admin/nvd-json-data-feeds
1
0
Fork 0
mirror of https://github.com/fkie-cad/nvd-json-data-feeds.git synced 2025-05-07 19:16:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Auto-Update: 2023-09-18T14:00:26.102324+00:00

Browse Source
This commit is contained in:
cad-safe-bot 2023-09-18 14:00:29 +00:00
parent 68e31eaa3f
commit f41504b6ba
35 changed files with 743 additions and 86 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
CVE-2020/CVE-2020-367xx/CVE-2020-36766.json
View File

@ -2,12 +2,16 @@
"id": "CVE-2020-36766",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-09-18T09:15:07.693",
"lastModified": "2023-09-18T09:15:07.693",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in the Linux kernel before 5.8.6. drivers/media/cec/core/cec-api.c leaks one byte of kernel memory on specific hardware to unprivileged users, because of directly assigning log_addrs with a hole in the struct."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en el kernel de Linux anterior a 5.8.6. drivers/media/cec/core/cec-api.c pierde un byte de memoria del kernel en hardware espec\u00edfico a usuarios sin privilegios, debido a la asignaci\u00f3n directa de log_addrs con un agujero en la estructura."
}
],
"metrics": {},

8
CVE-2021/CVE-2021-442xx/CVE-2021-44226.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2021-44226",
"sourceIdentifier": "cve@mitre.org",
"published": "2022-03-23T22:15:12.937",
"lastModified": "2023-02-22T17:39:00.247",
"vulnStatus": "Analyzed",
"lastModified": "2023-09-18T13:15:07.290",
"vulnStatus": "Modified",
"descriptions": [
{
"lang": "en",
@ -138,6 +138,10 @@
"Not Applicable"
]
},
{
"url": "http://seclists.org/fulldisclosure/2023/Sep/6",
"source": "cve@mitre.org"
},
{
"url": "https://www.razer.com/community",
"source": "cve@mitre.org",

128
CVE-2022/CVE-2022-240xx/CVE-2022-24093.json
View File

@ -1,20 +1,44 @@
{
"id": "CVE-2022-24093",
"sourceIdentifier": "078d4453-3bcd-4900-85e6-15281da43538",
"sourceIdentifier": "psirt@adobe.com",
"published": "2023-09-12T08:15:12.960",
"lastModified": "2023-09-12T11:52:00.047",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2023-09-18T13:52:11.613",
"vulnStatus": "Analyzed",
"descriptions": [
{
"lang": "en",
"value": "Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution."
},
{
"lang": "es",
"value": "Las versiones 2.4.3-p1 (y anteriores) y 2.3.7-p2 (y anteriores) de Adobe Commerce est\u00e1n afectadas por una vulnerabilidad de validaci\u00f3n de entrada incorrecta. La explotaci\u00f3n de este problema no requiere la interacci\u00f3n del usuario y podr\u00eda dar lugar a una ejecuci\u00f3n de c\u00f3digo arbitrario posterior a la autenticaci\u00f3n."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "078d4453-3bcd-4900-85e6-15281da43538",
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9
},
{
"source": "psirt@adobe.com",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
@ -36,7 +60,7 @@
},
"weaknesses": [
{
"source": "078d4453-3bcd-4900-85e6-15281da43538",
"source": "psirt@adobe.com",
"type": "Primary",
"description": [
{
@ -46,10 +70,102 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.7",
"matchCriteriaId": "DBBBFA0E-0D8F-4055-B912-13886EF81ADA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.4.0",
"versionEndExcluding": "2.4.3",
"matchCriteriaId": "1B6E6964-140A-4640-AFD0-A237BABFC61F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:adobe:magento_open_source:2.3.7:p1:*:*:*:*:*:*",
"matchCriteriaId": "A9083101-E776-41CA-9DC9-455AFEC577F7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:adobe:magento_open_source:2.3.7:p2:*:*:*:*:*:*",
"matchCriteriaId": "D4EFC0E8-5DA6-41AF-817F-6C5600C16CCC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:adobe:magento_open_source:2.4.3:-:*:*:*:*:*:*",
"matchCriteriaId": "01129B1A-1BEC-4108-920B-B18B57D08D74"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:adobe:magento_open_source:2.4.3:p1:*:*:*:*:*:*",
"matchCriteriaId": "5EBE0746-09A5-4444-9566-B7FCC6369622"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.7",
"matchCriteriaId": "9D3D4DD8-EBF6-4281-B103-CB85CFCAA4C0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.4.0",
"versionEndExcluding": "2.4.3",
"matchCriteriaId": "BF96C367-576B-437B-A86C-CB9CA65CB481"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*",
"matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*",
"matchCriteriaId": "27E5B990-1E1C-46AC-815F-AF737D211C16"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*",
"matchCriteriaId": "7B503C35-8C90-4A24-8E60-722CDBBF556B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*",
"matchCriteriaId": "8A453C85-A14A-47B8-B91D-3906BBE42A78"
}
]
}
]
}
],
"references": [
{
"url": "https://helpx.adobe.com/security/products/magento/apsb22-13.html",
"source": "078d4453-3bcd-4900-85e6-15281da43538"
"source": "psirt@adobe.com",
"tags": [
"Patch",
"Vendor Advisory"
]
}
]
}

