mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-08 11:37:26 +00:00
Auto-Update: 2024-01-31T05:00:24.450116+00:00
This commit is contained in:
cad-safe-bot
parent
b71d8d619d
commit
efcfb19ff1
47
CVE-2023/CVE-2023-24xx/CVE-2023-2439.json
Normal file
47
CVE-2023/CVE-2023-24xx/CVE-2023-2439.json
Normal file
@ -0,0 +1,47 @@
|
||||
{
|
||||
"id": "CVE-2023-2439",
|
||||
"sourceIdentifier": "security@wordfence.com",
|
||||
"published": "2024-01-31T03:15:07.973",
|
||||
"lastModified": "2024-01-31T03:15:07.973",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, 5.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "security@wordfence.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 6.4,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 3.1,
|
||||
"impactScore": 2.7
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681",
|
||||
"source": "security@wordfence.com"
|
||||
},
|
||||
{
|
||||
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/21cb424c-4efd-4c12-a08a-6d574f118c28?source=cve",
|
||||
"source": "security@wordfence.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,7 +2,7 @@
|
||||
"id": "CVE-2023-29491",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-04-14T01:15:08.570",
|
||||
"lastModified": "2023-12-03T20:15:07.023",
|
||||
"lastModified": "2024-01-31T03:15:07.860",
|
||||
"vulnStatus": "Modified",
|
||||
"descriptions": [
|
||||
{
|
||||
@ -91,6 +91,10 @@
|
||||
"url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://security.netapp.com/advisory/ntap-20230517-0009/",
|
||||
"source": "cve@mitre.org"
|
||||
|
||||
20
CVE-2023/CVE-2023-315xx/CVE-2023-31505.json
Normal file
20
CVE-2023/CVE-2023-315xx/CVE-2023-31505.json
Normal file
@ -0,0 +1,20 @@
|
||||
{
|
||||
"id": "CVE-2023-31505",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2024-01-31T03:15:08.160",
|
||||
"lastModified": "2024-01-31T03:15:08.160",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain sensitive information via a crafted .phtml file."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://m3n0sd0n4ld.github.io/patoHackventuras/cve-2023-31505",
|
||||
"source": "cve@mitre.org"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,12 +2,12 @@
|
||||
"id": "CVE-2023-48387",
|
||||
"sourceIdentifier": "twcert@cert.org.tw",
|
||||
"published": "2023-12-15T09:15:08.357",
|
||||
"lastModified": "2023-12-22T15:19:34.833",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-01-31T03:15:08.213",
|
||||
"vulnStatus": "Modified",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "TAIWAN-CA(TWCA) JCICSecurityTool's Registry-related functions have insufficient filtering for special characters. An unauthenticated remote attacker can inject malicious script into a webpage to perform XSS (Stored Cross-Site Scripting) attack."
|
||||
"value": "TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario where a user is using the JCICSecurityTool and has completed identity verification, if the user browses a malicious webpage created by an attacker, the attacker can exploit this vulnerability to read or modify any registry file under HKEY_CURRENT_USER, thereby achieving remote code execution.\n\n"
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
@ -17,27 +17,27 @@
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"source": "twcert@cert.org.tw",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 6.1,
|
||||
"baseSeverity": "MEDIUM"
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 2.7
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "twcert@cert.org.tw",
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
@ -60,17 +60,17 @@
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"source": "twcert@cert.org.tw",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-79"
|
||||
"value": "CWE-20"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "twcert@cert.org.tw",
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
"id": "CVE-2023-50495",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-12-12T15:15:07.867",
|
||||
"lastModified": "2024-01-19T16:15:10.193",
|
||||
"lastModified": "2024-01-31T03:15:08.490",
|
||||
"vulnStatus": "Modified",
|
||||
"descriptions": [
|
||||
{
|
||||
@ -68,6 +68,10 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html",
|
||||
"source": "cve@mitre.org",
|
||||
|
||||
51
CVE-2024/CVE-2024-10xx/CVE-2024-1069.json
Normal file
51
CVE-2024/CVE-2024-10xx/CVE-2024-1069.json
Normal file
@ -0,0 +1,51 @@
|
||||
{
|
||||
"id": "CVE-2024-1069",
|
||||
"sourceIdentifier": "security@wordfence.com",
|
||||
"published": "2024-01-31T03:15:08.573",
|
||||
"lastModified": "2024-01-31T03:15:08.573",
|
||||
"vulnStatus": "Received",
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Contact Form Entries plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'view_page' function in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "security@wordfence.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.2,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 1.2,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://plugins.trac.wordpress.org/browser/contact-form-entries/trunk/includes/plugin-pages.php?rev=3003884#L1213",
|
||||
"source": "security@wordfence.com"
|
||||
},
|
||||
{
|
||||
"url": "https://plugins.trac.wordpress.org/changeset/3028640/contact-form-entries#file1",
|
||||
"source": "security@wordfence.com"
|
||||
},
|
||||
{
|
||||
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/120313be-9f98-4448-9f5d-a77186a6ff08?source=cve",
|
||||
"source": "security@wordfence.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
18
README.md
18
README.md
@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
|
||||
### Last Repository Update
|
||||
|
||||
```plain
|
||||
2024-01-31T03:00:24.681901+00:00
|
||||
2024-01-31T05:00:24.450116+00:00
|
||||
```
|
||||
|
||||
### Most recent CVE Modification Timestamp synchronized with NVD
|
||||
|
||||
```plain
|
||||
2024-01-31T02:15:54.520000+00:00
|
||||
2024-01-31T03:15:08.573000+00:00
|
||||
```
|
||||
|
||||
### Last Data Feed Release
|
||||
@ -29,21 +29,25 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
|
||||
### Total Number of included CVEs
|
||||
|
||||
```plain
|
||||
237165
|
||||
237168
|
||||
```
|
||||
|
||||
### CVEs added in the last Commit
|
||||
|
||||
Recently added CVEs: `2`
|
||||
Recently added CVEs: `3`
|
||||
|
||||
* [CVE-2024-22569](CVE-2024/CVE-2024-225xx/CVE-2024-22569.json) (`2024-01-31T02:15:54.467`)
|
||||
* [CVE-2024-23745](CVE-2024/CVE-2024-237xx/CVE-2024-23745.json) (`2024-01-31T02:15:54.520`)
|
||||
* [CVE-2023-2439](CVE-2023/CVE-2023-24xx/CVE-2023-2439.json) (`2024-01-31T03:15:07.973`)
|
||||
* [CVE-2023-31505](CVE-2023/CVE-2023-315xx/CVE-2023-31505.json) (`2024-01-31T03:15:08.160`)
|
||||
* [CVE-2024-1069](CVE-2024/CVE-2024-10xx/CVE-2024-1069.json) (`2024-01-31T03:15:08.573`)
|
||||
|
||||
|
||||
### CVEs modified in the last Commit
|
||||
|
||||
Recently modified CVEs: `0`
|
||||
Recently modified CVEs: `3`
|
||||
|
||||
* [CVE-2023-29491](CVE-2023/CVE-2023-294xx/CVE-2023-29491.json) (`2024-01-31T03:15:07.860`)
|
||||
* [CVE-2023-48387](CVE-2023/CVE-2023-483xx/CVE-2023-48387.json) (`2024-01-31T03:15:08.213`)
|
||||
* [CVE-2023-50495](CVE-2023/CVE-2023-504xx/CVE-2023-50495.json) (`2024-01-31T03:15:08.490`)
|
||||
|
||||
|
||||
## Download and Usage
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user