mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-06-19 17:31:42 +00:00
Auto-Update: 2025-02-02T03:00:20.459795+00:00
This commit is contained in:
cad-safe-bot
parent
19f85e5052
commit
eac72dd3bc
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "In HeifDecoderImpl::getScanline of HeifDecoderImpl.cpp, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "En HeifDecoderImpl::getScanline de HeifDecoderImpl.cpp, existe una posible lectura fuera de los l\u00edmites debido a una validaci\u00f3n de entrada incorrecta. Esto podr\u00eda provocar la divulgaci\u00f3n remota de informaci\u00f3n sin necesidad de privilegios de ejecuci\u00f3n adicionales. Se necesita la interacci\u00f3n del usuario para su explotaci\u00f3n."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "In HeifDataSource::readAt of HeifDecoderImpl.cpp, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "En HeifDataSource::readAt de HeifDecoderImpl.cpp, existe una posible lectura fuera de los l\u00edmites debido a un desbordamiento de enteros. Esto podr\u00eda provocar la divulgaci\u00f3n remota de informaci\u00f3n sin necesidad de privilegios de ejecuci\u00f3n adicionales. Se necesita la interacci\u00f3n del usuario para su explotaci\u00f3n."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "In TdlsexRxFrameHandle of the MTK WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "En TdlsexRxFrameHandle del controlador MTK WLAN, existe una posible escritura fuera de los l\u00edmites debido a un neutra. Esto podr\u00eda provocar una escalada remota de privilegios sin necesidad de privilegios de ejecuci\u00f3n adicionales. No se necesita interacci\u00f3n del usuario para la explotaci\u00f3n."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "In BnAudioPolicyService::onTransact of IAudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "En BnAudioPolicyService::onTransact de IAudioPolicyService.cpp, existe una posible divulgaci\u00f3n de informaci\u00f3n debido a datos no inicializados. Esto podr\u00eda generar una divulgaci\u00f3n de informaci\u00f3n local sin necesidad de privilegios de ejecuci\u00f3n adicionales. No se necesita interacci\u00f3n del usuario para la explotaci\u00f3n."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "chrome-cve-admin@google.com",
|
||||
"published": "2019-11-25T15:15:33.887",
|
||||
"lastModified": "2024-11-21T04:25:34.420",
|
||||
"vulnStatus": "Modified",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape() function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "La versi\u00f3n 0.9.12 y anteriores de LibVNCServer contienen una vulnerabilidad de desbordamiento del b\u00fafer de mont\u00f3n dentro de la funci\u00f3n HandleCursorShape() en libvncclient/cursor.c. Un atacante env\u00eda formas de cursor con dimensiones manipulado especiales, lo que puede provocar la ejecuci\u00f3n remota de c\u00f3digo."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "secure@microsoft.com",
|
||||
"published": "2020-11-11T07:15:18.997",
|
||||
"lastModified": "2024-11-21T05:07:47.513",
|
||||
"vulnStatus": "Modified",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "security_alert@emc.com",
|
||||
"published": "2024-05-22T06:15:09.317",
|
||||
"lastModified": "2024-11-21T05:26:53.077",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "When copying files with rsync, octorpki uses the \"-a\" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service definition defaults to root ( https://github.com/cloudflare/cfrpki/blob/master/package/octorpki.service ) this could allow for a vector, when combined with another vulnerability that causes octorpki to process a malicious TAL file, for a local privilege escalation."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Al copiar archivos con rsync, octorpki utiliza el indicador \"-a\" 0, que obliga a rsync a copiar binarios con el bit suid establecido como root. Dado que la definici\u00f3n de servicio proporcionada tiene como valor predeterminado root (https://github.com/cloudflare/cfrpki/blob/master/package/octorpki.service), esto podr\u00eda permitir un vector, cuando se combina con otra vulnerabilidad que hace que octorpki procese un archivo TAL malicioso, para una escalada de privilegios local."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-03-04T18:15:07.670",
|
||||
"lastModified": "2024-11-21T06:35:22.760",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-03-04T18:15:08.090",
|
||||
"lastModified": "2024-11-21T06:35:23.650",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-03-04T18:15:08.267",
|
||||
"lastModified": "2024-11-21T06:35:23.917",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-03-04T18:15:08.450",
|
||||
"lastModified": "2024-11-21T06:35:24.037",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-05-21T15:15:11.530",
|
||||
"lastModified": "2024-11-21T06:35:39.510",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-05-21T15:15:24.710",
|
||||
"lastModified": "2024-11-21T06:36:03.317",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-05-21T15:15:26.030",
|
||||
"lastModified": "2024-11-21T06:36:04.693",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-05-22T07:15:11.117",
|
||||