10
CVE-2022/CVE-2022-476xx/CVE-2022-47631.json
View File

@ -2,16 +2,24 @@
"id": "CVE-2022-47631",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-09-14T22:15:07.733",
"lastModified": "2023-09-15T00:31:20.767",
"lastModified": "2023-09-18T13:15:07.700",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLLs into %PROGRAMDATA%\\Razer\\Synapse3\\Service\\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if it detects malicious DLLs in this directory, attackers can exploit a race condition and replace a valid DLL (i.e., a copy of a legitimate Razer DLL) with a malicious DLL after the service has already checked the file. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows."
},
{
"lang": "es",
"value": "Razer Synapse hasta 3.7.1209.121307 permite la escalada de privilegios debido a una ruta de instalaci\u00f3n insegura y una gesti\u00f3n de privilegios inadecuada. Los atacantes pueden colocar archivos DLL en %PROGRAMDATA%\\Razer\\Synapse3\\Service\\bin si lo hacen antes de que se instale el servicio y si niegan el acceso de escritura al usuario SISTEMA. Aunque el servicio no se iniciar\u00e1 si detecta archivos DLL maliciosos en este directorio, los atacantes pueden aprovechar una condici\u00f3n de ejecuci\u00f3n y reemplazar un DLL v\u00e1lido (es decir, una copia de una DLL leg\u00edtimo de Razer) con una DLL malicioso despu\u00e9s de que el servicio ya haya verificado el archivo. Como resultado, los usuarios locales de Windows pueden abusar del instalador del controlador Razer para obtener privilegios administrativos en Windows."
}
],
"metrics": {},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Sep/6",
"source": "cve@mitre.org"
},
{
"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-002.txt",
"source": "cve@mitre.org"

8
CVE-2022/CVE-2022-476xx/CVE-2022-47632.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2022-47632",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-01-27T15:15:09.303",
"lastModified": "2023-02-07T21:50:25.843",
"vulnStatus": "Analyzed",
"lastModified": "2023-09-18T13:15:07.903",
"vulnStatus": "Modified",
"descriptions": [
{
"lang": "en",
@ -87,6 +87,10 @@
"VDB Entry"
]
},
{
"url": "http://seclists.org/fulldisclosure/2023/Sep/6",
"source": "cve@mitre.org"
},
{
"url": "https://syss.de",
"source": "cve@mitre.org",

85
CVE-2023/CVE-2023-01xx/CVE-2023-0119.json
View File

@ -2,16 +2,40 @@
"id": "CVE-2023-0119",
"sourceIdentifier": "secalert@redhat.com",
"published": "2023-09-12T16:15:08.007",
"lastModified": "2023-09-12T19:38:09.050",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2023-09-18T13:58:16.140",
"vulnStatus": "Analyzed",
"descriptions": [
{
"lang": "en",
"value": "A stored Cross-site scripting vulnerability was found in foreman. The Comment section in the Hosts tab has incorrect filtering of user input data. As a result of the attack, an attacker with an existing account on the system can steal another user's session, make requests on behalf of the user, and obtain user credentials."
},
{
"lang": "es",
"value": "Se encontr\u00f3 una vulnerabilidad de Stored Cross-Site Scripting en foreman. La secci\u00f3n Comentario en la pesta\u00f1a Anfitriones tiene un filtrado incorrecto de los datos de entrada del usuario. Como resultado del ataque, un atacante con una cuenta existente en el sistema puede robar la sesi\u00f3n de otro usuario, realizar solicitudes en nombre del usuario y obtener credenciales de usuario."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7
},
{
"source": "secalert@redhat.com",
"type": "Secondary",
@ -34,18 +58,69 @@
}
]
},
"weaknesses": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:redhat:satellite:6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "6532CA36-F59B-40E4-A6F6-0776CC4C3F78"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"
}
]
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2023:3387",
"source": "secalert@redhat.com"
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-0119",
"source": "secalert@redhat.com"
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2159104",
"source": "secalert@redhat.com"
"source": "secalert@redhat.com",
"tags": [
"Issue Tracking",
"Vendor Advisory"
]
}
]
}

89
CVE-2023/CVE-2023-202xx/CVE-2023-20233.json
View File

@ -2,16 +2,40 @@
"id": "CVE-2023-20233",
"sourceIdentifier": "ykramarz@cisco.com",
"published": "2023-09-13T17:15:09.523",
"lastModified": "2023-09-13T17:27:35.837",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2023-09-18T13:48:41.517",
"vulnStatus": "Analyzed",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Connectivity Fault Management (CFM) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r This vulnerability is due to incorrect processing of invalid continuity check messages (CCMs). An attacker could exploit this vulnerability by sending crafted CCMs to an affected device. A successful exploit could allow the attacker to cause the CFM service to crash when a user displays information about maintenance end points (MEPs) for peer MEPs on an affected device."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la funci\u00f3n Connectivity Fault Management (CFM) del software Cisco IOS XR podr\u00eda permitir que un atacante remoto no autenticado cause una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en un dispositivo afectado. Esta vulnerabilidad se debe al procesamiento incorrecto de mensajes de verificaci\u00f3n de continuidad (CCM) no v\u00e1lidos. Un atacante podr\u00eda aprovechar esta vulnerabilidad enviando CCM manipulados a un dispositivo afectado. Una explotaci\u00f3n existosa podr\u00eda permitir al atacante provocar que el servicio CFM se bloquee cuando un usuario muestra informaci\u00f3n sobre los puntos finales de mantenimiento (MEP) para los MEP pares en un dispositivo afectado."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
},
{
"source": "ykramarz@cisco.com",
"type": "Secondary",
@ -34,10 +58,69 @@
}
]
},
"weaknesses": [
{
"source": "nvd@nist.gov",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-354"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.5.4",
"matchCriteriaId": "8460B545-0323-4B80-BB28-C553424A015B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.6",
"versionEndExcluding": "7.6.3",
"matchCriteriaId": "8775BE91-68A8-474E-94D1-D34604A027FA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.7",
"versionEndExcluding": "7.7.21",
"matchCriteriaId": "5C1A7DEE-8745-418A-8F1E-AB3E22D8B12D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.8",
"versionEndExcluding": "7.8.2",
"matchCriteriaId": "B7D6D905-28BD-4F5D-8884-4E3DEA205D97"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:cisco:ios_xr:7.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3E05BB05-DEDD-433A-931E-88562C50726E"
}
]
}
]
}
],
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-xr-cfm-3pWN8MKt",
"source": "ykramarz@cisco.com"
"source": "ykramarz@cisco.com",
"tags": [
"Vendor Advisory"
]
}
]
}

