mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-05-06 10:42:17 +00:00
Auto-Update: 2024-09-11T18:00:17.868597+00:00
This commit is contained in:
cad-safe-bot
parent
66114bdc00
commit
fe3ed7f991
@ -2,7 +2,7 @@
|
||||
"id": "CVE-2017-15587",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2017-10-18T08:29:00.310",
|
||||
"lastModified": "2023-11-07T02:40:19.917",
|
||||
"lastModified": "2024-09-11T17:15:11.070",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
@ -102,6 +102,18 @@
|
||||
"url": "http://www.debian.org/security/2017/dsa-4006",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://bugs.ghostscript.com/show_bug.cgi?id=698605",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://bugs.ghostscript.com/show_bug.cgi?id=698704",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=d18bc728e46c5a5708f14d27c2b6c44e1d0c3232",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00007.html",
|
||||
"source": "cve@mitre.org"
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2017-6060",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2017-03-15T14:59:00.697",
|
||||
"lastModified": "2022-04-18T17:58:09.220",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T17:15:11.190",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -143,6 +143,14 @@
|
||||
"Third Party Advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=06a012a42c9884e3cd653e7826cff1ddec04eb6e",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=e089b2e2c1d38c5696c7dfd741e21f8f3ef22b14",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.debian.org/debian-lts-announce/2021/09/msg00013.html",
|
||||
"source": "cve@mitre.org",
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2017-9216",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2017-05-24T05:29:00.193",
|
||||
"lastModified": "2021-11-02T13:49:42.477",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T17:15:11.320",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -131,6 +131,10 @@
|
||||
"Vendor Advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.ghostscript.com/?p=ghostpdl.git%3Ba=commit%3Bh=3ebffb1d96ba0cacec23016eccb4047dab365853",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.debian.org/debian-lts-announce/2021/10/msg00023.html",
|
||||
"source": "cve@mitre.org",
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2018-1000051",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2018-02-09T23:29:01.777",
|
||||
"lastModified": "2019-03-14T17:24:08.083",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:15:03.220",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -131,6 +131,10 @@
|
||||
"Third Party Advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=321ba1de287016b0036bf4a56ce774ad11763384",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://security.gentoo.org/glsa/201811-15",
|
||||
"source": "cve@mitre.org",
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2018-6187",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2018-01-24T10:29:01.097",
|
||||
"lastModified": "2020-08-24T17:37:01.140",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T17:15:11.427",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -126,6 +126,10 @@
|
||||
"Third Party Advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=3e30fbb7bf5efd88df431e366492356e7eb969ec",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://security.gentoo.org/glsa/201811-15",
|
||||
"source": "cve@mitre.org",
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
"id": "CVE-2018-6192",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2018-01-24T21:29:00.467",
|
||||
"lastModified": "2019-06-28T15:15:10.783",
|
||||
"lastModified": "2024-09-11T17:15:11.520",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
@ -126,6 +126,10 @@
|
||||
"Third Party Advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=5e411a99604ff6be5db9e273ee84737204113299",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00027.html",
|
||||
"source": "cve@mitre.org"
|
||||
|
||||
@ -2,13 +2,17 @@
|
||||
"id": "CVE-2019-25212",
|
||||
"sourceIdentifier": "security@wordfence.com",
|
||||
"published": "2024-09-11T09:15:01.887",
|
||||
"lastModified": "2024-09-11T09:15:01.887",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2024-09-11T16:26:11.920",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The video carousel slider with lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "El complemento video carousel slider with lightbox para WordPress es vulnerable a la inyecci\u00f3n SQL a trav\u00e9s del par\u00e1metro 'id' en todas las versiones hasta la 1.0.6 incluida, debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y a la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que los atacantes autenticados, con acceso de nivel de administrador y superior, agreguen consultas SQL adicionales a las consultas ya existentes que se pueden usar para extraer informaci\u00f3n confidencial de la base de datos."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
"id": "CVE-2019-6130",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2019-01-11T05:29:01.687",
|
||||
"lastModified": "2023-11-07T03:13:06.000",
|
||||
"lastModified": "2024-09-11T16:15:03.420",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
@ -110,6 +110,10 @@
|
||||
"Third Party Advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=faf47b94e24314d74907f3f6bc874105f2c962ed",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.debian.org/debian-lts-announce/2019/06/msg00027.html",
|
||||
"source": "cve@mitre.org"
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
"id": "CVE-2019-6131",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2019-01-11T05:29:01.717",
|
||||
"lastModified": "2023-11-07T03:13:06.090",
|
||||
"lastModified": "2024-09-11T16:15:03.570",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
@ -110,6 +110,10 @@
|
||||
"Third Party Advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=c8f7e48ff74720a5e984ae19d978a5ab4d5dde5b",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNJNEX5EW6YH5OARXXSSXW4HHC5PIBSY/",
|
||||
"source": "cve@mitre.org"
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
"id": "CVE-2019-7321",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2019-06-13T18:29:00.730",
|
||||
"lastModified": "2024-07-17T22:15:02.780",
|
||||
"lastModified": "2024-09-11T16:15:03.643",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
@ -102,6 +102,10 @@
|
||||
"url": "https://bugs.ghostscript.com/show_bug.cgi?id=700560",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=2be83b57e77938fddbb06bdffb11979ad89a9c7d",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/ereisr00/bagofbugz/tree/master/MuPDF/700560",
|
||||
"source": "cve@mitre.org",
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2020-21896",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-08-22T19:16:18.793",
|
||||
"lastModified": "2023-08-25T18:15:18.393",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:15:03.750",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -65,6 +65,10 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "http://www.ghostscript.com/cgi-bin/findgit.cgi?8719e07834d6a72b6b4131539e49ed1e8e2ff79e",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://bugs.ghostscript.com/show_bug.cgi?id=701294",
|
||||
"source": "cve@mitre.org",
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2020-26683",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-08-22T19:16:19.997",
|
||||
"lastModified": "2023-08-28T16:44:27.123",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:15:03.843",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -77,6 +77,10 @@
|
||||
"Issue Tracking",
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=05720b4ee3dbae57e65546dc2eecc3021c08eeea",
|
||||
"source": "cve@mitre.org"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,13 +2,13 @@
|
||||
"id": "CVE-2021-1245",
|
||||
"sourceIdentifier": "ykramarz@cisco.com",
|
||||
"published": "2021-01-13T22:15:21.083",
|
||||
"lastModified": "2023-11-07T03:27:46.890",
|
||||
"lastModified": "2024-09-11T16:15:04.007",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack and obtain potentially confidential information by leveraging a flaw in the authentication mechanism. For more information about these vulnerabilities, see the Details section of this advisory."
|
||||
"value": "Cisco Finesse and Cisco Unified CVP OpenSocial Gadget Editor Cross-Site Scripting Vulnerability\r\n\r\nA vulnerability in the web-based management interface of Cisco Finesse and Cisco Unified CVP could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface.\r\nThe vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
@ -101,7 +101,7 @@
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-306"
|
||||
"value": "CWE-79"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -181,11 +181,8 @@
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2",
|
||||
"source": "ykramarz@cisco.com",
|
||||
"tags": [
|
||||
"Vendor Advisory"
|
||||
]
|
||||
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2",
|
||||
"source": "ykramarz@cisco.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,13 +2,13 @@
|
||||
"id": "CVE-2021-1246",
|
||||
"sourceIdentifier": "ykramarz@cisco.com",
|
||||
"published": "2021-01-13T22:15:21.193",
|
||||
"lastModified": "2023-11-07T03:27:47.093",
|
||||
"lastModified": "2024-09-11T16:15:04.190",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Multiple vulnerabilities in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack and obtain potentially confidential information by leveraging a flaw in the authentication mechanism. For more information about these vulnerabilities, see the Details section of this advisory."