"lastModified": "2024-11-21T06:36:12.487",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,12 +3,16 @@
|
||||
"sourceIdentifier": "cve@rapid7.com",
|
||||
"published": "2025-01-28T00:15:06.487",
|
||||
"lastModified": "2025-01-28T00:15:06.487",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware OS before 12.8.1, 12.1.4, and 12.5.10 allows an authenticated remote attacker with unprivileged credentials to upload or read files to limited, arbitrary locations on WatchGuard Firebox and XTM appliances"
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Una vulnerabilidad de inyecci\u00f3n de argumentos en los comandos diagnose e import pac en WatchGuard Fireware OS anterior a 12.8.1, 12.1.4 y 12.5.10 permite que un atacante remoto autenticado con credenciales sin privilegios cargue o lea archivos en ubicaciones arbitrarias limitadas en los dispositivos WatchGuard Firebox y XTM"
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote Mouse Server by Emote Interactive can be abused by attackers to inject OS commands over theproduct's custom control protocol. A Metasploit module was written and tested against version 4.110, the current version when this CVE was reserved."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Debido a la dependencia de un c\u00f3digo de sustituci\u00f3n trivial, enviado en texto plano, y la dependencia de una contrase\u00f1a predeterminada cuando el usuario no establece una contrase\u00f1a, los atacantes pueden abusar del servidor de mouse remoto de Emote Interactive para inyectar comandos del sistema operativo a trav\u00e9s del protocolo de control personalizado del producto. Se escribi\u00f3 y prob\u00f3 un m\u00f3dulo de Metasploit contra la versi\u00f3n 4.110, la versi\u00f3n actual cuando se reserv\u00f3 este CVE."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,12 +3,16 @@
|
||||
"sourceIdentifier": "psirt@us.ibm.com",
|
||||
"published": "2025-01-30T12:15:26.867",
|
||||
"lastModified": "2025-01-30T14:15:29.990",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM App Connect Enterprise Certified Container 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12.5, 12.6, and 12.7 Pods do not restrict network egress for Pods that are used for internal infrastructure."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Los pods de IBM App Connect Enterprise Certified Container 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12.5, 12.6 y 12.7 no restringen la salida de la red para los pods que se utilizan para la infraestructura interna."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "GPAC MP4box 2.1-DEV-rev574-g9d5bb184b contains a buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c, check needed for num_exp_tile_columns"
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "GPAC MP4box 2.1-DEV-rev574-g9d5bb184b contiene un desbordamiento de b\u00fafer en la funci\u00f3n gf_vvc_read_pps_bs_internal de media_tools/av_parsers.c, se necesita una verificaci\u00f3n para num_exp_tile_columns"
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-03-05T12:15:45.780",
|
||||
"lastModified": "2024-11-21T07:33:38.930",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-05-21T16:15:12.100",
|
||||
"lastModified": "2024-11-21T07:33:49.720",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-07-16T12:15:03.427",
|
||||
"lastModified": "2024-11-21T07:34:01.003",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "xmlXIncludeAddNode en xinclude.c en libxml2 anterior a 2.11.0 tiene un use-after-free."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A flaw was found in the Red Hat Advanced Cluster Security (RHACS) portal. When rendering a table view in the portal, for example, on any of the /main/configmanagement/* endpoints, the front-end generates a DOM table-element (id=\"pdf-table\"). This information is then populated with unsanitized data using innerHTML. An attacker with some control over the data rendered can trigger a cross-site scripting (XSS) vulnerability."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Se encontr\u00f3 una falla en el portal Red Hat Advanced Cluster Security (RHACS). Al representar una vista de tabla en el portal, por ejemplo, en cualquiera de los archivos /main/configmanagement/* endpoints, el front-end genera un elemento de tabla DOM (id=\"pdf-table\"). Esta informaci\u00f3n luego se completa con datos no desinfectada mediante innerHTML. Un atacante con cierto control sobre los datos representados puede desencadenar una vulnerabilidad de cross-site scripting (XSS)."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2025-01-21T22:15:09.710",
|
||||
"lastModified": "2025-01-23T16:15:27.067",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2025-01-21T22:15:09.823",
|
||||