59
CVE-2023/CVE-2023-321xx/CVE-2023-32187.json Normal file
View File

@ -0,0 +1,59 @@
{
"id": "CVE-2023-32187",
"sourceIdentifier": "meissner@suse.de",
"published": "2023-09-18T13:15:08.190",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port (TCP 6443) cause denial of service.\nThis issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.0 before v1.25.13+k3s1, from v1.26.0 before v1.26.8+k3s1, from sev1.27.0 before v1.27.5+k3s1, from v1.28.0 before v1.28.1+k3s1.\n\n"
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "meissner@suse.de",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "meissner@suse.de",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
}
],
"references": [
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32187https://",
"source": "meissner@suse.de"
},
{
"url": "https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2",
"source": "meissner@suse.de"
}
]
}

24
CVE-2023/CVE-2023-341xx/CVE-2023-34195.json Normal file
View File

@ -0,0 +1,24 @@
{
"id": "CVE-2023-34195",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-09-18T13:15:08.487",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The implementation of the GetImage method retrieves the value of a runtime variable named GetImageProgress, and later uses this value as a function pointer. This variable is wiped out by the same module near the end of the function. By setting this UEFI variable from the OS to point into custom code, an attacker could achieve arbitrary code execution in the DXE phase, before several chipset locks are set."
}
],
"metrics": {},
"references": [
{
"url": "https://www.insyde.com/security-pledge",
"source": "cve@mitre.org"
},
{
"url": "https://www.insyde.com/security-pledge/SA-2023052",
"source": "cve@mitre.org"
}
]
}

8
CVE-2023/CVE-2023-349xx/CVE-2023-34999.json
View File

@ -2,12 +2,16 @@
"id": "CVE-2023-34999",
"sourceIdentifier": "psirt@bosch.com",
"published": "2023-09-18T11:15:41.867",
"lastModified": "2023-09-18T11:15:41.867",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) that allows an attacker to perform arbitrary code execution via the admin web interface."
},
{
"lang": "es",
"value": " Existe una vulnerabilidad de inyecci\u00f3n de comandos en RTS VLink Virtual Matrix Software versiones v5 (&lt; 5.7.6) y v6 (&lt; 6.5.0) que permite a un atacante realizar la ejecuci\u00f3n de c\u00f3digo arbitrario a trav\u00e9s de la interfaz web de administraci\u00f3n."
}
],
"metrics": {

8
CVE-2023/CVE-2023-358xx/CVE-2023-35850.json
View File

@ -2,12 +2,16 @@
"id": "CVE-2023-35850",
"sourceIdentifier": "twcert@cert.org.tw",
"published": "2023-09-18T03:15:07.590",
"lastModified": "2023-09-18T03:15:07.590",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:27:02.010",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "\nSUNNET WMPro portal's file management function has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege or a privileged account can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operations or disrupt service.\n\n"
},
{
"lang": "es",
"value": "La funci\u00f3n de administraci\u00f3n de archivos del portal SUNNET WMPro tiene una vulnerabilidad de filtrado insuficiente para la entrada del usuario. Un atacante remoto con privilegios de administrador o una cuenta privilegiada puede aprovechar esta vulnerabilidad para inyectar y ejecutar comandos arbitrarios del sistema para realizar operaciones arbitrarias del sistema o interrumpir el servicio. "
}
],
"metrics": {

8
CVE-2023/CVE-2023-358xx/CVE-2023-35851.json
View File

@ -2,12 +2,16 @@
"id": "CVE-2023-35851",
"sourceIdentifier": "twcert@cert.org.tw",
"published": "2023-09-18T03:15:08.017",
"lastModified": "2023-09-18T03:15:08.017",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:27:02.010",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "\nSUNNET WMPro portal's FAQ function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to obtain sensitive information via a database.\n\n"
},
{
"lang": "es",
"value": "La funci\u00f3n de preguntas frecuentes del portal SUNNET WMPro no tiene una validaci\u00f3n suficiente para la entrada del usuario. Un atacante remoto no autenticado puede inyectar comandos SQL arbitrarios para obtener informaci\u00f3n sensible a trav\u00e9s de una base de datos. "
}
],
"metrics": {

