From e444343162d529d455e2ea40d547798f66db4cf4 Mon Sep 17 00:00:00 2001 From: cad-safe-bot Date: Fri, 26 May 2023 02:00:29 +0000 Subject: [PATCH] Auto-Update: 2023-05-26T02:00:25.671025+00:00 --- CVE-2023/CVE-2023-27xx/CVE-2023-2712.json | 49 +++++++++++- CVE-2023/CVE-2023-329xx/CVE-2023-32991.json | 64 ++++++++++++++- CVE-2023/CVE-2023-329xx/CVE-2023-32995.json | 64 ++++++++++++++- CVE-2023/CVE-2023-332xx/CVE-2023-33288.json | 88 +++++++++++++++++++-- README.md | 23 +++--- 5 files changed, 254 insertions(+), 34 deletions(-) diff --git a/CVE-2023/CVE-2023-27xx/CVE-2023-2712.json b/CVE-2023/CVE-2023-27xx/CVE-2023-2712.json index c6d5bc15556..48ff58da449 100644 --- a/CVE-2023/CVE-2023-27xx/CVE-2023-2712.json +++ b/CVE-2023/CVE-2023-27xx/CVE-2023-2712.json @@ -2,8 +2,8 @@ "id": "CVE-2023-2712", "sourceIdentifier": "cve@usom.gov.tr", "published": "2023-05-20T10:15:09.203", - "lastModified": "2023-05-20T11:31:57.830", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-05-26T01:13:24.607", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", @@ -13,8 +13,28 @@ "metrics": { "cvssMetricV31": [ { - "source": "cve@usom.gov.tr", + "source": "nvd@nist.gov", "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 9.8, + "baseSeverity": "CRITICAL" + }, + "exploitabilityScore": 3.9, + "impactScore": 5.9 + }, + { + "source": "cve@usom.gov.tr", + "type": "Secondary", "cvssData": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", @@ -46,10 +66,31 @@ ] } ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:rental_module_project:rental_module:*:*:*:*:*:*:*:*", + "versionEndExcluding": "23.05.15", + "matchCriteriaId": "00F83330-FE72-4710-AFCA-2C6158D27EAB" + } + ] + } + ] + } + ], "references": [ { "url": "https://www.usom.gov.tr/bildirim/tr-23-0276", - "source": "cve@usom.gov.tr" + "source": "cve@usom.gov.tr", + "tags": [ + "Third Party Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-329xx/CVE-2023-32991.json b/CVE-2023/CVE-2023-329xx/CVE-2023-32991.json index 4426880ccee..c1c748df2f2 100644 --- a/CVE-2023/CVE-2023-329xx/CVE-2023-32991.json +++ b/CVE-2023/CVE-2023-329xx/CVE-2023-32991.json @@ -2,19 +2,75 @@ "id": "CVE-2023-32991", "sourceIdentifier": "jenkinsci-cert@googlegroups.com", "published": "2023-05-16T17:15:11.803", - "lastModified": "2023-05-16T20:04:03.627", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-05-26T01:54:42.837", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML." } ], - "metrics": {}, + "metrics": { + "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 2.8, + "impactScore": 5.9 + } + ] + }, + "weaknesses": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-352" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:jenkins:saml_single_sign_on:*:*:*:*:*:jenkins:*:*", + "versionEndIncluding": "2.0.2", + "matchCriteriaId": "7DF2495A-9EA7-47AC-9962-FC4840EE1BDE" + } + ] + } + ] + } + ], "references": [ { "url": "https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2993", - "source": "jenkinsci-cert@googlegroups.com" + "source": "jenkinsci-cert@googlegroups.com", + "tags": [ + "Vendor Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-329xx/CVE-2023-32995.json b/CVE-2023/CVE-2023-329xx/CVE-2023-32995.json index c238d1ba3ee..e088535d876 100644 --- a/CVE-2023/CVE-2023-329xx/CVE-2023-32995.json +++ b/CVE-2023/CVE-2023-329xx/CVE-2023-32995.json @@ -2,19 +2,75 @@ "id": "CVE-2023-32995", "sourceIdentifier": "jenkinsci-cert@googlegroups.com", "published": "2023-05-16T17:15:11.980", - "lastModified": "2023-05-16T20:04:03.627", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-05-26T01:57:21.513", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", "value": "A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails." } ], - "metrics": {}, + "metrics": { + "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "NONE", + "userInteraction": "REQUIRED", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 2.8, + "impactScore": 5.9 + } + ] + }, + "weaknesses": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-352" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:a:jenkins:saml_single_sign_on:*:*:*:*:*:jenkins:*:*", + "versionEndIncluding": "2.0.0", + "matchCriteriaId": "4C7911E5-8380-4DFC-8009-3D1DF96A3499" + } + ] + } + ] + } + ], "references": [ { "url": "https://www.jenkins.io/security/advisory/2023-05-16/#SECURITY-2994", - "source": "jenkinsci-cert@googlegroups.com" + "source": "jenkinsci-cert@googlegroups.com", + "tags": [ + "Vendor Advisory" + ] } ] } \ No newline at end of file diff --git a/CVE-2023/CVE-2023-332xx/CVE-2023-33288.json b/CVE-2023/CVE-2023-332xx/CVE-2023-33288.json index c806502ac8f..09fd7e1dff8 