024-26450](CVE-2024/CVE-2024-264xx/CVE-2024-26450.json) (`2024-02-28T22:15:26.730`)
* [CVE-2024-26476](CVE-2024/CVE-2024-264xx/CVE-2024-26476.json) (`2024-02-28T22:15:26.767`)
### CVEs modified in the last Commit