"
+ }
+ ]
}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36568.json b/2020/36xxx/CVE-2020-36568.json
index 85bddec243ab..e8738c6c97d3 100644
--- a/2020/36xxx/CVE-2020-36568.json
+++ b/2020/36xxx/CVE-2020-36568.json
@@ -1,18 +1,84 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2020-36568",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@golang.org",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-400: Uncontrolled Resource Consumption"
+ }
+ ]
}
]
- }
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "github.com/revel/revel",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "github.com/revel/revel",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/revel/revel/pull/1427",
+ "refsource": "MISC",
+ "name": "https://github.com/revel/revel/pull/1427"
+ },
+ {
+ "url": "https://github.com/revel/revel/commit/d160ecb72207824005b19778594cbdc272e8a605",
+ "refsource": "MISC",
+ "name": "https://github.com/revel/revel/commit/d160ecb72207824005b19778594cbdc272e8a605"
+ },
+ {
+ "url": "https://github.com/revel/revel/issues/1424",
+ "refsource": "MISC",
+ "name": "https://github.com/revel/revel/issues/1424"
+ },
+ {
+ "url": "https://pkg.go.dev/vuln/GO-2020-0003",
+ "refsource": "MISC",
+ "name": "https://pkg.go.dev/vuln/GO-2020-0003"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "@SYM01"
+ }
+ ]
}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36569.json b/2020/36xxx/CVE-2020-36569.json
index 814cebb0fbe7..02fbb3be08df 100644
--- a/2020/36xxx/CVE-2020-36569.json
+++ b/2020/36xxx/CVE-2020-36569.json
@@ -1,18 +1,79 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2020-36569",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@golang.org",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-305: Authentication Bypass by Primary Weakness"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "github.com/nanobox-io/golang-nanoauth",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "github.com/nanobox-io/golang-nanoauth",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "0.0.0-20160722212129-ac0cc4484ad4",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/nanobox-io/golang-nanoauth/pull/5",
+ "refsource": "MISC",
+ "name": "https://github.com/nanobox-io/golang-nanoauth/pull/5"
+ },
+ {
+ "url": "https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3",
+ "refsource": "MISC",
+ "name": "https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3"
+ },
+ {
+ "url": "https://pkg.go.dev/vuln/GO-2020-0004",
+ "refsource": "MISC",
+ "name": "https://pkg.go.dev/vuln/GO-2020-0004"
}
]
- }
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "@bouk"
+ }
+ ]
}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36607.json b/2020/36xxx/CVE-2020-36607.json
index fbbae6591890..b914c492e939 100644
--- a/2020/36xxx/CVE-2020-36607.json
+++ b/2020/36xxx/CVE-2020-36607.json
@@ -5,13 +5,57 @@
"CVE_data_meta": {
"ID": "CVE-2020-36607",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "n/a"
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "CONFIRM",
+ "name": "https://github.com/liufee/cms/issues/45",
+ "url": "https://github.com/liufee/cms/issues/45"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag."
}
]
}
diff --git a/2020/36xxx/CVE-2020-36612.json b/2020/36xxx/CVE-2020-36612.json
new file mode 100644
index 000000000000..ee0d697b50f4
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36612.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36612",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36613.json b/2020/36xxx/CVE-2020-36613.json
new file mode 100644
index 000000000000..ff7fe727b2d8
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36613.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36613",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36614.json b/2020/36xxx/CVE-2020-36614.json
new file mode 100644
index 000000000000..a97987aab2b6
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36614.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36614",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36615.json b/2020/36xxx/CVE-2020-36615.json
new file mode 100644
index 000000000000..825fb3f333d1
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36615.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36615",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36616.json b/2020/36xxx/CVE-2020-36616.json
new file mode 100644
index 000000000000..1fb1fe4275ae
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36616.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36616",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36617.json b/2020/36xxx/CVE-2020-36617.json
new file mode 100644
index 000000000000..86dff81126c7
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36617.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36617",
+ "TITLE": "ewxrjk sftpserver parse.c sftp_parse_path uninitialized pointer",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "ewxrjk",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "sftpserver",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-908 Uninitialized Resource -> CWE-824 Uninitialized Pointer"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** DISPUTED ** A vulnerability was found in ewxrjk sftpserver. It has been declared as problematic. Affected by this vulnerability is the function sftp_parse_path of the file parse.c. The manipulation leads to uninitialized pointer. The real existence of this vulnerability is still doubted at the moment. The name of the patch is bf4032f34832ee11d79aa60a226cc018e7ec5eed. It is recommended to apply a patch to fix this issue. The identifier VDB-216205 was assigned to this vulnerability. NOTE: In some deployment models this would be a vulnerability. README specifically warns about avoiding such deployment models."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "4.6",
+ "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/ewxrjk/sftpserver/commit/bf4032f34832ee11d79aa60a226cc018e7ec5eed",
+ "refsource": "MISC",
+ "name": "https://github.com/ewxrjk/sftpserver/commit/bf4032f34832ee11d79aa60a226cc018e7ec5eed"
+ },
+ {
+ "url": "https://vuldb.com/?id.216205",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216205"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36618.json b/2020/36xxx/CVE-2020-36618.json
new file mode 100644
index 000000000000..eba94790e053
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36618.json
@@ -0,0 +1,82 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36618",
+ "TITLE": "Furqan node-whois index.coffee prototype pollution",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Furqan",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "node-whois",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-74 Injection -> CWE-94 Code Injection -> CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as critical has been found in Furqan node-whois. Affected is an unknown function of the file index.coffee. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to launch the attack remotely. The name of the patch is 46ccc2aee8d063c7b6b4dee2c2834113b7286076. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216252."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "6.3",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/FurqanSoftware/node-whois/pull/105",
+ "refsource": "MISC",
+ "name": "https://github.com/FurqanSoftware/node-whois/pull/105"
+ },
+ {
+ "url": "https://github.com/FurqanSoftware/node-whois/commit/46ccc2aee8d063c7b6b4dee2c2834113b7286076",
+ "refsource": "MISC",
+ "name": "https://github.com/FurqanSoftware/node-whois/commit/46ccc2aee8d063c7b6b4dee2c2834113b7286076"
+ },
+ {
+ "url": "https://vuldb.com/?id.216252",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216252"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36619.json b/2020/36xxx/CVE-2020-36619.json
new file mode 100644
index 000000000000..fa1b98e2cfe6
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36619.json
@@ -0,0 +1,87 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36619",
+ "TITLE": "multimon-ng demod_flex.c add_ch format string",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "multimon-ng",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-119 Memory Corruption -> CWE-134 Format String"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in multimon-ng. It has been rated as critical. This issue affects the function add_ch of the file demod_flex.c. The manipulation of the argument ch leads to format string. Upgrading to version 1.2.0 is able to address this issue. The name of the patch is e5a51c508ef952e81a6da25b43034dd1ed023c07. It is recommended to upgrade the affected component. The identifier VDB-216269 was assigned to this vulnerability."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "5.5",
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/EliasOenal/multimon-ng/pull/160",
+ "refsource": "MISC",
+ "name": "https://github.com/EliasOenal/multimon-ng/pull/160"
+ },
+ {
+ "url": "https://github.com/EliasOenal/multimon-ng/releases/tag/1.2.0",
+ "refsource": "MISC",
+ "name": "https://github.com/EliasOenal/multimon-ng/releases/tag/1.2.0"
+ },
+ {
+ "url": "https://github.com/EliasOenal/multimon-ng/commit/e5a51c508ef952e81a6da25b43034dd1ed023c07",
+ "refsource": "MISC",
+ "name": "https://github.com/EliasOenal/multimon-ng/commit/e5a51c508ef952e81a6da25b43034dd1ed023c07"
+ },
+ {
+ "url": "https://vuldb.com/?id.216269",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216269"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36620.json b/2020/36xxx/CVE-2020-36620.json
new file mode 100644
index 000000000000..46a1e3b36e94
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36620.json
@@ -0,0 +1,94 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36620",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in Brondahl EnumStringValues up to 4.0.0. It has been declared as problematic. This vulnerability affects the function GetStringValuesWithPreferences_Uncache of the file EnumStringValues/EnumExtensions.cs. The manipulation leads to resource consumption. Upgrading to version 4.0.1 is able to address this issue. The name of the patch is c0fc7806beb24883cc2f9543ebc50c0820297307. It is recommended to upgrade the affected component. VDB-216466 is the identifier assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "In Brondahl EnumStringValues bis 4.0.0 wurde eine Schwachstelle ausgemacht. Sie wurde als problematisch eingestuft. Das betrifft die Funktion GetStringValuesWithPreferences_Uncache der Datei EnumStringValues/EnumExtensions.cs. Durch Manipulieren mit unbekannten Daten kann eine resource consumption-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 4.0.1 vermag dieses Problem zu l\u00f6sen. Der Patch wird als c0fc7806beb24883cc2f9543ebc50c0820297307 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-400 Resource Consumption",
+ "cweId": "CWE-400"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Brondahl",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "EnumStringValues",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "4.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/Brondahl/EnumStringValues/commit/c0fc7806beb24883cc2f9543ebc50c0820297307",
+ "refsource": "MISC",
+ "name": "https://github.com/Brondahl/EnumStringValues/commit/c0fc7806beb24883cc2f9543ebc50c0820297307"
+ },
+ {
+ "url": "https://vuldb.com/?id.216466",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216466"
+ },
+ {
+ "url": "https://github.com/Brondahl/EnumStringValues/releases/tag/4.0.1",
+ "refsource": "MISC",
+ "name": "https://github.com/Brondahl/EnumStringValues/releases/tag/4.0.1"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36621.json b/2020/36xxx/CVE-2020-36621.json
new file mode 100644
index 000000000000..cbb5913df61c
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36621.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36621",
+ "TITLE": "chedabob whatismyudid mobileconfig.js exports.enrollment cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "chedabob",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "whatismyudid",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as problematic, has been found in chedabob whatismyudid. Affected by this issue is the function exports.enrollment of the file routes/mobileconfig.js. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is bb33d4325fba80e7ea68b79121dba025caf6f45f. It is recommended to apply a patch to fix this issue. VDB-216470 is the identifier assigned to this vulnerability."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/chedabob/whatismyudid/commit/bb33d4325fba80e7ea68b79121dba025caf6f45f",
+ "refsource": "MISC",
+ "name": "https://github.com/chedabob/whatismyudid/commit/bb33d4325fba80e7ea68b79121dba025caf6f45f"
+ },
+ {
+ "url": "https://vuldb.com/?id.216470",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216470"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36622.json b/2020/36xxx/CVE-2020-36622.json
new file mode 100644
index 000000000000..61b9ba02818b
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36622.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36622",
+ "TITLE": "sah-comp bienlein cross-site request forgery",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "sah-comp",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "bienlein",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-863 Incorrect Authorization -> CWE-862 Missing Authorization -> CWE-352 Cross-Site Request Forgery"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in sah-comp bienlein and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is d7836a4f2b241e4745ede194f0f6fb47199cab6b. It is recommended to apply a patch to fix this issue. The identifier VDB-216473 was assigned to this vulnerability."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "4.3",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/sah-comp/bienlein/commit/d7836a4f2b241e4745ede194f0f6fb47199cab6b",
+ "refsource": "MISC",
+ "name": "https://github.com/sah-comp/bienlein/commit/d7836a4f2b241e4745ede194f0f6fb47199cab6b"
+ },
+ {
+ "url": "https://vuldb.com/?id.216473",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216473"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36623.json b/2020/36xxx/CVE-2020-36623.json
new file mode 100644
index 000000000000..603148dd13fa
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36623.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36623",
+ "TITLE": "Pengu index.js runApp cross-site request forgery",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Pengu",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-863 Incorrect Authorization -> CWE-862 Missing Authorization -> CWE-352 Cross-Site Request Forgery"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in Pengu. It has been declared as problematic. Affected by this vulnerability is the function runApp of the file src/index.js. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The name of the patch is aea66f12b8cdfc3c8c50ad6a9c89d8307e9d0a91. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216475."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "4.3",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/jtojnar/pengu/commit/aea66f12b8cdfc3c8c50ad6a9c89d8307e9d0a91",
+ "refsource": "MISC",
+ "name": "https://github.com/jtojnar/pengu/commit/aea66f12b8cdfc3c8c50ad6a9c89d8307e9d0a91"
+ },
+ {
+ "url": "https://vuldb.com/?id.216475",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216475"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36624.json b/2020/36xxx/CVE-2020-36624.json
new file mode 100644
index 000000000000..b506dac7d5c8
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36624.json
@@ -0,0 +1,99 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36624",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability affects unknown code of the file lib/text_helpers/translation.rb. The manipulation of the argument link leads to use of web link to untrusted target with window.opener access. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to address this issue. The name of the patch is 184b60ded0e43c985788582aca2d1e746f9405a3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216520."
+ },
+ {
+ "lang": "deu",
+ "value": "In ahorner text-helpers bis 1.0.x wurde eine Schwachstelle ausgemacht. Sie wurde als kritisch eingestuft. Es geht um eine nicht n\u00e4her bekannte Funktion der Datei lib/text_helpers/translation.rb. Durch das Manipulieren des Arguments link mit unbekannten Daten kann eine use of web link to untrusted target with window.opener access-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Ein Aktualisieren auf die Version 1.1.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 184b60ded0e43c985788582aca2d1e746f9405a3 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-1022 Use of Web Link to Untrusted Target with window.opener Access",
+ "cweId": "CWE-1022"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "ahorner",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "text-helpers",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/ahorner/text-helpers/pull/19",
+ "refsource": "MISC",
+ "name": "https://github.com/ahorner/text-helpers/pull/19"
+ },
+ {
+ "url": "https://github.com/ahorner/text-helpers/commit/184b60ded0e43c985788582aca2d1e746f9405a3",
+ "refsource": "MISC",
+ "name": "https://github.com/ahorner/text-helpers/commit/184b60ded0e43c985788582aca2d1e746f9405a3"
+ },
+ {
+ "url": "https://vuldb.com/?id.216520",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216520"
+ },
+ {
+ "url": "https://github.com/ahorner/text-helpers/releases/tag/v1.1.0",
+ "refsource": "MISC",
+ "name": "https://github.com/ahorner/text-helpers/releases/tag/v1.1.0"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36625.json b/2020/36xxx/CVE-2020-36625.json
new file mode 100644
index 000000000000..d4e7a09bd317
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36625.json
@@ -0,0 +1,82 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36625",
+ "TITLE": "destiny.gg chat main.go websocket.Upgrader cross-site request forgery",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "destiny.gg",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "chat",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-863 Incorrect Authorization -> CWE-862 Missing Authorization -> CWE-352 Cross-Site Request Forgery"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is bebd256fc3063111fb4503ca25e005ebf6e73780. It is recommended to apply a patch to fix this issue. The identifier VDB-216521 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "4.3",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/destinygg/chat/pull/35",
+ "refsource": "MISC",
+ "name": "https://github.com/destinygg/chat/pull/35"
+ },
+ {
+ "url": "https://github.com/destinygg/chat/commit/bebd256fc3063111fb4503ca25e005ebf6e73780",
+ "refsource": "MISC",
+ "name": "https://github.com/destinygg/chat/commit/bebd256fc3063111fb4503ca25e005ebf6e73780"
+ },
+ {
+ "url": "https://vuldb.com/?id.216521",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216521"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36626.json b/2020/36xxx/CVE-2020-36626.json
new file mode 100644
index 000000000000..86fdc42b326e
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36626.json
@@ -0,0 +1,82 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36626",
+ "TITLE": "Modern Tribe Panel Builder Plugin SearchFilter.php add_post_content_filtered_to_search_sql sql injection",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Modern Tribe",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Panel Builder Plugin",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-89 SQL Injection"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as critical has been found in Modern Tribe Panel Builder Plugin. Affected is the function add_post_content_filtered_to_search_sql of the file ModularContent/SearchFilter.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 4528d4f855dbbf24e9fc12a162fda84ce3bedc2f. It is recommended to apply a patch to fix this issue. VDB-216738 is the identifier assigned to this vulnerability."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "5.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/moderntribe/panel-builder/pull/173",
+ "refsource": "MISC",
+ "name": "https://github.com/moderntribe/panel-builder/pull/173"
+ },
+ {
+ "url": "https://github.com/moderntribe/panel-builder/commit/4528d4f855dbbf24e9fc12a162fda84ce3bedc2f",
+ "refsource": "MISC",
+ "name": "https://github.com/moderntribe/panel-builder/commit/4528d4f855dbbf24e9fc12a162fda84ce3bedc2f"
+ },
+ {
+ "url": "https://vuldb.com/?id.216738",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216738"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36627.json b/2020/36xxx/CVE-2020-36627.json
new file mode 100644
index 000000000000..fc3c637f5972
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36627.json
@@ -0,0 +1,94 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36627",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in Macaron i18n. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file i18n.go. The manipulation leads to open redirect. The attack can be launched remotely. Upgrading to version 0.5.0 is able to address this issue. The name of the patch is 329b0c4844cc16a5a253c011b55180598e707735. It is recommended to upgrade the affected component. The identifier VDB-216745 was assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "In Macaron i18n wurde eine problematische Schwachstelle ausgemacht. Es geht um eine nicht n\u00e4her bekannte Funktion der Datei i18n.go. Dank Manipulation mit unbekannten Daten kann eine open redirect-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Ein Aktualisieren auf die Version 0.5.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 329b0c4844cc16a5a253c011b55180598e707735 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-601 Open Redirect",
+ "cweId": "CWE-601"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Macaron",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "i18n",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216745",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216745"
+ },
+ {
+ "url": "https://github.com/go-macaron/i18n/commit/329b0c4844cc16a5a253c011b55180598e707735",
+ "refsource": "MISC",
+ "name": "https://github.com/go-macaron/i18n/commit/329b0c4844cc16a5a253c011b55180598e707735"
+ },
+ {
+ "url": "https://github.com/go-macaron/i18n/releases/tag/v0.5.0",
+ "refsource": "MISC",
+ "name": "https://github.com/go-macaron/i18n/releases/tag/v0.5.0"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36628.json b/2020/36xxx/CVE-2020-36628.json
new file mode 100644
index 000000000000..49104fac30c5
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36628.json
@@ -0,0 +1,94 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36628",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as critical has been found in Calsign APDE. This affects the function handleExtract of the file APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java of the component ZIP File Handler. The manipulation leads to path traversal. Upgrading to version 0.5.2-pre2-alpha is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216747."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine Schwachstelle in Calsign APDE entdeckt. Sie wurde als kritisch eingestuft. Es geht dabei um die Funktion handleExtract der Datei APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java der Komponente ZIP File Handler. Durch die Manipulation mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 0.5.2-pre2-alpha vermag dieses Problem zu l\u00f6sen. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-22 Path Traversal",
+ "cweId": "CWE-22"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Calsign",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "APDE",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216747",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216747"
+ },
+ {
+ "url": "https://github.com/Calsign/APDE/commit/c6d64cbe465348c1bfd211122d89e3117afadecf",
+ "refsource": "MISC",
+ "name": "https://github.com/Calsign/APDE/commit/c6d64cbe465348c1bfd211122d89e3117afadecf"
+ },
+ {
+ "url": "https://github.com/Calsign/APDE/releases/tag/v0.5.2-pre2-alpha",
+ "refsource": "MISC",
+ "name": "https://github.com/Calsign/APDE/releases/tag/v0.5.2-pre2-alpha"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36629.json b/2020/36xxx/CVE-2020-36629.json
new file mode 100644
index 000000000000..4cdb6bdf29d9
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36629.json
@@ -0,0 +1,94 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36629",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as critical was found in SimbCo httpster. This vulnerability affects the function fs.realpathSync of the file src/server.coffee. The manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. The name of the patch is d3055b3e30b40b65d30c5a06d6e053dffa7f35d0. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216748."
+ },
+ {
+ "lang": "deu",
+ "value": "In SimbCo httpster wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Dabei geht es um die Funktion fs.realpathSync der Datei src/server.coffee. Durch Manipulation mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Der Patch wird als d3055b3e30b40b65d30c5a06d6e053dffa7f35d0 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-22 Path Traversal",
+ "cweId": "CWE-22"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "SimbCo",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "httpster",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216748",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216748"
+ },
+ {
+ "url": "https://github.com/SimbCo/httpster/pull/36",
+ "refsource": "MISC",
+ "name": "https://github.com/SimbCo/httpster/pull/36"
+ },
+ {
+ "url": "https://github.com/SimbCo/httpster/commit/d3055b3e30b40b65d30c5a06d6e053dffa7f35d0",
+ "refsource": "MISC",
+ "name": "https://github.com/SimbCo/httpster/commit/d3055b3e30b40b65d30c5a06d6e053dffa7f35d0"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36630.json b/2020/36xxx/CVE-2020-36630.json
new file mode 100644
index 000000000000..3153f1be42e9
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36630.json
@@ -0,0 +1,99 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36630",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in FreePBX cdr 14.0. It has been classified as critical. This affects the function ajaxHandler of the file ucp/Cdr.class.php. The manipulation of the argument limit/offset leads to sql injection. Upgrading to version 14.0.5.21 is able to address this issue. The name of the patch is f1a9eea2dfff30fb99d825bac194a676a82b9ec8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216771."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine Schwachstelle in FreePBX cdr 14.0 ausgemacht. Sie wurde als kritisch eingestuft. Hiervon betroffen ist die Funktion ajaxHandler der Datei ucp/Cdr.class.php. Mittels dem Manipulieren des Arguments limit/offset mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 14.0.5.21 vermag dieses Problem zu l\u00f6sen. Der Patch wird als f1a9eea2dfff30fb99d825bac194a676a82b9ec8 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-89 SQL Injection",
+ "cweId": "CWE-89"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "FreePBX",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "cdr",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "14.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216771",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216771"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216771",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216771"
+ },
+ {
+ "url": "https://github.com/FreePBX/cdr/commit/f1a9eea2dfff30fb99d825bac194a676a82b9ec8",
+ "refsource": "MISC",
+ "name": "https://github.com/FreePBX/cdr/commit/f1a9eea2dfff30fb99d825bac194a676a82b9ec8"
+ },
+ {
+ "url": "https://github.com/FreePBX/cdr/releases/tag/release%2F14.0.5.21",
+ "refsource": "MISC",
+ "name": "https://github.com/FreePBX/cdr/releases/tag/release%2F14.0.5.21"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36631.json b/2020/36xxx/CVE-2020-36631.json
new file mode 100644
index 000000000000..aace8ec66c5c
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36631.json
@@ -0,0 +1,99 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36631",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in barronwaffles dwc_network_server_emulator. It has been declared as critical. This vulnerability affects the function update_profile of the file gamespy/gs_database.py. The manipulation of the argument firstname/lastname leads to sql injection. The attack can be initiated remotely. The name of the patch is f70eb21394f75019886fbc2fb536de36161ba422. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216772."
+ },
+ {
+ "lang": "deu",
+ "value": "In barronwaffles dwc_network_server_emulator wurde eine Schwachstelle ausgemacht. Sie wurde als kritisch eingestuft. Betroffen ist die Funktion update_profile der Datei gamespy/gs_database.py. Mittels Manipulieren des Arguments firstname/lastname mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Patch wird als f70eb21394f75019886fbc2fb536de36161ba422 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-89 SQL Injection",
+ "cweId": "CWE-89"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "barronwaffles",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "dwc_network_server_emulator",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216772",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216772"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216772",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216772"
+ },
+ {
+ "url": "https://github.com/barronwaffles/dwc_network_server_emulator/pull/538",
+ "refsource": "MISC",
+ "name": "https://github.com/barronwaffles/dwc_network_server_emulator/pull/538"
+ },
+ {
+ "url": "https://github.com/barronwaffles/dwc_network_server_emulator/commit/f70eb21394f75019886fbc2fb536de36161ba422",
+ "refsource": "MISC",
+ "name": "https://github.com/barronwaffles/dwc_network_server_emulator/commit/f70eb21394f75019886fbc2fb536de36161ba422"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36632.json b/2020/36xxx/CVE-2020-36632.json
new file mode 100644
index 000000000000..7a6e521b4ad7
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36632.json
@@ -0,0 +1,109 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36632",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as critical, was found in hughsk flat up to 5.0.0. This affects the function unflatten of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). It is possible to initiate the attack remotely. Upgrading to version 5.0.1 is able to address this issue. The name of the patch is 20ef0ef55dfa028caddaedbcb33efbdb04d18e13. It is recommended to upgrade the affected component. The identifier VDB-216777 was assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine kritische Schwachstelle in hughsk flat bis 5.0.0 gefunden. Es geht dabei um die Funktion unflatten der Datei index.js. Dank der Manipulation mit unbekannten Daten kann eine improperly controlled modification of object prototype attributes ('prototype pollution')-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Ein Aktualisieren auf die Version 5.0.1 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 20ef0ef55dfa028caddaedbcb33efbdb04d18e13 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')",
+ "cweId": "CWE-1321"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "hughsk",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "flat",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "5.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/hughsk/flat/issues/105",
+ "refsource": "MISC",
+ "name": "https://github.com/hughsk/flat/issues/105"
+ },
+ {
+ "url": "https://github.com/hughsk/flat/pull/106",
+ "refsource": "MISC",
+ "name": "https://github.com/hughsk/flat/pull/106"
+ },
+ {
+ "url": "https://vuldb.com/?id.216777",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216777"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216777",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216777"
+ },
+ {
+ "url": "https://github.com/hughsk/flat/commit/20ef0ef55dfa028caddaedbcb33efbdb04d18e13",
+ "refsource": "MISC",
+ "name": "https://github.com/hughsk/flat/commit/20ef0ef55dfa028caddaedbcb33efbdb04d18e13"
+ },
+ {
+ "url": "https://github.com/hughsk/flat/releases/tag/5.0.1",
+ "refsource": "MISC",
+ "name": "https://github.com/hughsk/flat/releases/tag/5.0.1"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36633.json b/2020/36xxx/CVE-2020-36633.json
new file mode 100644
index 000000000000..4cb2df9035df
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36633.json
@@ -0,0 +1,104 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36633",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in moodle-block_sitenews 1.0. It has been classified as problematic. This affects the function get_content of the file block_sitenews.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.1 is able to address this issue. The name of the patch is cd18d8b1afe464ae6626832496f4e070bac4c58f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216879."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine Schwachstelle in moodle-block_sitenews 1.0 ausgemacht. Sie wurde als problematisch eingestuft. Betroffen hiervon ist die Funktion get_content der Datei block_sitenews.php. Durch die Manipulation mit unbekannten Daten kann eine cross-site request forgery-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Ein Aktualisieren auf die Version 1.1 vermag dieses Problem zu l\u00f6sen. Der Patch wird als cd18d8b1afe464ae6626832496f4e070bac4c58f bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-352 Cross-Site Request Forgery",
+ "cweId": "CWE-352"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "moodle-block_sitenews",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216879",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216879"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216879",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216879"
+ },
+ {
+ "url": "https://github.com/eberhardt/moodle-block_sitenews/pull/5",
+ "refsource": "MISC",
+ "name": "https://github.com/eberhardt/moodle-block_sitenews/pull/5"
+ },
+ {
+ "url": "https://github.com/eberhardt/moodle-block_sitenews/commit/cd18d8b1afe464ae6626832496f4e070bac4c58f",
+ "refsource": "MISC",
+ "name": "https://github.com/eberhardt/moodle-block_sitenews/commit/cd18d8b1afe464ae6626832496f4e070bac4c58f"
+ },
+ {
+ "url": "https://github.com/eberhardt/moodle-block_sitenews/releases/tag/v1.1",
+ "refsource": "MISC",
+ "name": "https://github.com/eberhardt/moodle-block_sitenews/releases/tag/v1.1"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 4.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 4.3,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36634.json b/2020/36xxx/CVE-2020-36634.json
new file mode 100644
index 000000000000..ec9b84274fa4
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36634.json
@@ -0,0 +1,231 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36634",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic has been found in Indeed Engineering util up to 1.0.33. Affected is the function visit/appendTo of the file varexport/src/main/java/com/indeed/util/varexport/servlet/ViewExportedVariablesServlet.java. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.34 is able to address this issue. The name of the patch is c0952a9db51a880e9544d9fac2a2218a6bfc9c63. It is recommended to upgrade the affected component. VDB-216882 is the identifier assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine problematische Schwachstelle in Indeed Engineering util bis 1.0.33 entdeckt. Es geht dabei um die Funktion visit/appendTo der Datei varexport/src/main/java/com/indeed/util/varexport/servlet/ViewExportedVariablesServlet.java. Mittels Manipulieren mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Ein Aktualisieren auf die Version 1.0.34 vermag dieses Problem zu l\u00f6sen. Der Patch wird als c0952a9db51a880e9544d9fac2a2218a6bfc9c63 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Indeed Engineering",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "util",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.0.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.5",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.6",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.7",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.8",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.9",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.10",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.11",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.12",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.13",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.14",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.15",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.16",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.17",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.18",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.19",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.20",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.21",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.22",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.23",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.24",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.25",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.26",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.27",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.28",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.29",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.30",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.31",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.32",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.33",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216882",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216882"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216882",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216882"
+ },
+ {
+ "url": "https://github.com/indeedeng/util/commit/c0952a9db51a880e9544d9fac2a2218a6bfc9c63",
+ "refsource": "MISC",
+ "name": "https://github.com/indeedeng/util/commit/c0952a9db51a880e9544d9fac2a2218a6bfc9c63"
+ },
+ {
+ "url": "https://github.com/indeedeng/util/releases/tag/published%2F1.0.34",
+ "refsource": "MISC",
+ "name": "https://github.com/indeedeng/util/releases/tag/published%2F1.0.34"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 2.6,
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 2.6,
+ "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36635.json b/2020/36xxx/CVE-2020-36635.json
new file mode 100644
index 000000000000..fc3fcdb304d8
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36635.json
@@ -0,0 +1,152 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36635",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in OpenMRS Appointment Scheduling Module up to 1.12.x. It has been classified as problematic. This affects the function validateFieldName of the file api/src/main/java/org/openmrs/module/appointmentscheduling/validator/AppointmentTypeValidator.java. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.13.0 is able to address this issue. The name of the patch is 34213c3f6ea22df427573076fb62744694f601d8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216915."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine Schwachstelle in OpenMRS Appointment Scheduling Module bis 1.12.x ausgemacht. Sie wurde als problematisch eingestuft. Es betrifft die Funktion validateFieldName der Datei api/src/main/java/org/openmrs/module/appointmentscheduling/validator/AppointmentTypeValidator.java. Mittels Manipulieren mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Ein Aktualisieren auf die Version 1.13.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 34213c3f6ea22df427573076fb62744694f601d8 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "OpenMRS",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Appointment Scheduling Module",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.5",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.6",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.7",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.8",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.10",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.11",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.12",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216915",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216915"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216915",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216915"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-appointmentscheduling/pull/32",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-appointmentscheduling/pull/32"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-appointmentscheduling/commit/34213c3f6ea22df427573076fb62744694f601d8",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-appointmentscheduling/commit/34213c3f6ea22df427573076fb62744694f601d8"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-appointmentscheduling/releases/tag/1.13.0",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-appointmentscheduling/releases/tag/1.13.0"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36636.json b/2020/36xxx/CVE-2020-36636.json
new file mode 100644
index 000000000000..0cfca75b890b
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36636.json
@@ -0,0 +1,120 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36636",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic has been found in OpenMRS Admin UI Module up to 1.4.x. Affected is the function sendErrorMessage of the file omod/src/main/java/org/openmrs/module/adminui/page/controller/systemadmin/accounts/AccountPageController.java of the component Account Setup Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 702fbfdac7c4418f23bb5f6452482b4a88020061. It is recommended to upgrade the affected component. VDB-216918 is the identifier assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine problematische Schwachstelle in OpenMRS Admin UI Module bis 1.4.x entdeckt. Dabei betrifft es die Funktion sendErrorMessage der Datei omod/src/main/java/org/openmrs/module/adminui/page/controller/systemadmin/accounts/AccountPageController.java der Komponente Account Setup Handler. Durch das Beeinflussen mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Ein Aktualisieren auf die Version 1.5.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 702fbfdac7c4418f23bb5f6452482b4a88020061 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "OpenMRS",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Admin UI Module",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.4",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216918",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216918"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216918",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216918"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-adminui/pull/57",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-adminui/pull/57"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-adminui/commit/702fbfdac7c4418f23bb5f6452482b4a88020061",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-adminui/commit/702fbfdac7c4418f23bb5f6452482b4a88020061"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-adminui/releases/tag/1.5.0",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-adminui/releases/tag/1.5.0"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36637.json b/2020/36xxx/CVE-2020-36637.json
new file mode 100644
index 000000000000..61caa9323600
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36637.json
@@ -0,0 +1,111 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36637",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** UNSUPPPORTED WHEN ASSIGNED **** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Chris92de AdminServ. It has been declared as problematic. This vulnerability affects unknown code of the file resources/core/adminserv.php. The manipulation of the argument text leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 3ed17dab3b4d6e8bf1c82ddfbf882314365e9cd7. It is recommended to apply a patch to fix this issue. VDB-217042 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer."
+ },
+ {
+ "lang": "deu",
+ "value": "** UNSUPPPORTED WHEN ASSIGNED **In Chris92de AdminServ wurde eine Schwachstelle ausgemacht. Sie wurde als problematisch eingestuft. Betroffen ist eine unbekannte Verarbeitung der Datei resources/core/adminserv.php. Dank Manipulation des Arguments text mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Patch wird als 3ed17dab3b4d6e8bf1c82ddfbf882314365e9cd7 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Chris92de",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "AdminServ",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217042",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217042"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217042",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217042"
+ },
+ {
+ "url": "https://github.com/Chris92de/AdminServ/pull/7",
+ "refsource": "MISC",
+ "name": "https://github.com/Chris92de/AdminServ/pull/7"
+ },
+ {
+ "url": "https://github.com/Chris92de/AdminServ/commit/3ed17dab3b4d6e8bf1c82ddfbf882314365e9cd7",
+ "refsource": "MISC",
+ "name": "https://github.com/Chris92de/AdminServ/commit/3ed17dab3b4d6e8bf1c82ddfbf882314365e9cd7"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 4,
+ "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36638.json b/2020/36xxx/CVE-2020-36638.json
new file mode 100644
index 000000000000..127e19e1538d
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36638.json
@@ -0,0 +1,111 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36638",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** UNSUPPPORTED WHEN ASSIGNED **** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Chris92de AdminServ. It has been rated as problematic. This issue affects some unknown processing of the file resources/core/adminserv.php. The manipulation of the argument error leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 9a45087814295de6fb3a3fe38f96293665234da1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217043. NOTE: This vulnerability only affects products that are no longer supported by the maintainer."
+ },
+ {
+ "lang": "deu",
+ "value": "** UNSUPPPORTED WHEN ASSIGNED **Eine Schwachstelle wurde in Chris92de AdminServ ausgemacht. Sie wurde als problematisch eingestuft. Betroffen davon ist ein unbekannter Prozess der Datei resources/core/adminserv.php. Mit der Manipulation des Arguments error mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Patch wird als 9a45087814295de6fb3a3fe38f96293665234da1 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Chris92de",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "AdminServ",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217043",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217043"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217043",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217043"
+ },
+ {
+ "url": "https://github.com/Chris92de/AdminServ/pull/6",
+ "refsource": "MISC",
+ "name": "https://github.com/Chris92de/AdminServ/pull/6"
+ },
+ {
+ "url": "https://github.com/Chris92de/AdminServ/commit/9a45087814295de6fb3a3fe38f96293665234da1",
+ "refsource": "MISC",
+ "name": "https://github.com/Chris92de/AdminServ/commit/9a45087814295de6fb3a3fe38f96293665234da1"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 4,
+ "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36639.json b/2020/36xxx/CVE-2020-36639.json
new file mode 100644
index 000000000000..b6d2a1b88570
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36639.json
@@ -0,0 +1,111 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36639",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability has been found in AlliedModders AMX Mod X and classified as critical. This vulnerability affects the function cmdVoteMap of the file plugins/adminvote.sma of the component Console Command Handler. The manipulation of the argument amx_votemap leads to path traversal. The name of the patch is a5f2b5539f6d61050b68df8b22ebb343a2862681. It is recommended to apply a patch to fix this issue. VDB-217354 is the identifier assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "In AlliedModders AMX Mod X wurde eine kritische Schwachstelle gefunden. Hierbei betrifft es die Funktion cmdVoteMap der Datei plugins/adminvote.sma der Komponente Console Command Handler. Mittels dem Manipulieren des Arguments amx_votemap mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Patch wird als a5f2b5539f6d61050b68df8b22ebb343a2862681 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-22 Path Traversal",
+ "cweId": "CWE-22"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "AlliedModders",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "AMX Mod X",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217354",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217354"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217354",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217354"
+ },
+ {
+ "url": "https://github.com/alliedmodders/amxmodx/pull/823",
+ "refsource": "MISC",
+ "name": "https://github.com/alliedmodders/amxmodx/pull/823"
+ },
+ {
+ "url": "https://github.com/alliedmodders/amxmodx/commit/a5f2b5539f6d61050b68df8b22ebb343a2862681",
+ "refsource": "MISC",
+ "name": "https://github.com/alliedmodders/amxmodx/commit/a5f2b5539f6d61050b68df8b22ebb343a2862681"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 4.3,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 4.3,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 4.7,
+ "vectorString": "AV:A/AC:L/Au:M/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36640.json b/2020/36xxx/CVE-2020-36640.json
new file mode 100644
index 000000000000..ed14b6952b68
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36640.json
@@ -0,0 +1,128 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36640",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function TransformerConfigurationException of the file src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 is able to address this issue. The name of the patch is a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine problematische Schwachstelle in bonitasoft bonita-connector-webservice bis 1.3.0 gefunden. Dabei betrifft es die Funktion TransformerConfigurationException der Datei src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java. Mittels Manipulieren mit unbekannten Daten kann eine xml external entity reference-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 1.3.1 vermag dieses Problem zu l\u00f6sen. Der Patch wird als a12ad691c05af19e9061d7949b6b828ce48815d5 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-611 XML External Entity Reference",
+ "cweId": "CWE-611"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "bonitasoft",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "bonita-connector-webservice",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.3",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217443",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217443"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217443",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217443"
+ },
+ {
+ "url": "https://github.com/bonitasoft/bonita-connector-webservice/pull/17",
+ "refsource": "MISC",
+ "name": "https://github.com/bonitasoft/bonita-connector-webservice/pull/17"
+ },
+ {
+ "url": "https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5",
+ "refsource": "MISC",
+ "name": "https://github.com/bonitasoft/bonita-connector-webservice/commit/a12ad691c05af19e9061d7949b6b828ce48815d5"
+ },
+ {
+ "url": "https://github.com/bonitasoft/bonita-connector-webservice/releases/tag/1.3.1",
+ "refsource": "MISC",
+ "name": "https://github.com/bonitasoft/bonita-connector-webservice/releases/tag/1.3.1"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 4.9,
+ "vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36641.json b/2020/36xxx/CVE-2020-36641.json
new file mode 100644
index 000000000000..131b62b6839e
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36641.json
@@ -0,0 +1,159 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36641",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function ResponseParser of the file src/main/java/de/timroes/axmlrpc/ResponseParser.java. The manipulation leads to xml external entity reference. Upgrading to version 1.12.1 is able to address this issue. The name of the patch is ad6615b3ec41353e614f6ea5fdd5b046442a832b. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "In gturri aXMLRPC bis 1.12.0 wurde eine Schwachstelle entdeckt. Sie wurde als problematisch eingestuft. Es geht um die Funktion ResponseParser der Datei src/main/java/de/timroes/axmlrpc/ResponseParser.java. Mit der Manipulation mit unbekannten Daten kann eine xml external entity reference-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 1.12.1 vermag dieses Problem zu l\u00f6sen. Der Patch wird als ad6615b3ec41353e614f6ea5fdd5b046442a832b bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-611 XML External Entity Reference",
+ "cweId": "CWE-611"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "gturri",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "aXMLRPC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.5",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.6",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.7",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.8",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.10",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.11",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.12",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217450",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217450"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217450",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217450"
+ },
+ {
+ "url": "https://github.com/gturri/aXMLRPC/commit/ad6615b3ec41353e614f6ea5fdd5b046442a832b",
+ "refsource": "MISC",
+ "name": "https://github.com/gturri/aXMLRPC/commit/ad6615b3ec41353e614f6ea5fdd5b046442a832b"
+ },
+ {
+ "url": "https://github.com/gturri/aXMLRPC/releases/tag/aXMLRPC-1.12.1",
+ "refsource": "MISC",
+ "name": "https://github.com/gturri/aXMLRPC/releases/tag/aXMLRPC-1.12.1"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 4.9,
+ "vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36642.json b/2020/36xxx/CVE-2020-36642.json
new file mode 100644
index 000000000000..b34a5abcab06
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36642.json
@@ -0,0 +1,140 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36642",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in trampgeek jobe up to 1.6.x and classified as critical. This issue affects the function run_in_sandbox of the file application/libraries/LanguageTask.php. The manipulation leads to command injection. Upgrading to version 1.7.0 is able to address this issue. The name of the patch is 8f43daf50c943b98eaf0c542da901a4a16e85b02. It is recommended to upgrade the affected component. The identifier VDB-217553 was assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Eine kritische Schwachstelle wurde in trampgeek jobe bis 1.6.x gefunden. Betroffen davon ist die Funktion run_in_sandbox der Datei application/libraries/LanguageTask.php. Mittels Manipulieren mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 1.7.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 8f43daf50c943b98eaf0c542da901a4a16e85b02 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-77 Command Injection",
+ "cweId": "CWE-77"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "trampgeek",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "jobe",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.5",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.6",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217553",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217553"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217553",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217553"
+ },
+ {
+ "url": "https://github.com/trampgeek/jobe/issues/39",
+ "refsource": "MISC",
+ "name": "https://github.com/trampgeek/jobe/issues/39"
+ },
+ {
+ "url": "https://github.com/trampgeek/jobe/commit/8f43daf50c943b98eaf0c542da901a4a16e85b02",
+ "refsource": "MISC",
+ "name": "https://github.com/trampgeek/jobe/commit/8f43daf50c943b98eaf0c542da901a4a16e85b02"
+ },
+ {
+ "url": "https://github.com/trampgeek/jobe/releases/tag/v1.7.0",
+ "refsource": "MISC",
+ "name": "https://github.com/trampgeek/jobe/releases/tag/v1.7.0"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 5.2,
+ "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36643.json b/2020/36xxx/CVE-2020-36643.json
new file mode 100644
index 000000000000..3f20a6c1ca95
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36643.json
@@ -0,0 +1,106 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36643",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in intgr uqm-wasm. It has been classified as critical. This affects the function log_displayBox in the library sc2/src/libs/log/msgbox_macosx.m. The manipulation leads to format string. The name of the patch is 1d5cbf3350a02c423ad6bef6dfd5300d38aa828f. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217563."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine Schwachstelle in intgr uqm-wasm ausgemacht. Sie wurde als kritisch eingestuft. Dabei betrifft es die Funktion log_displayBox in der Bibliothek sc2/src/libs/log/msgbox_macosx.m. Mittels dem Manipulieren mit unbekannten Daten kann eine format string-Schwachstelle ausgenutzt werden. Der Patch wird als 1d5cbf3350a02c423ad6bef6dfd5300d38aa828f bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-134 Format String",
+ "cweId": "CWE-134"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "intgr",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "uqm-wasm",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217563",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217563"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217563",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217563"
+ },
+ {
+ "url": "https://github.com/intgr/uqm-wasm/commit/1d5cbf3350a02c423ad6bef6dfd5300d38aa828f",
+ "refsource": "MISC",
+ "name": "https://github.com/intgr/uqm-wasm/commit/1d5cbf3350a02c423ad6bef6dfd5300d38aa828f"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 5.2,
+ "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36644.json b/2020/36xxx/CVE-2020-36644.json
new file mode 100644
index 000000000000..d4c33b386d92
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36644.json
@@ -0,0 +1,120 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36644",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inline_svg/action_view/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.7.2 is able to address this issue. The name of the patch is f5363b351508486021f99e083c92068cf2943621. It is recommended to upgrade the affected component. The identifier VDB-217597 was assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "In jamesmartin Inline SVG bis 1.7.1 wurde eine Schwachstelle gefunden. Sie wurde als problematisch eingestuft. Betroffen ist eine unbekannte Verarbeitung der Datei lib/inline_svg/action_view/helpers.rb der Komponente URL Parameter Handler. Mittels Manipulieren des Arguments filename mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Ein Aktualisieren auf die Version 1.7.2 vermag dieses Problem zu l\u00f6sen. Der Patch wird als f5363b351508486021f99e083c92068cf2943621 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "jamesmartin",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Inline SVG",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.7.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.7.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217597",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217597"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217597",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217597"
+ },
+ {
+ "url": "https://github.com/jamesmartin/inline_svg/pull/117",
+ "refsource": "MISC",
+ "name": "https://github.com/jamesmartin/inline_svg/pull/117"
+ },
+ {
+ "url": "https://github.com/jamesmartin/inline_svg/commit/f5363b351508486021f99e083c92068cf2943621",
+ "refsource": "MISC",
+ "name": "https://github.com/jamesmartin/inline_svg/commit/f5363b351508486021f99e083c92068cf2943621"
+ },
+ {
+ "url": "https://github.com/jamesmartin/inline_svg/releases/tag/v1.7.2",
+ "refsource": "MISC",
+ "name": "https://github.com/jamesmartin/inline_svg/releases/tag/v1.7.2"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 4,
+ "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36645.json b/2020/36xxx/CVE-2020-36645.json
new file mode 100644
index 000000000000..c4aaefd2cfb2
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36645.json
@@ -0,0 +1,116 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36645",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as critical, was found in square squalor. This affects an unknown part. The manipulation leads to sql injection. Upgrading to version v0.0.0 is able to address this issue. The name of the patch is f6f0a47cc344711042eb0970cb423e6950ba3f93. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217623."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine kritische Schwachstelle in square squalor gefunden. Dabei betrifft es einen unbekannter Codeteil. Durch Beeinflussen mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version v0.0.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als f6f0a47cc344711042eb0970cb423e6950ba3f93 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-89 SQL Injection",
+ "cweId": "CWE-89"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "square",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "squalor",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217623",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217623"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217623",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217623"
+ },
+ {
+ "url": "https://github.com/square/squalor/pull/76",
+ "refsource": "MISC",
+ "name": "https://github.com/square/squalor/pull/76"
+ },
+ {
+ "url": "https://github.com/square/squalor/commit/f6f0a47cc344711042eb0970cb423e6950ba3f93",
+ "refsource": "MISC",
+ "name": "https://github.com/square/squalor/commit/f6f0a47cc344711042eb0970cb423e6950ba3f93"
+ },
+ {
+ "url": "https://github.com/square/squalor/releases/tag/v0.0.0",
+ "refsource": "MISC",
+ "name": "https://github.com/square/squalor/releases/tag/v0.0.0"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 5.2,
+ "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36646.json b/2020/36xxx/CVE-2020-36646.json
new file mode 100644
index 000000000000..4bc2fded3527
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36646.json
@@ -0,0 +1,268 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36646",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic has been found in MediaArea ZenLib up to 0.4.38. This affects the function Ztring::Date_From_Seconds_1970_Local of the file Source/ZenLib/Ztring.cpp. The manipulation of the argument Value leads to unchecked return value to null pointer dereference. Upgrading to version 0.4.39 is able to address this issue. The name of the patch is 6475fcccd37c9cf17e0cfe263b5fe0e2e47a8408. It is recommended to upgrade the affected component. The identifier VDB-217629 was assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine Schwachstelle in MediaArea ZenLib bis 0.4.38 entdeckt. Sie wurde als problematisch eingestuft. Betroffen hiervon ist die Funktion Ztring::Date_From_Seconds_1970_Local der Datei Source/ZenLib/Ztring.cpp. Mittels dem Manipulieren des Arguments Value mit unbekannten Daten kann eine unchecked return value to null pointer dereference-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 0.4.39 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 6475fcccd37c9cf17e0cfe263b5fe0e2e47a8408 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-690 Unchecked Return Value to NULL Pointer Dereference",
+ "cweId": "CWE-690"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "MediaArea",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "ZenLib",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "0.4.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.5",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.6",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.7",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.8",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.9",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.10",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.11",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.12",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.13",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.14",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.15",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.16",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.17",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.18",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.19",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.20",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.21",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.22",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.23",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.24",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.25",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.26",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.27",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.28",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.29",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.30",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.31",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.32",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.33",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.34",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.35",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.36",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.37",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4.38",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217629",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217629"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217629",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217629"
+ },
+ {
+ "url": "https://github.com/MediaArea/ZenLib/pull/119",
+ "refsource": "MISC",
+ "name": "https://github.com/MediaArea/ZenLib/pull/119"
+ },
+ {
+ "url": "https://github.com/MediaArea/ZenLib/commit/6475fcccd37c9cf17e0cfe263b5fe0e2e47a8408",
+ "refsource": "MISC",
+ "name": "https://github.com/MediaArea/ZenLib/commit/6475fcccd37c9cf17e0cfe263b5fe0e2e47a8408"
+ },
+ {
+ "url": "https://github.com/MediaArea/ZenLib/releases/tag/v0.4.39",
+ "refsource": "MISC",
+ "name": "https://github.com/MediaArea/ZenLib/releases/tag/v0.4.39"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 2.3,
+ "vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36647.json b/2020/36xxx/CVE-2020-36647.json
new file mode 100644
index 000000000000..426978542653
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36647.json
@@ -0,0 +1,111 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36647",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as critical has been found in YunoHost-Apps transmission_ynh. Affected is an unknown function of the file conf/nginx.conf. The manipulation leads to path traversal. The name of the patch is f136dfd44eda128129e5fd2d850a3a3c600e6a4a. It is recommended to apply a patch to fix this issue. VDB-217638 is the identifier assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine kritische Schwachstelle in YunoHost-Apps transmission_ynh entdeckt. Dabei betrifft es einen unbekannter Codeteil der Datei conf/nginx.conf. Durch die Manipulation mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Patch wird als f136dfd44eda128129e5fd2d850a3a3c600e6a4a bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-22 Path Traversal",
+ "cweId": "CWE-22"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "YunoHost-Apps",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "transmission_ynh",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217638",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217638"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217638",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217638"
+ },
+ {
+ "url": "https://github.com/YunoHost-Apps/transmission_ynh/pull/75",
+ "refsource": "MISC",
+ "name": "https://github.com/YunoHost-Apps/transmission_ynh/pull/75"
+ },
+ {
+ "url": "https://github.com/YunoHost-Apps/transmission_ynh/commit/f136dfd44eda128129e5fd2d850a3a3c600e6a4a",
+ "refsource": "MISC",
+ "name": "https://github.com/YunoHost-Apps/transmission_ynh/commit/f136dfd44eda128129e5fd2d850a3a3c600e6a4a"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 5.2,
+ "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36648.json b/2020/36xxx/CVE-2020-36648.json
new file mode 100644
index 000000000000..2fdf6569f917
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36648.json
@@ -0,0 +1,106 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36648",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as critical, was found in pouetnet pouet 2.0. This affects an unknown part. The manipulation of the argument howmany leads to sql injection. The name of the patch is 11d615931352066fb2f6dcb07428277c2cd99baf. It is recommended to apply a patch to fix this issue. The identifier VDB-217641 was assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine kritische Schwachstelle in pouetnet pouet 2.0 gefunden. Hiervon betroffen ist ein unbekannter Codeblock. Mittels Manipulieren des Arguments howmany mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Patch wird als 11d615931352066fb2f6dcb07428277c2cd99baf bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-89 SQL Injection",
+ "cweId": "CWE-89"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "pouetnet",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "pouet",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "2.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217641",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217641"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217641",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217641"
+ },
+ {
+ "url": "https://github.com/pouetnet/pouet2.0/commit/11d615931352066fb2f6dcb07428277c2cd99baf",
+ "refsource": "MISC",
+ "name": "https://github.com/pouetnet/pouet2.0/commit/11d615931352066fb2f6dcb07428277c2cd99baf"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 5.2,
+ "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36649.json b/2020/36xxx/CVE-2020-36649.json
new file mode 100644
index 000000000000..a21f719984d0
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36649.json
@@ -0,0 +1,125 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36649",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 5.2.0 is able to address this issue. The name of the patch is 235a12758cd77266d2e98fd715f53536b34ad621. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218004."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine problematische Schwachstelle in mholt PapaParse bis 5.1.x ausgemacht. Betroffen hiervon ist ein unbekannter Ablauf der Datei papaparse.js. Mittels Manipulieren mit unbekannten Daten kann eine inefficient regular expression complexity-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 5.2.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 235a12758cd77266d2e98fd715f53536b34ad621 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-1333 Inefficient Regular Expression Complexity",
+ "cweId": "CWE-1333"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "mholt",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "PapaParse",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "5.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "5.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.218004",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.218004"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.218004",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.218004"
+ },
+ {
+ "url": "https://github.com/mholt/PapaParse/issues/777",
+ "refsource": "MISC",
+ "name": "https://github.com/mholt/PapaParse/issues/777"
+ },
+ {
+ "url": "https://github.com/mholt/PapaParse/pull/779",
+ "refsource": "MISC",
+ "name": "https://github.com/mholt/PapaParse/pull/779"
+ },
+ {
+ "url": "https://github.com/mholt/PapaParse/commit/235a12758cd77266d2e98fd715f53536b34ad621",
+ "refsource": "MISC",
+ "name": "https://github.com/mholt/PapaParse/commit/235a12758cd77266d2e98fd715f53536b34ad621"
+ },
+ {
+ "url": "https://github.com/mholt/PapaParse/releases/tag/5.2.0",
+ "refsource": "MISC",
+ "name": "https://github.com/mholt/PapaParse/releases/tag/5.2.0"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 2.3,
+ "vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/36xxx/CVE-2020-36650.json b/2020/36xxx/CVE-2020-36650.json
new file mode 100644
index 000000000000..7024effc5066
--- /dev/null
+++ b/2020/36xxx/CVE-2020-36650.json
@@ -0,0 +1,116 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2020-36650",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as critical, was found in IonicaBizau node-gry up to 5.x. This affects an unknown part. The manipulation leads to command injection. Upgrading to version 6.0.0 is able to address this issue. The name of the patch is 5108446c1e23960d65e8b973f1d9486f9f9dbd6c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218019."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine kritische Schwachstelle in IonicaBizau node-gry bis 5.x gefunden. Betroffen hiervon ist ein unbekannter Ablauf. Durch Beeinflussen mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 6.0.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 5108446c1e23960d65e8b973f1d9486f9f9dbd6c bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-77 Command Injection",
+ "cweId": "CWE-77"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "IonicaBizau",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "node-gry",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "5.x",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.218019",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.218019"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.218019",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.218019"
+ },
+ {
+ "url": "https://github.com/IonicaBizau/node-gry/pull/22",
+ "refsource": "MISC",
+ "name": "https://github.com/IonicaBizau/node-gry/pull/22"
+ },
+ {
+ "url": "https://github.com/IonicaBizau/node-gry/commit/5108446c1e23960d65e8b973f1d9486f9f9dbd6c",
+ "refsource": "MISC",
+ "name": "https://github.com/IonicaBizau/node-gry/commit/5108446c1e23960d65e8b973f1d9486f9f9dbd6c"
+ },
+ {
+ "url": "https://github.com/IonicaBizau/node-gry/releases/tag/6.0.0",
+ "refsource": "MISC",
+ "name": "https://github.com/IonicaBizau/node-gry/releases/tag/6.0.0"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 5.2,
+ "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2020/4xxx/CVE-2020-4497.json b/2020/4xxx/CVE-2020-4497.json
index 8a83684cda7e..cd293dcc8b18 100644
--- a/2020/4xxx/CVE-2020-4497.json
+++ b/2020/4xxx/CVE-2020-4497.json
@@ -1,17 +1,92 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2020-4497",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@us.ibm.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "IBM Spectrum Protect Plus 10.1.0 through 10.1.12 discloses sensitive information due to unencrypted data being used in the communication flow between Spectrum Protect Plus vSnap and its agents. An attacker could obtain information using main in the middle techniques. IBM X-Force ID: 182106."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-319 Cleartext Transmission of Sensitive Information",
+ "cweId": "CWE-319"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "IBM",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Spectrum Protect Plus",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "10.1.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.ibm.com/support/pages/node/6847627",
+ "refsource": "MISC",
+ "name": "https://www.ibm.com/support/pages/node/6847627"
+ },
+ {
+ "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182106",
+ "refsource": "MISC",
+ "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/182106"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "HIGH",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 6.8,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2020/7xxx/CVE-2020-7112.json b/2020/7xxx/CVE-2020-7112.json
index 5e246b46dd3d..6a6eafbd9992 100644
--- a/2020/7xxx/CVE-2020-7112.json
+++ b/2020/7xxx/CVE-2020-7112.json
@@ -1,17 +1,17 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2020-7112",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-alert@hpe.com",
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "CVE was unused by HPE."
}
]
}
diff --git a/2020/7xxx/CVE-2020-7118.json b/2020/7xxx/CVE-2020-7118.json
index c467398ed453..fdd5fbc3f6c8 100644
--- a/2020/7xxx/CVE-2020-7118.json
+++ b/2020/7xxx/CVE-2020-7118.json
@@ -1,17 +1,17 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2020-7118",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-alert@hpe.com",
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "CVE was unused by HPE."
}
]
}
diff --git a/2020/7xxx/CVE-2020-7346.json b/2020/7xxx/CVE-2020-7346.json
index b0b8252fed32..e40df9abbc9f 100644
--- a/2020/7xxx/CVE-2020-7346.json
+++ b/2020/7xxx/CVE-2020-7346.json
@@ -1,14 +1,38 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "psirt@mcafee.com",
"ID": "CVE-2020-7346",
- "STATE": "PUBLIC",
- "TITLE": "Privilege escalation in McAfee DLP Endpoint for Windows"
+ "ASSIGNER": "trellixpsirt@trellix.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) for Windows prior to 11.6.100 allows a local, low privileged, attacker through the use of junctions to cause the product to load DLLs of the attacker's choosing. This requires the creation and removal of junctions by the attacker along with sending a specific IOTL command at the correct time."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-59: Improper Link Resolution Before File Access ('Link Following')",
+ "cweId": "CWE-59"
+ }
+ ]
+ }
+ ]
},
"affects": {
"vendor": {
"vendor_data": [
{
+ "vendor_name": "McAfee,LLC",
"product": {
"product_data": [
{
@@ -16,72 +40,49 @@
"version": {
"version_data": [
{
- "platform": "Windows",
- "version_affected": "<",
- "version_value": "11.6.100"
+ "version_value": "unspecified",
+ "version_affected": "="
}
]
}
}
]
- },
- "vendor_name": "McAfee,LLC"
+ }
}
]
}
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
- "description": {
- "description_data": [
+ "references": {
+ "reference_data": [
{
- "lang": "eng",
- "value": "Privilege Escalation vulnerability in McAfee Data Loss Prevention (DLP) for Windows prior to 11.6.100 allows a local, low privileged, attacker through the use of junctions to cause the product to load DLLs of the attacker's choosing. This requires the creation and removal of junctions by the attacker along with sending a specific IOTL command at the correct time."