"lastModified": "2025-01-23T16:15:28.080",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Potential privilege escalation vulnerability in Revenera InstallShield versions 2022 R2 and 2021 R2\u00a0due to adding\u00a0InstallScript custom action to a Basic MSI or InstallScript MSI project extracting few binaries to a predefined writable folder during installation time. The standard user account has write access to these files and folders, hence replacing them during installation time can lead to a DLL hijacking vulnerability."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Vulnerabilidad potencial de escalada de privilegios en las versiones 2022 R2 y 2021 R2 de Revenera InstallShield debido a la adici\u00f3n de una acci\u00f3n personalizada InstallScript a un proyecto MSI b\u00e1sico o MSI InstallScript que extrae algunos archivos binarios a una carpeta escribible predefinida durante el tiempo de instalaci\u00f3n. La cuenta de usuario est\u00e1ndar tiene acceso de escritura a estos archivos y carpetas, por lo que reemplazarlos durante el tiempo de instalaci\u00f3n puede provocar una vulnerabilidad de secuestro de DLL."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "psirt@us.ibm.com",
|
||||
"published": "2025-01-23T03:15:08.290",
|
||||
"lastModified": "2025-01-23T03:15:08.290",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Security Verify Governance 10.0.2 Identity Manager \n\nuses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Security Verify Governance 10.0.2 Identity Manager utiliza un hash criptogr\u00e1fico unidireccional contra una entrada que no debe ser reversible, como una contrase\u00f1a, pero el producto no utiliza una sal como parte de la entrada."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Security Verify Governance 10.0.2 Identity Manager can transmit user credentials in clear text that could be obtained by an attacker using man in the middle techniques."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Security Verify Governance 10.0.2 Identity Manager puede transmitir credenciales de usuario en texto plano que un atacante podr\u00eda obtener mediante t\u00e9cnicas de intermediario."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Aspera Faspex 5.0.0 a 5.0.10 no requiere que los usuarios tengan contrase\u00f1as seguras de forma predeterminada, lo que facilita que los atacantes comprometan las cuentas de usuario."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2025-01-22T15:15:09.647",
|
||||
"lastModified": "2025-01-22T15:15:09.647",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2025-01-22T15:15:10.987",
|
||||
"lastModified": "2025-01-23T15:15:09.280",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2025-01-22T15:15:11.100",
|
||||
"lastModified": "2025-01-22T15:15:11.100",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2025-01-22T15:15:11.207",
|
||||
"lastModified": "2025-01-22T15:15:11.207",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2025-01-22T15:15:11.310",
|
||||
"lastModified": "2025-01-22T15:15:11.310",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2025-01-22T15:15:11.410",
|
||||
"lastModified": "2025-01-22T15:15:11.410",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2025-01-22T15:15:11.510",
|
||||
"lastModified": "2025-01-22T15:15:11.510",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2025-01-22T15:15:11.613",
|
||||
"lastModified": "2025-01-22T15:15:11.613",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2025-01-22T15:15:11.710",
|
||||
"lastModified": "2025-01-22T15:15:11.710",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2025-01-22T15:15:11.817",
|
||||
"lastModified": "2025-01-23T15:15:09.430",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2025-01-22T15:15:11.913",
|
||||
"lastModified": "2025-01-22T15:15:11.913",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Aspera Faspex 5.0.0 a 5.0.10 no requiere que los usuarios tengan contrase\u00f1as seguras de forma predeterminada, lo que facilita que los atacantes comprometan las cuentas de usuario."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Aspera Faspex 5.0.0 through 5.0.10 could allow a privileged user to make system changes without proper access controls."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Aspera Faspex 5.0.0 a 5.0.10 podr\u00eda permitir que un usuario privilegiado realice cambios sistema sin los controles de acceso adecuados."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Aspera Faspex 5.0.0 through 5.0.10 could disclose sensitive username information due to an observable response discrepancy."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Aspera Faspex 5.0.0 a 5.0.10 podr\u00edan revelar informaci\u00f3n confidencial del nombre de usuario debido a una discrepancia de respuesta observable."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Cognos Mobile Client 1.1 iOS puede ser vulnerable a la divulgaci\u00f3n de informaci\u00f3n mediante t\u00e9cnicas de intermediario (man in the middle) debido a la falta de fijaci\u00f3n de certificados."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Cloud Pak System 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Cloud Pak System 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1 y 2.3.4.0 podr\u00edan permitir que un atacante remoto recorra directorios en el directorio ra\u00edz sistema. Un atacante podr\u00eda enviar una solicitud de URL manipulado especial que contenga secuencias de \"punto punto\" (/../) para ver archivos arbitrarios sistema."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the system."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7 y 2.3.3.7 iFix1 podr\u00edan revelar informaci\u00f3n confidencial en respuestas HTTP que podr\u00eda ayudar en futuros ataques contra el tallo sistema."