|
||||
"value": "Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability\r\n\r\nA vulnerability in the web management interface of Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP could allow an unauthenticated, remote attacker to access the OpenSocial Gadget Editor without providing valid user credentials.\r\nThe vulnerability is due to missing authentication for a specific section of the web-based management interface. An attacker could exploit this vulnerability by accessing a crafted URL. A successful exploit could allow the attacker to obtain access to a section of the interface, which they could use to obtain potentially confidential information and create arbitrary XML files.\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
@ -181,11 +181,8 @@
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2",
|
||||
"source": "ykramarz@cisco.com",
|
||||
"tags": [
|
||||
"Vendor Advisory"
|
||||
]
|
||||
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-multi-vuln-finesse-qp6gbUO2",
|
||||
"source": "ykramarz@cisco.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2021-4441",
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-08-22T02:15:04.563",
|
||||
"lastModified": "2024-08-22T12:48:02.790",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T16:43:41.000",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -15,27 +15,142 @@
|
||||
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: spi: spi-zynq-qspi: corrige una desreferencia de puntero NULL en zynq_qspi_exec_mem_op() En zynq_qspi_exec_mem_op(), kzalloc() se usa directamente en memset(), lo que podr\u00eda provocar un Desreferencia del puntero NULL en caso de falla de kzalloc(). Corrija este error agregando una verificaci\u00f3n de tmpbuf. Este error fue encontrado por un analizador est\u00e1tico. El an\u00e1lisis emplea verificaci\u00f3n diferencial para identificar operaciones de seguridad inconsistentes (por ejemplo, comprobaciones o kfrees) entre dos rutas de c\u00f3digo y confirma que las operaciones inconsistentes no se recuperan en la funci\u00f3n actual o en las personas que llaman, por lo que constituyen errores. Tenga en cuenta que, como error encontrado mediante an\u00e1lisis est\u00e1tico, puede ser un falso positivo o dif\u00edcil de activar. Varios investigadores han realizado una revisi\u00f3n cruzada del error. Las compilaciones con CONFIG_SPI_ZYNQ_QSPI=m no muestran nuevas advertencias y nuestro analizador est\u00e1tico ya no advierte sobre este c\u00f3digo."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 5.5,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.8,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-476"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.2",
|
||||
"versionEndExcluding": "5.4.182",
|
||||
"matchCriteriaId": "14A69F21-00AC-43D7-A8A1-4D144BA6E074"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.5",
|
||||
"versionEndExcluding": "5.10.103",
|
||||
"matchCriteriaId": "1A95B717-3110-4D4F-B8FC-373919BB514D"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.11",
|
||||
"versionEndExcluding": "5.15.26",
|
||||
"matchCriteriaId": "9AB342AE-A62E-4947-A6EA-511453062B2B"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.16",
|
||||
"versionEndExcluding": "5.16.12",
|
||||
"matchCriteriaId": "C76BAB21-7F23-4AD8-A25F-CA7B262A2698"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "7BD5F8D9-54FA-4CB0-B4F0-CB0471FDDB2D"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "E6E34B23-78B4-4516-9BD8-61B33F4AC49A"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "C030FA3D-03F4-4FB9-9DBF-D08E5CAC51AA"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "B2D2677C-5389-4AE9-869D-0F881E80D923"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "EFA3917C-C322-4D92-912D-ECE45B2E7416"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/2efece1368aeee2d2552c7ec36aeb676c4d4c95f",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/3c32405d6474a21f7d742828e73c13e326dcae82",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/ab3824427b848da10e9fe2727f035bbeecae6ff4",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/b9dd08cbebe0c593c49bf86d2012a431494e54cb",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/df14d2bed8e2455878e046e67123d9ecb2e79056",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2022-48895",
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-08-21T07:15:05.580",
|
||||
"lastModified": "2024-08-21T12:30:33.697",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T16:01:23.487",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -15,15 +15,90 @@
|
||||
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: iommu/arm-smmu: no cancelar el registro al apagar Michael Walle dice que not\u00f3 el siguiente seguimiento de pila mientras realizaba un apagado con \"reboot -f\". Sugiere que tuvo \"suerte\" y dio en el lugar correcto para el reinicio mientras hab\u00eda una transmisi\u00f3n de paquetes en vuelo. No se puede manejar la desreferencia del puntero NULL del kernel en la direcci\u00f3n virtual 0000000000000098 CPU: 0 PID: 23 Comm: kworker/0:1 Not tainted 6.1.0-rc5-00088-gf3600ff8e322 #1930 Nombre de hardware: Kontron KBox A-230-LS (DT) pc: iommu_get_dma_domain+0x14/0x20 lr: iommu_dma_map_page+0x9c/0x254 Rastreo de llamadas: iommu_get_dma_domain+0x14/0x20 dma_map_page_attrs+0x1ec/0x250 enetc_start_xmit+0x14c/0x10b0 enetc_xmit+0x 60/0xdc dev_hard_start_xmit+0xb8/0x210 sch_direct_xmit+0x11c/0x420 __dev_queue_xmit+0x354 /0xb20 ip6_finish_output2+0x280/0x5b0 __ip6_finish_output+0x15c/0x270 ip6_output+0x78/0x15c NF_HOOK.constprop.0+0x50/0xd0 mld_sendpack+0x1bc/0x320 mld_ifc_work+0x1d8/0x4d c proceso_one_work+0x1e8/0x460 trabajador_thread+0x178/0x534 kthread+0xe0/ 0xe4 ret_from_fork+0x10/0x20 C\u00f3digo: d503201f f9416800 d503233f d50323bf (f9404c00) ---[ end trace 00000000000000000 ]--- P\u00e1nico del kernel - no se sincroniza: Ups: excepci\u00f3n fatal en la interrupci\u00f3n Esto parece ser reproducible cuando la placa tiene una IP direcci\u00f3n, se inunda el ping desde otro host y se utiliza \"reboot -f\". La siguiente es una manifestaci\u00f3n m\u00e1s del problema: $ reboot -f kvm: saliendo de la virtualizaci\u00f3n de hardware cfg80211: no se pudo cargar regulator.db arm-smmu 5000000.iommu: deshabilitando la traducci\u00f3n sdhci-esdhc 2140000.mmc: eliminando del grupo iommu 11 sdhci- esdhc 2150000.mmc: Eliminaci\u00f3n del grupo iommu 12 fsl-edma 22c0000.dma-controller: Eliminaci\u00f3n del grupo iommu 17 dwc3 3100000.usb: Eliminaci\u00f3n del grupo iommu 9 dwc3 3110000.usb: Eliminaci\u00f3n del grupo iommu 10 ahci-qoriq 3200000.sata : Eliminaci\u00f3n de iommu grupo 2 fsl-qdma 8380000.dma-controller: Eliminaci\u00f3n de iommu grupo 20 plataforma f080000.display: Eliminaci\u00f3n de iommu grupo 0 etnaviv-gpu f0c0000.gpu: Eliminaci\u00f3n de iommu grupo 1 etnaviv etnaviv: Eliminaci\u00f3n de iommu grupo 1 caam_jr 8010000.jr: Eliminando del grupo iommu 13 caam_jr 8020000.jr: Eliminando del grupo iommu 14 caam_jr 8030000.jr: Eliminando del grupo iommu 15 caam_jr 8040000.jr: Eliminando del grupo iommu 16 fsl_enetc 0000:00:00.0: Eliminando de iommu grupo 4 arm-smmu 5000000.iommu: ID de transmisi\u00f3n desconocida bloqueada 0x429; arranque con \"arm-smmu.disable_bypass=0\" para permitir, pero esto puede tener implicaciones de seguridad arm-smmu 5000000.iommu: GFSR 0x80000002, GFSYNR0 0x00000002, GFSYNR1 0x00000429, GFSYNR2 0x00000000 fsl_enetc 0000:00 :00.1: Eliminaci\u00f3n del grupo 5 de Iommu arm-smmu 5000000.iommu: ID de transmisi\u00f3n desconocida bloqueada 0x429; arranque con \"arm-smmu.disable_bypass=0\" para permitir, pero esto puede tener implicaciones de seguridad arm-smmu 5000000.iommu: GFSR 0x80000002, GFSYNR0 0x00000002, GFSYNR1 0x00000429, GFSYNR2 0x00000000 arm-smmu 5000000. iommu: ID de transmisi\u00f3n desconocida bloqueada 0x429 ; arranque con \"arm-smmu.disable_bypass=0\" para permitir, pero esto puede tener implicaciones de seguridad arm-smmu 5000000.iommu: GFSR 0x80000002, GFSYNR0 0x00000000, GFSYNR1 0x00000429, GFSYNR2 0x00000000 fsl_enetc 0000:00 :00.2: Eliminaci\u00f3n del grupo 6 de Iommu fsl_enetc_mdio 0000:00:00.3: Eliminaci\u00f3n del grupo iommu 8 mscc_felix 0000:00:00.5: Eliminaci\u00f3n del grupo iommu 3 fsl_enetc 0000:00:00.6: Eliminaci\u00f3n del grupo iommu 7 pcieport 0001:00:00.0: Eliminaci\u00f3n del grupo iommu 1 8 brazos- smmu 5000000.iommu: ID de transmisi\u00f3n desconocida bloqueada 0x429; arranque con \"arm-smmu.disable_bypass=0\" para permitir, pero esto puede tener implicaciones de seguridad arm-smmu 5000000.iommu: GFSR 0x00000002, GFSYNR0 0x00000000, GFSYNR1 0x00000429, GFSYNR2 0x00000000 pcieport 0002:00:00 .0: ---truncado---"
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 5.5,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.8,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-476"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "6.1",
|
||||
"versionEndExcluding": "6.1.7",
|
||||
"matchCriteriaId": "043B7290-EDB8-4ACE-A87A-8FA7D130B565"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/a1b9c7b1978aacf4b2f33e34bde1e2bb80b8497a",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/ce31e6ca68bd7639bd3e5ef97be215031842bbab",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2022-48896",
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-08-21T07:15:05.640",
|
||||
"lastModified": "2024-08-21T12:30:33.697",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T16:06:04.297",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -15,27 +15,132 @@
|
||||
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ixgbe: repara la fuga de recuento de dispositivos pci Como dice el comentario de pci_get_domain_bus_and_slot(), devuelve un dispositivo PCI con el recuento de referencia incrementado, cuando termine de usarlo, la persona que llama debe disminuir el recuento de referencias en llamando a pci_dev_put(). En ixgbe_get_first_secondary_devfn() y ixgbe_x550em_a_has_mii(), se llama a pci_dev_put() para evitar fugas."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 5.5,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.8,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-401"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.0",
|
||||
"versionEndExcluding": "5.4.229",
|
||||
"matchCriteriaId": "2A559735-D7FB-49EC-A608-46802CA50E6C"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.5",
|
||||
"versionEndExcluding": "5.10.164",
|
||||
"matchCriteriaId": "CA742E66-32D2-459E-AB19-171C4DB3B1F4"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.11",
|
||||
"versionEndExcluding": "5.15.89",
|
||||
"matchCriteriaId": "E706841F-E788-4316-9B05-DA8EB60CE6B3"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.16",
|
||||
"versionEndExcluding": "6.1.7",
|
||||
"matchCriteriaId": "9275C81F-AE96-4CDB-AD20-7DBD36E5D909"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/112df4cd2b09acd64bcd18f5ef83ba5d07b34bf0",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/4c93422a54cd6a349988f42e1c6bf082cf4ea9d8",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/53cefa802f070d46c0c518f4865be2c749818a18",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/b93fb4405fcb5112c5739c5349afb52ec7f15c07",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/c49996c6aa03590e4ef5add8772cb6068d99fd59",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2022-48897",
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-08-21T07:15:05.693",
|
||||
"lastModified": "2024-08-21T12:30:33.697",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T16:10:40.843",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -15,15 +15,90 @@
|
||||
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: arm64/mm: corrige file_map_count incorrecto para pmd no v\u00e1lido. La verificaci\u00f3n de la tabla de p\u00e1ginas activa BUG_ON() inesperadamente cuando se divide una p\u00e1gina enorme: ------------[ cortar aqu\u00ed ]------------ \u00a1ERROR del kernel en mm/page_table_check.c:119! Error interno: Ups - ERROR: 00000000f2000800 [#1] SMP Dumping ftrace buffer: (ftrace buffer vac\u00edo) M\u00f3dulos vinculados en: CPU: 7 PID: 210 Comm: transhuge-stres No contaminado 6.1.0-rc3+ #748 Nombre de hardware: linux ,dummy-virt (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc: page_table_check_set.isra.0+0x398/0x468 lr: page_table_check_set.isra.0+0x1c0/0x468 [...] Rastreo de llamadas: page_table_check_set.isra.0+0x398/0x468 __page_table_check_pte_set+0x160/0x1c0 __split_huge_pmd_locked+0x900/0x1648 __split_huge_pmd+0x28c/0x3b8 unmap_page_range+0x428/0x858 single_vma+0xf4/0x1c8 zap_page_range+0x2b0/0x410 madvise_vma_behavior+0xc44 /0xe78 do_madvise+0x280/0x698 __arm64_sys_madvise+0x90/0xe8 invoke_syscall.constprop.0+0xdc/0x1d8 do_el0_svc+0xf4/0x3f8 el0_svc+0x58/0x120 el0t_64_sync_handler+0x b8/0xc0 el0t_64_sync+0x19c/0x1a0 [...] En arm64, pmd_leaf () devolver\u00e1 verdadero incluso si el pmd no es v\u00e1lido debido a la verificaci\u00f3n pmd_present_invalid(). Entonces, en pmdp_invalidate() file_map_count no solo disminuir\u00e1 una vez sino que tambi\u00e9n aumentar\u00e1 una vez. Luego, en set_pte_at(), file_map_count aumenta nuevamente y, por lo tanto, activa BUG_ON() inesperadamente. Agregue !pmd_present_invalid() check in pmd_user_accessible_page() para solucionar el problema."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 5.5,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.8,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NVD-CWE-noinfo"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.19",
|
||||
"versionEndExcluding": "6.1.7",
|
||||
"matchCriteriaId": "A3B4D9E4-9005-47B1-B0C1-FFC9874D6FF6"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/21e5eca0ac9046da9918a919bc92b7b5a78d27e7",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/74c2f81054510d45b813548cb0a1c4ebf87cdd5f",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2022-48898",
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-08-21T07:15:05.750",
|
||||
"lastModified": "2024-08-21T12:30:33.697",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T16:19:18.350",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -15,23 +15,118 @@
|
||||