+ "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10344",
+ "refsource": "MISC",
+ "name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10344"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
- "impact": {
- "cvss": {
- "attackComplexity": "LOW",
- "attackVector": "LOCAL",
- "availabilityImpact": "HIGH",
- "baseScore": 7.8,
- "baseSeverity": "HIGH",
- "confidentialityImpact": "HIGH",
- "integrityImpact": "HIGH",
- "privilegesRequired": "LOW",
- "scope": "UNCHANGED",
- "userInteraction": "NONE",
- "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
- "version": "3.1"
- }
- },
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-269: Privilege escalation vulnerability\t"
- }
- ]
- }
- ]
+ "source": {
+ "discovery": "EXTERNAL"
},
- "references": {
- "reference_data": [
+ "impact": {
+ "cvss": [
{
- "name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10344",
- "refsource": "CONFIRM",
- "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10344"
+ "attackComplexity": "LOW",
+ "attackVector": "LOCAL",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.8,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
+ "version": "3.1"
}
]
- },
- "source": {
- "discovery": "EXTERNAL"
}
-}
+}
\ No newline at end of file
diff --git a/2020/8xxx/CVE-2020-8813.json b/2020/8xxx/CVE-2020-8813.json
index d0a10d29cdc7..3c435f1323dc 100644
--- a/2020/8xxx/CVE-2020-8813.json
+++ b/2020/8xxx/CVE-2020-8813.json
@@ -126,6 +126,11 @@
"refsource": "GENTOO",
"name": "GLSA-202004-16",
"url": "https://security.gentoo.org/glsa/202004-16"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20221231 [SECURITY] [DLA 3252-1] cacti security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html"
}
]
}
diff --git a/2021/21xxx/CVE-2021-21200.json b/2021/21xxx/CVE-2021-21200.json
index e0aaf124dbc4..577ab5eeeb4f 100644
--- a/2021/21xxx/CVE-2021-21200.json
+++ b/2021/21xxx/CVE-2021-21200.json
@@ -1,17 +1,67 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-21200",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "chrome-cve-admin@google.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Out of bounds read in WebUI Settings in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chrome security severity: Low)"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Out of bounds read"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Google",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Chrome",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "89.0.4389.72",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html",
+ "refsource": "MISC",
+ "name": "https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html"
+ },
+ {
+ "url": "https://crbug.com/1164816",
+ "refsource": "MISC",
+ "name": "https://crbug.com/1164816"
}
]
}
diff --git a/2021/21xxx/CVE-2021-21366.json b/2021/21xxx/CVE-2021-21366.json
index bc81a3af4e3b..8c412f3e7126 100644
--- a/2021/21xxx/CVE-2021-21366.json
+++ b/2021/21xxx/CVE-2021-21366.json
@@ -96,6 +96,11 @@
"name": "https://github.com/xmldom/xmldom/commit/d4201b9dfbf760049f457f9f08a3888d48835135",
"refsource": "MISC",
"url": "https://github.com/xmldom/xmldom/commit/d4201b9dfbf760049f457f9f08a3888d48835135"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20230101 [SECURITY] [DLA 3260-1] node-xmldom security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html"
}
]
},
diff --git a/2021/21xxx/CVE-2021-21707.json b/2021/21xxx/CVE-2021-21707.json
index d041a32a8158..a64ccd7b247c 100644
--- a/2021/21xxx/CVE-2021-21707.json
+++ b/2021/21xxx/CVE-2021-21707.json
@@ -110,6 +110,11 @@
"refsource": "CONFIRM",
"name": "https://www.tenable.com/security/tns-2022-09",
"url": "https://www.tenable.com/security/tns-2022-09"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3243-1] php7.3 security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00030.html"
}
]
},
diff --git a/2021/22xxx/CVE-2021-22600.json b/2021/22xxx/CVE-2021-22600.json
index 3e405c79889e..966e5e9f5586 100644
--- a/2021/22xxx/CVE-2021-22600.json
+++ b/2021/22xxx/CVE-2021-22600.json
@@ -99,6 +99,11 @@
"refsource": "DEBIAN",
"name": "DSA-5096",
"url": "https://www.debian.org/security/2022/dsa-5096"
+ },
+ {
+ "refsource": "CONFIRM",
+ "name": "https://security.netapp.com/advisory/ntap-20230110-0002/",
+ "url": "https://security.netapp.com/advisory/ntap-20230110-0002/"
}
]
},
diff --git a/2021/22xxx/CVE-2021-22922.json b/2021/22xxx/CVE-2021-22922.json
index 00b0a2a444f3..34d8e2e6fd4c 100644
--- a/2021/22xxx/CVE-2021-22922.json
+++ b/2021/22xxx/CVE-2021-22922.json
@@ -88,6 +88,11 @@
"refsource": "CONFIRM",
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202212-01",
+ "url": "https://security.gentoo.org/glsa/202212-01"
}
]
},
diff --git a/2021/22xxx/CVE-2021-22923.json b/2021/22xxx/CVE-2021-22923.json
index 9fd5bfaee0f4..fc5fbd07f0b0 100644
--- a/2021/22xxx/CVE-2021-22923.json
+++ b/2021/22xxx/CVE-2021-22923.json
@@ -68,6 +68,11 @@
"refsource": "CONFIRM",
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202212-01",
+ "url": "https://security.gentoo.org/glsa/202212-01"
}
]
},
diff --git a/2021/22xxx/CVE-2021-22925.json b/2021/22xxx/CVE-2021-22925.json
index d6b35cf3af85..da27ca5d2b4f 100644
--- a/2021/22xxx/CVE-2021-22925.json
+++ b/2021/22xxx/CVE-2021-22925.json
@@ -98,6 +98,11 @@
"refsource": "CONFIRM",
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202212-01",
+ "url": "https://security.gentoo.org/glsa/202212-01"
}
]
},
diff --git a/2021/22xxx/CVE-2021-22926.json b/2021/22xxx/CVE-2021-22926.json
index ad378c1e3b8b..e659ff95b18b 100644
--- a/2021/22xxx/CVE-2021-22926.json
+++ b/2021/22xxx/CVE-2021-22926.json
@@ -93,6 +93,11 @@
"refsource": "CONFIRM",
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202212-01",
+ "url": "https://security.gentoo.org/glsa/202212-01"
}
]
},
diff --git a/2021/22xxx/CVE-2021-22945.json b/2021/22xxx/CVE-2021-22945.json
index 21a5bb74d175..a27ab51bd31e 100644
--- a/2021/22xxx/CVE-2021-22945.json
+++ b/2021/22xxx/CVE-2021-22945.json
@@ -88,6 +88,11 @@
"refsource": "DEBIAN",
"name": "DSA-5197",
"url": "https://www.debian.org/security/2022/dsa-5197"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202212-01",
+ "url": "https://security.gentoo.org/glsa/202212-01"
}
]
},
diff --git a/2021/22xxx/CVE-2021-22946.json b/2021/22xxx/CVE-2021-22946.json
index da86fdcfc14a..2f6c58adf784 100644
--- a/2021/22xxx/CVE-2021-22946.json
+++ b/2021/22xxx/CVE-2021-22946.json
@@ -118,6 +118,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20220828 [SECURITY] [DLA 3085-1] curl security update",
"url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202212-01",
+ "url": "https://security.gentoo.org/glsa/202212-01"
}
]
},
diff --git a/2021/22xxx/CVE-2021-22947.json b/2021/22xxx/CVE-2021-22947.json
index 5787b5c09c54..97ea7a53e038 100644
--- a/2021/22xxx/CVE-2021-22947.json
+++ b/2021/22xxx/CVE-2021-22947.json
@@ -113,6 +113,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20220828 [SECURITY] [DLA 3085-1] curl security update",
"url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202212-01",
+ "url": "https://security.gentoo.org/glsa/202212-01"
}
]
},
diff --git a/2021/23xxx/CVE-2021-23056.json b/2021/23xxx/CVE-2021-23056.json
index 4ca70f67a49b..78424e9f7474 100644
--- a/2021/23xxx/CVE-2021-23056.json
+++ b/2021/23xxx/CVE-2021-23056.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23056",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23057.json b/2021/23xxx/CVE-2021-23057.json
index 5ad93752815b..dcded131612e 100644
--- a/2021/23xxx/CVE-2021-23057.json
+++ b/2021/23xxx/CVE-2021-23057.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23057",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23058.json b/2021/23xxx/CVE-2021-23058.json
index 37c8ed468d26..a67931ba5b2d 100644
--- a/2021/23xxx/CVE-2021-23058.json
+++ b/2021/23xxx/CVE-2021-23058.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23058",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23059.json b/2021/23xxx/CVE-2021-23059.json
index 037f3225fb21..3e53f07c699c 100644
--- a/2021/23xxx/CVE-2021-23059.json
+++ b/2021/23xxx/CVE-2021-23059.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23059",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23060.json b/2021/23xxx/CVE-2021-23060.json
index ee344affa1b5..f60b4bf086d9 100644
--- a/2021/23xxx/CVE-2021-23060.json
+++ b/2021/23xxx/CVE-2021-23060.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23060",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23061.json b/2021/23xxx/CVE-2021-23061.json
index df5003467070..ad061d661a9b 100644
--- a/2021/23xxx/CVE-2021-23061.json
+++ b/2021/23xxx/CVE-2021-23061.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23061",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23062.json b/2021/23xxx/CVE-2021-23062.json
index b66d7cc24a46..ef3709aaf959 100644
--- a/2021/23xxx/CVE-2021-23062.json
+++ b/2021/23xxx/CVE-2021-23062.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23062",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23063.json b/2021/23xxx/CVE-2021-23063.json
index 3780c5ae00b0..38f094be3d74 100644
--- a/2021/23xxx/CVE-2021-23063.json
+++ b/2021/23xxx/CVE-2021-23063.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23063",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23064.json b/2021/23xxx/CVE-2021-23064.json
index 96f0468856b6..3d70c7f82253 100644
--- a/2021/23xxx/CVE-2021-23064.json
+++ b/2021/23xxx/CVE-2021-23064.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23064",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23065.json b/2021/23xxx/CVE-2021-23065.json
index 407b0b0193f5..ea434dd0c83a 100644
--- a/2021/23xxx/CVE-2021-23065.json
+++ b/2021/23xxx/CVE-2021-23065.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23065",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23066.json b/2021/23xxx/CVE-2021-23066.json
index dfd5fd83b67d..441804fe3451 100644
--- a/2021/23xxx/CVE-2021-23066.json
+++ b/2021/23xxx/CVE-2021-23066.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23066",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23067.json b/2021/23xxx/CVE-2021-23067.json
index 8654c971cdd5..e103d5399a60 100644
--- a/2021/23xxx/CVE-2021-23067.json
+++ b/2021/23xxx/CVE-2021-23067.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23067",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23068.json b/2021/23xxx/CVE-2021-23068.json
index 483e1fc84a40..80ac1f223652 100644
--- a/2021/23xxx/CVE-2021-23068.json
+++ b/2021/23xxx/CVE-2021-23068.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23068",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23069.json b/2021/23xxx/CVE-2021-23069.json
index 67b6c9d0ea86..7b58b40f7f21 100644
--- a/2021/23xxx/CVE-2021-23069.json
+++ b/2021/23xxx/CVE-2021-23069.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23069",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23070.json b/2021/23xxx/CVE-2021-23070.json
index 16a613951a86..bfaee46bc445 100644
--- a/2021/23xxx/CVE-2021-23070.json
+++ b/2021/23xxx/CVE-2021-23070.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23070",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23071.json b/2021/23xxx/CVE-2021-23071.json
index 52f68b72afa2..fe6e1e96f90e 100644
--- a/2021/23xxx/CVE-2021-23071.json
+++ b/2021/23xxx/CVE-2021-23071.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23071",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23072.json b/2021/23xxx/CVE-2021-23072.json
index 10daf472407d..216d24107cd6 100644
--- a/2021/23xxx/CVE-2021-23072.json
+++ b/2021/23xxx/CVE-2021-23072.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23072",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23073.json b/2021/23xxx/CVE-2021-23073.json
index d1dd00a6a913..a94334971904 100644
--- a/2021/23xxx/CVE-2021-23073.json
+++ b/2021/23xxx/CVE-2021-23073.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23073",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23074.json b/2021/23xxx/CVE-2021-23074.json
index 69498c25e0bf..63d9668295e0 100644
--- a/2021/23xxx/CVE-2021-23074.json
+++ b/2021/23xxx/CVE-2021-23074.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23074",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23075.json b/2021/23xxx/CVE-2021-23075.json
index c1de1447690a..32738f82d662 100644
--- a/2021/23xxx/CVE-2021-23075.json
+++ b/2021/23xxx/CVE-2021-23075.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23075",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23076.json b/2021/23xxx/CVE-2021-23076.json
index 4a6ce8872064..5a7146fe7016 100644
--- a/2021/23xxx/CVE-2021-23076.json
+++ b/2021/23xxx/CVE-2021-23076.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23076",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23077.json b/2021/23xxx/CVE-2021-23077.json
index b65cf36d3562..d91aa5d25f9f 100644
--- a/2021/23xxx/CVE-2021-23077.json
+++ b/2021/23xxx/CVE-2021-23077.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23077",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23078.json b/2021/23xxx/CVE-2021-23078.json
index bd392c9f8c29..d3b8b36ffa25 100644
--- a/2021/23xxx/CVE-2021-23078.json
+++ b/2021/23xxx/CVE-2021-23078.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23078",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23079.json b/2021/23xxx/CVE-2021-23079.json
index 38dd08034bdf..c5951d5edaf0 100644
--- a/2021/23xxx/CVE-2021-23079.json
+++ b/2021/23xxx/CVE-2021-23079.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23079",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23080.json b/2021/23xxx/CVE-2021-23080.json
index 248c0d6fa69d..07d2edbe02f5 100644
--- a/2021/23xxx/CVE-2021-23080.json
+++ b/2021/23xxx/CVE-2021-23080.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23080",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23081.json b/2021/23xxx/CVE-2021-23081.json
index 8c65724c5d38..5a0d775ff838 100644
--- a/2021/23xxx/CVE-2021-23081.json
+++ b/2021/23xxx/CVE-2021-23081.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23081",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23082.json b/2021/23xxx/CVE-2021-23082.json
index 251be6603a59..0cde6a5d1758 100644
--- a/2021/23xxx/CVE-2021-23082.json
+++ b/2021/23xxx/CVE-2021-23082.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23082",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23083.json b/2021/23xxx/CVE-2021-23083.json
index adddeb80cfc1..682464cc9587 100644
--- a/2021/23xxx/CVE-2021-23083.json
+++ b/2021/23xxx/CVE-2021-23083.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23083",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23084.json b/2021/23xxx/CVE-2021-23084.json
index 91c38e31842a..dcf72b5c0a34 100644
--- a/2021/23xxx/CVE-2021-23084.json
+++ b/2021/23xxx/CVE-2021-23084.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23084",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23085.json b/2021/23xxx/CVE-2021-23085.json
index 5053f2bd898a..330951f7511f 100644
--- a/2021/23xxx/CVE-2021-23085.json
+++ b/2021/23xxx/CVE-2021-23085.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23085",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23086.json b/2021/23xxx/CVE-2021-23086.json
index 96f8c075a430..b3519af516c0 100644
--- a/2021/23xxx/CVE-2021-23086.json
+++ b/2021/23xxx/CVE-2021-23086.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23086",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23087.json b/2021/23xxx/CVE-2021-23087.json
index 91028634d518..7e620648fcc8 100644
--- a/2021/23xxx/CVE-2021-23087.json
+++ b/2021/23xxx/CVE-2021-23087.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23087",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23088.json b/2021/23xxx/CVE-2021-23088.json
index 9c6efb04e4be..41a819b2e90a 100644
--- a/2021/23xxx/CVE-2021-23088.json
+++ b/2021/23xxx/CVE-2021-23088.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23088",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23089.json b/2021/23xxx/CVE-2021-23089.json
index 3c2a529ea704..f1aaa7831c14 100644
--- a/2021/23xxx/CVE-2021-23089.json
+++ b/2021/23xxx/CVE-2021-23089.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23089",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23090.json b/2021/23xxx/CVE-2021-23090.json
index 7cebb5f3edf7..bd8c27e32dc2 100644
--- a/2021/23xxx/CVE-2021-23090.json
+++ b/2021/23xxx/CVE-2021-23090.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23090",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23091.json b/2021/23xxx/CVE-2021-23091.json
index 792c8064a053..059571c49ee7 100644
--- a/2021/23xxx/CVE-2021-23091.json
+++ b/2021/23xxx/CVE-2021-23091.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23091",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23092.json b/2021/23xxx/CVE-2021-23092.json
index efe6b1267ba9..12d2e6c88db6 100644
--- a/2021/23xxx/CVE-2021-23092.json
+++ b/2021/23xxx/CVE-2021-23092.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23092",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23093.json b/2021/23xxx/CVE-2021-23093.json
index f853dea7502d..b2a0ebb25f2e 100644
--- a/2021/23xxx/CVE-2021-23093.json
+++ b/2021/23xxx/CVE-2021-23093.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23093",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23094.json b/2021/23xxx/CVE-2021-23094.json
index 0adce7d3e2f1..d0d96163bec1 100644
--- a/2021/23xxx/CVE-2021-23094.json
+++ b/2021/23xxx/CVE-2021-23094.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23094",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23095.json b/2021/23xxx/CVE-2021-23095.json
index d9697b5f9915..d3a40b4c783b 100644
--- a/2021/23xxx/CVE-2021-23095.json
+++ b/2021/23xxx/CVE-2021-23095.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23095",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23096.json b/2021/23xxx/CVE-2021-23096.json
index 3a9cf1f5149d..0658f6df2c93 100644
--- a/2021/23xxx/CVE-2021-23096.json
+++ b/2021/23xxx/CVE-2021-23096.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23096",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23097.json b/2021/23xxx/CVE-2021-23097.json
index a5dafe42af21..424326fb3448 100644
--- a/2021/23xxx/CVE-2021-23097.json
+++ b/2021/23xxx/CVE-2021-23097.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23097",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23098.json b/2021/23xxx/CVE-2021-23098.json
index 89f4c4403069..0a87a1817051 100644
--- a/2021/23xxx/CVE-2021-23098.json
+++ b/2021/23xxx/CVE-2021-23098.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23098",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23099.json b/2021/23xxx/CVE-2021-23099.json
index a297e625a123..074725e482c1 100644
--- a/2021/23xxx/CVE-2021-23099.json
+++ b/2021/23xxx/CVE-2021-23099.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23099",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23100.json b/2021/23xxx/CVE-2021-23100.json
index 61ee1501d08d..8afa81faedf6 100644
--- a/2021/23xxx/CVE-2021-23100.json
+++ b/2021/23xxx/CVE-2021-23100.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23100",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23101.json b/2021/23xxx/CVE-2021-23101.json
index 6eded2df5f44..3f6d6b888067 100644
--- a/2021/23xxx/CVE-2021-23101.json
+++ b/2021/23xxx/CVE-2021-23101.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23101",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23102.json b/2021/23xxx/CVE-2021-23102.json
index fc3ded6f4670..f572aae320e7 100644
--- a/2021/23xxx/CVE-2021-23102.json
+++ b/2021/23xxx/CVE-2021-23102.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23102",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23103.json b/2021/23xxx/CVE-2021-23103.json
index 1bbefb8fdd44..9b8111d8467f 100644
--- a/2021/23xxx/CVE-2021-23103.json
+++ b/2021/23xxx/CVE-2021-23103.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23103",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23104.json b/2021/23xxx/CVE-2021-23104.json
index 2d21292e55e5..d63f587c945b 100644
--- a/2021/23xxx/CVE-2021-23104.json
+++ b/2021/23xxx/CVE-2021-23104.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23104",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23105.json b/2021/23xxx/CVE-2021-23105.json
index ec51540302dc..db20e310503c 100644
--- a/2021/23xxx/CVE-2021-23105.json
+++ b/2021/23xxx/CVE-2021-23105.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23105",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23106.json b/2021/23xxx/CVE-2021-23106.json
index 83782185e8ad..4f66e5b5f962 100644
--- a/2021/23xxx/CVE-2021-23106.json
+++ b/2021/23xxx/CVE-2021-23106.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23106",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23107.json b/2021/23xxx/CVE-2021-23107.json
index dc7a9ef8b504..55477a9fda00 100644
--- a/2021/23xxx/CVE-2021-23107.json
+++ b/2021/23xxx/CVE-2021-23107.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23107",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23108.json b/2021/23xxx/CVE-2021-23108.json
index df6552a1bed0..2a1a2329e14f 100644
--- a/2021/23xxx/CVE-2021-23108.json
+++ b/2021/23xxx/CVE-2021-23108.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23108",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23109.json b/2021/23xxx/CVE-2021-23109.json
index f7193e5c29c4..71a1086b6902 100644
--- a/2021/23xxx/CVE-2021-23109.json
+++ b/2021/23xxx/CVE-2021-23109.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23109",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23110.json b/2021/23xxx/CVE-2021-23110.json
index 87e4a480c9c4..684b9e07568e 100644
--- a/2021/23xxx/CVE-2021-23110.json
+++ b/2021/23xxx/CVE-2021-23110.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23110",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23111.json b/2021/23xxx/CVE-2021-23111.json
index e5cbd9b340ba..245dc138ece5 100644
--- a/2021/23xxx/CVE-2021-23111.json
+++ b/2021/23xxx/CVE-2021-23111.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23111",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23112.json b/2021/23xxx/CVE-2021-23112.json
index 8bf186f5faef..95d652bad6b4 100644
--- a/2021/23xxx/CVE-2021-23112.json
+++ b/2021/23xxx/CVE-2021-23112.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23112",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23113.json b/2021/23xxx/CVE-2021-23113.json
index 391ef2f0bd94..24e186c26353 100644
--- a/2021/23xxx/CVE-2021-23113.json
+++ b/2021/23xxx/CVE-2021-23113.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23113",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23114.json b/2021/23xxx/CVE-2021-23114.json
index 826ea8429cc5..fe2c5bb84476 100644
--- a/2021/23xxx/CVE-2021-23114.json
+++ b/2021/23xxx/CVE-2021-23114.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23114",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23115.json b/2021/23xxx/CVE-2021-23115.json
index 257305a6bd31..08e14146f813 100644
--- a/2021/23xxx/CVE-2021-23115.json
+++ b/2021/23xxx/CVE-2021-23115.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23115",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23116.json b/2021/23xxx/CVE-2021-23116.json
index e98a6238fe6a..3a7089d5518a 100644
--- a/2021/23xxx/CVE-2021-23116.json
+++ b/2021/23xxx/CVE-2021-23116.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23116",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23117.json b/2021/23xxx/CVE-2021-23117.json
index b8dc6be55d41..a2ec9356cdda 100644
--- a/2021/23xxx/CVE-2021-23117.json
+++ b/2021/23xxx/CVE-2021-23117.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23117",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23118.json b/2021/23xxx/CVE-2021-23118.json
index 6900409f8a99..b9444268ba2a 100644
--- a/2021/23xxx/CVE-2021-23118.json
+++ b/2021/23xxx/CVE-2021-23118.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23118",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23119.json b/2021/23xxx/CVE-2021-23119.json
index cfdca6163eba..d271d5025083 100644
--- a/2021/23xxx/CVE-2021-23119.json
+++ b/2021/23xxx/CVE-2021-23119.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23119",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23120.json b/2021/23xxx/CVE-2021-23120.json
index 7176e15f8589..ff1bd3232bff 100644
--- a/2021/23xxx/CVE-2021-23120.json
+++ b/2021/23xxx/CVE-2021-23120.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23120",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23121.json b/2021/23xxx/CVE-2021-23121.json
index 962b0da93e2c..dda9f293411e 100644
--- a/2021/23xxx/CVE-2021-23121.json
+++ b/2021/23xxx/CVE-2021-23121.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23121",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23122.json b/2021/23xxx/CVE-2021-23122.json
index 7b7579bd286f..eaa69e0e3d56 100644
--- a/2021/23xxx/CVE-2021-23122.json
+++ b/2021/23xxx/CVE-2021-23122.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-23122",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/23xxx/CVE-2021-23123.json b/2021/23xxx/CVE-2021-23123.json
index 22a10e5154b6..40aed2cdfc84 100644
--- a/2021/23xxx/CVE-2021-23123.json
+++ b/2021/23xxx/CVE-2021-23123.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-23123",
- "DATE_PUBLIC": "2021-01-12T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210101] - Core - com_modules exposes module names"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.0.0-3.9.23"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.0.0-3.9.23",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
diff --git a/2021/23xxx/CVE-2021-23124.json b/2021/23xxx/CVE-2021-23124.json
index 5b19b9dc0d95..a5645f6132cf 100644
--- a/2021/23xxx/CVE-2021-23124.json
+++ b/2021/23xxx/CVE-2021-23124.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-23124",
- "DATE_PUBLIC": "2021-01-12T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210102] - Core - XSS in mod_breadcrumbs aria-label attribute"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.9.0-3.9.23"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.9.0-3.9.23",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
diff --git a/2021/23xxx/CVE-2021-23125.json b/2021/23xxx/CVE-2021-23125.json
index e1c5ab08dce2..1e2de4fd1454 100644
--- a/2021/23xxx/CVE-2021-23125.json
+++ b/2021/23xxx/CVE-2021-23125.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-23125",
- "DATE_PUBLIC": "2021-01-12T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210103] - Core - XSS in com_tags image parameters"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.1.0-3.9.23"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.1.0-3.9.23",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
diff --git a/2021/23xxx/CVE-2021-23126.json b/2021/23xxx/CVE-2021-23126.json
index 863a397e6d8d..e6be6011d5d6 100644
--- a/2021/23xxx/CVE-2021-23126.json
+++ b/2021/23xxx/CVE-2021-23126.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-23126",
- "DATE_PUBLIC": "2021-03-02T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210301] - Core - Insecure randomness within 2FA secret generation"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.2.0-3.9.24"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.2.0-3.9.24",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
diff --git a/2021/23xxx/CVE-2021-23127.json b/2021/23xxx/CVE-2021-23127.json
index 4bae47c06611..1d2a9fc11e7d 100644
--- a/2021/23xxx/CVE-2021-23127.json
+++ b/2021/23xxx/CVE-2021-23127.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-23127",
- "DATE_PUBLIC": "2021-03-02T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210301] - Core - Insecure randomness within 2FA secret generation"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.2.0-3.9.24"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.2.0-3.9.24",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
diff --git a/2021/23xxx/CVE-2021-23128.json b/2021/23xxx/CVE-2021-23128.json
index dfa096fd89f7..68a8711f480d 100644
--- a/2021/23xxx/CVE-2021-23128.json
+++ b/2021/23xxx/CVE-2021-23128.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-23128",
- "DATE_PUBLIC": "2021-03-02T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210302] - Core - Potential Insecure FOFEncryptRandval"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.2.0-3.9.24"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.2.0-3.9.24",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
diff --git a/2021/23xxx/CVE-2021-23129.json b/2021/23xxx/CVE-2021-23129.json
index 23c79d0a621a..36eb132c50fe 100644
--- a/2021/23xxx/CVE-2021-23129.json
+++ b/2021/23xxx/CVE-2021-23129.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-23129",
- "DATE_PUBLIC": "2021-03-02T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210303] - Core - XSS within alert messages showed to users"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "2.5.0-3.9.24"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "2.5.0-3.9.24",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
diff --git a/2021/23xxx/CVE-2021-23130.json b/2021/23xxx/CVE-2021-23130.json
index cb0d8163ea74..ebfc72ae68cc 100644
--- a/2021/23xxx/CVE-2021-23130.json
+++ b/2021/23xxx/CVE-2021-23130.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-23130",
- "DATE_PUBLIC": "2021-03-02T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210304] - Core - XSS within the feed parser library"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "2.5.0-3.9.24"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "2.5.0-3.9.24",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
diff --git a/2021/23xxx/CVE-2021-23131.json b/2021/23xxx/CVE-2021-23131.json
index c129e3761861..d50446400600 100644
--- a/2021/23xxx/CVE-2021-23131.json
+++ b/2021/23xxx/CVE-2021-23131.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-23131",
- "DATE_PUBLIC": "2021-03-02T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210305] - Core - Input validation within the template manager"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.2.0-3.9.24"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.2.0-3.9.24",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
diff --git a/2021/23xxx/CVE-2021-23132.json b/2021/23xxx/CVE-2021-23132.json
index 94fbecf5927e..3caa20fa25d0 100644
--- a/2021/23xxx/CVE-2021-23132.json
+++ b/2021/23xxx/CVE-2021-23132.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-23132",
- "DATE_PUBLIC": "2021-03-02T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210306] - Core - com_media allowed paths that are not intended for image uploads"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.0.0-3.9.24"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.0.0-3.9.24",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
diff --git a/2021/23xxx/CVE-2021-23892.json b/2021/23xxx/CVE-2021-23892.json
index f745ca64255c..dc2d14958c01 100644
--- a/2021/23xxx/CVE-2021-23892.json
+++ b/2021/23xxx/CVE-2021-23892.json
@@ -1,13 +1,38 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "psirt@mcafee.com",
"ID": "CVE-2021-23892",
+ "ASSIGNER": "trellixpsirt@trellix.com",
"STATE": "PUBLIC"
},
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "By exploiting a time of check to time of use (TOCTOU) race condition during the Endpoint Security for Linux Threat Prevention and Firewall (ENSL TP/FW) installation process, a local user can perform a privilege escalation attack to obtain administrator privileges for the purpose of executing arbitrary code through insecure use of predictable temporary file locations."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-59: Improper Link Resolution Before File Access ('Link Following')",
+ "cweId": "CWE-59"
+ }
+ ]
+ }
+ ]
+ },
"affects": {
"vendor": {
"vendor_data": [
{
+ "vendor_name": "McAfee,LLC",
"product": {
"product_data": [
{
@@ -15,72 +40,49 @@
"version": {
"version_data": [
{
- "platform": "Linux",
- "version_affected": "<",
- "version_value": "10.7.5"
+ "version_value": "unspecified",
+ "version_affected": "="
}
]
}
}
]
- },
- "vendor_name": "McAfee,LLC"
+ }
}
]
}
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
- "description": {
- "description_data": [
+ "references": {
+ "reference_data": [
{
- "lang": "eng",
- "value": "By exploiting a time of check to time of use (TOCTOU) race condition during the Endpoint Security for Linux Threat Prevention and Firewall (ENSL TP/FW) installation process, a local user can perform a privilege escalation attack to obtain administrator privileges for the purpose of executing arbitrary code through insecure use of predictable temporary file locations."
+ "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10355",
+ "refsource": "MISC",
+ "name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10355"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
- "impact": {
- "cvss": {
- "attackComplexity": "LOW",
- "attackVector": "LOCAL",
- "availabilityImpact": "HIGH",
- "baseScore": 8.2,
- "baseSeverity": "HIGH",
- "confidentialityImpact": "HIGH",
- "integrityImpact": "HIGH",
- "privilegesRequired": "LOW",
- "scope": "CHANGED",
- "userInteraction": "REQUIRED",
- "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
- "version": "3.1"
- }
- },
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-362: Time-of-check Time-of-use (TOCTOU) Race Condition"
- }
- ]
- }
- ]
+ "source": {
+ "discovery": "UNKNOWN"
},
- "references": {
- "reference_data": [
+ "impact": {
+ "cvss": [
{
- "name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10355",
- "refsource": "CONFIRM",
- "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10355"
+ "attackComplexity": "LOW",
+ "attackVector": "LOCAL",
+ "availabilityImpact": "HIGH",
+ "baseScore": 8.2,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
+ "version": "3.1"
}
]
- },
- "source": {
- "discovery": "UNKNOWN"
}
-}
+}
\ No newline at end of file
diff --git a/2021/24xxx/CVE-2021-24119.json b/2021/24xxx/CVE-2021-24119.json
index 4cebd8341526..a8795422efe1 100644
--- a/2021/24xxx/CVE-2021-24119.json
+++ b/2021/24xxx/CVE-2021-24119.json
@@ -1,35 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-24119",
+ "ASSIGNER": "cve@mitre.org",
"STATE": "PUBLIC"
},
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "n/a",
- "version": {
- "version_data": [
- {
- "version_value": "n/a"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "n/a"
- }
- ]
- }
- },
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -50,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
@@ -58,24 +59,29 @@
"name": "https://github.com/ARMmbed/mbedtls/releases"
},
{
+ "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html",
"refsource": "MISC",
- "name": "https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publication.md",
- "url": "https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publication.md"
+ "name": "https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html"
},
{
- "refsource": "FEDORA",
- "name": "FEDORA-2021-10bfc067d1",
- "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DRRVY7DMTX3ECFNZKDYTSFEG5AI2HBC6/"
+ "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html",
+ "refsource": "MISC",
+ "name": "https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html"
+ },
+ {
+ "url": "https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publication.md",
+ "refsource": "MISC",
+ "name": "https://github.com/UzL-ITS/util-lookup/blob/main/cve-vulnerability-publication.md"
},
{
- "refsource": "FEDORA",
- "name": "FEDORA-2021-165969af24",
- "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EYJW7HAW3TDV2YMDFYXP3HD6WRQRTLJW/"
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRRVY7DMTX3ECFNZKDYTSFEG5AI2HBC6/",
+ "refsource": "MISC",
+ "name": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DRRVY7DMTX3ECFNZKDYTSFEG5AI2HBC6/"
},
{
- "refsource": "MLIST",
- "name": "[debian-lts-announce] 20211123 [SECURITY] [DLA 2826-1] mbedtls security update",
- "url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00021.html"
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYJW7HAW3TDV2YMDFYXP3HD6WRQRTLJW/",
+ "refsource": "MISC",
+ "name": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EYJW7HAW3TDV2YMDFYXP3HD6WRQRTLJW/"
}
]
}
diff --git a/2021/24xxx/CVE-2021-24417.json b/2021/24xxx/CVE-2021-24417.json
index abafb51c4c96..0bba8eb55e3e 100644
--- a/2021/24xxx/CVE-2021-24417.json
+++ b/2021/24xxx/CVE-2021-24417.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-24417",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/24xxx/CVE-2021-24942.json b/2021/24xxx/CVE-2021-24942.json
index f11e75174da9..086b2efef2eb 100644
--- a/2021/24xxx/CVE-2021-24942.json
+++ b/2021/24xxx/CVE-2021-24942.json
@@ -1,18 +1,79 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-24942",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "contact@wpscan.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the \"Visibility logic\" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-94 Improper Control of Generation of Code ('Code Injection')"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Unknown",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Menu Item Visibility Control",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://wpscan.com/vulnerability/eaa28832-74c1-4cd5-9b0f-02338e23b418",
+ "refsource": "MISC",
+ "name": "https://wpscan.com/vulnerability/eaa28832-74c1-4cd5-9b0f-02338e23b418"
}
]
- }
+ },
+ "generator": {
+ "engine": "WPScan CVE Generator"
+ },
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "bl4derunner"
+ },
+ {
+ "lang": "en",
+ "value": "WPScan"
+ }
+ ]
}
\ No newline at end of file
diff --git a/2021/25xxx/CVE-2021-25221.json b/2021/25xxx/CVE-2021-25221.json
index 5dde8de02ea7..5b457791dd63 100644
--- a/2021/25xxx/CVE-2021-25221.json
+++ b/2021/25xxx/CVE-2021-25221.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-25221",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/25xxx/CVE-2021-25222.json b/2021/25xxx/CVE-2021-25222.json
index c8b4372b4200..207ded62533b 100644
--- a/2021/25xxx/CVE-2021-25222.json
+++ b/2021/25xxx/CVE-2021-25222.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-25222",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/25xxx/CVE-2021-25223.json b/2021/25xxx/CVE-2021-25223.json
index 70faa8405dea..8aa3038fdddf 100644
--- a/2021/25xxx/CVE-2021-25223.json
+++ b/2021/25xxx/CVE-2021-25223.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-25223",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/26xxx/CVE-2021-26027.json b/2021/26xxx/CVE-2021-26027.json
index 7f712eea8642..4b469ce781d5 100644
--- a/2021/26xxx/CVE-2021-26027.json
+++ b/2021/26xxx/CVE-2021-26027.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-26027",
- "DATE_PUBLIC": "2021-03-02T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210307] - Core - ACL violation within com_content frontend editing"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.0.0-3.9.24"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.0.0-3.9.24",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
diff --git a/2021/26xxx/CVE-2021-26028.json b/2021/26xxx/CVE-2021-26028.json
index 137dd99588ea..d8da05c8c172 100644
--- a/2021/26xxx/CVE-2021-26028.json
+++ b/2021/26xxx/CVE-2021-26028.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-26028",
- "DATE_PUBLIC": "2021-03-02T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210308] - Core - Path Traversal within joomla/archive zip class"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.0.0-3.9.24"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.0.0-3.9.24",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
diff --git a/2021/26xxx/CVE-2021-26029.json b/2021/26xxx/CVE-2021-26029.json
index 2c035fc0ece0..c4ec32915f66 100644
--- a/2021/26xxx/CVE-2021-26029.json
+++ b/2021/26xxx/CVE-2021-26029.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-26029",
- "DATE_PUBLIC": "2021-03-02T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210309] - Core - Inadequate filtering of form contents could allow to overwrite the author field"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "1.6.0-3.9.24"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.6.0-3.9.24",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
diff --git a/2021/26xxx/CVE-2021-26030.json b/2021/26xxx/CVE-2021-26030.json
index 5e6f5bb46c24..86c68565354e 100644
--- a/2021/26xxx/CVE-2021-26030.json
+++ b/2021/26xxx/CVE-2021-26030.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-26030",
- "DATE_PUBLIC": "2021-04-13T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210401] - Core - Escape xss in logo parameter error pages"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.0.0-3.9.25"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.0.0-3.9.25",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
@@ -61,4 +60,4 @@
}
]
}
-}
+}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26031.json b/2021/26xxx/CVE-2021-26031.json
index d14e77c79a21..62fb7fb1b648 100644
--- a/2021/26xxx/CVE-2021-26031.json
+++ b/2021/26xxx/CVE-2021-26031.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-26031",
- "DATE_PUBLIC": "2021-04-13T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210402] - Core - Inadequate filters on module layout settings"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.0.0-3.9.25"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.0.0-3.9.25",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
@@ -61,4 +60,4 @@
}
]
}
-}
+}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26032.json b/2021/26xxx/CVE-2021-26032.json
index d185db909332..b28012fcac3c 100644
--- a/2021/26xxx/CVE-2021-26032.json
+++ b/2021/26xxx/CVE-2021-26032.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-26032",
- "DATE_PUBLIC": "2021-05-25T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210501] - Core - Adding HTML to the executable block list of MediaHelper::canUpload"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.0.0-3.9.26"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.0.0-3.9.26",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
@@ -61,4 +60,4 @@
}
]
}
-}
+}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26033.json b/2021/26xxx/CVE-2021-26033.json
index d2d7e2bc6981..adbd048a2850 100644
--- a/2021/26xxx/CVE-2021-26033.json
+++ b/2021/26xxx/CVE-2021-26033.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-26033",
- "DATE_PUBLIC": "2021-05-25T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210502] - Core - CSRF in AJAX reordering endpoint"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.0.0-3.9.26"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.0.0-3.9.26",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
@@ -61,4 +60,4 @@
}
]
}
-}
+}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26034.json b/2021/26xxx/CVE-2021-26034.json
index 183b17360965..d261a3047791 100644
--- a/2021/26xxx/CVE-2021-26034.json
+++ b/2021/26xxx/CVE-2021-26034.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-26034",
- "DATE_PUBLIC": "2021-05-25T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210503] - Core - CSRF in data download endpoints"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.0.0-3.9.26"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.0.0-3.9.26",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
@@ -61,4 +60,4 @@
}
]
}
-}
+}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26035.json b/2021/26xxx/CVE-2021-26035.json
index 238cab02f991..78b2b90c5fab 100644
--- a/2021/26xxx/CVE-2021-26035.json
+++ b/2021/26xxx/CVE-2021-26035.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-26035",
- "DATE_PUBLIC": "2021-07-06T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210701] - Core - XSS in JForm Rules field"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.0.0-3.9.27"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.0.0-3.9.27",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
@@ -61,4 +60,4 @@
}
]
}
-}
+}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26036.json b/2021/26xxx/CVE-2021-26036.json
index cb959a55d15f..eceb78699595 100644
--- a/2021/26xxx/CVE-2021-26036.json
+++ b/2021/26xxx/CVE-2021-26036.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-26036",
- "DATE_PUBLIC": "2021-07-06T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210702] - Core - DoS through usergroup table manipulation"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "2.5.0-3.9.27"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "2.5.0-3.9.27",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
@@ -61,4 +60,4 @@
}
]
}
-}
+}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26037.json b/2021/26xxx/CVE-2021-26037.json
index a29523ef892e..31249ebd319c 100644
--- a/2021/26xxx/CVE-2021-26037.json
+++ b/2021/26xxx/CVE-2021-26037.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-26037",
- "DATE_PUBLIC": "2021-07-06T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210703] - Core - Lack of enforced session termination"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "2.5.0-3.9.27"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "2.5.0-3.9.27",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
@@ -61,4 +60,4 @@
}
]
}
-}
+}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26038.json b/2021/26xxx/CVE-2021-26038.json
index 97073cf72c73..816f9dcf810f 100644
--- a/2021/26xxx/CVE-2021-26038.json
+++ b/2021/26xxx/CVE-2021-26038.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-26038",
- "DATE_PUBLIC": "2021-07-06T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210704] - Core - Privilege escalation through com_installer"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "2.5.0-3.9.27"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "2.5.0-3.9.27",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
@@ -61,4 +60,4 @@
}
]
}
-}
+}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26039.json b/2021/26xxx/CVE-2021-26039.json
index 60ccbba06d97..eade96290ccc 100644
--- a/2021/26xxx/CVE-2021-26039.json
+++ b/2021/26xxx/CVE-2021-26039.json
@@ -1,37 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
"ID": "CVE-2021-26039",
- "DATE_PUBLIC": "2021-07-06T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210705] - Core - XSS in com_media imagelist"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "3.0.0-3.9.27"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -52,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.0.0-3.9.27",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
@@ -61,4 +60,4 @@
}
]
}
-}
+}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26040.json b/2021/26xxx/CVE-2021-26040.json
index 0f62ee370280..8ffb5d353418 100644
--- a/2021/26xxx/CVE-2021-26040.json
+++ b/2021/26xxx/CVE-2021-26040.json
@@ -1,64 +1,63 @@
-{
- "CVE_data_meta": {
- "ASSIGNER": "security@joomla.org",
- "ID": "CVE-2021-26040",
- "DATE_PUBLIC": "2021-08-24T16:00:00",
- "STATE": "PUBLIC",
- "TITLE": "[20210801] - Core - Insufficient access control for com_media deletion endpoint"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "Joomla! CMS",
- "version": {
- "version_data": [
- {
- "version_value": "4.0.0"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "Joomla! Project"
- }
- ]
- }
- },
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command."
- }
- ]
- },
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CSRF"
- }
- ]
- }
- ]
- },
- "references": {
- "reference_data": [
- {
- "url": "https://developer.joomla.org/security-centre/861-20210801-core-insufficient-access-control-for-com-media-deletion-endpoint",
- "refsource": "MISC",
- "name": "https://developer.joomla.org/security-centre/861-20210801-core-insufficient-access-control-for-com-media-deletion-endpoint"
- }
- ]
- }
-}
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-26040",
+ "ASSIGNER": "security@joomla.org",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "An issue was discovered in Joomla! 4.0.0. The media manager does not correctly check the user's permissions before executing a file deletion command."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CSRF"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Joomla! Project",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Joomla! CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "4.0.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://developer.joomla.org/security-centre/861-20210801-core-insufficient-access-control-for-com-media-deletion-endpoint",
+ "refsource": "MISC",
+ "name": "https://developer.joomla.org/security-centre/861-20210801-core-insufficient-access-control-for-com-media-deletion-endpoint"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26316.json b/2021/26xxx/CVE-2021-26316.json
index 94a8266540ec..206bd83c297c 100644
--- a/2021/26xxx/CVE-2021-26316.json
+++ b/2021/26xxx/CVE-2021-26316.json
@@ -1,18 +1,137 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-26316",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting in potential SMM (System Management Mode) arbitrary code execution."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": " AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Ryzen 5000 Series ",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Ryzen 2000 Series",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ {
+ "vendor_name": "AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Ryzen 3000 Series",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "1st Gen EPYC ",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "2nd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "3rd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031"
+ },
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
}
]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1031, AMD-SB-1032",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26328.json b/2021/26xxx/CVE-2021-26328.json
index 3f6b90b5e6e2..09c9c7ba8818 100644
--- a/2021/26xxx/CVE-2021-26328.json
+++ b/2021/26xxx/CVE-2021-26328.json
@@ -1,18 +1,70 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-26328",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Failure to verify the mode of CPU execution at the time of SNP_INIT may lead to a potential loss of memory integrity for SNP guests."
}
]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "3rd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1032",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26343.json b/2021/26xxx/CVE-2021-26343.json
index 0bde4d281a40..f79813d716df 100644
--- a/2021/26xxx/CVE-2021-26343.json
+++ b/2021/26xxx/CVE-2021-26343.json
@@ -1,18 +1,70 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-26343",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memory which may result in information disclosure."
}
]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "3rd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1032",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26346.json b/2021/26xxx/CVE-2021-26346.json
index 085da27a9967..7c055f35d1db 100644
--- a/2021/26xxx/CVE-2021-26346.json
+++ b/2021/26xxx/CVE-2021-26346.json
@@ -1,18 +1,70 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-26346",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service."
}
]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": " AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Ryzen 5000 Series",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1031",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26347.json b/2021/26xxx/CVE-2021-26347.json
index 8a9a61b90883..593618db2ca0 100644
--- a/2021/26xxx/CVE-2021-26347.json
+++ b/2021/26xxx/CVE-2021-26347.json
@@ -1,71 +1,70 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "psirt@amd.com",
- "DATE_PUBLIC": "2022-05-10T20:00:00.000Z",
"ID": "CVE-2021-26347",
+ "ASSIGNER": "psirt@amd.com",
"STATE": "PUBLIC"
},
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in the L2 directory table in SPI flash resulting in a potential denial of service."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
"affects": {
"vendor": {
"vendor_data": [
{
+ "vendor_name": " AMD",
"product": {
"product_data": [
{
- "product_name": " EPYC\u2122 Processors ",
+ "product_name": "Ryzen 5000 Series",
"version": {
"version_data": [
{
- "version_affected": "=",
- "version_value": "various "
+ "version_value": "various ",
+ "version_affected": "="
}
]
}
}
]
- },
- "vendor_name": "AMD"
+ }
}
]
}
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "TOCTOU (time-of-check to time-of-use) issue in the System Management Unit (SMU) may result in a DMA (Direct Memory Access) to invalid DRAM address that could result in denial of service."
- }
- ]
- },
- "generator": {
- "engine": "Vulnogram 0.0.9"
- },
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "tbd"
- }
- ]
- }
- ]
- },
"references": {
"reference_data": [
{
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031",
"refsource": "MISC",
- "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028",
- "name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1028"
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031"
}
]
},
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
"source": {
- "advisory": "AMD-SB-1028",
+ "advisory": "AMD-SB-1031",
"discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26353.json b/2021/26xxx/CVE-2021-26353.json
index 8ead05f2c984..54376f3531e7 100644
--- a/2021/26xxx/CVE-2021-26353.json
+++ b/2021/26xxx/CVE-2021-26353.json
@@ -1,71 +1,70 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "psirt@amd.com",
- "DATE_PUBLIC": "2022-05-06T20:00:00.000Z",
"ID": "CVE-2021-26353",
+ "ASSIGNER": "psirt@amd.com",
"STATE": "PUBLIC"
},
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "Failure to validate inputs in SMM may allow an attacker to create a mishandled error leaving the DRTM UApp in a partially initialized state potentially resulting in loss of memory integrity."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
"affects": {
"vendor": {
"vendor_data": [
{
+ "vendor_name": "AMD",
"product": {
"product_data": [
{
- "product_name": "3rd Gen AMD EPYC\u2122",
+ "product_name": "3rd Gen EPYC",
"version": {
"version_data": [
{
- "version_affected": "<",
- "version_value": "MilanPI-SP3_1.0.0.4"
+ "version_value": "various ",
+ "version_affected": "="
}
]
}
}
]
- },
- "vendor_name": "AMD"
+ }
}
]
}
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "Due to a mishandled error, it is possible to leave the DRTM UApp in a partially initialized state, which can result in unchecked memory writes when the UApp handles subsequent mailbox commands."
- }
- ]
- },
- "generator": {
- "engine": "Vulnogram 0.0.9"
- },
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-665 Improper Initialization"
- }
- ]
- }
- ]
- },
"references": {
"reference_data": [
{
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
"refsource": "MISC",
- "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1021",
- "name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1021"
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
}
]
},
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
"source": {
- "advisory": "AMD-SB-1021",
+ "advisory": "AMD-SB-1032",
"discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26355.json b/2021/26xxx/CVE-2021-26355.json
index 2857512ecda5..ef96b8122f36 100644
--- a/2021/26xxx/CVE-2021-26355.json
+++ b/2021/26xxx/CVE-2021-26355.json
@@ -1,18 +1,70 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-26355",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in a potential denial-of-service."
}
]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "3rd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1032",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26396.json b/2021/26xxx/CVE-2021-26396.json
index f70070edf150..c8766a09634f 100644
--- a/2021/26xxx/CVE-2021-26396.json
+++ b/2021/26xxx/CVE-2021-26396.json
@@ -1,18 +1,70 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-26396",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest."
}
]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "3rd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1032",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26398.json b/2021/26xxx/CVE-2021-26398.json
index 455ec41a3b78..30a417f7c402 100644
--- a/2021/26xxx/CVE-2021-26398.json
+++ b/2021/26xxx/CVE-2021-26398.json
@@ -1,18 +1,92 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-26398",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Insufficient input validation in SYS_KEY_DERIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure Processor) OS memory which may lead to potential arbitrary code execution."
}
]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "1st Gen EPYC ",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "2nd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "3rd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1032",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26402.json b/2021/26xxx/CVE-2021-26402.json
index 54a7bb00d1eb..ae066413d47c 100644
--- a/2021/26xxx/CVE-2021-26402.json
+++ b/2021/26xxx/CVE-2021-26402.json
@@ -1,18 +1,81 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-26402",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Insufficient bounds checking in ASP (AMD Secure Processor) firmware while handling BIOS mailbox commands, may allow an attacker to write partially-controlled data out-of-bounds to SMM or SEV-ES regions which may lead to a potential loss of integrity and availability."
}
]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "2nd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "3rd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1032",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26403.json b/2021/26xxx/CVE-2021-26403.json
index 7382038a6d80..2cebbe5c7503 100644
--- a/2021/26xxx/CVE-2021-26403.json
+++ b/2021/26xxx/CVE-2021-26403.json
@@ -1,18 +1,88 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-26403",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Insufficient checks in SEV may lead to a malicious hypervisor disclosing the launch secret potentially resulting in compromise of VM confidentiality."
}
]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "1st Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ {
+ "vendor_name": " AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "2nd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1032",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26404.json b/2021/26xxx/CVE-2021-26404.json
index 5440fad7823c..70462010010e 100644
--- a/2021/26xxx/CVE-2021-26404.json
+++ b/2021/26xxx/CVE-2021-26404.json
@@ -1,18 +1,70 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-26404",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Improper input validation and bounds checking in SEV firmware may leak scratch buffer bytes leading to potential information disclosure."
}
]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "3rd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1032",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26407.json b/2021/26xxx/CVE-2021-26407.json
index d23ae3bcec75..5accddd51ad0 100644
--- a/2021/26xxx/CVE-2021-26407.json
+++ b/2021/26xxx/CVE-2021-26407.json
@@ -1,18 +1,70 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-26407",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A randomly generated Initialization Vector (IV) may lead to a collision of IVs with the same key potentially resulting in information disclosure."
}
]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": " AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "2nd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1032",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26409.json b/2021/26xxx/CVE-2021-26409.json
index 945d5e466eb4..50e0429c9048 100644
--- a/2021/26xxx/CVE-2021-26409.json
+++ b/2021/26xxx/CVE-2021-26409.json
@@ -1,18 +1,70 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-26409",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Insufficient bounds checking in SEV-ES may allow an attacker to corrupt Reverse Map table (RMP) memory, potentially resulting in a loss of SNP (Secure Nested Paging) memory integrity."
}
]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "3rd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1032",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/26xxx/CVE-2021-26568.json b/2021/26xxx/CVE-2021-26568.json
index 079c40dc95db..b1c4eb5beec3 100644
--- a/2021/26xxx/CVE-2021-26568.json
+++ b/2021/26xxx/CVE-2021-26568.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-26568",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/27xxx/CVE-2021-27650.json b/2021/27xxx/CVE-2021-27650.json
index 132b2f5b97ff..03d131db688c 100644
--- a/2021/27xxx/CVE-2021-27650.json
+++ b/2021/27xxx/CVE-2021-27650.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-27650",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/28xxx/CVE-2021-28544.json b/2021/28xxx/CVE-2021-28544.json
index fa81717e5214..05a081606d0c 100644
--- a/2021/28xxx/CVE-2021-28544.json
+++ b/2021/28xxx/CVE-2021-28544.json
@@ -1,14 +1,38 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@apache.org",
"ID": "CVE-2021-28544",
- "STATE": "PUBLIC",
- "TITLE": "Apache Subversion SVN authz protected copyfrom paths regression"
+ "ASSIGNER": "security@apache.org",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
+ "cweId": "CWE-200"
+ }
+ ]
+ }
+ ]
},
"affects": {
"vendor": {
"vendor_data": [
{
+ "vendor_name": "Apache Software Foundation",
"product": {
"product_data": [
{
@@ -16,88 +40,62 @@
"version": {
"version_data": [
{
- "version_value": "1.10.0 to 1.14.1"
+ "version_value": "1.10.0 to 1.14.1",
+ "version_affected": "="
}
]
}
}
]
- },
- "vendor_name": "Apache Software Foundation"
+ }
}
]
}
},
- "credit": [
- {
- "lang": "eng",
- "value": "Apache Subversion would like to thank Evgeny Kotkov, visualsvn.com."
- }
- ],
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable."
- }
- ]
- },
- "generator": {
- "engine": "Vulnogram 0.0.9"
- },
- "impact": [
- {}
- ],
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-287 Improper Authentication"
- }
- ]
- }
- ]
- },
"references": {
"reference_data": [
{
- "refsource": "MISC",
"url": "https://subversion.apache.org/security/CVE-2021-28544-advisory.txt",
+ "refsource": "MISC",
"name": "https://subversion.apache.org/security/CVE-2021-28544-advisory.txt"
},
{
- "refsource": "DEBIAN",
- "name": "DSA-5119",
- "url": "https://www.debian.org/security/2022/dsa-5119"
+ "url": "https://www.debian.org/security/2022/dsa-5119",
+ "refsource": "MISC",
+ "name": "https://www.debian.org/security/2022/dsa-5119"
},
{
- "refsource": "FEDORA",
- "name": "FEDORA-2022-13cc09ecf2",
- "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/"
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/",
+ "refsource": "MISC",
+ "name": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/"
},
{
- "refsource": "FEDORA",
- "name": "FEDORA-2022-2af658b090",
- "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/"
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/",
+ "refsource": "MISC",
+ "name": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/"
},
{
- "refsource": "CONFIRM",
- "name": "https://support.apple.com/kb/HT213345",
- "url": "https://support.apple.com/kb/HT213345"
+ "url": "https://support.apple.com/kb/HT213345",
+ "refsource": "MISC",
+ "name": "https://support.apple.com/kb/HT213345"
},
{
- "refsource": "FULLDISC",
- "name": "20220721 APPLE-SA-2022-07-20-2 macOS Monterey 12.5",
- "url": "http://seclists.org/fulldisclosure/2022/Jul/18"
+ "url": "http://seclists.org/fulldisclosure/2022/Jul/18",
+ "refsource": "MISC",
+ "name": "http://seclists.org/fulldisclosure/2022/Jul/18"
}
]
},
+ "generator": {
+ "engine": "Vulnogram 0.0.9"
+ },
"source": {
"discovery": "UNKNOWN"
- }
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Apache Subversion would like to thank Evgeny Kotkov, visualsvn.com."
+ }
+ ]
}
\ No newline at end of file
diff --git a/2021/28xxx/CVE-2021-28655.json b/2021/28xxx/CVE-2021-28655.json
index 0728d13e556b..54011db15cd3 100644
--- a/2021/28xxx/CVE-2021-28655.json
+++ b/2021/28xxx/CVE-2021-28655.json
@@ -1,18 +1,76 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-28655",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@apache.org",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The improper Input Validation vulnerability in \"\u201dMove folder to Trash\u201d feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-20 Improper Input Validation",
+ "cweId": "CWE-20"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Apache Software Foundation",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Apache Zeppelin",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://lists.apache.org/thread/bxs056g3xlsofz0jb3wny9dw4llwptd2",
+ "refsource": "MISC",
+ "name": "https://lists.apache.org/thread/bxs056g3xlsofz0jb3wny9dw4llwptd2"
}
]
- }
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Kai Zhao"
+ }
+ ]
}
\ No newline at end of file
diff --git a/2021/29xxx/CVE-2021-29458.json b/2021/29xxx/CVE-2021-29458.json
index 21c767b843f6..fd89e1874395 100644
--- a/2021/29xxx/CVE-2021-29458.json
+++ b/2021/29xxx/CVE-2021-29458.json
@@ -77,6 +77,11 @@
"refsource": "FEDORA",
"name": "FEDORA-2021-be94728b95",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P2A5GMJEXQ5Q76JK6F6VKK5JYCLVFGKN/"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
}
]
},
diff --git a/2021/2xxx/CVE-2021-2175.json b/2021/2xxx/CVE-2021-2175.json
index adaac141d4dc..d6c337628940 100644
--- a/2021/2xxx/CVE-2021-2175.json
+++ b/2021/2xxx/CVE-2021-2175.json
@@ -81,6 +81,11 @@
"refsource": "MISC",
"name": "https://databasesecurityninja.wordpress.com/2022/02/02/cve-2021-2175-database-vault-metadata-exposure-vulnerability/",
"url": "https://databasesecurityninja.wordpress.com/2022/02/02/cve-2021-2175-database-vault-metadata-exposure-vulnerability/"
+ },
+ {
+ "refsource": "MISC",
+ "name": "http://packetstormsecurity.com/files/170373/Oracle-Database-Vault-Metadata-Exposure.html",
+ "url": "http://packetstormsecurity.com/files/170373/Oracle-Database-Vault-Metadata-Exposure.html"
}
]
}
diff --git a/2021/30xxx/CVE-2021-30134.json b/2021/30xxx/CVE-2021-30134.json
index e38af2448264..ea3a244427d3 100644
--- a/2021/30xxx/CVE-2021-30134.json
+++ b/2021/30xxx/CVE-2021-30134.json
@@ -1,17 +1,62 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-30134",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://wpscan.com/vulnerability/0b547728-27d2-402e-ae17-90d539344ec7",
+ "refsource": "MISC",
+ "name": "https://wpscan.com/vulnerability/0b547728-27d2-402e-ae17-90d539344ec7"
}
]
}
diff --git a/2021/30xxx/CVE-2021-30558.json b/2021/30xxx/CVE-2021-30558.json
index a7f2fc3687ad..6a053a81f101 100644
--- a/2021/30xxx/CVE-2021-30558.json
+++ b/2021/30xxx/CVE-2021-30558.json
@@ -1,17 +1,67 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-30558",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "chrome-cve-admin@google.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chrome security severity: Medium)"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Insufficient policy enforcement"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Google",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Chrome",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.0.4472.77",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html",
+ "refsource": "MISC",
+ "name": "https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html"
+ },
+ {
+ "url": "https://crbug.com/916326",
+ "refsource": "MISC",
+ "name": "https://crbug.com/916326"
}
]
}
diff --git a/2021/31xxx/CVE-2021-31650.json b/2021/31xxx/CVE-2021-31650.json
index 532b98b921ba..72b769836ab7 100644
--- a/2021/31xxx/CVE-2021-31650.json
+++ b/2021/31xxx/CVE-2021-31650.json
@@ -1,17 +1,61 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
- "ID": "CVE-2021-31650",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ID": "CVE-2021-31650",
+ "STATE": "PUBLIC"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "n/a"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A SQL injection vulnerability in Sourcecodester Online Grading System 1.0 allows remote attackers to execute arbitrary SQL commands via the uname parameter."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.exploit-db.com/exploits/49493",
+ "refsource": "MISC",
+ "name": "https://www.exploit-db.com/exploits/49493"
}
]
}
diff --git a/2021/31xxx/CVE-2021-31693.json b/2021/31xxx/CVE-2021-31693.json
index dd120a263c33..fe7d639fcb85 100644
--- a/2021/31xxx/CVE-2021-31693.json
+++ b/2021/31xxx/CVE-2021-31693.json
@@ -48,6 +48,11 @@
"refsource": "MISC",
"name": "https://www.vmware.com/security/advisories/VMSA-2022-0029.html",
"url": "https://www.vmware.com/security/advisories/VMSA-2022-0029.html"
+ },
+ {
+ "refsource": "CONFIRM",
+ "name": "https://security.netapp.com/advisory/ntap-20221223-0009/",
+ "url": "https://security.netapp.com/advisory/ntap-20221223-0009/"
}
]
},
diff --git a/2021/31xxx/CVE-2021-31838.json b/2021/31xxx/CVE-2021-31838.json
index 13989c8f0af3..362a5a62e2c8 100644
--- a/2021/31xxx/CVE-2021-31838.json
+++ b/2021/31xxx/CVE-2021-31838.json
@@ -1,14 +1,38 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "psirt@mcafee.com",
"ID": "CVE-2021-31838",
- "STATE": "PUBLIC",
- "TITLE": "Command injection through environment variable in MVISION EDR"
+ "ASSIGNER": "trellixpsirt@trellix.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A command injection vulnerability in MVISION EDR (MVEDR) prior to 3.4.0 allows an authenticated MVEDR administrator to trigger the EDR client to execute arbitrary commands through PowerShell using the EDR functionality 'execute reaction'."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+ "cweId": "CWE-78"
+ }
+ ]
+ }
+ ]
},
"affects": {
"vendor": {
"vendor_data": [
{
+ "vendor_name": "McAfee,LLC",
"product": {
"product_data": [
{
@@ -16,71 +40,49 @@
"version": {
"version_data": [
{
- "version_affected": "<",
- "version_value": "3.4.0"
+ "version_value": "unspecified",
+ "version_affected": "="
}
]
}
}
]
- },
- "vendor_name": "McAfee,LLC"
+ }
}
]
}
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
- "description": {
- "description_data": [
+ "references": {
+ "reference_data": [
{
- "lang": "eng",
- "value": "A command injection vulnerability in MVISION EDR (MVEDR) prior to 3.4.0 allows an authenticated MVEDR administrator to trigger the EDR client to execute arbitrary commands through PowerShell using the EDR functionality 'execute reaction'."
+ "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10342",
+ "refsource": "MISC",
+ "name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10342"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
- "impact": {
- "cvss": {
- "attackComplexity": "LOW",
- "attackVector": "ADJACENT_NETWORK",
- "availabilityImpact": "HIGH",
- "baseScore": 8.4,
- "baseSeverity": "HIGH",
- "confidentialityImpact": "HIGH",
- "integrityImpact": "HIGH",
- "privilegesRequired": "HIGH",
- "scope": "CHANGED",
- "userInteraction": "NONE",
- "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
- "version": "3.1"
- }
- },
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-77 - Command injection"
- }
- ]
- }
- ]
+ "source": {
+ "discovery": "INTERNAL"
},
- "references": {
- "reference_data": [
+ "impact": {
+ "cvss": [
{
- "name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10342",
- "refsource": "CONFIRM",
- "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10342"
+ "attackComplexity": "LOW",
+ "attackVector": "ADJACENT_NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 8.4,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "HIGH",
+ "scope": "CHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
+ "version": "3.1"
}
]
- },
- "source": {
- "discovery": "INTERNAL"
}
-}
+}
\ No newline at end of file
diff --git a/2021/31xxx/CVE-2021-31843.json b/2021/31xxx/CVE-2021-31843.json
index d726c3bd110e..adbffd37415a 100644
--- a/2021/31xxx/CVE-2021-31843.json
+++ b/2021/31xxx/CVE-2021-31843.json
@@ -1,14 +1,38 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "psirt@mcafee.com",
"ID": "CVE-2021-31843",
- "STATE": "PUBLIC",
- "TITLE": "Improper access control vulnerability in McAfee ENS for Windows"
+ "ASSIGNER": "trellixpsirt@trellix.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "Improper privileges management vulnerability in McAfee Endpoint Security (ENS) Windows prior to 10.7.0 September 2021 Update allows local users to access files which they would otherwise not have access to via manipulating junction links to redirect McAfee folder operations to an unintended location."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-59: Improper Link Resolution Before File Access ('Link Following')",
+ "cweId": "CWE-59"
+ }
+ ]
+ }
+ ]
},
"affects": {
"vendor": {
"vendor_data": [
{
+ "vendor_name": "McAfee,LLC",
"product": {
"product_data": [
{
@@ -16,71 +40,49 @@
"version": {
"version_data": [
{
- "version_affected": "<",
- "version_value": "10.7.0 September 2021 Update"
+ "version_value": "unspecified",
+ "version_affected": "="
}
]
}
}
]
- },
- "vendor_name": "McAfee,LLC"
+ }
}
]
}
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
- "description": {
- "description_data": [
+ "references": {
+ "reference_data": [
{
- "lang": "eng",
- "value": "Improper privileges management vulnerability in McAfee Endpoint Security (ENS) Windows prior to 10.7.0 September 2021 Update allows local users to access files which they would otherwise not have access to via manipulating junction links to redirect McAfee folder operations to an unintended location."
+ "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10367",
+ "refsource": "MISC",
+ "name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10367"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
- "impact": {
- "cvss": {
- "attackComplexity": "LOW",
- "attackVector": "LOCAL",
- "availabilityImpact": "HIGH",
- "baseScore": 7.3,
- "baseSeverity": "HIGH",
- "confidentialityImpact": "HIGH",
- "integrityImpact": "HIGH",
- "privilegesRequired": "LOW",
- "scope": "UNCHANGED",
- "userInteraction": "REQUIRED",
- "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
- "version": "3.1"
- }
- },
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-269: Improper Privileges Management"
- }
- ]
- }
- ]
+ "source": {
+ "discovery": "UNKNOWN"
},
- "references": {
- "reference_data": [
+ "impact": {
+ "cvss": [
{
- "name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10367",
- "refsource": "CONFIRM",
- "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10367"
+ "attackComplexity": "LOW",
+ "attackVector": "LOCAL",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.3,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
+ "version": "3.1"
}
]
- },
- "source": {
- "discovery": "UNKNOWN"
}
-}
+}
\ No newline at end of file
diff --git a/2021/31xxx/CVE-2021-31854.json b/2021/31xxx/CVE-2021-31854.json
index 803a24c4647f..fa12d17558c1 100644
--- a/2021/31xxx/CVE-2021-31854.json
+++ b/2021/31xxx/CVE-2021-31854.json
@@ -1,14 +1,38 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "psirt@mcafee.com",
"ID": "CVE-2021-31854",
- "STATE": "PUBLIC",
- "TITLE": "Code injection vulnerability in McAfee Agent"
+ "ASSIGNER": "trellixpsirt@trellix.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A command Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.7.5 allows local users to inject arbitrary shell code into the file cleanup.exe. The malicious clean.exe file is placed into the relevant folder and executed by running the McAfee Agent deployment feature located in the System Tree. An attacker may exploit the vulnerability to obtain a reverse shell which can lead to privilege escalation to obtain root privileges."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')",
+ "cweId": "CWE-78"
+ }
+ ]
+ }
+ ]
},
"affects": {
"vendor": {
"vendor_data": [
{
+ "vendor_name": "McAfee,LLC",
"product": {
"product_data": [
{
@@ -16,72 +40,49 @@
"version": {
"version_data": [
{
- "platform": "Windows",
- "version_affected": "<",
- "version_value": "5.7.5"
+ "version_value": "unspecified",
+ "version_affected": "="
}
]
}
}
]
- },
- "vendor_name": "McAfee,LLC"
+ }
}
]
}
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
- "description": {
- "description_data": [
+ "references": {
+ "reference_data": [
{
- "lang": "eng",
- "value": "A command Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.7.5 allows local users to inject arbitrary shell code into the file cleanup.exe. The malicious clean.exe file is placed into the relevant folder and executed by running the McAfee Agent deployment feature located in the System Tree. An attacker may exploit the vulnerability to obtain a reverse shell which can lead to privilege escalation to obtain root privileges."
+ "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10378",
+ "refsource": "MISC",
+ "name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10378"
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
- "impact": {
- "cvss": {
- "attackComplexity": "LOW",
- "attackVector": "LOCAL",
- "availabilityImpact": "HIGH",
- "baseScore": 7.7,
- "baseSeverity": "HIGH",
- "confidentialityImpact": "HIGH",
- "integrityImpact": "HIGH",
- "privilegesRequired": "HIGH",
- "scope": "CHANGED",
- "userInteraction": "REQUIRED",
- "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
- "version": "3.1"
- }
- },
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"
- }
- ]
- }
- ]
+ "source": {
+ "discovery": "EXTERNAL"
},
- "references": {
- "reference_data": [
+ "impact": {
+ "cvss": [
{
- "name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10378",
- "refsource": "CONFIRM",
- "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10378"
+ "attackComplexity": "LOW",
+ "attackVector": "LOCAL",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.7,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "HIGH",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
+ "version": "3.1"
}
]
- },
- "source": {
- "discovery": "EXTERNAL"
}
-}
+}
\ No newline at end of file
diff --git a/2021/31xxx/CVE-2021-31875.json b/2021/31xxx/CVE-2021-31875.json
index ef9b44fd3b44..1592733f8dfa 100644
--- a/2021/31xxx/CVE-2021-31875.json
+++ b/2021/31xxx/CVE-2021-31875.json
@@ -34,7 +34,7 @@
"description_data": [
{
"lang": "eng",
- "value": "In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse, which can potentially lead to redirection of control flow."