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1\u00a0could allow an authenticated user to obtain sensitive information from log files."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7 y 2.3.3.7 iFix1 podr\u00edan permitir que un usuario autenticado obtenga informaci\u00f3n confidencial de los archivos de registro."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1\u00a0could disclose sensitive information about the system that could aid in further attacks against the system."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7 y 2.3.3.7 iFix1 podr\u00edan revelar informaci\u00f3n confidencial sobre el tallo sistema que podr\u00eda ayudar en futuros ataques contra sistema."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1\u00a0could disclose sensitive information about the system that could aid in further attacks against the system."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7 y 2.3.3.7 iFix1 podr\u00edan revelar informaci\u00f3n confidencial sobre el tallo sistema que podr\u00eda ayudar en futuros ataques contra sistema."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could disclose sensitive information about the system that could aid in further attacks against the system."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1 y 2.3.4.0 podr\u00edan revelar informaci\u00f3n confidencial sobre el tallo sistema que podr\u00eda ayudar en futuros ataques contra sistema."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM InfoSphere Master Data Management 11.6, 12.0, and 14.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM InfoSphere Master Data Management 11.6, 12.0 y 14.0 es vulnerable a Cross-Site Scripting Almacenado. Esta vulnerabilidad permite a los usuarios incorporar c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, alterando as\u00ed la funcionalidad prevista y pudiendo provocar la divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n de confianza."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to enumerate usernames due to an observable discrepancy in request responses."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Sterling File Gateway 6.0.0.0 a 6.1.2.5 y 6.2.0.0 a 6.2.0.1 podr\u00edan permitir que un usuario autenticado enumere nombres de usuario debido a una discrepancia observable en las respuestas de las solicitudes."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "audit@patchstack.com",
|
||||
"published": "2025-01-02T12:15:15.180",
|
||||
"lastModified": "2025-01-02T12:15:15.180",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "audit@patchstack.com",
|
||||
"published": "2024-04-24T16:15:07.913",
|
||||
"lastModified": "2024-11-21T08:30:21.103",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "psirt@us.ibm.com",
|
||||
"published": "2025-01-23T03:15:08.573",
|
||||
"lastModified": "2025-01-23T03:15:08.573",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,12 +3,16 @@
|
||||
"sourceIdentifier": "psirt@us.ibm.com",
|
||||
"published": "2025-01-28T01:15:08.410",
|
||||
"lastModified": "2025-01-28T01:15:08.410",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1\nis vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Sterling B2B Integrator 6.0.0.0 a 6.1.2.5 y 6.2.0.0 a 6.2.0.1 es vulnerable a la inyecci\u00f3n SQL. Un atacante remoto podr\u00eda enviar instrucciones SQL especialmente manipuladas, que podr\u00edan permitirle ver, agregar, modificar o eliminar informaci\u00f3n en la base de datos back-end."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Common Licensing 9.0 almacena las credenciales de usuario en formato texto plano simple que puede ser le\u00eddo por un usuario local."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization mechanism."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Common Licensing 9.0 podr\u00eda permitir que un usuario autenticado modifique un archivo de configuraci\u00f3n al que no deber\u00eda tener acceso debido a un mecanismo de autorizaci\u00f3n roto."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "IBM Sterling File Gateway 6.0.0.0 a 6.1.2.5 y 6.2.0.0 a 6.2.0.3 es vulnerable a Cross-Site Scripting Almacenado. Esta vulnerabilidad permite a los usuarios incorporar c\u00f3digo JavaScript arbitrario en la interfaz de usuario web, alterando as\u00ed la funcionalidad prevista y pudiendo provocar la divulgaci\u00f3n de credenciales dentro de una sesi\u00f3n de confianza."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-03-06T07:15:06.553",
|
||||
"lastModified": "2024-11-21T08:40:07.307",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-04-03T15:15:51.417",
|
||||
"lastModified": "2024-11-21T08:40:15.537",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-05-21T16:15:16.957",
|
||||
"lastModified": "2024-11-21T08:40:34.457",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-05-21T16:15:22.377",
|
||||
"lastModified": "2024-11-21T08:40:43.647",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-05-21T16:15:22.803",
|
||||
"lastModified": "2024-11-21T08:40:44.087",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-05-21T16:15:23.003",
|
||||
"lastModified": "2024-11-21T08:40:44.493",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "security@wordfence.com",