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/msm/dp: no complete dp_aux_cmd_fifo_tx() si irq no es para transferencia auxiliar. Hay 3 posibles fuentes de interrupci\u00f3n que son manejadas por el controlador DP, HPDstatus, los cambios de estado del controlador y Aux. transacci\u00f3n de lectura/escritura. En cada irq, el controlador DP debe verificar el estado isr de cada fuente de interrupci\u00f3n y atender la interrupci\u00f3n si sus bits de estado isr muestran que hay interrupciones pendientes. Existe una posible condici\u00f3n de ejecuci\u00f3n que puede ocurrir en la implementaci\u00f3n actual del controlador aux isr, ya que siempre est\u00e1 completo dp_aux_cmd_fifo_tx(), incluso irq no es para transacciones de lectura o escritura auxiliar. Esto puede causar que la transacci\u00f3n de lectura auxiliar regrese prematuramente si la lectura de datos auxiliares del host est\u00e1 en medio de la espera de que el receptor complete la transferencia de datos al host mientras ocurre la irq. Esto har\u00e1 que el b\u00fafer de recepci\u00f3n del host contenga datos inesperados. Este parche soluciona este problema verificando aux isr y regresa inmediatamente al controlador aux isr si no hay ning\u00fan bit de estado isr establecido. Actualmente hay un informe de error que indica que la corrupci\u00f3n de eDP edid ocurre durante el inicio del sistema. Despu\u00e9s de una larga depuraci\u00f3n, descubr\u00ed que la interrupci\u00f3n VIDEO_READY se activaba continuamente durante el inicio del sistema, lo que provocaba que dp_aux_isr() completara dp_aux_cmd_fifo_tx() prematuramente para recuperar datos del b\u00fafer de hardware auxiliar que a\u00fan no contiene la transferencia completa de datos desde el receptor. Esto provoc\u00f3 corrupci\u00f3n. A continuaci\u00f3n se muestra la firma en los registros del kernel cuando ocurre un problema, EDID tiene el panel de encabezado corrupto-simple-dp-aux aux-aea0000.edp: No se pudo identificar el panel a trav\u00e9s de EDID Cambios en v2: - complete si (ret == IRQ_HANDLED) ay dp-aux_isr() - agregar m\u00e1s texto de confirmaci\u00f3n Cambios en v3: - agregar Stephen sugerido - dp_aux_isr() devolver IRQ_XXX a la persona que llama - dp_ctrl_isr() devolver IRQ_XXX a la persona que llama Cambios en v4: - dividir en dos parches Cambios en v5: - eliminar l\u00ednea vac\u00eda entre etiquetas Cambios en v6: - eliminar \"eso\" adicional y l\u00ednea fija de m\u00e1s de 75 caracteres en el texto de confirmaci\u00f3n Patchwork: https://patchwork.freedesktop.org/patch/516121/"
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 4.7,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.0,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-362"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.10",
|
||||
"versionEndExcluding": "5.10.164",
|
||||
"matchCriteriaId": "0A75A69A-4F89-495D-9990-0D27E9EA3748"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.11",
|
||||
"versionEndExcluding": "5.15.89",
|
||||
"matchCriteriaId": "E706841F-E788-4316-9B05-DA8EB60CE6B3"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.16",
|
||||
"versionEndExcluding": "6.1.7",
|
||||
"matchCriteriaId": "9275C81F-AE96-4CDB-AD20-7DBD36E5D909"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/1cba0d150fa102439114a91b3e215909efc9f169",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/785607e5e6fb52caf141e4580de40405565f04f1",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/984ad875db804948c86ca9e1c2e784ae8252715a",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/b7dcbca46db3c77fdb02c2a9d6239e5aa3b06a59",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2022-48899",
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-08-21T07:15:05.810",
|
||||
"lastModified": "2024-08-21T12:30:33.697",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T16:22:26.583",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -15,31 +15,146 @@
|
||||
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/virtio: corrige la creaci\u00f3n del identificador GEM. El espacio de usuario UAF puede adivinar el valor del identificador e intentar acelerar la creaci\u00f3n de objetos GEM con el cierre del identificador, lo que resulta en un use-after-free si desreferenciamos el objeto despu\u00e9s de soltar la referencia del identificador. Por esa raz\u00f3n, la eliminaci\u00f3n de la referencia del identificador debe realizarse *despu\u00e9s* de que hayamos terminado de desreferenciar el objeto."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 4.7,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.0,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-416"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "4.4",
|
||||
"versionEndExcluding": "4.19.270",
|
||||
"matchCriteriaId": "418E3384-8E40-4371-AD2F-18BCA50756EA"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "4.20",
|
||||
"versionEndExcluding": "5.4.229",
|
||||
"matchCriteriaId": "A0C0D95E-414A-445E-941B-3EF6A4D3A093"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.5",
|
||||
"versionEndExcluding": "5.10.164",
|
||||
"matchCriteriaId": "CA742E66-32D2-459E-AB19-171C4DB3B1F4"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.11",
|
||||
"versionEndExcluding": "5.15.89",
|
||||
"matchCriteriaId": "E706841F-E788-4316-9B05-DA8EB60CE6B3"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.16",
|
||||
"versionEndExcluding": "6.1.7",
|
||||
"matchCriteriaId": "9275C81F-AE96-4CDB-AD20-7DBD36E5D909"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/011ecdbcd520c90c344b872ca6b4821f7783b2f8",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/19ec87d06acfab2313ee82b2a689bf0c154e57ea",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/52531258318ed59a2dc5a43df2eaf0eb1d65438e",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/68bcd063857075d2f9edfed6024387ac377923e2",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/adc48e5e408afbb01d261bd303fd9fbbbaa3e317",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/d01d6d2b06c0d8390adf8f3ba08aa60b5642ef73",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,13 +2,13 @@
|
||||
"id": "CVE-2023-39914",
|
||||
"sourceIdentifier": "sep@nlnetlabs.nl",
|
||||
"published": "2023-09-13T15:15:07.657",
|
||||
"lastModified": "2023-09-15T15:17:58.497",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:15:04.547",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NLnet Labs\u2019 bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding."
|
||||
"value": "NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather than rejecting the data with an error. This can affect both the actual decoding stage as well as accessing content of types that utilized delayed decoding."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
@ -76,7 +76,11 @@
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-228"
|
||||
"value": "CWE-232"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-240"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -2,13 +2,13 @@
|
||||
"id": "CVE-2023-39915",
|
||||
"sourceIdentifier": "sep@nlnetlabs.nl",
|
||||
"published": "2023-09-13T15:15:07.763",
|
||||
"lastModified": "2023-09-15T19:04:36.513",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:15:04.700",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NLnet Labs\u2019 Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914."
|
||||
"value": "NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI objects. This is due to insufficient input checking in the bcder library covered by CVE-2023-39914."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
@ -76,7 +76,11 @@
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-228"
|
||||
"value": "CWE-232"
|
||||
},
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-240"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-40708",
|
||||
"sourceIdentifier": "ot-cert@dragos.com",
|
||||
"published": "2023-08-24T17:15:09.067",
|
||||
"lastModified": "2023-08-29T23:33:16.533",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:15:04.820",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -72,7 +72,7 @@
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-284"
|
||||
"value": "CWE-1188"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-40709",
|
||||
"sourceIdentifier": "ot-cert@dragos.com",
|
||||
"published": "2023-08-24T17:15:09.160",
|
||||
"lastModified": "2023-08-29T23:32:09.780",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:15:04.970",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -72,7 +72,7 @@
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-400"
|
||||
"value": "CWE-770"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -2,13 +2,13 @@
|
||||
"id": "CVE-2023-40710",
|
||||
"sourceIdentifier": "ot-cert@dragos.com",
|
||||
"published": "2023-08-24T17:15:09.253",
|
||||
"lastModified": "2023-08-30T13:37:34.677",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:15:05.057",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the\u00a0SNAP PAC S1 Firmware version R10.3b\n"
|
||||
"value": "An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the\u00a0SNAP PAC S1 Firmware version R10.3b"
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
@ -72,7 +72,7 @@
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-400"
|
||||
"value": "CWE-770"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -2,13 +2,13 @@
|
||||
"id": "CVE-2023-46371",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:37.877",
|
||||
"lastModified": "2023-11-01T20:08:56.603",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:15:05.180",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "TP-Link device TL-WDR7660 2.0.30 has a stack overflow vulnerability via the function upgradeInfoJsonToBin."
|
||||
"value": "TP-Link device TL-WDR7660 2.0.30 and TL-WR886N 2.0.12 has a stack overflow vulnerability via the function upgradeInfoJsonToBin."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
@ -88,6 +88,10 @@
|
||||
"Exploit",
|
||||
"Third Party Advisory"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/Jianchun-Ding/CVE-poc-update",
|
||||
"source": "cve@mitre.org"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46414",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T20:15:12.357",
|
||||
"lastModified": "2023-11-01T16:36:05.017",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:02.090",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46415",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T20:15:12.400",
|
||||
"lastModified": "2023-11-01T16:36:12.117",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:03.377",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46416",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T20:15:12.447",
|
||||
"lastModified": "2023-11-01T16:36:26.463",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:04.277",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46417",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T20:15:12.490",
|
||||
"lastModified": "2023-11-01T16:36:37.977",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:05.057",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46418",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T20:15:12.540",
|
||||
"lastModified": "2023-11-01T16:36:47.947",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:05.910",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46419",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T20:15:12.600",
|
||||
"lastModified": "2023-11-01T16:36:59.347",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:10.787",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46420",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T20:15:12.670",
|
||||
"lastModified": "2023-11-01T16:37:11.987",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:11.590",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46421",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T20:15:12.740",
|
||||
"lastModified": "2023-11-01T16:37:21.153",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:12.407",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46422",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T20:15:12.803",
|
||||
"lastModified": "2023-11-01T16:37:31.890",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:13.283",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46423",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T20:15:12.863",
|
||||
"lastModified": "2023-11-01T16:37:41.027",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:14.223",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-77"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46520",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.053",
|
||||
"lastModified": "2023-10-26T22:18:36.137",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:15.170",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46521",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.100",
|
||||
"lastModified": "2023-10-26T22:41:06.530",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:15.977",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46522",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.147",
|
||||
"lastModified": "2023-10-26T22:41:11.743",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:16.773",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46523",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.193",
|
||||
"lastModified": "2023-10-26T22:41:16.507",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:17.560",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46525",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.237",
|
||||
"lastModified": "2023-10-26T22:41:25.257",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:18.350",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46526",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.283",
|
||||
"lastModified": "2023-10-26T22:41:40.603",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:19.150",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,13 +2,13 @@
|
||||
"id": "CVE-2023-46527",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.323",
|
||||
"lastModified": "2023-10-26T22:41:32.283",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:19.963",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function bindRequestHandle."