+ "value": "** DISPUTED ** In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off-by-one heap-based buffer overflow in mjs_json_parse, which can potentially lead to redirection of control flow. NOTE: the original reporter disputes the significance of this finding because \"there isn\u2019t very much of an opportunity to exploit this reliably for an information leak, so there isn\u2019t any real security impact.\""
}
]
},
diff --git a/2021/32xxx/CVE-2021-32563.json b/2021/32xxx/CVE-2021-32563.json
index 9b87a727b487..c49d19974210 100644
--- a/2021/32xxx/CVE-2021-32563.json
+++ b/2021/32xxx/CVE-2021-32563.json
@@ -81,6 +81,16 @@
"refsource": "MISC",
"name": "https://gitlab.xfce.org/xfce/thunar/-/commit/1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d",
"url": "https://gitlab.xfce.org/xfce/thunar/-/commit/1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[oss-security] 20230104 Code execution through MIME-type association of Mono interpreter and security expectations of MIME type associations",
+ "url": "http://www.openwall.com/lists/oss-security/2023/01/05/1"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[oss-security] 20230105 Re: Code execution through MIME-type association of Mono interpreter and security expectations of MIME type associations",
+ "url": "http://www.openwall.com/lists/oss-security/2023/01/05/2"
}
]
}
diff --git a/2021/32xxx/CVE-2021-32692.json b/2021/32xxx/CVE-2021-32692.json
index 6a8a1eec5005..31d689554e3e 100644
--- a/2021/32xxx/CVE-2021-32692.json
+++ b/2021/32xxx/CVE-2021-32692.json
@@ -1,18 +1,97 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
- "CVE_data_meta": {
- "ID": "CVE-2021-32692",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
- },
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
- }
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "generator": {
+ "engine": "Vulnogram 0.0.9"
+ },
+ "CVE_data_meta": {
+ "ID": "CVE-2021-32692",
+ "ASSIGNER": "security-advisories@github.com",
+ "DATE_PUBLIC": "",
+ "TITLE": "Activity Watch vulnerable to command execution on macOS via printAppTitle.scpt",
+ "AKA": "",
+ "STATE": "PUBLIC"
+ },
+ "source": {
+ "defect": [],
+ "advisory": "",
+ "discovery": "UNKNOWN"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "ActivityWatch",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Activity Watch",
+ "version": {
+ "version_data": [
+ {
+ "version_name": "0.11.0",
+ "version_affected": "<",
+ "version_value": "0.11.0",
+ "platform": ""
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"
+ }
]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "Activity Watch is a free and open-source automated time tracker. Versions prior to 0.11.0 allow an attacker to execute arbitrary commands on any macOS machine with ActivityWatch running. The attacker can exploit this vulnerability by having the user visiting a website with the page title set to a malicious string. An attacker could use another application to accomplish the same, but the web browser is the most likely attack vector. This issue is patched in version 0.11.0. As a workaround, users can run the latest version of aw-watcher-window from source, or manually patch the `printAppTitle.scpt` file."
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "CONFIRM",
+ "url": "https://github.com/ActivityWatch/activitywatch/security/advisories/GHSA-3x6w-q32m-jqf3",
+ "name": "https://github.com/ActivityWatch/activitywatch/security/advisories/GHSA-3x6w-q32m-jqf3"
+ }
+ ]
+ },
+ "configuration": [],
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "NONE",
+ "userInteraction": "REQUIRED",
+ "scope": "CHANGED",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "availabilityImpact": "HIGH",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
+ "baseScore": 9.6,
+ "baseSeverity": "CRITICAL"
}
-}
\ No newline at end of file
+ },
+ "exploit": [],
+ "work_around": [],
+ "solution": [],
+ "credit": []
+}
diff --git a/2021/32xxx/CVE-2021-32815.json b/2021/32xxx/CVE-2021-32815.json
index badef49a41fa..31a1d654f9d8 100644
--- a/2021/32xxx/CVE-2021-32815.json
+++ b/2021/32xxx/CVE-2021-32815.json
@@ -88,6 +88,11 @@
"refsource": "FEDORA",
"name": "FEDORA-2021-cbaef8e2d5",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
}
]
},
diff --git a/2021/32xxx/CVE-2021-32821.json b/2021/32xxx/CVE-2021-32821.json
index 0616fa4f1783..f87fa075aede 100644
--- a/2021/32xxx/CVE-2021-32821.json
+++ b/2021/32xxx/CVE-2021-32821.json
@@ -1,18 +1,91 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
+ "ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-32821",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC",
+ "TITLE": "Regular expression Denial of Service in MooTools"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "mootools-core",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "1.6.0",
+ "version_value": "1.6.0"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "mootools"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "MooTools is a collection of JavaScript utilities for JavaScript developers. All known versions include a CSS selector parser that is vulnerable to Regular Expression Denial of Service (ReDoS). An attack requires that an attacker can inject a string into a CSS selector at runtime, which is quite common with e.g. jQuery CSS selectors. No patches are available for this issue."
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.0.9"
+ },
+ "impact": {
+ "cvss": {
+ "attackComplexity": "LOW",
+ "attackVector": "LOCAL",
+ "availabilityImpact": "HIGH",
+ "baseScore": 6.2,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "version": "3.1"
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-400 Uncontrolled Resource Consumption"
+ }
+ ]
}
]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "name": "https://securitylab.github.com/advisories/GHSL-2020-345-redos-mootools/",
+ "refsource": "CONFIRM",
+ "url": "https://securitylab.github.com/advisories/GHSL-2020-345-redos-mootools/"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSL-2020-345",
+ "defect": [
+ "GHSL-2020-345"
+ ],
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/32xxx/CVE-2021-32824.json b/2021/32xxx/CVE-2021-32824.json
index 0cc0ae5ed4de..a6e1a9a8f6ee 100644
--- a/2021/32xxx/CVE-2021-32824.json
+++ b/2021/32xxx/CVE-2021-32824.json
@@ -1,18 +1,101 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
+ "ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-32824",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC",
+ "TITLE": "Regular expression Denial of Service in MooTools"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Dubbo",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "2.6.10",
+ "version_value": "2.6.10"
+ },
+ {
+ "version_affected": "<",
+ "version_name": "2.7.10",
+ "version_value": "2.7.10"
+ },
+ {
+ "version_affected": ">=",
+ "version_name": "2.7.0",
+ "version_value": "2.7.0"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "Apache"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Apache Dubbo is a java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-auth remote code execution via arbitrary bean manipulation in the Telnet handler. The Dubbo main service port can be used to access a Telnet Handler which offers some basic methods to collect information about the providers and methods exposed by the service and it can even allow to shutdown the service. This endpoint is unprotected. Additionally, a provider method can be invoked using the `invoke` handler. This handler uses a safe version of FastJson to process the call arguments. However, the resulting list is later processed with `PojoUtils.realize` which can be used to instantiate arbitrary classes and invoke its setters. Even though FastJson is properly protected with a default blocklist, `PojoUtils.realize` is not, and an attacker can leverage that to achieve remote code execution. Versions 2.6.10 and 2.7.10 contain fixes for this issue."
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.0.9"
+ },
+ "impact": {
+ "cvss": {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 9.8,
+ "baseSeverity": "CRITICAL",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+ "version": "3.1"
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-502 Deserialization of Untrusted Data"
+ }
+ ]
}
]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "name": "https://securitylab.github.com/advisories/GHSL-2021-034_043-apache-dubbo/",
+ "refsource": "CONFIRM",
+ "url": "https://securitylab.github.com/advisories/GHSL-2021-034_043-apache-dubbo/"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSL-2021-039",
+ "defect": [
+ "GHSL-2021-039"
+ ],
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/32xxx/CVE-2021-32828.json b/2021/32xxx/CVE-2021-32828.json
index e030d169da26..9544f651e1d4 100644
--- a/2021/32xxx/CVE-2021-32828.json
+++ b/2021/32xxx/CVE-2021-32828.json
@@ -1,18 +1,96 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
+ "ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-32828",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC",
+ "TITLE": "Regular expression Denial of Service in MooTools"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Nuxeo",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_name": "11.5.109",
+ "version_value": "11.5.109"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "Hyland"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the `oauth2` REST API is vulnerable to Reflected Cross-Site Scripting (XSS). This XSS can be escalated to Remote Code Execution (RCE) by levering the automation API."
}
]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.0.9"
+ },
+ "impact": {
+ "cvss": {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 5.4,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "LOW",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
+ "version": "3.1"
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-502 Deserialization of Untrusted Data"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "name": "https://securitylab.github.com/advisories/GHSL-2021-072-nuxeo",
+ "refsource": "CONFIRM",
+ "url": "https://securitylab.github.com/advisories/GHSL-2021-072-nuxeo"
+ },
+ {
+ "name": "https://github.com/nuxeo/nuxeo/blob/master/modules/platform/nuxeo-platform-oauth/src/main/java/org/nuxeo/ecm/webengine/oauth2/OAuth2Callback.java",
+ "refsource": "MISC",
+ "url": "https://github.com/nuxeo/nuxeo/blob/master/modules/platform/nuxeo-platform-oauth/src/main/java/org/nuxeo/ecm/webengine/oauth2/OAuth2Callback.java"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSL-2021-072",
+ "defect": [
+ "GHSL-2021-072"
+ ],
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/33xxx/CVE-2021-33285.json b/2021/33xxx/CVE-2021-33285.json
index 6725fd44b5b0..9c0d198720ff 100644
--- a/2021/33xxx/CVE-2021-33285.json
+++ b/2021/33xxx/CVE-2021-33285.json
@@ -96,6 +96,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/33xxx/CVE-2021-33286.json b/2021/33xxx/CVE-2021-33286.json
index 808af91ae7dd..77ae2039630b 100644
--- a/2021/33xxx/CVE-2021-33286.json
+++ b/2021/33xxx/CVE-2021-33286.json
@@ -76,6 +76,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/33xxx/CVE-2021-33287.json b/2021/33xxx/CVE-2021-33287.json
index 652a30761795..dddf4c4cddf5 100644
--- a/2021/33xxx/CVE-2021-33287.json
+++ b/2021/33xxx/CVE-2021-33287.json
@@ -91,6 +91,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/33xxx/CVE-2021-33289.json b/2021/33xxx/CVE-2021-33289.json
index 08f83e2056a9..f176ed920a66 100644
--- a/2021/33xxx/CVE-2021-33289.json
+++ b/2021/33xxx/CVE-2021-33289.json
@@ -86,6 +86,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/33xxx/CVE-2021-33420.json b/2021/33xxx/CVE-2021-33420.json
index 7e7fab58f3b4..9f48bdd1382d 100644
--- a/2021/33xxx/CVE-2021-33420.json
+++ b/2021/33xxx/CVE-2021-33420.json
@@ -1,17 +1,76 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
- "ID": "CVE-2021-33420",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ID": "CVE-2021-33420",
+ "STATE": "PUBLIC"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "n/a"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializable function in TypedArray object."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/inikulin/replicator/issues/16",
+ "refsource": "MISC",
+ "name": "https://github.com/inikulin/replicator/issues/16"
+ },
+ {
+ "url": "https://github.com/inikulin/replicator/pull/17",
+ "refsource": "MISC",
+ "name": "https://github.com/inikulin/replicator/pull/17"
+ },
+ {
+ "url": "https://github.com/inikulin/replicator/commit/2c626242fb4a118855262c64b5731b2ce98e521b",
+ "refsource": "MISC",
+ "name": "https://github.com/inikulin/replicator/commit/2c626242fb4a118855262c64b5731b2ce98e521b"
+ },
+ {
+ "url": "https://advisory.checkmarx.net/advisory/CX-2021-4787",
+ "refsource": "MISC",
+ "name": "https://advisory.checkmarx.net/advisory/CX-2021-4787"
}
]
}
diff --git a/2021/33xxx/CVE-2021-33621.json b/2021/33xxx/CVE-2021-33621.json
index e8a54eda17bd..9ac814fa0e43 100644
--- a/2021/33xxx/CVE-2021-33621.json
+++ b/2021/33xxx/CVE-2021-33621.json
@@ -71,6 +71,11 @@
"refsource": "FEDORA",
"name": "FEDORA-2022-b9b710f199",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/THVTYHHEOVLQFCFHWURZYO7PVUPBHRZD/"
+ },
+ {
+ "refsource": "CONFIRM",
+ "name": "https://security.netapp.com/advisory/ntap-20221228-0004/",
+ "url": "https://security.netapp.com/advisory/ntap-20221228-0004/"
}
]
}
diff --git a/2021/33xxx/CVE-2021-33623.json b/2021/33xxx/CVE-2021-33623.json
index 745bd59fb6c3..a31fe2eb3877 100644
--- a/2021/33xxx/CVE-2021-33623.json
+++ b/2021/33xxx/CVE-2021-33623.json
@@ -66,6 +66,11 @@
"refsource": "CONFIRM",
"name": "https://security.netapp.com/advisory/ntap-20210702-0007/",
"url": "https://security.netapp.com/advisory/ntap-20210702-0007/"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20221223 [SECURITY] [DLA 3247-1] node-trim-newlines security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00033.html"
}
]
}
diff --git a/2021/33xxx/CVE-2021-33640.json b/2021/33xxx/CVE-2021-33640.json
index 8776fd795580..868ce11e27d3 100644
--- a/2021/33xxx/CVE-2021-33640.json
+++ b/2021/33xxx/CVE-2021-33640.json
@@ -1,18 +1,120 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
+ "ASSIGNER": "securities@openeuler.org",
"ID": "CVE-2021-33640",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "openEuler 22.03 LTS",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_name": " libtar",
+ "version_value": "1.2.20-21"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "openEuler 20.03 LTS SP1",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_name": " libtar",
+ "version_value": "1.2.20-19"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "openEuler 20.03 LTS SP3",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_name": " libtar",
+ "version_value": "1.2.20-19"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "openEuler"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free)."
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.0.9"
+ },
+ "impact": {
+ "cvss": {
+ "attackComplexity": "LOW",
+ "attackVector": "LOCAL",
+ "availabilityImpact": "HIGH",
+ "baseScore": 6.2,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "version": "3.1"
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-416 Use After Free"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "url": "https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2021-33640&packageName=libtar",
+ "name": "https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2021-33640&packageName=libtar"
+ },
+ {
+ "refsource": "FEDORA",
+ "name": "FEDORA-2022-88772d0a2d",
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/"
+ },
+ {
+ "refsource": "FEDORA",
+ "name": "FEDORA-2022-ccc68b06cc",
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T/"
}
]
+ },
+ "source": {
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/33xxx/CVE-2021-33643.json b/2021/33xxx/CVE-2021-33643.json
index 865ff7bde77d..82946ca677f9 100644
--- a/2021/33xxx/CVE-2021-33643.json
+++ b/2021/33xxx/CVE-2021-33643.json
@@ -63,6 +63,16 @@
"refsource": "FEDORA",
"name": "FEDORA-2022-44a20bba43",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7Q26QDNOJDOFYWMJWEIK5XR62M2FF6IJ/"
+ },
+ {
+ "refsource": "FEDORA",
+ "name": "FEDORA-2022-88772d0a2d",
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/"
+ },
+ {
+ "refsource": "FEDORA",
+ "name": "FEDORA-2022-ccc68b06cc",
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T/"
}
]
},
diff --git a/2021/33xxx/CVE-2021-33644.json b/2021/33xxx/CVE-2021-33644.json
index 1b6bac12eac3..9aaadbd81b51 100644
--- a/2021/33xxx/CVE-2021-33644.json
+++ b/2021/33xxx/CVE-2021-33644.json
@@ -63,6 +63,16 @@
"refsource": "FEDORA",
"name": "FEDORA-2022-44a20bba43",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7Q26QDNOJDOFYWMJWEIK5XR62M2FF6IJ/"
+ },
+ {
+ "refsource": "FEDORA",
+ "name": "FEDORA-2022-88772d0a2d",
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/"
+ },
+ {
+ "refsource": "FEDORA",
+ "name": "FEDORA-2022-ccc68b06cc",
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T/"
}
]
},
diff --git a/2021/33xxx/CVE-2021-33645.json b/2021/33xxx/CVE-2021-33645.json
index 46c6d15ef39c..39ddb1826f7b 100644
--- a/2021/33xxx/CVE-2021-33645.json
+++ b/2021/33xxx/CVE-2021-33645.json
@@ -63,6 +63,16 @@
"refsource": "FEDORA",
"name": "FEDORA-2022-44a20bba43",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7Q26QDNOJDOFYWMJWEIK5XR62M2FF6IJ/"
+ },
+ {
+ "refsource": "FEDORA",
+ "name": "FEDORA-2022-88772d0a2d",
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/"
+ },
+ {
+ "refsource": "FEDORA",
+ "name": "FEDORA-2022-ccc68b06cc",
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T/"
}
]
},
diff --git a/2021/33xxx/CVE-2021-33646.json b/2021/33xxx/CVE-2021-33646.json
index d890192bb649..8954a91ef699 100644
--- a/2021/33xxx/CVE-2021-33646.json
+++ b/2021/33xxx/CVE-2021-33646.json
@@ -63,6 +63,16 @@
"refsource": "FEDORA",
"name": "FEDORA-2022-44a20bba43",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7Q26QDNOJDOFYWMJWEIK5XR62M2FF6IJ/"
+ },
+ {
+ "refsource": "FEDORA",
+ "name": "FEDORA-2022-88772d0a2d",
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S4PJRCJLEAWN2EKXGLSOBTL7O57V7NC/"
+ },
+ {
+ "refsource": "FEDORA",
+ "name": "FEDORA-2022-ccc68b06cc",
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WX5YE66CT7Y5C2HTHXSFDKQWYWYWJ2T/"
}
]
},
diff --git a/2021/33xxx/CVE-2021-33895.json b/2021/33xxx/CVE-2021-33895.json
index f58a038e3849..5bb4521060dd 100644
--- a/2021/33xxx/CVE-2021-33895.json
+++ b/2021/33xxx/CVE-2021-33895.json
@@ -34,7 +34,7 @@
"description_data": [
{
"lang": "eng",
- "value": "ETINET BACKBOX E4.09 and H4.09 mismanages password access control. When a user uses the User ID of the process running BBSV to login to the Backbox UI application, the system procedure (USER_AUTHENTICATE_) used for verifying the Password returns 0 (no error). The reason is that the user is not running the XYGate application. Hence, BBSV assumes the Password is correct. For H4.09, the affected version isT0954V04^AAO. For E4.09, the affected version is 22SEP2020."
+ "value": "ETINET BACKBOX E4.09 and H4.09 mismanages password access control. When a user uses the User ID of the process running BBSV to login to the Backbox UI application, the system procedure (USER_AUTHENTICATE_) used for verifying the Password returns 0 (no error). The reason is that the user is not running the XYGate application. Hence, BBSV assumes the Password is correct. For H4.09, the affected version isT0954V04^AAO. For E4.09, the affected version is 22SEP2020. Note: If your current version is E4.10-16MAY2021 (version procedure T9999V04_16MAY2022_BPAKETI_10), a hotfix (FIXPAK-19OCT-2022) is available in version E4.10-19OCT2022. Resolution to CVE-2021-33895 in version E4.11-19OCT2022"
}
]
},
diff --git a/2021/34xxx/CVE-2021-34334.json b/2021/34xxx/CVE-2021-34334.json
index b070b2348deb..146238ff7c97 100644
--- a/2021/34xxx/CVE-2021-34334.json
+++ b/2021/34xxx/CVE-2021-34334.json
@@ -88,6 +88,11 @@
"refsource": "FEDORA",
"name": "FEDORA-2021-cbaef8e2d5",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
}
]
},
diff --git a/2021/34xxx/CVE-2021-34427.json b/2021/34xxx/CVE-2021-34427.json
index 6c1073fb8397..c3c075dc9a5a 100644
--- a/2021/34xxx/CVE-2021-34427.json
+++ b/2021/34xxx/CVE-2021-34427.json
@@ -57,7 +57,17 @@
"name": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142",
"refsource": "CONFIRM",
"url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142"
+ },
+ {
+ "refsource": "FULLDISC",
+ "name": "20221220 SEC Consult SA-20221216-0 :: Remote code execution bypass in Eclipse Business Intelligence Reporting Tool (BiRT)",
+ "url": "http://seclists.org/fulldisclosure/2022/Dec/30"
+ },
+ {
+ "refsource": "MISC",
+ "name": "http://packetstormsecurity.com/files/170326/Eclipse-Business-Intelligence-Reporting-Tool-4.11.0-Remote-Code-Execution.html",
+ "url": "http://packetstormsecurity.com/files/170326/Eclipse-Business-Intelligence-Reporting-Tool-4.11.0-Remote-Code-Execution.html"
}
]
}
-}
+}
\ No newline at end of file
diff --git a/2021/34xxx/CVE-2021-34603.json b/2021/34xxx/CVE-2021-34603.json
index 701638d5afef..9df0997f7d83 100644
--- a/2021/34xxx/CVE-2021-34603.json
+++ b/2021/34xxx/CVE-2021-34603.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-34603",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/34xxx/CVE-2021-34607.json b/2021/34xxx/CVE-2021-34607.json
index de52c3053fa3..075d751a628d 100644
--- a/2021/34xxx/CVE-2021-34607.json
+++ b/2021/34xxx/CVE-2021-34607.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-34607",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/34xxx/CVE-2021-34608.json b/2021/34xxx/CVE-2021-34608.json
index ca43c4514dbd..120cb2f8c1cc 100644
--- a/2021/34xxx/CVE-2021-34608.json
+++ b/2021/34xxx/CVE-2021-34608.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-34608",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/35xxx/CVE-2021-35065.json b/2021/35xxx/CVE-2021-35065.json
index 0cc09f91cd56..cdf533d77b81 100644
--- a/2021/35xxx/CVE-2021-35065.json
+++ b/2021/35xxx/CVE-2021-35065.json
@@ -1,17 +1,72 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-35065",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294",
+ "refsource": "MISC",
+ "name": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294"
+ },
+ {
+ "url": "https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339",
+ "refsource": "MISC",
+ "name": "https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339"
+ },
+ {
+ "url": "https://github.com/gulpjs/glob-parent/pull/49",
+ "refsource": "MISC",
+ "name": "https://github.com/gulpjs/glob-parent/pull/49"
}
]
}
diff --git a/2021/35xxx/CVE-2021-35252.json b/2021/35xxx/CVE-2021-35252.json
index 19747be80fec..861a4082d1f8 100644
--- a/2021/35xxx/CVE-2021-35252.json
+++ b/2021/35xxx/CVE-2021-35252.json
@@ -1,17 +1,116 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-35252",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@solarwinds.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Common encryption key appears to be used across all deployed instances of Serv-U FTP Server. Because of this an encrypted value that is exposed to an attacker can be simply recovered to plaintext."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-798 Use of Hard-coded Credentials",
+ "cweId": "CWE-798"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "SolarWinds",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Serv-U FTP Server",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "15.3.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-2_release_notes.htm",
+ "refsource": "MISC",
+ "name": "https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3-2_release_notes.htm"
+ },
+ {
+ "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35252",
+ "refsource": "MISC",
+ "name": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35252"
+ },
+ {
+ "url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35252",
+ "refsource": "MISC",
+ "name": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35252"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "SolarWinds advises to upgrade to the latest version of Serv-U 15.3.2 once became generally available."
+ }
+ ],
+ "value": "SolarWinds advises to upgrade to the latest version of Serv-U 15.3.2 once became generally available."
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "SecureWorks Disclosure Team"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "ADJACENT_NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 6.5,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2021/35xxx/CVE-2021-35266.json b/2021/35xxx/CVE-2021-35266.json
index a9325a5f73d8..6c976d6bfceb 100644
--- a/2021/35xxx/CVE-2021-35266.json
+++ b/2021/35xxx/CVE-2021-35266.json
@@ -86,6 +86,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/35xxx/CVE-2021-35267.json b/2021/35xxx/CVE-2021-35267.json
index f258ae8ccc7d..3c7968ae7e8e 100644
--- a/2021/35xxx/CVE-2021-35267.json
+++ b/2021/35xxx/CVE-2021-35267.json
@@ -86,6 +86,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/35xxx/CVE-2021-35268.json b/2021/35xxx/CVE-2021-35268.json
index 9eea35b750a6..320ff8eb3598 100644
--- a/2021/35xxx/CVE-2021-35268.json
+++ b/2021/35xxx/CVE-2021-35268.json
@@ -86,6 +86,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/35xxx/CVE-2021-35269.json b/2021/35xxx/CVE-2021-35269.json
index 9c8841057dfa..03c886f994b5 100644
--- a/2021/35xxx/CVE-2021-35269.json
+++ b/2021/35xxx/CVE-2021-35269.json
@@ -81,6 +81,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/35xxx/CVE-2021-35452.json b/2021/35xxx/CVE-2021-35452.json
index 943ef7a19bce..c8d88f2b0e64 100644
--- a/2021/35xxx/CVE-2021-35452.json
+++ b/2021/35xxx/CVE-2021-35452.json
@@ -56,6 +56,11 @@
"url": "https://github.com/strukturag/libde265/issues/298",
"refsource": "MISC",
"name": "https://github.com/strukturag/libde265/issues/298"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3240-1] libde265 security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00027.html"
}
]
}
diff --git a/2021/35xxx/CVE-2021-35576.json b/2021/35xxx/CVE-2021-35576.json
index cabbe7b947e6..b7f97931c76b 100644
--- a/2021/35xxx/CVE-2021-35576.json
+++ b/2021/35xxx/CVE-2021-35576.json
@@ -77,6 +77,16 @@
"refsource": "MISC",
"name": "https://databasesecurityninja.wordpress.com/2022/06/11/cve-2021-35576-bypassing-unified-audit-policy/",
"url": "https://databasesecurityninja.wordpress.com/2022/06/11/cve-2021-35576-bypassing-unified-audit-policy/"
+ },
+ {
+ "refsource": "MISC",
+ "name": "http://packetstormsecurity.com/files/170354/Oracle-Unified-Audit-Policy-Bypass.html",
+ "url": "http://packetstormsecurity.com/files/170354/Oracle-Unified-Audit-Policy-Bypass.html"
+ },
+ {
+ "refsource": "MISC",
+ "name": "http://packetstormsecurity.com/files/170373/Oracle-Database-Vault-Metadata-Exposure.html",
+ "url": "http://packetstormsecurity.com/files/170373/Oracle-Database-Vault-Metadata-Exposure.html"
}
]
}
diff --git a/2021/35xxx/CVE-2021-35951.json b/2021/35xxx/CVE-2021-35951.json
index 80c02b101a79..fc0398a27c57 100644
--- a/2021/35xxx/CVE-2021-35951.json
+++ b/2021/35xxx/CVE-2021-35951.json
@@ -1,17 +1,67 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-35951",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows an Unauthenticated Remote attacker to send a malicious firmware update via BLE and brick the device."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.fastrack.in/shop/watch-smart-wearables-reflex-2",
+ "refsource": "MISC",
+ "name": "https://www.fastrack.in/shop/watch-smart-wearables-reflex-2"
+ },
+ {
+ "url": "https://payatu.com/advisory/fastrack-reflex-unauthenticated-firmware-update",
+ "refsource": "MISC",
+ "name": "https://payatu.com/advisory/fastrack-reflex-unauthenticated-firmware-update"
}
]
}
diff --git a/2021/35xxx/CVE-2021-35952.json b/2021/35xxx/CVE-2021-35952.json
index a88aba9bb971..1521fd4cc050 100644
--- a/2021/35xxx/CVE-2021-35952.json
+++ b/2021/35xxx/CVE-2021-35952.json
@@ -1,17 +1,67 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-35952",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month via Bluetooth LE Characteristics on handle 0x0017."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.fastrack.in/shop/watch-smart-wearables-reflex-2",
+ "refsource": "MISC",
+ "name": "https://www.fastrack.in/shop/watch-smart-wearables-reflex-2"
+ },
+ {
+ "url": "https://payatu.com/advisory/lack-of-bluetooth-le-pairing-fastrack-reflex",
+ "refsource": "MISC",
+ "name": "https://payatu.com/advisory/lack-of-bluetooth-le-pairing-fastrack-reflex"
}
]
}
diff --git a/2021/35xxx/CVE-2021-35953.json b/2021/35xxx/CVE-2021-35953.json
index 5df4b557a759..13e15def0b0c 100644
--- a/2021/35xxx/CVE-2021-35953.json
+++ b/2021/35xxx/CVE-2021-35953.json
@@ -1,17 +1,67 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-35953",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service (device outage) via crafted choices of the last three bytes of a characteristic value."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.fastrack.in/shop/watch-smart-wearables-reflex-2",
+ "refsource": "MISC",
+ "name": "https://www.fastrack.in/shop/watch-smart-wearables-reflex-2"
+ },
+ {
+ "url": "https://payatu.com/advisory/device-crash-fastrack-reflex-two-activity-tracker",
+ "refsource": "MISC",
+ "name": "https://payatu.com/advisory/device-crash-fastrack-reflex-two-activity-tracker"
}
]
}
diff --git a/2021/35xxx/CVE-2021-35954.json b/2021/35xxx/CVE-2021-35954.json
index b3a42bdb0376..b25373c70837 100644
--- a/2021/35xxx/CVE-2021-35954.json
+++ b/2021/35xxx/CVE-2021-35954.json
@@ -1,17 +1,67 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-35954",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious firmware, and brick the device via the Serial Wire Debug (SWD) feature."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.fastrack.in/shop/watch-smart-wearables-reflex-2",
+ "refsource": "MISC",
+ "name": "https://www.fastrack.in/shop/watch-smart-wearables-reflex-2"
+ },
+ {
+ "url": "https://payatu.com/advisory/dumping-and-re-flashing-firmware-fastrack-reflex",
+ "refsource": "MISC",
+ "name": "https://payatu.com/advisory/dumping-and-re-flashing-firmware-fastrack-reflex"
}
]
}
diff --git a/2021/36xxx/CVE-2021-36408.json b/2021/36xxx/CVE-2021-36408.json
index c1ee7a8f786e..8289bbc45311 100644
--- a/2021/36xxx/CVE-2021-36408.json
+++ b/2021/36xxx/CVE-2021-36408.json
@@ -56,6 +56,11 @@
"url": "https://github.com/strukturag/libde265/issues/299",
"refsource": "MISC",
"name": "https://github.com/strukturag/libde265/issues/299"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3240-1] libde265 security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00027.html"
}
]
}
diff --git a/2021/36xxx/CVE-2021-36409.json b/2021/36xxx/CVE-2021-36409.json
index 9c94e1ec298c..2c0ef4e690d3 100644
--- a/2021/36xxx/CVE-2021-36409.json
+++ b/2021/36xxx/CVE-2021-36409.json
@@ -56,6 +56,11 @@
"url": "https://github.com/strukturag/libde265/issues/300",
"refsource": "MISC",
"name": "https://github.com/strukturag/libde265/issues/300"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3240-1] libde265 security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00027.html"
}
]
}
diff --git a/2021/36xxx/CVE-2021-36410.json b/2021/36xxx/CVE-2021-36410.json
index fbca45557883..cad2a0e8af11 100644
--- a/2021/36xxx/CVE-2021-36410.json
+++ b/2021/36xxx/CVE-2021-36410.json
@@ -56,6 +56,11 @@
"url": "https://github.com/strukturag/libde265/issues/301",
"refsource": "MISC",
"name": "https://github.com/strukturag/libde265/issues/301"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3240-1] libde265 security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00027.html"
}
]
}
diff --git a/2021/36xxx/CVE-2021-36411.json b/2021/36xxx/CVE-2021-36411.json
index b26a33045a3b..d9bb38ea1a75 100644
--- a/2021/36xxx/CVE-2021-36411.json
+++ b/2021/36xxx/CVE-2021-36411.json
@@ -56,6 +56,11 @@
"url": "https://github.com/strukturag/libde265/issues/302",
"refsource": "MISC",
"name": "https://github.com/strukturag/libde265/issues/302"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20221215 [SECURITY] [DLA 3240-1] libde265 security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00027.html"
}
]
}
diff --git a/2021/36xxx/CVE-2021-36572.json b/2021/36xxx/CVE-2021-36572.json
index 208adc17dc87..6a72d9ae0c2e 100644
--- a/2021/36xxx/CVE-2021-36572.json
+++ b/2021/36xxx/CVE-2021-36572.json
@@ -1,17 +1,61 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
- "ID": "CVE-2021-36572",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ID": "CVE-2021-36572",
+ "STATE": "PUBLIC"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "n/a"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/liufee/cms/issues/58",
+ "refsource": "MISC",
+ "name": "https://github.com/liufee/cms/issues/58"
}
]
}
diff --git a/2021/36xxx/CVE-2021-36573.json b/2021/36xxx/CVE-2021-36573.json
index b39b99f2960f..c798b877d531 100644
--- a/2021/36xxx/CVE-2021-36573.json
+++ b/2021/36xxx/CVE-2021-36573.json
@@ -1,17 +1,61 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
- "ID": "CVE-2021-36573",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ID": "CVE-2021-36573",
+ "STATE": "PUBLIC"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "n/a"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/liufee/cms/issues/59",
+ "refsource": "MISC",
+ "name": "https://github.com/liufee/cms/issues/59"
}
]
}
diff --git a/2021/36xxx/CVE-2021-36603.json b/2021/36xxx/CVE-2021-36603.json
index 610bf516ef29..5e688e74adc5 100644
--- a/2021/36xxx/CVE-2021-36603.json
+++ b/2021/36xxx/CVE-2021-36603.json
@@ -5,13 +5,57 @@
"CVE_data_meta": {
"ID": "CVE-2021-36603",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "n/a"
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://github.com/arendst/Tasmota/issues/12221",
+ "url": "https://github.com/arendst/Tasmota/issues/12221"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Cross Site Scripting (XSS) in Tasmota firmware 6.5.0 allows remote attackers to inject JavaScript code via a crafted string in the field \"Friendly Name 1\"."
}
]
}
diff --git a/2021/36xxx/CVE-2021-36631.json b/2021/36xxx/CVE-2021-36631.json
index 9a0c3faf9e8b..bd1e89107399 100644
--- a/2021/36xxx/CVE-2021-36631.json
+++ b/2021/36xxx/CVE-2021-36631.json
@@ -1,17 +1,61 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
- "ID": "CVE-2021-36631",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ID": "CVE-2021-36631",
+ "STATE": "PUBLIC"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "n/a"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Untrusted search path vulnerability in Baidunetdisk Version 7.4.3 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://github.com/shigophilo/CVE/blob/main/Baidunetdisk%20Version%207.4.3%20dll%20hijack.md",
+ "url": "https://github.com/shigophilo/CVE/blob/main/Baidunetdisk%20Version%207.4.3%20dll%20hijack.md"
}
]
}
diff --git a/2021/36xxx/CVE-2021-36981.json b/2021/36xxx/CVE-2021-36981.json
index 49c483a4fe62..cc8cfc765394 100644
--- a/2021/36xxx/CVE-2021-36981.json
+++ b/2021/36xxx/CVE-2021-36981.json
@@ -61,6 +61,16 @@
"refsource": "MISC",
"name": "https://github.com/SerNet/verinice/compare/1.22.1...1.22.2",
"url": "https://github.com/SerNet/verinice/compare/1.22.1...1.22.2"
+ },
+ {
+ "refsource": "MISC",
+ "name": "https://github.com/0xBrAinsTorM/CVE-2021-36981",
+ "url": "https://github.com/0xBrAinsTorM/CVE-2021-36981"
+ },
+ {
+ "refsource": "MISC",
+ "name": "https://www.secianus.de/worum-geht-es/aktuelle-meldung/cve-2021-36981-verinicepro-unsafe-java-deserialization",
+ "url": "https://www.secianus.de/worum-geht-es/aktuelle-meldung/cve-2021-36981-verinicepro-unsafe-java-deserialization"
}
]
}
diff --git a/2021/37xxx/CVE-2021-37533.json b/2021/37xxx/CVE-2021-37533.json
index 41fab4516d93..83b48fe59bcb 100644
--- a/2021/37xxx/CVE-2021-37533.json
+++ b/2021/37xxx/CVE-2021-37533.json
@@ -78,6 +78,16 @@
"refsource": "MLIST",
"name": "[oss-security] 20221203 CVE-2021-37533: Apache Commons Net's FTP client trusts the host from PASV response by default",
"url": "http://www.openwall.com/lists/oss-security/2022/12/03/1"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20221229 [SECURITY] [DLA 3251-1] libcommons-net-java security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00038.html"
+ },
+ {
+ "refsource": "DEBIAN",
+ "name": "DSA-5307",
+ "url": "https://www.debian.org/security/2022/dsa-5307"
}
]
},
diff --git a/2021/37xxx/CVE-2021-37620.json b/2021/37xxx/CVE-2021-37620.json
index 04f543937c6f..193928f22cea 100644
--- a/2021/37xxx/CVE-2021-37620.json
+++ b/2021/37xxx/CVE-2021-37620.json
@@ -88,6 +88,11 @@
"refsource": "FEDORA",
"name": "FEDORA-2021-cbaef8e2d5",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
}
]
},
diff --git a/2021/37xxx/CVE-2021-37621.json b/2021/37xxx/CVE-2021-37621.json
index 8756ca0aa276..a355b6a6f5ab 100644
--- a/2021/37xxx/CVE-2021-37621.json
+++ b/2021/37xxx/CVE-2021-37621.json
@@ -88,6 +88,11 @@
"refsource": "FEDORA",
"name": "FEDORA-2021-cbaef8e2d5",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
}
]
},
diff --git a/2021/37xxx/CVE-2021-37622.json b/2021/37xxx/CVE-2021-37622.json
index 00f0623835ab..bbe158a9d042 100644
--- a/2021/37xxx/CVE-2021-37622.json
+++ b/2021/37xxx/CVE-2021-37622.json
@@ -88,6 +88,11 @@
"refsource": "FEDORA",
"name": "FEDORA-2021-cbaef8e2d5",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UYGDELIFFJWKUU7SO3QATCIXCZJERGAC/"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20230110 [SECURITY] [DLA 3265-1] exiv2 security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00004.html"
}
]
},
diff --git a/2021/38xxx/CVE-2021-38241.json b/2021/38xxx/CVE-2021-38241.json
index b46c58265e8c..95f7e95d6d09 100644
--- a/2021/38xxx/CVE-2021-38241.json
+++ b/2021/38xxx/CVE-2021-38241.json
@@ -1,17 +1,61 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
- "ID": "CVE-2021-38241",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ID": "CVE-2021-38241",
+ "STATE": "PUBLIC"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "n/a"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Deserialization issue discovered in Ruoyi before 4.6.1 allows remote attackers to run arbitrary code via weak cipher in Shiro framework."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://www.du1ge.com/archives/CVE-2021-38241",
+ "url": "https://www.du1ge.com/archives/CVE-2021-38241"
}
]
}
diff --git a/2021/38xxx/CVE-2021-38370.json b/2021/38xxx/CVE-2021-38370.json
index 980e54d97f2d..aa4acdf54520 100644
--- a/2021/38xxx/CVE-2021-38370.json
+++ b/2021/38xxx/CVE-2021-38370.json
@@ -66,6 +66,11 @@
"refsource": "MISC",
"name": "https://bugs.gentoo.org/807613#c4",
"url": "https://bugs.gentoo.org/807613#c4"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-07",
+ "url": "https://security.gentoo.org/glsa/202301-07"
}
]
}
diff --git a/2021/38xxx/CVE-2021-38561.json b/2021/38xxx/CVE-2021-38561.json
index e37dccaad2bd..ca96577cf32d 100644
--- a/2021/38xxx/CVE-2021-38561.json
+++ b/2021/38xxx/CVE-2021-38561.json
@@ -1,17 +1,77 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-38561",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://groups.google.com/g/golang-announce",
+ "refsource": "MISC",
+ "name": "https://groups.google.com/g/golang-announce"
+ },
+ {
+ "url": "https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f",
+ "refsource": "MISC",
+ "name": "https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f"
+ },
+ {
+ "url": "https://deps.dev/advisory/OSV/GO-2021-0113",
+ "refsource": "MISC",
+ "name": "https://deps.dev/advisory/OSV/GO-2021-0113"
+ },
+ {
+ "url": "https://pkg.go.dev/golang.org/x/text/language",
+ "refsource": "MISC",
+ "name": "https://pkg.go.dev/golang.org/x/text/language"
}
]
}
diff --git a/2021/38xxx/CVE-2021-38928.json b/2021/38xxx/CVE-2021-38928.json
index ccb288bb2345..e5e07c9c2ed8 100644
--- a/2021/38xxx/CVE-2021-38928.json
+++ b/2021/38xxx/CVE-2021-38928.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-38928",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@us.ibm.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 210323."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "942 Overly Permissive Cross-domain Whitelist"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "IBM",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Sterling B2B Integrator Standard Edition",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "6.0.0.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.ibm.com/support/pages/node/6852467",
+ "refsource": "MISC",
+ "name": "https://www.ibm.com/support/pages/node/6852467"
+ },
+ {
+ "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/210323",
+ "refsource": "MISC",
+ "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/210323"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 5.4,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39251.json b/2021/39xxx/CVE-2021-39251.json
index f545ff276335..ca2fcf4a1ed5 100644
--- a/2021/39xxx/CVE-2021-39251.json
+++ b/2021/39xxx/CVE-2021-39251.json
@@ -96,6 +96,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39252.json b/2021/39xxx/CVE-2021-39252.json
index 8d0d31c41824..7157d109881e 100644
--- a/2021/39xxx/CVE-2021-39252.json
+++ b/2021/39xxx/CVE-2021-39252.json
@@ -81,6 +81,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39253.json b/2021/39xxx/CVE-2021-39253.json
index aef1df33a736..331fc7b25a8f 100644
--- a/2021/39xxx/CVE-2021-39253.json
+++ b/2021/39xxx/CVE-2021-39253.json
@@ -81,6 +81,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39254.json b/2021/39xxx/CVE-2021-39254.json
index 3366b0a03540..83978003b95b 100644
--- a/2021/39xxx/CVE-2021-39254.json
+++ b/2021/39xxx/CVE-2021-39254.json
@@ -81,6 +81,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39255.json b/2021/39xxx/CVE-2021-39255.json
index f71dd6f60fbf..63d04fa93626 100644
--- a/2021/39xxx/CVE-2021-39255.json
+++ b/2021/39xxx/CVE-2021-39255.json
@@ -71,6 +71,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39256.json b/2021/39xxx/CVE-2021-39256.json
index 8b7bb8066bb3..986108639697 100644
--- a/2021/39xxx/CVE-2021-39256.json
+++ b/2021/39xxx/CVE-2021-39256.json
@@ -71,6 +71,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39257.json b/2021/39xxx/CVE-2021-39257.json
index fc817f87bf84..c5998018cf45 100644
--- a/2021/39xxx/CVE-2021-39257.json
+++ b/2021/39xxx/CVE-2021-39257.json
@@ -71,6 +71,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39258.json b/2021/39xxx/CVE-2021-39258.json
index 45f8ba729836..e779e25af90f 100644
--- a/2021/39xxx/CVE-2021-39258.json
+++ b/2021/39xxx/CVE-2021-39258.json
@@ -71,6 +71,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39259.json b/2021/39xxx/CVE-2021-39259.json
index 1609ef3f4b45..c99e5ad09721 100644
--- a/2021/39xxx/CVE-2021-39259.json
+++ b/2021/39xxx/CVE-2021-39259.json
@@ -71,6 +71,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39260.json b/2021/39xxx/CVE-2021-39260.json
index 717ca6da6f45..25ef2eece8cc 100644
--- a/2021/39xxx/CVE-2021-39260.json
+++ b/2021/39xxx/CVE-2021-39260.json
@@ -71,6 +71,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39261.json b/2021/39xxx/CVE-2021-39261.json
index 63c3c35243e5..cf58825250d4 100644
--- a/2021/39xxx/CVE-2021-39261.json
+++ b/2021/39xxx/CVE-2021-39261.json
@@ -71,6 +71,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39262.json b/2021/39xxx/CVE-2021-39262.json
index 8e443a3b0738..60b6d0326c02 100644
--- a/2021/39xxx/CVE-2021-39262.json
+++ b/2021/39xxx/CVE-2021-39262.json
@@ -71,6 +71,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39263.json b/2021/39xxx/CVE-2021-39263.json
index d3a11a38cc88..733280285a9a 100644
--- a/2021/39xxx/CVE-2021-39263.json
+++ b/2021/39xxx/CVE-2021-39263.json
@@ -71,6 +71,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20211116 [SECURITY] [DLA 2819-1] ntfs-3g security update",
"url": "https://lists.debian.org/debian-lts-announce/2021/11/msg00013.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-01",
+ "url": "https://security.gentoo.org/glsa/202301-01"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39298.json b/2021/39xxx/CVE-2021-39298.json
index a23dcc8626e7..f52fff157d9e 100644
--- a/2021/39xxx/CVE-2021-39298.json
+++ b/2021/39xxx/CVE-2021-39298.json
@@ -1,82 +1,119 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "psirt@amd.com",
- "DATE_PUBLIC": "2022-05-10T20:00:00.000Z",
"ID": "CVE-2021-39298",
+ "ASSIGNER": "psirt@amd.com",
"STATE": "PUBLIC"
},
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
"affects": {
"vendor": {
"vendor_data": [
{
+ "vendor_name": "AMD",
"product": {
"product_data": [
{
- "product_name": "Ryzen\u2122 Series ",
+ "product_name": "2nd Gen EPYC",
"version": {
"version_data": [
{
- "version_affected": "=",
- "version_value": "various"
+ "version_value": "Various ",
+ "version_affected": "="
}
]
}
},
{
- "product_name": " Athlon\u2122 Series ",
+ "product_name": "3rd Gen EPYC",
"version": {
"version_data": [
{
- "version_affected": "=",
- "version_value": "various"
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Ryzen 2000 Series",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Ryzen 3000 Series ",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Ryzen 5000 Series ",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
}
]
}
}
]
- },
- "vendor_name": "AMD"
+ }
}
]
}
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware."
- }
- ]
- },
- "generator": {
- "engine": "Vulnogram 0.0.9"
- },
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "tbd"
- }
- ]
- }
- ]
- },
"references": {
"reference_data": [
{
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
"refsource": "MISC",
- "url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027",
- "name": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027"
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
+ },
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1027",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1027"
}
]
},
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
"source": {
- "advisory": "AMD-SB-1027 ",
+ "advisory": "AMD-SB-1032",
"discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/39xxx/CVE-2021-39369.json b/2021/39xxx/CVE-2021-39369.json
index 18593f7fc392..9c6b0aee1fe3 100644
--- a/2021/39xxx/CVE-2021-39369.json
+++ b/2021/39xxx/CVE-2021-39369.json
@@ -1,17 +1,72 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-39369",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by authenticated users to access files stored outside of the web root."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.youtube.com/watch?v=7zC84TNpIxw",
+ "refsource": "MISC",
+ "name": "https://www.youtube.com/watch?v=7zC84TNpIxw"
+ },
+ {
+ "url": "https://www.usa.philips.com/healthcare",
+ "refsource": "MISC",
+ "name": "https://www.usa.philips.com/healthcare"
+ },
+ {
+ "url": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01",
+ "refsource": "MISC",
+ "name": "https://www.cisa.gov/uscert/ics/advisories/icsma-21-187-01"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39426.json b/2021/39xxx/CVE-2021-39426.json
index a49cc3c1f720..3ce30f8f592d 100644
--- a/2021/39xxx/CVE-2021-39426.json
+++ b/2021/39xxx/CVE-2021-39426.json
@@ -1,17 +1,61 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
- "ID": "CVE-2021-39426",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ID": "CVE-2021-39426",
+ "STATE": "PUBLIC"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "n/a"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An issue was discovered in /Upload/admin/admin_notify.php in Seacms 11.4 allows attackers to execute arbitrary php code via the notify1 parameter when the action parameter equals set."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://github.com/seacms-com/seacms/issues/21",
+ "url": "https://github.com/seacms-com/seacms/issues/21"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39427.json b/2021/39xxx/CVE-2021-39427.json
index d487875aafc8..c2b35b017101 100644
--- a/2021/39xxx/CVE-2021-39427.json
+++ b/2021/39xxx/CVE-2021-39427.json
@@ -1,17 +1,61 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
- "ID": "CVE-2021-39427",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ID": "CVE-2021-39427",
+ "STATE": "PUBLIC"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "n/a"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Cross site scripting vulnerability in 188Jianzhan 2.10 allows attackers to execute arbitrary code via the username parameter to /admin/reg.php."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/vtime-tech/188Jianzhan/issues/4",
+ "refsource": "MISC",
+ "name": "https://github.com/vtime-tech/188Jianzhan/issues/4"
}
]
}
diff --git a/2021/39xxx/CVE-2021-39428.json b/2021/39xxx/CVE-2021-39428.json
index 57daad666867..e798f3a29b77 100644
--- a/2021/39xxx/CVE-2021-39428.json
+++ b/2021/39xxx/CVE-2021-39428.json
@@ -1,17 +1,61 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
- "ID": "CVE-2021-39428",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ID": "CVE-2021-39428",
+ "STATE": "PUBLIC"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "n/a"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Cross Site Scripting (XSS) vulnerability in Users.php in eyoucms 1.5.4 allows remote attackers to run arbitrary code and gain escalated privilege via the filename for edit_users_head_pic."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/eyoucms/eyoucms/issues/14",
+ "refsource": "MISC",
+ "name": "https://github.com/eyoucms/eyoucms/issues/14"
}
]
}
diff --git a/2021/3xxx/CVE-2021-3092.json b/2021/3xxx/CVE-2021-3092.json
index 0a5e716a1e4c..35cd9d5e4b49 100644
--- a/2021/3xxx/CVE-2021-3092.json
+++ b/2021/3xxx/CVE-2021-3092.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-3092",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/3xxx/CVE-2021-3093.json b/2021/3xxx/CVE-2021-3093.json
index 1f5072518c05..4e224777dd03 100644
--- a/2021/3xxx/CVE-2021-3093.json
+++ b/2021/3xxx/CVE-2021-3093.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-3093",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/3xxx/CVE-2021-3094.json b/2021/3xxx/CVE-2021-3094.json
index 459a2684f33e..bc5496eda4c8 100644
--- a/2021/3xxx/CVE-2021-3094.json
+++ b/2021/3xxx/CVE-2021-3094.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-3094",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/3xxx/CVE-2021-3096.json b/2021/3xxx/CVE-2021-3096.json
index 5ea54bd8ad86..5d9a9b144c86 100644
--- a/2021/3xxx/CVE-2021-3096.json
+++ b/2021/3xxx/CVE-2021-3096.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-3096",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/3xxx/CVE-2021-3097.json b/2021/3xxx/CVE-2021-3097.json
index b413c4cccf79..ce9b7065e388 100644
--- a/2021/3xxx/CVE-2021-3097.json
+++ b/2021/3xxx/CVE-2021-3097.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-3097",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/3xxx/CVE-2021-3098.json b/2021/3xxx/CVE-2021-3098.json
index dcdd00081b8d..c718d6832427 100644
--- a/2021/3xxx/CVE-2021-3098.json
+++ b/2021/3xxx/CVE-2021-3098.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-3098",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/3xxx/CVE-2021-3102.json b/2021/3xxx/CVE-2021-3102.json
index e22ff36d2090..81e15982a6d6 100644
--- a/2021/3xxx/CVE-2021-3102.json
+++ b/2021/3xxx/CVE-2021-3102.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-3102",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/3xxx/CVE-2021-3103.json b/2021/3xxx/CVE-2021-3103.json
index 04bc7b4065b9..96cd0fa1f5e5 100644
--- a/2021/3xxx/CVE-2021-3103.json
+++ b/2021/3xxx/CVE-2021-3103.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-3103",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/3xxx/CVE-2021-3104.json b/2021/3xxx/CVE-2021-3104.json
index cbf631c471d6..6e7ca8214265 100644
--- a/2021/3xxx/CVE-2021-3104.json
+++ b/2021/3xxx/CVE-2021-3104.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-3104",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/3xxx/CVE-2021-3105.json b/2021/3xxx/CVE-2021-3105.json
index 0f7350008401..dd5ef789298c 100644
--- a/2021/3xxx/CVE-2021-3105.json
+++ b/2021/3xxx/CVE-2021-3105.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-3105",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2021/3xxx/CVE-2021-3485.json b/2021/3xxx/CVE-2021-3485.json
index da6a7dd7a234..3095ad1e719c 100644
--- a/2021/3xxx/CVE-2021-3485.json
+++ b/2021/3xxx/CVE-2021-3485.json
@@ -1,15 +1,38 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "cve-requests@bitdefender.com",
- "DATE_PUBLIC": "2021-05-21T09:00:00.000Z",
"ID": "CVE-2021-3485",
- "STATE": "PUBLIC",
- "TITLE": "Improper Input Validation in Bitdefender Endpoint Security Tools for Linux"
+ "ASSIGNER": "cve-requests@bitdefender.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.155."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-494 Download of Code Without Integrity Check",
+ "cweId": "CWE-494"
+ }
+ ]
+ }
+ ]
},
"affects": {
"vendor": {
"vendor_data": [
{
+ "vendor_name": "Bitdefender",
"product": {
"product_data": [
{
@@ -17,85 +40,70 @@
"version": {
"version_data": [
{
- "version_affected": "<",
- "version_value": "6.2.21.155"
+ "version_value": "unspecified",
+ "version_affected": "="
}
]
}
}
]
- },
- "vendor_name": "Bitdefender"
+ }
}
]
}
},
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "An Improper Input Validation vulnerability in the Product Update feature of Bitdefender Endpoint Security Tools for Linux allows a man-in-the-middle attacker to abuse the DownloadFile function of the Product Update to achieve remote code execution. This issue affects: Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.155."
- }
- ]
- },
- "generator": {
- "engine": "Vulnogram 0.0.9"
- },
- "impact": {
- "cvss": {
- "attackComplexity": "HIGH",
- "attackVector": "ADJACENT_NETWORK",
- "availabilityImpact": "HIGH",
- "baseScore": 6.4,
- "baseSeverity": "MEDIUM",
- "confidentialityImpact": "HIGH",
- "integrityImpact": "HIGH",
- "privilegesRequired": "HIGH",
- "scope": "UNCHANGED",
- "userInteraction": "NONE",
- "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
- "version": "3.1"
- }
- },
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-20 Improper Input Validation"
- }
- ]
- }
- ]
- },
"references": {
"reference_data": [
{
- "refsource": "MISC",
"url": "https://www.bitdefender.com/support/security-advisories/improper-input-validation-in-bitdefender-endpoint-security-tools-for-linux-va-9769",
+ "refsource": "MISC",
"name": "https://www.bitdefender.com/support/security-advisories/improper-input-validation-in-bitdefender-endpoint-security-tools-for-linux-va-9769"
},
{
+ "url": "https://herolab.usd.de/security-advisories/usd-2021-0014/",
"refsource": "MISC",
- "name": "https://herolab.usd.de/security-advisories/usd-2021-0014/",
- "url": "https://herolab.usd.de/security-advisories/usd-2021-0014/"
+ "name": "https://herolab.usd.de/security-advisories/usd-2021-0014/"
}
]
},
- "solution": [
- {
- "lang": "eng",
- "value": "An automatic update to version 6.2.21.155 fixes the issue."
- }
- ],
+ "generator": {
+ "engine": "Vulnogram 0.0.9"
+ },
"source": {
"defect": [
"VA-9769"
],
"discovery": "EXTERNAL"
+ },
+ "solution": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "An automatic update to version 6.2.21.155 fixes the issue.
"
+ }
+ ],
+ "value": "An automatic update to version 6.2.21.155 fixes the issue.\n\n"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "HIGH",
+ "attackVector": "ADJACENT_NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "HIGH",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
+ "version": "3.1"
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/2021/3xxx/CVE-2021-3671.json b/2021/3xxx/CVE-2021-3671.json
index 8f1734c48af6..11d848841dd9 100644
--- a/2021/3xxx/CVE-2021-3671.json
+++ b/2021/3xxx/CVE-2021-3671.json
@@ -68,6 +68,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20221126 [SECURITY] [DLA 3206-1] heimdal security update",
"url": "https://lists.debian.org/debian-lts-announce/2022/11/msg00034.html"
+ },
+ {
+ "refsource": "CONFIRM",
+ "name": "https://security.netapp.com/advisory/ntap-20221215-0002/",
+ "url": "https://security.netapp.com/advisory/ntap-20221215-0002/"
}
]
},
diff --git a/2021/3xxx/CVE-2021-3759.json b/2021/3xxx/CVE-2021-3759.json
index c4341143f770..5bfd89ce1bcc 100644
--- a/2021/3xxx/CVE-2021-3759.json
+++ b/2021/3xxx/CVE-2021-3759.json
@@ -58,6 +58,11 @@
"refsource": "MISC",
"name": "https://lore.kernel.org/linux-mm/1626333284-1404-1-git-send-email-nglaive@gmail.com/",
"url": "https://lore.kernel.org/linux-mm/1626333284-1404-1-git-send-email-nglaive@gmail.com/"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20221222 [SECURITY] [DLA 3244-1] linux-5.10 security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html"
}
]
},
diff --git a/2021/3xxx/CVE-2021-3966.json b/2021/3xxx/CVE-2021-3966.json
index c0125653cca9..081f6040059e 100644
--- a/2021/3xxx/CVE-2021-3966.json
+++ b/2021/3xxx/CVE-2021-3966.json
@@ -4,15 +4,82 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-3966",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "vulnerabilities@zephyrproject.org",
+ "DATE_PUBLIC": "2022-02-16T00:00:00.000Z",
+ "STATE": "PUBLIC",
+ "TITLE": "Usb bluetooth device ACL read cb buffer overflow"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "zephyrproject-rtos",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "zephyr",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_value": "v3.0"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H",
+ "attackVector": "Adjacent",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "NONE",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "HIGH",
+ "availabilityImpact": "HIGH",
+ "baseSeverity": "CRITICAL"
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Heap-based Buffer Overflow (CWE-122)"
+ }
+ ]
}
]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hfxq-3w6x-fv2m",
+ "refsource": "MISC",
+ "name": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hfxq-3w6x-fv2m"
+ }
+ ]
+ },
+ "source": {
+ "defect": [
+ "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hfxq-3w6x-fv2m"
+ ]
}
-}
\ No newline at end of file
+}
diff --git a/2021/40xxx/CVE-2021-40341.json b/2021/40xxx/CVE-2021-40341.json
index 5bb426b5d098..64d8549d64b0 100644
--- a/2021/40xxx/CVE-2021-40341.json
+++ b/2021/40xxx/CVE-2021-40341.json
@@ -1,17 +1,186 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-40341",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "cybersecurity@hitachienergy.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "DES cipher, which has inadequate encryption strength, is used Hitachi Energy FOXMAN-UN to encrypt user credentials used to access the Network Elements. Successful exploitation allows sensitive information to be decrypted easily. This issue affects * FOXMAN-UN product: FOXMAN-UN R16A, FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; * UNEM product: UNEM R16A, UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C. List of CPEs: * cpe:2.3:a:hitachienergy:foxman-un:R16A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R16A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:*"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-326 Inadequate Encryption Strength",
+ "cweId": "CWE-326"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Hitachi Energy",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "FOXMAN-UN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "FOXMAN-UN R16A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "FOXMAN-UN R15B",
+ "version_affected": "="
+ },
+ {
+ "version_value": "FOXMAN-UN R15A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "FOXMAN-UN R14B",
+ "version_affected": "="
+ },
+ {
+ "version_value": "FOXMAN-UN R14A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "FOXMAN-UN R11B",
+ "version_affected": "="
+ },
+ {
+ "version_value": "FOXMAN-UN R11A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "FOXMAN-UN R10C",
+ "version_affected": "="
+ },
+ {
+ "version_value": "FOXMAN-UN R9C",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "UNEM",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "UNEM R16A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "UNEM R15B",
+ "version_affected": "="
+ },
+ {
+ "version_value": "UNEM R15A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "UNEM R14B",
+ "version_affected": "="
+ },
+ {
+ "version_value": "UNEM R14A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "UNEM R11B",
+ "version_affected": "="
+ },
+ {
+ "version_value": "UNEM R11A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "UNEM R10C",
+ "version_affected": "="
+ },
+ {
+ "version_value": "UNEM R9C",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000083&LanguageCode=en&DocumentPartId=&Action=Launch",
+ "refsource": "MISC",
+ "name": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000083&LanguageCode=en&DocumentPartId=&Action=Launch"
+ },
+ {
+ "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000084&LanguageCode=en&DocumentPartId=&Action=Launch",
+ "refsource": "MISC",
+ "name": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000084&LanguageCode=en&DocumentPartId=&Action=Launch"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "work_around": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "\n\nThe vulnerabilities are partially remediated in FOXMAN-UN R16A or UNEM R16A, the full remediation will be done in the upcoming release (planned).\n
For immediate recommended mitigation actions if using FOXMAN-UN R16A or UNEM R16A,\nplease refer to the \n\nDatabase contains credentials with weak encryption\n\nclause of section Mitigation Factors/Workarounds\nin the respective products' advisory.\n
For immediate recommended mitigation actions if using FOXMAN-UN R15B or UNEM R15B and earlier, please refer to the multiple clauses of section Mitigation Factors/Workarounds in the advisory
- Secure the NMS CLIENT/SERVER communication.
- Embedded FOXCST with RADIUS authentication should be avoided.
- Database contains credentials with weak encryption.\n\n
"
+ }
+ ],
+ "value": "\nThe vulnerabilities are partially remediated in FOXMAN-UN R16A or UNEM R16A, the full remediation will be done in the upcoming release (planned).\n\n\nFor immediate recommended mitigation actions if using FOXMAN-UN R16A or UNEM R16A,\nplease refer to the \n\nDatabase contains credentials with weak encryption\n\nclause of section Mitigation Factors/Workarounds\nin the respective products' advisory.\n\n\nFor immediate recommended mitigation actions if using FOXMAN-UN R15B or UNEM R15B and earlier, please refer to the multiple clauses of section Mitigation Factors/Workarounds in the advisory\n * Secure the NMS CLIENT/SERVER communication.\u00a0\n * Embedded FOXCST with RADIUS authentication should be avoided.\u00a0\n * Database contains credentials with weak encryption.\n\n\n\n\n"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "K-Businessom AG, Austria"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "LOCAL",
+ "availabilityImpact": "NONE",
+ "baseScore": 7.1,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2021/40xxx/CVE-2021-40342.json b/2021/40xxx/CVE-2021-40342.json
index 664da61ab94f..2fe3c8c096ea 100644
--- a/2021/40xxx/CVE-2021-40342.json
+++ b/2021/40xxx/CVE-2021-40342.json
@@ -1,17 +1,186 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-40342",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "cybersecurity@hitachienergy.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In the DES implementation, the affected product versions use a default key for encryption. Successful exploitation allows an attacker to obtain sensitive information and gain access to the network elements that are managed by the affected products versions. This issue affects * FOXMAN-UN product: FOXMAN-UN R16A, FOXMAN-UN R15B, FOXMAN-UN R15A, FOXMAN-UN R14B, FOXMAN-UN R14A, FOXMAN-UN R11B, FOXMAN-UN R11A, FOXMAN-UN R10C, FOXMAN-UN R9C; * UNEM product: UNEM R16A, UNEM R15B, UNEM R15A, UNEM R14B, UNEM R14A, UNEM R11B, UNEM R11A, UNEM R10C, UNEM R9C. List of CPEs: * cpe:2.3:a:hitachienergy:foxman-un:R16A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:foxman-un:R9C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R16A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R15A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R14A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11B:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R11A:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R10C:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:unem:R9C:*:*:*:*:*:*:*"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-798 Use of Hard-coded Credentials",
+ "cweId": "CWE-798"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Hitachi Energy",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "FOXMAN-UN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "FOXMAN-UN R16A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "FOXMAN-UN R15B",
+ "version_affected": "="
+ },
+ {
+ "version_value": "FOXMAN-UN R15A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "FOXMAN-UN R14B",
+ "version_affected": "="
+ },
+ {
+ "version_value": "FOXMAN-UN R14A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "FOXMAN-UN R11B",
+ "version_affected": "="
+ },
+ {
+ "version_value": "FOXMAN-UN R11A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "FOXMAN-UN R10C",
+ "version_affected": "="
+ },
+ {
+ "version_value": "FOXMAN-UN R9C",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "UNEM",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "UNEM R16A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "UNEM R15B",
+ "version_affected": "="
+ },
+ {
+ "version_value": "UNEM R15A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "UNEM R14B",
+ "version_affected": "="
+ },
+ {
+ "version_value": "UNEM R14A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "UNEM R11B",
+ "version_affected": "="
+ },
+ {
+ "version_value": "UNEM R11A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "UNEM R10C",
+ "version_affected": "="
+ },
+ {
+ "version_value": "UNEM R9C",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000083&LanguageCode=en&DocumentPartId=&Action=Launch",
+ "refsource": "MISC",
+ "name": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000083&LanguageCode=en&DocumentPartId=&Action=Launch"
+ },
+ {
+ "url": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000084&LanguageCode=en&DocumentPartId=&Action=Launch",
+ "refsource": "MISC",
+ "name": "https://search.abb.com/library/Download.aspx?DocumentID=8DBD000084&LanguageCode=en&DocumentPartId=&Action=Launch"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "work_around": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "\n\n\n\nThe vulnerabilities are partially remediated in FOXMAN-UN R16A or UNEM R16A, the full remediation will be done in the upcoming release (planned).\n
For immediate recommended mitigation actions if using FOXMAN-UN R16A or UNEM R16A,\nplease refer to the \n\nDatabase contains credentials with weak encryption\n\nclause of section Mitigation Factors/Workarounds\nin the respective products' advisory.\n
For immediate recommended mitigation actions if using FOXMAN-UN R15B or UNEM R15B and earlier, please refer to the multiple clauses of section Mitigation Factors/Workarounds in the advisory
- Secure the NMS CLIENT/SERVER communication.