20
CVE-2023/CVE-2023-410xx/CVE-2023-41064.json
View File

@ -2,8 +2,12 @@
"id": "CVE-2023-41064",
"sourceIdentifier": "product-security@apple.com",
"published": "2023-09-07T18:15:07.727",
"lastModified": "2023-09-12T13:09:57.077",
"vulnStatus": "Analyzed",
"lastModified": "2023-09-18T13:15:08.607",
"vulnStatus": "Modified",
"cisaExploitAdd": "2023-09-11",
"cisaActionDue": "2023-10-02",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability",
"descriptions": [
{
"lang": "en",
@ -105,6 +109,18 @@
}
],
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Sep/7",
"source": "product-security@apple.com"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Sep/8",
"source": "product-security@apple.com"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Sep/9",
"source": "product-security@apple.com"
},
{
"url": "https://support.apple.com/en-us/HT213905",
"source": "product-security@apple.com",

8
CVE-2023/CVE-2023-413xx/CVE-2023-41349.json
View File

@ -2,12 +2,16 @@
"id": "CVE-2023-41349",
"sourceIdentifier": "twcert@cert.org.tw",
"published": "2023-09-18T03:15:08.113",
"lastModified": "2023-09-18T03:15:08.113",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:27:02.010",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "\nASUS router RT-AX88U has a vulnerability of using externally controllable format strings within its Advanced Open VPN function. An authenticated remote attacker can exploit the exported OpenVPN configuration to execute an externally-controlled format string attack, resulting in sensitivity information leakage, or forcing the device to reset and permanent denial of service.\n\n"
},
{
"lang": "es",
"value": "El router ASUS RT-AX88U tiene una vulnerabilidad de uso de cadenas de formato controlables externamente dentro de su funci\u00f3n Advanced Open VPN. Un atacante remoto autenticado puede aprovechar la configuraci\u00f3n de OpenVPN exportada para ejecutar un ataque de cadena de formato controlado externamente, lo que resulta en una fuga de informaci\u00f3n sensible o obliga al dispositivo a reiniciarse y a la denegaci\u00f3n de servicio permanente. "
}
],
"metrics": {

47
CVE-2023/CVE-2023-419xx/CVE-2023-41929.json Normal file
View File

@ -0,0 +1,47 @@
{
"id": "CVE-2023-41929",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-09-18T12:15:07.470",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "A DLL hijacking vulnerability in Samsung Memory Card & UFD Authentication Utility PC Software before 1.0.1 could allow a local attacker to escalate privileges. (An attacker must already have user privileges on Windows to exploit this vulnerability.)"
},
{
"lang": "es",
"value": "Una vulnerabilidad de secuestro de DLL en Samsung Memory Card &amp; UFD Authentication Utility PC Software anterior a 1.0.1 podr\u00eda permitir a un atacante local escalar privilegios. (Un atacante ya debe tener privilegios de usuario en Windows para aprovechar esta vulnerabilidad)."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "cve@mitre.org",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 1.3,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://semiconductor.samsung.com/support/quality-support/product-security-updates/",
"source": "cve@mitre.org"
}
]
}

28
CVE-2023/CVE-2023-422xx/CVE-2023-42253.json Normal file
View File

@ -0,0 +1,28 @@
{
"id": "CVE-2023-42253",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-09-18T12:15:07.580",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting (XSS) in Add Accounts via Invoice No, To, and Mammul."
},
{
"lang": "es",
"value": "Code-Projects Vehicle Management 1.0 es vulnerable a Cross Site Scripting (XSS) al Agregar Cuentas a trav\u00e9s de Invoice No, To, y Mammul. "
}
],
"metrics": {},
"references": [
{
"url": "https://code-projects.org/vehicle-management-in-php-with-source-code/",
"source": "cve@mitre.org"
},
{
"url": "https://gist.github.com/Arajawat007/e37a131fd7b5f90148fa091a42de8f9d#file-cve-2023-42253",
"source": "cve@mitre.org"
}
]
}

24
CVE-2023/CVE-2023-423xx/CVE-2023-42359.json Normal file
View File

@ -0,0 +1,24 @@
{
"id": "CVE-2023-42359",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-09-18T12:15:07.633",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in Exam Form Submission in PHP with Source Code v.1.0 allows a remote attacker to escalate privileges via the val-username parameter in /index.php."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n SQL en el Exam Form Submission en PHP con C\u00f3digo Fuente v.1.0 permite a un atacante remoto escalar privilegios a trav\u00e9s del par\u00e1metro val-username en /index.php."
}
],
"metrics": {},
"references": [
{
"url": "https://upbeat-washer-def.notion.site/Exam-Form-Submission-In-PHP-SQL-Injection-in-index-php-bd71962db712459488019d531ab2f6f2?pvs=4",
"source": "cve@mitre.org"
}
]
}

4
CVE-2023/CVE-2023-425xx/CVE-2023-42520.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2023-42520",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-09-18T06:15:08.060",
"lastModified": "2023-09-18T06:15:08.060",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",

8
CVE-2023/CVE-2023-425xx/CVE-2023-42521.json
View File

@ -2,12 +2,16 @@
"id": "CVE-2023-42521",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-09-18T07:15:37.663",
"lastModified": "2023-09-18T07:15:37.663",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "Certain WithSecure products allow a remote crash of a scanning engine via processing of a compressed file. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1."
},
{
"lang": "es",
"value": "Ciertos productos WithSecure permiten un bloqueo remoto de un motor de escaneo a trav\u00e9s del procesamiento de un archivo comprimido. Esto afecta a WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email y Server Security 15, WithSecure Elements Endpoint Protection 17 y versiones posteriores, WithSecure Client Security para Mac 15, WithSecure Elements Endpoint Protection para Mac 17 y versiones posteriores, Linux Security 64 12.0, Linux Protection 12.0 y WithSecure Atlant (anteriormente F-Secure Atlant) 1.0.35-1. "
}
],
"metrics": {},