|
||||
"published": "2024-02-26T16:27:49.230",
|
||||
"lastModified": "2024-11-21T08:42:27.783",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "vulnerabilities@zephyrproject.org",
|
||||
"published": "2024-03-15T19:15:07.010",
|
||||
"lastModified": "2024-11-21T08:45:09.607",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "emo@eclipse.org",
|
||||
"published": "2024-07-17T15:15:10.457",
|
||||
"lastModified": "2024-11-21T08:45:38.900",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
56
CVE-2024/CVE-2024-01xx/CVE-2024-0131.json
Normal file
56
CVE-2024/CVE-2024-01xx/CVE-2024-0131.json
Normal file
@ -0,0 +1,56 @@
|
||||
{
|
||||
"id": "CVE-2024-0131",
|
||||
"sourceIdentifier": "psirt@nvidia.com",
|
||||
"published": "2025-02-02T01:15:24.640",
|
||||
"lastModified": "2025-02-02T01:15:24.640",
|
||||
"vulnStatus": "Received",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NVIDIA GPU kernel driver for Windows and Linux contains a vulnerability where a potential user-mode attacker could read \u00a0a buffer with an incorrect length. A successful exploit of this vulnerability might lead to denial of service."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "psirt@nvidia.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
|
||||
"baseScore": 4.4,
|
||||
"baseSeverity": "MEDIUM",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 0.8,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "psirt@nvidia.com",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-805"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5614",
|
||||
"source": "psirt@nvidia.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -3,12 +3,16 @@
|
||||
"sourceIdentifier": "psirt@nvidia.com",
|
||||
"published": "2025-01-28T03:15:07.283",
|
||||
"lastModified": "2025-01-28T03:15:07.283",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to modification of a host binary. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "NVIDIA Container Toolkit contiene una vulnerabilidad de aislamiento indebido en la que una imagen de contenedor manipulado especial podr\u00eda provocar la modificaci\u00f3n de un binario del host. Una explotaci\u00f3n exitosa de esta vulnerabilidad puede provocar la ejecuci\u00f3n de c\u00f3digo, la denegaci\u00f3n de servicio, la escalada de privilegios, la divulgaci\u00f3n de informaci\u00f3n y la manipulaci\u00f3n de datos."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,12 +3,16 @@
|
||||
"sourceIdentifier": "psirt@nvidia.com",
|
||||
"published": "2025-01-28T03:15:07.433",
|
||||
"lastModified": "2025-01-28T03:15:07.433",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code obtaining read and write access to host devices. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "NVIDIA Container Toolkit contiene una vulnerabilidad de aislamiento inapropiado en la que una imagen de contenedor manipulado especial podr\u00eda provocar que un c\u00f3digo no confiable obtenga acceso de lectura y escritura a los dispositivos host. Esta vulnerabilidad solo est\u00e1 presente cuando NVIDIA Container Toolkit est\u00e1 configurado de una manera no predeterminada. Una explotaci\u00f3n exitosa de esta vulnerabilidad puede provocar la ejecuci\u00f3n de c\u00f3digo, la denegaci\u00f3n de servicio, la escalada de privilegios, la divulgaci\u00f3n de informaci\u00f3n y la manipulaci\u00f3n de datos."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,12 +3,16 @@
|
||||
"sourceIdentifier": "psirt@nvidia.com",
|
||||
"published": "2025-01-28T03:15:07.567",
|
||||
"lastModified": "2025-01-28T03:15:07.567",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NVIDIA Container Toolkit contains an improper isolation vulnerability where a specially crafted container image could lead to untrusted code running in the host\u2019s network namespace. This vulnerability is present only when the NVIDIA Container Toolkit is configured in a nondefault way. A successful exploit of this vulnerability may lead to denial of service and escalation of privileges."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "NVIDIA Container Toolkit contiene una vulnerabilidad de aislamiento inapropiado en la que una imagen de contenedor manipulado especial podr\u00eda provocar la ejecuci\u00f3n de c\u00f3digo no confiable en el espacio de nombres de red del host. Esta vulnerabilidad solo est\u00e1 presente cuando NVIDIA Container Toolkit est\u00e1 configurado de una manera no predeterminada. Una explotaci\u00f3n exitosa de esta vulnerabilidad puede provocar la denegaci\u00f3n de servicio y la escalada de privilegios."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,12 +3,16 @@
|
||||
"sourceIdentifier": "psirt@nvidia.com",
|
||||
"published": "2025-01-28T04:15:08.730",
|
||||
"lastModified": "2025-01-28T04:15:08.730",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "NVIDIA RAPIDS contiene una vulnerabilidad en cuDF y cuML, donde un usuario podr\u00eda causar un problema de deserializaci\u00f3n de datos no confiables. Una explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda provocar ejecuci\u00f3n de c\u00f3digo, manipulaci\u00f3n de datos, denegaci\u00f3n de servicio y divulgaci\u00f3n de informaci\u00f3n."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,12 +3,16 @@