- Embedded FOXCST with RADIUS authentication should be avoided.
- Database contains credentials with weak encryption.
"
+ }
+ ],
+ "value": "\n\n\nThe vulnerabilities are partially remediated in FOXMAN-UN R16A or UNEM R16A, the full remediation will be done in the upcoming release (planned).\n\n\nFor immediate recommended mitigation actions if using FOXMAN-UN R16A or UNEM R16A,\nplease refer to the \n\nDatabase contains credentials with weak encryption\n\nclause of section Mitigation Factors/Workarounds\nin the respective products' advisory.\n\n\nFor immediate recommended mitigation actions if using FOXMAN-UN R15B or UNEM R15B and earlier, please refer to the multiple clauses of section Mitigation Factors/Workarounds in the advisory\n * Secure the NMS CLIENT/SERVER communication. \n * Embedded FOXCST with RADIUS authentication should be avoided. \n * Database contains credentials with weak encryption.\n\n\n"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "value": "K-Businessom AG, Austria"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "LOCAL",
+ "availabilityImpact": "NONE",
+ "baseScore": 7.1,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2021/40xxx/CVE-2021-40365.json b/2021/40xxx/CVE-2021-40365.json
index 64ddb91408ad..29cb2e248e48 100644
--- a/2021/40xxx/CVE-2021-40365.json
+++ b/2021/40xxx/CVE-2021-40365.json
@@ -1,12 +1,33 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2021-40365",
+ "ASSIGNER": "productcert@siemens.com",
"STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_version": "4.0",
- "data_type": "CVE",
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability has been identified in SIMATIC Drive Controller family, SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), SIMATIC S7-1200 CPU family (incl. SIPLUS variants), SIMATIC S7-1500 CPU 1510SP F-1 PN, SIMATIC S7-1500 CPU 1510SP-1 PN, SIMATIC S7-1500 CPU 1511-1 PN, SIMATIC S7-1500 CPU 1511-1 PN, SIMATIC S7-1500 CPU 1511C-1 PN, SIMATIC S7-1500 CPU 1511C-1 PN, SIMATIC S7-1500 CPU 1511F-1 PN, SIMATIC S7-1500 CPU 1511F-1 PN, SIMATIC S7-1500 CPU 1511T-1 PN, SIMATIC S7-1500 CPU 1511TF-1 PN, SIMATIC S7-1500 CPU 1512C-1 PN, SIMATIC S7-1500 CPU 1512C-1 PN, SIMATIC S7-1500 CPU 1512SP F-1 PN, SIMATIC S7-1500 CPU 1512SP-1 PN, SIMATIC S7-1500 CPU 1513-1 PN, SIMATIC S7-1500 CPU 1513-1 PN, SIMATIC S7-1500 CPU 1513F-1 PN, SIMATIC S7-1500 CPU 1513F-1 PN, SIMATIC S7-1500 CPU 1513R-1 PN, SIMATIC S7-1500 CPU 1515-2 PN, SIMATIC S7-1500 CPU 1515-2 PN, SIMATIC S7-1500 CPU 1515F-2 PN, SIMATIC S7-1500 CPU 1515F-2 PN, SIMATIC S7-1500 CPU 1515R-2 PN, SIMATIC S7-1500 CPU 1515T-2 PN, SIMATIC S7-1500 CPU 1515TF-2 PN, SIMATIC S7-1500 CPU 1516-3 PN/DP, SIMATIC S7-1500 CPU 1516-3 PN/DP, SIMATIC S7-1500 CPU 1516F-3 PN/DP, SIMATIC S7-1500 CPU 1516F-3 PN/DP, SIMATIC S7-1500 CPU 1516T-3 PN/DP, SIMATIC S7-1500 CPU 1516TF-3 PN/DP, SIMATIC S7-1500 CPU 1517-3 PN/DP, SIMATIC S7-1500 CPU 1517F-3 PN/DP, SIMATIC S7-1500 CPU 1517H-3 PN, SIMATIC S7-1500 CPU 1517T-3 PN/DP, SIMATIC S7-1500 CPU 1517TF-3 PN/DP, SIMATIC S7-1500 CPU 1518-4 PN/DP, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518-4F PN/DP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518HF-4 PN, SIMATIC S7-1500 CPU 1518T-4 PN/DP, SIMATIC S7-1500 CPU 1518TF-4 PN/DP, SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK, SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK, SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN, SIMATIC S7-1500 Software Controller, SIMATIC S7-PLCSIM Advanced, SIPLUS ET 200SP CPU 1510SP F-1 PN, SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL, SIPLUS ET 200SP CPU 1510SP-1 PN, SIPLUS ET 200SP CPU 1510SP-1 PN, SIPLUS ET 200SP CPU 1510SP-1 PN RAIL, SIPLUS ET 200SP CPU 1510SP-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP F-1 PN, SIPLUS ET 200SP CPU 1512SP F-1 PN, SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP-1 PN, SIPLUS ET 200SP CPU 1512SP-1 PN, SIPLUS ET 200SP CPU 1512SP-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP-1 PN RAIL, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL, SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL, SIPLUS S7-1500 CPU 1511-1 PN TX RAIL, SIPLUS S7-1500 CPU 1511-1 PN TX RAIL, SIPLUS S7-1500 CPU 1511F-1 PN, SIPLUS S7-1500 CPU 1511F-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513F-1 PN, SIPLUS S7-1500 CPU 1513F-1 PN, SIPLUS S7-1500 CPU 1515F-2 PN, SIPLUS S7-1500 CPU 1515F-2 PN, SIPLUS S7-1500 CPU 1515F-2 PN RAIL, SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL, SIPLUS S7-1500 CPU 1515R-2 PN, SIPLUS S7-1500 CPU 1515R-2 PN TX RAIL, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL, SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL, SIPLUS S7-1500 CPU 1516F-3 PN/DP, SIPLUS S7-1500 CPU 1516F-3 PN/DP, SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL, SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL, SIPLUS S7-1500 CPU 1517H-3 PN, SIPLUS S7-1500 CPU 1518-4 PN/DP, SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, SIPLUS S7-1500 CPU 1518F-4 PN/DP, SIPLUS S7-1500 CPU 1518HF-4 PN, SIPLUS TIM 1531 IRC, TIM 1531 IRC. Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial-of-service in the device."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-20: Improper Input Validation",
+ "cweId": "CWE-20"
+ }
+ ]
+ }
+ ]
+ },
"affects": {
"vendor": {
"vendor_data": [
@@ -15,61 +36,815 @@
"product": {
"product_data": [
{
- "product_name": "SIMATIC Drive Controller family",
+ "product_name": "SIMATIC Drive Controller family",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1200 CPU family (incl. SIPLUS variants)",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V4.6.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1510SP F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1510SP-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511C-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511T-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511TF-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1512C-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1512SP F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1512SP-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1513-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1513F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1513R-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515F-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515R-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515T-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515TF-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1516-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1516F-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1516T-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1516TF-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517F-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517H-3 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517T-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517TF-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518-4F PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518HF-4 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518T-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518TF-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN",
"version": {
"version_data": [
{
- "version_value": "All versions < V3.0.1"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)",
+ "product_name": "SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN",
"version": {
"version_data": [
{
- "version_value": "All versions"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC S7-1200 CPU family (incl. SIPLUS variants)",
+ "product_name": "SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN",
"version": {
"version_data": [
{
- "version_value": "All versions < V4.6.0"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)",
+ "product_name": "SIMATIC S7-1500 Software Controller",
"version": {
"version_data": [
{
- "version_value": "All versions < V3.0.1"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC S7-1500 Software Controller",
+ "product_name": "SIMATIC S7-PLCSIM Advanced",
"version": {
"version_data": [
{
- "version_value": "All versions"
+ "version_value": "All versions < V5.0",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC S7-PLCSIM Advanced",
+ "product_name": "SIPLUS ET 200SP CPU 1510SP F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1510SP-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1510SP-1 PN RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1512SP F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1512SP-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1512SP-1 PN RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1511-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1511-1 PN TX RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1511F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1513-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1513F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515F-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515F-2 PN RAIL",
"version": {
"version_data": [
{
- "version_value": "All versions < V5.0"
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515R-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515R-2 PN TX RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1517H-3 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1518-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1518F-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1518HF-4 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
}
]
}
@@ -79,7 +854,8 @@
"version": {
"version_data": [
{
- "version_value": "All versions"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
@@ -89,7 +865,8 @@
"version": {
"version_data": [
{
- "version_value": "All versions"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
@@ -100,33 +877,23 @@
]
}
},
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-20: Improper Input Validation"
- }
- ]
- }
- ]
- },
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V3.0.1), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.6.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V3.0.1), SIMATIC S7-1500 Software Controller (All versions), SIMATIC S7-PLCSIM Advanced (All versions < V5.0), SIPLUS TIM 1531 IRC (All versions), TIM 1531 IRC (All versions). Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial-of-service in the device."
- }
- ]
- },
"references": {
"reference_data": [
{
- "refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-382653.pdf",
+ "refsource": "MISC",
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-382653.pdf"
}
]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH"
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/2021/40xxx/CVE-2021-40393.json b/2021/40xxx/CVE-2021-40393.json
index 1eb59b483a9b..fed9ffedb275 100644
--- a/2021/40xxx/CVE-2021-40393.json
+++ b/2021/40xxx/CVE-2021-40393.json
@@ -48,6 +48,11 @@
"refsource": "MISC",
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1404",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1404"
+ },
+ {
+ "refsource": "DEBIAN",
+ "name": "DSA-5306",
+ "url": "https://www.debian.org/security/2022/dsa-5306"
}
]
},
diff --git a/2021/40xxx/CVE-2021-40394.json b/2021/40xxx/CVE-2021-40394.json
index 954959f2bad1..663ac567d341 100644
--- a/2021/40xxx/CVE-2021-40394.json
+++ b/2021/40xxx/CVE-2021-40394.json
@@ -48,6 +48,11 @@
"refsource": "MISC",
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1404",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2021-1404"
+ },
+ {
+ "refsource": "DEBIAN",
+ "name": "DSA-5306",
+ "url": "https://www.debian.org/security/2022/dsa-5306"
}
]
},
diff --git a/2021/40xxx/CVE-2021-40401.json b/2021/40xxx/CVE-2021-40401.json
index 72b79a957e0a..584a71941ef1 100644
--- a/2021/40xxx/CVE-2021-40401.json
+++ b/2021/40xxx/CVE-2021-40401.json
@@ -53,6 +53,11 @@
"refsource": "FEDORA",
"name": "FEDORA-2022-4a3ef86baa",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TUM5GIUZJ7AVHVCXDZW6ZVCAPV2ISN47/"
+ },
+ {
+ "refsource": "DEBIAN",
+ "name": "DSA-5306",
+ "url": "https://www.debian.org/security/2022/dsa-5306"
}
]
},
diff --git a/2021/40xxx/CVE-2021-40403.json b/2021/40xxx/CVE-2021-40403.json
index ac1be6ba7a0c..0bf3f1bf6d7f 100644
--- a/2021/40xxx/CVE-2021-40403.json
+++ b/2021/40xxx/CVE-2021-40403.json
@@ -53,6 +53,11 @@
"refsource": "FEDORA",
"name": "FEDORA-2022-e819bd191f",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PTGBC37N2FV7NKOWFVCFMPAFYEPHSB7C/"
+ },
+ {
+ "refsource": "DEBIAN",
+ "name": "DSA-5306",
+ "url": "https://www.debian.org/security/2022/dsa-5306"
}
]
},
diff --git a/2021/41xxx/CVE-2021-41006.json b/2021/41xxx/CVE-2021-41006.json
index afffa7153eda..d25b768ce356 100644
--- a/2021/41xxx/CVE-2021-41006.json
+++ b/2021/41xxx/CVE-2021-41006.json
@@ -1,17 +1,17 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-41006",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-alert@hpe.com",
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "CVE was unused by HPE."
}
]
}
diff --git a/2021/41xxx/CVE-2021-41007.json b/2021/41xxx/CVE-2021-41007.json
index 93ca24e752a3..b9e5d2ad1b24 100644
--- a/2021/41xxx/CVE-2021-41007.json
+++ b/2021/41xxx/CVE-2021-41007.json
@@ -1,17 +1,17 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-41007",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-alert@hpe.com",
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "CVE was unused by HPE."
}
]
}
diff --git a/2021/41xxx/CVE-2021-41008.json b/2021/41xxx/CVE-2021-41008.json
index 6de43d24a700..10917dca9607 100644
--- a/2021/41xxx/CVE-2021-41008.json
+++ b/2021/41xxx/CVE-2021-41008.json
@@ -1,17 +1,17 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-41008",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-alert@hpe.com",
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "CVE was unused by HPE."
}
]
}
diff --git a/2021/41xxx/CVE-2021-41009.json b/2021/41xxx/CVE-2021-41009.json
index 40a7b4ffddd1..59cddfb79435 100644
--- a/2021/41xxx/CVE-2021-41009.json
+++ b/2021/41xxx/CVE-2021-41009.json
@@ -1,17 +1,17 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-41009",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-alert@hpe.com",
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "CVE was unused by HPE."
}
]
}
diff --git a/2021/41xxx/CVE-2021-41010.json b/2021/41xxx/CVE-2021-41010.json
index b3916dfff76a..2fb353ed00c1 100644
--- a/2021/41xxx/CVE-2021-41010.json
+++ b/2021/41xxx/CVE-2021-41010.json
@@ -1,17 +1,17 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-41010",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-alert@hpe.com",
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "CVE was unused by HPE."
}
]
}
diff --git a/2021/41xxx/CVE-2021-41823.json b/2021/41xxx/CVE-2021-41823.json
index ef63df7d0fbd..dc1cf72cc18c 100644
--- a/2021/41xxx/CVE-2021-41823.json
+++ b/2021/41xxx/CVE-2021-41823.json
@@ -1,17 +1,61 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
- "ID": "CVE-2021-41823",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ID": "CVE-2021-41823",
+ "STATE": "PUBLIC"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "n/a"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Web Application Firewall (WAF) in Kemp LoadMaster 7.2.54.1 allows certain uses of onmouseover to bypass an XSS protection mechanism."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://pastebin.com/kpx9Nvbf",
+ "url": "https://pastebin.com/kpx9Nvbf"
}
]
}
diff --git a/2021/41xxx/CVE-2021-41977.json b/2021/41xxx/CVE-2021-41977.json
index cc8d39d68f0d..b0d659c8a394 100644
--- a/2021/41xxx/CVE-2021-41977.json
+++ b/2021/41xxx/CVE-2021-41977.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-41977",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none."
}
]
}
diff --git a/2021/41xxx/CVE-2021-41978.json b/2021/41xxx/CVE-2021-41978.json
index 8d37ddfbf2b7..2921fe27b67b 100644
--- a/2021/41xxx/CVE-2021-41978.json
+++ b/2021/41xxx/CVE-2021-41978.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-41978",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none."
}
]
}
diff --git a/2021/41xxx/CVE-2021-41979.json b/2021/41xxx/CVE-2021-41979.json
index d30335850835..da48a5a6afd3 100644
--- a/2021/41xxx/CVE-2021-41979.json
+++ b/2021/41xxx/CVE-2021-41979.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-41979",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none."
}
]
}
diff --git a/2021/41xxx/CVE-2021-41980.json b/2021/41xxx/CVE-2021-41980.json
index 009bb4c1df3d..a45e2b21767a 100644
--- a/2021/41xxx/CVE-2021-41980.json
+++ b/2021/41xxx/CVE-2021-41980.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-41980",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none."
}
]
}
diff --git a/2021/41xxx/CVE-2021-41981.json b/2021/41xxx/CVE-2021-41981.json
index 2bcc8381a5e4..e44b35d35528 100644
--- a/2021/41xxx/CVE-2021-41981.json
+++ b/2021/41xxx/CVE-2021-41981.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-41981",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none."
}
]
}
diff --git a/2021/41xxx/CVE-2021-41982.json b/2021/41xxx/CVE-2021-41982.json
index 58ce075491b9..396b6e24738f 100644
--- a/2021/41xxx/CVE-2021-41982.json
+++ b/2021/41xxx/CVE-2021-41982.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-41982",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none."
}
]
}
diff --git a/2021/41xxx/CVE-2021-41983.json b/2021/41xxx/CVE-2021-41983.json
index d071d3f18319..fb149785a50f 100644
--- a/2021/41xxx/CVE-2021-41983.json
+++ b/2021/41xxx/CVE-2021-41983.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-41983",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none."
}
]
}
diff --git a/2021/41xxx/CVE-2021-41984.json b/2021/41xxx/CVE-2021-41984.json
index 5caebf19464c..3b7c0e4f3111 100644
--- a/2021/41xxx/CVE-2021-41984.json
+++ b/2021/41xxx/CVE-2021-41984.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-41984",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none."
}
]
}
diff --git a/2021/41xxx/CVE-2021-41985.json b/2021/41xxx/CVE-2021-41985.json
index ef59d46ee525..c7d1050b7559 100644
--- a/2021/41xxx/CVE-2021-41985.json
+++ b/2021/41xxx/CVE-2021-41985.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-41985",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none."
}
]
}
diff --git a/2021/41xxx/CVE-2021-41986.json b/2021/41xxx/CVE-2021-41986.json
index bc54ec2a5f54..d60bacfc1064 100644
--- a/2021/41xxx/CVE-2021-41986.json
+++ b/2021/41xxx/CVE-2021-41986.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2021-41986",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none."
}
]
}
diff --git a/2021/43xxx/CVE-2021-43395.json b/2021/43xxx/CVE-2021-43395.json
index 4440ac0a9127..9fadbf3c458d 100644
--- a/2021/43xxx/CVE-2021-43395.json
+++ b/2021/43xxx/CVE-2021-43395.json
@@ -1,17 +1,102 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-43395",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, OpenIndiana Hipster 2021.04, and SmartOS 20210923. A local unprivileged user can cause a deadlock and kernel panic via crafted rename and rmdir calls on tmpfs filesystems. Oracle Solaris 10 and 11 is also affected."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/illumos/illumos-gate/blob/069654420de4aade43c63c43cd2896e66945fc8a/usr/src/uts/common/fs/tmpfs/tmp_vnops.c",
+ "refsource": "MISC",
+ "name": "https://github.com/illumos/illumos-gate/blob/069654420de4aade43c63c43cd2896e66945fc8a/usr/src/uts/common/fs/tmpfs/tmp_vnops.c"
+ },
+ {
+ "url": "https://github.com/illumos/illumos-gate/blob/b3403853e80914bd0aade9b5b605da4878078173/usr/src/uts/common/fs/tmpfs/tmp_dir.c",
+ "refsource": "MISC",
+ "name": "https://github.com/illumos/illumos-gate/blob/b3403853e80914bd0aade9b5b605da4878078173/usr/src/uts/common/fs/tmpfs/tmp_dir.c"
+ },
+ {
+ "url": "https://www.oracle.com/security-alerts/cpujan2022.html",
+ "refsource": "MISC",
+ "name": "https://www.oracle.com/security-alerts/cpujan2022.html"
+ },
+ {
+ "url": "http://www.tribblix.org/relnotes.html",
+ "refsource": "MISC",
+ "name": "http://www.tribblix.org/relnotes.html"
+ },
+ {
+ "url": "https://jgardner100.wordpress.com/2022/01/20/security-heads-up/",
+ "refsource": "MISC",
+ "name": "https://jgardner100.wordpress.com/2022/01/20/security-heads-up/"
+ },
+ {
+ "url": "https://illumos.topicbox.com/groups/developer/T1c9e4f27f8c2f959/security-heads-up-illumos14424",
+ "refsource": "MISC",
+ "name": "https://illumos.topicbox.com/groups/developer/T1c9e4f27f8c2f959/security-heads-up-illumos14424"
+ },
+ {
+ "url": "https://www.illumos.org/issues/14424",
+ "refsource": "MISC",
+ "name": "https://www.illumos.org/issues/14424"
+ },
+ {
+ "url": "https://github.com/illumos/illumos-gate/commit/f859e7171bb5db34321e45585839c6c3200ebb90",
+ "refsource": "MISC",
+ "name": "https://github.com/illumos/illumos-gate/commit/f859e7171bb5db34321e45585839c6c3200ebb90"
+ },
+ {
+ "url": "https://kebe.com/blog/?p=505",
+ "refsource": "MISC",
+ "name": "https://kebe.com/blog/?p=505"
}
]
}
diff --git a/2021/43xxx/CVE-2021-43527.json b/2021/43xxx/CVE-2021-43527.json
index d68a41589846..2b86666332dc 100644
--- a/2021/43xxx/CVE-2021-43527.json
+++ b/2021/43xxx/CVE-2021-43527.json
@@ -88,6 +88,11 @@
"refsource": "MISC",
"name": "https://www.starwindsoftware.com/security/sw-20220802-0001/",
"url": "https://www.starwindsoftware.com/security/sw-20220802-0001/"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202212-05",
+ "url": "https://security.gentoo.org/glsa/202212-05"
}
]
},
diff --git a/2021/43xxx/CVE-2021-43657.json b/2021/43xxx/CVE-2021-43657.json
index d0b262ce9c6b..860c0c292bec 100644
--- a/2021/43xxx/CVE-2021-43657.json
+++ b/2021/43xxx/CVE-2021-43657.json
@@ -1,17 +1,61 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
- "ID": "CVE-2021-43657",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ID": "CVE-2021-43657",
+ "STATE": "PUBLIC"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "n/a"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A Stored Cross-site scripting (XSS) vulnerability via MAster.php in Sourcecodetester Simple Client Management System (SCMS) 1.0 allows remote attackers to inject arbitrary web script or HTML via the vulnerable input fields."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://github.com/c0n5n3d/CVE-2021-43657/blob/main/Info.txt",
+ "url": "https://github.com/c0n5n3d/CVE-2021-43657/blob/main/Info.txt"
}
]
}
diff --git a/2021/43xxx/CVE-2021-43666.json b/2021/43xxx/CVE-2021-43666.json
index 949cd7b729d6..197a50f1e92c 100644
--- a/2021/43xxx/CVE-2021-43666.json
+++ b/2021/43xxx/CVE-2021-43666.json
@@ -1,35 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-43666",
+ "ASSIGNER": "cve@mitre.org",
"STATE": "PUBLIC"
},
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "n/a",
- "version": {
- "version_data": [
- {
- "version_value": "n/a"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "n/a"
- }
- ]
- }
- },
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -50,12 +27,41 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
"url": "https://github.com/ARMmbed/mbedtls/issues/5136",
"refsource": "MISC",
"name": "https://github.com/ARMmbed/mbedtls/issues/5136"
+ },
+ {
+ "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html",
+ "refsource": "MISC",
+ "name": "https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html"
}
]
}
diff --git a/2021/44xxx/CVE-2021-44002.json b/2021/44xxx/CVE-2021-44002.json
index 611679e1ec8c..b00c86bc8f82 100644
--- a/2021/44xxx/CVE-2021-44002.json
+++ b/2021/44xxx/CVE-2021-44002.json
@@ -1,12 +1,33 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2021-44002",
+ "ASSIGNER": "productcert@siemens.com",
"STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_version": "4.0",
- "data_type": "CVE",
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt1001.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15058, ZDI-CAN-19076, ZDI-CAN-19077)"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-787: Out-of-bounds Write",
+ "cweId": "CWE-787"
+ }
+ ]
+ }
+ ]
+ },
"affects": {
"vendor": {
"vendor_data": [
@@ -15,21 +36,34 @@
"product": {
"product_data": [
{
- "product_name": "JT2Go",
+ "product_name": "JT Open",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V11.1.1.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "JT Utilities",
"version": {
"version_data": [
{
- "version_value": "All versions < V13.2.0.5"
+ "version_value": "All versions < V13.1.1.0",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "Teamcenter Visualization",
+ "product_name": "Solid Edge",
"version": {
"version_data": [
{
- "version_value": "All versions < V13.2.0.5"
+ "version_value": "All versions < V2023",
+ "version_affected": "="
}
]
}
@@ -40,37 +74,27 @@
]
}
},
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-787: Out-of-bounds Write"
- }
- ]
- }
- ]
- },
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Jt1001.dll contains an out of bounds write past the end of an allocated structure while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-15058)"
- }
- ]
- },
"references": {
"reference_data": [
{
- "refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf",
+ "refsource": "MISC",
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf"
},
{
+ "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-936212.pdf",
"refsource": "MISC",
- "name": "https://www.zerodayinitiative.com/advisories/ZDI-22-006/",
- "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-006/"
+ "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-936212.pdf"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
+ "baseScore": 7.8,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2021/44xxx/CVE-2021-44014.json b/2021/44xxx/CVE-2021-44014.json
index 0c4c49be876f..2452ee60243c 100644
--- a/2021/44xxx/CVE-2021-44014.json
+++ b/2021/44xxx/CVE-2021-44014.json
@@ -1,12 +1,33 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2021-44014",
+ "ASSIGNER": "productcert@siemens.com",
"STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_version": "4.0",
- "data_type": "CVE",
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt1001.dll contains a use-after-free vulnerability that could be triggered while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15057, ZDI-CAN-19081)"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-416: Use After Free",
+ "cweId": "CWE-416"
+ }
+ ]
+ }
+ ]
+ },
"affects": {
"vendor": {
"vendor_data": [
@@ -15,21 +36,34 @@
"product": {
"product_data": [
{
- "product_name": "JT2Go",
+ "product_name": "JT Open",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V11.1.1.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "JT Utilities",
"version": {
"version_data": [
{
- "version_value": "All versions < V13.2.0.5"
+ "version_value": "All versions < V13.1.1.0",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "Teamcenter Visualization",
+ "product_name": "Solid Edge",
"version": {
"version_data": [
{
- "version_value": "All versions < V13.2.0.5"
+ "version_value": "All versions < V2023",
+ "version_affected": "="
}
]
}
@@ -40,37 +74,27 @@
]
}
},
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-416: Use After Free"
- }
- ]
- }
- ]
- },
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Jt1001.dll contains a use-after-free vulnerability that could be triggered while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-15057)"
- }
- ]
- },
"references": {
"reference_data": [
{
- "refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf",
+ "refsource": "MISC",
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-595101.pdf"
},
{
+ "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-936212.pdf",
"refsource": "MISC",
- "name": "https://www.zerodayinitiative.com/advisories/ZDI-22-005/",
- "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-005/"
+ "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-936212.pdf"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
+ "baseScore": 7.8,
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2021/44xxx/CVE-2021-44693.json b/2021/44xxx/CVE-2021-44693.json
index 7ebc4eb74424..813185cf5bd0 100644
--- a/2021/44xxx/CVE-2021-44693.json
+++ b/2021/44xxx/CVE-2021-44693.json
@@ -1,12 +1,33 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2021-44693",
+ "ASSIGNER": "productcert@siemens.com",
"STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_version": "4.0",
- "data_type": "CVE",
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability has been identified in SIMATIC Drive Controller family, SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), SIMATIC S7-1200 CPU family (incl. SIPLUS variants), SIMATIC S7-1500 CPU 1510SP F-1 PN, SIMATIC S7-1500 CPU 1510SP-1 PN, SIMATIC S7-1500 CPU 1511-1 PN, SIMATIC S7-1500 CPU 1511-1 PN, SIMATIC S7-1500 CPU 1511C-1 PN, SIMATIC S7-1500 CPU 1511C-1 PN, SIMATIC S7-1500 CPU 1511F-1 PN, SIMATIC S7-1500 CPU 1511F-1 PN, SIMATIC S7-1500 CPU 1511T-1 PN, SIMATIC S7-1500 CPU 1511TF-1 PN, SIMATIC S7-1500 CPU 1512C-1 PN, SIMATIC S7-1500 CPU 1512C-1 PN, SIMATIC S7-1500 CPU 1512SP F-1 PN, SIMATIC S7-1500 CPU 1512SP-1 PN, SIMATIC S7-1500 CPU 1513-1 PN, SIMATIC S7-1500 CPU 1513-1 PN, SIMATIC S7-1500 CPU 1513F-1 PN, SIMATIC S7-1500 CPU 1513F-1 PN, SIMATIC S7-1500 CPU 1513R-1 PN, SIMATIC S7-1500 CPU 1515-2 PN, SIMATIC S7-1500 CPU 1515-2 PN, SIMATIC S7-1500 CPU 1515F-2 PN, SIMATIC S7-1500 CPU 1515F-2 PN, SIMATIC S7-1500 CPU 1515R-2 PN, SIMATIC S7-1500 CPU 1515T-2 PN, SIMATIC S7-1500 CPU 1515TF-2 PN, SIMATIC S7-1500 CPU 1516-3 PN/DP, SIMATIC S7-1500 CPU 1516-3 PN/DP, SIMATIC S7-1500 CPU 1516F-3 PN/DP, SIMATIC S7-1500 CPU 1516F-3 PN/DP, SIMATIC S7-1500 CPU 1516T-3 PN/DP, SIMATIC S7-1500 CPU 1516TF-3 PN/DP, SIMATIC S7-1500 CPU 1517-3 PN/DP, SIMATIC S7-1500 CPU 1517F-3 PN/DP, SIMATIC S7-1500 CPU 1517H-3 PN, SIMATIC S7-1500 CPU 1517T-3 PN/DP, SIMATIC S7-1500 CPU 1517TF-3 PN/DP, SIMATIC S7-1500 CPU 1518-4 PN/DP, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518-4F PN/DP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518HF-4 PN, SIMATIC S7-1500 CPU 1518T-4 PN/DP, SIMATIC S7-1500 CPU 1518TF-4 PN/DP, SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK, SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK, SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN, SIMATIC S7-1500 Software Controller, SIMATIC S7-PLCSIM Advanced, SIPLUS ET 200SP CPU 1510SP F-1 PN, SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL, SIPLUS ET 200SP CPU 1510SP-1 PN, SIPLUS ET 200SP CPU 1510SP-1 PN, SIPLUS ET 200SP CPU 1510SP-1 PN RAIL, SIPLUS ET 200SP CPU 1510SP-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP F-1 PN, SIPLUS ET 200SP CPU 1512SP F-1 PN, SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP-1 PN, SIPLUS ET 200SP CPU 1512SP-1 PN, SIPLUS ET 200SP CPU 1512SP-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP-1 PN RAIL, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL, SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL, SIPLUS S7-1500 CPU 1511-1 PN TX RAIL, SIPLUS S7-1500 CPU 1511-1 PN TX RAIL, SIPLUS S7-1500 CPU 1511F-1 PN, SIPLUS S7-1500 CPU 1511F-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513F-1 PN, SIPLUS S7-1500 CPU 1513F-1 PN, SIPLUS S7-1500 CPU 1515F-2 PN, SIPLUS S7-1500 CPU 1515F-2 PN, SIPLUS S7-1500 CPU 1515F-2 PN RAIL, SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL, SIPLUS S7-1500 CPU 1515R-2 PN, SIPLUS S7-1500 CPU 1515R-2 PN TX RAIL, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL, SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL, SIPLUS S7-1500 CPU 1516F-3 PN/DP, SIPLUS S7-1500 CPU 1516F-3 PN/DP, SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL, SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL, SIPLUS S7-1500 CPU 1517H-3 PN, SIPLUS S7-1500 CPU 1518-4 PN/DP, SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, SIPLUS S7-1500 CPU 1518F-4 PN/DP, SIPLUS S7-1500 CPU 1518HF-4 PN, SIPLUS TIM 1531 IRC, TIM 1531 IRC. Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial-of-service in the device."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-1284: Improper Validation of Specified Quantity in Input",
+ "cweId": "CWE-1284"
+ }
+ ]
+ }
+ ]
+ },
"affects": {
"vendor": {
"vendor_data": [
@@ -15,61 +36,815 @@
"product": {
"product_data": [
{
- "product_name": "SIMATIC Drive Controller family",
+ "product_name": "SIMATIC Drive Controller family",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1200 CPU family (incl. SIPLUS variants)",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V4.6.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1510SP F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1510SP-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511C-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511T-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511TF-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1512C-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1512SP F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1512SP-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1513-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1513F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1513R-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515F-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515R-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515T-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515TF-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1516-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1516F-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1516T-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1516TF-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517F-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517H-3 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517T-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517TF-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518-4F PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518HF-4 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518T-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518TF-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN",
"version": {
"version_data": [
{
- "version_value": "All versions < V3.0.1"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)",
+ "product_name": "SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN",
"version": {
"version_data": [
{
- "version_value": "All versions"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC S7-1200 CPU family (incl. SIPLUS variants)",
+ "product_name": "SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN",
"version": {
"version_data": [
{
- "version_value": "All versions < V4.6.0"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)",
+ "product_name": "SIMATIC S7-1500 Software Controller",
"version": {
"version_data": [
{
- "version_value": "All versions < V3.0.1"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC S7-1500 Software Controller",
+ "product_name": "SIMATIC S7-PLCSIM Advanced",
"version": {
"version_data": [
{
- "version_value": "All versions"
+ "version_value": "All versions < V5.0",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC S7-PLCSIM Advanced",
+ "product_name": "SIPLUS ET 200SP CPU 1510SP F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1510SP-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1510SP-1 PN RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1512SP F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1512SP-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1512SP-1 PN RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1511-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1511-1 PN TX RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1511F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1513-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1513F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515F-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515F-2 PN RAIL",
"version": {
"version_data": [
{
- "version_value": "All versions < V5.0"
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515R-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515R-2 PN TX RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1517H-3 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1518-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1518F-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1518HF-4 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
}
]
}
@@ -79,7 +854,8 @@
"version": {
"version_data": [
{
- "version_value": "All versions"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
@@ -89,7 +865,8 @@
"version": {
"version_data": [
{
- "version_value": "All versions"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
@@ -100,33 +877,23 @@
]
}
},
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-1284: Improper Validation of Specified Quantity in Input"
- }
- ]
- }
- ]
- },
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V3.0.1), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.6.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V3.0.1), SIMATIC S7-1500 Software Controller (All versions), SIMATIC S7-PLCSIM Advanced (All versions < V5.0), SIPLUS TIM 1531 IRC (All versions), TIM 1531 IRC (All versions). Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial-of-service in the device."
- }
- ]
- },
"references": {
"reference_data": [
{
- "refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-382653.pdf",
+ "refsource": "MISC",
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-382653.pdf"
}
]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
+ "baseScore": 4.9,
+ "baseSeverity": "MEDIUM"
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/2021/44xxx/CVE-2021-44694.json b/2021/44xxx/CVE-2021-44694.json
index fbaff3d87231..0bc672406997 100644
--- a/2021/44xxx/CVE-2021-44694.json
+++ b/2021/44xxx/CVE-2021-44694.json
@@ -1,12 +1,33 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2021-44694",
+ "ASSIGNER": "productcert@siemens.com",
"STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_version": "4.0",
- "data_type": "CVE",
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability has been identified in SIMATIC Drive Controller family, SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), SIMATIC S7-1200 CPU family (incl. SIPLUS variants), SIMATIC S7-1500 CPU 1510SP F-1 PN, SIMATIC S7-1500 CPU 1510SP-1 PN, SIMATIC S7-1500 CPU 1511-1 PN, SIMATIC S7-1500 CPU 1511-1 PN, SIMATIC S7-1500 CPU 1511C-1 PN, SIMATIC S7-1500 CPU 1511C-1 PN, SIMATIC S7-1500 CPU 1511F-1 PN, SIMATIC S7-1500 CPU 1511F-1 PN, SIMATIC S7-1500 CPU 1511T-1 PN, SIMATIC S7-1500 CPU 1511TF-1 PN, SIMATIC S7-1500 CPU 1512C-1 PN, SIMATIC S7-1500 CPU 1512C-1 PN, SIMATIC S7-1500 CPU 1512SP F-1 PN, SIMATIC S7-1500 CPU 1512SP-1 PN, SIMATIC S7-1500 CPU 1513-1 PN, SIMATIC S7-1500 CPU 1513-1 PN, SIMATIC S7-1500 CPU 1513F-1 PN, SIMATIC S7-1500 CPU 1513F-1 PN, SIMATIC S7-1500 CPU 1513R-1 PN, SIMATIC S7-1500 CPU 1515-2 PN, SIMATIC S7-1500 CPU 1515-2 PN, SIMATIC S7-1500 CPU 1515F-2 PN, SIMATIC S7-1500 CPU 1515F-2 PN, SIMATIC S7-1500 CPU 1515R-2 PN, SIMATIC S7-1500 CPU 1515T-2 PN, SIMATIC S7-1500 CPU 1515TF-2 PN, SIMATIC S7-1500 CPU 1516-3 PN/DP, SIMATIC S7-1500 CPU 1516-3 PN/DP, SIMATIC S7-1500 CPU 1516F-3 PN/DP, SIMATIC S7-1500 CPU 1516F-3 PN/DP, SIMATIC S7-1500 CPU 1516T-3 PN/DP, SIMATIC S7-1500 CPU 1516TF-3 PN/DP, SIMATIC S7-1500 CPU 1517-3 PN/DP, SIMATIC S7-1500 CPU 1517F-3 PN/DP, SIMATIC S7-1500 CPU 1517H-3 PN, SIMATIC S7-1500 CPU 1517T-3 PN/DP, SIMATIC S7-1500 CPU 1517TF-3 PN/DP, SIMATIC S7-1500 CPU 1518-4 PN/DP, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518-4F PN/DP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518HF-4 PN, SIMATIC S7-1500 CPU 1518T-4 PN/DP, SIMATIC S7-1500 CPU 1518TF-4 PN/DP, SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK, SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK, SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN, SIMATIC S7-1500 Software Controller, SIMATIC S7-PLCSIM Advanced, SIPLUS ET 200SP CPU 1510SP F-1 PN, SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL, SIPLUS ET 200SP CPU 1510SP-1 PN, SIPLUS ET 200SP CPU 1510SP-1 PN, SIPLUS ET 200SP CPU 1510SP-1 PN RAIL, SIPLUS ET 200SP CPU 1510SP-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP F-1 PN, SIPLUS ET 200SP CPU 1512SP F-1 PN, SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP-1 PN, SIPLUS ET 200SP CPU 1512SP-1 PN, SIPLUS ET 200SP CPU 1512SP-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP-1 PN RAIL, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL, SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL, SIPLUS S7-1500 CPU 1511-1 PN TX RAIL, SIPLUS S7-1500 CPU 1511-1 PN TX RAIL, SIPLUS S7-1500 CPU 1511F-1 PN, SIPLUS S7-1500 CPU 1511F-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513F-1 PN, SIPLUS S7-1500 CPU 1513F-1 PN, SIPLUS S7-1500 CPU 1515F-2 PN, SIPLUS S7-1500 CPU 1515F-2 PN, SIPLUS S7-1500 CPU 1515F-2 PN RAIL, SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL, SIPLUS S7-1500 CPU 1515R-2 PN, SIPLUS S7-1500 CPU 1515R-2 PN TX RAIL, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL, SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL, SIPLUS S7-1500 CPU 1516F-3 PN/DP, SIPLUS S7-1500 CPU 1516F-3 PN/DP, SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL, SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL, SIPLUS S7-1500 CPU 1517H-3 PN, SIPLUS S7-1500 CPU 1518-4 PN/DP, SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, SIPLUS S7-1500 CPU 1518F-4 PN/DP, SIPLUS S7-1500 CPU 1518HF-4 PN, SIPLUS TIM 1531 IRC, TIM 1531 IRC. Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial-of-service in the device."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-1287: Improper Validation of Specified Type of Input",
+ "cweId": "CWE-1287"
+ }
+ ]
+ }
+ ]
+ },
"affects": {
"vendor": {
"vendor_data": [
@@ -15,61 +36,815 @@
"product": {
"product_data": [
{
- "product_name": "SIMATIC Drive Controller family",
+ "product_name": "SIMATIC Drive Controller family",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1200 CPU family (incl. SIPLUS variants)",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V4.6.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1510SP F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1510SP-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511C-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511T-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511TF-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1512C-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1512SP F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1512SP-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1513-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1513F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1513R-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515F-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515R-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515T-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515TF-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1516-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1516F-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1516T-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1516TF-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517F-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517H-3 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517T-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517TF-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518-4F PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518HF-4 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518T-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518TF-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN",
"version": {
"version_data": [
{
- "version_value": "All versions < V3.0.1"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)",
+ "product_name": "SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN",
"version": {
"version_data": [
{
- "version_value": "All versions"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC S7-1200 CPU family (incl. SIPLUS variants)",
+ "product_name": "SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN",
"version": {
"version_data": [
{
- "version_value": "All versions < V4.6.0"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)",
+ "product_name": "SIMATIC S7-1500 Software Controller",
"version": {
"version_data": [
{
- "version_value": "All versions < V3.0.1"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC S7-1500 Software Controller",
+ "product_name": "SIMATIC S7-PLCSIM Advanced",
"version": {
"version_data": [
{
- "version_value": "All versions"
+ "version_value": "All versions < V5.0",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC S7-PLCSIM Advanced",
+ "product_name": "SIPLUS ET 200SP CPU 1510SP F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1510SP-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1510SP-1 PN RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1512SP F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1512SP-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1512SP-1 PN RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1511-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1511-1 PN TX RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1511F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1513-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1513F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515F-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515F-2 PN RAIL",
"version": {
"version_data": [
{
- "version_value": "All versions < V5.0"
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515R-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515R-2 PN TX RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1517H-3 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1518-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1518F-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1518HF-4 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
}
]
}
@@ -79,7 +854,8 @@
"version": {
"version_data": [
{
- "version_value": "All versions"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
@@ -89,7 +865,8 @@
"version": {
"version_data": [
{
- "version_value": "All versions"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
@@ -100,33 +877,23 @@
]
}
},
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-1287: Improper Validation of Specified Type of Input"
- }
- ]
- }
- ]
- },
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V3.0.1), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.6.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V3.0.1), SIMATIC S7-1500 Software Controller (All versions), SIMATIC S7-PLCSIM Advanced (All versions < V5.0), SIPLUS TIM 1531 IRC (All versions), TIM 1531 IRC (All versions). Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial-of-service in the device."
- }
- ]
- },
"references": {
"reference_data": [
{
- "refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-382653.pdf",
+ "refsource": "MISC",
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-382653.pdf"
}
]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:P/RL:O/RC:C",
+ "baseScore": 5.5,
+ "baseSeverity": "MEDIUM"
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/2021/44xxx/CVE-2021-44695.json b/2021/44xxx/CVE-2021-44695.json
index 8240d79ddb4d..8a56f7b32dad 100644
--- a/2021/44xxx/CVE-2021-44695.json
+++ b/2021/44xxx/CVE-2021-44695.json
@@ -1,12 +1,33 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "productcert@siemens.com",
"ID": "CVE-2021-44695",
+ "ASSIGNER": "productcert@siemens.com",
"STATE": "PUBLIC"
},
- "data_format": "MITRE",
- "data_version": "4.0",
- "data_type": "CVE",
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability has been identified in SIMATIC Drive Controller family, SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), SIMATIC S7-1200 CPU family (incl. SIPLUS variants), SIMATIC S7-1500 CPU 1510SP F-1 PN, SIMATIC S7-1500 CPU 1510SP-1 PN, SIMATIC S7-1500 CPU 1511-1 PN, SIMATIC S7-1500 CPU 1511-1 PN, SIMATIC S7-1500 CPU 1511C-1 PN, SIMATIC S7-1500 CPU 1511C-1 PN, SIMATIC S7-1500 CPU 1511F-1 PN, SIMATIC S7-1500 CPU 1511F-1 PN, SIMATIC S7-1500 CPU 1511T-1 PN, SIMATIC S7-1500 CPU 1511TF-1 PN, SIMATIC S7-1500 CPU 1512C-1 PN, SIMATIC S7-1500 CPU 1512C-1 PN, SIMATIC S7-1500 CPU 1512SP F-1 PN, SIMATIC S7-1500 CPU 1512SP-1 PN, SIMATIC S7-1500 CPU 1513-1 PN, SIMATIC S7-1500 CPU 1513-1 PN, SIMATIC S7-1500 CPU 1513F-1 PN, SIMATIC S7-1500 CPU 1513F-1 PN, SIMATIC S7-1500 CPU 1513R-1 PN, SIMATIC S7-1500 CPU 1515-2 PN, SIMATIC S7-1500 CPU 1515-2 PN, SIMATIC S7-1500 CPU 1515F-2 PN, SIMATIC S7-1500 CPU 1515F-2 PN, SIMATIC S7-1500 CPU 1515R-2 PN, SIMATIC S7-1500 CPU 1515T-2 PN, SIMATIC S7-1500 CPU 1515TF-2 PN, SIMATIC S7-1500 CPU 1516-3 PN/DP, SIMATIC S7-1500 CPU 1516-3 PN/DP, SIMATIC S7-1500 CPU 1516F-3 PN/DP, SIMATIC S7-1500 CPU 1516F-3 PN/DP, SIMATIC S7-1500 CPU 1516T-3 PN/DP, SIMATIC S7-1500 CPU 1516TF-3 PN/DP, SIMATIC S7-1500 CPU 1517-3 PN/DP, SIMATIC S7-1500 CPU 1517F-3 PN/DP, SIMATIC S7-1500 CPU 1517H-3 PN, SIMATIC S7-1500 CPU 1517T-3 PN/DP, SIMATIC S7-1500 CPU 1517TF-3 PN/DP, SIMATIC S7-1500 CPU 1518-4 PN/DP, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518-4F PN/DP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518HF-4 PN, SIMATIC S7-1500 CPU 1518T-4 PN/DP, SIMATIC S7-1500 CPU 1518TF-4 PN/DP, SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK, SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK, SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN, SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN, SIMATIC S7-1500 Software Controller, SIMATIC S7-PLCSIM Advanced, SIPLUS ET 200SP CPU 1510SP F-1 PN, SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL, SIPLUS ET 200SP CPU 1510SP-1 PN, SIPLUS ET 200SP CPU 1510SP-1 PN, SIPLUS ET 200SP CPU 1510SP-1 PN RAIL, SIPLUS ET 200SP CPU 1510SP-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP F-1 PN, SIPLUS ET 200SP CPU 1512SP F-1 PN, SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP-1 PN, SIPLUS ET 200SP CPU 1512SP-1 PN, SIPLUS ET 200SP CPU 1512SP-1 PN RAIL, SIPLUS ET 200SP CPU 1512SP-1 PN RAIL, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN, SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL, SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL, SIPLUS S7-1500 CPU 1511-1 PN TX RAIL, SIPLUS S7-1500 CPU 1511-1 PN TX RAIL, SIPLUS S7-1500 CPU 1511F-1 PN, SIPLUS S7-1500 CPU 1511F-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513-1 PN, SIPLUS S7-1500 CPU 1513F-1 PN, SIPLUS S7-1500 CPU 1513F-1 PN, SIPLUS S7-1500 CPU 1515F-2 PN, SIPLUS S7-1500 CPU 1515F-2 PN, SIPLUS S7-1500 CPU 1515F-2 PN RAIL, SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL, SIPLUS S7-1500 CPU 1515R-2 PN, SIPLUS S7-1500 CPU 1515R-2 PN TX RAIL, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP, SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL, SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL, SIPLUS S7-1500 CPU 1516F-3 PN/DP, SIPLUS S7-1500 CPU 1516F-3 PN/DP, SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL, SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL, SIPLUS S7-1500 CPU 1517H-3 PN, SIPLUS S7-1500 CPU 1518-4 PN/DP, SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, SIPLUS S7-1500 CPU 1518F-4 PN/DP, SIPLUS S7-1500 CPU 1518HF-4 PN, SIPLUS TIM 1531 IRC, TIM 1531 IRC. Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial-of-service in the device."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-1286: Improper Validation of Syntactic Correctness of Input",
+ "cweId": "CWE-1286"
+ }
+ ]
+ }
+ ]
+ },
"affects": {
"vendor": {
"vendor_data": [
@@ -15,61 +36,815 @@
"product": {
"product_data": [
{
- "product_name": "SIMATIC Drive Controller family",
+ "product_name": "SIMATIC Drive Controller family",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1200 CPU family (incl. SIPLUS variants)",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V4.6.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1510SP F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1510SP-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511C-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511T-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1511TF-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1512C-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1512SP F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1512SP-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1513-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1513F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1513R-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515F-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515R-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515T-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1515TF-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1516-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1516F-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1516T-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1516TF-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517F-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517H-3 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517T-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1517TF-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518-4F PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518HF-4 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518T-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU 1518TF-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN",
"version": {
"version_data": [
{
- "version_value": "All versions < V3.0.1"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)",
+ "product_name": "SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN",
"version": {
"version_data": [
{
- "version_value": "All versions"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC S7-1200 CPU family (incl. SIPLUS variants)",
+ "product_name": "SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN",
"version": {
"version_data": [
{
- "version_value": "All versions < V4.6.0"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)",
+ "product_name": "SIMATIC S7-1500 Software Controller",
"version": {
"version_data": [
{
- "version_value": "All versions < V3.0.1"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC S7-1500 Software Controller",
+ "product_name": "SIMATIC S7-PLCSIM Advanced",
"version": {
"version_data": [
{
- "version_value": "All versions"
+ "version_value": "All versions < V5.0",
+ "version_affected": "="
}
]
}
},
{
- "product_name": "SIMATIC S7-PLCSIM Advanced",
+ "product_name": "SIPLUS ET 200SP CPU 1510SP F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1510SP-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1510SP-1 PN RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1512SP F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1512SP-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS ET 200SP CPU 1512SP-1 PN RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1511-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1511-1 PN TX RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1511F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1513-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1513F-1 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515F-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515F-2 PN RAIL",
"version": {
"version_data": [
{
- "version_value": "All versions < V5.0"
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515R-2 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1515R-2 PN TX RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1517H-3 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1518-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1518F-4 PN/DP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "SIPLUS S7-1500 CPU 1518HF-4 PN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "All versions < V3.0.1",
+ "version_affected": "="
}
]
}
@@ -79,7 +854,8 @@
"version": {
"version_data": [
{
- "version_value": "All versions"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
@@ -89,7 +865,8 @@
"version": {
"version_data": [
{
- "version_value": "All versions"
+ "version_value": "All versions",
+ "version_affected": "="
}
]
}
@@ -100,33 +877,23 @@
]
}
},
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-1286: Improper Validation of Syntactic Correctness of Input"
- }
- ]
- }
- ]
- },
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V3.0.1), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.6.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V3.0.1), SIMATIC S7-1500 Software Controller (All versions), SIMATIC S7-PLCSIM Advanced (All versions < V5.0), SIPLUS TIM 1531 IRC (All versions), TIM 1531 IRC (All versions). Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial-of-service in the device."
- }
- ]
- },
"references": {
"reference_data": [
{
- "refsource": "MISC",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-382653.pdf",
+ "refsource": "MISC",
"name": "https://cert-portal.siemens.com/productcert/pdf/ssa-382653.pdf"
}
]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
+ "baseScore": 4.9,
+ "baseSeverity": "MEDIUM"
+ }
+ ]
}
}
\ No newline at end of file
diff --git a/2021/44xxx/CVE-2021-44732.json b/2021/44xxx/CVE-2021-44732.json
index f85ee0547071..c68f8d6ac8e6 100644
--- a/2021/44xxx/CVE-2021-44732.json
+++ b/2021/44xxx/CVE-2021-44732.json
@@ -1,35 +1,12 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "cve@mitre.org",
"ID": "CVE-2021-44732",
+ "ASSIGNER": "cve@mitre.org",
"STATE": "PUBLIC"
},
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "product": {
- "product_data": [
- {
- "product_name": "n/a",
- "version": {
- "version_data": [
- {
- "version_value": "n/a"
- }
- ]
- }
- }
- ]
- },
- "vendor_name": "n/a"
- }
- ]
- }
- },
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
"description": {
"description_data": [
{
@@ -50,6 +27,30 @@
}
]
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
"references": {
"reference_data": [
{
@@ -58,29 +59,34 @@
"name": "https://github.com/ARMmbed/mbedtls/releases"
},
{
- "refsource": "CONFIRM",
- "name": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-12",
- "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-12"
+ "url": "https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0",
+ "refsource": "MISC",
+ "name": "https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0"
+ },
+ {
+ "url": "https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0",
+ "refsource": "MISC",
+ "name": "https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0"
},
{
- "refsource": "CONFIRM",
- "name": "https://bugs.gentoo.org/829660",
- "url": "https://bugs.gentoo.org/829660"
+ "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html",
+ "refsource": "MISC",
+ "name": "https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html"
},
{
- "refsource": "CONFIRM",
- "name": "https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.12",
- "url": "https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.12"
+ "url": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-12",
+ "refsource": "MISC",
+ "name": "https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2021-12"
},
{
- "refsource": "CONFIRM",
- "name": "https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0",
- "url": "https://github.com/ARMmbed/mbedtls/releases/tag/v2.28.0"
+ "url": "https://bugs.gentoo.org/829660",
+ "refsource": "MISC",
+ "name": "https://bugs.gentoo.org/829660"
},
{
- "refsource": "CONFIRM",
- "name": "https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0",
- "url": "https://github.com/ARMmbed/mbedtls/releases/tag/v3.1.0"
+ "url": "https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.12",
+ "refsource": "MISC",
+ "name": "https://github.com/ARMmbed/mbedtls/releases/tag/v2.16.12"
}
]
}
diff --git a/2021/44xxx/CVE-2021-44758.json b/2021/44xxx/CVE-2021-44758.json
index faa0d123f4c9..aea5fa8e1c58 100644
--- a/2021/44xxx/CVE-2021-44758.json
+++ b/2021/44xxx/CVE-2021-44758.json
@@ -1,17 +1,67 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-44758",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/heimdal/heimdal/security/advisories/GHSA-69h9-669w-88xv",
+ "refsource": "MISC",
+ "name": "https://github.com/heimdal/heimdal/security/advisories/GHSA-69h9-669w-88xv"
+ },
+ {
+ "url": "https://github.com/heimdal/heimdal/commit/f9ec7002cdd526ae84fbacbf153162e118f22580",
+ "refsource": "MISC",
+ "name": "https://github.com/heimdal/heimdal/commit/f9ec7002cdd526ae84fbacbf153162e118f22580"
}
]
}
diff --git a/2021/44xxx/CVE-2021-44854.json b/2021/44xxx/CVE-2021-44854.json
index 967069d1657b..7a666a434e36 100644
--- a/2021/44xxx/CVE-2021-44854.json
+++ b/2021/44xxx/CVE-2021-44854.json
@@ -1,17 +1,62 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-44854",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicly caches results from private wikis."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://phabricator.wikimedia.org/T292763",
+ "refsource": "MISC",
+ "name": "https://phabricator.wikimedia.org/T292763"
}
]
}
diff --git a/2021/44xxx/CVE-2021-44855.json b/2021/44xxx/CVE-2021-44855.json
index 9a34db11cf6f..12d74d22efb7 100644
--- a/2021/44xxx/CVE-2021-44855.json
+++ b/2021/44xxx/CVE-2021-44855.json
@@ -1,17 +1,62 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-44855",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Stored XSS via a URL to the Upload Image feature."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://phabricator.wikimedia.org/T293589",
+ "refsource": "MISC",
+ "name": "https://phabricator.wikimedia.org/T293589"
}
]
}
diff --git a/2021/44xxx/CVE-2021-44856.json b/2021/44xxx/CVE-2021-44856.json
index fa032f1ba3d3..d2cb633bdfe7 100644
--- a/2021/44xxx/CVE-2021-44856.json
+++ b/2021/44xxx/CVE-2021-44856.json
@@ -1,17 +1,62 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-44856",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by AbuseFilter can be created via Special:ChangeContentModel due to the mishandling of the EditFilterMergedContent hook return value."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://phabricator.wikimedia.org/T271037",
+ "refsource": "MISC",
+ "name": "https://phabricator.wikimedia.org/T271037"
}
]
}
diff --git a/2021/45xxx/CVE-2021-45450.json b/2021/45xxx/CVE-2021-45450.json
index 0870be4be57d..2695e3ac6861 100644
--- a/2021/45xxx/CVE-2021-45450.json
+++ b/2021/45xxx/CVE-2021-45450.json
@@ -71,6 +71,11 @@
"refsource": "FEDORA",
"name": "FEDORA-2022-1dd9dc5140",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IL66WKJGXY5AXMTFE7QDMGL3RIBD6PX5/"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-08",
+ "url": "https://security.gentoo.org/glsa/202301-08"
}
]
}
diff --git a/2021/45xxx/CVE-2021-45466.json b/2021/45xxx/CVE-2021-45466.json
index e59bac7e4a9b..6081c7d7293a 100644
--- a/2021/45xxx/CVE-2021-45466.json
+++ b/2021/45xxx/CVE-2021-45466.json
@@ -1,17 +1,67 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-45466",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://control-webpanel.com/changelog",
+ "refsource": "MISC",
+ "name": "https://control-webpanel.com/changelog"
+ },
+ {
+ "url": "https://octagon.net/blog/2022/01/22/cve-2021-45467-cwp-centos-web-panel-preauth-rce/",
+ "refsource": "MISC",
+ "name": "https://octagon.net/blog/2022/01/22/cve-2021-45467-cwp-centos-web-panel-preauth-rce/"
}
]
}
diff --git a/2021/45xxx/CVE-2021-45467.json b/2021/45xxx/CVE-2021-45467.json
index bd6a49b74316..0c57b7ce8990 100644
--- a/2021/45xxx/CVE-2021-45467.json
+++ b/2021/45xxx/CVE-2021-45467.json
@@ -1,17 +1,67 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-45467",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi URI. Any number of %00 instances can be used, e.g., .%00%00%00./.%00%00%00./api/account_new_create could also be used for the scripts parameter."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "?"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://control-webpanel.com/changelog",
+ "refsource": "MISC",
+ "name": "https://control-webpanel.com/changelog"
+ },
+ {
+ "url": "https://octagon.net/blog/2022/01/22/cve-2021-45467-cwp-centos-web-panel-preauth-rce/",
+ "refsource": "MISC",
+ "name": "https://octagon.net/blog/2022/01/22/cve-2021-45467-cwp-centos-web-panel-preauth-rce/"
}
]
}
diff --git a/2021/46xxx/CVE-2021-46767.json b/2021/46xxx/CVE-2021-46767.json
index a7640685aa46..1acf86ec9152 100644
--- a/2021/46xxx/CVE-2021-46767.json
+++ b/2021/46xxx/CVE-2021-46767.json
@@ -1,18 +1,88 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-46767",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memory potentially leading to a loss of integrity or denial of service."
}
]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": " AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "2nd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ {
+ "vendor_name": "AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "3rd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1032",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46768.json b/2021/46xxx/CVE-2021-46768.json
index c95d85b12d85..5ea410289b6e 100644
--- a/2021/46xxx/CVE-2021-46768.json
+++ b/2021/46xxx/CVE-2021-46768.json
@@ -1,18 +1,88 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-46768",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Insufficient input validation in SEV firmware may allow an attacker to perform out-of-bounds memory reads within the ASP boot loader, potentially leading to a denial of service."
}
]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": " AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "2nd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ {
+ "vendor_name": "AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "3rd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1032",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46779.json b/2021/46xxx/CVE-2021-46779.json
index 5e7996479800..765e75964eba 100644
--- a/2021/46xxx/CVE-2021-46779.json
+++ b/2021/46xxx/CVE-2021-46779.json
@@ -1,18 +1,99 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-46779",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Insufficient input validation in SVC_ECC_PRIMITIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (AMD Secure Processor) OS memory which may lead to potential loss of integrity and availability."
}
]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "1st Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "3rd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ {
+ "vendor_name": " AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "2nd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1032",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46784.json b/2021/46xxx/CVE-2021-46784.json
index f295b9edc4dc..d91ec01806f0 100644
--- a/2021/46xxx/CVE-2021-46784.json
+++ b/2021/46xxx/CVE-2021-46784.json
@@ -76,6 +76,11 @@
"refsource": "MISC",
"name": "https://security-tracker.debian.org/tracker/CVE-2021-46784",
"url": "https://security-tracker.debian.org/tracker/CVE-2021-46784"
+ },
+ {
+ "refsource": "CONFIRM",
+ "name": "https://security.netapp.com/advisory/ntap-20221223-0007/",
+ "url": "https://security.netapp.com/advisory/ntap-20221223-0007/"
}
]
}
diff --git a/2021/46xxx/CVE-2021-46791.json b/2021/46xxx/CVE-2021-46791.json
index dfd4c09bf395..71c7edceaa19 100644
--- a/2021/46xxx/CVE-2021-46791.json
+++ b/2021/46xxx/CVE-2021-46791.json
@@ -1,18 +1,70 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-46791",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Insufficient input validation during parsing of the System Management Mode (SMM) binary may allow a maliciously crafted SMM executable binary to corrupt Dynamic Root of Trust for Measurement (DRTM) user application memory that may result in a potential denial of service."
}
]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "3rd Gen EPYC",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1032"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1032",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46795.json b/2021/46xxx/CVE-2021-46795.json
index b174cb1138ce..cffb8f2d2add 100644
--- a/2021/46xxx/CVE-2021-46795.json
+++ b/2021/46xxx/CVE-2021-46795.json
@@ -1,18 +1,81 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-46795",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@amd.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A TOCTOU (time-of-check to time-of-use) vulnerability exists where an attacker may use a compromised BIOS to cause the TEE OS to read memory out of bounds that could potentially result in a denial of service."