100644 --- a/CVE-2023/CVE-2023-332xx/CVE-2023-33288.json +++ b/CVE-2023/CVE-2023-332xx/CVE-2023-33288.json @@ -2,35 +2,107 @@ "id": "CVE-2023-33288", "sourceIdentifier": "cve@mitre.org", "published": "2023-05-22T03:15:09.797", - "lastModified": "2023-05-22T15:15:09.797", - "vulnStatus": "Awaiting Analysis", + "lastModified": "2023-05-26T01:12:42.217", + "vulnStatus": "Analyzed", "descriptions": [ { "lang": "en", "value": "An issue was discovered in the Linux kernel before 6.2.9. A use-after-free was found in bq24190_remove in drivers/power/supply/bq24190_charger.c. It could allow a local attacker to crash the system due to a race condition." } ], - "metrics": {}, + "metrics": { + "cvssMetricV31": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", + "attackVector": "LOCAL", + "attackComplexity": "HIGH", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "NONE", + "integrityImpact": "NONE", + "availabilityImpact": "HIGH", + "baseScore": 4.7, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 1.0, + "impactScore": 3.6 + } + ] + }, + "weaknesses": [ + { + "source": "nvd@nist.gov", + "type": "Primary", + "description": [ + { + "lang": "en", + "value": "CWE-416" + } + ] + } + ], + "configurations": [ + { + "nodes": [ + { + "operator": "OR", + "negate": false, + "cpeMatch": [ + { + "vulnerable": true, + "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", + "versionEndExcluding": "6.2.9", + "matchCriteriaId": "9DB8D56A-80A7-46E9-A9BD-100B7446E81A" + } + ] + } + ] + } + ], "references": [ { "url": "https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.9", - "source": "cve@mitre.org" + "source": "cve@mitre.org", + "tags": [ + "Mailing List", + "Patch", + "Release Notes" + ] }, { "url": "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=47c29d69212911f50bdcdd0564b5999a559010d4", - "source": "cve@mitre.org" + "source": "cve@mitre.org", + "tags": [ + "Patch" + ] }, { "url": "https://github.com/torvalds/linux/commit/47c29d69212911f50bdcdd0564b5999a559010d4", - "source": "cve@mitre.org" + "source": "cve@mitre.org", + "tags": [ + "Patch" + ] }, { "url": "https://lore.kernel.org/all/CAHk-=whcaHLNpb7Mu_QX7ABwPgyRyfW-V8=v4Mv0S22fpjY4JQ@mail.gmail.com/", - "source": "cve@mitre.org" + "source": "cve@mitre.org", + "tags": [ + "Mailing List", + "Patch" + ] }, { "url": "https://lore.kernel.org/lkml/20230309174728.233732-1-zyytlz.wz@163.com/", - "source": "cve@mitre.org" + "source": "cve@mitre.org", + "tags": [ + "Mailing List", + "Patch" + ] } ] } \ No newline at end of file diff --git a/README.md b/README.md index 3d9685061b8..2d088802421 100644 --- a/README.md +++ b/README.md @@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2023-05-25T23:55:24.676866+00:00 +2023-05-26T02:00:25.671025+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2023-05-25T23:15:09.447000+00:00 +2023-05-26T01:57:21.513000+00:00 ``` ### Last Data Feed Release @@ -23,7 +23,7 @@ Repository synchronizes with the NVD every 2 hours. Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/releases/latest) ```plain -2023-05-25T00:00:13.539661+00:00 +2023-05-26T00:00:13.554083+00:00 ``` ### Total Number of included CVEs @@ -34,23 +34,18 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/ ### CVEs added in the last Commit -Recently added CVEs: `9` +Recently added CVEs: `0` -* [CVE-2023-2804](CVE-2023/CVE-2023-28xx/CVE-2023-2804.json) (`2023-05-25T22:15:09.443`) -* [CVE-2023-2901](CVE-2023/CVE-2023-29xx/CVE-2023-2901.json) (`2023-05-25T22:15:09.517`) -* [CVE-2023-2902](CVE-2023/CVE-2023-29xx/CVE-2023-2902.json) (`2023-05-25T22:15:09.600`) -* [CVE-2023-31124](CVE-2023/CVE-2023-311xx/CVE-2023-31124.json) (`2023-05-25T22:15:09.680`) -* [CVE-2023-31130](CVE-2023/CVE-2023-311xx/CVE-2023-31130.json) (`2023-05-25T22:15:09.760`) -* [CVE-2023-31147](CVE-2023/CVE-2023-311xx/CVE-2023-31147.json) (`2023-05-25T22:15:09.833`) -* [CVE-2023-2903](CVE-2023/CVE-2023-29xx/CVE-2023-2903.json) (`2023-05-25T23:15:09.293`) -* [CVE-2023-32067](CVE-2023/CVE-2023-320xx/CVE-2023-32067.json) (`2023-05-25T23:15:09.380`) -* [CVE-2023-32074](CVE-2023/CVE-2023-320xx/CVE-2023-32074.json) (`2023-05-25T23:15:09.447`) ### CVEs modified in the last Commit -Recently modified CVEs: `0` +Recently modified CVEs: `4` +* [CVE-2023-33288](CVE-2023/CVE-2023-332xx/CVE-2023-33288.json) (`2023-05-26T01:12:42.217`) +* [CVE-2023-2712](CVE-2023/CVE-2023-27xx/CVE-2023-2712.json) (`2023-05-26T01:13:24.607`) +* [CVE-2023-32991](CVE-2023/CVE-2023-329xx/CVE-2023-32991.json) (`2023-05-26T01:54:42.837`) +* [CVE-2023-32995](CVE-2023/CVE-2023-329xx/CVE-2023-32995.json) (`2023-05-26T01:57:21.513`) ## Download and Usage