|
||||
"value": "TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin and TL-WDR7660 2.0.30 was discovered to contain a stack overflow via the function bindRequestHandle."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
@ -81,6 +111,10 @@
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://github.com/Jianchun-Ding/CVE-poc-update",
|
||||
"source": "cve@mitre.org"
|
||||
},
|
||||
{
|
||||
"url": "https://github.com/XYIYM/Digging/blob/main/TP-LINK/TL-WR886N/13/1.md",
|
||||
"source": "cve@mitre.org",
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46534",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.373",
|
||||
"lastModified": "2023-10-26T22:41:48.037",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:20.833",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46535",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.420",
|
||||
"lastModified": "2023-10-26T22:41:55.033",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:22.007",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46536",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.463",
|
||||
"lastModified": "2023-10-26T22:42:01.013",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:22.883",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46537",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.503",
|
||||
"lastModified": "2023-10-26T22:42:07.053",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:23.687",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46538",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.550",
|
||||
"lastModified": "2023-10-26T22:42:13.817",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:24.480",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46539",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.593",
|
||||
"lastModified": "2023-10-26T22:42:20.953",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:25.280",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46540",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.637",
|
||||
"lastModified": "2023-11-01T20:18:44.327",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:26.063",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46541",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.683",
|
||||
"lastModified": "2023-11-02T12:49:01.120",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:26.850",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46542",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.727",
|
||||
"lastModified": "2023-11-02T13:09:06.287",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:27.667",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46543",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.780",
|
||||
"lastModified": "2023-11-01T20:35:20.917",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:28.450",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46544",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:38.827",
|
||||
"lastModified": "2023-11-01T20:28:38.340",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:29.257",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46552",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:39.227",
|
||||
"lastModified": "2023-11-01T18:01:24.630",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:30.173",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.0,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.1,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-121"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46553",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:39.273",
|
||||
"lastModified": "2023-11-01T18:01:20.617",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:30.983",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.0,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.1,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-121"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46554",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:39.317",
|
||||
"lastModified": "2023-10-27T22:01:03.050",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:31.783",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46555",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:39.363",
|
||||
"lastModified": "2023-10-27T22:00:56.397",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:32.637",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46556",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:39.410",
|
||||
"lastModified": "2023-10-27T22:00:49.937",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:33.430",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46557",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:39.450",
|
||||
"lastModified": "2023-10-27T22:00:41.117",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:34.220",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46558",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:39.497",
|
||||
"lastModified": "2023-10-27T22:00:33.390",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:35.010",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46559",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:39.547",
|
||||
"lastModified": "2023-10-27T22:00:25.797",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:35.797",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.0,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.1,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-121"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46560",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:39.593",
|
||||
"lastModified": "2023-10-27T22:00:15.483",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:36.590",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.0,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.1,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-121"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46562",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:39.637",
|
||||
"lastModified": "2023-10-27T22:00:06.663",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:37.377",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.0,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.1,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-121"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-46563",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2023-10-25T18:17:39.683",
|
||||
"lastModified": "2023-10-27T22:00:00.013",
|
||||
"vulnStatus": "Analyzed",
|
||||
"lastModified": "2024-09-11T16:35:38.173",
|
||||
"vulnStatus": "Modified",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -36,6 +36,26 @@
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.0,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.1,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
@ -49,6 +69,16 @@
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-121"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-52893",
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-08-21T07:15:05.880",
|
||||
"lastModified": "2024-08-21T12:30:33.697",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T16:24:49.853",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -15,35 +15,165 @@
|
||||
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: gsmi: corrige null-deref en gsmi_get_variable Podemos obtener variables EFI sin recuperar el atributo, por lo que debemos permitir eso en gsmi. commit 859748255b43 (\"efi: pstore: Omit efivars caching EFI varstore access Layer\") agreg\u00f3 una nueva llamada get_variable con attr=NULL, lo que desencadena p\u00e1nico en gsmi."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 5.5,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.8,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-476"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "3.0",
|
||||
"versionEndExcluding": "4.14.304",
|
||||
"matchCriteriaId": "7484020E-A2C4-48A2-9137-7AA65DB251B7"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "4.15",
|
||||
"versionEndExcluding": "4.19.271",
|
||||
"matchCriteriaId": "D86DA289-B5BC-4629-BD56-AB453D481393"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "4.20",
|
||||
"versionEndExcluding": "5.4.230",
|
||||
"matchCriteriaId": "9DB7398D-9781-49C5-B2AE-1969B694B614"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.5",
|
||||
"versionEndExcluding": "5.10.165",
|
||||
"matchCriteriaId": "C6002D5B-9B6A-4788-B943-E3EE01E01303"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.11",
|
||||
"versionEndExcluding": "5.15.90",
|
||||
"matchCriteriaId": "E995CDA5-7223-4FDB-BAD3-81B22C763A43"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.16",
|
||||
"versionEndExcluding": "6.1.8",
|
||||
"matchCriteriaId": "A6AFE6C9-3F59-4711-B2CF-7D6682FF6BD0"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "A127C155-689C-4F67-B146-44A57F4BFD85"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/32313c11bdc8a02c577abaf865be3664ab30410a",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/6646d769fdb0ce4318ef9afd127f8526d1ca8393",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/a769b05eeed7accc4019a1ed9799dd72067f1ce8",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/ae2a9dcc8caa60b1e14671294e5ec902ea5d1dfd",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/eb0421d90f916dffe96b4c049ddf01c0c50620d2",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/ee5763ef829bd923033510de6d1df7c73f085e4b",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/ffef77794fb5f1245c3249b86342bad2299accb5",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-52894",
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-08-21T07:15:05.943",
|
||||
"lastModified": "2024-08-21T12:30:33.697",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T16:27:06.380",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -15,35 +15,164 @@
|
||||
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: gadget: f_ncm: corrige potencial NULL ptr deref en ncm_bitrate() En el error interno de Google 265639009 hemos recibido un informe de fallo (hasta ahora) irreproducible de un aarch64 GKI 5.10. Dispositivo en ejecuci\u00f3n 149-android13. AFAICT, el c\u00f3digo fuente est\u00e1 en: https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10 La pila de llamadas es: ncm_close() -> ncm_notify() - > ncm_do_notify() con el bloqueo en: ncm_do_notify+0x98/0x270 C\u00f3digo: 79000d0b b9000a6c f940012a f9400269 (b9405d4b) El cual creo que se desmonta (no conozco el ensamblaje de ARM, pero me parece bastante sensato...): / / almac\u00e9n de media palabra (16 bits) presumiblemente en evento->wLength (en el desplazamiento 6 de la estructura usb_cdc_notification) 0B 0D 00 79 strh w11, [x8, #6] // almac\u00e9n de palabra (32 bits) presumiblemente en req->Longitud (en el desplazamiento 8 de la estructura usb_request) 6C 0A 00 B9 str w12, [x19, #8] // aqu\u00ed se ley\u00f3 x10 (NULL) desde el desplazamiento 0 del puntero v\u00e1lido x9 // En mi humilde opini\u00f3n, estamos leyendo 'cdev->gadget' y obtener NULL // el gadget est\u00e1 de hecho en el desplazamiento 0 de la estructura usb_composite_dev 2A 01 40 F9 ldr x10, [x9] // cargando el puntero req->buf, que est\u00e1 en el desplazamiento 0 de la estructura usb_request 69 02 40 F9 ldr x9, [x19 ] // x10 es nulo, falla, parece ser un intento de leer cdev->gadget->max_speed 4B 5D 40 B9 ldr w11, [x10, #0x5c] que parece alinearse con ncm_do_notify() caso NCM_NOTIFY_SPEED fragmento de c\u00f3digo: evento ->wLongitud = cpu_to_le16(8); solicitud->longitud = NCM_STATUS_BYTECOUNT; /* Los datos SPEED_CHANGE son velocidades de subida/bajada en bits/seg. */ data = req->buf + sizeof *event; datos[0] = cpu_to_le32(ncm_bitrate(cdev->gadget)); Mi an\u00e1lisis de los registros y la compensaci\u00f3n de fallas de NULL ptr deref (no se puede manejar la desreferencia del puntero NULL del kernel en la direcci\u00f3n virtual 000000000000005c) sugiere en gran medida que la falla se debe a que 'cdev->gadget' es NULL al ejecutar: datos[0] = cpu_to_le32(ncm_bitrate (cdev->gadget)); que llama: ncm_bitrate(NULL) que luego llama: gadget_is_superspeed(NULL) que lee ((struct usb_gadget *)NULL)->max_speed y entra en p\u00e1nico. AFAICT, si estoy contando bien, el desplazamiento de max_speed es de hecho 0x5C. (recuerde que hay una reserva GKI KABI de 16 bytes en la estructura work_struct) No me queda del todo claro c\u00f3mo se supone que funciona todo esto... pero devolver 0 parece mucho mejor que entrar en p\u00e1nico..."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 5.5,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.8,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-476"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionEndExcluding": "4.14.304",
|
||||
"matchCriteriaId": "E8A9B982-D3D6-49CA-BF0A-196ED7947B3A"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "4.15",
|
||||
"versionEndExcluding": "4.19.271",
|
||||
"matchCriteriaId": "D86DA289-B5BC-4629-BD56-AB453D481393"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "4.20",
|
||||
"versionEndExcluding": "5.4.230",
|
||||
"matchCriteriaId": "9DB7398D-9781-49C5-B2AE-1969B694B614"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.5",
|
||||
"versionEndExcluding": "5.10.165",
|
||||