}
]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": " AMD",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Ryzen 5000 Series",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Ryzen 3000 Series ",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "various ",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031",
+ "refsource": "MISC",
+ "name": "https://www.amd.com/en/corporate/product-security/bulletin/AMD-SB-1031"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "advisory": "AMD-SB-1031",
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46848.json b/2021/46xxx/CVE-2021-46848.json
index 4fd1cc9337ec..ac8a868b8802 100644
--- a/2021/46xxx/CVE-2021-46848.json
+++ b/2021/46xxx/CVE-2021-46848.json
@@ -86,6 +86,16 @@
"refsource": "CONFIRM",
"name": "https://security.netapp.com/advisory/ntap-20221118-0006/",
"url": "https://security.netapp.com/advisory/ntap-20221118-0006/"
+ },
+ {
+ "refsource": "FEDORA",
+ "name": "FEDORA-2022-3f9ee1ad91",
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECM2ELTVRYV4BZ5L5GMIRQE27RFHPAQ6/"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20230109 [SECURITY] [DLA 3263-1] libtasn1-6 security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00003.html"
}
]
}
diff --git a/2021/46xxx/CVE-2021-46853.json b/2021/46xxx/CVE-2021-46853.json
index fedff9fc6dfb..31c3cac081e4 100644
--- a/2021/46xxx/CVE-2021-46853.json
+++ b/2021/46xxx/CVE-2021-46853.json
@@ -61,6 +61,11 @@
"url": "https://bugs.gentoo.org/807613",
"refsource": "MISC",
"name": "https://bugs.gentoo.org/807613"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-07",
+ "url": "https://security.gentoo.org/glsa/202301-07"
}
]
}
diff --git a/2021/46xxx/CVE-2021-46856.json b/2021/46xxx/CVE-2021-46856.json
index 46342809cec4..86442b7ee229 100644
--- a/2021/46xxx/CVE-2021-46856.json
+++ b/2021/46xxx/CVE-2021-46856.json
@@ -1,18 +1,98 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-46856",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@huawei.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The multi-screen collaboration module has a path traversal vulnerability. Successful exploitation of this vulnerability may affect data confidentiality."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Path traversal vulnerability"
+ }
+ ]
}
]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Huawei",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "HarmonyOS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.0.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "EMUI",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "12.0.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "12.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-0000001462975397",
+ "refsource": "MISC",
+ "name": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202212-0000001462975397"
+ },
+ {
+ "url": "https://consumer.huawei.com/en/support/bulletin/2023/1/",
+ "refsource": "MISC",
+ "name": "https://consumer.huawei.com/en/support/bulletin/2023/1/"
+ },
+ {
+ "url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202301-0000001435541166",
+ "refsource": "MISC",
+ "name": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202301-0000001435541166"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46857.json b/2021/46xxx/CVE-2021-46857.json
new file mode 100644
index 000000000000..e43437bb40e0
--- /dev/null
+++ b/2021/46xxx/CVE-2021-46857.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-46857",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46858.json b/2021/46xxx/CVE-2021-46858.json
new file mode 100644
index 000000000000..c706df22176b
--- /dev/null
+++ b/2021/46xxx/CVE-2021-46858.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-46858",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46859.json b/2021/46xxx/CVE-2021-46859.json
new file mode 100644
index 000000000000..0ff8ca57f5e2
--- /dev/null
+++ b/2021/46xxx/CVE-2021-46859.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-46859",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46860.json b/2021/46xxx/CVE-2021-46860.json
new file mode 100644
index 000000000000..e90f62084d52
--- /dev/null
+++ b/2021/46xxx/CVE-2021-46860.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-46860",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46861.json b/2021/46xxx/CVE-2021-46861.json
new file mode 100644
index 000000000000..26d7ee19dae2
--- /dev/null
+++ b/2021/46xxx/CVE-2021-46861.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-46861",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46862.json b/2021/46xxx/CVE-2021-46862.json
new file mode 100644
index 000000000000..d0986a564c3e
--- /dev/null
+++ b/2021/46xxx/CVE-2021-46862.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-46862",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46863.json b/2021/46xxx/CVE-2021-46863.json
new file mode 100644
index 000000000000..793d882b2432
--- /dev/null
+++ b/2021/46xxx/CVE-2021-46863.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-46863",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46864.json b/2021/46xxx/CVE-2021-46864.json
new file mode 100644
index 000000000000..c80d7e607ce4
--- /dev/null
+++ b/2021/46xxx/CVE-2021-46864.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-46864",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46865.json b/2021/46xxx/CVE-2021-46865.json
new file mode 100644
index 000000000000..018da5c34869
--- /dev/null
+++ b/2021/46xxx/CVE-2021-46865.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-46865",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46866.json b/2021/46xxx/CVE-2021-46866.json
new file mode 100644
index 000000000000..f075ced3a6c1
--- /dev/null
+++ b/2021/46xxx/CVE-2021-46866.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-46866",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46867.json b/2021/46xxx/CVE-2021-46867.json
new file mode 100644
index 000000000000..0228d227edd2
--- /dev/null
+++ b/2021/46xxx/CVE-2021-46867.json
@@ -0,0 +1,79 @@
+{
+ "CVE_data_meta": {
+ "ASSIGNER": "psirt@huawei.com",
+ "ID": "CVE-2021-46867",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "HarmonyOS",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "2.0"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "EMUI",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "12.0.0"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "Huawei"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "The HW_KEYMASTER module has a problem in releasing memory.Successful exploitation of this vulnerability may result in out-of-bounds memory access."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Out-of-bounds memory access vulnerability"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://consumer.huawei.com/en/support/bulletin/2023/1/",
+ "refsource": "MISC",
+ "name": "https://consumer.huawei.com/en/support/bulletin/2023/1/"
+ },
+ {
+ "url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202301-0000001435541166",
+ "refsource": "MISC",
+ "name": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202301-0000001435541166"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46868.json b/2021/46xxx/CVE-2021-46868.json
new file mode 100644
index 000000000000..2bbb717b08ac
--- /dev/null
+++ b/2021/46xxx/CVE-2021-46868.json
@@ -0,0 +1,79 @@
+{
+ "CVE_data_meta": {
+ "ASSIGNER": "psirt@huawei.com",
+ "ID": "CVE-2021-46868",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "HarmonyOS",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "2.0"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "EMUI",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "=",
+ "version_value": "12.0.0"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "Huawei"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "The HW_KEYMASTER module has a problem in releasing memory.Successful exploitation of this vulnerability may result in out-of-bounds memory access."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Out-of-bounds memory access vulnerability"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://consumer.huawei.com/en/support/bulletin/2023/1/",
+ "refsource": "MISC",
+ "name": "https://consumer.huawei.com/en/support/bulletin/2023/1/"
+ },
+ {
+ "url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202301-0000001435541166",
+ "refsource": "MISC",
+ "name": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202301-0000001435541166"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46869.json b/2021/46xxx/CVE-2021-46869.json
new file mode 100644
index 000000000000..23214a83ea89
--- /dev/null
+++ b/2021/46xxx/CVE-2021-46869.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-46869",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46870.json b/2021/46xxx/CVE-2021-46870.json
new file mode 100644
index 000000000000..5c7dbbf516c7
--- /dev/null
+++ b/2021/46xxx/CVE-2021-46870.json
@@ -0,0 +1,18 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-46870",
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "RESERVED"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/46xxx/CVE-2021-46871.json b/2021/46xxx/CVE-2021-46871.json
new file mode 100644
index 000000000000..6b434dff895c
--- /dev/null
+++ b/2021/46xxx/CVE-2021-46871.json
@@ -0,0 +1,67 @@
+{
+ "CVE_data_meta": {
+ "ASSIGNER": "cve@mitre.org",
+ "ID": "CVE-2021-46871",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "n/a",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "n/a"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/advisories/GHSA-j3gg-r6gp-95q2",
+ "refsource": "MISC",
+ "name": "https://github.com/advisories/GHSA-j3gg-r6gp-95q2"
+ },
+ {
+ "url": "https://github.com/phoenixframework/phoenix_html/commit/62a0139fb716bcdce697f6221244bd81d321d620",
+ "refsource": "MISC",
+ "name": "https://github.com/phoenixframework/phoenix_html/commit/62a0139fb716bcdce697f6221244bd81d321d620"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4028.json b/2021/4xxx/CVE-2021-4028.json
index 0f96b2e80183..1857cbd74db6 100644
--- a/2021/4xxx/CVE-2021-4028.json
+++ b/2021/4xxx/CVE-2021-4028.json
@@ -68,6 +68,11 @@
"refsource": "MISC",
"name": "https://bugzilla.suse.com/show_bug.cgi?id=1193167#c0",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1193167#c0"
+ },
+ {
+ "refsource": "CONFIRM",
+ "name": "https://security.netapp.com/advisory/ntap-20221228-0002/",
+ "url": "https://security.netapp.com/advisory/ntap-20221228-0002/"
}
]
},
diff --git a/2021/4xxx/CVE-2021-4126.json b/2021/4xxx/CVE-2021-4126.json
index 6761fa21f75a..936bef44b9e4 100644
--- a/2021/4xxx/CVE-2021-4126.json
+++ b/2021/4xxx/CVE-2021-4126.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-4126",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.4.1",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "OpenPGP signature status doesn't consider additional message content"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2021-55/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2021-55/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1732310",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1732310"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a message footer added by a mailing list gateway, Thunderbird only considered the inner signed message for the signature validity. This gave the false impression that the additional contents were also covered by the digital signature. Starting with Thunderbird version 91.4.1, only the signature that belongs to the top level MIME part will be considered for the displayed status. This vulnerability affects Thunderbird < 91.4.1."
}
]
}
diff --git a/2021/4xxx/CVE-2021-4127.json b/2021/4xxx/CVE-2021-4127.json
index 3671bb36fd00..fc7b205388e9 100644
--- a/2021/4xxx/CVE-2021-4127.json
+++ b/2021/4xxx/CVE-2021-4127.json
@@ -4,14 +4,80 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-4127",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "78.9",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "78.9",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Angle graphics library out of date"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2021-12/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2021-12/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2021-11/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2021-11/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1691547",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1691547"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An out of date graphics library (Angle) likely contained vulnerabilities that could potentially be exploited. This vulnerability affects Thunderbird < 78.9 and Firefox ESR < 78.9."
}
]
}
diff --git a/2021/4xxx/CVE-2021-4128.json b/2021/4xxx/CVE-2021-4128.json
index 5798f4da6e48..729860ff4900 100644
--- a/2021/4xxx/CVE-2021-4128.json
+++ b/2021/4xxx/CVE-2021-4128.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-4128",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "95",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Use-after-free in fullscreen objects on MacOS"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2021-52/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2021-52/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1735852",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1735852"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory corruption and a potentially exploitable crash.
*This bug only affects Firefox on MacOS. Other operating systems are unaffected.*. This vulnerability affects Firefox < 95."
}
]
}
diff --git a/2021/4xxx/CVE-2021-4129.json b/2021/4xxx/CVE-2021-4129.json
index 8628e84c93dd..be374badd392 100644
--- a/2021/4xxx/CVE-2021-4129.json
+++ b/2021/4xxx/CVE-2021-4129.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-4129",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "95",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.4.0",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.4.0",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2021-53/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2021-53/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2021-54/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2021-54/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2021-52/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2021-52/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1393362%2C1736046%2C1736751%2C1737009%2C1739372%2C1739421",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1393362%2C1736046%2C1736751%2C1737009%2C1739372%2C1739421"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported memory safety bugs present in Firefox 94. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 95, Firefox ESR < 91.4.0, and Thunderbird < 91.4.0."
}
]
}
diff --git a/2021/4xxx/CVE-2021-4140.json b/2021/4xxx/CVE-2021-4140.json
index 52cf3452b7b8..aad43315af24 100644
--- a/2021/4xxx/CVE-2021-4140.json
+++ b/2021/4xxx/CVE-2021-4140.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-4140",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Iframe sandbox bypass with XSLT"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-02/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-02/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-03/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-03/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1746720",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1746720"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."
}
]
}
diff --git a/2021/4xxx/CVE-2021-4204.json b/2021/4xxx/CVE-2021-4204.json
index 919deab4604b..574dd7428e97 100644
--- a/2021/4xxx/CVE-2021-4204.json
+++ b/2021/4xxx/CVE-2021-4204.json
@@ -63,6 +63,11 @@
"refsource": "MISC",
"name": "https://security-tracker.debian.org/tracker/CVE-2021-4204",
"url": "https://security-tracker.debian.org/tracker/CVE-2021-4204"
+ },
+ {
+ "refsource": "CONFIRM",
+ "name": "https://security.netapp.com/advisory/ntap-20221228-0003/",
+ "url": "https://security.netapp.com/advisory/ntap-20221228-0003/"
}
]
},
diff --git a/2021/4xxx/CVE-2021-4221.json b/2021/4xxx/CVE-2021-4221.json
index 80bbc99061df..199f84366451 100644
--- a/2021/4xxx/CVE-2021-4221.json
+++ b/2021/4xxx/CVE-2021-4221.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-4221",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "92",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Address bar spoofing on Firefox for Android due to RTL characters"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2021-38/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2021-38/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1704422",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1704422"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "If a domain name contained a RTL character, it would cause the domain to be rendered to the right of the path. This could lead to user confusion and spoofing attacks.
*This bug only affects Firefox for Android. Other operating systems are unaffected.*
*Note*: Due to a clerical error this advisory was not included in the original announcement, and was added in Feburary 2022. This vulnerability affects Firefox < 92."
}
]
}
diff --git a/2021/4xxx/CVE-2021-4226.json b/2021/4xxx/CVE-2021-4226.json
index a4e9f5e54420..099ea048579a 100644
--- a/2021/4xxx/CVE-2021-4226.json
+++ b/2021/4xxx/CVE-2021-4226.json
@@ -1,18 +1,75 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-4226",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "contact@wpscan.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "RSFirewall tries to identify the original IP address by looking at different HTTP headers. A bypass is possible due to the way it is implemented."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-639 Authorization Bypass Through User-Controlled Key"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Unknown",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "RSFirewall!",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://wpscan.com/vulnerability/c0ed80c8-ebbf-4ed9-b02f-31660097c352",
+ "refsource": "MISC",
+ "name": "https://wpscan.com/vulnerability/c0ed80c8-ebbf-4ed9-b02f-31660097c352"
}
]
- }
+ },
+ "generator": {
+ "engine": "WPScan CVE Generator"
+ },
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Daniel Ruf"
+ }
+ ]
}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4235.json b/2021/4xxx/CVE-2021-4235.json
index 90a47d222925..72c61ecd6b0c 100644
--- a/2021/4xxx/CVE-2021-4235.json
+++ b/2021/4xxx/CVE-2021-4235.json
@@ -1,18 +1,79 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-4235",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@golang.org",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume significant system resources. If parsing user input, this may be used as a denial of service vector."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE 400: Uncontrolled Resource Consumption"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "gopkg.in/yaml.v2",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "gopkg.in/yaml.v2",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/go-yaml/yaml/pull/375",
+ "refsource": "MISC",
+ "name": "https://github.com/go-yaml/yaml/pull/375"
+ },
+ {
+ "url": "https://github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b241",
+ "refsource": "MISC",
+ "name": "https://github.com/go-yaml/yaml/commit/bb4e33bf68bf89cad44d386192cbed201f35b241"
+ },
+ {
+ "url": "https://pkg.go.dev/vuln/GO-2021-0061",
+ "refsource": "MISC",
+ "name": "https://pkg.go.dev/vuln/GO-2021-0061"
}
]
- }
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "@simonferquel"
+ }
+ ]
}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4236.json b/2021/4xxx/CVE-2021-4236.json
index 8d84a0965535..6b2dc4f5817e 100644
--- a/2021/4xxx/CVE-2021-4236.json
+++ b/2021/4xxx/CVE-2021-4236.json
@@ -1,17 +1,67 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-4236",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@golang.org",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-400: Uncontrolled Resource Consumption"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "github.com/ecnepsnai/web",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "github.com/ecnepsnai/web",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.4.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/ecnepsnai/web/commit/5a78f8d5c41ce60dcf9f61aaf47a7a8dc3e0002f",
+ "refsource": "MISC",
+ "name": "https://github.com/ecnepsnai/web/commit/5a78f8d5c41ce60dcf9f61aaf47a7a8dc3e0002f"
+ },
+ {
+ "url": "https://pkg.go.dev/vuln/GO-2021-0107",
+ "refsource": "MISC",
+ "name": "https://pkg.go.dev/vuln/GO-2021-0107"
}
]
}
diff --git a/2021/4xxx/CVE-2021-4238.json b/2021/4xxx/CVE-2021-4238.json
index bc0f23219040..ff041fddfa06 100644
--- a/2021/4xxx/CVE-2021-4238.json
+++ b/2021/4xxx/CVE-2021-4238.json
@@ -1,17 +1,67 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-4238",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@golang.org",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Randomly-generated alphanumeric strings contain significantly less entropy than expected. The RandomAlphaNumeric and CryptoRandomAlphaNumeric functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE 330: Use of Insufficiently Random Values"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "github.com/Masterminds/goutils",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "github.com/Masterminds/goutils",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/Masterminds/goutils/commit/869801f20f9f1e7ecdbdb6422049d8241270d5e1",
+ "refsource": "MISC",
+ "name": "https://github.com/Masterminds/goutils/commit/869801f20f9f1e7ecdbdb6422049d8241270d5e1"
+ },
+ {
+ "url": "https://pkg.go.dev/vuln/GO-2022-0411",
+ "refsource": "MISC",
+ "name": "https://pkg.go.dev/vuln/GO-2022-0411"
}
]
}
diff --git a/2021/4xxx/CVE-2021-4239.json b/2021/4xxx/CVE-2021-4239.json
index f6d3044782bd..e448cd0b2100 100644
--- a/2021/4xxx/CVE-2021-4239.json
+++ b/2021/4xxx/CVE-2021-4239.json
@@ -1,17 +1,67 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2021-4239",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@golang.org",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The Noise protocol implementation suffers from weakened cryptographic security after encrypting 2^64 messages, and a potential denial of service attack. After 2^64 (~18.4 quintillion) messages are encrypted with the Encrypt function, the nonce counter will wrap around, causing multiple messages to be encrypted with the same key and nonce. In a separate issue, the Decrypt function increments the nonce state even when it fails to decrypt a message. If an attacker can provide an invalid input to the Decrypt function, this will cause the nonce state to desynchronize between the peers, resulting in a failure to encrypt all subsequent messages."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE 400: Uncontrolled Resource Consumption"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "github.com/flynn/noise",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "github.com/flynn/noise",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/flynn/noise/pull/44",
+ "refsource": "MISC",
+ "name": "https://github.com/flynn/noise/pull/44"
+ },
+ {
+ "url": "https://pkg.go.dev/vuln/GO-2022-0425",
+ "refsource": "MISC",
+ "name": "https://pkg.go.dev/vuln/GO-2022-0425"
}
]
}
diff --git a/2021/4xxx/CVE-2021-4245.json b/2021/4xxx/CVE-2021-4245.json
new file mode 100644
index 000000000000..942d977eee19
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4245.json
@@ -0,0 +1,82 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4245",
+ "TITLE": "chbrown rfc6902 pointer.ts prototype pollution",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "chbrown",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "rfc6902",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-74 Injection -> CWE-94 Code Injection -> CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic has been found in chbrown rfc6902. This affects an unknown part of the file pointer.ts. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The exploit has been disclosed to the public and may be used. The name of the patch is c006ce9faa43d31edb34924f1df7b79c137096cf. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-215883."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "5.5",
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/chbrown/rfc6902/pull/76",
+ "refsource": "MISC",
+ "name": "https://github.com/chbrown/rfc6902/pull/76"
+ },
+ {
+ "url": "https://github.com/chbrown/rfc6902/commit/c006ce9faa43d31edb34924f1df7b79c137096cf",
+ "refsource": "MISC",
+ "name": "https://github.com/chbrown/rfc6902/commit/c006ce9faa43d31edb34924f1df7b79c137096cf"
+ },
+ {
+ "url": "https://vuldb.com/?id.215883",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.215883"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4246.json b/2021/4xxx/CVE-2021-4246.json
new file mode 100644
index 000000000000..085335a1a59b
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4246.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4246",
+ "TITLE": "roxlukas LMeve Login Page sql injection",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "roxlukas",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "LMeve",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-89 SQL Injection"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in roxlukas LMeve and classified as critical. Affected by this issue is some unknown functionality of the component Login Page. The manipulation of the argument X-Forwarded-For leads to sql injection. The attack may be launched remotely. The name of the patch is 29e1ead3bb1c1fad53b77dfc14534496421c5b5d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216176."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "6.3",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/roxlukas/lmeve/commit/29e1ead3bb1c1fad53b77dfc14534496421c5b5d",
+ "refsource": "MISC",
+ "name": "https://github.com/roxlukas/lmeve/commit/29e1ead3bb1c1fad53b77dfc14534496421c5b5d"
+ },
+ {
+ "url": "https://vuldb.com/?id.216176",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216176"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4247.json b/2021/4xxx/CVE-2021-4247.json
new file mode 100644
index 000000000000..3ef7d7e76582
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4247.json
@@ -0,0 +1,82 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4247",
+ "TITLE": "OWASP NodeGoat Query Parameter research.js denial of service",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "OWASP",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "NodeGoat",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-404 Denial of Service"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability has been found in OWASP NodeGoat and classified as problematic. This vulnerability affects unknown code of the file app/routes/research.js of the component Query Parameter Handler. The manipulation leads to denial of service. The attack can be initiated remotely. The name of the patch is 4a4d1db74c63fb4ff8d366551c3af006c25ead12. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216184."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "4.3",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/OWASP/NodeGoat/issues/225",
+ "refsource": "MISC",
+ "name": "https://github.com/OWASP/NodeGoat/issues/225"
+ },
+ {
+ "url": "https://github.com/OWASP/NodeGoat/commit/4a4d1db74c63fb4ff8d366551c3af006c25ead12",
+ "refsource": "MISC",
+ "name": "https://github.com/OWASP/NodeGoat/commit/4a4d1db74c63fb4ff8d366551c3af006c25ead12"
+ },
+ {
+ "url": "https://vuldb.com/?id.216184",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216184"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4248.json b/2021/4xxx/CVE-2021-4248.json
new file mode 100644
index 000000000000..f30d9b626e73
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4248.json
@@ -0,0 +1,90 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4248",
+ "TITLE": "kapetan dns Request.cs entropy",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "kapetan",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "dns",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "6.0"
+ },
+ {
+ "version_value": "6.1"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-330 Insufficiently Random Values -> CWE-331 Insufficient Entropy -> CWE-332 Insufficient Entropy in PRNG"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in kapetan dns up to 6.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file DNS/Protocol/Request.cs. The manipulation leads to insufficient entropy in prng. The attack may be launched remotely. Upgrading to version 7.0.0 is able to address this issue. The name of the patch is cf7105aa2aae90d6656088fe5a8ee1d5730773b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216188."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "5.6",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/kapetan/dns/pull/88",
+ "refsource": "MISC",
+ "name": "https://github.com/kapetan/dns/pull/88"
+ },
+ {
+ "url": "https://github.com/kapetan/dns/releases/tag/v7.0.0",
+ "refsource": "MISC",
+ "name": "https://github.com/kapetan/dns/releases/tag/v7.0.0"
+ },
+ {
+ "url": "https://github.com/kapetan/dns/commit/cf7105aa2aae90d6656088fe5a8ee1d5730773b6",
+ "refsource": "MISC",
+ "name": "https://github.com/kapetan/dns/commit/cf7105aa2aae90d6656088fe5a8ee1d5730773b6"
+ },
+ {
+ "url": "https://vuldb.com/?id.216188",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216188"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4249.json b/2021/4xxx/CVE-2021-4249.json
new file mode 100644
index 000000000000..0add7fcbfbe0
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4249.json
@@ -0,0 +1,306 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4249",
+ "TITLE": "xml-conduit DOCTYPE Entity Expansion Parse.hs infinite loop",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "xml-conduit",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "0.5.0"
+ },
+ {
+ "version_value": "0.5.0.1"
+ },
+ {
+ "version_value": "0.5.1"
+ },
+ {
+ "version_value": "0.5.1.1"
+ },
+ {
+ "version_value": "0.5.1.2"
+ },
+ {
+ "version_value": "0.5.2"
+ },
+ {
+ "version_value": "0.5.3"
+ },
+ {
+ "version_value": "0.5.3.1"
+ },
+ {
+ "version_value": "0.5.4"
+ },
+ {
+ "version_value": "0.6.0"
+ },
+ {
+ "version_value": "0.6.1"
+ },
+ {
+ "version_value": "0.7.0"
+ },
+ {
+ "version_value": "0.7.0.1"
+ },
+ {
+ "version_value": "0.7.0.2"
+ },
+ {
+ "version_value": "0.7.0.3"
+ },
+ {
+ "version_value": "1.0.0"
+ },
+ {
+ "version_value": "1.0.1"
+ },
+ {
+ "version_value": "1.0.1.1"
+ },
+ {
+ "version_value": "1.0.2"
+ },
+ {
+ "version_value": "1.0.2.1"
+ },
+ {
+ "version_value": "1.0.3"
+ },
+ {
+ "version_value": "1.0.3.1"
+ },
+ {
+ "version_value": "1.0.3.2"
+ },
+ {
+ "version_value": "1.0.3.3"
+ },
+ {
+ "version_value": "1.1.0"
+ },
+ {
+ "version_value": "1.1.0.1"
+ },
+ {
+ "version_value": "1.1.0.2"
+ },
+ {
+ "version_value": "1.1.0.3"
+ },
+ {
+ "version_value": "1.1.0.4"
+ },
+ {
+ "version_value": "1.1.0.5"
+ },
+ {
+ "version_value": "1.1.0.6"
+ },
+ {
+ "version_value": "1.1.0.7"
+ },
+ {
+ "version_value": "1.1.0.8"
+ },
+ {
+ "version_value": "1.1.0.9"
+ },
+ {
+ "version_value": "1.2.0"
+ },
+ {
+ "version_value": "1.2.0.1"
+ },
+ {
+ "version_value": "1.2.0.2"
+ },
+ {
+ "version_value": "1.2.0.3"
+ },
+ {
+ "version_value": "1.2.1"
+ },
+ {
+ "version_value": "1.2.1.1"
+ },
+ {
+ "version_value": "1.2.2"
+ },
+ {
+ "version_value": "1.2.3"
+ },
+ {
+ "version_value": "1.2.3.1"
+ },
+ {
+ "version_value": "1.2.3.2"
+ },
+ {
+ "version_value": "1.2.3.3"
+ },
+ {
+ "version_value": "1.2.4"
+ },
+ {
+ "version_value": "1.2.5"
+ },
+ {
+ "version_value": "1.2.5.1"
+ },
+ {
+ "version_value": "1.2.6"
+ },
+ {
+ "version_value": "1.3.0"
+ },
+ {
+ "version_value": "1.3.1"
+ },
+ {
+ "version_value": "1.3.2"
+ },
+ {
+ "version_value": "1.3.3"
+ },
+ {
+ "version_value": "1.3.3.1"
+ },
+ {
+ "version_value": "1.3.4"
+ },
+ {
+ "version_value": "1.3.4.1"
+ },
+ {
+ "version_value": "1.3.4.2"
+ },
+ {
+ "version_value": "1.3.5"
+ },
+ {
+ "version_value": "1.4.0"
+ },
+ {
+ "version_value": "1.4.0.1"
+ },
+ {
+ "version_value": "1.4.0.2"
+ },
+ {
+ "version_value": "1.4.0.3"
+ },
+ {
+ "version_value": "1.4.0.4"
+ },
+ {
+ "version_value": "1.5.0"
+ },
+ {
+ "version_value": "1.5.1"
+ },
+ {
+ "version_value": "1.6.0"
+ },
+ {
+ "version_value": "1.7.0"
+ },
+ {
+ "version_value": "1.7.0.1"
+ },
+ {
+ "version_value": "1.7.1.0"
+ },
+ {
+ "version_value": "1.7.1.1"
+ },
+ {
+ "version_value": "1.7.1.2"
+ },
+ {
+ "version_value": "1.8.0"
+ },
+ {
+ "version_value": "1.8.0.1"
+ },
+ {
+ "version_value": "1.9.0.0"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-404 Denial of Service -> CWE-835 Infinite Loop"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "4.3",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/snoyberg/xml/pull/161",
+ "refsource": "MISC",
+ "name": "https://github.com/snoyberg/xml/pull/161"
+ },
+ {
+ "url": "https://hackage.haskell.org/package/xml-conduit-1.9.1.0",
+ "refsource": "MISC",
+ "name": "https://hackage.haskell.org/package/xml-conduit-1.9.1.0"
+ },
+ {
+ "url": "https://github.com/snoyberg/xml/commit/4be1021791dcdee8b164d239433a2043dc0939ea",
+ "refsource": "MISC",
+ "name": "https://github.com/snoyberg/xml/commit/4be1021791dcdee8b164d239433a2043dc0939ea"
+ },
+ {
+ "url": "https://vuldb.com/?id.216204",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216204"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4250.json b/2021/4xxx/CVE-2021-4250.json
new file mode 100644
index 000000000000..0c194bf2c3da
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4250.json
@@ -0,0 +1,112 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4250",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic has been found in cgriego active_attr up to 0.15.2. This affects the function call of the file lib/active_attr/typecasting/boolean_typecaster.rb of the component Regex Handler. The manipulation of the argument value leads to denial of service. The exploit has been disclosed to the public and may be used. Upgrading to version 0.15.3 is able to address this issue. The name of the patch is dab95e5843b01525444b82bd7b336ef1d79377df. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216207."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine Schwachstelle in cgriego active_attr bis 0.15.2 entdeckt. Sie wurde als problematisch eingestuft. Es geht dabei um die Funktion call der Datei lib/active_attr/typecasting/boolean_typecaster.rb der Komponente Regex Handler. Mit der Manipulation des Arguments value mit unbekannten Daten kann eine denial of service-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Ein Aktualisieren auf die Version 0.15.3 vermag dieses Problem zu l\u00f6sen. Der Patch wird als dab95e5843b01525444b82bd7b336ef1d79377df bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-404 Denial of Service",
+ "cweId": "CWE-404"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "cgriego",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "active_attr",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "0.15.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.15.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.15.2",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/cgriego/active_attr/issues/184",
+ "refsource": "MISC",
+ "name": "https://github.com/cgriego/active_attr/issues/184"
+ },
+ {
+ "url": "https://github.com/cgriego/active_attr/pull/185",
+ "refsource": "MISC",
+ "name": "https://github.com/cgriego/active_attr/pull/185"
+ },
+ {
+ "url": "https://github.com/cgriego/active_attr/commit/dab95e5843b01525444b82bd7b336ef1d79377df",
+ "refsource": "MISC",
+ "name": "https://github.com/cgriego/active_attr/commit/dab95e5843b01525444b82bd7b336ef1d79377df"
+ },
+ {
+ "url": "https://vuldb.com/?id.216207",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216207"
+ },
+ {
+ "url": "https://github.com/cgriego/active_attr/releases/tag/v0.15.3",
+ "refsource": "MISC",
+ "name": "https://github.com/cgriego/active_attr/releases/tag/v0.15.3"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4251.json b/2021/4xxx/CVE-2021-4251.json
new file mode 100644
index 000000000000..2fe12e50251d
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4251.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4251",
+ "TITLE": "as include.cdn.php getFullURL cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "as",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic was found in as. This vulnerability affects the function getFullURL of the file include.cdn.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 4acad1e3d2c34c017473ceea442fb3e3e078b2bd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216208."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/andrewsauder/as/commit/4acad1e3d2c34c017473ceea442fb3e3e078b2bd",
+ "refsource": "MISC",
+ "name": "https://github.com/andrewsauder/as/commit/4acad1e3d2c34c017473ceea442fb3e3e078b2bd"
+ },
+ {
+ "url": "https://vuldb.com/?id.216208",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216208"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4252.json b/2021/4xxx/CVE-2021-4252.json
new file mode 100644
index 000000000000..8db896c87fb3
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4252.json
@@ -0,0 +1,82 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4252",
+ "TITLE": "WP-Ban ban-options.php toggle_checkbox cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "WP-Ban",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as problematic, has been found in WP-Ban. This issue affects the function toggle_checkbox of the file ban-options.php. The manipulation of the argument $_SERVER[\"HTTP_USER_AGENT\"] leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 13e0b1e922f3aaa3f8fcb1dd6d50200dd693fd76. It is recommended to apply a patch to fix this issue. The identifier VDB-216209 was assigned to this vulnerability."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/lesterchan/wp-ban/pull/11",
+ "refsource": "MISC",
+ "name": "https://github.com/lesterchan/wp-ban/pull/11"
+ },
+ {
+ "url": "https://github.com/lesterchan/wp-ban/commit/13e0b1e922f3aaa3f8fcb1dd6d50200dd693fd76",
+ "refsource": "MISC",
+ "name": "https://github.com/lesterchan/wp-ban/commit/13e0b1e922f3aaa3f8fcb1dd6d50200dd693fd76"
+ },
+ {
+ "url": "https://vuldb.com/?id.216209",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216209"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4253.json b/2021/4xxx/CVE-2021-4253.json
new file mode 100644
index 000000000000..0eab82c727dc
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4253.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4253",
+ "TITLE": "ctrlo lenio Ticket Lenio.pm cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "ctrlo",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "lenio",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as problematic, was found in ctrlo lenio. Affected is an unknown function in the library lib/Lenio.pm of the component Ticket Handler. The manipulation of the argument site_id leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 7a1f90bd2a0ce95b8338ec0926902da975ec64d9. It is recommended to apply a patch to fix this issue. VDB-216210 is the identifier assigned to this vulnerability."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/ctrlo/lenio/commit/7a1f90bd2a0ce95b8338ec0926902da975ec64d9",
+ "refsource": "MISC",
+ "name": "https://github.com/ctrlo/lenio/commit/7a1f90bd2a0ce95b8338ec0926902da975ec64d9"
+ },
+ {
+ "url": "https://vuldb.com/?id.216210",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216210"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4254.json b/2021/4xxx/CVE-2021-4254.json
new file mode 100644
index 000000000000..2ce892964966
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4254.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4254",
+ "TITLE": "ctrlo lenio Notice main.tt cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "ctrlo",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "lenio",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability has been found in ctrlo lenio and classified as problematic. Affected by this vulnerability is an unknown functionality of the file views/layouts/main.tt of the component Notice Handler. The manipulation of the argument notice.notice.text leads to cross site scripting. The attack can be launched remotely. The name of the patch is aa300555343c1c081951fcb68bfb6852fbba7451. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216211."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/ctrlo/lenio/commit/aa300555343c1c081951fcb68bfb6852fbba7451",
+ "refsource": "MISC",
+ "name": "https://github.com/ctrlo/lenio/commit/aa300555343c1c081951fcb68bfb6852fbba7451"
+ },
+ {
+ "url": "https://vuldb.com/?id.216211",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216211"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4255.json b/2021/4xxx/CVE-2021-4255.json
new file mode 100644
index 000000000000..ae341c17be62
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4255.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4255",
+ "TITLE": "ctrlo lenio contractor.tt cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "ctrlo",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "lenio",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in ctrlo lenio and classified as problematic. Affected by this issue is some unknown functionality of the file views/contractor.tt. The manipulation of the argument contractor.name leads to cross site scripting. The attack may be launched remotely. The name of the patch is e1646d5cd0a2fbab9eb505196dd2ca1c9e4cdd97. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216212."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/ctrlo/lenio/commit/e1646d5cd0a2fbab9eb505196dd2ca1c9e4cdd97",
+ "refsource": "MISC",
+ "name": "https://github.com/ctrlo/lenio/commit/e1646d5cd0a2fbab9eb505196dd2ca1c9e4cdd97"
+ },
+ {
+ "url": "https://vuldb.com/?id.216212",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216212"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4256.json b/2021/4xxx/CVE-2021-4256.json
new file mode 100644
index 000000000000..100a816e2768
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4256.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4256",
+ "TITLE": "ctrlo lenio index.tt cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "ctrlo",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "lenio",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in ctrlo lenio. It has been classified as problematic. This affects an unknown part of the file views/index.tt. The manipulation of the argument task.name/task.site.org.name leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is e1646d5cd0a2fbab9eb505196dd2ca1c9e4cdd97. It is recommended to apply a patch to fix this issue. The identifier VDB-216213 was assigned to this vulnerability."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/ctrlo/lenio/commit/e1646d5cd0a2fbab9eb505196dd2ca1c9e4cdd97",
+ "refsource": "MISC",
+ "name": "https://github.com/ctrlo/lenio/commit/e1646d5cd0a2fbab9eb505196dd2ca1c9e4cdd97"
+ },
+ {
+ "url": "https://vuldb.com/?id.216213",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216213"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4257.json b/2021/4xxx/CVE-2021-4257.json
new file mode 100644
index 000000000000..f9da0366bbf0
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4257.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4257",
+ "TITLE": "ctrlo lenio Task task.tt cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "ctrlo",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "lenio",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in ctrlo lenio. It has been declared as problematic. This vulnerability affects unknown code of the file views/task.tt of the component Task Handler. The manipulation of the argument site.org.name/check.name/task.tasktype.name/task.name leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 698c5fa465169d6f23c6a41ca4b1fc9a7869013a. It is recommended to apply a patch to fix this issue. VDB-216214 is the identifier assigned to this vulnerability."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/ctrlo/lenio/commit/698c5fa465169d6f23c6a41ca4b1fc9a7869013a",
+ "refsource": "MISC",
+ "name": "https://github.com/ctrlo/lenio/commit/698c5fa465169d6f23c6a41ca4b1fc9a7869013a"
+ },
+ {
+ "url": "https://vuldb.com/?id.216214",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216214"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4258.json b/2021/4xxx/CVE-2021-4258.json
new file mode 100644
index 000000000000..c01f31d7358f
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4258.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4258",
+ "TITLE": "whohas Package Information cleartext transmission",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "whohas",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-310 Cryptographic Issues -> CWE-319 Cleartext Transmission of Sensitive Information"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** DISPUTED ** A vulnerability was found in whohas. It has been rated as problematic. This issue affects some unknown processing of the component Package Information Handler. The manipulation leads to cleartext transmission of sensitive information. The attack may be initiated remotely. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 667c3e2e9178f15c23d7918b5db25cd0792c8472. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216251. NOTE: Most sources redirect to the encrypted site which limits the possibilities of an attack."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.7",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/whohas/whohas/commit/667c3e2e9178f15c23d7918b5db25cd0792c8472",
+ "refsource": "MISC",
+ "name": "https://github.com/whohas/whohas/commit/667c3e2e9178f15c23d7918b5db25cd0792c8472"
+ },
+ {
+ "url": "https://vuldb.com/?id.216251",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216251"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4259.json b/2021/4xxx/CVE-2021-4259.json
new file mode 100644
index 000000000000..d5f49ebefb39
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4259.json
@@ -0,0 +1,98 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4259",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in phpRedisAdmin up to 1.16.1. It has been classified as problematic. This affects the function authHttpDigest of the file includes/login.inc.php. The manipulation of the argument response leads to use of wrong operator in string comparison. Upgrading to version 1.16.2 is able to address this issue. The name of the patch is 31aa7661e6db6f4dffbf9a635817832a0a11c7d9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216267."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine Schwachstelle in phpRedisAdmin bis 1.16.1 ausgemacht. Sie wurde als problematisch eingestuft. Es geht dabei um die Funktion authHttpDigest der Datei includes/login.inc.php. Durch das Manipulieren des Arguments response mit unbekannten Daten kann eine use of wrong operator in string comparison-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 1.16.2 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 31aa7661e6db6f4dffbf9a635817832a0a11c7d9 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-597 Use of Wrong Operator in String Comparison",
+ "cweId": "CWE-597"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "phpRedisAdmin",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.16.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.16.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/erikdubbelboer/phpRedisAdmin/commit/31aa7661e6db6f4dffbf9a635817832a0a11c7d9",
+ "refsource": "MISC",
+ "name": "https://github.com/erikdubbelboer/phpRedisAdmin/commit/31aa7661e6db6f4dffbf9a635817832a0a11c7d9"
+ },
+ {
+ "url": "https://vuldb.com/?id.216267",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216267"
+ },
+ {
+ "url": "https://github.com/erikdubbelboer/phpRedisAdmin/releases/tag/v1.16.2",
+ "refsource": "MISC",
+ "name": "https://github.com/erikdubbelboer/phpRedisAdmin/releases/tag/v1.16.2"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5,
+ "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5,
+ "vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4260.json b/2021/4xxx/CVE-2021-4260.json
new file mode 100644
index 000000000000..780c1a0185a7
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4260.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4260",
+ "TITLE": "oils-js Web.js redirect",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "oils-js",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-601 Open Redirect"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in oils-js. It has been declared as critical. This vulnerability affects unknown code of the file core/Web.js. The manipulation leads to open redirect. The attack can be initiated remotely. The name of the patch is fad8fbae824a7d367dacb90d56cb02c5cb999d42. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216268."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "6.3",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/mannyvergel/oils-js/commit/fad8fbae824a7d367dacb90d56cb02c5cb999d42",
+ "refsource": "MISC",
+ "name": "https://github.com/mannyvergel/oils-js/commit/fad8fbae824a7d367dacb90d56cb02c5cb999d42"
+ },
+ {
+ "url": "https://vuldb.com/?id.216268",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216268"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4261.json b/2021/4xxx/CVE-2021-4261.json
new file mode 100644
index 000000000000..37739a12b2ab
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4261.json
@@ -0,0 +1,97 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4261",
+ "TITLE": "pacman-canvas db-handler.php addHighscore sql injection",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "pacman-canvas",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.0.0"
+ },
+ {
+ "version_value": "1.0.1"
+ },
+ {
+ "version_value": "1.0.2"
+ },
+ {
+ "version_value": "1.0.3"
+ },
+ {
+ "version_value": "1.0.4"
+ },
+ {
+ "version_value": "1.0.5"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-89 SQL Injection"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as critical has been found in pacman-canvas up to 1.0.5. Affected is the function addHighscore of the file data/db-handler.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 1.0.6 is able to address this issue. The name of the patch is 29522c90ca1cebfce6453a5af5a45281d99b0646. It is recommended to upgrade the affected component. VDB-216270 is the identifier assigned to this vulnerability."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "6.3",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/platzhersh/pacman-canvas/commit/29522c90ca1cebfce6453a5af5a45281d99b0646",
+ "refsource": "MISC",
+ "name": "https://github.com/platzhersh/pacman-canvas/commit/29522c90ca1cebfce6453a5af5a45281d99b0646"
+ },
+ {
+ "url": "https://github.com/platzhersh/pacman-canvas/releases/tag/1.0.6",
+ "refsource": "MISC",
+ "name": "https://github.com/platzhersh/pacman-canvas/releases/tag/1.0.6"
+ },
+ {
+ "url": "https://vuldb.com/?id.216270",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216270"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4262.json b/2021/4xxx/CVE-2021-4262.json
new file mode 100644
index 000000000000..f29d731b883e
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4262.json
@@ -0,0 +1,82 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4262",
+ "TITLE": "laravel-jqgrid EloquentRepositoryAbstract.php getRows sql injection",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "laravel-jqgrid",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-89 SQL Injection"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as critical was found in laravel-jqgrid. Affected by this vulnerability is the function getRows of the file src/Mgallegos/LaravelJqgrid/Repositories/EloquentRepositoryAbstract.php. The manipulation leads to sql injection. The name of the patch is fbc2d94f43d0dc772767a5bdb2681133036f935e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216271."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "5.5",
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/mgallegos/laravel-jqgrid/pull/72",
+ "refsource": "MISC",
+ "name": "https://github.com/mgallegos/laravel-jqgrid/pull/72"
+ },
+ {
+ "url": "https://github.com/mgallegos/laravel-jqgrid/commit/fbc2d94f43d0dc772767a5bdb2681133036f935e",
+ "refsource": "MISC",
+ "name": "https://github.com/mgallegos/laravel-jqgrid/commit/fbc2d94f43d0dc772767a5bdb2681133036f935e"
+ },
+ {
+ "url": "https://vuldb.com/?id.216271",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216271"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4263.json b/2021/4xxx/CVE-2021-4263.json
new file mode 100644
index 000000000000..0a60d3dd0aec
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4263.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4263",
+ "TITLE": "leanote history.js define cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "leanote",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as problematic, has been found in leanote. This issue affects the function define of the file public/js/plugins/history.js. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The name of the patch is https:/github.com/leanote/leanote/commit/0f9733c890077942150696dcc6d2b1482b7a0a19. It is recommended to apply a patch to fix this issue. The identifier VDB-216461 was assigned to this vulnerability."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/leanote/leanote/commit/0f9733c890077942150696dcc6d2b1482b7a0a19",
+ "refsource": "MISC",
+ "name": "https://github.com/leanote/leanote/commit/0f9733c890077942150696dcc6d2b1482b7a0a19"
+ },
+ {
+ "url": "https://vuldb.com/?id.216461",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216461"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4264.json b/2021/4xxx/CVE-2021-4264.json
new file mode 100644
index 000000000000..9e5b70898fde
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4264.json
@@ -0,0 +1,109 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4264",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in LinkedIn dustjs up to 2.x and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is ddb6523832465d38c9d80189e9de60519ac307c3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216464."
+ },
+ {
+ "lang": "deu",
+ "value": "Eine Schwachstelle wurde in LinkedIn dustjs bis 2.x gefunden. Sie wurde als problematisch eingestuft. Hierbei geht es um eine nicht exakt ausgemachte Funktion. Mittels Manipulieren mit unbekannten Daten kann eine improperly controlled modification of object prototype attributes ('prototype pollution')-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Ein Aktualisieren auf die Version 3.0.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als ddb6523832465d38c9d80189e9de60519ac307c3 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')",
+ "cweId": "CWE-1321"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "LinkedIn",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "dustjs",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "2.x",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/linkedin/dustjs/issues/804",
+ "refsource": "MISC",
+ "name": "https://github.com/linkedin/dustjs/issues/804"
+ },
+ {
+ "url": "https://github.com/linkedin/dustjs/pull/805",
+ "refsource": "MISC",
+ "name": "https://github.com/linkedin/dustjs/pull/805"
+ },
+ {
+ "url": "https://github.com/linkedin/dustjs/commit/ddb6523832465d38c9d80189e9de60519ac307c3",
+ "refsource": "MISC",
+ "name": "https://github.com/linkedin/dustjs/commit/ddb6523832465d38c9d80189e9de60519ac307c3"
+ },
+ {
+ "url": "https://vuldb.com/?id.216464",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216464"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216464",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216464"
+ },
+ {
+ "url": "https://github.com/linkedin/dustjs/releases/tag/v3.0.0",
+ "refsource": "MISC",
+ "name": "https://github.com/linkedin/dustjs/releases/tag/v3.0.0"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4265.json b/2021/4xxx/CVE-2021-4265.json
new file mode 100644
index 000000000000..24178b74dd01
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4265.json
@@ -0,0 +1,82 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4265",
+ "TITLE": "siwapp-ror cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "siwapp-ror",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in siwapp-ror. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 924d16008cfcc09356c87db01848e45290cb58ca. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216467."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/siwapp/siwapp-ror/pull/365",
+ "refsource": "MISC",
+ "name": "https://github.com/siwapp/siwapp-ror/pull/365"
+ },
+ {
+ "url": "https://github.com/siwapp/siwapp-ror/commit/924d16008cfcc09356c87db01848e45290cb58ca",
+ "refsource": "MISC",
+ "name": "https://github.com/siwapp/siwapp-ror/commit/924d16008cfcc09356c87db01848e45290cb58ca"
+ },
+ {
+ "url": "https://vuldb.com/?id.216467",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216467"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4266.json b/2021/4xxx/CVE-2021-4266.json
new file mode 100644
index 000000000000..19da8059b89b
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4266.json
@@ -0,0 +1,87 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4266",
+ "TITLE": "Webdetails cpf DependenciesPackage.java cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Webdetails",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "cpf",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "9.5.0.0-80"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic has been found in Webdetails cpf up to 9.5.0.0-80. Affected is an unknown function of the file core/src/main/java/pt/webdetails/cpf/packager/DependenciesPackage.java. The manipulation of the argument baseUrl leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 9.5.0.0-81 is able to address this issue. The name of the patch is 3bff900d228e8cae3af256b447c5d15bdb03c174. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216468."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/siwapp/siwapp-ror/pull/365",
+ "refsource": "MISC",
+ "name": "https://github.com/siwapp/siwapp-ror/pull/365"
+ },
+ {
+ "url": "https://github.com/webdetails/cpf/releases/tag/9.5.0.0-81",
+ "refsource": "MISC",
+ "name": "https://github.com/webdetails/cpf/releases/tag/9.5.0.0-81"
+ },
+ {
+ "url": "https://github.com/webdetails/cpf/commit/3bff900d228e8cae3af256b447c5d15bdb03c174",
+ "refsource": "MISC",
+ "name": "https://github.com/webdetails/cpf/commit/3bff900d228e8cae3af256b447c5d15bdb03c174"
+ },
+ {
+ "url": "https://vuldb.com/?id.216468",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216468"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4267.json b/2021/4xxx/CVE-2021-4267.json
new file mode 100644
index 000000000000..500f3bfc3ced
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4267.json
@@ -0,0 +1,82 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4267",
+ "TITLE": "tad_discuss cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "tad_discuss",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic was found in tad_discuss. Affected by this vulnerability is an unknown functionality. The manipulation of the argument DiscussTitle leads to cross site scripting. The attack can be launched remotely. The name of the patch is af94d034ff8db642d05fd8788179eab05f433958. It is recommended to apply a patch to fix this issue. The identifier VDB-216469 was assigned to this vulnerability."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/tad0616/tad_discuss/pull/19",
+ "refsource": "MISC",
+ "name": "https://github.com/tad0616/tad_discuss/pull/19"
+ },
+ {
+ "url": "https://github.com/tad0616/tad_discuss/commit/af94d034ff8db642d05fd8788179eab05f433958",
+ "refsource": "MISC",
+ "name": "https://github.com/tad0616/tad_discuss/commit/af94d034ff8db642d05fd8788179eab05f433958"
+ },
+ {
+ "url": "https://vuldb.com/?id.216469",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216469"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4268.json b/2021/4xxx/CVE-2021-4268.json
new file mode 100644
index 000000000000..da902241e099
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4268.json
@@ -0,0 +1,109 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4268",
+ "TITLE": "phpRedisAdmin cross-site request forgery",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "phpRedisAdmin",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.14.0"
+ },
+ {
+ "version_value": "1.14.1"
+ },
+ {
+ "version_value": "1.15.0"
+ },
+ {
+ "version_value": "1.16.0"
+ },
+ {
+ "version_value": "1.16.1"
+ },
+ {
+ "version_value": "1.16.2"
+ },
+ {
+ "version_value": "1.17.0"
+ },
+ {
+ "version_value": "1.17.1"
+ },
+ {
+ "version_value": "1.17.2"
+ },
+ {
+ "version_value": "1.17.3"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-863 Incorrect Authorization -> CWE-862 Missing Authorization -> CWE-352 Cross-Site Request Forgery"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as problematic, was found in phpRedisAdmin up to 1.17.3. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.18.0 is able to address this issue. The name of the patch is b9039adbb264c81333328faa9575ecf8e0d2be94. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216471."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "4.3",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/erikdubbelboer/phpRedisAdmin/commit/b9039adbb264c81333328faa9575ecf8e0d2be94",
+ "refsource": "MISC",
+ "name": "https://github.com/erikdubbelboer/phpRedisAdmin/commit/b9039adbb264c81333328faa9575ecf8e0d2be94"
+ },
+ {
+ "url": "https://github.com/erikdubbelboer/phpRedisAdmin/releases/tag/v1.18.0",
+ "refsource": "MISC",
+ "name": "https://github.com/erikdubbelboer/phpRedisAdmin/releases/tag/v1.18.0"
+ },
+ {
+ "url": "https://vuldb.com/?id.216471",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216471"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4269.json b/2021/4xxx/CVE-2021-4269.json
new file mode 100644
index 000000000000..290b769f8e9d
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4269.json
@@ -0,0 +1,82 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4269",
+ "TITLE": "SimpleRisk common.js checkAndSetValidation cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "SimpleRisk",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability has been found in SimpleRisk and classified as problematic. This vulnerability affects the function checkAndSetValidation of the file simplerisk/js/common.js. The manipulation of the argument title leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 20220306-001 is able to address this issue. The name of the patch is 591405b4ed160fbefc1dca1e55c5745079a7bb48. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216472."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/simplerisk/code/commit/591405b4ed160fbefc1dca1e55c5745079a7bb48",
+ "refsource": "MISC",
+ "name": "https://github.com/simplerisk/code/commit/591405b4ed160fbefc1dca1e55c5745079a7bb48"
+ },
+ {
+ "url": "https://github.com/simplerisk/code/releases/tag/20220306-001",
+ "refsource": "MISC",
+ "name": "https://github.com/simplerisk/code/releases/tag/20220306-001"
+ },
+ {
+ "url": "https://vuldb.com/?id.216472",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216472"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4270.json b/2021/4xxx/CVE-2021-4270.json
new file mode 100644
index 000000000000..da77e3170961
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4270.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4270",
+ "TITLE": "Imprint CMS ViewHelpers.cs SearchForm cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Imprint CMS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in Imprint CMS. It has been classified as problematic. Affected is the function SearchForm of the file ImprintCMS/Models/ViewHelpers.cs. The manipulation of the argument query leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 6140b140ccd02b5e4e7d6ba013ac1225724487f4. It is recommended to apply a patch to fix this issue. VDB-216474 is the identifier assigned to this vulnerability."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/peders/Imprint-CMS/commit/6140b140ccd02b5e4e7d6ba013ac1225724487f4",
+ "refsource": "MISC",
+ "name": "https://github.com/peders/Imprint-CMS/commit/6140b140ccd02b5e4e7d6ba013ac1225724487f4"
+ },
+ {
+ "url": "https://vuldb.com/?id.216474",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216474"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4271.json b/2021/4xxx/CVE-2021-4271.json
new file mode 100644
index 000000000000..1fea882652a8
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4271.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4271",
+ "TITLE": "panicsteve w2wiki Markdown index.php toHTML cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "panicsteve",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "w2wiki",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in panicsteve w2wiki. It has been rated as problematic. Affected by this issue is the function toHTML of the file index.php of the component Markdown Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is 8f1d0470b4ddb1c7699e3308e765c11ed29542b6. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216476."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/panicsteve/w2wiki/commit/8f1d0470b4ddb1c7699e3308e765c11ed29542b6",
+ "refsource": "MISC",
+ "name": "https://github.com/panicsteve/w2wiki/commit/8f1d0470b4ddb1c7699e3308e765c11ed29542b6"
+ },
+ {
+ "url": "https://vuldb.com/?id.216476",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216476"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4272.json b/2021/4xxx/CVE-2021-4272.json
new file mode 100644
index 000000000000..3f99bd1433e9
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4272.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4272",
+ "TITLE": "studygolang topics.js cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "studygolang",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic has been found in studygolang. This affects an unknown part of the file static/js/topics.js. The manipulation of the argument contentHtml leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is 0fb30f9640bd5fa0cae58922eac6c00bb1a94391. It is recommended to apply a patch to fix this issue. The identifier VDB-216477 was assigned to this vulnerability."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/studygolang/studygolang/commit/0fb30f9640bd5fa0cae58922eac6c00bb1a94391",
+ "refsource": "MISC",
+ "name": "https://github.com/studygolang/studygolang/commit/0fb30f9640bd5fa0cae58922eac6c00bb1a94391"
+ },
+ {
+ "url": "https://vuldb.com/?id.216477",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216477"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4273.json b/2021/4xxx/CVE-2021-4273.json
new file mode 100644
index 000000000000..1407f8bb27dd
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4273.json
@@ -0,0 +1,82 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4273",
+ "TITLE": "studygolang search.go Search cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "studygolang",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic was found in studygolang. This vulnerability affects the function Search of the file http/controller/search.go. The manipulation of the argument q leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 97ba556d42fa89dfaa7737e9cd3a8ddaf670bb23. It is recommended to apply a patch to fix this issue. VDB-216478 is the identifier assigned to this vulnerability."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "4.3",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/studygolang/studygolang/pull/158",
+ "refsource": "MISC",
+ "name": "https://github.com/studygolang/studygolang/pull/158"
+ },
+ {
+ "url": "https://github.com/studygolang/studygolang/commit/97ba556d42fa89dfaa7737e9cd3a8ddaf670bb23",
+ "refsource": "MISC",
+ "name": "https://github.com/studygolang/studygolang/commit/97ba556d42fa89dfaa7737e9cd3a8ddaf670bb23"
+ },
+ {
+ "url": "https://vuldb.com/?id.216478",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216478"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4274.json b/2021/4xxx/CVE-2021-4274.json
new file mode 100644
index 000000000000..88801df654f6
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4274.json
@@ -0,0 +1,82 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4274",
+ "TITLE": "sileht bird-lg layout.html cross site scripting",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "sileht",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "bird-lg",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as problematic, has been found in sileht bird-lg. This issue affects some unknown processing of the file templates/layout.html. The manipulation of the argument request_args leads to cross site scripting. The attack may be initiated remotely. The name of the patch is ef6b32c527478fefe7a4436e10b96ee28ed5b308. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216479."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "3.5",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/sileht/bird-lg/pull/82",
+ "refsource": "MISC",
+ "name": "https://github.com/sileht/bird-lg/pull/82"
+ },
+ {
+ "url": "https://github.com/sileht/bird-lg/commit/ef6b32c527478fefe7a4436e10b96ee28ed5b308",
+ "refsource": "MISC",
+ "name": "https://github.com/sileht/bird-lg/commit/ef6b32c527478fefe7a4436e10b96ee28ed5b308"
+ },
+ {
+ "url": "https://vuldb.com/?id.216479",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216479"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4275.json b/2021/4xxx/CVE-2021-4275.json
new file mode 100644
index 000000000000..6262f5851d99
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4275.json
@@ -0,0 +1,77 @@
+{
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4275",
+ "TITLE": "katlings pyambic-pentameter cross-site request forgery",
+ "REQUESTER": "cna@vuldb.com",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "generator": "vuldb.com",
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "katlings",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "pyambic-pentameter",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-863 Incorrect Authorization -> CWE-862 Missing Authorization -> CWE-352 Cross-Site Request Forgery"
+ }
+ ]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as problematic, was found in katlings pyambic-pentameter. Affected is an unknown function. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The name of the patch is 974f21aa1b2527ef39c8afe1a5060548217deca8. It is recommended to apply a patch to fix this issue. VDB-216498 is the identifier assigned to this vulnerability."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "baseScore": "4.3",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/katlings/pyambic-pentameter/commit/974f21aa1b2527ef39c8afe1a5060548217deca8",
+ "refsource": "MISC",
+ "name": "https://github.com/katlings/pyambic-pentameter/commit/974f21aa1b2527ef39c8afe1a5060548217deca8"
+ },
+ {
+ "url": "https://vuldb.com/?id.216498",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216498"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4276.json b/2021/4xxx/CVE-2021-4276.json
new file mode 100644
index 000000000000..7cbca96a582d
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4276.json
@@ -0,0 +1,93 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4276",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in dns-stats hedgehog. It has been rated as problematic. Affected by this issue is the function DSCIOManager::dsc_import_input_from_source of the file src/DSCIOManager.cpp. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 58922c345d3d1fe89bb2020111873a3e07ca93ac. It is recommended to apply a patch to fix this issue. VDB-216746 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: We do assume that the Data Manager server can only be accessed by authorised users. Because of this, we don\u2019t believe this specific attack is possible without such a compromise of the Data Manager server."
+ },
+ {
+ "lang": "deu",
+ "value": "** DISPUTED ** ** UNSUPPPORTED WHEN ASSIGNED **Eine problematische Schwachstelle wurde in dns-stats hedgehog ausgemacht. Es geht hierbei um die Funktion DSCIOManager::dsc_import_input_from_source der Datei src/DSCIOManager.cpp. Mit der Manipulation mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Bisher konnte die Existenz der vermeintlichen Schwachstelle noch nicht eindeutig nachgewiesen werden. Der Patch wird als 58922c345d3d1fe89bb2020111873a3e07ca93ac bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-89 SQL Injection",
+ "cweId": "CWE-89"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "dns-stats",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "hedgehog",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "before 58922c345d3d1fe89bb2020111873a3e07ca93ac"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216746",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216746"
+ },
+ {
+ "url": "https://github.com/dns-stats/hedgehog/pull/190",
+ "refsource": "MISC",
+ "name": "https://github.com/dns-stats/hedgehog/pull/190"
+ },
+ {
+ "url": "https://github.com/dns-stats/hedgehog/commit/58922c345d3d1fe89bb2020111873a3e07ca93ac",
+ "refsource": "MISC",
+ "name": "https://github.com/dns-stats/hedgehog/commit/58922c345d3d1fe89bb2020111873a3e07ca93ac"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 4.1,
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 4.1,
+ "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4277.json b/2021/4xxx/CVE-2021-4277.json
new file mode 100644
index 000000000000..104a3e301297
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4277.json
@@ -0,0 +1,89 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4277",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as problematic, has been found in fredsmith utils. This issue affects some unknown processing of the file screenshot_sync of the component Filename Handler. The manipulation leads to predictable from observable state. The name of the patch is dbab1b66955eeb3d76b34612b358307f5c4e3944. It is recommended to apply a patch to fix this issue. The identifier VDB-216749 was assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Eine Schwachstelle wurde in fredsmith utils entdeckt. Sie wurde als problematisch eingestuft. Hierbei geht es um eine nicht exakt ausgemachte Funktion der Datei screenshot_sync der Komponente Filename Handler. Mittels dem Manipulieren mit unbekannten Daten kann eine predictable from observable state-Schwachstelle ausgenutzt werden. Der Patch wird als dbab1b66955eeb3d76b34612b358307f5c4e3944 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-341 Predictable from Observable State",
+ "cweId": "CWE-341"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "fredsmith",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "utils",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216749",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216749"
+ },
+ {
+ "url": "https://github.com/fredsmith/utils/commit/dbab1b66955eeb3d76b34612b358307f5c4e3944",
+ "refsource": "MISC",
+ "name": "https://github.com/fredsmith/utils/commit/dbab1b66955eeb3d76b34612b358307f5c4e3944"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 2.6,
+ "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 2.6,
+ "vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4278.json b/2021/4xxx/CVE-2021-4278.json
new file mode 100644
index 000000000000..32d83a6dbdb3
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4278.json
@@ -0,0 +1,119 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4278",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic has been found in cronvel tree-kit up to 0.6.x. This affects an unknown part. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). Upgrading to version 0.7.0 is able to address this issue. The name of the patch is a63f559c50d70e8cb2eaae670dec25d1dbc4afcd. It is recommended to upgrade the affected component. The identifier VDB-216765 was assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine Schwachstelle in cronvel tree-kit bis 0.6.x entdeckt. Sie wurde als problematisch eingestuft. Es betrifft eine unbekannte Funktion. Durch Beeinflussen mit unbekannten Daten kann eine improperly controlled modification of object prototype attributes ('prototype pollution')-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 0.7.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als a63f559c50d70e8cb2eaae670dec25d1dbc4afcd bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')",
+ "cweId": "CWE-1321"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "cronvel",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "tree-kit",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "0.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.5",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.6",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216765",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216765"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216765",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216765"
+ },
+ {
+ "url": "https://github.com/cronvel/tree-kit/commit/a63f559c50d70e8cb2eaae670dec25d1dbc4afcd",
+ "refsource": "MISC",
+ "name": "https://github.com/cronvel/tree-kit/commit/a63f559c50d70e8cb2eaae670dec25d1dbc4afcd"
+ },
+ {
+ "url": "https://github.com/cronvel/tree-kit/releases/tag/v0.7.0",
+ "refsource": "MISC",
+ "name": "https://github.com/cronvel/tree-kit/releases/tag/v0.7.0"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4279.json b/2021/4xxx/CVE-2021-4279.json
new file mode 100644
index 000000000000..7beae5155d18
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4279.json
@@ -0,0 +1,108 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4279",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "In Starcounter-Jack JSON-Patch bis 3.1.0 wurde eine problematische Schwachstelle gefunden. Dabei geht es um eine nicht genauer bekannte Funktion. Dank Manipulation mit unbekannten Daten kann eine improperly controlled modification of object prototype attributes ('prototype pollution')-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Ein Aktualisieren auf die Version 3.1.1 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 7ad6af41eabb2d799f698740a91284d762c955c9 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')",
+ "cweId": "CWE-1321"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Starcounter-Jack",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "JSON-Patch",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "3.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216778",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216778"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216778",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216778"
+ },
+ {
+ "url": "https://github.com/Starcounter-Jack/JSON-Patch/pull/262",
+ "refsource": "MISC",
+ "name": "https://github.com/Starcounter-Jack/JSON-Patch/pull/262"
+ },
+ {
+ "url": "https://github.com/Starcounter-Jack/JSON-Patch/commit/7ad6af41eabb2d799f698740a91284d762c955c9",
+ "refsource": "MISC",
+ "name": "https://github.com/Starcounter-Jack/JSON-Patch/commit/7ad6af41eabb2d799f698740a91284d762c955c9"
+ },
+ {
+ "url": "https://github.com/Starcounter-Jack/JSON-Patch/releases/tag/3.1.1",
+ "refsource": "MISC",
+ "name": "https://github.com/Starcounter-Jack/JSON-Patch/releases/tag/3.1.1"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4280.json b/2021/4xxx/CVE-2021-4280.json
new file mode 100644
index 000000000000..6003368f9625
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4280.json
@@ -0,0 +1,94 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4280",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in styler_praat_scripts. It has been classified as problematic. Affected is an unknown function of the file file_segmenter.praat of the component Slash Handler. The manipulation leads to denial of service. It is possible to launch the attack remotely. The name of the patch is 0cad44aa4a3eb0ecdba071c10eaff16023d8b35f. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216780."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine problematische Schwachstelle in styler_praat_scripts ausgemacht. Es betrifft eine unbekannte Funktion der Datei file_segmenter.praat der Komponente Slash Handler. Durch die Manipulation mit unbekannten Daten kann eine denial of service-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Der Patch wird als 0cad44aa4a3eb0ecdba071c10eaff16023d8b35f bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-404 Denial of Service",
+ "cweId": "CWE-404"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "styler_praat_scripts",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216780",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216780"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216780",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216780"
+ },
+ {
+ "url": "https://github.com/stylerw/styler_praat_scripts/commit/0cad44aa4a3eb0ecdba071c10eaff16023d8b35f",
+ "refsource": "MISC",
+ "name": "https://github.com/stylerw/styler_praat_scripts/commit/0cad44aa4a3eb0ecdba071c10eaff16023d8b35f"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 4.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 4.3,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4281.json b/2021/4xxx/CVE-2021-4281.json
new file mode 100644
index 000000000000..1ec3ca4e475d
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4281.json
@@ -0,0 +1,99 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4281",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the file .github/workflows/combine-prs.yml. The manipulation leads to os command injection. The name of the patch is 55b5a234c0fab935df5fb08365bc8fe9c37cf46b. It is recommended to apply a patch to fix this issue. VDB-216842 is the identifier assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Eine Schwachstelle wurde in Brave UX for-the-badge gefunden. Sie wurde als kritisch eingestuft. Dies betrifft einen unbekannten Teil der Datei .github/workflows/combine-prs.yml. Durch Beeinflussen mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Der Patch wird als 55b5a234c0fab935df5fb08365bc8fe9c37cf46b bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-78 OS Command Injection",
+ "cweId": "CWE-78"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Brave UX",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "for-the-badge",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216842",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216842"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216842",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216842"
+ },
+ {
+ "url": "https://github.com/BraveUX/for-the-badge/pull/165",
+ "refsource": "MISC",
+ "name": "https://github.com/BraveUX/for-the-badge/pull/165"
+ },
+ {
+ "url": "https://github.com/BraveUX/for-the-badge/commit/55b5a234c0fab935df5fb08365bc8fe9c37cf46b",
+ "refsource": "MISC",
+ "name": "https://github.com/BraveUX/for-the-badge/commit/55b5a234c0fab935df5fb08365bc8fe9c37cf46b"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 4.6,
+ "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 4.6,
+ "vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4282.json b/2021/4xxx/CVE-2021-4282.json
new file mode 100644
index 000000000000..e1bb8efb4b25
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4282.json
@@ -0,0 +1,99 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4282",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in FreePBX voicemail. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file page.voicemail.php. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 14.0.6.25 is able to address this issue. The name of the patch is 12e1469ef9208eda9d8955206e78345949236ee6. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216871."