|
||||
"sourceIdentifier": "psirt@nvidia.com",
|
||||
"published": "2025-01-28T04:15:09.447",
|
||||
"lastModified": "2025-01-28T04:15:09.447",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause memory corruption. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, or data tampering."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "El software NVIDIA vGPU contiene una vulnerabilidad en el Administrador de GPU virtual, donde un invitado malintencionado podr\u00eda provocar da\u00f1os en la memoria. Una explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda provocar la ejecuci\u00f3n de c\u00f3digo, la denegaci\u00f3n de servicio, la divulgaci\u00f3n de informaci\u00f3n o la manipulaci\u00f3n de datos."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,12 +3,16 @@
|
||||
"sourceIdentifier": "psirt@nvidia.com",
|
||||
"published": "2025-01-28T04:15:09.590",
|
||||
"lastModified": "2025-01-28T04:15:09.590",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NVIDIA GPU display driver for Windows and Linux contains a vulnerability where referencing memory after it has been freed can lead to denial of service or data tampering."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "El controlador de pantalla de la GPU NVIDIA para Windows y Linux contiene una vulnerabilidad donde hacer referencia a la memoria despu\u00e9s de haberla liberado puede provocar una denegaci\u00f3n de servicio o manipulaci\u00f3n de datos."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,12 +3,16 @@
|
||||
"sourceIdentifier": "psirt@nvidia.com",
|
||||
"published": "2025-01-28T04:15:09.733",
|
||||
"lastModified": "2025-01-28T04:15:09.733",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an attacker unauthorized access to files. A successful exploit of this vulnerability might lead to limited information disclosure."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "El controlador de pantalla de la GPU NVIDIA para Linux contiene una vulnerabilidad que podr\u00eda permitir a un atacante acceder sin autorizaci\u00f3n a los archivos. Una explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda dar lugar a una divulgaci\u00f3n limitada de informaci\u00f3n."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,12 +3,16 @@
|
||||
"sourceIdentifier": "psirt@nvidia.com",
|
||||
"published": "2025-01-28T04:15:09.877",
|
||||
"lastModified": "2025-01-28T04:15:09.877",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NVIDIA GPU display driver for Windows and Linux contains a vulnerability where data is written past the end or before the beginning of a buffer. A successful exploit of this vulnerability might lead to information disclosure, denial of service, or data tampering."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "El controlador de pantalla de la GPU NVIDIA para Windows y Linux contiene una vulnerabilidad en la que los datos se escriben despu\u00e9s del final o antes del comienzo de un b\u00fafer. Una explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda provocar la divulgaci\u00f3n de informaci\u00f3n, la denegaci\u00f3n de servicio o la manipulaci\u00f3n de datos."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "security_alert@emc.com",
|
||||
"published": "2024-04-12T17:17:21.027",
|
||||
"lastModified": "2024-11-21T08:45:57.560",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "security_alert@emc.com",
|
||||
"published": "2024-03-13T16:15:10.143",
|
||||
"lastModified": "2024-11-21T08:45:58.623",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "security_alert@emc.com",
|
||||
"published": "2024-03-13T17:15:46.617",
|
||||
"lastModified": "2024-11-21T08:45:58.750",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "security_alert@emc.com",
|
||||
"published": "2024-04-03T10:15:08.030",
|
||||
"lastModified": "2024-11-21T08:46:00.143",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "product-security@silabs.com",
|
||||
"published": "2024-02-15T21:15:08.673",
|
||||
"lastModified": "2024-11-21T08:46:07.790",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
"sourceIdentifier": "emo@eclipse.org",
|
||||
"published": "2024-04-26T10:15:10.960",
|
||||
"lastModified": "2024-11-21T08:47:15.553",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A Code Injection vulnerability was identified in GitHub Enterprise Server that allowed attackers to inject malicious code into the query selector via the identity property in the message handling function. This\u00a0enabled the exfiltration of sensitive data by manipulating the DOM, including authentication tokens.\u00a0To execute the attack, the victim must be logged into GitHub and interact with the attacker controlled malicious webpage containing the hidden iframe.\u00a0This vulnerability occurs due to an improper sequence of validation, where the origin check occurs after accepting the user-controlled\u00a0identity property.\u00a0This vulnerability affected all versions of GitHub Enterprise Server prior to 3.11.16, 3.12.10, 3.13.5, 3.14.2, and 3.15.0. This vulnerability was reported via the GitHub Bug Bounty program."