"matchCriteriaId": "C6002D5B-9B6A-4788-B943-E3EE01E01303"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.11",
|
||||
"versionEndExcluding": "5.15.90",
|
||||
"matchCriteriaId": "E995CDA5-7223-4FDB-BAD3-81B22C763A43"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.16",
|
||||
"versionEndExcluding": "6.1.8",
|
||||
"matchCriteriaId": "A6AFE6C9-3F59-4711-B2CF-7D6682FF6BD0"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "A127C155-689C-4F67-B146-44A57F4BFD85"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/09e4507ec8ef2d44da6ba4092b8ee2d81f216497",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/63d161f29cd39c050e8873aa36e0c9fc013bb763",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/a21da7f7aae618c785f7e4a275d43c06dc8412b6",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/a69c8dfb85b44be9cc223be07d35cc3a9baefbea",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/c6ec929595c7443250b2a4faea988c62019d5cd2",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/e92c70059178da751e5af7de02384b7dfadb5ec7",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/fef6b29671b66dfb71f17e337c1ad14b5a2cedae",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-52895",
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-08-21T07:15:06.007",
|
||||
"lastModified": "2024-08-21T12:30:33.697",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T16:31:31.597",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -15,15 +15,73 @@
|
||||
"value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: io_uring/poll: no volver a emitir en caso de ejecuci\u00f3n de sondeo en solicitud de m\u00faltiples disparos. Una confirmaci\u00f3n anterior solucion\u00f3 una ejecuci\u00f3n de sondeo que puede ocurrir, pero solo se aplica a solicitudes de m\u00faltiples disparos. Para una solicitud de disparo m\u00faltiple, podemos ignorar con seguridad una activaci\u00f3n espuria, ya que, para empezar, nunca salimos de la cola de espera. Una reemisi\u00f3n contundente de una solicitud de armado de m\u00faltiples disparos puede hacer que perdamos un b\u00fafer, si se proporciona en anillo. Si bien esto parece un error en s\u00ed mismo, en realidad no es un comportamiento definido volver a emitir una solicitud multidisparo directamente. Tambi\u00e9n es menos eficiente hacerlo y no es necesario rearmar nada como lo es para solicitudes de sondeo de un solo disparo."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 5.5,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.8,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-401"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.1.7:*:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "6E5E3E6D-B23E-4B23-9819-3DEB8963E4E3"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/36fc7317cdb16cfeae0f879916995037bb615ac4",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/8caa03f10bf92cb8657408a6ece6a8a73f96ce13",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2023-52896",
|
||||
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"published": "2024-08-21T07:15:06.060",
|
||||
"lastModified": "2024-08-21T12:30:33.697",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T16:37:08.107",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -15,27 +15,144 @@
|
||||
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: corrige la ejecuci\u00f3n entre el rescaneo de cuotas y la deshabilitaci\u00f3n que conduce a un puntero NULL deref. Si tenemos una tarea que intenta iniciar el trabajador de rescaneo de cuotas mientras otra intenta deshabilitar las cuotas, podemos finalizar hasta llegar a una ejecuci\u00f3n que resulta en que el trabajador de rescaneo de cuotas realice una desreferencia del puntero NULL. Los pasos para esto son los siguientes: 1) Se habilitan las cuotas; 2) La tarea A llama al ioctl de rescaneo de cuotas e ingresa btrfs_qgroup_rescan(). Llama a qgroup_rescan_init() que devuelve 0 (\u00e9xito) y luego se une a una transacci\u00f3n y la confirma; 3) La tarea B llama a ioctl de desactivaci\u00f3n de cuota e ingresa btrfs_quota_disable(). Borra el bit BTRFS_FS_QUOTA_ENABLED de fs_info->flags y llama a btrfs_qgroup_wait_for_completion(), que regresa inmediatamente ya que el trabajador de rescaneo a\u00fan no se est\u00e1 ejecutando. Luego inicia una transacci\u00f3n y bloquea fs_info->qgroup_ioctl_lock; 4) La tarea A pone en cola al trabajador que vuelve a escanear, llamando a btrfs_queue_work(); 5) El trabajador de rescaneo inicia y llama a rescan_should_stop() al inicio de su ciclo while, lo que resulta en 0 iteraciones del ciclo, ya que la bandera BTRFS_FS_QUOTA_ENABLED fue borrada de fs_info->flags por la tarea B en el paso 3); 6) La tarea B establece fs_info->quota_root en NULL; 7) El trabajador de rescaneo intenta iniciar una transacci\u00f3n y usa fs_info->quota_root como argumento ra\u00edz para btrfs_start_transaction(). Esto da como resultado una desreferencia del puntero NULL en la cadena de llamadas de btrfs_start_transaction(). El seguimiento de la pila es similar al que se informa en la etiqueta de enlace a continuaci\u00f3n: falla de protecci\u00f3n general, probablemente para la direcci\u00f3n no can\u00f3nica 0xdffffc0000000041: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000208-0x0000000000000020f] CPU: 1 PID: 34 Comm: kworker/u4:2 No contaminado 6.1.0-syzkaller-13872-gb6bb9676f216 #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 26/10/2022 Cola de trabajo: btrfs-qgroup-rescan btrfs_work_helper RIP: 0010:start_transaction+0x48/0x10f0 fs/btrfs/transaction.c:564 C\u00f3digo: 48 89 fb 48 (...) RSP: 0018:ffffc90000ab7ab0 EFLAGS: 00010206 RAX: 0000000000000041 X: 0000000000000208 RCX: ffff88801779ba80 RDX: 00000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: dffffc0000000000 R08: 0000000000000001 R09: fffff52000156f5d R10: fffff52000156f5d R11: 2000156f5c R12: 0000000000000000 R13: 0000000000000001 R14: 0000000000000001 R15: 00000000000000003 FS: 0000000000000000(0000) 8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2bea75b718 CR3: 000000001d0cc000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 00000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Seguimiento de llamadas: / btrfs/qgroup.c:3402 btrfs_work_helper+0x312/0x850 fs/btrfs/async-thread.c:280 Process_one_work+0x877/0xdb0 kernel/workqueue.c:2289 trabajador_thread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266 /0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 M\u00f3dulos vinculados en: Solucione este problema haciendo que la funci\u00f3n de trabajo de rescaneo no intente iniciar una transacci\u00f3n si No hice ning\u00fan trabajo de reexploraci\u00f3n."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "HIGH",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 4.7,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.0,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-476"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.4.178",
|
||||
"versionEndExcluding": "5.4.230",
|
||||
"matchCriteriaId": "E16E0383-9CED-439E-8DEC-DDDD9B142E64"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.10.99",
|
||||
"versionEndExcluding": "5.10.165",
|
||||
"matchCriteriaId": "5C13010D-C392-45FA-BB6D-957B35B6E33C"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.15.22",
|
||||
"versionEndExcluding": "5.15.90",
|
||||
"matchCriteriaId": "11ABF525-41F7-480A-8DEB-5BF11C1C0C44"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartExcluding": "5.16.8",
|
||||
"versionEndExcluding": "5.17",
|
||||
"matchCriteriaId": "F6E1B0A7-FD05-4730-935F-1A3481E6B3AF"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||||
"versionStartIncluding": "5.17",
|
||||
"versionEndExcluding": "6.1.8",
|
||||
"matchCriteriaId": "3FB612E5-3EDB-46B7-95D9-1BA0CD61AA5E"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "725C78C9-12CE-406F-ABE8-0813A01D66E8"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "A127C155-689C-4F67-B146-44A57F4BFD85"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/1004fc90f0d79a4b7d9e3d432729914f472f9ad1",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/3bd43374857103ba3cac751d6d4afa8d83b5d92a",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/64287cd456a22373053998c1fccf14b651e9cbbd",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/89ac597e3e807b91e2ebd6a7c36fec7b97290233",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
},
|
||||
{
|
||||
"url": "https://git.kernel.org/stable/c/b7adbf9ada3513d2092362c8eac5cddc5b651f5c",
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||||
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||||
"tags": [
|
||||
"Patch"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2024-0104",
|
||||
"sourceIdentifier": "psirt@nvidia.com",
|
||||
"published": "2024-08-08T18:15:09.800",
|
||||
"lastModified": "2024-08-08T18:55:19.180",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T17:40:35.430",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -17,6 +17,26 @@
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "psirt@nvidia.com",
|
||||
"type": "Secondary",
|
||||
@ -40,6 +60,16 @@
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NVD-CWE-Other"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "psirt@nvidia.com",
|
||||
"type": "Secondary",
|
||||
@ -51,10 +81,121 @@
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"operator": "AND",
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:nvidia:mlnx-os:*:*:*:*:-:*:*:*",
|
||||
"versionEndExcluding": "3.11.2002",
|
||||
"matchCriteriaId": "D34C04D4-8472-4497-8976-A1336CA1730E"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:nvidia:mlnx-os:*:*:*:*:lts:*:*:*",
|
||||
"versionEndExcluding": "3.11.2202",
|
||||
"matchCriteriaId": "24D950AF-5F1E-4C64-AE31-C0974D2D0593"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": false,
|
||||
"criteria": "cpe:2.3:h:nvidia:metrox-2:-:*:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "2CBE1921-C790-488B-8B8B-228C4DBC2D7E"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"operator": "AND",
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:nvidia:mlnx-gw:*:*:*:*:-:*:*:*",
|
||||
"versionEndExcluding": "8.2.2202",
|
||||
"matchCriteriaId": "836B17DB-2E03-4D33-B3D0-87C4F989A861"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": false,
|
||||
"criteria": "cpe:2.3:h:nvidia:skyway:-:*:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "59E40D6B-8182-4448-A57C-E300F9750A7A"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:nvidia:onyx:*:*:*:*:lts:*:*:*",
|
||||
"versionEndExcluding": "3.10.4402",
|
||||
"matchCriteriaId": "26CF254C-1556-4D77-9423-C4DD973B8CE5"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"operator": "AND",
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:nvidia:nvda-os_xc:*:*:*:*:*:*:*:*",
|
||||
"versionEndExcluding": "18.2.2000",
|
||||
"matchCriteriaId": "BD3E5FC6-48B3-4911-92EE-258F5FDE40FC"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": false,
|
||||
"criteria": "cpe:2.3:h:nvidia:metrox-3_xc:-:*:*:*:*:*:*:*",
|
||||
"matchCriteriaId": "5440361F-B691-419C-94F1-B457873463B2"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5559",
|
||||
"source": "psirt@nvidia.com"
|
||||
"source": "psirt@nvidia.com",
|
||||
"tags": [
|
||||
"Vendor Advisory"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2024-0113",
|
||||
"sourceIdentifier": "psirt@nvidia.com",
|
||||
"published": "2024-08-12T13:38:12.693",
|
||||
"lastModified": "2024-08-12T13:41:36.517",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T17:34:37.667",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -17,6 +17,26 @@
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
},
|
||||
{
|
||||
"source": "psirt@nvidia.com",
|
||||
"type": "Secondary",
|
||||
@ -40,6 +60,16 @@
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-22"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "psirt@nvidia.com",
|
||||
"type": "Secondary",
|
||||
@ -51,10 +81,114 @@
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:nvidia:mellanox_os:*:*:*:*:*:mellanox_os_lts:*:*",
|
||||
"versionEndExcluding": "3.10.4500",
|
||||
"matchCriteriaId": "E4D632AA-754C-4160-86D6-CB1CE337405C"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:nvidia:mellanox_os:*:*:*:*:*:mellanox_os:*:*",
|
||||
"versionEndExcluding": "3.12.1002",
|
||||
"matchCriteriaId": "A0761130-9A9E-43EE-B426-03AD461743AC"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:nvidia:mellanox_os:*:*:*:*:*:mellanox_os_lts:*:*",
|
||||
"versionStartExcluding": "3.11.0000",
|
||||
"versionEndIncluding": "3.11.2302",
|
||||
"matchCriteriaId": "5886AC86-BB6B-4627-91D7-9A6F256500A3"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:o:nvidia:onyx:*:*:*:*:onyx_lts:*:*:*",
|
||||
"versionEndExcluding": "3.10.4504",
|
||||
"matchCriteriaId": "1D9AD737-499F-4926-AB18-D34D75EFA169"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:h:nvidia:skyway:*:*:*:*:*:skyway_lts:*:*",
|
||||
"versionEndExcluding": "8.1.4500",
|
||||
"matchCriteriaId": "629A139D-C222-48B2-BCE9-323BD1595698"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:h:nvidia:skyway:*:*:*:*:*:skyway:*:*",
|
||||
"versionEndExcluding": "8.2.2300",
|
||||
"matchCriteriaId": "EF4FB15E-A443-402B-AB78-87F047FAA16C"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:h:nvidia:metrox-3_xc:*:*:*:*:*:metrox:*:*",