+ },
+ {
+ "lang": "deu",
+ "value": "In FreePBX voicemail wurde eine problematische Schwachstelle ausgemacht. Das betrifft eine unbekannte Funktionalit\u00e4t der Datei page.voicemail.php. Mittels Manipulieren mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Ein Aktualisieren auf die Version 14.0.6.25 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 12e1469ef9208eda9d8955206e78345949236ee6 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "FreePBX",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "voicemail",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216871",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216871"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216871",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216871"
+ },
+ {
+ "url": "https://github.com/FreePBX/voicemail/commit/12e1469ef9208eda9d8955206e78345949236ee6",
+ "refsource": "MISC",
+ "name": "https://github.com/FreePBX/voicemail/commit/12e1469ef9208eda9d8955206e78345949236ee6"
+ },
+ {
+ "url": "https://github.com/FreePBX/voicemail/releases/tag/release%2F14.0.6.25",
+ "refsource": "MISC",
+ "name": "https://github.com/FreePBX/voicemail/releases/tag/release%2F14.0.6.25"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4283.json b/2021/4xxx/CVE-2021-4283.json
new file mode 100644
index 000000000000..334f266ded8a
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4283.json
@@ -0,0 +1,99 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4283",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in FreeBPX voicemail. It has been rated as problematic. Affected by this issue is some unknown functionality of the file views/ssettings.php of the component Settings Handler. The manipulation of the argument key leads to cross site scripting. The attack may be launched remotely. Upgrading to version 14.0.6.25 is able to address this issue. The name of the patch is ffce4882016076acd16fe0f676246905aa3cb2f3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216872."
+ },
+ {
+ "lang": "deu",
+ "value": "Eine problematische Schwachstelle wurde in FreeBPX voicemail ausgemacht. Dies betrifft einen unbekannten Teil der Datei views/ssettings.php der Komponente Settings Handler. Durch das Manipulieren des Arguments key mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Ein Aktualisieren auf die Version 14.0.6.25 vermag dieses Problem zu l\u00f6sen. Der Patch wird als ffce4882016076acd16fe0f676246905aa3cb2f3 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "FreeBPX",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "voicemail",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/FreePBX/voicemail/releases/tag/release%2F14.0.6.25",
+ "refsource": "MISC",
+ "name": "https://github.com/FreePBX/voicemail/releases/tag/release%2F14.0.6.25"
+ },
+ {
+ "url": "https://vuldb.com/?id.216872",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216872"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216872",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216872"
+ },
+ {
+ "url": "https://github.com/FreePBX/voicemail/commit/ffce4882016076acd16fe0f676246905aa3cb2f3",
+ "refsource": "MISC",
+ "name": "https://github.com/FreePBX/voicemail/commit/ffce4882016076acd16fe0f676246905aa3cb2f3"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 2.4,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 2.4,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4284.json b/2021/4xxx/CVE-2021-4284.json
new file mode 100644
index 000000000000..5f19f6ca2fff
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4284.json
@@ -0,0 +1,109 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4284",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic has been found in OpenMRS HTML Form Entry UI Framework Integration Module up to 1.x. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is 811990972ea07649ae33c4b56c61c3b520895f07. It is recommended to upgrade the affected component. The identifier VDB-216873 was assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine Schwachstelle in OpenMRS HTML Form Entry UI Framework Integration Module bis 1.x entdeckt. Sie wurde als problematisch eingestuft. Dabei betrifft es einen unbekannter Codeteil. Durch Manipulieren mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Ein Aktualisieren auf die Version 2.0.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 811990972ea07649ae33c4b56c61c3b520895f07 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "OpenMRS",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "HTML Form Entry UI Framework Integration Module",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.x",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216873",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216873"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216873",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216873"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-htmlformentryui/pull/51",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-htmlformentryui/pull/51"
+ },
+ {
+ "url": "https://issues.openmrs.org/browse/RA-1424?filter=-1",
+ "refsource": "MISC",
+ "name": "https://issues.openmrs.org/browse/RA-1424?filter=-1"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-htmlformentryui/commit/811990972ea07649ae33c4b56c61c3b520895f07",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-htmlformentryui/commit/811990972ea07649ae33c4b56c61c3b520895f07"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-htmlformentryui/releases/tag/2.0.0",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-htmlformentryui/releases/tag/2.0.0"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4285.json b/2021/4xxx/CVE-2021-4285.json
new file mode 100644
index 000000000000..cbac4159f97a
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4285.json
@@ -0,0 +1,104 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4285",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic was found in Nagios NCPA. This vulnerability affects unknown code of the file agent/listener/templates/tail.html. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 2.4.0 is able to address this issue. The name of the patch is 5abbcd7aa26e0fc815e6b2b0ffe1c15ef3e8fab5. It is recommended to upgrade the affected component. VDB-216874 is the identifier assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "In Nagios NCPA wurde eine Schwachstelle entdeckt. Sie wurde als problematisch eingestuft. Hierbei betrifft es unbekannten Programmcode der Datei agent/listener/templates/tail.html. Durch das Beeinflussen des Arguments name mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Ein Aktualisieren auf die Version 2.4.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 5abbcd7aa26e0fc815e6b2b0ffe1c15ef3e8fab5 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Nagios",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "NCPA",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216874",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216874"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216874",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216874"
+ },
+ {
+ "url": "https://github.com/NagiosEnterprises/ncpa/pull/834",
+ "refsource": "MISC",
+ "name": "https://github.com/NagiosEnterprises/ncpa/pull/834"
+ },
+ {
+ "url": "https://github.com/NagiosEnterprises/ncpa/commit/5abbcd7aa26e0fc815e6b2b0ffe1c15ef3e8fab5",
+ "refsource": "MISC",
+ "name": "https://github.com/NagiosEnterprises/ncpa/commit/5abbcd7aa26e0fc815e6b2b0ffe1c15ef3e8fab5"
+ },
+ {
+ "url": "https://github.com/NagiosEnterprises/ncpa/releases/tag/v2.4.0",
+ "refsource": "MISC",
+ "name": "https://github.com/NagiosEnterprises/ncpa/releases/tag/v2.4.0"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4286.json b/2021/4xxx/CVE-2021-4286.json
new file mode 100644
index 000000000000..566857fe8a18
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4286.json
@@ -0,0 +1,168 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4286",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculate_x of the file srp/_ctsrp.py. The manipulation leads to information exposure through discrepancy. Upgrading to version 1.0.17 is able to address this issue. The name of the patch is dba52642f5e95d3da7af1780561213ee6053195f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216875."
+ },
+ {
+ "lang": "deu",
+ "value": "Eine Schwachstelle wurde in cocagne pysrp bis 1.0.16 entdeckt. Sie wurde als problematisch eingestuft. Davon betroffen ist die Funktion calculate_x der Datei srp/_ctsrp.py. Durch Beeinflussen mit unbekannten Daten kann eine information exposure through discrepancy-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 1.0.17 vermag dieses Problem zu l\u00f6sen. Der Patch wird als dba52642f5e95d3da7af1780561213ee6053195f bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-203 Information Exposure Through Discrepancy",
+ "cweId": "CWE-203"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "cocagne",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "pysrp",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.0.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.5",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.6",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.7",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.8",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.9",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.10",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.11",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.12",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.13",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.14",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.15",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.16",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216875",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216875"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216875",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216875"
+ },
+ {
+ "url": "https://github.com/cocagne/pysrp/pull/43",
+ "refsource": "MISC",
+ "name": "https://github.com/cocagne/pysrp/pull/43"
+ },
+ {
+ "url": "https://github.com/cocagne/pysrp/commit/dba52642f5e95d3da7af1780561213ee6053195f",
+ "refsource": "MISC",
+ "name": "https://github.com/cocagne/pysrp/commit/dba52642f5e95d3da7af1780561213ee6053195f"
+ },
+ {
+ "url": "https://github.com/cocagne/pysrp/releases/tag/1.0.17",
+ "refsource": "MISC",
+ "name": "https://github.com/cocagne/pysrp/releases/tag/1.0.17"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 2.6,
+ "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 2.6,
+ "vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4287.json b/2021/4xxx/CVE-2021-4287.json
new file mode 100644
index 000000000000..423be9e3b7b7
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4287.json
@@ -0,0 +1,112 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4287",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as problematic, was found in ReFirm Labs binwalk up to 2.3.2. Affected is an unknown function of the file src/binwalk/modules/extractor.py of the component Archive Extraction Handler. The manipulation leads to symlink following. It is possible to launch the attack remotely. Upgrading to version 2.3.3 is able to address this issue. The name of the patch is fa0c0bd59b8588814756942fe4cb5452e76c1dcd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216876."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine Schwachstelle in ReFirm Labs binwalk bis 2.3.2 gefunden. Sie wurde als problematisch eingestuft. Hiervon betroffen ist ein unbekannter Codeblock der Datei src/binwalk/modules/extractor.py der Komponente Archive Extraction Handler. Dank der Manipulation mit unbekannten Daten kann eine symlink following-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Ein Aktualisieren auf die Version 2.3.3 vermag dieses Problem zu l\u00f6sen. Der Patch wird als fa0c0bd59b8588814756942fe4cb5452e76c1dcd bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-61 Symlink Following",
+ "cweId": "CWE-61"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "ReFirm Labs",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "binwalk",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "2.3.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.3.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.3.2",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216876",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216876"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216876",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216876"
+ },
+ {
+ "url": "https://github.com/ReFirmLabs/binwalk/pull/556",
+ "refsource": "MISC",
+ "name": "https://github.com/ReFirmLabs/binwalk/pull/556"
+ },
+ {
+ "url": "https://github.com/ReFirmLabs/binwalk/commit/fa0c0bd59b8588814756942fe4cb5452e76c1dcd",
+ "refsource": "MISC",
+ "name": "https://github.com/ReFirmLabs/binwalk/commit/fa0c0bd59b8588814756942fe4cb5452e76c1dcd"
+ },
+ {
+ "url": "https://github.com/ReFirmLabs/binwalk/releases/tag/v2.3.3",
+ "refsource": "MISC",
+ "name": "https://github.com/ReFirmLabs/binwalk/releases/tag/v2.3.3"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5,
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5,
+ "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4288.json b/2021/4xxx/CVE-2021-4288.json
new file mode 100644
index 000000000000..8aef28b73373
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4288.json
@@ -0,0 +1,148 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4288",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. It has been rated as problematic. This issue affects some unknown processing of the file omod/src/main/webapp/pages/userApp.gsp. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.12.0 is able to address this issue. The name of the patch is 35f81901a4cb925747a9615b8706f5079d2196a1. It is recommended to upgrade the affected component. The identifier VDB-216881 was assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Eine Schwachstelle wurde in OpenMRS openmrs-module-referenceapplication bis 2.11.x ausgemacht. Sie wurde als problematisch eingestuft. Es geht hierbei um eine nicht n\u00e4her spezifizierte Funktion der Datei omod/src/main/webapp/pages/userApp.gsp. Mittels dem Manipulieren mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Ein Aktualisieren auf die Version 2.12.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 35f81901a4cb925747a9615b8706f5079d2196a1 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "OpenMRS",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "openmrs-module-referenceapplication",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "2.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.5",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.6",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.7",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.8",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.9",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.10",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.11",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216881",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216881"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216881",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216881"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-referenceapplication/pull/92",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-referenceapplication/pull/92"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-referenceapplication/commit/35f81901a4cb925747a9615b8706f5079d2196a1",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-referenceapplication/commit/35f81901a4cb925747a9615b8706f5079d2196a1"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-referenceapplication/releases/tag/referenceapplication-2.12.0",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-referenceapplication/releases/tag/referenceapplication-2.12.0"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4289.json b/2021/4xxx/CVE-2021-4289.json
new file mode 100644
index 000000000000..41e95e64511f
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4289.json
@@ -0,0 +1,153 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4289",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic was found in OpenMRS openmrs-module-referenceapplication up to 2.11.x. Affected by this vulnerability is the function post of the file omod/src/main/java/org/openmrs/module/referenceapplication/page/controller/UserAppPageController.java of the component User App Page. The manipulation of the argument AppId leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.12.0 is able to address this issue. The name of the patch is 0410c091d46eed3c132fe0fcafe5964182659f74. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216883."
+ },
+ {
+ "lang": "deu",
+ "value": "In OpenMRS openmrs-module-referenceapplication bis 2.11.x wurde eine problematische Schwachstelle entdeckt. Dabei geht es um die Funktion post der Datei omod/src/main/java/org/openmrs/module/referenceapplication/page/controller/UserAppPageController.java der Komponente User App Page. Durch das Manipulieren des Arguments AppId mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Ein Aktualisieren auf die Version 2.12.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 0410c091d46eed3c132fe0fcafe5964182659f74 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "OpenMRS",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "openmrs-module-referenceapplication",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "2.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.5",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.6",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.7",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.8",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.9",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.10",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.11",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/openmrs/openmrs-module-referenceapplication/releases/tag/referenceapplication-2.12.0",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-referenceapplication/releases/tag/referenceapplication-2.12.0"
+ },
+ {
+ "url": "https://vuldb.com/?id.216883",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216883"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216883",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216883"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-referenceapplication/pull/89",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-referenceapplication/pull/89"
+ },
+ {
+ "url": "https://issues.openmrs.org/browse/RA-1875",
+ "refsource": "MISC",
+ "name": "https://issues.openmrs.org/browse/RA-1875"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-referenceapplication/commit/0410c091d46eed3c132fe0fcafe5964182659f74",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-referenceapplication/commit/0410c091d46eed3c132fe0fcafe5964182659f74"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4290.json b/2021/4xxx/CVE-2021-4290.json
new file mode 100644
index 000000000000..0a8079cf2822
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4290.json
@@ -0,0 +1,94 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4290",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in DHBW Fallstudie. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file app/config/passport.js of the component Login. The manipulation of the argument id/email leads to sql injection. The name of the patch is 5c13c6a972ef4c07c5f35b417916e0598af9e123. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216907."
+ },
+ {
+ "lang": "deu",
+ "value": "In DHBW Fallstudie wurde eine kritische Schwachstelle ausgemacht. Betroffen ist eine unbekannte Verarbeitung der Datei app/config/passport.js der Komponente Login. Durch das Beeinflussen des Arguments id/email mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Der Patch wird als 5c13c6a972ef4c07c5f35b417916e0598af9e123 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-89 SQL Injection",
+ "cweId": "CWE-89"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "DHBW Fallstudie",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216907",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216907"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216907",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216907"
+ },
+ {
+ "url": "https://github.com/maboehm/fallstudie/commit/5c13c6a972ef4c07c5f35b417916e0598af9e123",
+ "refsource": "MISC",
+ "name": "https://github.com/maboehm/fallstudie/commit/5c13c6a972ef4c07c5f35b417916e0598af9e123"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4291.json b/2021/4xxx/CVE-2021-4291.json
new file mode 100644
index 000000000000..f2e08424c284
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4291.json
@@ -0,0 +1,124 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4291",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in OpenMRS Admin UI Module up to 1.5.x. It has been declared as problematic. This vulnerability affects unknown code of the file omod/src/main/webapp/pages/metadata/locations/location.gsp. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.6.0 is able to address this issue. The name of the patch is a7eefb5f69f6c50a3bffcb138bb8ea57cb41a9b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216916."
+ },
+ {
+ "lang": "deu",
+ "value": "In OpenMRS Admin UI Module bis 1.5.x wurde eine Schwachstelle ausgemacht. Sie wurde als problematisch eingestuft. Das betrifft eine unbekannte Funktionalit\u00e4t der Datei omod/src/main/webapp/pages/metadata/locations/location.gsp. Durch das Manipulieren mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Ein Aktualisieren auf die Version 1.6.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als a7eefb5f69f6c50a3bffcb138bb8ea57cb41a9b6 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "OpenMRS",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Admin UI Module",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.5",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216916",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216916"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216916",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216916"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-adminui/pull/61",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-adminui/pull/61"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-adminui/commit/a7eefb5f69f6c50a3bffcb138bb8ea57cb41a9b6",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-adminui/commit/a7eefb5f69f6c50a3bffcb138bb8ea57cb41a9b6"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-adminui/releases/tag/1.6.0",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-adminui/releases/tag/1.6.0"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4292.json b/2021/4xxx/CVE-2021-4292.json
new file mode 100644
index 000000000000..8d254de284b6
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4292.json
@@ -0,0 +1,120 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4292",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in OpenMRS Admin UI Module up to 1.4.x. It has been rated as problematic. This issue affects some unknown processing of the file omod/src/main/webapp/pages/metadata/privileges/privilege.gsp of the component Manage Privilege Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 4f8565425b7c74128dec9ca46dfbb9a3c1c24911. It is recommended to upgrade the affected component. The identifier VDB-216917 was assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Eine Schwachstelle wurde in OpenMRS Admin UI Module bis 1.4.x ausgemacht. Sie wurde als problematisch eingestuft. Dies betrifft einen unbekannten Teil der Datei omod/src/main/webapp/pages/metadata/privileges/privilege.gsp der Komponente Manage Privilege Page. Durch Manipulieren mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Ein Aktualisieren auf die Version 1.5.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 4f8565425b7c74128dec9ca46dfbb9a3c1c24911 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "OpenMRS",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Admin UI Module",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.4",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/openmrs/openmrs-module-adminui/releases/tag/1.5.0",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-adminui/releases/tag/1.5.0"
+ },
+ {
+ "url": "https://vuldb.com/?id.216917",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216917"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216917",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216917"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-adminui/pull/58",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-adminui/pull/58"
+ },
+ {
+ "url": "https://github.com/openmrs/openmrs-module-adminui/commit/4f8565425b7c74128dec9ca46dfbb9a3c1c24911",
+ "refsource": "MISC",
+ "name": "https://github.com/openmrs/openmrs-module-adminui/commit/4f8565425b7c74128dec9ca46dfbb9a3c1c24911"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4293.json b/2021/4xxx/CVE-2021-4293.json
new file mode 100644
index 000000000000..d4b77c68fe2e
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4293.json
@@ -0,0 +1,103 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4293",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "** UNSUPPPORTED WHEN ASSIGNED **** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in gnuboard youngcart5 up to 5.4.5.1. Affected is an unknown function of the file adm/menu_list_update.php. The manipulation of the argument me_link leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 5.4.5.2 is able to address this issue. The name of the patch is 70daa537adfa47b87af12d85f1e698fff01785ff. It is recommended to upgrade the affected component. VDB-216954 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer."
+ },
+ {
+ "lang": "deu",
+ "value": "** UNSUPPPORTED WHEN ASSIGNED **Es wurde eine problematische Schwachstelle in gnuboard youngcart5 bis 5.4.5.1 entdeckt. Betroffen hiervon ist ein unbekannter Ablauf der Datei adm/menu_list_update.php. Dank Manipulation des Arguments me_link mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Ein Aktualisieren auf die Version 5.4.5.2 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 70daa537adfa47b87af12d85f1e698fff01785ff bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "gnuboard",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "youngcart5",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "5.4.5.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "5.4.5.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216954",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216954"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216954",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216954"
+ },
+ {
+ "url": "https://github.com/gnuboard/youngcart5/commit/70daa537adfa47b87af12d85f1e698fff01785ff",
+ "refsource": "MISC",
+ "name": "https://github.com/gnuboard/youngcart5/commit/70daa537adfa47b87af12d85f1e698fff01785ff"
+ },
+ {
+ "url": "https://github.com/gnuboard/youngcart5/releases/tag/5.4.5.2",
+ "refsource": "MISC",
+ "name": "https://github.com/gnuboard/youngcart5/releases/tag/5.4.5.2"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4294.json b/2021/4xxx/CVE-2021-4294.json
new file mode 100644
index 000000000000..12d8c4bb8773
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4294.json
@@ -0,0 +1,99 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4294",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine Schwachstelle in OpenShift OSIN ausgemacht. Sie wurde als problematisch eingestuft. Es geht dabei um die Funktion ClientSecretMatches/CheckClientSecret. Dank Manipulation des Arguments secret mit unbekannten Daten kann eine observable timing discrepancy-Schwachstelle ausgenutzt werden. Der Patch wird als 8612686d6dda34ae9ef6b5a974e4b7accb4fea29 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-208 Observable Timing Discrepancy",
+ "cweId": "CWE-208"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "OpenShift",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "OSIN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.216987",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.216987"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.216987",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.216987"
+ },
+ {
+ "url": "https://github.com/openshift/osin/pull/200",
+ "refsource": "MISC",
+ "name": "https://github.com/openshift/osin/pull/200"
+ },
+ {
+ "url": "https://github.com/openshift/osin/commit/8612686d6dda34ae9ef6b5a974e4b7accb4fea29",
+ "refsource": "MISC",
+ "name": "https://github.com/openshift/osin/commit/8612686d6dda34ae9ef6b5a974e4b7accb4fea29"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 2.6,
+ "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 2.6,
+ "vectorString": "CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4295.json b/2021/4xxx/CVE-2021-4295.json
new file mode 100644
index 000000000000..4c0ca340cc94
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4295.json
@@ -0,0 +1,230 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4295",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic was found in ONC code-validator-api up to 1.0.30. This vulnerability affects the function vocabularyValidationConfigurations of the file src/main/java/org/sitenv/vocabularies/configuration/CodeValidatorApiConfiguration.java of the component XML Handler. The manipulation leads to xml external entity reference. Upgrading to version 1.0.31 is able to address this issue. The name of the patch is fbd8ea121755a2d3d116b13f235bc8b61d8449af. It is recommended to upgrade the affected component. VDB-217018 is the identifier assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "In ONC code-validator-api bis 1.0.30 wurde eine Schwachstelle entdeckt. Sie wurde als problematisch eingestuft. Dabei geht es um die Funktion vocabularyValidationConfigurations der Datei src/main/java/org/sitenv/vocabularies/configuration/CodeValidatorApiConfiguration.java der Komponente XML Handler. Durch Beeinflussen mit unbekannten Daten kann eine xml external entity reference-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 1.0.31 vermag dieses Problem zu l\u00f6sen. Der Patch wird als fbd8ea121755a2d3d116b13f235bc8b61d8449af bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-611 XML External Entity Reference",
+ "cweId": "CWE-611"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "ONC",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "code-validator-api",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.0.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.5",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.6",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.7",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.8",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.9",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.10",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.11",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.12",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.13",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.14",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.15",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.16",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.17",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.18",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.19",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.20",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.21",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.22",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.23",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.24",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.25",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.26",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.27",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.28",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.29",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.0.30",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217018",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217018"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217018",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217018"
+ },
+ {
+ "url": "https://github.com/onc-healthit/code-validator-api/pull/97",
+ "refsource": "MISC",
+ "name": "https://github.com/onc-healthit/code-validator-api/pull/97"
+ },
+ {
+ "url": "https://github.com/onc-healthit/code-validator-api/commit/fbd8ea121755a2d3d116b13f235bc8b61d8449af",
+ "refsource": "MISC",
+ "name": "https://github.com/onc-healthit/code-validator-api/commit/fbd8ea121755a2d3d116b13f235bc8b61d8449af"
+ },
+ {
+ "url": "https://github.com/onc-healthit/code-validator-api/releases/tag/1.0.31",
+ "refsource": "MISC",
+ "name": "https://github.com/onc-healthit/code-validator-api/releases/tag/1.0.31"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4296.json b/2021/4xxx/CVE-2021-4296.json
new file mode 100644
index 000000000000..eee78e260c02
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4296.json
@@ -0,0 +1,105 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4296",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as problematic, has been found in w3c Unicorn. This issue affects the function ValidatorNuMessage of the file src/org/w3c/unicorn/response/impl/ValidatorNuMessage.java. The manipulation of the argument message leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 51f75c31f7fc33859a9a571311c67ae4e95d9c68. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217019."
+ },
+ {
+ "lang": "deu",
+ "value": "Eine Schwachstelle wurde in w3c Unicorn entdeckt. Sie wurde als problematisch eingestuft. Hierbei geht es um die Funktion ValidatorNuMessage der Datei src/org/w3c/unicorn/response/impl/ValidatorNuMessage.java. Dank der Manipulation des Arguments message mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Patch wird als 51f75c31f7fc33859a9a571311c67ae4e95d9c68 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "w3c",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Unicorn",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217019",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217019"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217019",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217019"
+ },
+ {
+ "url": "https://github.com/w3c/Unicorn/pull/212",
+ "refsource": "MISC",
+ "name": "https://github.com/w3c/Unicorn/pull/212"
+ },
+ {
+ "url": "https://github.com/w3c/Unicorn/commit/51f75c31f7fc33859a9a571311c67ae4e95d9c68",
+ "refsource": "MISC",
+ "name": "https://github.com/w3c/Unicorn/commit/51f75c31f7fc33859a9a571311c67ae4e95d9c68"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4297.json b/2021/4xxx/CVE-2021-4297.json
new file mode 100644
index 000000000000..dd350d8e6cdc
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4297.json
@@ -0,0 +1,126 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4297",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability has been found in trampgeek jobe up to 1.6.4 and classified as problematic. This vulnerability affects the function runs_post of the file application/controllers/Restapi.php. The manipulation of the argument sourcefilename leads to an unknown weakness. Upgrading to version 1.6.5 is able to address this issue. The name of the patch is 694da5013dbecc8d30dd83e2a83e78faadf93771. It is recommended to upgrade the affected component. VDB-217174 is the identifier assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "In trampgeek jobe bis 1.6.4 wurde eine problematische Schwachstelle gefunden. Hierbei betrifft es die Funktion runs_post der Datei application/controllers/Restapi.php. Dank Manipulation des Arguments sourcefilename mit unbekannten Daten kann eine unbekannte Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 1.6.5 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 694da5013dbecc8d30dd83e2a83e78faadf93771 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Privilege Escalation"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "trampgeek",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "jobe",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.6.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.6.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.6.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.6.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.6.4",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217174",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217174"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217174",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217174"
+ },
+ {
+ "url": "https://github.com/trampgeek/jobe/issues/46",
+ "refsource": "MISC",
+ "name": "https://github.com/trampgeek/jobe/issues/46"
+ },
+ {
+ "url": "https://github.com/trampgeek/jobe/commit/694da5013dbecc8d30dd83e2a83e78faadf93771",
+ "refsource": "MISC",
+ "name": "https://github.com/trampgeek/jobe/commit/694da5013dbecc8d30dd83e2a83e78faadf93771"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 4.9,
+ "vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4298.json b/2021/4xxx/CVE-2021-4298.json
new file mode 100644
index 000000000000..8ea42707b7ce
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4298.json
@@ -0,0 +1,111 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4298",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as critical has been found in Hesburgh Libraries of Notre Dame Sipity. This affects the function SearchCriteriaForWorksParameter of the file app/parameters/sipity/parameters/search_criteria_for_works_parameter.rb. The manipulation leads to sql injection. Upgrading to version 2021.8 is able to address this issue. The name of the patch is d1704c7363b899ffce65be03a796a0ee5fdbfbdc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217179."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine Schwachstelle in Hesburgh Libraries of Notre Dame Sipity entdeckt. Sie wurde als kritisch eingestuft. Betroffen hiervon ist die Funktion SearchCriteriaForWorksParameter der Datei app/parameters/sipity/parameters/search_criteria_for_works_parameter.rb. Mittels Manipulieren mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 2021.8 vermag dieses Problem zu l\u00f6sen. Der Patch wird als d1704c7363b899ffce65be03a796a0ee5fdbfbdc bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-89 SQL Injection",
+ "cweId": "CWE-89"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Hesburgh Libraries of Notre Dame",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Sipity",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217179",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217179"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217179",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217179"
+ },
+ {
+ "url": "https://github.com/ndlib/sipity/commit/d1704c7363b899ffce65be03a796a0ee5fdbfbdc",
+ "refsource": "MISC",
+ "name": "https://github.com/ndlib/sipity/commit/d1704c7363b899ffce65be03a796a0ee5fdbfbdc"
+ },
+ {
+ "url": "https://github.com/ndlib/sipity/releases/tag/v2021.8",
+ "refsource": "MISC",
+ "name": "https://github.com/ndlib/sipity/releases/tag/v2021.8"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 5.2,
+ "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4299.json b/2021/4xxx/CVE-2021-4299.json
new file mode 100644
index 000000000000..65b0c34918f4
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4299.json
@@ -0,0 +1,139 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4299",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/naturalSort.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to version 0.12.8 is able to address this issue. The name of the patch is 9cac4c298ee92c1695b0695951f1488884a7ca73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217180."
+ },
+ {
+ "lang": "deu",
+ "value": "In cronvel string-kit bis 0.12.7 wurde eine Schwachstelle entdeckt. Sie wurde als problematisch eingestuft. Es geht um die Funktion naturalSort der Datei lib/naturalSort.js. Durch das Manipulieren mit unbekannten Daten kann eine inefficient regular expression complexity-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Ein Aktualisieren auf die Version 0.12.8 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 9cac4c298ee92c1695b0695951f1488884a7ca73 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-1333 Inefficient Regular Expression Complexity",
+ "cweId": "CWE-1333"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "cronvel",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "string-kit",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "0.12.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.12.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.12.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.12.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.12.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.12.5",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.12.6",
+ "version_affected": "="
+ },
+ {
+ "version_value": "0.12.7",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217180",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217180"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217180",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217180"
+ },
+ {
+ "url": "https://github.com/cronvel/string-kit/commit/9cac4c298ee92c1695b0695951f1488884a7ca73",
+ "refsource": "MISC",
+ "name": "https://github.com/cronvel/string-kit/commit/9cac4c298ee92c1695b0695951f1488884a7ca73"
+ },
+ {
+ "url": "https://github.com/cronvel/string-kit/releases/tag/v0.12.8",
+ "refsource": "MISC",
+ "name": "https://github.com/cronvel/string-kit/releases/tag/v0.12.8"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 4.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 4.3,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 4,
+ "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4300.json b/2021/4xxx/CVE-2021-4300.json
new file mode 100644
index 000000000000..6273a6a1059c
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4300.json
@@ -0,0 +1,111 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4300",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability has been found in ghostlander Halcyon and classified as critical. Affected by this vulnerability is the function CBlock::AddToBlockIndex of the file src/main.cpp of the component Block Verification. The manipulation leads to improper access controls. The attack can be launched remotely. Upgrading to version 1.1.1.0-hal is able to address this issue. The name of the patch is 0675b25ae9cc10b5fdc8ea3a32c642979762d45e. It is recommended to upgrade the affected component. The identifier VDB-217417 was assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "In ghostlander Halcyon wurde eine Schwachstelle gefunden. Sie wurde als kritisch eingestuft. Betroffen ist die Funktion CBlock::AddToBlockIndex der Datei src/main.cpp der Komponente Block Verification. Mit der Manipulation mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Ein Aktualisieren auf die Version 1.1.1.0-hal vermag dieses Problem zu l\u00f6sen. Der Patch wird als 0675b25ae9cc10b5fdc8ea3a32c642979762d45e bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-284 Improper Access Controls",
+ "cweId": "CWE-284"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "ghostlander",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Halcyon",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217417",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217417"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217417",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217417"
+ },
+ {
+ "url": "https://github.com/ghostlander/Halcyon/commit/0675b25ae9cc10b5fdc8ea3a32c642979762d45e",
+ "refsource": "MISC",
+ "name": "https://github.com/ghostlander/Halcyon/commit/0675b25ae9cc10b5fdc8ea3a32c642979762d45e"
+ },
+ {
+ "url": "https://github.com/ghostlander/Halcyon/releases/tag/v1.1.1.0-hal",
+ "refsource": "MISC",
+ "name": "https://github.com/ghostlander/Halcyon/releases/tag/v1.1.1.0-hal"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 6.5,
+ "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4301.json b/2021/4xxx/CVE-2021-4301.json
new file mode 100644
index 000000000000..e33bb0f50709
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4301.json
@@ -0,0 +1,215 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4301",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in slackero phpwcms up to 1.9.26 and classified as critical. Affected by this issue is some unknown functionality. The manipulation of the argument $phpwcms['db_prepend'] leads to sql injection. The attack may be launched remotely. Upgrading to version 1.9.27 is able to address this issue. The name of the patch is 77dafb6a8cc1015f0777daeb5792f43beef77a9d. It is recommended to upgrade the affected component. VDB-217418 is the identifier assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Eine Schwachstelle wurde in slackero phpwcms bis 1.9.26 gefunden. Sie wurde als kritisch eingestuft. Betroffen davon ist ein unbekannter Prozess. Durch die Manipulation des Arguments $phpwcms['db_prepend'] mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Ein Aktualisieren auf die Version 1.9.27 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 77dafb6a8cc1015f0777daeb5792f43beef77a9d bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-89 SQL Injection",
+ "cweId": "CWE-89"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "slackero",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "phpwcms",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.9.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.5",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.6",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.7",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.8",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.9",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.10",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.11",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.12",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.13",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.14",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.15",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.16",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.17",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.18",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.19",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.20",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.21",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.22",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.23",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.24",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.25",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.26",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/slackero/phpwcms/releases/tag/v1.9.27",
+ "refsource": "MISC",
+ "name": "https://github.com/slackero/phpwcms/releases/tag/v1.9.27"
+ },
+ {
+ "url": "https://vuldb.com/?id.217418",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217418"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217418",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217418"
+ },
+ {
+ "url": "https://github.com/slackero/phpwcms/commit/77dafb6a8cc1015f0777daeb5792f43beef77a9d",
+ "refsource": "MISC",
+ "name": "https://github.com/slackero/phpwcms/commit/77dafb6a8cc1015f0777daeb5792f43beef77a9d"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 6.5,
+ "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4302.json b/2021/4xxx/CVE-2021-4302.json
new file mode 100644
index 000000000000..2eb86a80ee73
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4302.json
@@ -0,0 +1,215 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4302",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.9.27 is able to address this issue. The name of the patch is b39db9c7ad3800f319195ff0e26a0981395b1c54. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217419."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine Schwachstelle in slackero phpwcms bis 1.9.26 ausgemacht. Sie wurde als problematisch eingestuft. Betroffen hiervon ist ein unbekannter Ablauf der Komponente SVG File Handler. Durch Manipulation mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Ein Aktualisieren auf die Version 1.9.27 vermag dieses Problem zu l\u00f6sen. Der Patch wird als b39db9c7ad3800f319195ff0e26a0981395b1c54 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "slackero",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "phpwcms",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.9.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.5",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.6",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.7",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.8",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.9",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.10",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.11",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.12",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.13",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.14",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.15",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.16",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.17",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.18",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.19",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.20",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.21",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.22",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.23",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.24",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.25",
+ "version_affected": "="
+ },
+ {
+ "version_value": "1.9.26",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217419",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217419"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217419",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217419"
+ },
+ {
+ "url": "https://github.com/slackero/phpwcms/commit/b39db9c7ad3800f319195ff0e26a0981395b1c54",
+ "refsource": "MISC",
+ "name": "https://github.com/slackero/phpwcms/commit/b39db9c7ad3800f319195ff0e26a0981395b1c54"
+ },
+ {
+ "url": "https://github.com/slackero/phpwcms/releases/tag/v1.9.27",
+ "refsource": "MISC",
+ "name": "https://github.com/slackero/phpwcms/releases/tag/v1.9.27"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 4,
+ "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4303.json b/2021/4xxx/CVE-2021-4303.json
new file mode 100644
index 000000000000..1346640ec258
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4303.json
@@ -0,0 +1,111 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4303",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as problematic, has been found in shannah Xataface up to 2.x. Affected by this issue is the function testftp of the file install/install_form.js.php of the component Installer. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 94143a4299e386f33bf582139cd4702571d93bde. It is recommended to upgrade the affected component. VDB-217442 is the identifier assigned to this vulnerability. NOTE: Installer is disabled by default."
+ },
+ {
+ "lang": "deu",
+ "value": "Eine problematische Schwachstelle wurde in shannah Xataface bis 2.x entdeckt. Dies betrifft die Funktion testftp der Datei install/install_form.js.php der Komponente Installer. Mittels dem Manipulieren mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Ein Aktualisieren auf die Version 3.0.0 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 94143a4299e386f33bf582139cd4702571d93bde bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "shannah",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Xataface",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "2.x",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217442",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217442"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217442",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217442"
+ },
+ {
+ "url": "https://github.com/shannah/xataface/commit/94143a4299e386f33bf582139cd4702571d93bde",
+ "refsource": "MISC",
+ "name": "https://github.com/shannah/xataface/commit/94143a4299e386f33bf582139cd4702571d93bde"
+ },
+ {
+ "url": "https://github.com/shannah/xataface/releases/tag/3.0.0",
+ "refsource": "MISC",
+ "name": "https://github.com/shannah/xataface/releases/tag/3.0.0"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 2,
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 2,
+ "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 1.7,
+ "vectorString": "AV:N/AC:H/Au:M/C:N/I:P/A:N",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4304.json b/2021/4xxx/CVE-2021-4304.json
new file mode 100644
index 000000000000..59ec6bc77ff1
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4304.json
@@ -0,0 +1,106 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4304",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in eprintsug ulcc-core. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file cgi/toolbox/toolbox. The manipulation of the argument password leads to command injection. The attack can be launched remotely. The name of the patch is 811edaae81eb044891594f00062a828f51b22cb1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217447."
+ },
+ {
+ "lang": "deu",
+ "value": "In eprintsug ulcc-core wurde eine kritische Schwachstelle ausgemacht. Betroffen ist eine unbekannte Verarbeitung der Datei cgi/toolbox/toolbox. Durch Beeinflussen des Arguments password mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Patch wird als 811edaae81eb044891594f00062a828f51b22cb1 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-77 Command Injection",
+ "cweId": "CWE-77"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "eprintsug",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "ulcc-core",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217447",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217447"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217447",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217447"
+ },
+ {
+ "url": "https://github.com/eprintsug/ulcc-core/commit/811edaae81eb044891594f00062a828f51b22cb1",
+ "refsource": "MISC",
+ "name": "https://github.com/eprintsug/ulcc-core/commit/811edaae81eb044891594f00062a828f51b22cb1"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 6.5,
+ "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4305.json b/2021/4xxx/CVE-2021-4305.json
new file mode 100644
index 000000000000..73b30a07a076
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4305.json
@@ -0,0 +1,111 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4305",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in Woorank robots-txt-guard. It has been rated as problematic. Affected by this issue is the function makePathPattern of the file lib/patterns.js. The manipulation of the argument pattern leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. The name of the patch is c03827cd2f9933619c23894ce7c98401ea824020. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217448."
+ },
+ {
+ "lang": "deu",
+ "value": "Eine problematische Schwachstelle wurde in Woorank robots-txt-guard ausgemacht. Betroffen davon ist die Funktion makePathPattern der Datei lib/patterns.js. Dank der Manipulation des Arguments pattern mit unbekannten Daten kann eine inefficient regular expression complexity-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Der Patch wird als c03827cd2f9933619c23894ce7c98401ea824020 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-1333 Inefficient Regular Expression Complexity",
+ "cweId": "CWE-1333"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Woorank",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "robots-txt-guard",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217448",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217448"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217448",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217448"
+ },
+ {
+ "url": "https://github.com/Woorank/robots-txt-guard/pull/4",
+ "refsource": "MISC",
+ "name": "https://github.com/Woorank/robots-txt-guard/pull/4"
+ },
+ {
+ "url": "https://github.com/Woorank/robots-txt-guard/commit/c03827cd2f9933619c23894ce7c98401ea824020",
+ "refsource": "MISC",
+ "name": "https://github.com/Woorank/robots-txt-guard/commit/c03827cd2f9933619c23894ce7c98401ea824020"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 2.3,
+ "vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4306.json b/2021/4xxx/CVE-2021-4306.json
new file mode 100644
index 000000000000..83d1d52ee9e3
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4306.json
@@ -0,0 +1,139 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4306",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic has been found in cronvel terminal-kit up to 2.1.7. Affected is an unknown function. The manipulation leads to inefficient regular expression complexity. Upgrading to version 2.1.8 is able to address this issue. The name of the patch is a2e446cc3927b559d0281683feb9b821e83b758c. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217620."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine problematische Schwachstelle in cronvel terminal-kit bis 2.1.7 entdeckt. Es betrifft eine unbekannte Funktion. Durch das Manipulieren mit unbekannten Daten kann eine inefficient regular expression complexity-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 2.1.8 vermag dieses Problem zu l\u00f6sen. Der Patch wird als a2e446cc3927b559d0281683feb9b821e83b758c bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-1333 Inefficient Regular Expression Complexity",
+ "cweId": "CWE-1333"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "cronvel",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "terminal-kit",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "2.1.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.1.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.1.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.1.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.1.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.1.5",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.1.6",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.1.7",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217620",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217620"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217620",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217620"
+ },
+ {
+ "url": "https://github.com/cronvel/terminal-kit/commit/a2e446cc3927b559d0281683feb9b821e83b758c",
+ "refsource": "MISC",
+ "name": "https://github.com/cronvel/terminal-kit/commit/a2e446cc3927b559d0281683feb9b821e83b758c"
+ },
+ {
+ "url": "https://github.com/cronvel/terminal-kit/releases/tag/v2.1.8",
+ "refsource": "MISC",
+ "name": "https://github.com/cronvel/terminal-kit/releases/tag/v2.1.8"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 2.3,
+ "vectorString": "AV:A/AC:M/Au:S/C:N/I:N/A:P",
+ "baseSeverity": "LOW"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4307.json b/2021/4xxx/CVE-2021-4307.json
new file mode 100644
index 000000000000..f90926f8adc0
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4307.json
@@ -0,0 +1,140 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4307",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in Yomguithereal Baobab up to 2.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be launched remotely. Upgrading to version 2.6.1 is able to address this issue. The name of the patch is c56639532a923d9a1600fb863ec7551b188b5d19. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217627."
+ },
+ {
+ "lang": "deu",
+ "value": "In Yomguithereal Baobab bis 2.6.0 wurde eine kritische Schwachstelle ausgemacht. Betroffen ist eine unbekannte Verarbeitung. Durch die Manipulation mit unbekannten Daten kann eine improperly controlled modification of object prototype attributes ('prototype pollution')-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Ein Aktualisieren auf die Version 2.6.1 vermag dieses Problem zu l\u00f6sen. Der Patch wird als c56639532a923d9a1600fb863ec7551b188b5d19 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')",
+ "cweId": "CWE-1321"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Yomguithereal",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Baobab",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "2.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.2",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.5",
+ "version_affected": "="
+ },
+ {
+ "version_value": "2.6",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217627",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217627"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217627",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217627"
+ },
+ {
+ "url": "https://github.com/Yomguithereal/baobab/pull/511",
+ "refsource": "MISC",
+ "name": "https://github.com/Yomguithereal/baobab/pull/511"
+ },
+ {
+ "url": "https://github.com/Yomguithereal/baobab/commit/c56639532a923d9a1600fb863ec7551b188b5d19",
+ "refsource": "MISC",
+ "name": "https://github.com/Yomguithereal/baobab/commit/c56639532a923d9a1600fb863ec7551b188b5d19"
+ },
+ {
+ "url": "https://github.com/Yomguithereal/baobab/releases/tag/2.6.1",
+ "refsource": "MISC",
+ "name": "https://github.com/Yomguithereal/baobab/releases/tag/2.6.1"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 6.5,
+ "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4308.json b/2021/4xxx/CVE-2021-4308.json
new file mode 100644
index 000000000000..df1dd1fcfbc6
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4308.json
@@ -0,0 +1,120 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4308",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in WebPA up to 3.1.1. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. Upgrading to version 3.1.2 is able to address this issue. The name of the patch is 8836c4f549181e885a68e0e7ca561fdbcbd04bf0. It is recommended to upgrade the affected component. The identifier VDB-217637 was assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Eine Schwachstelle wurde in WebPA bis 3.1.1 ausgemacht. Sie wurde als kritisch eingestuft. Dies betrifft einen unbekannten Teil. Mit der Manipulation mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Ein Aktualisieren auf die Version 3.1.2 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 8836c4f549181e885a68e0e7ca561fdbcbd04bf0 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-89 SQL Injection",
+ "cweId": "CWE-89"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "WebPA",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "3.1.0",
+ "version_affected": "="
+ },
+ {
+ "version_value": "3.1.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217637",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217637"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217637",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217637"
+ },
+ {
+ "url": "https://github.com/WebPA/WebPA/pull/87",
+ "refsource": "MISC",
+ "name": "https://github.com/WebPA/WebPA/pull/87"
+ },
+ {
+ "url": "https://github.com/WebPA/WebPA/commit/8836c4f549181e885a68e0e7ca561fdbcbd04bf0",
+ "refsource": "MISC",
+ "name": "https://github.com/WebPA/WebPA/commit/8836c4f549181e885a68e0e7ca561fdbcbd04bf0"
+ },
+ {
+ "url": "https://github.com/WebPA/WebPA/releases/tag/v3.1.2",
+ "refsource": "MISC",
+ "name": "https://github.com/WebPA/WebPA/releases/tag/v3.1.2"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 5.2,
+ "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4309.json b/2021/4xxx/CVE-2021-4309.json
new file mode 100644
index 000000000000..129421582191
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4309.json
@@ -0,0 +1,106 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4309",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability, which was classified as problematic, has been found in 01-Scripts 01ACP. This issue affects some unknown processing. The manipulation of the argument $_SERVER['SCRIPT_NAME'] leads to cross site scripting. The attack may be initiated remotely. The name of the patch is a16eb7da46ed22bc61067c212635394f2571d3c4. It is recommended to apply a patch to fix this issue. The identifier VDB-217649 was assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Eine Schwachstelle wurde in 01-Scripts 01ACP entdeckt. Sie wurde als problematisch eingestuft. Hierbei geht es um eine nicht exakt ausgemachte Funktion. Durch die Manipulation des Arguments $_SERVER['SCRIPT_NAME'] mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Patch wird als a16eb7da46ed22bc61067c212635394f2571d3c4 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "01-Scripts",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "01ACP",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217649",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217649"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217649",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217649"
+ },
+ {
+ "url": "https://github.com/01-Scripts/01ACP/commit/a16eb7da46ed22bc61067c212635394f2571d3c4",
+ "refsource": "MISC",
+ "name": "https://github.com/01-Scripts/01ACP/commit/a16eb7da46ed22bc61067c212635394f2571d3c4"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 4,
+ "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4310.json b/2021/4xxx/CVE-2021-4310.json
new file mode 100644
index 000000000000..252494ced3be
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4310.json
@@ -0,0 +1,106 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4310",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was found in 01-Scripts 01-Artikelsystem. It has been classified as problematic. Affected is an unknown function of the file 01article.php. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is ae849b347a58c2cb1be38d04bbe56fc883d5d84a. It is recommended to apply a patch to fix this issue. VDB-217662 is the identifier assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine problematische Schwachstelle in 01-Scripts 01-Artikelsystem ausgemacht. Es geht dabei um eine nicht klar definierte Funktion der Datei 01article.php. Mittels dem Manipulieren des Arguments $_SERVER['PHP_SELF'] mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Patch wird als ae849b347a58c2cb1be38d04bbe56fc883d5d84a bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "01-Scripts",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "01-Artikelsystem",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217662",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217662"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217662",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217662"
+ },
+ {
+ "url": "https://github.com/01-Scripts/01-Artikelsystem/commit/ae849b347a58c2cb1be38d04bbe56fc883d5d84a",
+ "refsource": "MISC",
+ "name": "https://github.com/01-Scripts/01-Artikelsystem/commit/ae849b347a58c2cb1be38d04bbe56fc883d5d84a"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 3.5,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "LOW"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 4,
+ "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2021/4xxx/CVE-2021-4311.json b/2021/4xxx/CVE-2021-4311.json
new file mode 100644
index 000000000000..adb8c0f15a5f
--- /dev/null
+++ b/2021/4xxx/CVE-2021-4311.json
@@ -0,0 +1,111 @@
+{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "CVE_data_meta": {
+ "ID": "CVE-2021-4311",
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The manipulation leads to xml external entity reference. The name of the patch is 31d442b9fb1d518128fd18f6e4d54e06c3d67793. It is recommended to apply a patch to fix this issue. VDB-217666 is the identifier assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "In Talend Open Studio for MDM wurde eine Schwachstelle entdeckt. Sie wurde als problematisch eingestuft. Das betrifft eine unbekannte Funktionalit\u00e4t der Komponente XML Handler. Durch das Beeinflussen mit unbekannten Daten kann eine xml external entity reference-Schwachstelle ausgenutzt werden. Der Patch wird als 31d442b9fb1d518128fd18f6e4d54e06c3d67793 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-611 XML External Entity Reference",
+ "cweId": "CWE-611"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Talend",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Open Studio for MDM",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "n/a",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.217666",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.217666"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.217666",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.217666"
+ },
+ {
+ "url": "https://github.com/Talend/tmdm-server-se/pull/1420",
+ "refsource": "MISC",
+ "name": "https://github.com/Talend/tmdm-server-se/pull/1420"
+ },
+ {
+ "url": "https://github.com/Talend/tmdm-server-se/commit/31d442b9fb1d518128fd18f6e4d54e06c3d67793",
+ "refsource": "MISC",
+ "name": "https://github.com/Talend/tmdm-server-se/commit/31d442b9fb1d518128fd18f6e4d54e06c3d67793"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "VulDB GitHub Commit Analyzer"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 5.5,
+ "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 4.9,
+ "vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P",
+ "baseSeverity": "MEDIUM"
+ }
+ ]
+ }
+}
\ No newline at end of file
diff --git a/2022/0xxx/CVE-2022-0259.json b/2022/0xxx/CVE-2022-0259.json
index 688fde411142..4a93443a3203 100644
--- a/2022/0xxx/CVE-2022-0259.json
+++ b/2022/0xxx/CVE-2022-0259.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2022-0259",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2022. Notes: none."
}
]
}
diff --git a/2022/0xxx/CVE-2022-0337.json b/2022/0xxx/CVE-2022-0337.json
index db79b747fab4..f26670b4e518 100644
--- a/2022/0xxx/CVE-2022-0337.json
+++ b/2022/0xxx/CVE-2022-0337.json
@@ -1,17 +1,67 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-0337",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "chrome-cve-admin@google.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. (Chrome security severity: High)"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Inappropriate implementation"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Google",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Chrome",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "97.0.4692.71",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html",
+ "refsource": "MISC",
+ "name": "https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html"
+ },
+ {
+ "url": "https://crbug.com/1247389",
+ "refsource": "MISC",
+ "name": "https://crbug.com/1247389"
}
]
}
diff --git a/2022/0xxx/CVE-2022-0511.json b/2022/0xxx/CVE-2022-0511.json
index b301b5302dd5..e8500cc37372 100644
--- a/2022/0xxx/CVE-2022-0511.json
+++ b/2022/0xxx/CVE-2022-0511.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-0511",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "97",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Memory safety bugs fixed in Firefox 97"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-04/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-04/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1713579%2C1735448%2C1743821%2C1746313%2C1746314%2C1746316%2C1746321%2C1746322%2C1746323%2C1746412%2C1746430%2C1746451%2C1746488%2C1746875%2C1746898%2C1746905%2C1746907%2C1746917%2C1747128%2C1747137%2C1747331%2C1747346%2C1747439%2C1747457%2C1747870%2C1749051%2C1749274%2C1749831",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1713579%2C1735448%2C1743821%2C1746313%2C1746314%2C1746316%2C1746321%2C1746322%2C1746323%2C1746412%2C1746430%2C1746451%2C1746488%2C1746875%2C1746898%2C1746905%2C1746907%2C1746917%2C1747128%2C1747137%2C1747331%2C1747346%2C1747439%2C1747457%2C1747870%2C1749051%2C1749274%2C1749831"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Mozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan Herrera, Lars T Hansen, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 97."
}
]
}
diff --git a/2022/0xxx/CVE-2022-0517.json b/2022/0xxx/CVE-2022-0517.json
index 4a54ca0d936e..a2902b668e6d 100644
--- a/2022/0xxx/CVE-2022-0517.json
+++ b/2022/0xxx/CVE-2022-0517.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-0517",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Mozilla VPN",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "2.7.1",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Local privilege escalation vis uncontrolled OpenSSL search path"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-08/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-08/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1752291",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1752291"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage this to launch arbitrary code with SYSTEM privilege. This vulnerability affects Mozilla VPN < 2.7.1."
}
]
}
diff --git a/2022/0xxx/CVE-2022-0553.json b/2022/0xxx/CVE-2022-0553.json
index 5fec3a8398f5..0d7e45f2fcae 100644
--- a/2022/0xxx/CVE-2022-0553.json
+++ b/2022/0xxx/CVE-2022-0553.json
@@ -4,15 +4,82 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-0553",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "vulnerabilities@zephyrproject.org",
+ "DATE_PUBLIC": "2022-05-12T00:00:00.000Z",
+ "STATE": "PUBLIC",
+ "TITLE": "Possible to retrieve uncrypted firmware image"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "zephyrproject-rtos",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "zephyr",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<=",
+ "version_value": "v3.0"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrieved easily."
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
+ "attackVector": "Adjacent",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "NONE",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "LOW",
+ "availabilityImpact": "LOW",
+ "baseSeverity": "MODERATE"
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)"
+ }
+ ]
}
]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wrj2-9vj9-rrcp",
+ "refsource": "MISC",
+ "name": "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wrj2-9vj9-rrcp"
+ }
+ ]
+ },
+ "source": {
+ "defect": [
+ "https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wrj2-9vj9-rrcp"
+ ]
}
-}
\ No newline at end of file
+}
diff --git a/2022/0xxx/CVE-2022-0564.json b/2022/0xxx/CVE-2022-0564.json
index 07d9fbf9a7ae..e8388629fa80 100644
--- a/2022/0xxx/CVE-2022-0564.json
+++ b/2022/0xxx/CVE-2022-0564.json
@@ -55,19 +55,19 @@
"references": {
"reference_data": [
{
- "url": "https://csirt.divd.nl/cases/DIVD-2021-00021",
+ "url": "https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531",
"refsource": "MISC",
- "name": "https://csirt.divd.nl/cases/DIVD-2021-00021"
+ "name": "https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531"
},
{
- "url": "https://csirt.divd.nl/cves/CVE-2022-0564",
+ "url": "https://csirt.divd.nl/DIVD-2021-00021/",
"refsource": "MISC",
- "name": "https://csirt.divd.nl/cves/CVE-2022-0564"
+ "name": "https://csirt.divd.nl/DIVD-2021-00021/"
},
{
- "url": "https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531",
+ "url": "https://csirt.divd.nl/CVE-2022-0564/",
"refsource": "MISC",
- "name": "https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531"
+ "name": "https://csirt.divd.nl/CVE-2022-0564/"
}
]
},
@@ -81,13 +81,27 @@
"work_around": [
{
"lang": "en",
- "value": "Disable internet-facing NTLM endpoints, e.g. internal_windows_authentication, to avoid domain enumeration."
+ "value": "Disable internet-facing NTLM endpoints, e.g. internal_windows_authentication, to avoid domain enumeration.\n\n",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Disable internet-facing NTLM endpoints, e.g. internal_windows_authentication, to avoid domain enumeration.
"
+ }
+ ]
}
],
"solution": [
{
"lang": "en",
- "value": "Update Qlik Sense Enterprise on Windows to version 14.44.0 or higher."
+ "value": "Update Qlik Sense Enterprise on Windows to version 14.44.0 or higher.\n\n",
+ "supportingMedia": [
+ {
+ "type": "text/html",
+ "base64": false,
+ "value": "Update Qlik Sense Enterprise on Windows to version 14.44.0 or higher.
"
+ }
+ ]
}
],
"credits": [
@@ -99,18 +113,18 @@
"impact": {
"cvss": [
{
- "attackComplexity": "LOW",
+ "version": "3.1",
"attackVector": "NETWORK",
- "availabilityImpact": "NONE",
- "baseScore": 5.3,
- "baseSeverity": "MEDIUM",
- "confidentialityImpact": "LOW",
- "integrityImpact": "NONE",
+ "attackComplexity": "LOW",
"privilegesRequired": "NONE",
- "scope": "UNCHANGED",
"userInteraction": "NONE",
- "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
- "version": "3.1"
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "NONE",
+ "availabilityImpact": "NONE",
+ "baseSeverity": "MEDIUM",
+ "baseScore": 5.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
]
}
diff --git a/2022/0xxx/CVE-2022-0566.json b/2022/0xxx/CVE-2022-0566.json
index 5bb707791f91..ec9b3a5b09ee 100644
--- a/2022/0xxx/CVE-2022-0566.json
+++ b/2022/0xxx/CVE-2022-0566.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-0566",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6.1",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Crafted email could trigger an out-of-bounds write"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-07/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-07/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1753094",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1753094"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1."
}
]
}
diff --git a/2022/0xxx/CVE-2022-0668.json b/2022/0xxx/CVE-2022-0668.json
index c099d2b493e6..6f7f19e19c23 100644
--- a/2022/0xxx/CVE-2022-0668.json
+++ b/2022/0xxx/CVE-2022-0668.json
@@ -1,18 +1,87 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
- "CVE_data_meta": {
- "ID": "CVE-2022-0668",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
- },
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
- }
+ "data_type": "CVE",
+ "data_format": "MITRE",
+ "data_version": "4.0",
+ "CVE_data_meta": {
+ "ID": "CVE-2022-0668",
+ "ASSIGNER": "security@jfrog.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "JFrog",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "JFrog Artifactory",
+ "version": {
+ "version_data": [
+ {
+ "version_name": "JFrog Artifactory versions before 7.x",
+ "version_affected": "<",
+ "version_value": "7.37.13",
+ "platform": ""
+ },
+ {
+ "version_name": "JFrog Artifactory versions before 6.x",
+ "version_affected": "<",
+ "version_value": "6.23.41",
+ "platform": ""
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-274 Improper Handling of Insufficient Privileges"
+ }
]
+ }
+ ]
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated user."
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "url": "https://www.jfrog.com/confluence/display/JFROG/CVE-2022-0668%3A+Artifactory+Authentication+Bypass",
+ "name": "https://www.jfrog.com/confluence/display/JFROG/CVE-2022-0668%3A+Artifactory+Authentication+Bypass"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": {
+ "version": "3.1",
+ "attackVector": "NETWORK",
+ "attackComplexity": "LOW",
+ "privilegesRequired": "NONE",
+ "userInteraction": "NONE",
+ "scope": "UNCHANGED",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "NONE",
+ "availabilityImpact": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+ "baseScore": 5.3,
+ "baseSeverity": "MEDIUM"
}
-}
\ No newline at end of file
+ }
+}
diff --git a/2022/0xxx/CVE-2022-0730.json b/2022/0xxx/CVE-2022-0730.json
index eb2a875a1ec4..9446f20ff7a6 100644
--- a/2022/0xxx/CVE-2022-0730.json
+++ b/2022/0xxx/CVE-2022-0730.json
@@ -73,6 +73,11 @@
"refsource": "DEBIAN",
"name": "DSA-5298",
"url": "https://www.debian.org/security/2022/dsa-5298"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20221231 [SECURITY] [DLA 3252-1] cacti security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html"
}
]
},
diff --git a/2022/0xxx/CVE-2022-0801.json b/2022/0xxx/CVE-2022-0801.json
index b3a1482b35c5..a929307305fc 100644
--- a/2022/0xxx/CVE-2022-0801.json
+++ b/2022/0xxx/CVE-2022-0801.json
@@ -1,17 +1,67 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-0801",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "chrome-cve-admin@google.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Inappropriate implementation in HTML parser in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass XSS preventions via a crafted HTML page. (Chrome security severity: Medium)"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Inappropriate implementation"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Google",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Chrome",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "99.0.4844.51",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.html",
+ "refsource": "MISC",
+ "name": "https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop.html"
+ },
+ {
+ "url": "https://crbug.com/1231037",
+ "refsource": "MISC",
+ "name": "https://crbug.com/1231037"
}
]
}
diff --git a/2022/0xxx/CVE-2022-0843.json b/2022/0xxx/CVE-2022-0843.json
index 0758a17d6302..4c9cd20b1338 100644
--- a/2022/0xxx/CVE-2022-0843.json
+++ b/2022/0xxx/CVE-2022-0843.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-0843",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "98",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Memory safety bugs fixed in Firefox 98"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-10/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-10/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1746523%2C1749062%2C1749164%2C1749214%2C1749610%2C1750032%2C1752100%2C1752405%2C1753612%2C1754508",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1746523%2C1749062%2C1749164%2C1749214%2C1749610%2C1750032%2C1752100%2C1752405%2C1753612%2C1754508"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 97. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 98."
}
]
}
diff --git a/2022/0xxx/CVE-2022-0865.json b/2022/0xxx/CVE-2022-0865.json
index 9e2d8a0fe448..cc43baa46f8a 100644
--- a/2022/0xxx/CVE-2022-0865.json
+++ b/2022/0xxx/CVE-2022-0865.json
@@ -78,6 +78,11 @@
"refsource": "GENTOO",
"name": "GLSA-202210-10",
"url": "https://security.gentoo.org/glsa/202210-10"
+ },
+ {
+ "refsource": "CONFIRM",
+ "name": "https://security.netapp.com/advisory/ntap-20221228-0008/",
+ "url": "https://security.netapp.com/advisory/ntap-20221228-0008/"
}
]
},
diff --git a/2022/0xxx/CVE-2022-0891.json b/2022/0xxx/CVE-2022-0891.json
index ef8c5ea46fd9..b3e86ba9d824 100644
--- a/2022/0xxx/CVE-2022-0891.json
+++ b/2022/0xxx/CVE-2022-0891.json
@@ -83,6 +83,11 @@
"refsource": "GENTOO",
"name": "GLSA-202210-10",
"url": "https://security.gentoo.org/glsa/202210-10"
+ },
+ {
+ "refsource": "CONFIRM",
+ "name": "https://security.netapp.com/advisory/ntap-20221228-0008/",
+ "url": "https://security.netapp.com/advisory/ntap-20221228-0008/"
}
]
},
diff --git a/2022/0xxx/CVE-2022-0918.json b/2022/0xxx/CVE-2022-0918.json
index 928621b29282..8176d375b56c 100644
--- a/2022/0xxx/CVE-2022-0918.json
+++ b/2022/0xxx/CVE-2022-0918.json
@@ -1,12 +1,32 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-0918",
"ASSIGNER": "secalert@redhat.com",
"STATE": "PUBLIC"
},
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, no bind or other authentication is required. The message triggers a segmentation fault that results in slapd crashing."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Uncontrolled Resource Consumption"
+ }
+ ]
+ }
+ ]
+ },
"affects": {
"vendor": {
"vendor_data": [
@@ -19,7 +39,8 @@
"version": {
"version_data": [
{
- "version_value": "1.4"
+ "version_value": "1.4",
+ "version_affected": "="
}
]
}
@@ -30,38 +51,29 @@
]
}
},
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "Uncontrolled Resource Consumption"
- }
- ]
- }
- ]
- },
"references": {
"reference_data": [
{
+ "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2055815",
"refsource": "MISC",
- "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2055815",
- "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2055815"
+ "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2055815"
},
{
+ "url": "https://access.redhat.com/security/cve/CVE-2022-0918",
"refsource": "MISC",
- "name": "https://access.redhat.com/security/cve/CVE-2022-0918",
- "url": "https://access.redhat.com/security/cve/CVE-2022-0918"
- }
- ]
- },
- "description": {
- "description_data": [
+ "name": "https://access.redhat.com/security/cve/CVE-2022-0918"
+ },
{
- "lang": "eng",
- "value": "A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, no bind or other authentication is required. The message triggers a segmentation fault that results in slapd crashing."