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Se identific\u00f3 una vulnerabilidad de inyecci\u00f3n de c\u00f3digo en GitHub Enterprise Server que permit\u00eda a los atacantes inyectar c\u00f3digo malicioso en el selector de consultas a trav\u00e9s de la propiedad de identidad en la funci\u00f3n de gesti\u00f3n de mensajes. Esto permiti\u00f3 la exfiltraci\u00f3n de datos confidenciales mediante la manipulaci\u00f3n de los tokens de autenticaci\u00f3n DOM, incluida. Para ejecutar el ataque, la v\u00edctima debe iniciar sesi\u00f3n en GitHub e interactuar con la p\u00e1gina web maliciosa controlada por el atacante que contiene el iframe oculto. Esta vulnerabilidad se produce debido a una secuencia incorrecta de validaci\u00f3n, donde la verificaci\u00f3n de origen se produce despu\u00e9s de aceptar la propiedad de identidad controlada por el usuario. Esta vulnerabilidad afect\u00f3 a todas las versiones de GitHub Enterprise Server anteriores a 3.11.16, 3.12.10, 3.13.5, 3.14.2 y 3.15.0. Esta vulnerabilidad se inform\u00f3 a trav\u00e9s del programa GitHub Bug Bounty."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A weak hashing algorithm and small sizes of seeds/secrets in Google's gVisor allowed for a remote attacker to calculate a local IP address and a per-boot identifier that could aid in tracking of a device in certain circumstances."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Un algoritmo hash d\u00e9bil y tama\u00f1os peque\u00f1os de semillas/secretos en gVisor de Google permitieron a un atacante remoto calcular una direcci\u00f3n IP local y un identificador por arranque que podr\u00eda ayudar a rastrear un dispositivo en ciertas circunstancias."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Tracking Code Manager WordPress plugin before 2.4.0 does not sanitise and escape some of its metabox settings when outputing them in the page, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "El complemento Tracking Code Manager de WordPress anterior a la versi\u00f3n 2.4.0 no desinfecta ni escapa algunas de las configuraciones de su metabox al mostrarlas en la p\u00e1gina, lo que podr\u00eda permitir que los usuarios con un rol tan bajo como Colaborador realicen ataques de Cross-Site Scripting."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,12 +3,16 @@
|
||||
"sourceIdentifier": "security@wordfence.com",
|
||||
"published": "2025-01-24T14:15:30.837",
|
||||
"lastModified": "2025-01-24T14:15:30.837",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.2 via the register_controls function in widgets/offcanvas-rometheme.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "El complemento RomethemeKit For Elementor para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n confidencial en todas las versiones hasta la 1.5.2 y incluida a trav\u00e9s de la funci\u00f3n register_controls en widgets/offcanvas-rometheme.php. Esto permite que atacantes autenticados, con acceso de nivel de colaborador o superior, extraigan datos confidenciales de plantillas privadas, pendientes y en borrador."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Flexmls\u00ae IDX Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018api_key\u2019 and 'api_secret' parameters in all versions up to, and including, 3.14.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability was partially patched in version 3.14.25."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "El complemento Flexmls\u00ae IDX Plugin para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s de los par\u00e1metros 'api_key' y 'api_secret' en todas las versiones hasta la 3.14.26 y incluida, debido a un escape de entrada desinfecci\u00f3n y salida insuficiente. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitraria en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. La vulnerabilidad fue parcialmente corregida en la versi\u00f3n 3.14.25."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ays_save_google_credentials' function in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency). This makes it possible for unauthenticated attackers to modify the Google Sheets integration credentials within the plugin's settings. Because the 'client_id' parameter is not sanitized or escaped when used in output, this vulnerability could also be leveraged to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Los complementos Quiz Maker Business, Developer y Agency para WordPress son vulnerables a la modificaci\u00f3n no autorizada de datos debido a una verificaci\u00f3n de capacidad faltante en la funci\u00f3n 'ays_save_google_credentials' en todas las versiones hasta incluida, 8.8.0 (Business), hasta incluidag, 21.8.0 (Developer) y hasta incluidang, 31.8.0 (Agency). Esto permite que atacantes no autenticados modifiquen las credenciales de integraci\u00f3n de Google Sheets dentro de la configuraci\u00f3n del complemento. Debido a que el par\u00e1metro 'client_id' no se desinfecta ni se escapa cuando se usa en la salida, esta vulnerabilidad tambi\u00e9n podr\u00eda aprovecharse para inyectar scripts web arbitraria en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -3,12 +3,16 @@
|
||||
"sourceIdentifier": "security@wordfence.com",
|
||||
"published": "2025-01-30T14:15:30.737",
|
||||