|
||||
"versionEndExcluding": "18.2.2300",
|
||||
"matchCriteriaId": "0EAD9D32-C07A-4763-ADF6-CCD72A580125"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:h:nvidia:metrox-2:*:*:*:*:*:metrox:*:*",
|
||||
"versionEndExcluding": "3.12.1002",
|
||||
"matchCriteriaId": "F069237E-F6C7-4D57-9AB6-DAF4E75D7561"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5563",
|
||||
"source": "psirt@nvidia.com"
|
||||
"source": "psirt@nvidia.com",
|
||||
"tags": [
|
||||
"Vendor Advisory"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2024-0115",
|
||||
"sourceIdentifier": "psirt@nvidia.com",
|
||||
"published": "2024-08-12T13:38:12.943",
|
||||
"lastModified": "2024-08-12T13:41:36.517",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T17:24:27.393",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -17,6 +17,26 @@
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 6.1,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.8,
|
||||
"impactScore": 4.2
|
||||
},
|
||||
{
|
||||
"source": "psirt@nvidia.com",
|
||||
"type": "Secondary",
|
||||
@ -40,6 +60,16 @@
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "NVD-CWE-noinfo"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"source": "psirt@nvidia.com",
|
||||
"type": "Secondary",
|
||||
@ -51,10 +81,46 @@
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:nvidia:cv-cuda:*:*:*:*:*:jetpack:*:*",
|
||||
"versionStartIncluding": "0.1.0",
|
||||
"versionEndIncluding": "0.10.0",
|
||||
"matchCriteriaId": "C46E7E53-7D0C-4D53-A3FC-3E195E817386"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:nvidia:cv-cuda:*:*:*:*:*:ubuntu_20.04:*:*",
|
||||
"versionStartIncluding": "0.1.0",
|
||||
"versionEndIncluding": "0.10.0",
|
||||
"matchCriteriaId": "38D1DC42-30AD-423B-91FA-8EC7929F936D"
|
||||
},
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:nvidia:cv-cuda:*:*:*:*:*:ubuntu_22.04:*:*",
|
||||
"versionStartIncluding": "0.1.0",
|
||||
"versionEndIncluding": "0.10.0",
|
||||
"matchCriteriaId": "44B5F90C-CD1C-4F11-BB45-717CA0C8DEED"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5560",
|
||||
"source": "psirt@nvidia.com"
|
||||
"source": "psirt@nvidia.com",
|
||||
"tags": [
|
||||
"Vendor Advisory"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,13 +2,17 @@
|
||||
"id": "CVE-2024-1656",
|
||||
"sourceIdentifier": "security@octopus.com",
|
||||
"published": "2024-09-11T05:15:02.303",
|
||||
"lastModified": "2024-09-11T05:15:02.303",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2024-09-11T16:26:11.920",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Affected versions of Octopus Server had a weak content security policy."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Las versiones afectadas de Octopus Server ten\u00edan una pol\u00edtica de seguridad de contenido d\u00e9bil."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
56
CVE-2024/CVE-2024-203xx/CVE-2024-20304.json
Normal file
56
CVE-2024/CVE-2024-203xx/CVE-2024-20304.json
Normal file
@ -0,0 +1,56 @@
|
||||
{
|
||||
"id": "CVE-2024-20304",
|
||||
"sourceIdentifier": "ykramarz@cisco.com",
|
||||
"published": "2024-09-11T17:15:11.853",
|
||||
"lastModified": "2024-09-11T17:15:11.853",
|
||||
"vulnStatus": "Received",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A vulnerability in the multicast traceroute version 2 (Mtrace2) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to exhaust the UDP packet memory of an affected device.\r\n\r\nThis vulnerability exists because the Mtrace2 code does not properly handle packet memory. An attacker could exploit this vulnerability by sending crafted packets to an affected device. A successful exploit could allow the attacker to exhaust the incoming UDP packet memory. The affected device would not be able to process higher-level UDP-based protocols packets, possibly causing a denial of service (DoS) condition.\r\nNote: This vulnerability can be exploited using IPv4 or IPv6."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.6,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 4.0
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-401"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pak-mem-exhst-3ke9FeFy",
|
||||
"source": "ykramarz@cisco.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
56
CVE-2024/CVE-2024-203xx/CVE-2024-20317.json
Normal file
56
CVE-2024/CVE-2024-203xx/CVE-2024-20317.json
Normal file
@ -0,0 +1,56 @@
|
||||
{
|
||||
"id": "CVE-2024-20317",
|
||||
"sourceIdentifier": "ykramarz@cisco.com",
|
||||
"published": "2024-09-11T17:15:12.043",
|
||||
"lastModified": "2024-09-11T17:15:12.043",
|
||||
"vulnStatus": "Received",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A vulnerability in the handling of specific Ethernet frames by Cisco IOS XR Software for various Cisco Network Convergence System (NCS) platforms could allow an unauthenticated, adjacent attacker to cause critical priority packets to be dropped, resulting in a denial of service (DoS) condition.\r\n\r\nThis vulnerability is due to incorrect classification of certain types of Ethernet frames that are received on an interface. An attacker could exploit this vulnerability by sending specific types of Ethernet frames to or through the affected device. A successful exploit could allow the attacker to cause control plane protocol relationships to fail, resulting in a DoS condition. For more information, see the section of this advisory.\r\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.4,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 4.0
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-684"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-l2services-2mvHdNuC",
|
||||
"source": "ykramarz@cisco.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
56
CVE-2024/CVE-2024-203xx/CVE-2024-20343.json
Normal file
56
CVE-2024/CVE-2024-203xx/CVE-2024-20343.json
Normal file
@ -0,0 +1,56 @@
|
||||
{
|
||||
"id": "CVE-2024-20343",
|
||||
"sourceIdentifier": "ykramarz@cisco.com",
|
||||
"published": "2024-09-11T17:15:12.223",
|
||||
"lastModified": "2024-09-11T17:15:12.223",
|
||||
"vulnStatus": "Received",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to read any file in the file system of the underlying Linux operating system. The attacker must have valid credentials on the affected device.\r\n\r\nThis vulnerability is due to incorrect validation of the arguments that are passed to a specific CLI command. An attacker could exploit this vulnerability by logging in to an affected device with low-privileged credentials and using the affected command. A successful exploit could allow the attacker access files in read-only mode on the Linux file system."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 5.5,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.8,
|
||||
"impactScore": 3.6
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-284"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-shellutil-HCb278wD",
|
||||
"source": "ykramarz@cisco.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
56
CVE-2024/CVE-2024-203xx/CVE-2024-20381.json
Normal file
56
CVE-2024/CVE-2024-203xx/CVE-2024-20381.json
Normal file
@ -0,0 +1,56 @@
|
||||
{
|
||||
"id": "CVE-2024-20381",
|
||||
"sourceIdentifier": "ykramarz@cisco.com",
|
||||
"published": "2024-09-11T17:15:12.403",
|
||||
"lastModified": "2024-09-11T17:15:12.403",
|
||||
"vulnStatus": "Received",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A vulnerability in the JSON-RPC API feature in ConfD that is used by the web-based management interfaces of Cisco Crosswork Network Services Orchestrator (NSO), Cisco Optical Site Manager, and Cisco RV340 Dual WAN Gigabit VPN Routers could allow an authenticated, remote attacker to modify the configuration of an affected application or device.\r\n\r\nThis vulnerability is due to improper authorization checks on the API. An attacker with privileges sufficient to access the affected application or device could exploit this vulnerability by sending malicious requests to the JSON-RPC API. A successful exploit could allow the attacker to make unauthorized modifications to the configuration of the affected application or device, including creating new user accounts or elevating their own privileges on an affected system."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-285"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nso-auth-bypass-QnTEesp",
|
||||
"source": "ykramarz@cisco.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
56
CVE-2024/CVE-2024-203xx/CVE-2024-20390.json
Normal file
56
CVE-2024/CVE-2024-203xx/CVE-2024-20390.json
Normal file
@ -0,0 +1,56 @@
|
||||
{
|
||||
"id": "CVE-2024-20390",
|
||||
"sourceIdentifier": "ykramarz@cisco.com",
|
||||
"published": "2024-09-11T17:15:12.613",
|
||||
"lastModified": "2024-09-11T17:15:12.613",
|
||||
"vulnStatus": "Received",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A vulnerability in the Dedicated XML Agent feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) on XML TCP listen port 38751.\r\n\r\nThis vulnerability is due to a lack of proper error validation of ingress XML packets. An attacker could exploit this vulnerability by sending a sustained, crafted stream of XML traffic to a targeted device. A successful exploit could allow the attacker to cause XML TCP port 38751 to become unreachable while the attack traffic persists."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "LOW",
|
||||
"baseScore": 5.3,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 3.9,
|
||||
"impactScore": 1.4
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-940"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-xml-tcpdos-ZEXvrU2S",
|
||||
"source": "ykramarz@cisco.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
56
CVE-2024/CVE-2024-203xx/CVE-2024-20398.json
Normal file
56
CVE-2024/CVE-2024-203xx/CVE-2024-20398.json
Normal file
@ -0,0 +1,56 @@
|
||||
{
|
||||
"id": "CVE-2024-20398",
|
||||
"sourceIdentifier": "ykramarz@cisco.com",
|
||||
"published": "2024-09-11T17:15:12.860",
|
||||
"lastModified": "2024-09-11T17:15:12.860",
|
||||
"vulnStatus": "Received",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to obtain read/write file system access on the underlying operating system of an affected device.\r\n\r\nThis vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker with a low-privileged account could exploit this vulnerability by using crafted commands at the prompt. A successful exploit could allow the attacker to elevate privileges to root."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 8.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.0,
|
||||
"impactScore": 6.0
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-78"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-priv-esc-CrG5vhCq",
|
||||
"source": "ykramarz@cisco.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
56
CVE-2024/CVE-2024-204xx/CVE-2024-20406.json
Normal file
56
CVE-2024/CVE-2024-204xx/CVE-2024-20406.json
Normal file
@ -0,0 +1,56 @@
|
||||
{
|
||||
"id": "CVE-2024-20406",
|
||||
"sourceIdentifier": "ykramarz@cisco.com",
|
||||
"published": "2024-09-11T17:15:13.040",
|
||||
"lastModified": "2024-09-11T17:15:13.040",
|
||||
"vulnStatus": "Received",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A vulnerability in the segment routing feature for the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected device.\r\n\r\nThis vulnerability is due to insufficient input validation of ingress IS-IS packets. An attacker could exploit this vulnerability by sending specific IS-IS packets to an affected device after forming an adjacency. A successful exploit could allow the attacker to cause the IS-IS process on all affected devices that are participating in the Flexible Algorithm to crash and restart, resulting in a DoS condition.\r\nNote: The IS-IS protocol is a routing protocol. To exploit this vulnerability, an attacker must be Layer 2-adjacent to the affected device and must have formed an adjacency. This vulnerability affects segment routing for IS-IS over IPv4 and IPv6 control planes as well as devices that are configured as level 1, level 2, or multi-level routing IS-IS type."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
|
||||
"attackVector": "ADJACENT_NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "NONE",
|
||||
"integrityImpact": "NONE",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.4,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 4.0
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-20"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isis-xehpbVNe",
|
||||
"source": "ykramarz@cisco.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,13 +2,13 @@
|
||||
"id": "CVE-2024-20466",
|
||||
"sourceIdentifier": "ykramarz@cisco.com",
|
||||
"published": "2024-08-21T20:15:08.737",
|
||||
"lastModified": "2024-08-22T12:48:02.790",
|
||||
"lastModified": "2024-09-11T16:15:05.683",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device.\r\n\r\nThis vulnerability is due to improper enforcement of administrative privilege levels for high-value sensitive data. An attacker with read-only Administrator privileges for the web-based management interface on an affected device could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system."