8
CVE-2023/CVE-2023-425xx/CVE-2023-42522.json
View File

@ -2,12 +2,16 @@
"id": "CVE-2023-42522",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-09-18T07:15:37.880",
"lastModified": "2023-09-18T07:15:37.880",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1."
},
{
"lang": "es",
"value": "Ciertos productos WithSecure permiten un bloqueo remoto de un motor de escaneo a trav\u00e9s del procesamiento de una estructura de importaci\u00f3n en un archivo PE. Esto afecta a WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email y Server Security 15, WithSecure Elements Endpoint Protection 17 y versiones posteriores, WithSecure Client Security para Mac 15, WithSecure Elements Endpoint Protection para Mac 17 y versiones posteriores, Linux Security 64 12.0, Linux Protection 12.0 y WithSecure Atlant (anteriormente F-Secure Atlant) 1.0.35-1. "
}
],
"metrics": {},

8
CVE-2023/CVE-2023-425xx/CVE-2023-42523.json
View File

@ -2,12 +2,16 @@
"id": "CVE-2023-42523",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-09-18T07:15:37.953",
"lastModified": "2023-09-18T07:15:37.953",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "Certain WithSecure products allow a remote crash of a scanning engine via unpacking of a PE file. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1."
},
{
"lang": "es",
"value": "Ciertos productos WithSecure permiten un bloqueo remoto de un motor de escaneo mediante el desempaquetado de un archivo PE. Esto afecta a WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email y Server Security 15, WithSecure Elements Endpoint Protection 17 y versiones posteriores, WithSecure Client Security para Mac 15, WithSecure Elements Endpoint Protection para Mac 17 y versiones posteriores, Linux Security 64 12.0, Linux Protection 12.0 y WithSecure Atlant (anteriormente F-Secure Atlant) 1.0.35-1. "
}
],
"metrics": {},

8
CVE-2023/CVE-2023-425xx/CVE-2023-42524.json
View File

@ -2,12 +2,16 @@
"id": "CVE-2023-42524",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-09-18T07:15:38.040",
"lastModified": "2023-09-18T07:15:38.040",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1."
},
{
"lang": "es",
"value": "Ciertos productos WithSecure permiten un bucle infinito en un motor de escaneo a trav\u00e9s de tipos de archivos no especificados. Esto afecta a WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email y Server Security 15, WithSecure Elements Endpoint Protection 17 y versiones posteriores, WithSecure Client Security para Mac 15, WithSecure Elements Endpoint Protection para Mac 17 y versiones posteriores, Linux Security 64 12.0, Linux Protection 12.0 y WithSecure Atlant (anteriormente F-Secure Atlant) 1.0.35-1. "
}
],
"metrics": {},

8
CVE-2023/CVE-2023-425xx/CVE-2023-42525.json
View File

@ -2,12 +2,16 @@
"id": "CVE-2023-42525",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-09-18T07:15:38.193",
"lastModified": "2023-09-18T07:15:38.193",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, Linux Security 64 12.0 , Linux Protection 12.0, and WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1."
},
{
"lang": "es",
"value": "Ciertos productos WithSecure permiten un bucle infinito en un motor de escaneo a trav\u00e9s de tipos de archivos no especificados. Esto afecta a WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email y Server Security 15, WithSecure Elements Endpoint Protection 17 y versiones posteriores, WithSecure Client Security para Mac 15, WithSecure Elements Endpoint Protection para Mac 17 y versiones posteriores, Linux Security 64 12.0, Linux Protection 12.0 y WithSecure Atlant (anteriormente F-Secure Atlant) 1.0.35-1. "
}
],
"metrics": {},

4
CVE-2023/CVE-2023-425xx/CVE-2023-42526.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2023-42526",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-09-18T06:15:08.203",
"lastModified": "2023-09-18T06:15:08.203",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",

8
CVE-2023/CVE-2023-42xx/CVE-2023-4296.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2023-4296",
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"published": "2023-08-29T22:15:09.297",
"lastModified": "2023-09-13T14:50:08.323",
"vulnStatus": "Analyzed",
"lastModified": "2023-09-18T13:15:08.847",
"vulnStatus": "Modified",
"descriptions": [
{
"lang": "en",
@ -224,6 +224,10 @@
}
],
"references": [
{
"url": "http://seclists.org/fulldisclosure/2023/Sep/10",
"source": "ics-cert@hq.dhs.gov"
},
{
"url": "https://codebeamer.com/cb/wiki/31346480",
"source": "ics-cert@hq.dhs.gov",

8
CVE-2023/CVE-2023-431xx/CVE-2023-43114.json
View File

@ -2,12 +2,16 @@
"id": "CVE-2023-43114",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-09-18T07:15:38.333",
"lastModified": "2023-09-18T07:15:38.333",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. When using the GDI font engine, if a corrupted font is loaded via QFontDatabase::addApplicationFont{FromData], then it can cause the application to crash because of missing length checks."
},
{
"lang": "es",
"value": "Se descubri\u00f3 un problema en Qt antes de 5.15.16, 6.x antes de 6.2.10 y 6.3.x a 6.5.x antes de 6.5.3 en Windows. Cuando se utiliza el motor de fuentes GDI, si se carga una fuente da\u00f1ada a trav\u00e9s de QFontDatabase::addApplicationFont{FromData], puede hacer que la aplicaci\u00f3n se bloquee debido a la falta de comprobaciones de longitud. "
}
],
"metrics": {},