+ "url": "https://github.com/389ds/389-ds-base/issues/5242",
+ "refsource": "MISC",
+ "name": "https://github.com/389ds/389-ds-base/issues/5242"
}
]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
}
}
\ No newline at end of file
diff --git a/2022/1xxx/CVE-2022-1056.json b/2022/1xxx/CVE-2022-1056.json
index 4408b665efcc..3ec188cf3feb 100644
--- a/2022/1xxx/CVE-2022-1056.json
+++ b/2022/1xxx/CVE-2022-1056.json
@@ -63,6 +63,11 @@
"refsource": "GENTOO",
"name": "GLSA-202210-10",
"url": "https://security.gentoo.org/glsa/202210-10"
+ },
+ {
+ "refsource": "CONFIRM",
+ "name": "https://security.netapp.com/advisory/ntap-20221228-0008/",
+ "url": "https://security.netapp.com/advisory/ntap-20221228-0008/"
}
]
},
diff --git a/2022/1xxx/CVE-2022-1097.json b/2022/1xxx/CVE-2022-1097.json
index 235ec9f67a1f..6611d358a6dd 100644
--- a/2022/1xxx/CVE-2022-1097.json
+++ b/2022/1xxx/CVE-2022-1097.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-1097",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.8",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "99",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.8",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Use-after-free in NSSToken objects"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-13/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-13/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-14/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-14/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745667",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745667"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "NSSToken objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8."
}
]
}
diff --git a/2022/1xxx/CVE-2022-1101.json b/2022/1xxx/CVE-2022-1101.json
index 7409570f51a3..512b60ac9d53 100644
--- a/2022/1xxx/CVE-2022-1101.json
+++ b/2022/1xxx/CVE-2022-1101.json
@@ -1,17 +1,100 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-1101",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A vulnerability was found in SourceCodester Royale Event Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /royal_event/userregister.php. The manipulation leads to improper authentication. The attack may be initiated remotely. The identifier VDB-195785 was assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Eine Schwachstelle wurde in SourceCodester Royale Event Management System 1.0 ausgemacht. Sie wurde als kritisch eingestuft. Davon betroffen ist unbekannter Code der Datei /royal_event/userregister.php. Durch das Manipulieren mit unbekannten Daten kann eine improper authentication-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-287 Improper Authentication",
+ "cweId": "CWE-287"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "SourceCodester",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Royale Event Management System",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.195785",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.195785"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.195785",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.195785"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "mrempy (VulDB User)"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 7.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "HIGH"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 7.3,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "HIGH"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 7.5,
+ "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
+ "baseSeverity": "HIGH"
}
]
}
diff --git a/2022/1xxx/CVE-2022-1102.json b/2022/1xxx/CVE-2022-1102.json
index 2acafbf92db4..3eaa5e21d966 100644
--- a/2022/1xxx/CVE-2022-1102.json
+++ b/2022/1xxx/CVE-2022-1102.json
@@ -1,17 +1,105 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-1102",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "cna@vuldb.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A vulnerability classified as problematic has been found in SourceCodester Royale Event Management System 1.0. Affected is an unknown function of the file /royal_event/companyprofile.php. The manipulation of the argument companyname/regno/companyaddress/companyemail leads to cross site scripting. It is possible to launch the attack remotely. VDB-195786 is the identifier assigned to this vulnerability."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine problematische Schwachstelle in SourceCodester Royale Event Management System 1.0 entdeckt. Hiervon betroffen ist ein unbekannter Codeblock der Datei /royal_event/companyprofile.php. Durch Manipulieren des Arguments companyname/regno/companyaddress/companyemail mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Cross Site Scripting",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "SourceCodester",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Royale Event Management System",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "1.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://vuldb.com/?id.195786",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?id.195786"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.195786",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.195786"
+ },
+ {
+ "url": "https://www.sourcecodester.com/php/15238/event-management-system-project-php-source-code.html?",
+ "refsource": "MISC",
+ "name": "https://www.sourcecodester.com/php/15238/event-management-system-project-php-source-code.html?"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "mrempy (VulDB User)"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 4.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 4.3,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "2.0",
+ "baseScore": 5,
+ "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2022/1xxx/CVE-2022-1196.json b/2022/1xxx/CVE-2022-1196.json
index 431b434fd2ce..215bfddee251 100644
--- a/2022/1xxx/CVE-2022-1196.json
+++ b/2022/1xxx/CVE-2022-1196.json
@@ -4,14 +4,80 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-1196",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.8",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.8",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Use-after-free after VR Process destruction"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-14/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-14/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1750679",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1750679"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8 and Firefox ESR < 91.8."
}
]
}
diff --git a/2022/1xxx/CVE-2022-1197.json b/2022/1xxx/CVE-2022-1197.json
index 7ea970a38f77..44ab4378e3a4 100644
--- a/2022/1xxx/CVE-2022-1197.json
+++ b/2022/1xxx/CVE-2022-1197.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-1197",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.8",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "OpenPGP revocation information was ignored"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-15/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-15/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1754985",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1754985"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird < 91.8."
}
]
}
diff --git a/2022/1xxx/CVE-2022-1199.json b/2022/1xxx/CVE-2022-1199.json
index 381bad53d1c8..c69537152fd9 100644
--- a/2022/1xxx/CVE-2022-1199.json
+++ b/2022/1xxx/CVE-2022-1199.json
@@ -73,6 +73,11 @@
"refsource": "MISC",
"name": "https://access.redhat.com/security/cve/CVE-2022-1199",
"url": "https://access.redhat.com/security/cve/CVE-2022-1199"
+ },
+ {
+ "refsource": "CONFIRM",
+ "name": "https://security.netapp.com/advisory/ntap-20221228-0006/",
+ "url": "https://security.netapp.com/advisory/ntap-20221228-0006/"
}
]
},
diff --git a/2022/1xxx/CVE-2022-1401.json b/2022/1xxx/CVE-2022-1401.json
index 060381a0d62d..f669947e5a50 100644
--- a/2022/1xxx/CVE-2022-1401.json
+++ b/2022/1xxx/CVE-2022-1401.json
@@ -1,15 +1,38 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "cve-requests@bitdefender.com",
- "DATE_PUBLIC": "2022-08-16T19:00:00.000Z",
"ID": "CVE-2022-1401",
- "STATE": "PUBLIC",
- "TITLE": "Insufficient validation of provided paths in Exago WrImageResource.axd"
+ "ASSIGNER": "cve-requests@bitdefender.com",
+ "STATE": "PUBLIC"
+ },
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appliance allows an unauthenticated attacker to read sensitive server files with root permissions. This issue affects: Device42 CMDB versions prior to 18.01.00."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-863 Incorrect Authorization",
+ "cweId": "CWE-863"
+ }
+ ]
+ }
+ ]
},
"affects": {
"vendor": {
"vendor_data": [
{
+ "vendor_name": "Device42",
"product": {
"product_data": [
{
@@ -17,95 +40,80 @@
"version": {
"version_data": [
{
- "version_affected": "<",
- "version_value": "18.01.00"
+ "version_value": "unspecified",
+ "version_affected": "="
}
]
}
}
]
- },
- "vendor_name": "Device42"
+ }
}
]
}
},
- "credit": [
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/",
+ "refsource": "MISC",
+ "name": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.0.9"
+ },
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "solution": [
{
- "lang": "eng",
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "An update to Device42 CMDB version 18.01.00 fixes the issue.
"
+ }
+ ],
+ "value": "An update to Device42 CMDB version 18.01.00 fixes the issue.\n\n"
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
"value": "\u0218tefania POPESCU - Team Lead, Security @ Bitdefender"
},
{
- "lang": "eng",
+ "lang": "en",
"value": "Ionu\u021b LALU - Security Engineer @ Bitdefender"
},
{
- "lang": "eng",
+ "lang": "en",
"value": "Cristian BUZA - Security Engineer @ Bitdefender"
},
{
- "lang": "eng",
+ "lang": "en",
"value": "Alexandru LAZ\u0102R - Security Researcher @ Bitdefender"
}
],
- "data_format": "MITRE",
- "data_type": "CVE",
- "data_version": "4.0",
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appliance allows an unauthenticated attacker to read sensitive server files with root permissions. This issue affects: Device42 CMDB versions prior to 18.01.00."
- }
- ]
- },
- "generator": {
- "engine": "Vulnogram 0.0.9"
- },
"impact": {
- "cvss": {
- "attackComplexity": "HIGH",
- "attackVector": "ADJACENT_NETWORK",
- "availabilityImpact": "NONE",
- "baseScore": 6.9,
- "baseSeverity": "MEDIUM",
- "confidentialityImpact": "HIGH",
- "integrityImpact": "LOW",
- "privilegesRequired": "NONE",
- "scope": "CHANGED",
- "userInteraction": "NONE",
- "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N",
- "version": "3.1"
- }
- },
- "problemtype": {
- "problemtype_data": [
+ "cvss": [
{
- "description": [
- {
- "lang": "eng",
- "value": "CWE-284 Improper Access Control"
- }
- ]
+ "attackComplexity": "HIGH",
+ "attackVector": "ADJACENT_NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 6.9,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N",
+ "version": "3.1"
}
]
- },
- "references": {
- "reference_data": [
- {
- "refsource": "MISC",
- "url": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/",
- "name": "https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/"
- }
- ]
- },
- "solution": [
- {
- "lang": "eng",
- "value": "An update to Device42 CMDB version 18.01.00 fixes the issue."
- }
- ],
- "source": {
- "discovery": "EXTERNAL"
}
}
\ No newline at end of file
diff --git a/2022/1xxx/CVE-2022-1471.json b/2022/1xxx/CVE-2022-1471.json
index ba06054f09e9..9a81fc1e3551 100644
--- a/2022/1xxx/CVE-2022-1471.json
+++ b/2022/1xxx/CVE-2022-1471.json
@@ -58,6 +58,21 @@
"url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2",
"refsource": "MISC",
"name": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2"
+ },
+ {
+ "url": "https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479",
+ "refsource": "MISC",
+ "name": "https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479"
+ },
+ {
+ "url": "https://github.com/mbechler/marshalsec",
+ "refsource": "MISC",
+ "name": "https://github.com/mbechler/marshalsec"
+ },
+ {
+ "url": "https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true",
+ "refsource": "MISC",
+ "name": "https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true"
}
]
},
diff --git a/2022/1xxx/CVE-2022-1520.json b/2022/1xxx/CVE-2022-1520.json
index 0650238fe457..8ea9a999ad93 100644
--- a/2022/1xxx/CVE-2022-1520.json
+++ b/2022/1xxx/CVE-2022-1520.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-1520",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.9",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Incorrect security status shown after viewing an attached email"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-18/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-18/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745019",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745019"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird < 91.9."
}
]
}
diff --git a/2022/1xxx/CVE-2022-1529.json b/2022/1xxx/CVE-2022-1529.json
index 9ae7eecd80f7..a090076b2d58 100644
--- a/2022/1xxx/CVE-2022-1529.json
+++ b/2022/1xxx/CVE-2022-1529.json
@@ -4,14 +4,97 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-1529",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.9.1",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "100.0.2",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox for Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "100.3.0",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.9.1",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Untrusted input used in JavaScript object indexing, leading to prototype pollution"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-19/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-19/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1770048",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1770048"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1."
}
]
}
diff --git a/2022/1xxx/CVE-2022-1705.json b/2022/1xxx/CVE-2022-1705.json
index defd46e2ac5c..de102ed0b5d1 100644
--- a/2022/1xxx/CVE-2022-1705.json
+++ b/2022/1xxx/CVE-2022-1705.json
@@ -1,16 +1,37 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@golang.org",
"ID": "CVE-2022-1705",
+ "ASSIGNER": "security@golang.org",
"STATE": "PUBLIC"
},
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')"
+ }
+ ]
+ }
+ ]
+ },
"affects": {
"vendor": {
"vendor_data": [
{
+ "vendor_name": "Go standard library",
"product": {
"product_data": [
{
@@ -18,47 +39,22 @@
"version": {
"version_data": [
{
- "version_value": "1.17.12",
- "version_affected": "<"
+ "version_value": "0",
+ "version_affected": "="
},
{
"version_value": "1.18.0",
- "version_affected": ">="
- },
- {
- "version_value": "1.18.4",
- "version_affected": "<"
+ "version_affected": "="
}
]
}
}
]
- },
- "vendor_name": "Go"
+ }
}
]
}
},
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid."
- }
- ]
- },
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')"
- }
- ]
- }
- ]
- },
"references": {
"reference_data": [
{
@@ -90,17 +86,12 @@
"url": "https://go.dev/cl/410714",
"refsource": "MISC",
"name": "https://go.dev/cl/410714"
- },
- {
- "refsource": "FEDORA",
- "name": "FEDORA-2022-30c5ed5625",
- "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/"
}
]
},
- "credit": [
+ "credits": [
{
- "lang": "eng",
+ "lang": "en",
"value": "Zeyu Zhang (https://www.zeyu2001.com/)"
}
]
diff --git a/2022/1xxx/CVE-2022-1802.json b/2022/1xxx/CVE-2022-1802.json
index d02eb7554be1..23e38705a680 100644
--- a/2022/1xxx/CVE-2022-1802.json
+++ b/2022/1xxx/CVE-2022-1802.json
@@ -4,14 +4,97 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-1802",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.9.1",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "100.0.2",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox for Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "100.3.0",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.9.1",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Prototype pollution in Top-Level Await implementation"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-19/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-19/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1770137",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1770137"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1."
}
]
}
diff --git a/2022/1xxx/CVE-2022-1834.json b/2022/1xxx/CVE-2022-1834.json
index 223094ac3ab3..f2f57ad17145 100644
--- a/2022/1xxx/CVE-2022-1834.json
+++ b/2022/1xxx/CVE-2022-1834.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-1834",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.10",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Braille space character caused incorrect sender email to be shown for a digitally signed email"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-22/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-22/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1767816",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1767816"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed by many Braille space characters, the attacker's email address was not visible. Because Thunderbird compared the invisible sender address with the signature's email address, if the signing key or certificate was accepted by Thunderbird, the email was shown as having a valid digital signature. This vulnerability affects Thunderbird < 91.10."
}
]
}
diff --git a/2022/1xxx/CVE-2022-1887.json b/2022/1xxx/CVE-2022-1887.json
index e7e808314394..35d8fee4cdd8 100644
--- a/2022/1xxx/CVE-2022-1887.json
+++ b/2022/1xxx/CVE-2022-1887.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-1887",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox for iOS",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "101",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "SQL injection in history tab"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-23/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-23/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1767205",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1767205"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The search term could have been specified externally to trigger SQL injection. This vulnerability affects Firefox for iOS < 101."
}
]
}
diff --git a/2022/1xxx/CVE-2022-1941.json b/2022/1xxx/CVE-2022-1941.json
index b26a494b2a84..1127296f501d 100644
--- a/2022/1xxx/CVE-2022-1941.json
+++ b/2022/1xxx/CVE-2022-1941.json
@@ -150,6 +150,11 @@
"refsource": "MLIST",
"name": "[oss-security] 20220927 CVE-2022-1941: Protobuf C++, Python DoS",
"url": "http://www.openwall.com/lists/oss-security/2022/09/27/1"
+ },
+ {
+ "refsource": "FEDORA",
+ "name": "FEDORA-2022-25f35ed634",
+ "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3/"
}
]
},
diff --git a/2022/1xxx/CVE-2022-1958.json b/2022/1xxx/CVE-2022-1958.json
index 1dde4ec53b57..6b2055c1fbb9 100644
--- a/2022/1xxx/CVE-2022-1958.json
+++ b/2022/1xxx/CVE-2022-1958.json
@@ -1,20 +1,42 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-1958",
- "TITLE": "FileCloud NTFS access control",
- "REQUESTER": "cna@vuldb.com",
"ASSIGNER": "cna@vuldb.com",
"STATE": "PUBLIC"
},
- "generator": "vuldb.com",
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. Upgrading to version 21.3.5.18513 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-201960."
+ },
+ {
+ "lang": "deu",
+ "value": "Es wurde eine kritische Schwachstelle in FileCloud entdeckt. Es betrifft eine unbekannte Funktion der Komponente NTFS Handler. Dank der Manipulation mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Ein Aktualisieren auf die Version 21.3.5.18513 vermag dieses Problem zu l\u00f6sen. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-284 Improper Access Controls",
+ "cweId": "CWE-284"
+ }
+ ]
+ }
+ ]
+ },
"affects": {
"vendor": {
"vendor_data": [
{
- "vendor_name": "",
+ "vendor_name": "n/a",
"product": {
"product_data": [
{
@@ -22,7 +44,8 @@
"version": {
"version_data": [
{
- "version_value": "n/a"
+ "version_value": "n/a",
+ "version_affected": "="
}
]
}
@@ -33,34 +56,6 @@
]
}
},
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-284 Improper Access Controls"
- }
- ]
- }
- ]
- },
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "A vulnerability classified as critical has been found in FileCloud. Affected is the NTFS handler which leads to improper access controls. It is possible to launch the attack remotely but it demands some form of authentication. Upgrading to version 21.3.5.18513 is able to address this issue. It is recommended to upgrade the affected component."
- }
- ]
- },
- "credit": "Andrea Hauser/Ralph Meier",
- "impact": {
- "cvss": {
- "version": "3.1",
- "baseScore": "6.3",
- "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
- }
- },
"references": {
"reference_data": [
{
@@ -77,6 +72,37 @@
"url": "https://www.scip.ch/?news.20220615",
"refsource": "MISC",
"name": "https://www.scip.ch/?news.20220615"
+ },
+ {
+ "url": "https://vuldb.com/?ctiid.201960",
+ "refsource": "MISC",
+ "name": "https://vuldb.com/?ctiid.201960"
+ }
+ ]
+ },
+ "credits": [
+ {
+ "lang": "en",
+ "value": "Andrea Hauser"
+ },
+ {
+ "lang": "en",
+ "value": "Ralph Meier"
+ }
+ ],
+ "impact": {
+ "cvss": [
+ {
+ "version": "3.1",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
+ },
+ {
+ "version": "3.0",
+ "baseScore": 6.3,
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "baseSeverity": "MEDIUM"
}
]
}
diff --git a/2022/1xxx/CVE-2022-1962.json b/2022/1xxx/CVE-2022-1962.json
index 951f8693c9be..cbb760b751a3 100644
--- a/2022/1xxx/CVE-2022-1962.json
+++ b/2022/1xxx/CVE-2022-1962.json
@@ -1,16 +1,37 @@
{
+ "data_version": "4.0",
+ "data_type": "CVE",
+ "data_format": "MITRE",
"CVE_data_meta": {
- "ASSIGNER": "security@golang.org",
"ID": "CVE-2022-1962",
+ "ASSIGNER": "security@golang.org",
"STATE": "PUBLIC"
},
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
+ "description": {
+ "description_data": [
+ {
+ "lang": "eng",
+ "value": "Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-674: Uncontrolled Recursion"
+ }
+ ]
+ }
+ ]
+ },
"affects": {
"vendor": {
"vendor_data": [
{
+ "vendor_name": "Go standard library",
"product": {
"product_data": [
{
@@ -18,47 +39,22 @@
"version": {
"version_data": [
{
- "version_value": "1.17.12",
- "version_affected": "<"
+ "version_value": "0",
+ "version_affected": "="
},
{
"version_value": "1.18.0",
- "version_affected": ">="
- },
- {
- "version_value": "1.18.4",
- "version_affected": "<"
+ "version_affected": "="
}
]
}
}
]
- },
- "vendor_name": "Go"
+ }
}
]
}
},
- "description": {
- "description_data": [
- {
- "lang": "eng",
- "value": "Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations."
- }
- ]
- },
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "CWE-674: Uncontrolled Recursion"
- }
- ]
- }
- ]
- },
"references": {
"reference_data": [
{
@@ -85,17 +81,12 @@
"url": "https://go.dev/issue/53616",
"refsource": "MISC",
"name": "https://go.dev/issue/53616"
- },
- {
- "refsource": "FEDORA",
- "name": "FEDORA-2022-30c5ed5625",
- "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/"
}
]
},
- "credit": [
+ "credits": [
{
- "lang": "eng",
+ "lang": "en",
"value": "Juho Nurminen of Mattermost"
}
]
diff --git a/2022/20xxx/CVE-2022-20199.json b/2022/20xxx/CVE-2022-20199.json
index facf07ef098b..97f971a4669d 100644
--- a/2022/20xxx/CVE-2022-20199.json
+++ b/2022/20xxx/CVE-2022-20199.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20199",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In multiple locations of NfcService.java, there is a possible disclosure of NFC tags due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-199291025"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20369.json b/2022/20xxx/CVE-2022-20369.json
index e87ae4dfd31c..c20e50c5aa06 100644
--- a/2022/20xxx/CVE-2022-20369.json
+++ b/2022/20xxx/CVE-2022-20369.json
@@ -48,6 +48,11 @@
"refsource": "MISC",
"name": "https://source.android.com/security/bulletin/pixel/2022-08-01",
"url": "https://source.android.com/security/bulletin/pixel/2022-08-01"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[debian-lts-announce] 20221223 [SECURITY] [DLA 3245-1] linux security update",
+ "url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html"
}
]
},
diff --git a/2022/20xxx/CVE-2022-20463.json b/2022/20xxx/CVE-2022-20463.json
index b309baad48bc..049e0b892e88 100644
--- a/2022/20xxx/CVE-2022-20463.json
+++ b/2022/20xxx/CVE-2022-20463.json
@@ -4,58 +4,14 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20463",
- "ASSIGNER": "security@android.com",
- "STATE": "PUBLIC"
- },
- "affects": {
- "vendor": {
- "vendor_data": [
- {
- "vendor_name": "n/a",
- "product": {
- "product_data": [
- {
- "product_name": "Android",
- "version": {
- "version_data": [
- {
- "version_value": "Android-10 Android-11 Android-12 Android-12L Android-13"
- }
- ]
- }
- }
- ]
- }
- }
- ]
- }
- },
- "problemtype": {
- "problemtype_data": [
- {
- "description": [
- {
- "lang": "eng",
- "value": "Elevation of privilege"
- }
- ]
- }
- ]
- },
- "references": {
- "reference_data": [
- {
- "refsource": "MISC",
- "name": "https://source.android.com/security/bulletin/2022-11-01",
- "url": "https://source.android.com/security/bulletin/2022-11-01"
- }
- ]
+ "ASSIGNER": "cve@mitre.org",
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "In factoryReset of WifiServiceImpl, there is a possible way to preserve WiFi settings due to a logic error in the code. This could lead to a local non-security issue across network factory resets with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-231985227"
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."
}
]
}
diff --git a/2022/20xxx/CVE-2022-20503.json b/2022/20xxx/CVE-2022-20503.json
index b221d4409614..1c246ffb80f5 100644
--- a/2022/20xxx/CVE-2022-20503.json
+++ b/2022/20xxx/CVE-2022-20503.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20503",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In onCreate of WifiDppConfiguratorActivity.java, there is a possible way for a guest user to add a WiFi configuration due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224772890"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20504.json b/2022/20xxx/CVE-2022-20504.json
index c2b0b83b8579..300ed1991dc7 100644
--- a/2022/20xxx/CVE-2022-20504.json
+++ b/2022/20xxx/CVE-2022-20504.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20504",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In multiple locations of DreamManagerService.java, there is a missing permission check. This could lead to local escalation of privilege and dismissal of system dialogs with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-225878553"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20505.json b/2022/20xxx/CVE-2022-20505.json
index 6a780c789678..ef7be7120ff6 100644
--- a/2022/20xxx/CVE-2022-20505.json
+++ b/2022/20xxx/CVE-2022-20505.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20505",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In openFile of CallLogProvider.java, there is a possible permission bypass due to a path traversal error. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitationProduct: AndroidVersions: Android-13Android ID: A-225981754"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20506.json b/2022/20xxx/CVE-2022-20506.json
index 065c2310ee24..bf3002b5e30d 100644
--- a/2022/20xxx/CVE-2022-20506.json
+++ b/2022/20xxx/CVE-2022-20506.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20506",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In onCreate of WifiDialogActivity.java, there is a missing permission check. This could lead to local escalation of privilege from a guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-226133034"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20507.json b/2022/20xxx/CVE-2022-20507.json
index 6719daa83ec0..2bfce179c199 100644
--- a/2022/20xxx/CVE-2022-20507.json
+++ b/2022/20xxx/CVE-2022-20507.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20507",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In onMulticastListUpdateNotificationReceived of UwbEventManager.java, there is a possible arbitrary code execution due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-246649179"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20508.json b/2022/20xxx/CVE-2022-20508.json
index 35e02dabb1f1..bec355aea8e7 100644
--- a/2022/20xxx/CVE-2022-20508.json
+++ b/2022/20xxx/CVE-2022-20508.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20508",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In onAttach of ConfigureWifiSettings.java, there is a possible way for a guest user to change WiFi settings due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-218679614"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20509.json b/2022/20xxx/CVE-2022-20509.json
index 05595a90abf7..8247a7229d9b 100644
--- a/2022/20xxx/CVE-2022-20509.json
+++ b/2022/20xxx/CVE-2022-20509.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20509",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In mapGrantorDescr of MessageQueueBase.h, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-244713317"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20510.json b/2022/20xxx/CVE-2022-20510.json
index 14983dfe6d1f..23f0649dd5ba 100644
--- a/2022/20xxx/CVE-2022-20510.json
+++ b/2022/20xxx/CVE-2022-20510.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20510",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In getNearbyNotificationStreamingPolicy of DevicePolicyManagerService.java, there is a possible way to learn about the notification streaming policy of other users due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-235822336"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20511.json b/2022/20xxx/CVE-2022-20511.json
index 10496a5a628b..ad4ea3811336 100644
--- a/2022/20xxx/CVE-2022-20511.json
+++ b/2022/20xxx/CVE-2022-20511.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20511",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In getNearbyAppStreamingPolicy of DevicePolicyManagerService.java, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-235821829"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20512.json b/2022/20xxx/CVE-2022-20512.json
index 0e8d058fcdbc..66973468dcf5 100644
--- a/2022/20xxx/CVE-2022-20512.json
+++ b/2022/20xxx/CVE-2022-20512.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20512",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In navigateUpTo of Task.java, there is a possible way to launch an intent handler with a mismatched intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-238602879"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20513.json b/2022/20xxx/CVE-2022-20513.json
index c3551997d0eb..1f205cb3520c 100644
--- a/2022/20xxx/CVE-2022-20513.json
+++ b/2022/20xxx/CVE-2022-20513.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20513",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-244569759"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20514.json b/2022/20xxx/CVE-2022-20514.json
index db12d8dd8b7c..d8e5e0c588df 100644
--- a/2022/20xxx/CVE-2022-20514.json
+++ b/2022/20xxx/CVE-2022-20514.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20514",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In acquireFabricatedOverlayIterator, nextFabricatedOverlayInfos, and releaseFabricatedOverlayIterator of Idmap2Service.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-245727875"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20515.json b/2022/20xxx/CVE-2022-20515.json
index d0da9f618207..380fb84957f4 100644
--- a/2022/20xxx/CVE-2022-20515.json
+++ b/2022/20xxx/CVE-2022-20515.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20515",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In onPreferenceClick of AccountTypePreferenceLoader.java, there is a possible way to retrieve protected files from the Settings app due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-220733496"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20516.json b/2022/20xxx/CVE-2022-20516.json
index 44a51c0936b4..82dfe0488160 100644
--- a/2022/20xxx/CVE-2022-20516.json
+++ b/2022/20xxx/CVE-2022-20516.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20516",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In rw_t3t_act_handle_check_ndef_rsp of rw_t3t.cc, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224002331"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20517.json b/2022/20xxx/CVE-2022-20517.json
index 106a32fe02b0..11c864e20917 100644
--- a/2022/20xxx/CVE-2022-20517.json
+++ b/2022/20xxx/CVE-2022-20517.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20517",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In getMessagesByPhoneNumber of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224769956"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20518.json b/2022/20xxx/CVE-2022-20518.json
index bfad0933f75a..34ab2512b2e2 100644
--- a/2022/20xxx/CVE-2022-20518.json
+++ b/2022/20xxx/CVE-2022-20518.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20518",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In query of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224770203"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20519.json b/2022/20xxx/CVE-2022-20519.json
index ee91f8bf8d8b..40ec019b503b 100644
--- a/2022/20xxx/CVE-2022-20519.json
+++ b/2022/20xxx/CVE-2022-20519.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20519",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In onCreate of AddAppNetworksActivity.java, there is a possible way for a guest user to configure WiFi networks due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224772678"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20520.json b/2022/20xxx/CVE-2022-20520.json
index f3c1abc8af6a..80e1ec7ee9e0 100644
--- a/2022/20xxx/CVE-2022-20520.json
+++ b/2022/20xxx/CVE-2022-20520.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20520",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In onCreate of various files, there is a possible tapjacking/overlay attack. This could lead to local escalation of privilege or denial of server with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-227203202"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20521.json b/2022/20xxx/CVE-2022-20521.json
index e95913eacdde..77211619f1b7 100644
--- a/2022/20xxx/CVE-2022-20521.json
+++ b/2022/20xxx/CVE-2022-20521.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20521",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Denial of service"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In sdpu_find_most_specific_service_uuid of sdp_utils.cc, there is a possible way to crash Bluetooth due to a missing null check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-227203684"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20522.json b/2022/20xxx/CVE-2022-20522.json
index 2800d1110feb..cec72bc3fdd7 100644
--- a/2022/20xxx/CVE-2022-20522.json
+++ b/2022/20xxx/CVE-2022-20522.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20522",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In getSlice of ProviderModelSlice.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-227470877"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20523.json b/2022/20xxx/CVE-2022-20523.json
index d4109e0668de..ed11268d35c5 100644
--- a/2022/20xxx/CVE-2022-20523.json
+++ b/2022/20xxx/CVE-2022-20523.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20523",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In IncFs_GetFilledRangesStartingFrom of incfs.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-228222508"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20524.json b/2022/20xxx/CVE-2022-20524.json
index e757068f9142..969a75786e5c 100644
--- a/2022/20xxx/CVE-2022-20524.json
+++ b/2022/20xxx/CVE-2022-20524.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20524",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In compose of Vibrator.cpp, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-228523213"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20525.json b/2022/20xxx/CVE-2022-20525.json
index d1826c72df62..edd9422ee07d 100644
--- a/2022/20xxx/CVE-2022-20525.json
+++ b/2022/20xxx/CVE-2022-20525.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20525",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-229742768"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20526.json b/2022/20xxx/CVE-2022-20526.json
index 0a2412848c0f..379d18c46e56 100644
--- a/2022/20xxx/CVE-2022-20526.json
+++ b/2022/20xxx/CVE-2022-20526.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20526",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In CanvasContext::draw of CanvasContext.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-229742774"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20527.json b/2022/20xxx/CVE-2022-20527.json
index 8dd3a3a527c1..3ceece1e250f 100644
--- a/2022/20xxx/CVE-2022-20527.json
+++ b/2022/20xxx/CVE-2022-20527.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20527",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In HalCoreCallback of halcore.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure from the NFC firmware with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-229994861"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20528.json b/2022/20xxx/CVE-2022-20528.json
index dd9f629e43ae..308655e6bfae 100644
--- a/2022/20xxx/CVE-2022-20528.json
+++ b/2022/20xxx/CVE-2022-20528.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20528",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In findParam of HevcUtils.cpp there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-230172711"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20529.json b/2022/20xxx/CVE-2022-20529.json
index 278e1473658c..1c5a9ff4e35a 100644
--- a/2022/20xxx/CVE-2022-20529.json
+++ b/2022/20xxx/CVE-2022-20529.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20529",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In multiple locations of WifiDialogActivity.java, there is a possible limited lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege in wifi settings with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-231583603"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20530.json b/2022/20xxx/CVE-2022-20530.json
index 88981f10d01e..8c3d63f0eb44 100644
--- a/2022/20xxx/CVE-2022-20530.json
+++ b/2022/20xxx/CVE-2022-20530.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20530",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In strings.xml, there is a possible permission bypass due to a misleading string. This could lead to remote information disclosure of call logs with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-231585645"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20531.json b/2022/20xxx/CVE-2022-20531.json
index 648245cc6656..d16f65abed15 100644
--- a/2022/20xxx/CVE-2022-20531.json
+++ b/2022/20xxx/CVE-2022-20531.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2022-20531",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."
}
]
}
diff --git a/2022/20xxx/CVE-2022-20533.json b/2022/20xxx/CVE-2022-20533.json
index 63c0e0d242ea..6d3b01db2b26 100644
--- a/2022/20xxx/CVE-2022-20533.json
+++ b/2022/20xxx/CVE-2022-20533.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20533",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In getSlice of WifiSlice.java, there is a possible way to connect a new WiFi network from the guest mode due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-232798363"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20535.json b/2022/20xxx/CVE-2022-20535.json
index 766ef50a295f..ae2e13007d3d 100644
--- a/2022/20xxx/CVE-2022-20535.json
+++ b/2022/20xxx/CVE-2022-20535.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20535",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In registerLocalOnlyHotspotSoftApCallback of WifiManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-233605242"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20536.json b/2022/20xxx/CVE-2022-20536.json
index ff16d33a1659..7c791fe65a4e 100644
--- a/2022/20xxx/CVE-2022-20536.json
+++ b/2022/20xxx/CVE-2022-20536.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20536",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In registerBroadcastReceiver of RcsService.java, there is a possible way to change preferred TTY mode due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-235100180"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20537.json b/2022/20xxx/CVE-2022-20537.json
index ef2bdd57f494..4e282d7602d6 100644
--- a/2022/20xxx/CVE-2022-20537.json
+++ b/2022/20xxx/CVE-2022-20537.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20537",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In createDialog of WifiScanModeActivity.java, there is a possible way for a Guest user to enable location-sensitive settings due to a missing permission check. This could lead to local escalation of privilege from the Guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-235601169"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20538.json b/2022/20xxx/CVE-2022-20538.json
index d95630f06755..e6f591196102 100644
--- a/2022/20xxx/CVE-2022-20538.json
+++ b/2022/20xxx/CVE-2022-20538.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20538",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In getSmsRoleHolder of RoleService.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-235601770"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20539.json b/2022/20xxx/CVE-2022-20539.json
index 09d1cfbf1676..57c9e651ab4e 100644
--- a/2022/20xxx/CVE-2022-20539.json
+++ b/2022/20xxx/CVE-2022-20539.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20539",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In parameterToHal of Effect.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege in the audio server with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-237291425"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20540.json b/2022/20xxx/CVE-2022-20540.json
index 3402ef73d8a6..a731d1c013e3 100644
--- a/2022/20xxx/CVE-2022-20540.json
+++ b/2022/20xxx/CVE-2022-20540.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20540",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In SurfaceFlinger::doDump of SurfaceFlinger.cpp, there is possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-237291506"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20541.json b/2022/20xxx/CVE-2022-20541.json
index 533892bd39c7..4071edbaa543 100644
--- a/2022/20xxx/CVE-2022-20541.json
+++ b/2022/20xxx/CVE-2022-20541.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20541",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In phNxpNciHal_ioctl of phNxpNciHal.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-238083126"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20543.json b/2022/20xxx/CVE-2022-20543.json
index c9939fc22b6b..0b4e987d7c5d 100644
--- a/2022/20xxx/CVE-2022-20543.json
+++ b/2022/20xxx/CVE-2022-20543.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20543",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Denial of service"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In multiple locations, there is a possible display crash loop due to improper input validation. This could lead to local denial of service with system execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-238178261"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20544.json b/2022/20xxx/CVE-2022-20544.json
index 01046048c8c3..469970bda5ad 100644
--- a/2022/20xxx/CVE-2022-20544.json
+++ b/2022/20xxx/CVE-2022-20544.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20544",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In onOptionsItemSelected of ManageApplications.java, there is a possible bypass of profile owner restrictions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-238745070"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20545.json b/2022/20xxx/CVE-2022-20545.json
index 799934207314..10fbc9aee85f 100644
--- a/2022/20xxx/CVE-2022-20545.json
+++ b/2022/20xxx/CVE-2022-20545.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20545",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Denial of service"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In bindArtworkAndColors of MediaControlPanel.java, there is a possible way to crash the phone due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-239368697"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20546.json b/2022/20xxx/CVE-2022-20546.json
index 4f9c304d3386..850c267a23c4 100644
--- a/2022/20xxx/CVE-2022-20546.json
+++ b/2022/20xxx/CVE-2022-20546.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20546",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In getCurrentConfigImpl of Effect.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-240266798"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20547.json b/2022/20xxx/CVE-2022-20547.json
index f0c7714222a9..aaab0475ac44 100644
--- a/2022/20xxx/CVE-2022-20547.json
+++ b/2022/20xxx/CVE-2022-20547.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20547",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In multiple functions of AdapterService.java, there is a possible way to manipulate Bluetooth state due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-240301753"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20548.json b/2022/20xxx/CVE-2022-20548.json
index d920a4bdc078..c6538d696a99 100644
--- a/2022/20xxx/CVE-2022-20548.json
+++ b/2022/20xxx/CVE-2022-20548.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20548",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In setParameter of EqualizerEffect.cpp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-240919398"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20549.json b/2022/20xxx/CVE-2022-20549.json
index f91516993cb8..f04ebd2967a5 100644
--- a/2022/20xxx/CVE-2022-20549.json
+++ b/2022/20xxx/CVE-2022-20549.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20549",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In authToken2AidlVec of KeyMintUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-242702451"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20550.json b/2022/20xxx/CVE-2022-20550.json
index 89d2a96e8b2a..2874953be807 100644
--- a/2022/20xxx/CVE-2022-20550.json
+++ b/2022/20xxx/CVE-2022-20550.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20550",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In Multiple Locations, there is a possibility to launch arbitrary protected activities due to a confused deputy. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-242845514"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20552.json b/2022/20xxx/CVE-2022-20552.json
index 828e0efc85d8..76e1b469b2c5 100644
--- a/2022/20xxx/CVE-2022-20552.json
+++ b/2022/20xxx/CVE-2022-20552.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20552",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In btif_a2dp_sink_command_ready of btif_a2dp_sink.cc, there is a possible out of bounds read due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-243922806"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20553.json b/2022/20xxx/CVE-2022-20553.json
index d517a661985a..8aea6a1feed7 100644
--- a/2022/20xxx/CVE-2022-20553.json
+++ b/2022/20xxx/CVE-2022-20553.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20553",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In onCreate of LogAccessDialogActivity.java, there is a possible way to bypass a permission check due to a tapjacking/overlay attack. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-244155265"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20554.json b/2022/20xxx/CVE-2022-20554.json
index c55257780bc2..d9b266d05988 100644
--- a/2022/20xxx/CVE-2022-20554.json
+++ b/2022/20xxx/CVE-2022-20554.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20554",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In removeEventHubDevice of InputDevice.cpp, there is a possible OOB read due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-245770596"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20555.json b/2022/20xxx/CVE-2022-20555.json
index 699481646a52..d3d84bb03b9a 100644
--- a/2022/20xxx/CVE-2022-20555.json
+++ b/2022/20xxx/CVE-2022-20555.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20555",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In ufdt_get_node_by_path_len of ufdt_convert.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-246194233"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20556.json b/2022/20xxx/CVE-2022-20556.json
index ce351507ca3e..52f32c5181ec 100644
--- a/2022/20xxx/CVE-2022-20556.json
+++ b/2022/20xxx/CVE-2022-20556.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20556",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In launchConfigNewNetworkFragment of NetworkProviderSettings.java, there is a possible way for the guest user to add a new WiFi network due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-246301667"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20557.json b/2022/20xxx/CVE-2022-20557.json
index ceba525347f5..53583fe7ebb5 100644
--- a/2022/20xxx/CVE-2022-20557.json
+++ b/2022/20xxx/CVE-2022-20557.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20557",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In MessageQueueBase of MessageQueueBase.h, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-247092734"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20558.json b/2022/20xxx/CVE-2022-20558.json
index 69faf4e6fc52..a3d5b67c1bf2 100644
--- a/2022/20xxx/CVE-2022-20558.json
+++ b/2022/20xxx/CVE-2022-20558.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20558",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In registerReceivers of DeviceCapabilityListener.java, there is a possible way to change preferred TTY mode due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-236264289"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20559.json b/2022/20xxx/CVE-2022-20559.json
index 89850280fdf3..80c5bfba62ce 100644
--- a/2022/20xxx/CVE-2022-20559.json
+++ b/2022/20xxx/CVE-2022-20559.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20559",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android-13"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In revokeOwnPermissionsOnKill of PermissionManager.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-219739967"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20560.json b/2022/20xxx/CVE-2022-20560.json
index ede84ad64db1..655990471742 100644
--- a/2022/20xxx/CVE-2022-20560.json
+++ b/2022/20xxx/CVE-2022-20560.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20560",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Product: AndroidVersions: Android kernelAndroid ID: A-212623833References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20561.json b/2022/20xxx/CVE-2022-20561.json
index 2a4d9a7edbe9..87664ef9fde9 100644
--- a/2022/20xxx/CVE-2022-20561.json
+++ b/2022/20xxx/CVE-2022-20561.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20561",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In TBD of aud_hal_tunnel.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-222162870References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20562.json b/2022/20xxx/CVE-2022-20562.json
index 66b0ff1754bd..55b507c035f3 100644
--- a/2022/20xxx/CVE-2022-20562.json
+++ b/2022/20xxx/CVE-2022-20562.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20562",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In various functions of ap_input_processor.c, there is a possible way to record audio during a phone call due to a logic error in the code. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-231630423References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20563.json b/2022/20xxx/CVE-2022-20563.json
index b06a1d9a6e78..9c1dd85057fa 100644
--- a/2022/20xxx/CVE-2022-20563.json
+++ b/2022/20xxx/CVE-2022-20563.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20563",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In TBD of ufdt_convert, there is a possible out of bounds read due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-242067561References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20564.json b/2022/20xxx/CVE-2022-20564.json
index c367225ca1cc..a67dd8b84cb3 100644
--- a/2022/20xxx/CVE-2022-20564.json
+++ b/2022/20xxx/CVE-2022-20564.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20564",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In _ufdt_output_strtab_to_fdt of ufdt_convert.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-243798789References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20566.json b/2022/20xxx/CVE-2022-20566.json
index f4d9dcd5ee44..02066f425567 100644
--- a/2022/20xxx/CVE-2022-20566.json
+++ b/2022/20xxx/CVE-2022-20566.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20566",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-165329981References: Upstream kernel"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20567.json b/2022/20xxx/CVE-2022-20567.json
index 07cc70b9458e..1643a184e1cc 100644
--- a/2022/20xxx/CVE-2022-20567.json
+++ b/2022/20xxx/CVE-2022-20567.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20567",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-186777253References: Upstream kernel"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20568.json b/2022/20xxx/CVE-2022-20568.json
index d3f42e35d747..749aacb521fd 100644
--- a/2022/20xxx/CVE-2022-20568.json
+++ b/2022/20xxx/CVE-2022-20568.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20568",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In (TBD) of (TBD), there is a possible way to corrupt kernel memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-220738351References: Upstream kernel"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20569.json b/2022/20xxx/CVE-2022-20569.json
index f45b488d2520..74e522a8fc5a 100644
--- a/2022/20xxx/CVE-2022-20569.json
+++ b/2022/20xxx/CVE-2022-20569.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20569",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In thermal_cooling_device_stats_update of thermal_sysfs.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-229258234References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20570.json b/2022/20xxx/CVE-2022-20570.json
index a515ccc0d5ef..8a626da06815 100644
--- a/2022/20xxx/CVE-2022-20570.json
+++ b/2022/20xxx/CVE-2022-20570.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20570",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Product: AndroidVersions: Android kernelAndroid ID: A-230660904References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20571.json b/2022/20xxx/CVE-2022-20571.json
index 56c47c7c1597..9a74483354db 100644
--- a/2022/20xxx/CVE-2022-20571.json
+++ b/2022/20xxx/CVE-2022-20571.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20571",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In extract_metadata of dm-android-verity.c, there is a possible way to corrupt kernel memory due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-234030265References: Upstream kernel"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20572.json b/2022/20xxx/CVE-2022-20572.json
index aa6217307a57..b68131a9d84f 100644
--- a/2022/20xxx/CVE-2022-20572.json
+++ b/2022/20xxx/CVE-2022-20572.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20572",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-234475629References: Upstream kernel"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20574.json b/2022/20xxx/CVE-2022-20574.json
index bb28fe065794..fb9757db29eb 100644
--- a/2022/20xxx/CVE-2022-20574.json
+++ b/2022/20xxx/CVE-2022-20574.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20574",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In sec_sysmmu_info of drm_fw.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-237582191References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20575.json b/2022/20xxx/CVE-2022-20575.json
index 0168e263c5bc..2f115c1830b3 100644
--- a/2022/20xxx/CVE-2022-20575.json
+++ b/2022/20xxx/CVE-2022-20575.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20575",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In read_ppmpu_info of drm_fw.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-237585040References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20576.json b/2022/20xxx/CVE-2022-20576.json
index 7b98fbbe64ff..5648effb8d0c 100644
--- a/2022/20xxx/CVE-2022-20576.json
+++ b/2022/20xxx/CVE-2022-20576.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20576",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In externalOnRequest of rilapplication.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239701761References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20577.json b/2022/20xxx/CVE-2022-20577.json
index 591ae942687f..0c2b2269cd7a 100644
--- a/2022/20xxx/CVE-2022-20577.json
+++ b/2022/20xxx/CVE-2022-20577.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20577",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In OemSimAuthRequest::encode of wlandata.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-241762281References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20578.json b/2022/20xxx/CVE-2022-20578.json
index 51e32a22b4b4..f8b4f3f67de0 100644
--- a/2022/20xxx/CVE-2022-20578.json
+++ b/2022/20xxx/CVE-2022-20578.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20578",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In RadioImpl::setGsmBroadcastConfig of ril_service_legacy.cpp, there is a possible stack clash leading to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-243509749References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20579.json b/2022/20xxx/CVE-2022-20579.json
index 8ad2c3f657b7..6a9beda40510 100644
--- a/2022/20xxx/CVE-2022-20579.json
+++ b/2022/20xxx/CVE-2022-20579.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20579",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In RadioImpl::setCdmaBroadcastConfig of ril_service_legacy.cpp, there is a possible stack clash leading to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-243510139References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20580.json b/2022/20xxx/CVE-2022-20580.json
index cab9782135bd..fa1b3e932dd0 100644
--- a/2022/20xxx/CVE-2022-20580.json
+++ b/2022/20xxx/CVE-2022-20580.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20580",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In ufdt_do_one_fixup of ufdt_overlay.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-243629453References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20581.json b/2022/20xxx/CVE-2022-20581.json
index d7db286a42c5..4b50632abe0f 100644
--- a/2022/20xxx/CVE-2022-20581.json
+++ b/2022/20xxx/CVE-2022-20581.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20581",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In the Pixel camera driver, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-245916120References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20582.json b/2022/20xxx/CVE-2022-20582.json
index 23af71b4b80c..c8c94c6178bc 100644
--- a/2022/20xxx/CVE-2022-20582.json
+++ b/2022/20xxx/CVE-2022-20582.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20582",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In ppmp_unprotect_mfcfw_buf of drm_fw.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-233645166References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20583.json b/2022/20xxx/CVE-2022-20583.json
index 091d6f2de479..d1e096335293 100644
--- a/2022/20xxx/CVE-2022-20583.json
+++ b/2022/20xxx/CVE-2022-20583.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20583",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In ppmp_unprotect_mfcfw_buf of drm_fw.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege in S-EL1 with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-234859169References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20584.json b/2022/20xxx/CVE-2022-20584.json
index bdf733b249e2..7f8709e7988d 100644
--- a/2022/20xxx/CVE-2022-20584.json
+++ b/2022/20xxx/CVE-2022-20584.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20584",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In page_number of shared_mem.c, there is a possible code execution in secure world due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238366009References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20585.json b/2022/20xxx/CVE-2022-20585.json
index 778f9a145c50..52c282bfde85 100644
--- a/2022/20xxx/CVE-2022-20585.json
+++ b/2022/20xxx/CVE-2022-20585.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20585",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In valid_out_of_special_sec_dram_addr of drm_access_control.c, there is a possible EoP due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238716781References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20586.json b/2022/20xxx/CVE-2022-20586.json
index 0e0e9b8c68f9..2e0ec4a31d9c 100644
--- a/2022/20xxx/CVE-2022-20586.json
+++ b/2022/20xxx/CVE-2022-20586.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20586",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In valid_out_of_special_sec_dram_addr of drm_access_control.c, there is a possible EoP due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238718854References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20587.json b/2022/20xxx/CVE-2022-20587.json
index 8352fcd06402..e6c517cc0cc6 100644
--- a/2022/20xxx/CVE-2022-20587.json
+++ b/2022/20xxx/CVE-2022-20587.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20587",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In ppmp_validate_wsm of drm_fw.c, there is a possible EoP due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238720411References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20588.json b/2022/20xxx/CVE-2022-20588.json
index 809ac326dcaf..75f1577817b4 100644
--- a/2022/20xxx/CVE-2022-20588.json
+++ b/2022/20xxx/CVE-2022-20588.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20588",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In sysmmu_map of sysmmu.c, there is a possible EoP due to a precondition check failure. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238785915References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20589.json b/2022/20xxx/CVE-2022-20589.json
index d3436c32eba6..2665bc3cc23a 100644
--- a/2022/20xxx/CVE-2022-20589.json
+++ b/2022/20xxx/CVE-2022-20589.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20589",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In valid_va_secbuf_check of drm_access_control.c, there is a possible ID due to improper input validation. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238841928References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20590.json b/2022/20xxx/CVE-2022-20590.json
index 83bdfb4f57c0..44960824924f 100644
--- a/2022/20xxx/CVE-2022-20590.json
+++ b/2022/20xxx/CVE-2022-20590.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20590",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In valid_va_sec_mfc_check of drm_access_control.c, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238932493References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20591.json b/2022/20xxx/CVE-2022-20591.json
index 610e7c367e69..33dc861d6a47 100644
--- a/2022/20xxx/CVE-2022-20591.json
+++ b/2022/20xxx/CVE-2022-20591.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20591",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In ppmpu_set of ppmpu.c, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238939706References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20592.json b/2022/20xxx/CVE-2022-20592.json
index 705f667842e3..f9d122beee0c 100644
--- a/2022/20xxx/CVE-2022-20592.json
+++ b/2022/20xxx/CVE-2022-20592.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20592",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In ppmp_validate_secbuf of drm_fw.c, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238976908References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20593.json b/2022/20xxx/CVE-2022-20593.json
index dd7d18c2f152..ed77c14bcbfc 100644
--- a/2022/20xxx/CVE-2022-20593.json
+++ b/2022/20xxx/CVE-2022-20593.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20593",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In pop_descriptor_string of BufferDescriptor.h, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239415809References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20594.json b/2022/20xxx/CVE-2022-20594.json
index 40ed80b08240..448f76dfbf16 100644
--- a/2022/20xxx/CVE-2022-20594.json
+++ b/2022/20xxx/CVE-2022-20594.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20594",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In updateStart of WirelessCharger.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239567689References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20595.json b/2022/20xxx/CVE-2022-20595.json
index 1bb27f6481c9..a9a07bf24ed6 100644
--- a/2022/20xxx/CVE-2022-20595.json
+++ b/2022/20xxx/CVE-2022-20595.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20595",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In getWpcAuthChallengeResponse of WirelessCharger.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239700137References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20596.json b/2022/20xxx/CVE-2022-20596.json
index e859f47e9763..fc4dc4c8ae98 100644
--- a/2022/20xxx/CVE-2022-20596.json
+++ b/2022/20xxx/CVE-2022-20596.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20596",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In sendChunk of WirelessCharger.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239700400References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20597.json b/2022/20xxx/CVE-2022-20597.json
index 2c15b2e1ce32..3496e661881e 100644
--- a/2022/20xxx/CVE-2022-20597.json
+++ b/2022/20xxx/CVE-2022-20597.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20597",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In ppmpu_set of ppmpu.c, there is a possible EoP due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-243480506References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20598.json b/2022/20xxx/CVE-2022-20598.json
index 89bb859a843d..0fae34f7de72 100644
--- a/2022/20xxx/CVE-2022-20598.json
+++ b/2022/20xxx/CVE-2022-20598.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20598",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In sec_media_protect of media.c, there is a possible EoP due to an integer overflow. This could lead to local escalation of privilege of secure mode MFC Core with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-242357514References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20599.json b/2022/20xxx/CVE-2022-20599.json
index 7d58cccd8a97..aea479238d84 100644
--- a/2022/20xxx/CVE-2022-20599.json
+++ b/2022/20xxx/CVE-2022-20599.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20599",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In Pixel firmware, there is a possible exposure of sensitive memory due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-242332706References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20600.json b/2022/20xxx/CVE-2022-20600.json
index 95d7cf5b14cd..ee6268d86b35 100644
--- a/2022/20xxx/CVE-2022-20600.json
+++ b/2022/20xxx/CVE-2022-20600.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20600",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Elevation of privilege"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In TBD of TBD, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239847859References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20601.json b/2022/20xxx/CVE-2022-20601.json
index 2f45f24726ad..aaac3fa47829 100644
--- a/2022/20xxx/CVE-2022-20601.json
+++ b/2022/20xxx/CVE-2022-20601.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20601",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Product: AndroidVersions: Android kernelAndroid ID: A-204541506References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20602.json b/2022/20xxx/CVE-2022-20602.json
index 3801696ce301..7bf7e8025182 100644
--- a/2022/20xxx/CVE-2022-20602.json
+++ b/2022/20xxx/CVE-2022-20602.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20602",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Product: AndroidVersions: Android kernelAndroid ID: A-211081867References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20603.json b/2022/20xxx/CVE-2022-20603.json
index 8d0a9a7bd3ac..604c16bfb0e3 100644
--- a/2022/20xxx/CVE-2022-20603.json
+++ b/2022/20xxx/CVE-2022-20603.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20603",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Remote code execution"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In SetDecompContextDb of RohcDeCompContextOfRbId.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-219265339References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20604.json b/2022/20xxx/CVE-2022-20604.json
index e7f1b638ccda..70f3b1b70913 100644
--- a/2022/20xxx/CVE-2022-20604.json
+++ b/2022/20xxx/CVE-2022-20604.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20604",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In SAECOMM_SetDcnIdForPlmn of SAECOMM_DbManagement.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure from a single device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-230463606References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20605.json b/2022/20xxx/CVE-2022-20605.json
index 778ef3fc53a2..19486453bbec 100644
--- a/2022/20xxx/CVE-2022-20605.json
+++ b/2022/20xxx/CVE-2022-20605.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20605",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In SAECOMM_CopyBufferBytes of SAECOMM_Utility.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-231722405References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20606.json b/2022/20xxx/CVE-2022-20606.json
index f14681471238..61832dfd1016 100644
--- a/2022/20xxx/CVE-2022-20606.json
+++ b/2022/20xxx/CVE-2022-20606.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20606",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In SAEMM_MiningCodecTableWithMsgIE of SAEMM_RadioMessageCodec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-233230674References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20607.json b/2022/20xxx/CVE-2022-20607.json
index 550afa9c7dc8..b49df5ff5c30 100644
--- a/2022/20xxx/CVE-2022-20607.json
+++ b/2022/20xxx/CVE-2022-20607.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20607",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Remote code execution"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In the Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with LTE authentication needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238914868References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20608.json b/2022/20xxx/CVE-2022-20608.json
index 473596cf3778..3e176670f02a 100644
--- a/2022/20xxx/CVE-2022-20608.json
+++ b/2022/20xxx/CVE-2022-20608.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20608",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In Pixel cellular firmware, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239239246References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20609.json b/2022/20xxx/CVE-2022-20609.json
index 0009a1ba965a..ceaf43f0bda9 100644
--- a/2022/20xxx/CVE-2022-20609.json
+++ b/2022/20xxx/CVE-2022-20609.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20609",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Information disclosure"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In Pixel cellular firmware, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239240808References: N/A"
}
]
}
diff --git a/2022/20xxx/CVE-2022-20610.json b/2022/20xxx/CVE-2022-20610.json
index 89715c784b05..44bc7097e74c 100644
--- a/2022/20xxx/CVE-2022-20610.json
+++ b/2022/20xxx/CVE-2022-20610.json
@@ -4,14 +4,58 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-20610",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@android.com",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "n/a",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Android",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "Android kernel"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Remote code execution"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "refsource": "MISC",
+ "name": "https://source.android.com/security/bulletin/pixel/2022-12-01",
+ "url": "https://source.android.com/security/bulletin/pixel/2022-12-01"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In cellular modem firmware, there is a possible out of bounds read due to a missing bounds check. This could lead to remote code execution with LTE authentication needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-240462530References: N/A"
}
]
}
diff --git a/2022/21xxx/CVE-2022-21620.json b/2022/21xxx/CVE-2022-21620.json
index 64eb43b5f2cd..5107dbfa362d 100644
--- a/2022/21xxx/CVE-2022-21620.json
+++ b/2022/21xxx/CVE-2022-21620.json
@@ -64,6 +64,11 @@
"url": "https://www.oracle.com/security-alerts/cpuoct2022.html",
"refsource": "MISC",
"name": "https://www.oracle.com/security-alerts/cpuoct2022.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202212-03",
+ "url": "https://security.gentoo.org/glsa/202212-03"
}
]
}
diff --git a/2022/21xxx/CVE-2022-21621.json b/2022/21xxx/CVE-2022-21621.json
index 66e54816e11f..c784faafada6 100644
--- a/2022/21xxx/CVE-2022-21621.json
+++ b/2022/21xxx/CVE-2022-21621.json
@@ -64,6 +64,11 @@
"url": "https://www.oracle.com/security-alerts/cpuoct2022.html",
"refsource": "MISC",
"name": "https://www.oracle.com/security-alerts/cpuoct2022.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202212-03",
+ "url": "https://security.gentoo.org/glsa/202212-03"
}
]
}
diff --git a/2022/21xxx/CVE-2022-21627.json b/2022/21xxx/CVE-2022-21627.json
index aecaf8ea7f35..e05fc624c0fe 100644
--- a/2022/21xxx/CVE-2022-21627.json
+++ b/2022/21xxx/CVE-2022-21627.json
@@ -64,6 +64,11 @@
"url": "https://www.oracle.com/security-alerts/cpuoct2022.html",
"refsource": "MISC",
"name": "https://www.oracle.com/security-alerts/cpuoct2022.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202212-03",
+ "url": "https://security.gentoo.org/glsa/202212-03"
}
]
}
diff --git a/2022/21xxx/CVE-2022-21712.json b/2022/21xxx/CVE-2022-21712.json
index 6bcb6e043045..06e89495d864 100644
--- a/2022/21xxx/CVE-2022-21712.json
+++ b/2022/21xxx/CVE-2022-21712.json
@@ -98,6 +98,11 @@
"refsource": "FEDORA",
"name": "FEDORA-2022-9a489fa494",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K/"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-02",
+ "url": "https://security.gentoo.org/glsa/202301-02"
}
]
},
diff --git a/2022/21xxx/CVE-2022-21716.json b/2022/21xxx/CVE-2022-21716.json
index ab0a115f7ad4..5ccbbb3363d0 100644
--- a/2022/21xxx/CVE-2022-21716.json
+++ b/2022/21xxx/CVE-2022-21716.json
@@ -108,6 +108,11 @@
"refsource": "FEDORA",
"name": "FEDORA-2022-9a489fa494",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K/"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202301-02",
+ "url": "https://security.gentoo.org/glsa/202301-02"
}
]
},
diff --git a/2022/22xxx/CVE-2022-22063.json b/2022/22xxx/CVE-2022-22063.json
index 3533062333a4..45258a83d4cb 100644
--- a/2022/22xxx/CVE-2022-22063.json
+++ b/2022/22xxx/CVE-2022-22063.json
@@ -1,17 +1,108 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22063",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "product-security@qualcomm.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Memory corruption in Core due to improper configuration in boot remapper."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Qualcomm, Inc.",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Snapdragon",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "APQ8096AU",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MDM9640",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MDM9645",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6174",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6174A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6574A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6574AU",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3990",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin",
+ "refsource": "MISC",
+ "name": "https://www.qualcomm.com/company/product-security/bulletins/december-2022-bulletin"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "LOCAL",
+ "availabilityImpact": "HIGH",
+ "baseScore": 8.4,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+ "version": "3.1"
}
]
}
diff --git a/2022/22xxx/CVE-2022-22079.json b/2022/22xxx/CVE-2022-22079.json
index 2d941cf1bb13..77a5b98bcf3c 100644
--- a/2022/22xxx/CVE-2022-22079.json
+++ b/2022/22xxx/CVE-2022-22079.json
@@ -1,17 +1,260 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22079",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "product-security@qualcomm.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Denial of service while processing fastboot flash command on mmc due to buffer over read"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Qualcomm, Inc.",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Snapdragon",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "APQ8009",
+ "version_affected": "="
+ },
+ {
+ "version_value": "APQ8009W",
+ "version_affected": "="
+ },
+ {
+ "version_value": "APQ8064AU",
+ "version_affected": "="
+ },
+ {
+ "version_value": "APQ8096AU",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MDM9150",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MDM9250",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MDM9628",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MDM9650",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MSM8108",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MSM8208",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MSM8209",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MSM8608",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MSM8909W",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MSM8996AU",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA4020",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6174A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6564A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6564AU",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6574",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6574A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6574AU",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6584AU",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA9377",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA9379",
+ "version_affected": "="
+ },
+ {
+ "version_value": "Qualcomm215",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD210",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD429",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD625",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD626",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD835",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SDA429W",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SDM429W",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SDW2500",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SDX20",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SDX20M",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCD9326",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCD9335",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3610",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3615",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3620",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3660B",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3680",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3680B",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3980",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3990",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WSA8815",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin",
+ "refsource": "MISC",
+ "name": "https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "PHYSICAL",
+ "availabilityImpact": "HIGH",
+ "baseScore": 4.6,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "version": "3.1"
}
]
}
diff --git a/2022/22xxx/CVE-2022-22088.json b/2022/22xxx/CVE-2022-22088.json
index 65c2c2dcfcee..4739b5fad0f2 100644
--- a/2022/22xxx/CVE-2022-22088.json
+++ b/2022/22xxx/CVE-2022-22088.json
@@ -1,17 +1,676 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22088",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "product-security@qualcomm.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "n/a"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Qualcomm, Inc.",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Snapdragon",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "APQ8009",
+ "version_affected": "="
+ },
+ {
+ "version_value": "APQ8009W",
+ "version_affected": "="
+ },
+ {
+ "version_value": "APQ8052",
+ "version_affected": "="
+ },
+ {
+ "version_value": "APQ8056",
+ "version_affected": "="
+ },
+ {
+ "version_value": "APQ8076",
+ "version_affected": "="
+ },
+ {
+ "version_value": "APQ8096AU",
+ "version_affected": "="
+ },
+ {
+ "version_value": "AQT1000",
+ "version_affected": "="
+ },
+ {
+ "version_value": "AR8031",
+ "version_affected": "="
+ },
+ {
+ "version_value": "CSRA6620",
+ "version_affected": "="
+ },
+ {
+ "version_value": "CSRA6640",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MSM8108",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MSM8208",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MSM8209",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MSM8608",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MSM8909W",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MSM8952",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MSM8956",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MSM8976",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MSM8976SG",
+ "version_affected": "="
+ },
+ {
+ "version_value": "MSM8996AU",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6310",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6320",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6335",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6390",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6391",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6420",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6421",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6426",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6430",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6431",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6436",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6564A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6564AU",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6574",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6574A",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6574AU",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6584AU",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6595AU",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCA6696",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCC5100",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCM2290",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCM4290",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCM6125",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCM6490",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCN7606",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCN9011",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCN9012",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCN9074",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCS2290",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCS405",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCS410",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCS4290",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCS610",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCS6125",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QCS6490",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QRB5165",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QRB5165M",
+ "version_affected": "="
+ },
+ {
+ "version_value": "QRB5165N",
+ "version_affected": "="
+ },
+ {
+ "version_value": "Qualcomm215",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SA6145P",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SA6150P",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SA6155",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SA6155P",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SA8145P",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SA8150P",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SA8155",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SA8155P",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SA8195P",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD 675",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD 8 Gen1 5G",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD205",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD210",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD429",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD460",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD480",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD625",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD626",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD660",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD662",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD665",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD675",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD678",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD680",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD690 5G",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD695",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD720G",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD730",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD750G",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD765",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD765G",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD768G",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD778G",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD780G",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD835",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD845",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD855",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD865 5G",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD870",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD888",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SD888 5G",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SDM429W",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SDW2500",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SDX50M",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SDX55",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SDX55M",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SDXR1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SDXR2 5G",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SM4125",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SM4375",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SM6250",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SM6250P",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SM7250P",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SM7315",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SM7325P",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SW5100",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SW5100P",
+ "version_affected": "="
+ },
+ {
+ "version_value": "SXR2150P",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCD9326",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCD9335",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCD9340",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCD9341",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCD9370",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCD9375",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCD9380",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCD9385",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3610",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3615",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3620",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3660B",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3680",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3680B",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3910",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3950",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3980",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3988",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3990",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3991",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN3998",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN6740",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN6750",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN6850",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN6851",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN6855",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN6856",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN7850",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WCN7851",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WSA8810",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WSA8815",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WSA8830",
+ "version_affected": "="
+ },
+ {
+ "version_value": "WSA8835",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin",
+ "refsource": "MISC",
+ "name": "https://www.qualcomm.com/company/product-security/bulletins/january-2023-bulletin"
+ }
+ ]
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 9.8,
+ "baseSeverity": "CRITICAL",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
+ "version": "3.1"
}
]
}
diff --git a/2022/22xxx/CVE-2022-22158.json b/2022/22xxx/CVE-2022-22158.json
index 62c54b52f1ed..f2e4521d82d2 100644
--- a/2022/22xxx/CVE-2022-22158.json
+++ b/2022/22xxx/CVE-2022-22158.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2022-22158",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22165.json b/2022/22xxx/CVE-2022-22165.json
index 65a68fcf607b..e61dba1cbd2b 100644
--- a/2022/22xxx/CVE-2022-22165.json
+++ b/2022/22xxx/CVE-2022-22165.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2022-22165",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22184.json b/2022/22xxx/CVE-2022-22184.json
index 6176f2644e5d..e6ff01bd6abb 100644
--- a/2022/22xxx/CVE-2022-22184.json
+++ b/2022/22xxx/CVE-2022-22184.json
@@ -1,18 +1,138 @@
{
- "data_type": "CVE",
- "data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
+ "ASSIGNER": "sirt@juniper.net",
+ "DATE_PUBLIC": "2022-12-22T20:00:00.000Z",
"ID": "CVE-2022-22184",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "PUBLIC",
+ "TITLE": "Junos OS and Junos OS Evolved: A BGP session will flap upon receipt of a specific, optional transitive attribute in version 22.3R1"
},
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Junos OS",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "22.3",
+ "version_value": "22.3R1-S1"
+ },
+ {
+ "version_affected": "!<",
+ "version_value": "22.3R1"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Junos OS Evolved",
+ "version": {
+ "version_data": [
+ {
+ "version_affected": "<",
+ "version_name": "22.3-EVO",
+ "version_value": "22.3R1-S1-EVO"
+ },
+ {
+ "version_affected": "!<",
+ "version_value": "22.3R1-EVO"
+ }
+ ]
+ }
+ }
+ ]
+ },
+ "vendor_name": "Juniper Networks"
+ }
+ ]
+ }
+ },
+ "data_format": "MITRE",
+ "data_type": "CVE",
+ "data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network-based attacker to cause a Denial of Service (DoS). If a BGP update message is received over an established BGP session, and that message contains a specific, optional transitive attribute, this session will be torn down with an update message error. This issue cannot propagate beyond an affected system as the processing error occurs as soon as the update is received. This issue is exploitable remotely as the respective attribute will propagate through unaffected systems and intermediate AS (if any). Continuous receipt of a BGP update containing this attribute will create a sustained Denial of Service (DoS) condition. Since this issue only affects 22.3R1, Juniper strongly encourages customers to move to 22.3R1-S1. Juniper SIRT felt that the need to promptly warn customers about this issue affecting the 22.3R1 versions of Junos OS and Junos OS Evolved warranted an Out of Cycle JSA. This issue affects: Juniper Networks Junos OS version 22.3R1. Juniper Networks Junos OS Evolved version 22.3R1-EVO. This issue does not affect: Juniper Networks Junos OS versions prior to 22.3R1. Juniper Networks Junos OS Evolved versions prior to 22.3R1-EVO."