|
||||
"value": "A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information from an affected device. \r\n\r\nThis vulnerability is due to improper enforcement of administrative privilege levels for high-value sensitive data. An attacker with read-only Administrator privileges for the web-based management interface on an affected device could exploit this vulnerability by browsing to a page that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
|
||||
56
CVE-2024/CVE-2024-204xx/CVE-2024-20483.json
Normal file
56
CVE-2024/CVE-2024-204xx/CVE-2024-20483.json
Normal file
@ -0,0 +1,56 @@
|
||||
{
|
||||
"id": "CVE-2024-20483",
|
||||
"sourceIdentifier": "ykramarz@cisco.com",
|
||||
"published": "2024-09-11T17:15:13.213",
|
||||
"lastModified": "2024-09-11T17:15:13.213",
|
||||
"vulnStatus": "Received",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Multiple vulnerabilities in Cisco Routed PON Controller Software, which runs as a docker container on hardware that is supported by Cisco IOS XR Software, could allow an authenticated, remote attacker with Administrator-level privileges on the PON Manager or direct access to the PON Manager MongoDB instance to perform command injection attacks on the PON Controller container and execute arbitrary commands as root.\r\n\r\nThese vulnerabilities are due to insufficient validation of arguments that are passed to specific configuration commands. An attacker could exploit these vulnerabilities by including crafted input as the argument of an affected configuration command. A successful exploit could allow the attacker to execute arbitrary commands as root on the PON controller."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.2,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 1.2,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-78"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ponctlr-ci-OHcHmsFL",
|
||||
"source": "ykramarz@cisco.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
56
CVE-2024/CVE-2024-204xx/CVE-2024-20489.json
Normal file
56
CVE-2024/CVE-2024-204xx/CVE-2024-20489.json
Normal file
@ -0,0 +1,56 @@
|
||||
{
|
||||
"id": "CVE-2024-20489",
|
||||
"sourceIdentifier": "ykramarz@cisco.com",
|
||||
"published": "2024-09-11T17:15:13.393",
|
||||
"lastModified": "2024-09-11T17:15:13.393",
|
||||
"vulnStatus": "Received",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "A vulnerability in the storage method of the PON Controller configuration file could allow an authenticated, local attacker with low privileges to obtain the MongoDB credentials.\r\n\r\nThis vulnerability is due to improper storage of the unencrypted database credentials on the device that is running Cisco IOS XR Software. An attacker could exploit this vulnerability by accessing the configuration files on an affected system. A successful exploit could allow the attacker to view MongoDB credentials."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "NONE",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 8.4,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 2.0,
|
||||
"impactScore": 5.8
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "ykramarz@cisco.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-256"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-ponctlr-ci-OHcHmsFL",
|
||||
"source": "ykramarz@cisco.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,13 +2,17 @@
|
||||
"id": "CVE-2024-21529",
|
||||
"sourceIdentifier": "report@snyk.io",
|
||||
"published": "2024-09-11T05:15:02.547",
|
||||
"lastModified": "2024-09-11T05:15:02.547",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2024-09-11T16:26:11.920",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property __proto__, which is recursively assigned to all the objects in the program."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Las versiones del paquete dset anteriores a la 3.1.4 son vulnerables a la contaminaci\u00f3n de prototipos a trav\u00e9s de la funci\u00f3n dset debido a una desinfecci\u00f3n incorrecta de la entrada del usuario. Esta vulnerabilidad permite al atacante inyectar una propiedad de objeto maliciosa mediante la propiedad de objeto incorporada __proto__, que se asigna de forma recursiva a todos los objetos del programa."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -2,13 +2,17 @@
|
||||
"id": "CVE-2024-23716",
|
||||
"sourceIdentifier": "security@android.com",
|
||||
"published": "2024-09-11T00:15:10.957",
|
||||
"lastModified": "2024-09-11T00:15:10.957",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2024-09-11T16:26:11.920",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "In DevmemIntPFNotify of devicemem_server.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "En DevmemIntPFNotify de devicemem_server.c, existe un posible use after free debido a una condici\u00f3n de ejecuci\u00f3n. Esto podr\u00eda provocar una escalada local de privilegios en el n\u00facleo sin necesidad de permisos de ejecuci\u00f3n adicionales. No se necesita interacci\u00f3n del usuario para la explotaci\u00f3n."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
|
||||
@ -2,13 +2,17 @@
|
||||
"id": "CVE-2024-23906",
|
||||
"sourceIdentifier": "disclosures@gallagher.com",
|
||||
"published": "2024-09-11T04:15:03.530",
|
||||
"lastModified": "2024-09-11T04:15:03.530",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2024-09-11T16:26:11.920",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Improper Neutralization of Input During Web Page Generation (CWE-79) in the Controller 6000 and Controller 7000 diagnostic webpage allows an attacker to modify Controller configuration during an authenticated Operator's session.\n\n \n\n\n\nThis issue affects: Controller 6000 and Controller 7000 9.10 prior to vCR9.10.240816a (distributed in 9.10.1530 (MR2)), 9.00 prior to vCR9.00.240816a (distributed in 9.00.2168 (MR4)), 8.90 prior to vCR8.90.240816a (distributed in 8.90.2155 (MR5)), 8.80 prior to vCR8.80.240816b (distributed in 8.80.1938 (MR6)), all versions of 8.70 and prior."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Neutralizaci\u00f3n incorrecta de la entrada durante la generaci\u00f3n de la p\u00e1gina web (CWE-79) en la p\u00e1gina web de diagn\u00f3stico del Controller 6000 y el Controller 7000 permite que un atacante modifique la configuraci\u00f3n del Controller durante la sesi\u00f3n de un operador autenticado. Este problema afecta a: Controller 6000 y Controller 7000 9.10 anterior a vCR9.10.240816a (distribuido en 9.10.1530 (MR2)), 9.00 anterior a vCR9.00.240816a (distribuido en 9.00.2168 (MR4)), 8.90 anterior a vCR8.90.240816a (distribuido en 8.90.2155 (MR5)), 8.80 anterior a vCR8.80.240816b (distribuido en 8.80.1938 (MR6)), todas las versiones de 8.70 y anteriores."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -2,13 +2,17 @@
|
||||
"id": "CVE-2024-24972",
|
||||
"sourceIdentifier": "disclosures@gallagher.com",
|
||||
"published": "2024-09-11T04:15:05.250",
|
||||
"lastModified": "2024-09-11T04:15:05.250",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2024-09-11T16:26:11.920",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Buffer Copy without Checking Size of Input (CWE-120) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authorised and authenticated operator to reboot the Controller, causing a Denial of Service. Gallagher recommend the diagnostic web page is not enabled (default is off) unless advised by Gallagher Technical support. This interface is intended only for diagnostic purposes.\n\nThis issue affects:\u00a0Controller 6000 and Controller 7000 9.10 prior to vCR9.10.240816a (distributed in 9.10.1530 (MR2)), 9.00 prior to vCR9.00.240816a (distributed in 9.00.2168 (MR4)), 8.90 prior to vCR8.90.240816a (distributed in 8.90.2155 (MR5)),\u00a08.80 prior to vCR8.80.240816b (distributed in 8.80.1938 (MR6)), all versions of 8.70 and prior."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "La copia de b\u00fafer sin comprobar el tama\u00f1o de la entrada (CWE-120) en la interfaz web de diagn\u00f3stico del Controller 6000 y el Controller 7000 permite que un operador autorizado y autenticado reinicie el Controller, lo que provoca una denegaci\u00f3n de servicio. Gallagher recomienda que la p\u00e1gina web de diagn\u00f3stico no est\u00e9 habilitada (la opci\u00f3n predeterminada est\u00e1 desactivada) a menos que lo indique el soporte t\u00e9cnico de Gallagher. Esta interfaz est\u00e1 destinada \u00fanicamente a fines de diagn\u00f3stico. Este problema afecta a: Controller 6000 y Controller 7000 9.10 anterior a vCR9.10.240816a (distribuido en 9.10.1530 (MR2)), 9.00 anterior a vCR9.00.240816a (distribuido en 9.00.2168 (MR4)), 8.90 anterior a vCR8.90.240816a (distribuido en 8.90.2155 (MR5)), 8.80 anterior a vCR8.80.240816b (distribuido en 8.80.1938 (MR6)), todas las versiones de 8.70 y anteriores."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2024-27112",
|
||||
"sourceIdentifier": "csirt@divd.nl",
|
||||
"published": "2024-09-11T14:15:12.810",
|
||||
"lastModified": "2024-09-11T14:15:12.810",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2024-09-11T16:26:11.920",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2024-27113",
|
||||
"sourceIdentifier": "csirt@divd.nl",
|
||||
"published": "2024-09-11T14:15:12.947",
|
||||
"lastModified": "2024-09-11T14:15:12.947",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2024-09-11T16:26:11.920",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2024-27114",
|
||||
"sourceIdentifier": "csirt@divd.nl",
|
||||
"published": "2024-09-11T14:15:13.040",
|
||||
"lastModified": "2024-09-11T14:15:13.040",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2024-09-11T16:26:11.920",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2024-27115",
|
||||
"sourceIdentifier": "csirt@divd.nl",
|
||||
"published": "2024-09-11T14:15:13.147",
|
||||
"lastModified": "2024-09-11T14:15:13.147",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2024-09-11T16:26:11.920",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
|
||||
@ -2,13 +2,17 @@
|
||||
"id": "CVE-2024-31336",
|
||||
"sourceIdentifier": "security@android.com",
|
||||
"published": "2024-09-11T00:15:11.023",
|
||||
"lastModified": "2024-09-11T05:15:02.783",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2024-09-11T16:26:11.920",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Imagination PowerVR-GPU in Android before 2024-09-05 has a High Severity Vulnerability, aka A-337949672."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "Imagination PowerVR-GPU en Android antes del 5 de septiembre de 2024 tiene una vulnerabilidad de alta gravedad, tambi\u00e9n conocida como A-337949672."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
|
||||
@ -2,13 +2,17 @@
|
||||
"id": "CVE-2024-34831",
|
||||
"sourceIdentifier": "cve@mitre.org",
|
||||
"published": "2024-09-10T18:15:03.990",
|
||||
"lastModified": "2024-09-10T20:35:07.857",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2024-09-11T16:26:11.920",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in the library_manage_catalog_editProcess.php component."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "La vulnerabilidad de cross-site scripting (XSS) en Gibbon Core v26.0.00 permite a un atacante ejecutar c\u00f3digo arbitrario a trav\u00e9s del par\u00e1metro imageLink en el componente library_manage_catalog_editProcess.php."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
|
||||
@ -2,16 +2,43 @@
|
||||
"id": "CVE-2024-3899",
|
||||
"sourceIdentifier": "contact@wpscan.com",
|
||||
"published": "2024-09-11T06:15:01.870",
|
||||
"lastModified": "2024-09-11T06:15:01.870",
|
||||
"vulnStatus": "Received",
|
||||
"lastModified": "2024-09-11T16:35:39.437",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "The Gallery Plugin for WordPress WordPress plugin before 1.8.15 does not sanitise and escape some of its image settings, which could allow users with post-writing privilege such as Author to perform Cross-Site Scripting attacks."