4
CVE-2023/CVE-2023-431xx/CVE-2023-43115.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2023-43115",
"sourceIdentifier": "cve@mitre.org",
"published": "2023-09-18T08:15:07.380",
"lastModified": "2023-09-18T08:15:07.380",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",

22
CVE-2023/CVE-2023-43xx/CVE-2023-4387.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2023-4387",
"sourceIdentifier": "secalert@redhat.com",
"published": "2023-08-16T19:15:10.087",
"lastModified": "2023-08-22T23:08:56.270",
"vulnStatus": "Analyzed",
"lastModified": "2023-09-18T13:15:09.133",
"vulnStatus": "Modified",
"descriptions": [
{
"lang": "en",
@ -37,20 +37,20 @@
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM"
"baseScore": 7.1,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 0.7,
"impactScore": 5.9
"exploitabilityScore": 1.8,
"impactScore": 5.2
}
]
},

92
CVE-2023/CVE-2023-47xx/CVE-2023-4759.json
View File

@ -1,19 +1,43 @@
{
"id": "CVE-2023-4759",
"sourceIdentifier": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"sourceIdentifier": "emo@eclipse.org",
"published": "2023-09-12T10:15:29.977",
"lastModified": "2023-09-12T11:51:54.387",
"vulnStatus": "Awaiting Analysis",
"lastModified": "2023-09-18T13:54:11.407",
"vulnStatus": "Analyzed",
"descriptions": [
{
"lang": "en",
"value": "Arbitrary File Overwrite in Eclipse JGit <= 6.6.0\n\nIn Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem.\n\nThis can happen on checkout (DirCacheCheckout), merge (ResolveMerger\u00a0via its WorkingTreeUpdater), pull (PullCommand\u00a0using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command.\n\nThe issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration.\n\nSetting git configuration option core.symlinks = false\u00a0before checking out avoids the problem.\n\nThe issue was fixed in Eclipse JGit version 6.6.1.202309021850-r and 6.7.0.202309050840-r, available via Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/ \u00a0and repo.eclipse.org https://repo.eclipse.org/content/repositories/jgit-releases/ .\n\n\nThe JGit maintainers would like to thank RyotaK for finding and reporting this issue.\n\n\n\n"
},
{
"lang": "es",
"value": "Sobrescritura Arbitraria de Archivos en Eclipse JGit &lt;= 6.6.0 En Eclipse JGit, todas las versiones &lt;= 6.6.0.202305301015-r, se puede utilizar un enlace simb\u00f3lico presente en un repositorio git especialmente manipulado para escribir un archivo en ubicaciones fuera del \u00e1rbol de trabajo cuando esto el repositorio se clona con JGit en un sistema de archivos que no distingue entre may\u00fasculas y min\u00fasculas, o cuando se realiza una extracci\u00f3n de un clon de dicho repositorio en un sistema de archivos que no distingue entre may\u00fasculas y min\u00fasculas. Esto puede suceder al finalizar la compra (DirCacheCheckout), fusionar (ResolveMerger a trav\u00e9s de su WorkingTreeUpdater), extraer (PullCommand usando merge) y al aplicar un parche (PatchApplier). Esto se puede aprovechar para la ejecuci\u00f3n remota de c\u00f3digo (RCE), por ejemplo, si el archivo escrito fuera del \u00e1rbol de trabajo es un filtro git que se ejecuta en un comando git posterior. El problema ocurre solo en sistemas de archivos que no distinguen entre may\u00fasculas y min\u00fasculas, como los sistemas de archivos predeterminados en Windows y macOS. El usuario que realiza la clonaci\u00f3n o el pago debe tener derechos para crear enlaces simb\u00f3licos para que ocurra el problema, y ??los enlaces simb\u00f3licos deben estar habilitados en la configuraci\u00f3n de git. Configurar la opci\u00f3n de configuraci\u00f3n de git core.symlinks = false antes de realizar el check-out evita el problema. El problema se solucion\u00f3 en Eclipse JGit versi\u00f3n 6.6.1.202309021850-r y 6.7.0.202309050840-r, disponibles a trav\u00e9s de Maven Central https://repo1.maven.org/maven2/org/eclipse/jgit/ y repo.eclipse.org https: //repo.eclipse.org/content/repositories/jgit-releases/. Los mantenedores de JGit desean agradecer a RyotaK por encontrar e informar este problema."
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"source": "nvd@nist.gov",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
},
{
"source": "emo@eclipse.org",
"type": "Secondary",
"cvssData": {
"version": "3.1",
@ -36,7 +60,21 @@
},
"weaknesses": [
{
"source": "e51fbebd-6053-4e49-959f-1b94eeb69a2c",
"source": "nvd@nist.gov",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-178"
},
{
"lang": "en",
"value": "CWE-59"
}
]
},
{
"source": "emo@eclipse.org",
"type": "Secondary",
"description": [
{
@ -50,18 +88,56 @@
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.0",
"versionEndExcluding": "6.6.1.202309021850",
"matchCriteriaId": "265F20F2-D498-42D8-AD89-3863FFAC0800"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:eclipse:jgit:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.0",
"versionEndExcluding": "6.7.0.202309050840",
"matchCriteriaId": "A6A51C42-BDB6-4744-80CF-55291D1DC24F"
}
]
}
]
}
],
"references": [
{
"url": "https://git.eclipse.org/c/jgit/jgit.git/commit/?id=9072103f3b3cf64dd12ad2949836ab98f62dabf1",
"source": "e51fbebd-6053-4e49-959f-1b94eeb69a2c"
"source": "emo@eclipse.org",
"tags": [
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/11",
"source": "e51fbebd-6053-4e49-959f-1b94eeb69a2c"
"source": "emo@eclipse.org",
"tags": [
"Issue Tracking",
"Vendor Advisory"
]
},
{
"url": "https://projects.eclipse.org/projects/technology.jgit/releases/6.6.1",
"source": "e51fbebd-6053-4e49-959f-1b94eeb69a2c"
"source": "emo@eclipse.org",
"tags": [
"Release Notes",
"Vendor Advisory"
]
}
]
}