+ }
+ ]
+ },
+ "exploit": [
+ {
+ "lang": "eng",
+ "value": "Juniper SIRT is not aware of any malicious exploitation of this vulnerability."
+ }
+ ],
+ "generator": {
+ "engine": "Vulnogram 0.0.9"
+ },
+ "impact": {
+ "cvss": {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "version": "3.1"
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-20 Improper Input Validation"
+ }
+ ]
+ },
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Denial of Service (DoS)"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "name": "https://kb.juniper.net/JSA70175",
+ "refsource": "CONFIRM",
+ "url": "https://kb.juniper.net/JSA70175"
}
]
- }
+ },
+ "solution": [
+ {
+ "lang": "eng",
+ "value": "The following software releases have been updated to resolve this specific issue:\nJunos OS: 22.3R1-S1, 22.3R2, 22.4R1, and all subsequent releases;\nJunos OS Evolved: 22.3R1-S1-EVO, 22.3R2-EVO, 22.4R1-EVO, and all subsequent releases."
+ }
+ ],
+ "source": {
+ "advisory": "JSA70175",
+ "defect": [
+ "1698446"
+ ],
+ "discovery": "USER"
+ },
+ "work_around": [
+ {
+ "lang": "eng",
+ "value": "There are no known workarounds for this issue."
+ }
+ ]
}
\ No newline at end of file
diff --git a/2022/22xxx/CVE-2022-22199.json b/2022/22xxx/CVE-2022-22199.json
index 1cd1fe8987c2..0ca19a8f8e06 100644
--- a/2022/22xxx/CVE-2022-22199.json
+++ b/2022/22xxx/CVE-2022-22199.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2022-22199",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22200.json b/2022/22xxx/CVE-2022-22200.json
index 785e820a15ff..b577f99b1c8b 100644
--- a/2022/22xxx/CVE-2022-22200.json
+++ b/2022/22xxx/CVE-2022-22200.json
@@ -5,13 +5,13 @@
"CVE_data_meta": {
"ID": "CVE-2022-22200",
"ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "STATE": "REJECT"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22337.json b/2022/22xxx/CVE-2022-22337.json
index c0267a488210..561ac2cecb9a 100644
--- a/2022/22xxx/CVE-2022-22337.json
+++ b/2022/22xxx/CVE-2022-22337.json
@@ -1,17 +1,92 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22337",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@us.ibm.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 could disclose sensitive information to an authenticated user. IBM X-Force ID: 219507."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
+ "cweId": "CWE-200"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "IBM",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Sterling B2B Integrator Standard Edition",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "6.0.0.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.ibm.com/support/pages/node/6852459",
+ "refsource": "MISC",
+ "name": "https://www.ibm.com/support/pages/node/6852459"
+ },
+ {
+ "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/219507",
+ "refsource": "MISC",
+ "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/219507"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 4.3,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/22xxx/CVE-2022-22338.json b/2022/22xxx/CVE-2022-22338.json
index 176d21f1c8c7..55cf2a29d7b7 100644
--- a/2022/22xxx/CVE-2022-22338.json
+++ b/2022/22xxx/CVE-2022-22338.json
@@ -1,17 +1,92 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22338",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@us.ibm.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 219510."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+ "cweId": "CWE-89"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "IBM",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Sterling B2B Integrator Standard Edition",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "6.0.0.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.ibm.com/support/pages/node/6852453",
+ "refsource": "MISC",
+ "name": "https://www.ibm.com/support/pages/node/6852453"
+ },
+ {
+ "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/219510",
+ "refsource": "MISC",
+ "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/219510"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "LOW",
+ "baseScore": 6.3,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "version": "3.1"
}
]
}
diff --git a/2022/22xxx/CVE-2022-22352.json b/2022/22xxx/CVE-2022-22352.json
index dac2583ca1ca..8f9da383cd37 100644
--- a/2022/22xxx/CVE-2022-22352.json
+++ b/2022/22xxx/CVE-2022-22352.json
@@ -1,17 +1,92 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22352",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@us.ibm.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 220398."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "IBM",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Sterling B2B Integrator Standard Edition",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "6.0.0.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.ibm.com/support/pages/node/6852443",
+ "refsource": "MISC",
+ "name": "https://www.ibm.com/support/pages/node/6852443"
+ },
+ {
+ "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/220398",
+ "refsource": "MISC",
+ "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/220398"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 5.4,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "LOW",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/22xxx/CVE-2022-22371.json b/2022/22xxx/CVE-2022-22371.json
index 5dd30b384575..ada3f7cc9b68 100644
--- a/2022/22xxx/CVE-2022-22371.json
+++ b/2022/22xxx/CVE-2022-22371.json
@@ -1,17 +1,92 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22371",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@us.ibm.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.1 does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 221195."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-613 Insufficient Session Expiration",
+ "cweId": "CWE-613"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "IBM",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Sterling B2B Integrator Standard Edition",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "6.0.0.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.ibm.com/support/pages/node/6852461",
+ "refsource": "MISC",
+ "name": "https://www.ibm.com/support/pages/node/6852461"
+ },
+ {
+ "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/221195",
+ "refsource": "MISC",
+ "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/221195"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "ADJACENT_NETWORK",
+ "availabilityImpact": "LOW",
+ "baseScore": 5.5,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "version": "3.1"
}
]
}
diff --git a/2022/22xxx/CVE-2022-22449.json b/2022/22xxx/CVE-2022-22449.json
index 471d033fcb1f..eeeafe22a0a7 100644
--- a/2022/22xxx/CVE-2022-22449.json
+++ b/2022/22xxx/CVE-2022-22449.json
@@ -1,17 +1,92 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22449",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@us.ibm.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "IBM Security Verify Governance, Identity Manager 10.01 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 224915."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-209 Generation of Error Message Containing Sensitive Information",
+ "cweId": "CWE-209"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "IBM",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Security Verify Governance, Identity Manager",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "10.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.ibm.com/support/pages/node/6849247",
+ "refsource": "MISC",
+ "name": "https://www.ibm.com/support/pages/node/6849247"
+ },
+ {
+ "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/224915",
+ "refsource": "MISC",
+ "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/224915"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 5.3,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/22xxx/CVE-2022-22456.json b/2022/22xxx/CVE-2022-22456.json
index 7e041ba9b552..13a495dcfabe 100644
--- a/2022/22xxx/CVE-2022-22456.json
+++ b/2022/22xxx/CVE-2022-22456.json
@@ -1,17 +1,92 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22456",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@us.ibm.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "IBM Security Verify Governance, Identity Manager 10.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 225004."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "IBM",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Security Verify Governance, Identity Manager",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "10.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.ibm.com/support/pages/node/6849247",
+ "refsource": "MISC",
+ "name": "https://www.ibm.com/support/pages/node/6849247"
+ },
+ {
+ "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/225004",
+ "refsource": "MISC",
+ "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/225004"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "LOCAL",
+ "availabilityImpact": "NONE",
+ "baseScore": 4.2,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "HIGH",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/22xxx/CVE-2022-22457.json b/2022/22xxx/CVE-2022-22457.json
index c422b549d80f..5bf78cb99802 100644
--- a/2022/22xxx/CVE-2022-22457.json
+++ b/2022/22xxx/CVE-2022-22457.json
@@ -1,17 +1,92 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22457",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@us.ibm.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "IBM Security Verify Governance, Identity Manager 10.0.1 stores sensitive information including user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 225007."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-319 Cleartext Transmission of Sensitive Information",
+ "cweId": "CWE-319"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "IBM",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Security Verify Governance, Identity Manager",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "10.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.ibm.com/support/pages/node/6849247",
+ "refsource": "MISC",
+ "name": "https://www.ibm.com/support/pages/node/6849247"
+ },
+ {
+ "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/225007",
+ "refsource": "MISC",
+ "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/225007"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "HIGH",
+ "attackVector": "LOCAL",
+ "availabilityImpact": "NONE",
+ "baseScore": 5.3,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "HIGH",
+ "scope": "CHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/22xxx/CVE-2022-22458.json b/2022/22xxx/CVE-2022-22458.json
index bf233083ce12..ae992ed1f183 100644
--- a/2022/22xxx/CVE-2022-22458.json
+++ b/2022/22xxx/CVE-2022-22458.json
@@ -1,17 +1,92 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22458",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@us.ibm.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "IBM Security Verify Governance, Identity Manager 10.0.1 stores user credentials in plain clear text which can be read by a remote authenticated user. IBM X-Force ID: 225009."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-256 Plaintext Storage of a Password",
+ "cweId": "CWE-256"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "IBM",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Security Verify Governance, Identity Manager",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "10.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.ibm.com/support/pages/node/6849247",
+ "refsource": "MISC",
+ "name": "https://www.ibm.com/support/pages/node/6849247"
+ },
+ {
+ "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/225009",
+ "refsource": "MISC",
+ "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/225009"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "HIGH",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 6.3,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "scope": "CHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/22xxx/CVE-2022-22461.json b/2022/22xxx/CVE-2022-22461.json
index b632f2d07f41..ebe048474c36 100644
--- a/2022/22xxx/CVE-2022-22461.json
+++ b/2022/22xxx/CVE-2022-22461.json
@@ -1,17 +1,92 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22461",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@us.ibm.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "IBM Security Verify Governance, Identity Manager 10.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 225007."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm",
+ "cweId": "CWE-327"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "IBM",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Security Verify Governance, Identity Manager",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "10.0.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.ibm.com/support/pages/node/6850845",
+ "refsource": "MISC",
+ "name": "https://www.ibm.com/support/pages/node/6850845"
+ },
+ {
+ "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/225077",
+ "refsource": "MISC",
+ "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/225077"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "HIGH",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 5.9,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/22xxx/CVE-2022-22470.json b/2022/22xxx/CVE-2022-22470.json
index 1aad348541ad..87c7ba224fda 100644
--- a/2022/22xxx/CVE-2022-22470.json
+++ b/2022/22xxx/CVE-2022-22470.json
@@ -1,17 +1,91 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22470",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "psirt@us.ibm.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "IBM Security Verify Governance 10.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 225232."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "256 Plaintext Storage of a Password"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "IBM",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Security Verify Governance",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "10.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.ibm.com/support/pages/node/6852697",
+ "refsource": "MISC",
+ "name": "https://www.ibm.com/support/pages/node/6852697"
+ },
+ {
+ "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/225232",
+ "refsource": "MISC",
+ "name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/225232"
+ }
+ ]
+ },
+ "generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "HIGH",
+ "attackVector": "LOCAL",
+ "availabilityImpact": "NONE",
+ "baseScore": 4.1,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "HIGH",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/22xxx/CVE-2022-22576.json b/2022/22xxx/CVE-2022-22576.json
index 930b7c664782..a5c1076a6662 100644
--- a/2022/22xxx/CVE-2022-22576.json
+++ b/2022/22xxx/CVE-2022-22576.json
@@ -63,6 +63,11 @@
"refsource": "MLIST",
"name": "[debian-lts-announce] 20220828 [SECURITY] [DLA 3085-1] curl security update",
"url": "https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html"
+ },
+ {
+ "refsource": "GENTOO",
+ "name": "GLSA-202212-01",
+ "url": "https://security.gentoo.org/glsa/202212-01"
}
]
},
diff --git a/2022/22xxx/CVE-2022-22728.json b/2022/22xxx/CVE-2022-22728.json
index a6be39fb720e..4f440362e664 100644
--- a/2022/22xxx/CVE-2022-22728.json
+++ b/2022/22xxx/CVE-2022-22728.json
@@ -96,6 +96,41 @@
"refsource": "FEDORA",
"name": "FEDORA-2022-61f5b492b7",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HZZKVHYYWACPWONPEFRNPIRE3HYLV4T/"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[oss-security] 20221229 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption",
+ "url": "http://www.openwall.com/lists/oss-security/2022/12/29/1"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[oss-security] 20221230 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption",
+ "url": "http://www.openwall.com/lists/oss-security/2022/12/30/4"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[oss-security] 20221231 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption",
+ "url": "http://www.openwall.com/lists/oss-security/2022/12/31/1"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[oss-security] 20221231 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption",
+ "url": "http://www.openwall.com/lists/oss-security/2022/12/31/5"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[oss-security] 20230102 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption",
+ "url": "http://www.openwall.com/lists/oss-security/2023/01/02/1"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[oss-security] 20230102 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption",
+ "url": "http://www.openwall.com/lists/oss-security/2023/01/02/2"
+ },
+ {
+ "refsource": "MLIST",
+ "name": "[oss-security] 20230103 Re: CVE-2022-22728: libapreq2: libapreq2 multipart form parse memory corruption",
+ "url": "http://www.openwall.com/lists/oss-security/2023/01/03/2"
}
]
},
diff --git a/2022/22xxx/CVE-2022-22736.json b/2022/22xxx/CVE-2022-22736.json
index d554623e757f..f9fd3f8848a4 100644
--- a/2022/22xxx/CVE-2022-22736.json
+++ b/2022/22xxx/CVE-2022-22736.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22736",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Potential local privilege escalation when loading modules from the install directory."
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1742692",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1742692"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory for system libraries. However the install directory is not world-writable by default.
*This bug only affects Firefox for Windows in a non-default installation. Other operating systems are unaffected.*. This vulnerability affects Firefox < 96."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22737.json b/2022/22xxx/CVE-2022-22737.json
index 26a8b432e778..d11b45822f4b 100644
--- a/2022/22xxx/CVE-2022-22737.json
+++ b/2022/22xxx/CVE-2022-22737.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22737",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Race condition when playing audio files"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-02/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-02/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-03/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-03/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745874",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745874"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22738.json b/2022/22xxx/CVE-2022-22738.json
index ee7a2b2faa9a..aae62ca294e7 100644
--- a/2022/22xxx/CVE-2022-22738.json
+++ b/2022/22xxx/CVE-2022-22738.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22738",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Heap-buffer-overflow in blendGaussianBlur"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-02/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-02/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-03/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-03/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1742382",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1742382"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22739.json b/2022/22xxx/CVE-2022-22739.json
index 7dcad569d97b..b7f2c2aeac23 100644
--- a/2022/22xxx/CVE-2022-22739.json
+++ b/2022/22xxx/CVE-2022-22739.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22739",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Missing throttling on external protocol launch dialog"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-02/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-02/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-03/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-03/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1744158",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1744158"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22740.json b/2022/22xxx/CVE-2022-22740.json
index 75cd3711e69a..06069bbbed8f 100644
--- a/2022/22xxx/CVE-2022-22740.json
+++ b/2022/22xxx/CVE-2022-22740.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22740",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Use-after-free of ChannelEventQueue::mOwner"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-02/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-02/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-03/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-03/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1742334",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1742334"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Certain network request objects were freed too early when releasing a network request handle. This could have lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22741.json b/2022/22xxx/CVE-2022-22741.json
index 87bb08469fd5..4ac026d256c6 100644
--- a/2022/22xxx/CVE-2022-22741.json
+++ b/2022/22xxx/CVE-2022-22741.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22741",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Browser window spoof using fullscreen mode"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-02/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-02/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-03/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-03/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1740389",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1740389"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22742.json b/2022/22xxx/CVE-2022-22742.json
index 8a14b0707090..79b47fca8955 100644
--- a/2022/22xxx/CVE-2022-22742.json
+++ b/2022/22xxx/CVE-2022-22742.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22742",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Out-of-bounds memory access when inserting text in edit mode"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-02/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-02/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-03/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-03/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1739923",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1739923"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22743.json b/2022/22xxx/CVE-2022-22743.json
index e88d53a83764..3507f9acee78 100644
--- a/2022/22xxx/CVE-2022-22743.json
+++ b/2022/22xxx/CVE-2022-22743.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22743",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Browser window spoof using fullscreen mode"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-02/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-02/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-03/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-03/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1739220",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1739220"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made the browser unable to leave fullscreen mode. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22744.json b/2022/22xxx/CVE-2022-22744.json
index abdfd7139dc8..de11b92a428a 100644
--- a/2022/22xxx/CVE-2022-22744.json
+++ b/2022/22xxx/CVE-2022-22744.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22744",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "The 'Copy as curl' feature in DevTools did not fully escape website-controlled data, potentially leading to command injection"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-02/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-02/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-03/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-03/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1737252",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1737252"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "The constructed curl command from the \"Copy as curl\" feature in DevTools was not properly escaped for PowerShell. This could have lead to command injection if pasted into a Powershell prompt.
*This bug only affects Thunderbird for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22745.json b/2022/22xxx/CVE-2022-22745.json
index 4e4668494f89..837c81cbf7e8 100644
--- a/2022/22xxx/CVE-2022-22745.json
+++ b/2022/22xxx/CVE-2022-22745.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22745",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Leaking cross-origin URLs through securitypolicyviolation event"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-02/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-02/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-03/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-03/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1735856",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1735856"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22746.json b/2022/22xxx/CVE-2022-22746.json
index 9080feb99801..b39bd9001da9 100644
--- a/2022/22xxx/CVE-2022-22746.json
+++ b/2022/22xxx/CVE-2022-22746.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22746",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Calling into reportValidity could have lead to fullscreen window spoof"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-02/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-02/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-03/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-03/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1735071",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1735071"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticed.
*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22747.json b/2022/22xxx/CVE-2022-22747.json
index 0fe4b15c9a89..114cf9d12122 100644
--- a/2022/22xxx/CVE-2022-22747.json
+++ b/2022/22xxx/CVE-2022-22747.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22747",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Crash when handling empty pkcs7 sequence"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-02/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-02/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-03/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-03/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1735028",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1735028"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have lead to a crash. This crash is believed to be unexploitable. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22748.json b/2022/22xxx/CVE-2022-22748.json
index 7a3c0f9a7d8e..8e69cac083ed 100644
--- a/2022/22xxx/CVE-2022-22748.json
+++ b/2022/22xxx/CVE-2022-22748.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22748",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Spoofed origin on external protocol launch dialog"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-02/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-02/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-03/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-03/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1705211",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1705211"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handling an external URL protocol. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22749.json b/2022/22xxx/CVE-2022-22749.json
index 02140b6f8b53..af6b9f980d42 100644
--- a/2022/22xxx/CVE-2022-22749.json
+++ b/2022/22xxx/CVE-2022-22749.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22749",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Lack of URL restrictions when scanning QR codes"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1705094",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1705094"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content.
*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 96."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22750.json b/2022/22xxx/CVE-2022-22750.json
index 2ca5c51ba799..f279d90e61c6 100644
--- a/2022/22xxx/CVE-2022-22750.json
+++ b/2022/22xxx/CVE-2022-22750.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22750",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "IPC passing of resource handles could have lead to sandbox bypass"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1566608",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1566608"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "By generally accepting and passing resource handles across processes, a compromised content process might have confused higher privileged processes to interact with handles that the unprivileged process should not have access to.
*This bug only affects Firefox for Windows and MacOS. Other operating systems are unaffected.*. This vulnerability affects Firefox < 96."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22751.json b/2022/22xxx/CVE-2022-22751.json
index 8a59a0f9d69f..aeaf922a1091 100644
--- a/2022/22xxx/CVE-2022-22751.json
+++ b/2022/22xxx/CVE-2022-22751.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22751",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.5",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Memory safety bugs fixed in Thunderbird 91.5"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-02/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-02/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-03/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-03/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1664149%2C1737816%2C1739366%2C1740274%2C1740797%2C1741201%2C1741869%2C1743221%2C1743515%2C1745373%2C1746011",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1664149%2C1737816%2C1739366%2C1740274%2C1740797%2C1741201%2C1741869%2C1743221%2C1743515%2C1745373%2C1746011"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon Giesecke, and Steve Fink reported memory safety bugs present in Firefox 95 and Firefox ESR 91.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 91.5, Firefox < 96, and Thunderbird < 91.5."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22752.json b/2022/22xxx/CVE-2022-22752.json
index 71b4702738c0..6c3d035e5025 100644
--- a/2022/22xxx/CVE-2022-22752.json
+++ b/2022/22xxx/CVE-2022-22752.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22752",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Memory safety bugs fixed in Firefox 96"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1741210%2C1742770",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1741210%2C1742770"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 96."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22753.json b/2022/22xxx/CVE-2022-22753.json
index 210777d467e8..aabcc6178ee9 100644
--- a/2022/22xxx/CVE-2022-22753.json
+++ b/2022/22xxx/CVE-2022-22753.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22753",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "97",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Privilege Escalation to SYSTEM on Windows via Maintenance Service"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-05/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-05/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-04/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-04/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-06/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-06/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1732435",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1732435"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.
*This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22754.json b/2022/22xxx/CVE-2022-22754.json
index cc287e2efbf6..d2dd3c570ad1 100644
--- a/2022/22xxx/CVE-2022-22754.json
+++ b/2022/22xxx/CVE-2022-22754.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22754",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "97",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Extensions could have bypassed permission confirmation during update"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-05/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-05/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-04/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-04/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-06/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-06/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1750565",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1750565"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new version the new requested permissions. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22755.json b/2022/22xxx/CVE-2022-22755.json
index f991f921b483..9dffc41062f3 100644
--- a/2022/22xxx/CVE-2022-22755.json
+++ b/2022/22xxx/CVE-2022-22755.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22755",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "97",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "XSL could have allowed JavaScript execution after a tab was closed"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-04/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-04/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1309630",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1309630"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute JavaScript (within the bounds of the same-origin policy) even after the tab was closed. This vulnerability affects Firefox < 97."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22756.json b/2022/22xxx/CVE-2022-22756.json
index 396990cf39df..06323d8b9fdb 100644
--- a/2022/22xxx/CVE-2022-22756.json
+++ b/2022/22xxx/CVE-2022-22756.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22756",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "97",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Drag and dropping an image could have resulted in the dropped object being an executable"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-05/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-05/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-04/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-04/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-06/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-06/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1317873",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1317873"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22757.json b/2022/22xxx/CVE-2022-22757.json
index 9e264c6fcbc5..54ce61398dd6 100644
--- a/2022/22xxx/CVE-2022-22757.json
+++ b/2022/22xxx/CVE-2022-22757.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22757",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "97",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Remote Agent did not prevent local websites from connecting"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-04/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-04/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1720098",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1720098"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it.
*This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.*. This vulnerability affects Firefox < 97."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22758.json b/2022/22xxx/CVE-2022-22758.json
index 68072e3b2dde..f26854b29285 100644
--- a/2022/22xxx/CVE-2022-22758.json
+++ b/2022/22xxx/CVE-2022-22758.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22758",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "97",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "tel: links could have sent USSD codes to the dialer on Firefox for Android"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-04/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-04/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1728742",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1728742"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "When clicking on a tel: link, USSD codes, specified after a \\* character, would be included in the phone number. On certain phones, or on certain carriers, if the number was dialed this could perform actions on a user's account, similar to a cross-site request forgery attack.
*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22759.json b/2022/22xxx/CVE-2022-22759.json
index b94f63cb895d..efe8c9c4d2da 100644
--- a/2022/22xxx/CVE-2022-22759.json
+++ b/2022/22xxx/CVE-2022-22759.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22759",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "97",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Sandboxed iframes could have executed script if the parent appended elements"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-05/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-05/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-04/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-04/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-06/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-06/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1739957",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1739957"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "If a document created a sandboxed iframe without allow-scripts, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22760.json b/2022/22xxx/CVE-2022-22760.json
index 11557a0643aa..74bfc9f43f5b 100644
--- a/2022/22xxx/CVE-2022-22760.json
+++ b/2022/22xxx/CVE-2022-22760.json
@@ -4,14 +4,101 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22760",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "97",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Cross-Origin responses could be distinguished between script and non-script content-types"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-05/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-05/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-04/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-04/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-06/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-06/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1740985",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1740985"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1748503",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1748503"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses. This could have been abused to learn information cross-origin. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22761.json b/2022/22xxx/CVE-2022-22761.json
index e2395966fd6c..af7044657b52 100644
--- a/2022/22xxx/CVE-2022-22761.json
+++ b/2022/22xxx/CVE-2022-22761.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22761",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "97",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "frame-ancestors Content Security Policy directive was not enforced for framed extension pages"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-05/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-05/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-04/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-04/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-06/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-06/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745566",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1745566"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22762.json b/2022/22xxx/CVE-2022-22762.json
index a25d87b1f8ce..f3db98b03c38 100644
--- a/2022/22xxx/CVE-2022-22762.json
+++ b/2022/22xxx/CVE-2022-22762.json
@@ -4,14 +4,64 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22762",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "97",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "JavaScript Dialogs could have been displayed over other domains on Firefox for Android"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-04/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-04/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1743931",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1743931"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Under certain circumstances, a JavaScript alert (or prompt) could have been shown while another website was displayed underneath it. This could have been abused to trick the user.
*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 97."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22763.json b/2022/22xxx/CVE-2022-22763.json
index d14e9507bc2f..def2bf47f460 100644
--- a/2022/22xxx/CVE-2022-22763.json
+++ b/2022/22xxx/CVE-2022-22763.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22763",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "96",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Script Execution during invalid object state"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-05/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-05/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-06/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-06/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-01/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-01/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1740534",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1740534"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability affects Firefox < 96, Thunderbird < 91.6, and Firefox ESR < 91.6."
}
]
}
diff --git a/2022/22xxx/CVE-2022-22764.json b/2022/22xxx/CVE-2022-22764.json
index 29d7c6d2ee05..3fa24c9693f9 100644
--- a/2022/22xxx/CVE-2022-22764.json
+++ b/2022/22xxx/CVE-2022-22764.json
@@ -4,14 +4,96 @@
"data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-22764",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security@mozilla.org",
+ "STATE": "PUBLIC"
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "Mozilla",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "Firefox",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "97",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Thunderbird",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6",
+ "version_affected": "<"
+ }
+ ]
+ }
+ },
+ {
+ "product_name": "Firefox ESR",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "91.6",
+ "version_affected": "<"
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6"
+ }
+ ]
+ }
+ ]
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-05/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-05/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-04/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-04/"
+ },
+ {
+ "url": "https://www.mozilla.org/security/advisories/mfsa2022-06/",
+ "refsource": "MISC",
+ "name": "https://www.mozilla.org/security/advisories/mfsa2022-06/"
+ },
+ {
+ "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1742682%2C1744165%2C1746545%2C1748210%2C1748279",
+ "refsource": "MISC",
+ "name": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1742682%2C1744165%2C1746545%2C1748210%2C1748279"
+ }
+ ]
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96 and Firefox ESR 91.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 97, Thunderbird < 91.6, and Firefox ESR < 91.6."
}
]
}
diff --git a/2022/23xxx/CVE-2022-23474.json b/2022/23xxx/CVE-2022-23474.json
index 7c291c501d26..3cf56d36d74d 100644
--- a/2022/23xxx/CVE-2022-23474.json
+++ b/2022/23xxx/CVE-2022-23474.json
@@ -1,17 +1,90 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23474",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method passes pasted input into wrapper\u2019s innerHTML. This issue is patched in version 2.26.0."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-94: Improper Control of Generation of Code ('Code Injection')",
+ "cweId": "CWE-94"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "codex-team",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "editor.js",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "2.26.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js/",
+ "refsource": "MISC",
+ "name": "https://securitylab.github.com/advisories/GHSL-2022-028_codex-team_editor_js/"
+ },
+ {
+ "url": "https://github.com/codex-team/editor.js/pull/2100",
+ "refsource": "MISC",
+ "name": "https://github.com/codex-team/editor.js/pull/2100"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-6mvj-2569-3mcm",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 6.1,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23488.json b/2022/23xxx/CVE-2022-23488.json
index c42dfc673ee2..def59b5c7fca 100644
--- a/2022/23xxx/CVE-2022-23488.json
+++ b/2022/23xxx/CVE-2022-23488.json
@@ -1,17 +1,99 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23488",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The moderators-only webcams lock setting is not enforced on the backend, which allows an attacker to subscribe to viewers' webcams, even when the lock setting is applied. (The required streamId was being sent to all users even with lock setting applied). This issue is fixed in version 2.4-rc-6. There are no workarounds."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-201: Insertion of Sensitive Information Into Sent Data",
+ "cweId": "CWE-201"
+ }
+ ]
+ },
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
+ "cweId": "CWE-200"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "bigbluebutton",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "bigbluebutton",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "< 2.4-rc-6",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6",
+ "refsource": "MISC",
+ "name": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6"
+ },
+ {
+ "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j5g3-f74q-rvfq",
+ "refsource": "MISC",
+ "name": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j5g3-f74q-rvfq"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-j5g3-f74q-rvfq",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 6.5,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23490.json b/2022/23xxx/CVE-2022-23490.json
index 6d15430ac341..adcb113b2f01 100644
--- a/2022/23xxx/CVE-2022-23490.json
+++ b/2022/23xxx/CVE-2022-23490.json
@@ -1,17 +1,99 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23490",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "BigBlueButton is an open source web conferencing system. Versions prior to 2.4.0 expose sensitive information to Unauthorized Actors. This issue affects meetings with polls, where the attacker is a meeting participant. Subscribing to the current-poll collection does not update the client UI, but does give the attacker access to the contents of the collection, which include the individual poll responses. This issue is patched in version 2.4.0. There are no workarounds."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
+ "cweId": "CWE-200"
+ }
+ ]
+ },
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-863: Incorrect Authorization",
+ "cweId": "CWE-863"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "bigbluebutton",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "bigbluebutton",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "< 2.4.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0",
+ "refsource": "MISC",
+ "name": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0"
+ },
+ {
+ "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4qgc-xhw5-6qfg",
+ "refsource": "MISC",
+ "name": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4qgc-xhw5-6qfg"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-4qgc-xhw5-6qfg",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 4.3,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23506.json b/2022/23xxx/CVE-2022-23506.json
index 43cff55b8124..922af38b56b5 100644
--- a/2022/23xxx/CVE-2022-23506.json
+++ b/2022/23xxx/CVE-2022-23506.json
@@ -1,17 +1,98 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23506",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds. This can lead to exposure of sensitive AWS credentials in packer log files. Versions 1.29.2, 1.28.4, and 1.27.3 of Rosco contain fixes for this issue. A workaround is available. It's recommended to use short lived credentials via role assumption and IAM profiles. Additionally, credentials can be set in `/home/spinnaker/.aws/credentials` and `/home/spinnaker/.aws/config` as a volume mount for Rosco pods vs. setting credentials in roscos bake config properties. Last even with those it's recommend to use IAM Roles vs. long lived credentials. This drastically mitigates the risk of credentials exposure. If users have used static credentials, it's recommended to purge any bake logs for AWS, evaluate whether AWS_ACCESS_KEY, SECRET_KEY and/or other sensitive data has been introduced in log files and bake job logs. Then, rotate these credentials and evaluate potential improper use of those credentials."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-532: Insertion of Sensitive Information into Log File",
+ "cweId": "CWE-532"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "spinnaker",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "spinnaker",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "< 1.27.3",
+ "version_affected": "="
+ },
+ {
+ "version_value": ">= 1.28.0, < 1.28.4",
+ "version_affected": "="
+ },
+ {
+ "version_value": ">= 1.29.0, < 1.29.2",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/spinnaker/spinnaker/security/advisories/GHSA-2233-cqj8-j2q5",
+ "refsource": "MISC",
+ "name": "https://github.com/spinnaker/spinnaker/security/advisories/GHSA-2233-cqj8-j2q5"
+ },
+ {
+ "url": "https://github.com/spinnaker/rosco/commit/e80cfaa1abfb3a0e9026d45d6027291bfb815daf",
+ "refsource": "MISC",
+ "name": "https://github.com/spinnaker/rosco/commit/e80cfaa1abfb3a0e9026d45d6027291bfb815daf"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-2233-cqj8-j2q5",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 4.3,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23507.json b/2022/23xxx/CVE-2022-23507.json
index 38a24827ca01..5f57a0c7aa30 100644
--- a/2022/23xxx/CVE-2022-23507.json
+++ b/2022/23xxx/CVE-2022-23507.json
@@ -1,17 +1,85 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23507",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via Improper Verification of Cryptographic Signature, affecting anyone using the tendermint-light-client and related packages to perform light client verification (e.g. IBC-rs, Hermes). The light client does not check that the chain IDs of the trusted and untrusted headers match, resulting in a possible attack vector where someone who finds a header from an untrusted chain that satisfies all other verification conditions (e.g. enough overlapping validator signatures) could fool a light client. The attack vector is currently theoretical, and no proof-of-concept exists yet to exploit it on live networks. This issue is patched in version 0.28.0. There are no workarounds."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-347: Improper Verification of Cryptographic Signature",
+ "cweId": "CWE-347"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "informalsystems",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "tendermint-rs",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "0.28.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/informalsystems/tendermint-rs/security/advisories/GHSA-xqqc-c5gw-c5r5",
+ "refsource": "MISC",
+ "name": "https://github.com/informalsystems/tendermint-rs/security/advisories/GHSA-xqqc-c5gw-c5r5"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-xqqc-c5gw-c5r5",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "HIGH",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 5.4,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23508.json b/2022/23xxx/CVE-2022-23508.json
index a3ab85374937..a71b9cf18412 100644
--- a/2022/23xxx/CVE-2022-23508.json
+++ b/2022/23xxx/CVE-2022-23508.json
@@ -1,17 +1,113 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23508",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in GitOps run could allow a local user or process to alter a Kubernetes cluster's resources. GitOps run has a local S3 bucket which it uses for synchronizing files that are later applied against a Kubernetes cluster. Its endpoint had no security controls to block unauthorized access, therefore allowing local users (and processes) on the same machine to see and alter the bucket content. By leveraging this vulnerability, an attacker could pick a workload of their choosing and inject it into the S3 bucket, which resulted in the successful deployment in the target cluster, without the need to provide any credentials to either the S3 bucket nor the target Kubernetes cluster. There are no known workarounds for this issue, please upgrade. This vulnerability has been fixed by commits 75268c4 and 966823b. Users should upgrade to Weave GitOps version >= v0.12.0 released on 08/12/2022. ### Workarounds There is no workaround for this vulnerability. ### References Disclosed by Paulo Gomes, Senior Software Engineer, Weaveworks. ### For more information If you have any questions or comments about this advisory: - Open an issue in [Weave GitOps repository](https://github.com/weaveworks/weave-gitops) - Email us at [support@weave.works](mailto:support@weave.works)"
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-284: Improper Access Control",
+ "cweId": "CWE-284"
+ }
+ ]
+ },
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory",
+ "cweId": "CWE-538"
+ }
+ ]
+ },
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-552: Files or Directories Accessible to External Parties",
+ "cweId": "CWE-552"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "weaveworks",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "weave-gitops",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "<= 0.11.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/weaveworks/weave-gitops/security/advisories/GHSA-wr3c-g326-486c",
+ "refsource": "MISC",
+ "name": "https://github.com/weaveworks/weave-gitops/security/advisories/GHSA-wr3c-g326-486c"
+ },
+ {
+ "url": "https://github.com/weaveworks/weave-gitops/pull/3102/commits/966823bbda8c539a4661e2a4f8607c9307ba6225",
+ "refsource": "MISC",
+ "name": "https://github.com/weaveworks/weave-gitops/pull/3102/commits/966823bbda8c539a4661e2a4f8607c9307ba6225"
+ },
+ {
+ "url": "https://github.com/weaveworks/weave-gitops/pull/3114/commits/75268c4d2c8f7e4db22c63d76b451ba6545d117f",
+ "refsource": "MISC",
+ "name": "https://github.com/weaveworks/weave-gitops/pull/3114/commits/75268c4d2c8f7e4db22c63d76b451ba6545d117f"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-wr3c-g326-486c",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "ADJACENT_NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 8.9,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23509.json b/2022/23xxx/CVE-2022-23509.json
index 1d3e63afcf0d..eca1a4aa6258 100644
--- a/2022/23xxx/CVE-2022-23509.json
+++ b/2022/23xxx/CVE-2022-23509.json
@@ -1,17 +1,95 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23509",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. GitOps run has a local S3 bucket which it uses for synchronizing files that are later applied against a Kubernetes cluster. The communication between GitOps Run and the local S3 bucket is not encrypted. This allows privileged users or process to tap the local traffic to gain information permitting access to the s3 bucket. From that point, it would be possible to alter the bucket content, resulting in changes in the Kubernetes cluster's resources. There are no known workaround(s) for this vulnerability. This vulnerability has been fixed by commits ce2bbff and babd915. Users should upgrade to Weave GitOps version >= v0.12.0 released on 08/12/2022."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
+ "cweId": "CWE-200"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "weaveworks",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "weave-gitops",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "<= 0.11.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/weaveworks/weave-gitops/security/advisories/GHSA-89qm-wcmw-3mgg",
+ "refsource": "MISC",
+ "name": "https://github.com/weaveworks/weave-gitops/security/advisories/GHSA-89qm-wcmw-3mgg"
+ },
+ {
+ "url": "https://github.com/weaveworks/weave-gitops/pull/3098/commits/babd91574b99b310b84aeec9f8f895bd18acb967",
+ "refsource": "MISC",
+ "name": "https://github.com/weaveworks/weave-gitops/pull/3098/commits/babd91574b99b310b84aeec9f8f895bd18acb967"
+ },
+ {
+ "url": "https://github.com/weaveworks/weave-gitops/pull/3106/commits/ce2bbff0a3609c33396050ed544a5a21f8d0797f",
+ "refsource": "MISC",
+ "name": "https://github.com/weaveworks/weave-gitops/pull/3106/commits/ce2bbff0a3609c33396050ed544a5a21f8d0797f"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-89qm-wcmw-3mgg",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "HIGH",
+ "attackVector": "ADJACENT_NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.4,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "HIGH",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23513.json b/2022/23xxx/CVE-2022-23513.json
index f1eb710b49dd..b7a52c9b3fd9 100644
--- a/2022/23xxx/CVE-2022-23513.json
+++ b/2022/23xxx/CVE-2022-23513.json
@@ -1,17 +1,90 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23513",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on `queryads` endpoint. In the case of application, this vulnerability exists because of a lack of validation in code on a root server path: `/admin/scripts/pi-hole/phpqueryads.php.` Potential threat actor(s) are able to perform an unauthorized query search in blocked domain lists. This could lead to the disclosure for any victims' personal blacklists."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-284: Improper Access Control",
+ "cweId": "CWE-284"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "pi-hole",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "AdminLTE",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "< 5.17",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-6qh8-6rrj-7497",
+ "refsource": "MISC",
+ "name": "https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-6qh8-6rrj-7497"
+ },
+ {
+ "url": "https://github.com/pi-hole/AdminLTE/releases/tag/v5.18",
+ "refsource": "MISC",
+ "name": "https://github.com/pi-hole/AdminLTE/releases/tag/v5.18"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-6qh8-6rrj-7497",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 5.3,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23517.json b/2022/23xxx/CVE-2022-23517.json
index 0cd8ad65ad89..f7168cc9259b 100644
--- a/2022/23xxx/CVE-2022-23517.json
+++ b/2022/23xxx/CVE-2022-23517.json
@@ -1,17 +1,95 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23517",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-1333: Inefficient Regular Expression Complexity",
+ "cweId": "CWE-1333"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "rails",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "rails-html-sanitizer",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "< 1.4.4",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://hackerone.com/reports/1684163",
+ "refsource": "MISC",
+ "name": "https://hackerone.com/reports/1684163"
+ },
+ {
+ "url": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79-w82f-gw8w",
+ "refsource": "MISC",
+ "name": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-5x79-w82f-gw8w"
+ },
+ {
+ "url": "https://github.com/rails/rails-html-sanitizer/commit/56c61c0cebd1e493e8ad7bca2a0191609a4a6979",
+ "refsource": "MISC",
+ "name": "https://github.com/rails/rails-html-sanitizer/commit/56c61c0cebd1e493e8ad7bca2a0191609a4a6979"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-5x79-w82f-gw8w",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 7.5,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23518.json b/2022/23xxx/CVE-2022-23518.json
index 180ee7ec7d36..879733df3876 100644
--- a/2022/23xxx/CVE-2022-23518.json
+++ b/2022/23xxx/CVE-2022-23518.json
@@ -1,17 +1,95 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23518",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. This issue is patched in version 1.4.4."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "rails",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "rails-html-sanitizer",
+ "version": {
+ "version_data": [
+ {
+ "version_value": ">= 1.0.3, < 1.4.4",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://hackerone.com/reports/1694173",
+ "refsource": "MISC",
+ "name": "https://hackerone.com/reports/1694173"
+ },
+ {
+ "url": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-mcvf-2q2m-x72m",
+ "refsource": "MISC",
+ "name": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-mcvf-2q2m-x72m"
+ },
+ {
+ "url": "https://github.com/rails/rails-html-sanitizer/issues/135",
+ "refsource": "MISC",
+ "name": "https://github.com/rails/rails-html-sanitizer/issues/135"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-mcvf-2q2m-x72m",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 6.1,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+ "version": "3.0"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23519.json b/2022/23xxx/CVE-2022-23519.json
index ad445e8a915c..dc3e83f635e9 100644
--- a/2022/23xxx/CVE-2022-23519.json
+++ b/2022/23xxx/CVE-2022-23519.json
@@ -1,17 +1,90 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23519",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both \"math\" and \"style\" elements, or allow both \"svg\" and \"style\" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include \"math\" or \"svg\" and \"style\" should either upgrade or use the following workaround immediately: Remove \"style\" from the overridden allowed tags, or remove \"math\" and \"svg\" from the overridden allowed tags."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "rails",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "rails-html-sanitizer",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "< 1.4.4",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-9h9g-93gc-623h",
+ "refsource": "MISC",
+ "name": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-9h9g-93gc-623h"
+ },
+ {
+ "url": "https://hackerone.com/reports/1656627",
+ "refsource": "MISC",
+ "name": "https://hackerone.com/reports/1656627"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-9h9g-93gc-623h",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 7.2,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23520.json b/2022/23xxx/CVE-2022-23520.json
index 6767978b7d2f..b46625fb4f73 100644
--- a/2022/23xxx/CVE-2022-23520.json
+++ b/2022/23xxx/CVE-2022-23520.json
@@ -1,17 +1,90 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23520",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both \"select\" and \"style\" elements. Code is only impacted if allowed tags are being overridden. This issue is patched in version 1.4.4. All users overriding the allowed tags to include both \"select\" and \"style\" should either upgrade or use this workaround: Remove either \"select\" or \"style\" from the overridden allowed tags. NOTE: Code is _not_ impacted if allowed tags are overridden using either the :tags option to the Action View helper method sanitize or the :tags option to the instance method SafeListSanitizer#sanitize."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
+ "cweId": "CWE-79"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "rails",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "rails-html-sanitizer",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "< 1.4.4",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8",
+ "refsource": "MISC",
+ "name": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rrfc-7g8p-99q8"
+ },
+ {
+ "url": "https://hackerone.com/reports/1654310",
+ "refsource": "MISC",
+ "name": "https://hackerone.com/reports/1654310"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-rrfc-7g8p-99q8",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 6.1,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23524.json b/2022/23xxx/CVE-2022-23524.json
index bbb74aad946f..e1eef24906e4 100644
--- a/2022/23xxx/CVE-2022-23524.json
+++ b/2022/23xxx/CVE-2022-23524.json
@@ -1,17 +1,85 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23524",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting in Denial of Service. Input to functions in the _strvals_ package can cause a stack overflow. In Go, a stack overflow cannot be recovered from. Applications that use functions from the _strvals_ package in the Helm SDK can have a Denial of Service attack when they use this package and it panics. This issue has been patched in 3.10.3. SDK users can validate strings supplied by users won't create large arrays causing significant memory usage before passing them to the _strvals_ functions."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-400: Uncontrolled Resource Consumption",
+ "cweId": "CWE-400"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "helm",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "helm",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "< v3.10.3",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/helm/helm/security/advisories/GHSA-6rx9-889q-vv2r",
+ "refsource": "MISC",
+ "name": "https://github.com/helm/helm/security/advisories/GHSA-6rx9-889q-vv2r"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-6rx9-889q-vv2r",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "LOW",
+ "baseScore": 5.3,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23525.json b/2022/23xxx/CVE-2022-23525.json
index 82b413a81722..cd1428d2131f 100644
--- a/2022/23xxx/CVE-2022-23525.json
+++ b/2022/23xxx/CVE-2022-23525.json
@@ -1,17 +1,90 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23525",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the _repo_package. The _repo_ package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart repositories where charts are managed. The _repo_ package parses the index file of the repository and loads it into structures Go can work with. Some index files can cause array data structures to be created causing a memory violation. Applications that use the _repo_ package in the Helm SDK to parse an index file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The Helm Client will panic with an index file that causes a memory violation panic. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been patched in 3.10.3. SDK users can validate index files that are correctly formatted before passing them to the _repo_ functions."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-476: NULL Pointer Dereference",
+ "cweId": "CWE-476"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "helm",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "helm",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "< v3.10.3",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/helm/helm/security/advisories/GHSA-53c4-hhmh-vw5q",
+ "refsource": "MISC",
+ "name": "https://github.com/helm/helm/security/advisories/GHSA-53c4-hhmh-vw5q"
+ },
+ {
+ "url": "https://github.com/helm/helm/commit/638ebffbc2e445156f3978f02fd83d9af1e56f5b",
+ "refsource": "MISC",
+ "name": "https://github.com/helm/helm/commit/638ebffbc2e445156f3978f02fd83d9af1e56f5b"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-53c4-hhmh-vw5q",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "LOW",
+ "baseScore": 5.3,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23526.json b/2022/23xxx/CVE-2022-23526.json
index 852d9833a59b..d0222e8f4bda 100644
--- a/2022/23xxx/CVE-2022-23526.json
+++ b/2022/23xxx/CVE-2022-23526.json
@@ -1,17 +1,90 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23526",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the_chartutil_ package that can cause a segmentation violation. The _chartutil_ package contains a parser that loads a JSON Schema validation file. For example, the Helm client when rendering a chart will validate its values with the schema file. The _chartutil_ package parses the schema file and loads it into structures Go can work with. Some schema files can cause array data structures to be created causing a memory violation. Applications that use the _chartutil_ package in the Helm SDK to parse a schema file can suffer a Denial of Service when that input causes a panic that cannot be recovered from. Helm is not a long running service so the panic will not affect future uses of the Helm client. This issue has been patched in 3.10.3. SDK users can validate schema files that are correctly formatted before passing them to the _chartutil_ functions."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-476: NULL Pointer Dereference",
+ "cweId": "CWE-476"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "helm",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "helm",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "< v3.10.3",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/helm/helm/security/advisories/GHSA-67fx-wx78-jx33",
+ "refsource": "MISC",
+ "name": "https://github.com/helm/helm/security/advisories/GHSA-67fx-wx78-jx33"
+ },
+ {
+ "url": "https://github.com/helm/helm/commit/bafafa8bb1b571b61d7a9528da8d40c307dade3d",
+ "refsource": "MISC",
+ "name": "https://github.com/helm/helm/commit/bafafa8bb1b571b61d7a9528da8d40c307dade3d"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-67fx-wx78-jx33",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "LOW",
+ "baseScore": 5.3,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23527.json b/2022/23xxx/CVE-2022-23527.json
index 7deaf1117fe7..218434dd9f20 100644
--- a/2022/23xxx/CVE-2022-23527.json
+++ b/2022/23xxx/CVE-2022-23527.json
@@ -1,17 +1,90 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23527",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "mod_auth_openidc is an OpenID Certified\u2122 authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')",
+ "cweId": "CWE-601"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "zmartzone",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "mod_auth_openidc",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "< 2.4.12.2",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-q6f2-285m-gr53",
+ "refsource": "MISC",
+ "name": "https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-q6f2-285m-gr53"
+ },
+ {
+ "url": "https://github.com/zmartzone/mod_auth_openidc/blob/v2.4.12.1/auth_openidc.conf#L975-L984",
+ "refsource": "MISC",
+ "name": "https://github.com/zmartzone/mod_auth_openidc/blob/v2.4.12.1/auth_openidc.conf#L975-L984"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-q6f2-285m-gr53",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 4.7,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "NONE",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23529.json b/2022/23xxx/CVE-2022-23529.json
index c0293a2008fa..b47a9fe55225 100644
--- a/2022/23xxx/CVE-2022-23529.json
+++ b/2022/23xxx/CVE-2022-23529.json
@@ -1,17 +1,90 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23529",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "node-jsonwebtoken is a JsonWebToken implementation for node.js. For versions `<= 8.5.1` of `jsonwebtoken` library, if a malicious actor has the ability to modify the key retrieval parameter (referring to the `secretOrPublicKey` argument from the readme link of the `jwt.verify()` function, they can write arbitrary files on the host machine. Users are affected only if untrusted entities are allowed to modify the key retrieval parameter of the `jwt.verify()` on a host that you control. This issue has been fixed, please update to version 9.0.0."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-20: Improper Input Validation",
+ "cweId": "CWE-20"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "auth0",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "node-jsonwebtoken",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "<= 8.5.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-27h2-hvpr-p74q",
+ "refsource": "MISC",
+ "name": "https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-27h2-hvpr-p74q"
+ },
+ {
+ "url": "https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3",
+ "refsource": "MISC",
+ "name": "https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-27h2-hvpr-p74q",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "LOW",
+ "baseScore": 7.6,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23530.json b/2022/23xxx/CVE-2022-23530.json
index 6af7ff780497..9f297bd5326b 100644
--- a/2022/23xxx/CVE-2022-23530.json
+++ b/2022/23xxx/CVE-2022-23530.json
@@ -1,17 +1,95 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23530",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to v0.1.8 are vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package. Extracting files using shutil.unpack_archive() from a potentially malicious tarball without validating that the destination file path is within the intended destination directory can cause files outside the destination directory to be overwritten. This issue is patched in version 0.1.8. Potential workarounds include using a safer module, like zipfile, and validating the location of the extracted files and discarding those with malicious paths."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')",
+ "cweId": "CWE-22"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "DataDog",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "guarddog",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "< 0.1.8",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/DataDog/guarddog/security/advisories/GHSA-78m5-jpmf-ch7v",
+ "refsource": "MISC",
+ "name": "https://github.com/DataDog/guarddog/security/advisories/GHSA-78m5-jpmf-ch7v"
+ },
+ {
+ "url": "https://github.com/DataDog/guarddog/commit/37c7d0767ba28f4df46117d478f97652594c491c",
+ "refsource": "MISC",
+ "name": "https://github.com/DataDog/guarddog/commit/37c7d0767ba28f4df46117d478f97652594c491c"
+ },
+ {
+ "url": "https://github.com/DataDog/guarddog/blob/a1d064ceb09d39bb28deb6972bc0a278756ea91f/guarddog/scanners/package_scanner.py#L153..158",
+ "refsource": "MISC",
+ "name": "https://github.com/DataDog/guarddog/blob/a1d064ceb09d39bb28deb6972bc0a278756ea91f/guarddog/scanners/package_scanner.py#L153..158"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-78m5-jpmf-ch7v",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "HIGH",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "LOW",
+ "baseScore": 5.8,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23531.json b/2022/23xxx/CVE-2022-23531.json
index 90ca67b1ca90..022b0c04e4ac 100644
--- a/2022/23xxx/CVE-2022-23531.json
+++ b/2022/23xxx/CVE-2022-23531.json
@@ -1,17 +1,95 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23531",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. This issue is patched in version 0.1.5."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-23: Relative Path Traversal",
+ "cweId": "CWE-23"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "DataDog",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "guarddog",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "< 0.1.5",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/DataDog/guarddog/security/advisories/GHSA-rp2v-v467-q9vq",
+ "refsource": "MISC",
+ "name": "https://github.com/DataDog/guarddog/security/advisories/GHSA-rp2v-v467-q9vq"
+ },
+ {
+ "url": "https://github.com/DataDog/guarddog/pull/89/commits/a56aff58264cb6b7855d71b00dc10c39a5dbd306",
+ "refsource": "MISC",
+ "name": "https://github.com/DataDog/guarddog/pull/89/commits/a56aff58264cb6b7855d71b00dc10c39a5dbd306"
+ },
+ {
+ "url": "https://github.com/DataDog/guarddog/releases/tag/v0.1.5",
+ "refsource": "MISC",
+ "name": "https://github.com/DataDog/guarddog/releases/tag/v0.1.5"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-rp2v-v467-q9vq",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "HIGH",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "LOW",
+ "baseScore": 5.8,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "NONE",
+ "scope": "CHANGED",
+ "userInteraction": "REQUIRED",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23536.json b/2022/23xxx/CVE-2022-23536.json
index 42e9e86fb23a..7468fc869d10 100644
--- a/2022/23xxx/CVE-2022-23536.json
+++ b/2022/23xxx/CVE-2022-23536.json
@@ -1,17 +1,122 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23536",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-73: External Control of File Name or Path",
+ "cweId": "CWE-73"
+ }
+ ]
+ },
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-184: Incomplete List of Disallowed Inputs",
+ "cweId": "CWE-184"
+ }
+ ]
+ },
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-641: Improper Restriction of Names for Files and Other Resources",
+ "cweId": "CWE-641"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "cortexproject",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "cortex",
+ "version": {
+ "version_data": [
+ {
+ "version_value": ">= 1.13.0, <= 1.13.1",
+ "version_affected": "="
+ },
+ {
+ "version_value": "= 1.14.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/cortexproject/cortex/security/advisories/GHSA-cq2g-pw6q-hf7j",
+ "refsource": "MISC",
+ "name": "https://github.com/cortexproject/cortex/security/advisories/GHSA-cq2g-pw6q-hf7j"
+ },
+ {
+ "url": "https://cortexmetrics.io/docs/api/#set-alertmanager-configuration",
+ "refsource": "MISC",
+ "name": "https://cortexmetrics.io/docs/api/#set-alertmanager-configuration"
+ },
+ {
+ "url": "https://github.com/cortexproject/cortex/releases/tag/v1.13.2",
+ "refsource": "MISC",
+ "name": "https://github.com/cortexproject/cortex/releases/tag/v1.13.2"
+ },
+ {
+ "url": "https://github.com/cortexproject/cortex/releases/tag/v1.14.1",
+ "refsource": "MISC",
+ "name": "https://github.com/cortexproject/cortex/releases/tag/v1.14.1"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-cq2g-pw6q-hf7j",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "LOW",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 6.5,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23537.json b/2022/23xxx/CVE-2022-23537.json
index 3d2bb7e1272c..f9b598d6c877 100644
--- a/2022/23xxx/CVE-2022-23537.json
+++ b/2022/23xxx/CVE-2022-23537.json
@@ -1,17 +1,90 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23537",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown attribute. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as a commit in the master branch (2.13.1)."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-122: Heap-based Buffer Overflow",
+ "cweId": "CWE-122"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "pjsip",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "pjproject",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "<= 2.13",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/pjsip/pjproject/security/advisories/GHSA-9pfh-r8x4-w26w",
+ "refsource": "MISC",
+ "name": "https://github.com/pjsip/pjproject/security/advisories/GHSA-9pfh-r8x4-w26w"
+ },
+ {
+ "url": "https://github.com/pjsip/pjproject/commit/d8440f4d711a654b511f50f79c0445b26f9dd1e1",
+ "refsource": "MISC",
+ "name": "https://github.com/pjsip/pjproject/commit/d8440f4d711a654b511f50f79c0445b26f9dd1e1"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-9pfh-r8x4-w26w",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "HIGH",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "HIGH",
+ "baseScore": 6.5,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "NONE",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23539.json b/2022/23xxx/CVE-2022-23539.json
index cffde2237d3e..f9f0e1595b3a 100644
--- a/2022/23xxx/CVE-2022-23539.json
+++ b/2022/23xxx/CVE-2022-23539.json
@@ -1,17 +1,90 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23539",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you\u2019ll need to set the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and/or `verify()` functions."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
+ "cweId": "CWE-327"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "auth0",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "node-jsonwebtoken",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "<= 8.5.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3",
+ "refsource": "MISC",
+ "name": "https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3"
+ },
+ {
+ "url": "https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33",
+ "refsource": "MISC",
+ "name": "https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-8cf7-32gw-wr33",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "HIGH",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "NONE",
+ "baseScore": 5.9,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23540.json b/2022/23xxx/CVE-2022-23540.json
index 6c5fbb5717d8..7dcb2e5e3124 100644
--- a/2022/23xxx/CVE-2022-23540.json
+++ b/2022/23xxx/CVE-2022-23540.json
@@ -1,17 +1,90 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23540",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don\u2019t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-287: Improper Authentication",
+ "cweId": "CWE-287"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "auth0",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "node-jsonwebtoken",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "<= 8.5.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3",
+ "refsource": "MISC",
+ "name": "https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3"
+ },
+ {
+ "url": "https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6",
+ "refsource": "MISC",
+ "name": "https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-qwph-4952-7xr6",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "HIGH",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "LOW",
+ "baseScore": 6.4,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23541.json b/2022/23xxx/CVE-2022-23541.json
index d3e870eab566..e68ce6158c7e 100644
--- a/2022/23xxx/CVE-2022-23541.json
+++ b/2022/23xxx/CVE-2022-23541.json
@@ -1,17 +1,104 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23541",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-287: Improper Authentication",
+ "cweId": "CWE-287"
+ }
+ ]
+ },
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-1259: Improper Restriction of Security Token Assignment",
+ "cweId": "CWE-1259"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "auth0",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "node-jsonwebtoken",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "<= 8.5.1",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3",
+ "refsource": "MISC",
+ "name": "https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3"
+ },
+ {
+ "url": "https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959",
+ "refsource": "MISC",
+ "name": "https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959"
+ },
+ {
+ "url": "https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0",
+ "refsource": "MISC",
+ "name": "https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-hjrf-2m68-5959",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "HIGH",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "LOW",
+ "baseScore": 5,
+ "baseSeverity": "MEDIUM",
+ "confidentialityImpact": "LOW",
+ "integrityImpact": "LOW",
+ "privilegesRequired": "LOW",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23542.json b/2022/23xxx/CVE-2022-23542.json
index 7d41c93fecec..5bc2359d94ea 100644
--- a/2022/23xxx/CVE-2022-23542.json
+++ b/2022/23xxx/CVE-2022-23542.json
@@ -1,17 +1,95 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23542",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered that OpenFGA version 0.3.0 is vulnerable to authorization bypass under certain conditions. This issue has been patched in version 0.3.1 and is backward compatible."
+ }
+ ]
+ },
+ "problemtype": {
+ "problemtype_data": [
+ {
+ "description": [
+ {
+ "lang": "eng",
+ "value": "CWE-285: Improper Authorization",
+ "cweId": "CWE-285"
+ }
+ ]
+ }
+ ]
+ },
+ "affects": {
+ "vendor": {
+ "vendor_data": [
+ {
+ "vendor_name": "openfga",
+ "product": {
+ "product_data": [
+ {
+ "product_name": "openfga",
+ "version": {
+ "version_data": [
+ {
+ "version_value": "= 0.3.0",
+ "version_affected": "="
+ }
+ ]
+ }
+ }
+ ]
+ }
+ }
+ ]
+ }
+ },
+ "references": {
+ "reference_data": [
+ {
+ "url": "https://github.com/openfga/openfga/security/advisories/GHSA-m3q4-7qmj-657m",
+ "refsource": "MISC",
+ "name": "https://github.com/openfga/openfga/security/advisories/GHSA-m3q4-7qmj-657m"
+ },
+ {
+ "url": "https://github.com/openfga/openfga/pull/422",
+ "refsource": "MISC",
+ "name": "https://github.com/openfga/openfga/pull/422"
+ },
+ {
+ "url": "https://github.com/openfga/openfga/releases/tag/v0.3.1",
+ "refsource": "MISC",
+ "name": "https://github.com/openfga/openfga/releases/tag/v0.3.1"
+ }
+ ]
+ },
+ "source": {
+ "advisory": "GHSA-m3q4-7qmj-657m",
+ "discovery": "UNKNOWN"
+ },
+ "impact": {
+ "cvss": [
+ {
+ "attackComplexity": "HIGH",
+ "attackVector": "NETWORK",
+ "availabilityImpact": "LOW",
+ "baseScore": 7.7,
+ "baseSeverity": "HIGH",
+ "confidentialityImpact": "HIGH",
+ "integrityImpact": "HIGH",
+ "privilegesRequired": "NONE",
+ "scope": "UNCHANGED",
+ "userInteraction": "NONE",
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
+ "version": "3.1"
}
]
}
diff --git a/2022/23xxx/CVE-2022-23543.json b/2022/23xxx/CVE-2022-23543.json
index 22805b6eab4e..9f80a85060c4 100644
--- a/2022/23xxx/CVE-2022-23543.json
+++ b/2022/23xxx/CVE-2022-23543.json
@@ -1,17 +1,85 @@
{
+ "data_version": "4.0",
"data_type": "CVE",
"data_format": "MITRE",
- "data_version": "4.0",
"CVE_data_meta": {
"ID": "CVE-2022-23543",
- "ASSIGNER": "cve@mitre.org",
- "STATE": "RESERVED"
+ "ASSIGNER": "security-advisories@github.com",
+ "STATE": "PUBLIC"
},
"description": {
"description_data": [
{
"lang": "eng",
- "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
+ "value": "Silverware Games is a social network where people can play games online. Users can attach URLs to YouTube videos, the site will generate related `