|
||||
},
|
||||
{
|
||||
"lang": "es",
|
||||
"value": "El complemento Gallery Plugin for WordPress de WordPress anterior a la versi\u00f3n 1.8.15 no desinfecta ni escapa de algunas de sus configuraciones de imagen, lo que podr\u00eda permitir a los usuarios con privilegios de escritura posterior, como el Autor, realizar ataques de cross-site scripting."
|
||||
}
|
||||
],
|
||||
"metrics": {},
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||||
"type": "Secondary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.8,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.7,
|
||||
"impactScore": 2.7
|
||||
}
|
||||
]
|
||||
},
|
||||
"references": [
|
||||
{
|
||||
"url": "https://wpscan.com/vulnerability/e3afadda-4d9a-4a51-b744-10de7d8d8578/",
|
||||
|
||||
56
CVE-2024/CVE-2024-393xx/CVE-2024-39378.json
Normal file
56
CVE-2024/CVE-2024-393xx/CVE-2024-39378.json
Normal file
@ -0,0 +1,56 @@
|
||||
{
|
||||
"id": "CVE-2024-39378",
|
||||
"sourceIdentifier": "psirt@adobe.com",
|
||||
"published": "2024-09-11T16:15:05.797",
|
||||
"lastModified": "2024-09-11T16:26:11.920",
|
||||
"vulnStatus": "Awaiting Analysis",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "Audition versions 24.4.1, 23.6.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."
|
||||
}
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "psirt@adobe.com",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||||
"attackVector": "LOCAL",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "UNCHANGED",
|
||||
"confidentialityImpact": "HIGH",
|
||||
"integrityImpact": "HIGH",
|
||||
"availabilityImpact": "HIGH",
|
||||
"baseScore": 7.8,
|
||||
"baseSeverity": "HIGH"
|
||||
},
|
||||
"exploitabilityScore": 1.8,
|
||||
"impactScore": 5.9
|
||||
}
|
||||
]
|
||||
},
|
||||
"weaknesses": [
|
||||
{
|
||||
"source": "psirt@adobe.com",
|
||||
"type": "Secondary",
|
||||
"description": [
|
||||
{
|
||||
"lang": "en",
|
||||
"value": "CWE-787"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://helpx.adobe.com/security/products/audition/apsb24-54.html",
|
||||
"source": "psirt@adobe.com"
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2024-39627",
|
||||
"sourceIdentifier": "audit@patchstack.com",
|
||||
"published": "2024-08-01T23:15:51.123",
|
||||
"lastModified": "2024-08-02T12:59:43.990",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T17:35:37.523",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -17,6 +17,26 @@
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.8,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.7,
|
||||
"impactScore": 2.7
|
||||
},
|
||||
{
|
||||
"source": "audit@patchstack.com",
|
||||
"type": "Secondary",
|
||||
@ -51,10 +71,31 @@
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:imagely:nextgen_gallery:*:*:*:*:*:wordpress:*:*",
|
||||
"versionEndExcluding": "3.59.4",
|
||||
"matchCriteriaId": "01996367-237D-45FB-8142-C98706FD3BB2"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://patchstack.com/database/vulnerability/nextgen-gallery/wordpress-photo-gallery-sliders-proofing-and-themes-nextgen-gallery-plugin-3-59-3-cross-site-scripting-xss-vulnerability?_s_id=cve",
|
||||
"source": "audit@patchstack.com"
|
||||
"source": "audit@patchstack.com",
|
||||
"tags": [
|
||||
"Third Party Advisory"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2024-39629",
|
||||
"sourceIdentifier": "audit@patchstack.com",
|
||||
"published": "2024-08-01T23:15:51.320",
|
||||
"lastModified": "2024-08-02T12:59:43.990",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T17:35:06.743",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -17,6 +17,26 @@
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "HIGH",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 4.8,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 1.7,
|
||||
"impactScore": 2.7
|
||||
},
|
||||
{
|
||||
"source": "audit@patchstack.com",
|
||||
"type": "Secondary",
|
||||
@ -51,10 +71,31 @@
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:themegrill:himalayas:*:*:*:*:*:wordpress:*:*",
|
||||
"versionEndIncluding": "1.3.2",
|
||||
"matchCriteriaId": "A6ECD51D-ACCE-4CE3-89C9-1DAB81FBB5CE"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://patchstack.com/database/vulnerability/himalayas/wordpress-himalayas-theme-1-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve",
|
||||
"source": "audit@patchstack.com"
|
||||
"source": "audit@patchstack.com",
|
||||
"tags": [
|
||||
"Third Party Advisory"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2024-39631",
|
||||
"sourceIdentifier": "audit@patchstack.com",
|
||||
"published": "2024-08-01T23:15:51.520",
|
||||
"lastModified": "2024-08-02T12:59:43.990",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T17:34:08.967",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -17,6 +17,26 @@
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 6.1,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 2.7
|
||||
},
|
||||
{
|
||||
"source": "audit@patchstack.com",
|
||||
"type": "Secondary",
|
||||
@ -51,10 +71,31 @@
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:contest-gallery:contest_gallery:*:*:*:*:*:wordpress:*:*",
|
||||
"versionEndExcluding": "23.1.3",
|
||||
"matchCriteriaId": "0A248796-7D89-49A2-B269-A14CBED929FA"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://patchstack.com/database/vulnerability/contest-gallery/wordpress-contest-gallery-plugin-23-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve",
|
||||
"source": "audit@patchstack.com"
|
||||
"source": "audit@patchstack.com",
|
||||
"tags": [
|
||||
"Third Party Advisory"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2024-39643",
|
||||
"sourceIdentifier": "audit@patchstack.com",
|
||||
"published": "2024-08-01T23:15:51.730",
|
||||
"lastModified": "2024-08-02T12:59:43.990",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T17:33:14.787",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -17,6 +17,26 @@
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "NONE",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 6.1,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 2.8,
|
||||
"impactScore": 2.7
|
||||
},
|
||||
{
|
||||
"source": "audit@patchstack.com",
|
||||
"type": "Secondary",
|
||||
@ -51,10 +71,31 @@
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:metagauss:registrationmagic:*:*:*:*:*:wordpress:*:*",
|
||||
"versionEndExcluding": "6.0.0.2",
|
||||
"matchCriteriaId": "773287C1-08C4-4402-9670-1FA164CF0B29"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://patchstack.com/database/vulnerability/custom-registration-form-builder-with-submission-manager/wordpress-registrationmagic-custom-registration-forms-user-registration-payment-and-user-login-plugin-6-0-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve",
|
||||
"source": "audit@patchstack.com"
|
||||
"source": "audit@patchstack.com",
|
||||
"tags": [
|
||||
"Third Party Advisory"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
@ -2,8 +2,8 @@
|
||||
"id": "CVE-2024-39644",
|
||||
"sourceIdentifier": "audit@patchstack.com",
|
||||
"published": "2024-08-01T23:15:51.927",
|
||||
"lastModified": "2024-08-02T12:59:43.990",
|
||||
"vulnStatus": "Undergoing Analysis",
|
||||
"lastModified": "2024-09-11T17:31:27.760",
|
||||
"vulnStatus": "Analyzed",
|
||||
"cveTags": [],
|
||||
"descriptions": [
|
||||
{
|
||||
@ -17,6 +17,26 @@
|
||||
],
|
||||
"metrics": {
|
||||
"cvssMetricV31": [
|
||||
{
|
||||
"source": "nvd@nist.gov",
|
||||
"type": "Primary",
|
||||
"cvssData": {
|
||||
"version": "3.1",
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
||||
"attackVector": "NETWORK",
|
||||
"attackComplexity": "LOW",
|
||||
"privilegesRequired": "LOW",
|
||||
"userInteraction": "REQUIRED",
|
||||
"scope": "CHANGED",
|
||||
"confidentialityImpact": "LOW",
|
||||
"integrityImpact": "LOW",
|
||||
"availabilityImpact": "NONE",
|
||||
"baseScore": 5.4,
|
||||
"baseSeverity": "MEDIUM"
|
||||
},
|
||||
"exploitabilityScore": 2.3,
|
||||
"impactScore": 2.7
|
||||
},
|
||||
{
|
||||
"source": "audit@patchstack.com",
|
||||
"type": "Secondary",
|
||||
@ -51,10 +71,31 @@
|
||||
]
|
||||
}
|
||||
],
|
||||
"configurations": [
|
||||
{
|
||||
"nodes": [
|
||||
{
|
||||
"operator": "OR",
|
||||
"negate": false,
|
||||
"cpeMatch": [
|
||||
{
|
||||
"vulnerable": true,
|
||||
"criteria": "cpe:2.3:a:modernaweb:black_widgets_for_elementor:*:*:*:*:*:wordpress:*:*",
|
||||
"versionEndExcluding": "1.3.6",
|
||||
"matchCriteriaId": "D879A1DE-C865-457D-93D7-242C3BEC6B0E"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"references": [
|
||||
{
|
||||
"url": "https://patchstack.com/database/vulnerability/black-widgets/wordpress-black-widgets-for-elementor-plugin-1-3-5-cross-site-scripting-xss-vulnerability?_s_id=cve",
|
||||
"source": "audit@patchstack.com"
|
||||
"source": "audit@patchstack.com",
|
||||
"tags": [
|
||||
"Third Party Advisory"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user