8
CVE-2023/CVE-2023-50xx/CVE-2023-5031.json
View File

@ -2,12 +2,16 @@
"id": "CVE-2023-5031",
"sourceIdentifier": "cna@vuldb.com",
"published": "2023-09-18T02:15:51.220",
"lastModified": "2023-09-18T02:15:51.220",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:27:02.010",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in OpenRapid RapidCMS 1.3.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/article/article-add.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239875."
},
{
"lang": "es",
"value": "Se encontr\u00f3 una vulnerabilidad en OpenRapid RapidCMS 1.3.1. Ha sido declarado como cr\u00edtico. Esta vulnerabilidad afecta a una funcionalidad desconocida del archivo /admin/article/article-add.php. La manipulaci\u00f3n del id del argumento conduce a la inyecci\u00f3n sql. El ataque se puede lanzar de forma remota. El exploit ha sido divulgado al p\u00fablico y puede ser utilizado. El identificador asociado de esta vulnerabilidad es VDB-239875. "
}
],
"metrics": {

8
CVE-2023/CVE-2023-50xx/CVE-2023-5032.json
View File

@ -2,12 +2,16 @@
"id": "CVE-2023-5032",
"sourceIdentifier": "cna@vuldb.com",
"published": "2023-09-18T04:15:11.327",
"lastModified": "2023-09-18T04:15:11.327",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in OpenRapid RapidCMS 1.3.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/article/article-edit-run.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-239876."
},
{
"lang": "es",
"value": "Fue encontrada una vulnerabilidad en OpenRapid RapidCMS 1.3.1. Ha sido calificado como cr\u00edtico. Este problema afecta a algunas funciones desconocidas del archivo /admin/article/article-edit-run.php. La manipulaci\u00f3n del id del argumento conduce a la inyecci\u00f3n sql. El ataque puede ser lanzado de forma remota. El exploit ha sido divulgado al p\u00fablico y puede ser utilizado. El identificador de esta vulnerabilidad es VDB-239876. "
}
],
"metrics": {

8
CVE-2023/CVE-2023-50xx/CVE-2023-5033.json
View File

@ -2,12 +2,16 @@
"id": "CVE-2023-5033",
"sourceIdentifier": "cna@vuldb.com",
"published": "2023-09-18T05:15:07.417",
"lastModified": "2023-09-18T05:15:07.417",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as critical has been found in OpenRapid RapidCMS 1.3.1. This affects an unknown part of the file /admin/category/cate-edit-run.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-239877 was assigned to this vulnerability."
},
{
"lang": "es",
"value": "Una vulnerabilidad clasificada como cr\u00edtica en OpenRapid RapidCMS 1.3.1. Esto afecta a una parte desconocida del archivo /admin/category/cate-edit-run.php. La manipulaci\u00f3n del id del argumento conduce a la inyecci\u00f3n sql. Es posible iniciar el ataque de forma remota. El exploit ha sido divulgado al p\u00fablico y puede ser utilizado. El identificador VDB-239877 se asign\u00f3 a esta vulnerabilidad. "
}
],
"metrics": {

8
CVE-2023/CVE-2023-50xx/CVE-2023-5034.json
View File

@ -2,12 +2,16 @@
"id": "CVE-2023-5034",
"sourceIdentifier": "cna@vuldb.com",
"published": "2023-09-18T05:15:07.500",
"lastModified": "2023-09-18T05:15:07.500",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as problematic was found in SourceCodester My Food Recipe 1.0. This vulnerability affects unknown code of the file index.php of the component Image Upload Handler. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-239878 is the identifier assigned to this vulnerability."
},
{
"lang": "es",
"value": "Una vulnerabilidad clasificada como problem\u00e1tica en SourceCodester My Food Recipe 1.0. Esta vulnerabilidad afecta al c\u00f3digo desconocido del \u00edndice de archivos.php del componente Image Upload Handler. La manipulaci\u00f3n conduce a una carga sin restricciones. El ataque se puede iniciar de forma remota. El exploit ha sido divulgado al p\u00fablico y puede ser utilizado. VDB-239878 es el identificador asignado a esta vulnerabilidad. "
}
],
"metrics": {

4
CVE-2023/CVE-2023-50xx/CVE-2023-5036.json
View File

@ -2,8 +2,8 @@
"id": "CVE-2023-5036",
"sourceIdentifier": "security@huntr.dev",
"published": "2023-09-18T06:15:08.267",
"lastModified": "2023-09-18T06:15:08.267",
"vulnStatus": "Received",
"lastModified": "2023-09-18T13:26:56.797",
"vulnStatus": "Awaiting Analysis",
"descriptions": [
{
"lang": "en",