"lastModified": "2025-01-30T14:15:30.737",
|
||||
"vulnStatus": "Received",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The MWB HubSpot for WooCommerce \u2013 CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hubwoo_save_updates() function in all versions up to, and including, 1.5.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "El complemento HubSpot for WooCommerce \u2013 CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics de MWB para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos que puede provocar una escalada de privilegios debido a una falta de verificaci\u00f3n de capacidad en la funci\u00f3n hubwoo_save_updates() en todas las versiones hasta la 1.5.9 y incluida. Esto permite que atacantes autenticados, con acceso de nivel de colaborador y superior, actualicen opciones arbitrarias en el sitio de WordPress. Esto se puede aprovechar para actualizar el rol predeterminado para el registro como administrador y habilitar el registro de usuarios para que los atacantes obtengan acceso de usuario administrativo a un sitio vulnerable."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be predicted by an external attacker in some circumstances."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Las debilidades en la generaci\u00f3n de puertos de origen TCP/UDP y algunos otros valores de encabezado en gVisor de Google permitieron que un atacante externo pudiera predecirlos en algunas circunstancias."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Vulnerabilities in the algorithms used by Fuchsia to populate network protocol header fields, specifically the TCP ISN, TCP timestamp, TCP and UDP source ports, and IPv4/IPv6 fragment ID allow for these values to be guessed under circumstances"
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Las vulnerabilidades en los algoritmos utilizados por Fuchsia para completar los campos de encabezado del protocolo de red, espec\u00edficamente TCP ISN, TCP timestamp, puertos de origen TCP y UDP y el ID de fragmento IPv4/IPv6 permiten adivinar estos valores en determinadas circunstancias."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to SQL Injection via the \u2018id\u2019 parameter in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Los complementos Quiz Maker Business, Developer y Agency para WordPress son vulnerables a la inyecci\u00f3n SQL a trav\u00e9s del par\u00e1metro \"id\" en todas las versiones hasta incluida, 8.8.0 (Business), hasta incluidag, 21.8.0 (Developer) y hasta incluidang, 31.8.0 (Agency) debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y a la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto permite que atacantes no autenticados agreguen consultas SQL adicionales a consultas ya existentes que se pueden usar para extraer informaci\u00f3n confidencial de la base de datos."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency). This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Los complementos Quiz Maker Business, Developer y Agency para WordPress son vulnerables a la ejecuci\u00f3n de c\u00f3digos cortos arbitrarios en todas las versiones hasta incluida, 8.8.0 (Business), hasta incluidag, 21.8.0 (Developer) y hasta incluidang, 31.8.0 (Agency). Esto se debe a que el software permite a los usuarios ejecutar una acci\u00f3n que no valida correctamente un valor antes de ejecutar do_shortcode. Esto hace posible que atacantes no autenticados ejecuten c\u00f3digos cortos arbitrarios."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018content\u2019 parameter in all versions up to, and including, 8.8.0 (Business), up to, and including, 21.8.0 (Developer), and up to, and including, 31.8.0 (Agency) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Los complementos Quiz Maker Business, Developer y Agency para WordPress son vulnerables a Cross-Site Scripting Reflejado a trav\u00e9s del par\u00e1metro 'content' en todas las versiones hasta incluida, 8.8.0 (Business), hasta incluidag, 21.8.0 (Developer) y hasta incluidang, 31.8.0 (Agency) debido a un escape de entrada desinfecci\u00f3n y de salida insuficiente. Esto permite que atacantes no autenticados inyecten scripts web arbitraria en p\u00e1ginas que se ejecutan si pueden enga\u00f1ar con \u00e9xito a un usuario para que realice una acci\u00f3n como hacer clic en un enlace."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -9,6 +9,10 @@
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Multiple Page Generator Plugin \u2013 MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.5 via the 'mpg_download_file_by_link' function. This makes it possible for authenticated attackers, with editor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "El complemento Multiple Page Generator Plugin \u2013 MPG para WordPress es vulnerable a Server-Side Request Forgery en todas las versiones hasta la 4.0.5 y incluida a trav\u00e9s de la funci\u00f3n 'mpg_download_file_by_link'. Esto permite que atacantes autenticados, con acceso de nivel de editor o superior, realicen solicitudes web a ubicaciones arbitrarias que se originan en la aplicaci\u00f3n web y se pueden usar para consultar y modificar informaci\u00f3n de servicios internos."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user