41
README.md
View File

@ -9,13 +9,13 @@ Repository synchronizes with the NVD every 2 hours.
### Last Repository Update
```plain
2023-09-18T12:00:24.968168+00:00
2023-09-18T14:00:26.102324+00:00
```
### Most recent CVE Modification Timestamp synchronized with NVD
```plain
2023-09-18T11:15:41.867000+00:00
2023-09-18T13:58:16.140000+00:00
```
### Last Data Feed Release
@ -29,20 +29,49 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/
### Total Number of included CVEs
```plain
225754
225759
```
### CVEs added in the last Commit
Recently added CVEs: `1`
Recently added CVEs: `5`
* [CVE-2023-34999](CVE-2023/CVE-2023-349xx/CVE-2023-34999.json) (`2023-09-18T11:15:41.867`)
* [CVE-2023-41929](CVE-2023/CVE-2023-419xx/CVE-2023-41929.json) (`2023-09-18T12:15:07.470`)
* [CVE-2023-42253](CVE-2023/CVE-2023-422xx/CVE-2023-42253.json) (`2023-09-18T12:15:07.580`)
* [CVE-2023-42359](CVE-2023/CVE-2023-423xx/CVE-2023-42359.json) (`2023-09-18T12:15:07.633`)
* [CVE-2023-32187](CVE-2023/CVE-2023-321xx/CVE-2023-32187.json) (`2023-09-18T13:15:08.190`)
* [CVE-2023-34195](CVE-2023/CVE-2023-341xx/CVE-2023-34195.json) (`2023-09-18T13:15:08.487`)
### CVEs modified in the last Commit
Recently modified CVEs: `0`
Recently modified CVEs: `29`
* [CVE-2022-24093](CVE-2022/CVE-2022-240xx/CVE-2022-24093.json) (`2023-09-18T13:52:11.613`)
* [CVE-2023-41064](CVE-2023/CVE-2023-410xx/CVE-2023-41064.json) (`2023-09-18T13:15:08.607`)
* [CVE-2023-4296](CVE-2023/CVE-2023-42xx/CVE-2023-4296.json) (`2023-09-18T13:15:08.847`)
* [CVE-2023-4387](CVE-2023/CVE-2023-43xx/CVE-2023-4387.json) (`2023-09-18T13:15:09.133`)
* [CVE-2023-5032](CVE-2023/CVE-2023-50xx/CVE-2023-5032.json) (`2023-09-18T13:26:56.797`)
* [CVE-2023-5033](CVE-2023/CVE-2023-50xx/CVE-2023-5033.json) (`2023-09-18T13:26:56.797`)
* [CVE-2023-5034](CVE-2023/CVE-2023-50xx/CVE-2023-5034.json) (`2023-09-18T13:26:56.797`)
* [CVE-2023-42520](CVE-2023/CVE-2023-425xx/CVE-2023-42520.json) (`2023-09-18T13:26:56.797`)
* [CVE-2023-42526](CVE-2023/CVE-2023-425xx/CVE-2023-42526.json) (`2023-09-18T13:26:56.797`)
* [CVE-2023-5036](CVE-2023/CVE-2023-50xx/CVE-2023-5036.json) (`2023-09-18T13:26:56.797`)
* [CVE-2023-42521](CVE-2023/CVE-2023-425xx/CVE-2023-42521.json) (`2023-09-18T13:26:56.797`)
* [CVE-2023-42522](CVE-2023/CVE-2023-425xx/CVE-2023-42522.json) (`2023-09-18T13:26:56.797`)
* [CVE-2023-42523](CVE-2023/CVE-2023-425xx/CVE-2023-42523.json) (`2023-09-18T13:26:56.797`)
* [CVE-2023-42524](CVE-2023/CVE-2023-425xx/CVE-2023-42524.json) (`2023-09-18T13:26:56.797`)
* [CVE-2023-42525](CVE-2023/CVE-2023-425xx/CVE-2023-42525.json) (`2023-09-18T13:26:56.797`)
* [CVE-2023-43114](CVE-2023/CVE-2023-431xx/CVE-2023-43114.json) (`2023-09-18T13:26:56.797`)
* [CVE-2023-43115](CVE-2023/CVE-2023-431xx/CVE-2023-43115.json) (`2023-09-18T13:26:56.797`)
* [CVE-2023-34999](CVE-2023/CVE-2023-349xx/CVE-2023-34999.json) (`2023-09-18T13:26:56.797`)
* [CVE-2023-5031](CVE-2023/CVE-2023-50xx/CVE-2023-5031.json) (`2023-09-18T13:27:02.010`)
* [CVE-2023-35850](CVE-2023/CVE-2023-358xx/CVE-2023-35850.json) (`2023-09-18T13:27:02.010`)
* [CVE-2023-35851](CVE-2023/CVE-2023-358xx/CVE-2023-35851.json) (`2023-09-18T13:27:02.010`)
* [CVE-2023-41349](CVE-2023/CVE-2023-413xx/CVE-2023-41349.json) (`2023-09-18T13:27:02.010`)
* [CVE-2023-20233](CVE-2023/CVE-2023-202xx/CVE-2023-20233.json) (`2023-09-18T13:48:41.517`)
* [CVE-2023-4759](CVE-2023/CVE-2023-47xx/CVE-2023-4759.json) (`2023-09-18T13:54:11.407`)
* [CVE-2023-0119](CVE-2023/CVE-2023-01xx/CVE-2023-0119.json) (`2023-09-18T13:58:16.140`)
## Download and Usage